1X509_STORE_ADD_CERT(3) OpenSSL X509_STORE_ADD_CERT(3)
2
6 X509_STORE_add_cert, X509_STORE_add_crl, X509_STORE_set_depth,
7 X509_STORE_set_flags, X509_STORE_set_purpose, X509_STORE_set_trust,
8 X509_STORE_load_locations, X509_STORE_set_default_paths - X509_STORE
9 manipulation
10
12 #include <openssl/x509_vfy.h>
13 int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
15 int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
16 int X509_STORE_set_depth(X509_STORE *store, int depth);
17 int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
18 int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
19 int X509_STORE_set_trust(X509_STORE *ctx, int trust);
20 int X509_STORE_load_locations(X509_STORE *ctx,
22 const char *file, const char *dir);
23 int X509_STORE_set_default_paths(X509_STORE *ctx);
24
26 The X509_STORE structure is intended to be a consolidated mechanism for
27 holding information about X.509 certificates and CRLs, and constructing
28 and validating chains of certificates terminating in trusted roots. It
29 admits multiple lookup mechanisms and efficient scaling performance
30 with large numbers of certificates, and a great deal of flexibility in
31 how validation and policy checks are performed.
32 X509_STORE_new(3) creates an empty X509_STORE structure, which contains
34 no information about trusted certificates or where such certificates
35 are located on disk, and is generally not usable. Normally, trusted
36 certificates will be added to the X509_STORE to prepare it for use, via
37 mechanisms such as X509_STORE_add_lookup() and X509_LOOKUP_file(), or
38 PEM_read_bio_X509_AUX() and X509_STORE_add_cert(). CRLs can also be
39 added, and many behaviors configured as desired.
40 Once the X509_STORE is suitably configured, X509_STORE_CTX_new() is
42 used to instantiate a single-use X509_STORE_CTX for each chain-building
43 and verification operation. That process includes providing the end-
44 entity certificate to be verified and an additional set of untrusted
45 certificates that may be used in chain-building. As such, it is
46 expected that the certificates included in the X509_STORE are
47 certificates that represent trusted entities such as root certificate
48 authorities (CAs). OpenSSL represents these trusted certificates
49 internally as X509 objects with an associated X509_CERT_AUX, as are
50 produced by PEM_read_bio_X509_AUX() and similar routines that refer to
51 X509_AUX. The public interfaces that operate on such trusted
52 certificates still operate on pointers to X509 objects, though.
53 X509_STORE_add_cert() and X509_STORE_add_crl() add the respective
55 object to the X509_STORE's local storage. Untrusted objects should not
56 be added in this way.
57 X509_STORE_set_depth(), X509_STORE_set_flags(),
59 X509_STORE_set_purpose(), X509_STORE_set_trust(), and
60 X509_STORE_set1_param() set the default values for the corresponding
61 values used in certificate chain validation. Their behavior is
62 documented in the corresponding X509_VERIFY_PARAM manual pages, e.g.,
63 X509_VERIFY_PARAM_set_depth(3).
64 X509_STORE_load_locations() loads trusted certificate(s) into an
66 X509_STORE from a given file and/or directory path. It is permitted to
67 specify just a file, just a directory, or both paths. The certificates
68 in the directory must be in hashed form, as documented in
69 X509_LOOKUP_hash_dir(3).
70 X509_STORE_set_default_paths() is somewhat misnamed, in that it does
72 not set what default paths should be used for loading certificates.
73 Instead, it loads certificates into the X509_STORE from the hardcoded
74 default paths.
75
77 X509_STORE_add_cert(), X509_STORE_add_crl(), X509_STORE_set_depth(),
78 X509_STORE_set_flags(), X509_STORE_set_purpose(),
79 X509_STORE_set_trust(), X509_STORE_load_locations(), and
80 X509_STORE_set_default_paths() return 1 on success or 0 on failure.
81
83 X509_LOOKUP_hash_dir(3). X509_VERIFY_PARAM_set_depth(3).
84 X509_STORE_new(3), X509_STORE_get0_param(3)
85
87 Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
88 Licensed under the OpenSSL license (the "License"). You may not use
90 this file except in compliance with the License. You can obtain a copy
91 in the file LICENSE in the source distribution or at
92 <https://www.openssl.org/source/license.html>.
931.1.1c 2019-05-28 X509_STORE_ADD_CERT(3)