Index: trunk/src/VBox/Runtime/common/crypto/iprt-openssl.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/iprt-openssl.cpp	(revision 84211)
+++ trunk/src/VBox/Runtime/common/crypto/iprt-openssl.cpp	(revision 84230)
@@ -34,4 +34,6 @@
 # include <iprt/err.h>
 # include <iprt/string.h>
+# include <iprt/mem.h>
+# include <iprt/asn1.h>
 
 # include "internal/iprt-openssl.h"
@@ -64,11 +66,72 @@
 
 
-DECLHIDDEN(int) rtCrOpenSslAddX509CertToStack(void *pvOsslStack, PCRTCRX509CERTIFICATE pCert)
+DECLHIDDEN(int) rtCrOpenSslConvertX509Cert(void **ppvOsslCert, PCRTCRX509CERTIFICATE pCert, PRTERRINFO pErrInfo)
 {
-    int                  rc;
-    const unsigned char *pabEncoded = (const unsigned char *)RTASN1CORE_GET_RAW_ASN1_PTR(&pCert->SeqCore.Asn1Core);
-    uint32_t             cbEncoded  = RTASN1CORE_GET_RAW_ASN1_SIZE(&pCert->SeqCore.Asn1Core);
-    X509                *pOsslCert  = NULL;
-    if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
+    const unsigned char *pabEncoded;
+
+    /*
+     * ASSUME that if the certificate has data pointers, it's been parsed out
+     * of a binary blob and we can safely access that here.
+     */
+    if (pCert->SeqCore.Asn1Core.uData.pv)
+    {
+        pabEncoded = (const unsigned char *)RTASN1CORE_GET_RAW_ASN1_PTR(&pCert->SeqCore.Asn1Core);
+        uint32_t cbEncoded  = RTASN1CORE_GET_RAW_ASN1_SIZE(&pCert->SeqCore.Asn1Core);
+        X509    *pOsslCert  = NULL;
+        if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
+        {
+            *ppvOsslCert = pOsslCert;
+            return VINF_SUCCESS;
+        }
+    }
+    /*
+     * Otherwise, we'll have to encode it into a temporary buffer that openssl
+     * can decode into its structures.
+     */
+    else
+    {
+        PRTASN1CORE pNonConstCore = (PRTASN1CORE)&pCert->SeqCore.Asn1Core;
+        uint32_t    cbEncoded     = 0;
+        int rc = RTAsn1EncodePrepare(pNonConstCore, RTASN1ENCODE_F_DER, &cbEncoded, pErrInfo);
+        AssertRCReturn(rc, rc);
+
+        void * const pvEncoded = RTMemTmpAllocZ(cbEncoded);
+        AssertReturn(pvEncoded, VERR_NO_TMP_MEMORY);
+
+        rc = RTAsn1EncodeToBuffer(pNonConstCore, RTASN1ENCODE_F_DER, pvEncoded, cbEncoded, pErrInfo);
+        if (RT_SUCCESS(rc))
+        {
+            pabEncoded = (const unsigned char *)pvEncoded;
+            X509 *pOsslCert = NULL;
+            if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
+            {
+                *ppvOsslCert = pOsslCert;
+                RTMemTmpFree(pvEncoded);
+                return VINF_SUCCESS;
+            }
+        }
+        else
+        {
+            RTMemTmpFree(pvEncoded);
+            return rc;
+        }
+    }
+
+    *ppvOsslCert = NULL;
+    return RTErrInfoSet(pErrInfo, VERR_CR_X509_OSSL_D2I_FAILED, "d2i_X509");
+}
+
+
+DECLHIDDEN(void) rtCrOpenSslFreeConvertedX509Cert(void *pvOsslCert)
+{
+    X509_free((X509 *)pvOsslCert);
+}
+
+
+DECLHIDDEN(int) rtCrOpenSslAddX509CertToStack(void *pvOsslStack, PCRTCRX509CERTIFICATE pCert, PRTERRINFO pErrInfo)
+{
+    X509 *pOsslCert = NULL;
+    int rc = rtCrOpenSslConvertX509Cert((void **)&pOsslCert, pCert, pErrInfo);
+    if (RT_SUCCESS(rc))
     {
         if (sk_X509_push((STACK_OF(X509) *)pvOsslStack, pOsslCert))
@@ -76,10 +139,8 @@
         else
         {
-            rc = VERR_NO_MEMORY;
-            X509_free(pOsslCert);
+            rtCrOpenSslFreeConvertedX509Cert(pOsslCert);
+            rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "sk_X509_push");
         }
     }
-    else
-        rc = VERR_CR_X509_OSSL_D2I_FAILED;
     return rc;
 }
Index: trunk/src/VBox/Runtime/common/crypto/key-openssl.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/key-openssl.cpp	(revision 84211)
+++ trunk/src/VBox/Runtime/common/crypto/key-openssl.cpp	(revision 84230)
@@ -60,6 +60,66 @@
  * @param   pErrInfo        Where to optionally return more error details.
  */
-DECLHIDDEN(int) rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
-                                    void /*EVP_PKEY*/ **ppEvpKey, const void /*EVP_MD*/ **ppEvpMdType, PRTERRINFO pErrInfo)
+DECLHIDDEN(int) rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, void /*EVP_PKEY*/ **ppEvpKey, PRTERRINFO pErrInfo)
+{
+    *ppEvpKey = NULL;
+    AssertReturn(hKey->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
+    AssertReturn(fNeedPublic == !(hKey->fFlags & RTCRKEYINT_F_PRIVATE), VERR_WRONG_TYPE);
+
+    rtCrOpenSslInit();
+
+    /*
+     * Translate the key type from IPRT to EVP speak.
+     */
+    int         idKeyType;
+    switch (hKey->enmType)
+    {
+        case RTCRKEYTYPE_RSA_PRIVATE:
+        case RTCRKEYTYPE_RSA_PUBLIC:
+            idKeyType = EVP_PKEY_RSA;
+            break;
+        default:
+            return RTErrInfoSetF(pErrInfo, VERR_NOT_SUPPORTED, "Unsupported key type: %d", hKey->enmType);
+    }
+
+    /*
+     * Allocate a new key structure and set its type.
+     */
+    EVP_PKEY *pEvpNewKey = EVP_PKEY_new();
+    if (!pEvpNewKey)
+        return RTErrInfoSetF(pErrInfo, VERR_NO_MEMORY, "EVP_PKEY_new/%d failed", idKeyType);
+
+    /*
+     * Load the key into the structure.
+     */
+    const unsigned char *puchPublicKey = hKey->pbEncoded;
+    EVP_PKEY *pRet;
+    if (fNeedPublic)
+        *ppEvpKey = pRet = d2i_PublicKey(idKeyType, &pEvpNewKey, &puchPublicKey, hKey->cbEncoded);
+    else
+        *ppEvpKey = pRet = d2i_PrivateKey(idKeyType, &pEvpNewKey, &puchPublicKey, hKey->cbEncoded);
+    if (pRet)
+        return VINF_SUCCESS;
+
+    /* Bail out: */
+    EVP_PKEY_free(pEvpNewKey);
+    return RTErrInfoSet(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PUBLIC_KEY_FAILED,
+                        fNeedPublic ? "d2i_PublicKey failed" : "d2i_PrivateKey failed");
+}
+
+
+/**
+ * Creates an OpenSSL key for the given IPRT one, returning the message digest
+ * algorithm if desired.
+ *
+ * @returns IRPT status code.
+ * @param   hKey            The key to convert to an OpenSSL key.
+ * @param   fNeedPublic     Set if we need the public side of the key.
+ * @param   pszAlgoObjId    Alogrithm stuff we currently need.
+ * @param   ppEvpKey        Where to return the pointer to the key structure.
+ * @param   ppEvpMdType     Where to optionally return the message digest type.
+ * @param   pErrInfo        Where to optionally return more error details.
+ */
+DECLHIDDEN(int) rtCrKeyToOpenSslKeyEx(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
+                                      void /*EVP_PKEY*/ **ppEvpKey, const void /*EVP_MD*/ **ppEvpMdType, PRTERRINFO pErrInfo)
 {
     *ppEvpKey = NULL;
Index: trunk/src/VBox/Runtime/common/crypto/pemfile-write.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/pemfile-write.cpp	(revision 84211)
+++ trunk/src/VBox/Runtime/common/crypto/pemfile-write.cpp	(revision 84230)
@@ -110,4 +110,24 @@
     cchRet += pfnOutput(pvUser, NULL, 0);
 
+    return cchRet;
+}
+
+
+RTDECL(ssize_t) RTCrPemWriteBlobToVfsIoStrm(RTVFSIOSTREAM hVfsIos, const void *pvContent, size_t cbContent, const char *pszMarker)
+{
+    VFSIOSTRMOUTBUF Buf;
+    VFSIOSTRMOUTBUF_INIT(&Buf, hVfsIos);
+    size_t cchRet = RTCrPemWriteBlob(RTVfsIoStrmStrOutputCallback, &Buf, pvContent, cbContent, pszMarker);
+    Assert(Buf.offBuf == 0);
+    return RT_SUCCESS(Buf.rc) ? (ssize_t)cchRet : Buf.rc;
+}
+
+
+RTDECL(ssize_t) RTCrPemWriteBlobToVfsFile(RTVFSFILE hVfsFile, const void *pvContent, size_t cbContent, const char *pszMarker)
+{
+    RTVFSIOSTREAM hVfsIos = RTVfsFileToIoStream(hVfsFile);
+    AssertReturn(hVfsIos != NIL_RTVFSIOSTREAM, VERR_INVALID_HANDLE);
+    ssize_t cchRet = RTCrPemWriteBlobToVfsIoStrm(hVfsIos, pvContent, cbContent, pszMarker);
+    RTVfsIoStrmRelease(hVfsIos);
     return cchRet;
 }
@@ -236,2 +256,3 @@
 }
 
+
Index: trunk/src/VBox/Runtime/common/crypto/pkcs7-sign.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/pkcs7-sign.cpp	(revision 84230)
+++ trunk/src/VBox/Runtime/common/crypto/pkcs7-sign.cpp	(revision 84230)
@@ -0,0 +1,187 @@
+/* $Id$ */
+/** @file
+ * IPRT - Crypto - PKCS \#7, Signing
+ */
+
+/*
+ * Copyright (C) 2006-2020 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#include "internal/iprt.h"
+#include <iprt/crypto/pkcs7.h>
+
+#include <iprt/err.h>
+#include <iprt/string.h>
+#include <iprt/crypto/digest.h>
+#include <iprt/crypto/key.h>
+#include <iprt/crypto/pkix.h>
+#include <iprt/crypto/store.h>
+#include <iprt/crypto/x509.h>
+
+#ifdef IPRT_WITH_OPENSSL
+# include "internal/iprt-openssl.h"
+# include <openssl/pkcs7.h>
+# include <openssl/cms.h>
+# include <openssl/x509.h>
+# include <openssl/err.h>
+#endif
+
+
+/*********************************************************************************************************************************
+*   Structures and Typedefs                                                                                                      *
+*********************************************************************************************************************************/
+/**
+ * PKCS\#7 / CMS signing operation instance.
+ */
+typedef struct RTCRPKCS7SIGNINGJOBINT
+{
+    /** Magic value (RTCRPKCS7SIGNINGJOBINT).  */
+    uint32_t                u32Magic;
+    /** Reference counter. */
+    uint32_t volatile       cRefs;
+    /** RTCRPKCS7SIGN_F_XXX. */
+    uint64_t                fFlags;
+    /** Set if finalized. */
+    bool                    fFinallized;
+
+    //....
+} RTCRPKCS7SIGNINGJOBINT;
+
+/** Magic value for RTCRPKCS7SIGNINGJOBINT (Jonathan Lethem). */
+#define RTCRPKCS7SIGNINGJOBINT_MAGIC    UINT32_C(0x19640219)
+
+/** Handle to PKCS\#7/CMS signing operation. */
+typedef struct RTCRPKCS7SIGNINGJOBINT *RTCRPKCS7SIGNINGJOB;
+/** Pointer to a PKCS\#7/CMS signing operation handle. */
+typedef RTCRPKCS7SIGNINGJOB *PRTCRPKCS7SIGNINGJOB;
+
+//// CMS_sign
+//RTDECL(int) RTCrPkcs7Sign(PRTCRPKCS7SIGNINGJOB *phJob, uint64_t fFlags, PCRTCRX509CERTIFICATE pSigner, RTCRKEY hPrivateKey,
+//                          RTCRSTORE hAdditionalCerts,
+//
+
+
+
+RTDECL(int) RTCrPkcs7SimpleSignSignedData(uint32_t fFlags, PCRTCRX509CERTIFICATE pSigner, RTCRKEY hPrivateKey,
+                                          void const *pvData, size_t cbData, RTCRSTORE hAdditionalCerts,
+                                          void *pvResult, size_t *pcbResult, PRTERRINFO pErrInfo)
+{
+    size_t const cbResultBuf = *pcbResult;
+    *pcbResult = 0;
+    AssertReturn(!(fFlags & ~RTCRPKCS7SIGN_SD_F_VALID_MASK), VERR_INVALID_FLAGS);
+#if defined(IPRT_WITH_OPENSSL) && (OPENSSL_VERSION_NUMBER > 0x10000000L) /* 0.9.8 doesn't seem to have EVP_PKEY_CTX_set_signature_md. */
+    AssertReturn((int)cbData >= 0 && (unsigned)cbData == cbData, VERR_TOO_MUCH_DATA);
+
+    /*
+     * Convert the private key.
+     */
+    EVP_PKEY *pEvpPrivateKey = NULL;
+    int rc = rtCrKeyToOpenSslKey(hPrivateKey, false /*fNeedPublic*/, (void **)&pEvpPrivateKey, pErrInfo);
+    if (RT_SUCCESS(rc))
+    {
+        /*
+         * Convert the signing certificate.
+         */
+        X509 *pOsslSigner = NULL;
+        rc = rtCrOpenSslConvertX509Cert((void **)&pOsslSigner, pSigner, pErrInfo);
+        if (RT_SUCCESS(rc))
+        {
+            /*
+             * Convert any additional certificates.
+             */
+            STACK_OF(X509) *pOsslAdditionalCerts = NULL;
+            if (hAdditionalCerts != NIL_RTCRSTORE)
+                rc = RTCrStoreConvertToOpenSslCertStack(hAdditionalCerts, 0 /*fFlags*/, (void **)&pOsslAdditionalCerts, pErrInfo);
+            if (RT_SUCCESS(rc))
+            {
+                /*
+                 * Create a BIO for the data buffer.
+                 */
+                BIO *pOsslData = BIO_new_mem_buf(pvData, (int)cbData);
+                if (pOsslData)
+                {
+                    /*
+                     * Do the signing.
+                     */
+                    unsigned int fOsslSign = CMS_BINARY;
+                    if (fFlags & RTCRPKCS7SIGN_SD_F_DEATCHED)
+                        fOsslSign |= CMS_DETACHED;
+                    if (fFlags & RTCRPKCS7SIGN_SD_F_NO_SMIME_CAP)
+                        fOsslSign |= CMS_NOSMIMECAP;
+                    CMS_ContentInfo *pCms = CMS_sign(pOsslSigner, pEvpPrivateKey, pOsslAdditionalCerts, pOsslData, fOsslSign);
+                    if (pCms)
+                    {
+                        /*
+                         * Get the output and copy it into the result buffer.
+                         */
+                        BIO *pOsslResult = BIO_new(BIO_s_mem());
+                        if (pOsslResult)
+                        {
+                            rc = i2d_CMS_bio(pOsslResult, pCms);
+                            if (rc > 0)
+                            {
+                                BUF_MEM *pBuf = NULL;
+                                rc = (int)BIO_get_mem_ptr(pOsslResult, &pBuf);
+                                if (rc > 0)
+                                {
+                                    AssertPtr(pBuf);
+                                    size_t const cbResult = pBuf->length;
+                                    if (   cbResultBuf >= cbResult
+                                        && pvResult != NULL)
+                                    {
+                                        memcpy(pvResult, pBuf->data, cbResult);
+                                        rc = VINF_SUCCESS;
+                                    }
+                                    else
+                                        rc = VERR_BUFFER_OVERFLOW;
+                                    *pcbResult = cbResult;
+                                }
+                                else
+                                    rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "BIO_get_mem_ptr");
+                            }
+                            else
+                                rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "i2d_CMS_bio");
+                            BIO_free(pOsslResult);
+                        }
+                        else
+                            rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "BIO_new/BIO_s_mem");
+                        CMS_ContentInfo_free(pCms);
+                    }
+                    else
+                        rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "CMS_sign");
+                    BIO_free(pOsslData);
+                }
+            }
+            rtCrOpenSslFreeConvertedX509Cert(pOsslSigner);
+        }
+        EVP_PKEY_free(pEvpPrivateKey);
+    }
+    return rc;
+#else
+    RT_NOREF(fFlags, pSigner, hPrivateKey, pvData, cbData, hAdditionalCerts, pvResult, pErrInfo);
+    *pcbResult = 0;
+    return VERR_NOT_IMPLEMENTED;
+#endif
+}
+
Index: trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp	(revision 84211)
+++ trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp	(revision 84230)
@@ -68,5 +68,5 @@
         STACK_OF(X509) *pAddCerts = NULL;
         if (hAdditionalCerts != NIL_RTCRSTORE)
-            rcOssl = RTCrStoreConvertToOpenSslCertStack(hAdditionalCerts, 0, (void **)&pAddCerts);
+            rcOssl = RTCrStoreConvertToOpenSslCertStack(hAdditionalCerts, 0, (void **)&pAddCerts, pErrInfo);
         else
         {
@@ -79,9 +79,9 @@
             for (uint32_t i = 0; i < pCerts->cItems; i++)
                 if (pCerts->papItems[i]->enmChoice == RTCRPKCS7CERTCHOICE_X509)
-                    rtCrOpenSslAddX509CertToStack(pAddCerts, pCerts->papItems[i]->u.pX509Cert);
+                    rtCrOpenSslAddX509CertToStack(pAddCerts, pCerts->papItems[i]->u.pX509Cert, NULL);
 
             X509_STORE *pTrustedCerts = NULL;
             if (hTrustedCerts != NIL_RTCRSTORE)
-                rcOssl = RTCrStoreConvertToOpenSslCertStore(hTrustedCerts, 0, (void **)&pTrustedCerts);
+                rcOssl = RTCrStoreConvertToOpenSslCertStore(hTrustedCerts, 0, (void **)&pTrustedCerts, pErrInfo);
             if (RT_SUCCESS(rcOssl))
             {
Index: trunk/src/VBox/Runtime/common/crypto/pkix-sign.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/pkix-sign.cpp	(revision 84211)
+++ trunk/src/VBox/Runtime/common/crypto/pkix-sign.cpp	(revision 84230)
@@ -155,6 +155,6 @@
     EVP_PKEY     *pEvpPrivateKey = NULL;
     const EVP_MD *pEvpMdType = NULL;
-    int rcOssl = rtCrKeyToOpenSslKey(hPrivateKey, false /*fNeedPublic*/, pszAlgObjId,
-                                     (void **)&pEvpPrivateKey, (const void **)&pEvpMdType, pErrInfo);
+    int rcOssl = rtCrKeyToOpenSslKeyEx(hPrivateKey, false /*fNeedPublic*/, pszAlgObjId,
+                                       (void **)&pEvpPrivateKey, (const void **)&pEvpMdType, pErrInfo);
     if (RT_SUCCESS(rcOssl))
     {
Index: trunk/src/VBox/Runtime/common/crypto/pkix-verify.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/pkix-verify.cpp	(revision 84211)
+++ trunk/src/VBox/Runtime/common/crypto/pkix-verify.cpp	(revision 84230)
@@ -116,6 +116,6 @@
     EVP_PKEY     *pEvpPublicKey = NULL;
     const EVP_MD *pEvpMdType = NULL;
-    int rcOssl = rtCrKeyToOpenSslKey(hPublicKey, true /*fNeedPublic*/, pAlgorithm->szObjId,
-                                     (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
+    int rcOssl = rtCrKeyToOpenSslKeyEx(hPublicKey, true /*fNeedPublic*/, pAlgorithm->szObjId,
+                                       (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
     if (RT_SUCCESS(rcOssl))
     {
@@ -230,6 +230,6 @@
     EVP_PKEY     *pEvpPublicKey = NULL;
     const EVP_MD *pEvpMdType = NULL;
-    int rcOssl = rtCrKeyToOpenSslKey(hPublicKey, true /*fNeedPublic*/, pszAlgObjId,
-                                     (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
+    int rcOssl = rtCrKeyToOpenSslKeyEx(hPublicKey, true /*fNeedPublic*/, pszAlgObjId,
+                                       (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
     if (RT_SUCCESS(rcOssl))
     {
Index: trunk/src/VBox/Runtime/common/crypto/store.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/store.cpp	(revision 84211)
+++ trunk/src/VBox/Runtime/common/crypto/store.cpp	(revision 84230)
@@ -318,6 +318,7 @@
  */
 
-RTDECL(int) RTCrStoreConvertToOpenSslCertStore(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStore)
-{
+RTDECL(int) RTCrStoreConvertToOpenSslCertStore(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStore, PRTERRINFO pErrInfo)
+{
+    RT_NOREF(pErrInfo);
     PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
@@ -372,6 +373,7 @@
 
 
-RTDECL(int) RTCrStoreConvertToOpenSslCertStack(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStack)
-{
+RTDECL(int) RTCrStoreConvertToOpenSslCertStack(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStack, PRTERRINFO pErrInfo)
+{
+    RT_NOREF(pErrInfo);
     PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
