1=pod
2
3=head1 NAME
4
5X509_STORE,
6X509_STORE_add_cert, X509_STORE_add_crl, X509_STORE_set_depth,
7X509_STORE_set_flags, X509_STORE_set_purpose, X509_STORE_set_trust,
8X509_STORE_add_lookup,
9X509_STORE_load_locations,
10X509_STORE_set_default_paths
11- X509_STORE manipulation
12
13=head1 SYNOPSIS
14
15 #include <openssl/x509_vfy.h>
16
17 typedef x509_store_st X509_STORE;
18
19 int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
20 int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
21 int X509_STORE_set_depth(X509_STORE *store, int depth);
22 int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
23 int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
24 int X509_STORE_set_trust(X509_STORE *ctx, int trust);
25
26 X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *store,
27                                    X509_LOOKUP_METHOD *meth);
28
29 int X509_STORE_load_locations(X509_STORE *ctx,
30                               const char *file, const char *dir);
31 int X509_STORE_set_default_paths(X509_STORE *ctx);
32
33=head1 DESCRIPTION
34
35The B<X509_STORE> structure is intended to be a consolidated mechanism for
36holding information about X.509 certificates and CRLs, and constructing
37and validating chains of certificates terminating in trusted roots.
38It admits multiple lookup mechanisms and efficient scaling performance
39with large numbers of certificates, and a great deal of flexibility in
40how validation and policy checks are performed.
41
42L<X509_STORE_new(3)> creates an empty B<X509_STORE> structure, which contains
43no information about trusted certificates or where such certificates
44are located on disk, and is generally not usable.  Normally, trusted
45certificates will be added to the B<X509_STORE> to prepare it for use,
46via mechanisms such as X509_STORE_add_lookup() and X509_LOOKUP_file(), or
47PEM_read_bio_X509_AUX() and X509_STORE_add_cert().  CRLs can also be added,
48and many behaviors configured as desired.
49
50Once the B<X509_STORE> is suitably configured, X509_STORE_CTX_new() is
51used to instantiate a single-use B<X509_STORE_CTX> for each chain-building
52and verification operation.  That process includes providing the end-entity
53certificate to be verified and an additional set of untrusted certificates
54that may be used in chain-building.  As such, it is expected that the
55certificates included in the B<X509_STORE> are certificates that represent
56trusted entities such as root certificate authorities (CAs).
57OpenSSL represents these trusted certificates internally as B<X509> objects
58with an associated B<X509_CERT_AUX>, as are produced by
59PEM_read_bio_X509_AUX() and similar routines that refer to X509_AUX.
60The public interfaces that operate on such trusted certificates still
61operate on pointers to B<X509> objects, though.
62
63X509_STORE_add_cert() and X509_STORE_add_crl() add the respective object
64to the B<X509_STORE>'s local storage.  Untrusted objects should not be
65added in this way.  The added object's reference count is incremented by one,
66hence the caller retains ownership of the object and needs to free it when it
67is no longer needed.
68
69X509_STORE_set_depth(), X509_STORE_set_flags(), X509_STORE_set_purpose(),
70X509_STORE_set_trust(), and X509_STORE_set1_param() set the default values
71for the corresponding values used in certificate chain validation.  Their
72behavior is documented in the corresponding B<X509_VERIFY_PARAM> manual
73pages, e.g., L<X509_VERIFY_PARAM_set_depth(3)>.
74
75X509_STORE_add_lookup() finds or creates a L<X509_LOOKUP(3)> with the
76L<X509_LOOKUP_METHOD(3)> I<meth> and adds it to the B<X509_STORE>
77I<store>.  This also associates the B<X509_STORE> with the lookup, so
78B<X509_LOOKUP> functions can look up objects in that store.
79
80X509_STORE_load_locations() loads trusted certificate(s) into an
81B<X509_STORE> from a given file and/or directory path.  It is permitted
82to specify just a file, just a directory, or both paths.  The certificates
83in the directory must be in hashed form, as documented in
84L<X509_LOOKUP_hash_dir(3)>.
85
86X509_STORE_set_default_paths() is somewhat misnamed, in that it does not
87set what default paths should be used for loading certificates.  Instead,
88it loads certificates into the B<X509_STORE> from the hardcoded default
89paths.
90
91=head1 RETURN VALUES
92
93X509_STORE_add_cert(), X509_STORE_add_crl(), X509_STORE_set_depth(),
94X509_STORE_set_flags(), X509_STORE_set_purpose(),
95X509_STORE_set_trust(), X509_STORE_load_locations(), and
96X509_STORE_set_default_paths() return 1 on success or 0 on failure.
97
98X509_STORE_add_lookup() returns the found or created
99L<X509_LOOKUP(3)>, or NULL on error.
100
101=head1 SEE ALSO
102
103L<X509_LOOKUP_hash_dir(3)>.
104L<X509_VERIFY_PARAM_set_depth(3)>.
105L<X509_STORE_new(3)>,
106L<X509_STORE_get0_param(3)>
107
108=head1 COPYRIGHT
109
110Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
111
112Licensed under the OpenSSL license (the "License").  You may not use
113this file except in compliance with the License.  You can obtain a copy
114in the file LICENSE in the source distribution or at
115L<https://www.openssl.org/source/license.html>.
116
117=cut
118