CTLOG_STORE_NEW(3ssl)

✨ CTLOG_STORE_NEW — bestie's guide to Certificate Transparency log lists ✨

okay so this is the CTLOG_STORE_NEW(3ssl) page from the OpenSSL manuals, and it's literally all about creating and populating a Certificate Transparency log list. stay with me, it's actually so good 💅

---

🌸 NAME 🌸

CTLOG_STORE_new_ex, CTLOG_STORE_new, CTLOG_STORE_free, CTLOG_STORE_add0_log, CTLOG_STORE_load_default_file, CTLOG_STORE_load_file — all of these together are the "create and populate a Certificate Transparency log list" squad 🫶

---

🎀 SYNOPSIS 🎀

#include <openssl/ct.h>

CTLOG_STORE *CTLOG_STORE_new_ex(OSSL_LIB_CTX *libctx, const char *propq);
CTLOG_STORE *CTLOG_STORE_new(void);
void CTLOG_STORE_free(CTLOG_STORE *store);

int CTLOG_STORE_add0_log(CTLOG_STORE *store, CTLOG *log);

int CTLOG_STORE_load_default_file(CTLOG_STORE *store);
int CTLOG_STORE_load_file(CTLOG_STORE *store, const char *file);

like, that's the whole lineup. iconic honestly ✨

---

💖 DESCRIPTION 💖

So a CTLOG_STORE is this container situation that holds a whole list of CTLOGs (those are Certificate Transparency logs, fyi). The list can be loaded from one or more files, or you can populate it programmatically yourself, and then you can search it by LogID. and yes, if you're wondering what a LogID even is — check RFC 6962, Section 3.2, it's defined right there 📖

CTLOG_STORE_new_ex() creates an empty list of CT logs, and it's associated with the library context libctx and the property query string propq. very demure, very mindful.

CTLOG_STORE_new() does the exact same thing as CTLOG_STORE_new_ex() but with the default library context and the default property query string. the no-args version, we love her 💅

Then you actually fill that CTLOG_STORE up using CTLOG_STORE_load_default_file(), CTLOG_STORE_load_file(), or CTLOG_STORE_add0_log().

CTLOG_STORE_load_default_file() loads from the default file, which is named ct_log_list.cnf and lives in OPENSSLDIR (peep the output of openssl-version(1) if you need to find it 👀). You can override that with an environment variable named CTLOG_FILE. Meanwhile CTLOG_STORE_load_file() loads from a file path you specify yourself instead. and here's the thing — both of these functions append any loaded CT logs to the CTLOG_STORE. they don't wipe what's already there, they add to it 🧚

The format the file is expected to be in? literally this:

 enabled_logs=foo,bar

 [foo]
 description = Log 1
 key = <base64-encoded DER SubjectPublicKeyInfo here>

 [bar]
 description = Log 2
 key = <base64-encoded DER SubjectPublicKeyInfo here>

CTLOG_STORE_add0_log() adds a single CTLOG (go see CTLOG_new(3)) into the store. On success, the store takes ownership of log and the caller must not free it. On failure, the caller keeps ownership and is responsible for freeing log. so like, pay attention to which one happened, ok? 🙈

Once you're done with a CTLOG_STORE, pass it to CTLOG_STORE_free(). That deletes all the CTLOGs stored inside it, plus the CTLOG_STORE itself. and if the argument is NULL? nothing happens. no drama, no crash, we love a chill function 💜

---

🦋 NOTES 🦋

If there are any invalid CT logs in a file, they get skipped and the remaining valid logs will still be added to the CTLOG_STORE. no cap, the whole file doesn't explode.

A CT log gets considered invalid if it's missing a "key" or "description" field. that's the vibe check it fails ✨

---

🔥 RETURN VALUES 🔥

• CTLOG_STORE_add0_log returns 1 on success and 0 on failure.
• Both CTLOG_STORE_load_default_file and CTLOG_STORE_load_file return 1 if all the CT logs in the file are successfully parsed and loaded, and 0 otherwise.

---

🌈 SEE ALSO 🌈

ct(7), CTLOG_STORE_get0_log_by_id(3), SSL_CTX_set_ctlog_list_file(3)

go read those too, i promise they're relevant 🫶

---

👑 HISTORY 👑

CTLOG_STORE_add0_log was added in OpenSSL 4.1. CTLOG_STORE_new_ex was added in OpenSSL 3.0. All the other functions were added in OpenSSL 1.1.0. so like, this page has lore 📜

---

💀 COPYRIGHT 💀

Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. (that URL is straight from the page, i'm not making it up, fr fr)

---

okay that's the whole thing bestie!! 🎀 this was version 4.1.0, dated 2026-10-23, and it's the CTLOG_STORE_NEW(3ssl) page — go forth and populate those log lists, you're gonna slay 💖✨