CTLOG_STORE_NEW(3ossl)

💖 CTLOG_STORE_NEW 💖

okay bestie, gather round, because today we're talking about the CTLOG_STORE_NEW(3ossl) crew — a whole little family of functions that build and fill up your very own Certificate Transparency log list. it's giving certificate nerd royalty, no cap. 👑

---

✨ NAME ✨

CTLOG_STORE_new_ex, CTLOG_STORE_new, CTLOG_STORE_free, CTLOG_STORE_load_default_file, CTLOG_STORE_load_file — create and populate a Certificate Transparency log list 🦋

---

🌸 SYNOPSIS 🌸

#include <openssl/ct.h>

CTLOG_STORE *CTLOG_STORE_new_ex(OSSL_LIB_CTX *libctx, const char *propq);
CTLOG_STORE *CTLOG_STORE_new(void);
void CTLOG_STORE_free(CTLOG_STORE *store);

int CTLOG_STORE_load_default_file(CTLOG_STORE *store);
int CTLOG_STORE_load_file(CTLOG_STORE *store, const char *file);

---

💅 DESCRIPTION 💅

so a CTLOG_STORE is literally just a container holding a list of CTLOGs (those are Certificate Transparency logs, iykyk). you can load that list from one or more files, and then search it by LogID — and if you wanna know what a LogID even is, go read RFC 6962, Section 3.2, bestie, it's all defined right there. 📖

CTLOG_STORE_new_ex() makes you a shiny empty list of CT logs, all tied to the library context libctx and the property query string propq. main character energy from the jump.

CTLOG_STORE_new() does the exact same thing as CTLOG_STORE_new_ex() — except it rolls with the default library context and the default property query string. lowkey the easy mode version. ✨

then you fill that CTLOG_STORE up with either CTLOG_STORE_load_default_file() or CTLOG_STORE_load_file(). here's the tea:

• CTLOG_STORE_load_default_file() pulls from the default file, which is named ct_log_list.cnf and lives in OPENSSLDIR (peep the output of openssl-version(1) if you need to find it 🕵️).
• you can override that default using an environment variable named CTLOG_FILE.
• CTLOG_STORE_load_file() instead loads from a file path you specify. caller's choice, iconic.
• both of these functions APPEND any loaded CT logs to the CTLOG_STORE — they don't wipe what's already there, they just keep stacking. 🫶

and the file format it expects? bestie it looks exactly like this:

enabled_logs=foo,bar

[foo]
description = Log 1
key = <base64-encoded DER SubjectPublicKeyInfo here>

[bar]
description = Log 2
key = <base64-encoded DER SubjectPublicKeyInfo here>

once you're done with a CTLOG_STORE and it no longer needs to exist, pass it to CTLOG_STORE_free(). that deletes every single CTLOG stored inside it, plus the CTLOG_STORE itself. clean slate, we love a tidy queen. 🧹✨

and if the argument is NULL? nothing happens. no drama, no crash, it just... does nothing. the chillest function in the whole file. 😌

---

🎀 NOTES 🎀

if a file has any invalid CT logs in it, they get skipped — but don't panic, the remaining valid logs still get added to the CTLOG_STORE. 💖

a CT log counts as invalid if it's missing a "key" field or a "description" field. no key, no description, no entry, periodt.

---

⭐ RETURN VALUES ⭐

both CTLOG_STORE_load_default_file and CTLOG_STORE_load_file return 1 if all the CT logs in the file got parsed and loaded successfully, and 0 otherwise. that's it, that's the whole vibe check. ✅

---

🌈 SEE ALSO 🌈

• ct(7)
• CTLOG_STORE_get0_log_by_id(3)
• SSL_CTX_set_ctlog_list_file(3)

---

👑 HISTORY 👑

CTLOG_STORE_new_ex was added in OpenSSL 3.0 — a newer addition, a little baby. 🌱 all the other functions were added way back in OpenSSL 1.1.0. veterans fr fr.

---

💜 COPYRIGHT 💜

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 🎉 this was OpenSSL 3.5.9, dated 2026-09-29, and it's the CTLOG_STORE_NEW(3ossl) manual — go forth and populate those log stores, you absolute legend. 💖✨🦋🌸💅