ASN1_ITEM_SIGN(3) | Library Functions Manual | ASN1_ITEM_SIGN(3)

# NAME

`ASN1_item_sign`, `ASN1_item_sign_ctx` — DER-encode and sign an ASN.1 value

# SYNOPSIS

library “libcrypto”
`#include <openssl/x509.h>`

int
`ASN1_item_sign`(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2, ASN1_BIT_STRING *sig_out, void *val_in, EVP_PKEY *pkey, const EVP_MD *type);

int
`ASN1_item_sign_ctx`(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2, ASN1_BIT_STRING *sig_out, void *val_in, EVP_MD_CTX *ctx);

# DESCRIPTION

`ASN1_item_sign`() assumes that val_in is an ASN1_VALUE of the type specified by it, encodes it into DER format by calling ASN1_item_i2d(3), and signs the resulting byte array in a way similar to EVP_DigestSign(3), using a signing context created with EVP_DigestSignInit(3) for the given digest type and private key pkey. The created signature is placed into the sig_out object provided by the caller, freeing and replacing any data already contained in that object.

`ASN1_item_sign_ctx`() is similar except that the provided ctx is used rather than creating a new one. No matter whether `ASN1_item_sign_ctx`() succeeds or fails, EVP_MD_CTX_cleanup(3) is called on ctx before returning.

For both functions, unless algor1 is `NULL`, its algorithm OID and parameter type are set according to the digest type used, and its parameter value is cleared. In RSA-PSS mode, the parameter value is also copied into algor1. Unless algor2 is `NULL`, the same data is copied into it.

# RETURN VALUES

These functions return the length of the signature in bytes or 0 if memory allocation, encoding, or signing fails.

`ASN1_item_sign_ctx`() also fails and returns 0 if ctx is not fully initialized.

# SEE ALSO

ASN1_BIT_STRING_new(3), ASN1_item_digest(3), ASN1_item_i2d(3), ASN1_item_verify(3), EVP_Digest(3), EVP_DigestSign(3), EVP_MD_CTX_new(3), EVP_PKEY_new(3), OBJ_find_sigid_by_algs(3), X509_ALGOR_new(3)

# HISTORY

`ASN1_item_sign`() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.1.

`ASN1_item_sign_ctx`() first appeared in OpenSSL 1.0.1 and has been available since OpenBSD 5.3.

June 8, 2025 | Debian