PKCS12_NEWPASS(3) | Library Functions Manual | PKCS12_NEWPASS(3)

# NAME

`PKCS12_newpass` — change the password of a PKCS#12 structure

# SYNOPSIS

library “libcrypto”
`#include <openssl/pkcs12.h>`

int
`PKCS12_newpass`(PKCS12 *p12, const char *oldpass, const char *newpass);

# DESCRIPTION

`PKCS12_newpass`() changes the password of a PKCS#12 structure.

p12 is a pointer to a PKCS#12 structure. oldpass is the existing password and newpass is the new password.

If the PKCS#12 structure does not have a password, use the empty string "" for oldpass. Passing `NULL` for oldpass results in a `PKCS12_newpass`() failure.

If the wrong password is used for oldpass, the function will fail with a MAC verification error. In rare cases, the PKCS#12 structure does not contain a MAC: in this case it will usually fail with a decryption padding error.

# RETURN VALUES

Upon successful completion, 1 is returned; otherwise 0 is returned and an error code can be retrieved with ERR_get_error(3).

# EXAMPLES

This example loads a PKCS#12 file, changes its password, and writes out the result to a new file.

    #include <stdio.h>
    #include <stdlib.h>
    #include <openssl/pem.h>
    #include <openssl/err.h>
    #include <openssl/pkcs12.h>

    int main(int argc, char **argv)
    {
    	FILE *fp;
    	PKCS12 *p12;
    	if (argc != 5) {
    		fprintf(stderr,
    		    "Usage: pkread p12file password newpass opfile\n");
    		return 1;
    	}
    	if ((fp = fopen(argv[1], "rb")) == NULL) {
    		fprintf(stderr, "Error opening file %s\n", argv[1]);
    		return 1;
    	}
    	p12 = d2i_PKCS12_fp(fp, NULL);
    	fclose(fp);
    	if (p12 == NULL) {
    		fprintf(stderr, "Error reading PKCS#12 file\n");
    		ERR_print_errors_fp(stderr);
    		return 1;
    	}
    	if (PKCS12_newpass(p12, argv[2], argv[3]) == 0) {
    		fprintf(stderr, "Error changing password\n");
    		ERR_print_errors_fp(stderr);
    		PKCS12_free(p12);
    		return 1;
    	}
    	if ((fp = fopen(argv[4], "wb")) == NULL) {
    		fprintf(stderr, "Error opening file %s\n", argv[4]);
    		PKCS12_free(p12);
    		return 1;
    	}
    	i2d_PKCS12_fp(fp, p12);
    	PKCS12_free(p12);
    	fclose(fp);
    	return 0;
    }

# SEE ALSO

PKCS12_create(3), PKCS12_new(3)

# HISTORY

`PKCS12_newpass`() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.

# BUGS

The password format is a NUL terminated ASCII string which is converted to Unicode form internally. As a result, some passwords cannot be supplied to this function.

June 8, 2025 | Debian