TS_VERIFY_CTX(3ossl)

🎀 TS_VERIFY_CTX — bestie, let's manage that TS response verification context 💅

okay so this whole page is about the OpenSSL crew (that's 3ossl, hi) and the little family of functions that handle the TS response verification context. The stars of the show are TS_VERIFY_CTX, TS_VERIFY_CTX_new, TS_VERIFY_CTX_init, TS_VERIFY_CTX_free, TS_VERIFY_CTX_cleanup, TS_VERIFY_CTX_set_flags, TS_VERIFY_CTX_add_flags, TS_VERIFY_CTX_set0_data, TS_VERIFY_CTX_set0_imprint, TS_VERIFY_CTX_set0_store, TS_VERIFY_CTX_set0_certs, TS_VERIFY_CTX_set_certs, TS_VERIFY_CTS_set_certs (yes, that spelling is intentional, we'll get to it 🙈), TS_VERIFY_CTX_set_data, TS_VERIFY_CTX_set_imprint, and TS_VERIFY_CTX_set_store — and they all exist to manage the TS response verification context.

✨ SYNOPSIS ✨

#include <openssl/ts.h>

typedef struct TS_verify_ctx TS_VERIFY_CTX;

TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int f);
int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int f);
int TS_VERIFY_CTX_set0_data(TS_VERIFY_CTX *ctx, BIO *b);
int TS_VERIFY_CTX_set0_imprint(TS_VERIFY_CTX *ctx,
                               unsigned char *hexstr, long len);
int TS_VERIFY_CTX_set0_store(TS_VERIFY_CTX *ctx, X509_STORE *s);
int TS_VERIFY_CTX_set0_certs(TS_VERIFY_CTX *ctx, STACK_OF(X509) *certs);

The following functions have been deprecated since OpenSSL 3.4:

BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *b);
unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx,
                                        unsigned char *hexstr, long len);
X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *s);
STACK_OF(X509) *TS_VERIFY_CTX_set_certs(TS_VERIFY_CTX *ctx,
                                       STACK_OF(X509) *certs);

The following function has been deprecated since OpenSSL 3.0:

STACK_OF(X509) *TS_VERIFY_CTS_set_certs(TS_VERIFY_CTX *ctx,
                                       STACK_OF(X509) *certs);

⚠️ warning bestie: those last two blocks? deprecated, like fully. TS_VERIFY_CTX_set_data, TS_VERIFY_CTX_set_imprint, TS_VERIFY_CTX_set_store, and TS_VERIFY_CTX_set_certs have been deprecated since OpenSSL 3.4, and TS_VERIFY_CTS_set_certs has been deprecated since OpenSSL 3.0. We still document them because history is real, but don't go picking them for a new project, iykyk.

🌸 DESCRIPTION 🌸

So the Time-Stamp Protocol (TSP) is defined by RFC 3161, and it's basically a protocol that gives you long-term proof that certain data existed before a particular time. Iconic behaviour, honestly.

TSP defines two main characters:

a Time Stamping Authority (TSA) 👑
an entity that makes requests to the TSA 🫶

Usually the TSA is the server side, and the requesting entity is the client.

Here's the vibe: in TSP, when the server sends a response to the client, it normally needs to sign the response data — that's the TimeStampToken (TST) — with its private key 🔥. Then the client verifies the received TST using the server's certificate chain. Chain of trust, main character energy.

💜 the functions, one by one

For all the following methods, unless noted otherwise, ctx is the verification context created in advance.

TS_VERIFY_CTX_new() — returns an allocated TS_VERIFY_CTX structure. Fresh out the box, no cap.
TS_VERIFY_CTX_init() — initializes a verification context.
TS_VERIFY_CTX_free() — frees up a TS_VERIFY_CTX object. ctx is the verification context to be freed. If ctx is NULL, the call is just ignored, no drama.
TS_VERIFY_CTX_set_flags() — sets the flags in the verification context. f are the flags to be set.
TS_VERIFY_CTX_add_flags() — adds flags to the verification context. f are the flags to be added (OR'd).
TS_VERIFY_CTX_set0_data() — sets the data to be verified. b is the BIO with the data. Heads up: a previously assigned BIO is freed by this one 🫧.
TS_VERIFY_CTX_set0_imprint() — sets the message imprint. hexstr is the message imprint to be assigned. Also, a previously assigned imprint is freed.
TS_VERIFY_CTX_set0_store() — sets the store for the verification context. s is the store to be assigned. Yep, a previously assigned store is freed.
TS_VERIFY_CTX_set0_certs() — used to set the server's certificate chain when verifying a TST. certs is a stack of X509 certificates.
TS_VERIFY_CTX_cleanup() — frees all data associated with the given TS_VERIFY_CTX object and initializes it. ctx is the verification context created in advance. If ctx is NULL, the call is ignored. Two-for-one, we love to see it.

🙈 the deprecated girlies (read with care)

All of the following functions described are deprecated. Applications should instead use TS_VERIFY_CTX_set0_data(3), TS_VERIFY_CTX_set0_imprint(3), TS_VERIFY_CTX_set0_store(3), and TS_VERIFY_CTX_set0_certs(3). Like, please, the upgrade is right there ✨.

TS_VERIFY_CTX_set_data() — used to set the BIO with the data to be verified. A previously assigned BIO is not freed by this call (see? different from the set0 version, that's the whole reason they deprecated this mess). b is the BIO with the data to assign.
TS_VERIFY_CTX_set_imprint() — used to set the message imprint. A previously assigned imprint is freed by this call. hexstr is the string with the message imprint to assign.
TS_VERIFY_CTX_set_store() — used to set the certificate store. A previously assigned store is not freed by this call. s is the store to assign.
TS_VERIFY_CTX_set_certs() — used to set the server's certificate chain. A previously assigned stack is not freed by this call. certs is a stack of X509 certificates.
TS_VERIFY_CTS_set_certs() — okay so this one is a misspelled version of TS_VERIFY_CTX_set_certs() 🙈 it takes the same parameters and returns the same result. Blame history.

Reminder: the "not freed" vs "is freed" difference is literally the whole plot of the deprecated-vs-set0 saga, so don't mix them up 💀.

💖 RETURN VALUES 💖

TS_VERIFY_CTX_new() — returns an allocated TS_VERIFY_CTX structure.
TS_VERIFY_CTX_set_flags() — returns the flags passed via parameter f.
TS_VERIFY_CTX_add_flags() — returns the flags of the context after the ones passed via parameter f are added to it.
TS_VERIFY_CTX_set0_data(), TS_VERIFY_CTX_set0_imprint(), TS_VERIFY_CTX_set0_store(), and TS_VERIFY_CTX_set0_certs() — return 1 if the value could be successfully set and 0 in case of any error. Slay or fail, no in-between 😭.

The deprecated functions TS_VERIFY_CTX_set_data(), TS_VERIFY_CTX_set_imprint(), TS_VERIFY_CTX_set_store(), and TS_VERIFY_CTX_set_certs() return the parameter the user passes via parameter bio, hexstr, s or certs.

🦋 SEE ALSO 🦋

OSSL_ESS_check_signing_certs(3) — go read it, bestie, it's giving related ✨

⭐ HISTORY ⭐

TS_VERIFY_CTX_set0_data(), TS_VERIFY_CTX_set0_imprint(), TS_VERIFY_CTX_set0_store(), and TS_VERIFY_CTX_set0_certs() replace the functions TS_VERIFY_CTX_set_data(), TS_VERIFY_CTX_set_imprint(), TS_VERIFY_CTX_set_store(), and TS_VERIFY_CTX_set_certs() that were deprecated in OpenSSL 3.4.0. Glow-up confirmed 💅
The spelling of TS_VERIFY_CTX_set_certs() was corrected in OpenSSL 3.0.0. The misspelled version TS_VERIFY_CTS_set_certs() has been retained for compatibility reasons, but it is deprecated in OpenSSL 3.0.0.

🌈 COPYRIGHT 🌈

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you ate that 🍓 stay hydrated, free your TS_VERIFY_CTX objects, and remember: set0 takes ownership, the old ones don't. mwah 💋

version 3.5.0, dated 2026-09-25 — that's the tea, bye bestie 🫶

📦 where this page comes from

opensuse-leap 16.0: openssl-3-doc 3.5.0-160000.11.1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms