blob: f80670ce785f7e8475c2c4f29a61b1f2a5b98373 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
.Dd $Mdocdate: October 12 2014 $
.Dt SSL_CTX_SET_CERT_STORE 3
.Os
.Sh NAME
.Nm SSL_CTX_set_cert_store ,
.Nm SSL_CTX_get_cert_store
.Nd manipulate X509 certificate verification storage
.Sh SYNOPSIS
.In openssl/ssl.h
.Ft void
.Fn SSL_CTX_set_cert_store "SSL_CTX *ctx" "X509_STORE *store"
.Ft X509_STORE *
.Fn SSL_CTX_get_cert_store "const SSL_CTX *ctx"
.Sh DESCRIPTION
.Fn SSL_CTX_set_cert_store
setsthe verification storage of
.Fa ctx
to or replaces it with
.Fa store .
If another
.Vt X509_STORE
object is currently set in
.Fa ctx ,
it will be
.Xr X509_STORE_free 3 Ns ed.
.Pp
.Fn SSL_CTX_get_cert_store
returns a pointer to the current certificate verification storage.
.Sh NOTES
In order to verify the certificates presented by the peer, trusted CA
certificates must be accessed.
These CA certificates are made available via lookup methods, handled inside the
.Vt X509_STORE .
From the
.Vt X509_STORE
the
.Vt X509_STORE_CTX
used when verifying certificates is created.
.Pp
Typically the trusted certificate store is handled indirectly via using
.Xr SSL_CTX_load_verify_locations 3 .
Using the
.Fn SSL_CTX_set_cert_store
and
.Fn SSL_CTX_get_cert_store
functions it is possible to manipulate the
.Vt X509_STORE
object beyond the
.Xr SSL_CTX_load_verify_locations 3
call.
.Pp
Currently no detailed documentation on how to use the
.Vt X509_STORE
object is available.
Not all members of the
.Vt X509_STORE
are used when the verification takes place.
So will, for example, the
.Fn verify_callback
be overridden with the
.Fn verify_callback
set via the
.Xr SSL_CTX_set_verify 3
family of functions.
This document must therefore be updated when documentation about the
.Vt X509_STORE
object and its handling becomes available.
.Sh RETURN VALUES
.Fn SSL_CTX_set_cert_store
does not return diagnostic output.
.Pp
.Fn SSL_CTX_get_cert_store
returns the current setting.
.Sh SEE ALSO
.Xr ssl 3 ,
.Xr SSL_CTX_load_verify_locations 3 ,
.Xr SSL_CTX_set_verify 3
|
