---
name: "libressl-PKCS7_final"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-PKCS7_final"
---

# libressl-PKCS7\_final(3)

read data from a BIO into a ContentInfo object

## NAME

**PKCS7\_final** – read data from a BIO into a ContentInfo object

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/pkcs7.h\>**

*int*\

**PKCS7\_final**(*PKCS7 \*p7*, *BIO \*data*, *int flags*);

## DESCRIPTION

**PKCS7\_final**() reads *data* and puts it into the appropriate content field of *p7* itself or of its appropriate substructure, which can be of type *SignedData*, *EnvelopedData*, *SignedAndEnvelopedData*, *DigestedData*, or arbitrary data. The PKCS7\_dataFinal(3) manual explains which field exactly the data is put into.

The following *flags* are recognized:

- PKCS7\_BINARY

  Copy the data verbatim without changing any bytes. By default, line endings are replaced with two-byte "\\r\\n" sequences (ASCII CR+LF). If this flag is set, PKCS7\_TEXT is ignored.

- PKCS7\_TEXT

  Prepend "Content-Type: text/plain" followed by a blank line to the data. This flag is ignored if PKCS7\_BINARY is also set.

If any other bits are set in *flags*, for example PKCS7\_STREAM or PKCS7\_PARTIAL, they are ignored, allowing to pass the same *flags* argument that was already passed to PKCS7\_sign(3) or PKCS7\_encrypt(3).

**PKCS7\_final**() is most commonly used to finalize a *p7* object returned from a call to PKCS7\_sign(3) that used *flags* including PKCS7\_PARTIAL or PKCS7\_STREAM. With these flags, PKCS7\_sign(3) ignores its *data* argument. The partial *p7* object returned can then be customized, for example setting up multiple signers or non-default digest algorithms with PKCS7\_sign\_add\_signer(3), before calling **PKCS7\_final**().

Similarly, **PKCS7\_final**() can be used to finalize a *p7* object returned from a call to PKCS7\_encrypt(3) that used *flags* including PKCS7\_STREAM.

Since **PKCS7\_final**() starts by calling PKCS7\_dataInit(3) internally, using it to finalize a *p7* object containing *SignedAndEnvelopedData*, *DigestedData*, or arbitrary data requires the setup described in the PKCS7\_dataInit(3) manual. For *SignedData* and *EnvelopedData*, such manual setup is also feasible, but it is more easily performed with PKCS7\_sign(3) or PKCS7\_encrypt(3), respectively.

**PKCS7\_final**() is only one among several functions that can be used to finalize *p7*; alternatives include SMIME\_write\_PKCS7(3), PEM\_write\_bio\_PKCS7\_stream(3), and i2d\_PKCS7\_bio\_stream(3).

## RETURN VALUES

**PKCS7\_final**() returns 1 on success or 0 on failure.

Possible reasons for failure include:

- *p7* is NULL.

- The *content* field of *p7* is empty.

- The *contentType* of *p7* is unsupported.

- Signing or digesting is requested and *p7* is not configured to store a detached signature, but does not contain the required field to store the content either.

- At least one signer lacks a usable digest algorithm.

- A cipher is required but none is configured.

- Any required operation fails, for example signing or digesting.

- Memory allocation fails.

Signers lacking private keys do not cause failure but are silently skipped.

## SEE ALSO

BIO\_new(3), i2d\_PKCS7\_bio\_stream(3), PEM\_write\_bio\_PKCS7\_stream(3), PKCS7\_add\_attribute(3), PKCS7\_dataFinal(3), PKCS7\_dataInit(3), PKCS7\_encrypt(3), PKCS7\_new(3), PKCS7\_sign(3), SMIME\_write\_PKCS7(3)

## HISTORY

**PKCS7\_final**() first appeared in OpenSSL 1.0.0 and has been available since OpenBSD 4.9.

## CAVEATS

This function does not support *EncryptedData*.