---
name: "libressl-PKCS7_decrypt"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-PKCS7_decrypt"
---

# libressl-PKCS7\_decrypt(3)

decrypt content from a PKCS#7 envelopedData structure

## NAME

**PKCS7\_decrypt** – decrypt content from a PKCS#7 envelopedData structure

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/pkcs7.h\>**

*int*\

**PKCS7\_decrypt**(*PKCS7 \*p7*, *EVP\_PKEY \*pkey*, *X509 \*cert*, *BIO \*data*, *int flags*);

## DESCRIPTION

**PKCS7\_decrypt**() extracts and decrypts the content from a PKCS#7 envelopedData structure. *pkey* is the private key of the recipient, *cert* is the recipient's certificate, *data* is a *BIO* to write the content to and *flags* is an optional set of flags.

Although the recipient's certificate is not needed to decrypt the data, it is needed to locate the appropriate recipients in the PKCS#7 structure.

If the PKCS7\_TEXT *flag* is set, MIME headers for type **text/plain** are deleted from the content. If the content is not of type **text/plain**, an error is returned.

## RETURN VALUES

**PKCS7\_decrypt**() returns 1 for success or 0 for failure.

The error can be obtained from ERR\_get\_error(3).

## SEE ALSO

PKCS7\_encrypt(3), PKCS7\_new(3), PKCS7\_verify(3)

## HISTORY

**PKCS7\_decrypt**() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.

## BUGS

**PKCS7\_decrypt**() must be passed the correct recipient key and certificate. It would be better if it could look up the correct key and certificate from a database.

The lack of single pass processing and need to hold all data in memory as mentioned in PKCS7\_sign(3) also applies to **PKCS7\_decrypt**().