1.\" $OpenBSD: X509_STORE_CTX_new.3,v 1.5 2017/01/07 03:01:44 schwarze Exp $ 2.\" OpenSSL 186bb907 Apr 13 11:05:13 2015 -0700 3.\" 4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>. 5.\" Copyright (c) 2009, 2015 The OpenSSL Project. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in 16.\" the documentation and/or other materials provided with the 17.\" distribution. 18.\" 19.\" 3. All advertising materials mentioning features or use of this 20.\" software must display the following acknowledgment: 21.\" "This product includes software developed by the OpenSSL Project 22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 23.\" 24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 25.\" endorse or promote products derived from this software without 26.\" prior written permission. For written permission, please contact 27.\" openssl-core@openssl.org. 28.\" 29.\" 5. Products derived from this software may not be called "OpenSSL" 30.\" nor may "OpenSSL" appear in their names without prior written 31.\" permission of the OpenSSL Project. 32.\" 33.\" 6. Redistributions of any form whatsoever must retain the following 34.\" acknowledgment: 35.\" "This product includes software developed by the OpenSSL Project 36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)" 37.\" 38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 49.\" OF THE POSSIBILITY OF SUCH DAMAGE. 50.\" 51.Dd $Mdocdate: January 7 2017 $ 52.Dt X509_STORE_CTX_NEW 3 53.Os 54.Sh NAME 55.Nm X509_STORE_CTX_new , 56.Nm X509_STORE_CTX_cleanup , 57.Nm X509_STORE_CTX_free , 58.Nm X509_STORE_CTX_init , 59.Nm X509_STORE_CTX_trusted_stack , 60.Nm X509_STORE_CTX_set_cert , 61.Nm X509_STORE_CTX_set_chain , 62.Nm X509_STORE_CTX_set0_crls , 63.Nm X509_STORE_CTX_get0_param , 64.Nm X509_STORE_CTX_set0_param , 65.Nm X509_STORE_CTX_set_default 66.Nd X509_STORE_CTX initialisation 67.Sh SYNOPSIS 68.In openssl/x509_vfy.h 69.Ft X509_STORE_CTX * 70.Fn X509_STORE_CTX_new void 71.Ft void 72.Fo X509_STORE_CTX_cleanup 73.Fa "X509_STORE_CTX *ctx" 74.Fc 75.Ft void 76.Fo X509_STORE_CTX_free 77.Fa "X509_STORE_CTX *ctx" 78.Fc 79.Ft int 80.Fo X509_STORE_CTX_init 81.Fa "X509_STORE_CTX *ctx" 82.Fa "X509_STORE *store" 83.Fa "X509 *x509" 84.Fa "STACK_OF(X509) *chain" 85.Fc 86.Ft void 87.Fo X509_STORE_CTX_trusted_stack 88.Fa "X509_STORE_CTX *ctx" 89.Fa "STACK_OF(X509) *sk" 90.Fc 91.Ft void 92.Fo X509_STORE_CTX_set_cert 93.Fa "X509_STORE_CTX *ctx" 94.Fa "X509 *x" 95.Fc 96.Ft void 97.Fo X509_STORE_CTX_set_chain 98.Fa "X509_STORE_CTX *ctx" 99.Fa "STACK_OF(X509) *sk" 100.Fc 101.Ft void 102.Fo X509_STORE_CTX_set0_crls 103.Fa "X509_STORE_CTX *ctx" 104.Fa "STACK_OF(X509_CRL) *sk" 105.Fc 106.Ft X509_VERIFY_PARAM * 107.Fo X509_STORE_CTX_get0_param 108.Fa "X509_STORE_CTX *ctx" 109.Fc 110.Ft void 111.Fo X509_STORE_CTX_set0_param 112.Fa "X509_STORE_CTX *ctx" 113.Fa "X509_VERIFY_PARAM *param" 114.Fc 115.Ft int 116.Fo X509_STORE_CTX_set_default 117.Fa "X509_STORE_CTX *ctx" 118.Fa "const char *name" 119.Fc 120.Sh DESCRIPTION 121These functions initialise an 122.Vt X509_STORE_CTX 123structure for subsequent use by 124.Xr X509_verify_cert 3 . 125.Pp 126.Fn X509_STORE_CTX_new 127returns a newly initialised 128.Vt X509_STORE_CTX 129structure. 130.Pp 131.Fn X509_STORE_CTX_cleanup 132internally cleans up an 133.Vt X509_STORE_CTX 134structure. 135The context can then be reused with a new call to 136.Fn X509_STORE_CTX_init . 137.Pp 138.Fn X509_STORE_CTX_free 139completely frees up 140.Fa ctx . 141After this call 142.Fa ctx 143is no longer valid. 144If 145.Fa ctx 146is a 147.Dv NULL 148pointer, no action occurs. 149.Pp 150.Fn X509_STORE_CTX_init 151sets up 152.Fa ctx 153for a subsequent verification operation. 154The trusted certificate store is set to 155.Fa store , 156the end entity certificate to be verified is set to 157.Fa x509 158and a set of additional certificates (which will be untrusted but may be 159used to build the chain) in 160.Fa chain . 161Any or all of the 162.Fa store , 163.Fa x509 , 164and 165.Fa chain 166parameters can be 167.Dv NULL . 168.Pp 169.Fn X509_STORE_CTX_trusted_stack 170sets the set of trusted certificates of 171.Fa ctx 172to 173.Fa sk . 174This is an alternative way of specifying trusted certificates instead of 175using an 176.Vt X509_STORE . 177.Pp 178.Fn X509_STORE_CTX_set_cert 179sets the certificate to be verified in 180.Fa ctx 181to 182.Fa x . 183.Pp 184.Fn X509_STORE_CTX_set_chain 185sets the additional certificate chain used by 186.Fa ctx 187to 188.Fa sk . 189.Pp 190.Fn X509_STORE_CTX_set0_crls 191sets a set of CRLs to use to aid certificate verification to 192.Fa sk . 193These CRLs will only be used if CRL verification is enabled in the 194associated 195.Vt X509_VERIFY_PARAM 196structure. 197This might be used where additional "useful" CRLs are supplied as part 198of a protocol, for example in a PKCS#7 structure. 199.Pp 200.Fn X509_STORE_CTX_get0_param 201retrieves an internal pointer to the verification parameters associated 202with 203.Fa ctx . 204.Pp 205.Fn X509_STORE_CTX_set0_param 206sets the internal verification parameter pointer to 207.Fa param . 208After this call 209.Fa param 210should not be used. 211.Pp 212.Fn X509_STORE_CTX_set_default 213looks up and sets the default verification method to 214.Fa name . 215This uses the function 216.Fn X509_VERIFY_PARAM_lookup 217to find an appropriate set of parameters from 218.Fa name . 219.Pp 220The certificates and CRLs in a store are used internally and should 221.Sy not 222be freed up until after the associated 223.Vt X509_STORE_CTX 224is freed. 225Legacy applications might implicitly use an 226.Vt X509_STORE_CTX 227like this: 228.Bd -literal -offset indent 229X509_STORE_CTX ctx; 230X509_STORE_CTX_init(&ctx, store, cert, chain); 231.Ed 232.Pp 233This is 234.Sy not 235recommended in new applications. 236They should instead do: 237.Bd -literal -offset indent 238X509_STORE_CTX *ctx; 239ctx = X509_STORE_CTX_new(); 240if (ctx == NULL) 241 /* Bad error */ 242X509_STORE_CTX_init(ctx, store, cert, chain); 243.Ed 244.Sh RETURN VALUES 245.Fn X509_STORE_CTX_new 246returns a newly allocated context or 247.Dv NULL 248if an error occurred. 249.Pp 250.Fn X509_STORE_CTX_init 251returns 1 for success or 0 if an error occurred. 252.Pp 253.Fn X509_STORE_CTX_get0_param 254returns a pointer to an 255.Vt X509_VERIFY_PARAM 256structure or 257.Dv NULL 258if an error occurred. 259.Pp 260.Fn X509_STORE_CTX_cleanup , 261.Fn X509_STORE_CTX_free , 262.Fn X509_STORE_CTX_trusted_stack , 263.Fn X509_STORE_CTX_set_cert , 264.Fn X509_STORE_CTX_set_chain , 265.Fn X509_STORE_CTX_set0_crls , 266and 267.Fn X509_STORE_CTX_set0_param 268do not return values. 269.Pp 270.Fn X509_STORE_CTX_set_default 271returns 1 for success or 0 if an error occurred. 272.Sh SEE ALSO 273.Xr X509_verify_cert 3 , 274.Xr X509_VERIFY_PARAM_set_flags 3 275.Sh HISTORY 276.Fn X509_STORE_CTX_set0_crls 277was first added to OpenSSL 1.0.0. 278.Sh BUGS 279The certificates and CRLs in a context are used internally and should 280.Sy not 281be freed up until after the associated 282.Vt X509_STORE_CTX 283is freed. 284Copies should be made or reference counts increased instead. 285