creating certificate only structure -- CMS_sign

Michael Richardson mcr at
Tue May 14 16:39:16 UTC 2019

{resending, because it did not seem to make it into the archives} says:
  If signcert and pkey are NULL then a certificates only CMS structure is

I am trying to create one to return in an RFC7030 (EST) /cacerts request.
It appears that it needs to be a NID_pkcs7_signed.

a) Do I need to set any flags?
b) I assume that any certificates in the STACK_OF(X509) *certs will be included?
c) Does it have to have CMS_PARTIAL or some other flags set, and then call
   CMS_final() explicitely?

I am getting
      error:2E07F068:CMS routines:CMS_final:cms lib

(I think I am dumping the entire error stack with:
        unsigned long err = ERR_get_error();
        while(err != 0) {
            fprintf(stderr, "error: %s\n", ERR_error_string(err, NULL));
            err = ERR_get_error();

when called like:
  signcert: (nil) pkey: (nil) certs: 0x563df7fc1e30 bio: (nil), flg: 0
  (via ruby, I haven't written a C-only example yet...)

I am running with  => "OpenSSL 1.1.1-dev  xx XXX xxxx", which is really
1.1.1c with a patch to the DTLS code.

Looking at CMS_dataInit(), it looks like if the contentType is not set,
and icont is NULL, and no content was provided into the CMS structure,
that it simply runs to the end and returns NULL.  Or, it is type
pkcs7_signed, and since cont and icont are NULL, it also returns NULL.
If I had run into an error, there would be additional items on the error stack.

It appears that it needs to be a NID_pkcs7_signed, so it seems that returning
with no content is what is happening.  I try adding some data to sign, but I
get the same error.

Looking at test/cmsapitest.c, I think that probably cert only payload
creation is simply not tested/implemented.  Would I be wrong here?
I haven't looked at "openssl cms" to see if it can be built that way.

]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr at        |   ruby on rails    [

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 487 bytes
Desc: not available
URL: <>

More information about the openssl-users mailing list