---
name: "libressl-PKCS7_encrypt"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-PKCS7_encrypt"
---

# libressl-PKCS7\_encrypt(3)

create a PKCS#7 envelopedData structure

## NAME

**PKCS7\_encrypt** – create a PKCS#7 envelopedData structure

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/pkcs7.h\>**

*PKCS7* *\**\

**PKCS7\_encrypt**(*STACK\_OF(X509) \*certs*, *BIO \*in*, *const EVP\_CIPHER \*cipher*, *int flags*);

## DESCRIPTION

**PKCS7\_encrypt**() creates and returns a PKCS#7 envelopedData structure. *certs* is a list of recipient certificates. *in* is the content to be encrypted. *cipher* is the symmetric cipher to use. *flags* is an optional set of flags.

Only RSA keys are supported in PKCS#7 and envelopedData so the recipient certificates supplied to this function must all contain RSA public keys, though they do not have to be signed using the RSA algorithm.

The algorithm passed in the *cipher* parameter must support ASN.1 encoding of its parameters.

Many browsers implement a "sign and encrypt" option which is simply an S/MIME envelopedData containing an S/MIME signed message. This can be readily produced by storing the S/MIME signed message in a memory *BIO* and passing it to **PKCS7\_encrypt**().

The following flags can be passed in the *flags* parameter.

If the PKCS7\_TEXT flag is set, MIME headers for type **text/plain** are prepended to the data.

Normally the supplied content is translated into MIME canonical format (as required by the S/MIME specifications). If PKCS7\_BINARY is set, no translation occurs. This option should be used if the supplied data is in binary format; otherwise, the translation will corrupt it. If PKCS7\_BINARY is set, then PKCS7\_TEXT is ignored.

If the PKCS7\_STREAM flag is set, a partial *PKCS7* structure is output suitable for streaming I/O: no data is read from *in*.

If the flag PKCS7\_STREAM is set, the returned *PKCS7* structure is **not** complete and outputting its contents via a function that does not properly finalize the *PKCS7* structure will give unpredictable results.

Several functions including PKCS7\_final(3), SMIME\_write\_PKCS7(3), PEM\_write\_bio\_PKCS7\_stream(3), and i2d\_PKCS7\_bio\_stream(3) finalize the structure. Alternatively finalization can be performed by obtaining the streaming ASN.1 *BIO* directly using **BIO\_new\_PKCS7**().

## RETURN VALUES

**PKCS7\_encrypt**() returns either a *PKCS7* structure or NULL if an error occurred. The error can be obtained from ERR\_get\_error(3).

## SEE ALSO

PKCS7\_decrypt(3), PKCS7\_final(3), PKCS7\_new(3), PKCS7\_sign(3)

## HISTORY

**PKCS7\_encrypt**() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.

The PKCS7\_STREAM flag was first supported in OpenSSL 1.0.0.