1X509_STORE_ADD_CERT(3ossl)          OpenSSL         X509_STORE_ADD_CERT(3ossl)
2
3
4

NAME

6       X509_STORE, X509_STORE_add_cert, X509_STORE_add_crl,
7       X509_STORE_set_depth, X509_STORE_set_flags, X509_STORE_set_purpose,
8       X509_STORE_set_trust, X509_STORE_add_lookup, X509_STORE_load_file_ex,
9       X509_STORE_load_file, X509_STORE_load_path, X509_STORE_load_store_ex,
10       X509_STORE_load_store, X509_STORE_set_default_paths_ex,
11       X509_STORE_set_default_paths, X509_STORE_load_locations_ex,
12       X509_STORE_load_locations - X509_STORE manipulation
13

SYNOPSIS

15        #include <openssl/x509_vfy.h>
16
17        typedef x509_store_st X509_STORE;
18
19        int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
20        int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
21        int X509_STORE_set_depth(X509_STORE *store, int depth);
22        int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
23        int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
24        int X509_STORE_set_trust(X509_STORE *ctx, int trust);
25
26        X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *store,
27                                           X509_LOOKUP_METHOD *meth);
28
29        int X509_STORE_set_default_paths_ex(X509_STORE *ctx, OSSL_LIB_CTX *libctx,
30                                            const char *propq);
31        int X509_STORE_set_default_paths(X509_STORE *ctx);
32        int X509_STORE_load_file_ex(X509_STORE *ctx, const char *file,
33                                    OSSL_LIB_CTX *libctx, const char *propq);
34        int X509_STORE_load_file(X509_STORE *ctx, const char *file);
35        int X509_STORE_load_path(X509_STORE *ctx, const char *dir);
36        int X509_STORE_load_store_ex(X509_STORE *ctx, const char *uri,
37                                     OSSL_LIB_CTX *libctx, const char *propq);
38        int X509_STORE_load_store(X509_STORE *ctx, const char *uri);
39        int X509_STORE_load_locations_ex(X509_STORE *ctx, const char *file,
40                                         const char *dir, OSSL_LIB_CTX *libctx,
41                                         const char *propq);
42        int X509_STORE_load_locations(X509_STORE *ctx,
43                                      const char *file, const char *dir);
44

DESCRIPTION

46       The X509_STORE structure is intended to be a consolidated mechanism for
47       holding information about X.509 certificates and CRLs, and constructing
48       and validating chains of certificates terminating in trusted roots.  It
49       admits multiple lookup mechanisms and efficient scaling performance
50       with large numbers of certificates, and a great deal of flexibility in
51       how validation and policy checks are performed.
52
53       Details of the chain building and checking process are described in
54       "Certification Path Building" in openssl-verification-options(1) and
55       "Certification Path Validation" in openssl-verification-options(1).
56
57       X509_STORE_new(3) creates an empty X509_STORE structure, which contains
58       no information about trusted certificates or where such certificates
59       are located on disk, and is generally not usable.  Normally, trusted
60       certificates will be added to the X509_STORE to prepare it for use, via
61       mechanisms such as X509_STORE_add_lookup() and X509_LOOKUP_file(), or
62       PEM_read_bio_X509_AUX() and X509_STORE_add_cert().  CRLs can also be
63       added, and many behaviors configured as desired.
64
65       Once the X509_STORE is suitably configured, X509_STORE_CTX_new() is
66       used to instantiate a single-use X509_STORE_CTX for each chain-building
67       and verification operation.  That process includes providing the end-
68       entity certificate to be verified and an additional set of untrusted
69       certificates that may be used in chain-building.  As such, it is
70       expected that the certificates included in the X509_STORE are
71       certificates that represent trusted entities such as root certificate
72       authorities (CAs).  OpenSSL represents these trusted certificates
73       internally as X509 objects with an associated X509_CERT_AUX, as are
74       produced by PEM_read_bio_X509_AUX() and similar routines that refer to
75       X509_AUX.  The public interfaces that operate on such trusted
76       certificates still operate on pointers to X509 objects, though.
77
78       X509_STORE_add_cert() and X509_STORE_add_crl() add the respective
79       object to the X509_STORE's local storage.  Untrusted objects should not
80       be added in this way.  The added object's reference count is
81       incremented by one, hence the caller retains ownership of the object
82       and needs to free it when it is no longer needed.
83
84       X509_STORE_set_depth(), X509_STORE_set_flags(),
85       X509_STORE_set_purpose(), X509_STORE_set_trust(), and
86       X509_STORE_set1_param() set the default values for the corresponding
87       values used in certificate chain validation.  Their behavior is
88       documented in the corresponding X509_VERIFY_PARAM manual pages, e.g.,
89       X509_VERIFY_PARAM_set_depth(3).
90
91       X509_STORE_add_lookup() finds or creates a X509_LOOKUP(3) with the
92       X509_LOOKUP_METHOD(3) meth and adds it to the X509_STORE store.  This
93       also associates the X509_STORE with the lookup, so X509_LOOKUP
94       functions can look up objects in that store.
95
96       X509_STORE_load_file_ex() loads trusted certificate(s) into an
97       X509_STORE from a given file. The library context libctx and property
98       query propq are used when fetching algorithms from providers.
99
100       X509_STORE_load_file() is similar to X509_STORE_load_file_ex() but uses
101       NULL for the library context libctx and property query propq.
102
103       X509_STORE_load_path() loads trusted certificate(s) into an X509_STORE
104       from a given directory path.  The certificates in the directory must be
105       in hashed form, as documented in X509_LOOKUP_hash_dir(3).
106
107       X509_STORE_load_store_ex() loads trusted certificate(s) into an
108       X509_STORE from a store at a given URI. The library context libctx and
109       property query propq are used when fetching algorithms from providers.
110
111       X509_STORE_load_store() is similar to X509_STORE_load_store_ex() but
112       uses NULL for the library context libctx and property query propq.
113
114       X509_STORE_load_locations_ex() combines X509_STORE_load_file_ex() and
115       X509_STORE_load_path() for a given file and/or directory path.  It is
116       permitted to specify just a file, just a directory, or both paths.
117
118       X509_STORE_load_locations() is similar to
119       X509_STORE_load_locations_ex() but uses NULL for the library context
120       libctx and property query propq.
121
122       X509_STORE_set_default_paths_ex() is somewhat misnamed, in that it does
123       not set what default paths should be used for loading certificates.
124       Instead, it loads certificates into the X509_STORE from the hardcoded
125       default paths. The library context libctx and property query propq are
126       used when fetching algorithms from providers.
127
128       X509_STORE_set_default_paths() is similar to
129       X509_STORE_set_default_paths_ex() but uses NULL for the library context
130       libctx and property query propq.
131

RETURN VALUES

133       X509_STORE_add_cert(), X509_STORE_add_crl(), X509_STORE_set_depth(),
134       X509_STORE_set_flags(), X509_STORE_set_purpose(),
135       X509_STORE_set_trust(), X509_STORE_load_file_ex(),
136       X509_STORE_load_file(), X509_STORE_load_path(),
137       X509_STORE_load_store_ex(), X509_STORE_load_store(),
138       X509_STORE_load_locations_ex(), X509_STORE_load_locations(),
139       X509_STORE_set_default_paths_ex() and X509_STORE_set_default_paths()
140       return 1 on success or 0 on failure.
141
142       X509_STORE_add_lookup() returns the found or created X509_LOOKUP(3), or
143       NULL on error.
144

SEE ALSO

146       X509_LOOKUP_hash_dir(3).  X509_VERIFY_PARAM_set_depth(3).
147       X509_STORE_new(3), X509_STORE_get0_param(3)
148

HISTORY

150       The functions X509_STORE_set_default_paths_ex(),
151       X509_STORE_load_file_ex(), X509_STORE_load_store_ex() and
152       X509_STORE_load_locations_ex() were added in OpenSSL 3.0.
153
155       Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
156
157       Licensed under the Apache License 2.0 (the "License").  You may not use
158       this file except in compliance with the License.  You can obtain a copy
159       in the file LICENSE in the source distribution or at
160       <https://www.openssl.org/source/license.html>.
161
162
163
1643.1.1                             2023-08-31        X509_STORE_ADD_CERT(3ossl)
Impressum