1X509_STORE_ADD_CERT(3)              OpenSSL             X509_STORE_ADD_CERT(3)
2
3
4

NAME

6       X509_STORE, X509_STORE_add_cert, X509_STORE_add_crl,
7       X509_STORE_set_depth, X509_STORE_set_flags, X509_STORE_set_purpose,
8       X509_STORE_set_trust, X509_STORE_add_lookup, X509_STORE_load_locations,
9       X509_STORE_set_default_paths - X509_STORE manipulation
10

SYNOPSIS

12        #include <openssl/x509_vfy.h>
13
14        typedef x509_store_st X509_STORE;
15
16        int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
17        int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
18        int X509_STORE_set_depth(X509_STORE *store, int depth);
19        int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
20        int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
21        int X509_STORE_set_trust(X509_STORE *ctx, int trust);
22
23        X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *store,
24                                           X509_LOOKUP_METHOD *meth);
25
26        int X509_STORE_load_locations(X509_STORE *ctx,
27                                      const char *file, const char *dir);
28        int X509_STORE_set_default_paths(X509_STORE *ctx);
29

DESCRIPTION

31       The X509_STORE structure is intended to be a consolidated mechanism for
32       holding information about X.509 certificates and CRLs, and constructing
33       and validating chains of certificates terminating in trusted roots.  It
34       admits multiple lookup mechanisms and efficient scaling performance
35       with large numbers of certificates, and a great deal of flexibility in
36       how validation and policy checks are performed.
37
38       X509_STORE_new(3) creates an empty X509_STORE structure, which contains
39       no information about trusted certificates or where such certificates
40       are located on disk, and is generally not usable.  Normally, trusted
41       certificates will be added to the X509_STORE to prepare it for use, via
42       mechanisms such as X509_STORE_add_lookup() and X509_LOOKUP_file(), or
43       PEM_read_bio_X509_AUX() and X509_STORE_add_cert().  CRLs can also be
44       added, and many behaviors configured as desired.
45
46       Once the X509_STORE is suitably configured, X509_STORE_CTX_new() is
47       used to instantiate a single-use X509_STORE_CTX for each chain-building
48       and verification operation.  That process includes providing the end-
49       entity certificate to be verified and an additional set of untrusted
50       certificates that may be used in chain-building.  As such, it is
51       expected that the certificates included in the X509_STORE are
52       certificates that represent trusted entities such as root certificate
53       authorities (CAs).  OpenSSL represents these trusted certificates
54       internally as X509 objects with an associated X509_CERT_AUX, as are
55       produced by PEM_read_bio_X509_AUX() and similar routines that refer to
56       X509_AUX.  The public interfaces that operate on such trusted
57       certificates still operate on pointers to X509 objects, though.
58
59       X509_STORE_add_cert() and X509_STORE_add_crl() add the respective
60       object to the X509_STORE's local storage.  Untrusted objects should not
61       be added in this way.  The added object's reference count is
62       incremented by one, hence the caller retains ownership of the object
63       and needs to free it when it is no longer needed.
64
65       X509_STORE_set_depth(), X509_STORE_set_flags(),
66       X509_STORE_set_purpose(), X509_STORE_set_trust(), and
67       X509_STORE_set1_param() set the default values for the corresponding
68       values used in certificate chain validation.  Their behavior is
69       documented in the corresponding X509_VERIFY_PARAM manual pages, e.g.,
70       X509_VERIFY_PARAM_set_depth(3).
71
72       X509_STORE_add_lookup() finds or creates a X509_LOOKUP(3) with the
73       X509_LOOKUP_METHOD(3) meth and adds it to the X509_STORE store.  This
74       also associates the X509_STORE with the lookup, so X509_LOOKUP
75       functions can look up objects in that store.
76
77       X509_STORE_load_locations() loads trusted certificate(s) into an
78       X509_STORE from a given file and/or directory path.  It is permitted to
79       specify just a file, just a directory, or both paths.  The certificates
80       in the directory must be in hashed form, as documented in
81       X509_LOOKUP_hash_dir(3).
82
83       X509_STORE_set_default_paths() is somewhat misnamed, in that it does
84       not set what default paths should be used for loading certificates.
85       Instead, it loads certificates into the X509_STORE from the hardcoded
86       default paths.
87

RETURN VALUES

89       X509_STORE_add_cert(), X509_STORE_add_crl(), X509_STORE_set_depth(),
90       X509_STORE_set_flags(), X509_STORE_set_purpose(),
91       X509_STORE_set_trust(), X509_STORE_load_locations(), and
92       X509_STORE_set_default_paths() return 1 on success or 0 on failure.
93
94       X509_STORE_add_lookup() returns the found or created X509_LOOKUP(3), or
95       NULL on error.
96

SEE ALSO

98       X509_LOOKUP_hash_dir(3).  X509_VERIFY_PARAM_set_depth(3).
99       X509_STORE_new(3), X509_STORE_get0_param(3)
100
102       Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
103
104       Licensed under the OpenSSL license (the "License").  You may not use
105       this file except in compliance with the License.  You can obtain a copy
106       in the file LICENSE in the source distribution or at
107       <https://www.openssl.org/source/license.html>.
108
109
110
1111.1.1k                            2021-03-26            X509_STORE_ADD_CERT(3)
Impressum