---
name: "libressl-SMIME_write_PKCS7"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SMIME_write_PKCS7"
---

# libressl-SMIME\_write\_PKCS7(3)

convert PKCS#7 structure to S/MIME format

## NAME

**SMIME\_write\_PKCS7** – convert PKCS#7 structure to S/MIME format

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/pkcs7.h\>**

*int*\

**SMIME\_write\_PKCS7**(*BIO \*out*, *PKCS7 \*p7*, *BIO \*data*, *int flags*);

## DESCRIPTION

**SMIME\_write\_PKCS7**() generates an S/MIME message on *out* by writing MIME 1.0 headers followed by a BER- and base64-encoded serialization of *p7*. The BER encoding uses the DER format except as described for PKCS7\_STREAM below. If streaming is enabled, then the content must be supplied in the *data* argument.

The *flags* can be the logical OR of zero or more of the following bits:

- PKCS7\_DETACHED

  Use cleartext signing and generate a "multipart/signed" S/MIME message. The content is read from *data*. If *data* is a NULL pointer, this flag is ignored.

  This flag is only supported for signedData where PKCS7\_DETACHED is also set when PKCS7\_sign(3) is called.

  If PKCS7\_STREAM is not set, the data must be read twice: once to compute the signature in PKCS7\_sign(3) and once to output the S/MIME message.

  If PKCS7\_DETACHED is ignored or not specified, the smime-type is chosen according to the type of *p7*:

  - NID\_pkcs7\_enveloped

    "enveloped-data"

  - NID\_pkcs7\_signed

    - "signed-data"

      if *p7* specifies any digest algorithm

    - "certs-only"

      otherwise

  - NID\_id\_smime\_ct\_compressedData

    "compressed-data"

- PKCS7\_REUSE\_DIGEST

  Skip the calls to PKCS7\_dataInit(3) and PKCS7\_dataFinal(3). This flag has no effect unless PKCS7\_DETACHED is also set.

- PKCS7\_STREAM

  Perform streaming by reading the content from *data*. This only works if PKCS7\_DETACHED is not specified.

  This flag should only be set if PKCS7\_STREAM was also set in the previous call to PKCS7\_sign(3) or PKCS7\_encrypt(3).

  The content is output in BER format using indefinite length constructed encoding except in the case of signed data with detached content where the content is absent and DER format is used.

- PKCS7\_TEXT

  Prepend the line "Content-Type: text/plain" to the content. This only makes sense if PKCS7\_DETACHED is also set. It is ignored if the flag SMIME\_BINARY is also set.

- SMIME\_BINARY

  If specified, this flag is passed through to SMIME\_crlf\_copy(3).

- SMIME\_CRLFEOL

  End MIME header lines with pairs of carriage return and newline characters. By default, no carriage return characters are written and header lines are ended with newline characters only.

- SMIME\_OLDMIME

  If this bit is set in the *flags* argument, "application/pkcs7-mime" or "application/pkcs7-signature" is used in Content-Type headers. Otherwise, "application/x-pkcs7-mime" or "application/x-pkcs7-signature" is used.

## RETURN VALUES

**SMIME\_write\_PKCS7**() is intended to return 1 on success or 0 on failure.

## SEE ALSO

BIO\_f\_base64(3), BIO\_new(3), i2d\_PKCS7\_bio\_stream(3), PEM\_write\_bio\_PKCS7\_stream(3), PEM\_write\_PKCS7(3), PKCS7\_final(3), PKCS7\_new(3), SMIME\_crlf\_copy(3), SMIME\_read\_PKCS7(3), SMIME\_write\_CMS(3)

## HISTORY

**SMIME\_write\_PKCS7**() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.

## BUGS

**SMIME\_write\_PKCS7**() ignores most errors and is likely to return 1 even after producing corrupt or incomplete output.

**SMIME\_write\_PKCS7**() always base64 encodes PKCS#7 structures. There should be an option to disable this.