---
name: "libressl-PKCS12_newpass"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-PKCS12_newpass"
---

# libressl-PKCS12\_newpass(3)

change the password of a PKCS#12 structure

## NAME

**PKCS12\_newpass** – change the password of a PKCS#12 structure

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/pkcs12.h\>**

*int*\

**PKCS12\_newpass**(*PKCS12 \*p12*, *const char \*oldpass*, *const char \*newpass*);

## DESCRIPTION

**PKCS12\_newpass**() changes the password of a PKCS#12 structure.

*p12* is a pointer to a PKCS#12 structure. *oldpass* is the existing password and *newpass* is the new password.

If the PKCS#12 structure does not have a password, use the empty string "" for *oldpass*. Passing NULL for *oldpass* results in a **PKCS12\_newpass**() failure.

If the wrong password is used for *oldpass*, the function will fail with a MAC verification error. In rare cases, the PKCS#12 structure does not contain a MAC: in this case it will usually fail with a decryption padding error.

## RETURN VALUES

Upon successful completion, 1 is returned; otherwise 0 is returned and an error code can be retrieved with ERR\_get\_error(3).

## EXAMPLES

This example loads a PKCS#12 file, changes its password, and writes out the result to a new file.

```
#include <stdio.h>
#include <stdlib.h>
#include <openssl/pem.h>
#include <openssl/err.h>
#include <openssl/pkcs12.h>
int main(int argc, char **argv)
{
	FILE *fp;
	PKCS12 *p12;
	if (argc != 5) {
		fprintf(stderr,
		    "Usage: pkread p12file password newpass opfile\n");
		return 1;
	}
	if ((fp = fopen(argv[1], "rb")) == NULL) {
		fprintf(stderr, "Error opening file %s\n", argv[1]);
		return 1;
	}
	p12 = d2i_PKCS12_fp(fp, NULL);
	fclose(fp);
	if (p12 == NULL) {
		fprintf(stderr, "Error reading PKCS#12 file\n");
		ERR_print_errors_fp(stderr);
		return 1;
	}
	if (PKCS12_newpass(p12, argv[2], argv[3]) == 0) {
		fprintf(stderr, "Error changing password\n");
		ERR_print_errors_fp(stderr);
		PKCS12_free(p12);
		return 1;
	}
	if ((fp = fopen(argv[4], "wb")) == NULL) {
		fprintf(stderr, "Error opening file %s\n", argv[4]);
		PKCS12_free(p12);
		return 1;
	}
	i2d_PKCS12_fp(fp, p12);
	PKCS12_free(p12);
	fclose(fp);
	return 0;
}
```

## SEE ALSO

PKCS12\_create(3), PKCS12\_new(3)

## HISTORY

**PKCS12\_newpass**() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.

## BUGS

The password format is a NUL terminated ASCII string which is converted to Unicode form internally. As a result, some passwords cannot be supplied to this function.