1=pod 2 3=head1 NAME 4 5X509_STORE_add_cert, X509_STORE_add_crl, X509_STORE_set_depth, 6X509_STORE_set_flags, X509_STORE_set_purpose, X509_STORE_set_trust, 7X509_STORE_load_locations, 8X509_STORE_set_default_paths 9- X509_STORE manipulation 10 11=head1 SYNOPSIS 12 13 #include <openssl/x509_vfy.h> 14 15 int X509_STORE_add_cert(X509_STORE *ctx, X509 *x); 16 int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x); 17 int X509_STORE_set_depth(X509_STORE *store, int depth); 18 int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags); 19 int X509_STORE_set_purpose(X509_STORE *ctx, int purpose); 20 int X509_STORE_set_trust(X509_STORE *ctx, int trust); 21 22 int X509_STORE_load_locations(X509_STORE *ctx, 23 const char *file, const char *dir); 24 int X509_STORE_set_default_paths(X509_STORE *ctx); 25 26=head1 DESCRIPTION 27 28The B<X509_STORE> structure is intended to be a consolidated mechanism for 29holding information about X.509 certificates and CRLs, and constructing 30and validating chains of certificates terminating in trusted roots. 31It admits multiple lookup mechanisms and efficient scaling performance 32with large numbers of certificates, and a great deal of flexibility in 33how validation and policy checks are performed. 34 35L<X509_STORE_new(3)> creates an empty B<X509_STORE> structure, which contains 36no information about trusted certificates or where such certificates 37are located on disk, and is generally not usable. Normally, trusted 38certificates will be added to the B<X509_STORE> to prepare it for use, 39via mechanisms such as X509_STORE_add_lookup() and X509_LOOKUP_file(), or 40PEM_read_bio_X509_AUX() and X509_STORE_add_cert(). CRLs can also be added, 41and many behaviors configured as desired. 42 43Once the B<X509_STORE> is suitably configured, X509_STORE_CTX_new() is 44used to instantiate a single-use B<X509_STORE_CTX> for each chain-building 45and verification operation. That process includes providing the end-entity 46certificate to be verified and an additional set of untrusted certificates 47that may be used in chain-building. As such, it is expected that the 48certificates included in the B<X509_STORE> are certificates that represent 49trusted entities such as root certificate authorities (CAs). 50OpenSSL represents these trusted certificates internally as B<X509> objects 51with an associated B<X509_CERT_AUX>, as are produced by 52PEM_read_bio_X509_AUX() and similar routines that refer to X509_AUX. 53The public interfaces that operate on such trusted certificates still 54operate on pointers to B<X509> objects, though. 55 56X509_STORE_add_cert() and X509_STORE_add_crl() add the respective object 57to the B<X509_STORE>'s local storage. Untrusted objects should not be 58added in this way. The added object's reference count is incremented by one, 59hence the caller retains ownership of the object and needs to free it when it 60is no longer needed. 61 62X509_STORE_set_depth(), X509_STORE_set_flags(), X509_STORE_set_purpose(), 63X509_STORE_set_trust(), and X509_STORE_set1_param() set the default values 64for the corresponding values used in certificate chain validation. Their 65behavior is documented in the corresponding B<X509_VERIFY_PARAM> manual 66pages, e.g., L<X509_VERIFY_PARAM_set_depth(3)>. 67 68X509_STORE_load_locations() loads trusted certificate(s) into an 69B<X509_STORE> from a given file and/or directory path. It is permitted 70to specify just a file, just a directory, or both paths. The certificates 71in the directory must be in hashed form, as documented in 72L<X509_LOOKUP_hash_dir(3)>. 73 74X509_STORE_set_default_paths() is somewhat misnamed, in that it does not 75set what default paths should be used for loading certificates. Instead, 76it loads certificates into the B<X509_STORE> from the hardcoded default 77paths. 78 79=head1 RETURN VALUES 80 81X509_STORE_add_cert(), X509_STORE_add_crl(), X509_STORE_set_depth(), 82X509_STORE_set_flags(), X509_STORE_set_purpose(), 83X509_STORE_set_trust(), X509_STORE_load_locations(), and 84X509_STORE_set_default_paths() return 1 on success or 0 on failure. 85 86=head1 SEE ALSO 87 88L<X509_LOOKUP_hash_dir(3)>. 89L<X509_VERIFY_PARAM_set_depth(3)>. 90L<X509_STORE_new(3)>, 91L<X509_STORE_get0_param(3)> 92 93=head1 COPYRIGHT 94 95Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. 96 97Licensed under the OpenSSL license (the "License"). You may not use 98this file except in compliance with the License. You can obtain a copy 99in the file LICENSE in the source distribution or at 100L<https://www.openssl.org/source/license.html>. 101 102=cut 103