CTLOG_STORE_NEW(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ CTLOG_STORE_NEW ✨ (that's the 3SSL manual page, bestie 💅)

okay so. listen. you want to make a Certificate Transparency log list? say less. this whole page is about the CTLOG_STORE_new_ex, CTLOG_STORE_new, CTLOG_STORE_free, CTLOG_STORE_load_default_file, and CTLOG_STORE_load_file functions — and they're literally just "make a list, fill the list, destroy the list." iconic. no cap.

🌸 SYNOPSIS 🌸

like, include this first obviously:

#include <openssl/ct.h>

CTLOG_STORE *CTLOG_STORE_new_ex(OSSL_LIB_CTX *libctx, const char *propq);
CTLOG_STORE *CTLOG_STORE_new(void);
void CTLOG_STORE_free(CTLOG_STORE *store);

int CTLOG_STORE_load_default_file(CTLOG_STORE *store);
int CTLOG_STORE_load_file(CTLOG_STORE *store, const char *file);

💖 DESCRIPTION 💖

A CTLOG_STORE is a container for a list of CTLOGs (Certificate Transparency logs). it's giving "glorified bag of logs" and honestly? that's the vibe. you load the list from one or more files, and then you can search it by LogID — and if you need to know what a LogID even is, that's RFC 6962, Section 3.2, go read it, i'll wait 🫶

here's the function-by-function breakdown, keep up:

  • CTLOG_STORE_new_ex() — makes you an empty list of CT logs, tied to the library context libctx and the property query string propq.
  • CTLOG_STORE_new() — same exact thing as CTLOG_STORE_new_ex(), except it uses the default library context and the default property query string. the "i don't want to think about it" option, we love her.

so you've got your empty CTLOG_STORE, now you populate it with CTLOG_STORE_load_default_file() or CTLOG_STORE_load_file(). details:

  • CTLOG_STORE_load_default_file() — loads from the default file, which is named ct_log_list.cnf and lives in OPENSSLDIR. no idea where OPENSSLDIR is on your machine? run openssl-version(1) and it'll tell you, slay. and if you hate that default, you can override it with an environment variable named CTLOG_FILE. also you can point it elsewhere with CTLOG_STORE_load_file() instead, which loads from a caller-specified file path. oh and a lil detail: both of these functions append any loaded CT logs to the CTLOG_STORE. they don't wipe it. just so you know bestie 💀

the file it expects is formatted like this, exactly:

enabled_logs=foo,bar

[foo]
description = Log 1
key = <base64-encoded DER SubjectPublicKeyInfo here>

[bar]
description = Log 2
key = <base64-encoded DER SubjectPublicKeyInfo here>

and when you're done with a CTLOG_STORE (like, truly done, not "done for now"), pass it to CTLOG_STORE_free(). that deletes all the CTLOGs stored inside it, along with the CTLOG_STORE itself. very "cleaning out your camera roll" energy. and if the argument is NULL, nothing happens at all. no drama, no crash, nothing is done. ✨

🎀 NOTES 🎀

okay important: if a file has any invalid CT logs in it, those get skipped — the remaining valid logs still get added to the CTLOG_STORE. so one bad apple does not ruin the whole batch, thank god. 🍓

and what makes a CT log count as invalid? if it's missing a "key" or a "description" field. that's it, that's the whole vibe check.

🌈 RETURN VALUES 🌈

both CTLOG_STORE_load_default_file and CTLOG_STORE_load_file return 1 if all CT logs in the file are successfully parsed and loaded. otherwise they return 0. that's it. binary. no in-between. periodt.

💜 SEE ALSO 💜

go read these too, i promise they're worth it:

🦋 HISTORY 🦋

  • CTLOG_STORE_new_ex was added in OpenSSL 3.0.
  • all the other functions were added in OpenSSL 1.1.0.

so yeah, some of these are old money and one of them is new money. both are valid. 👑

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, mwah 💖 this was OpenSSL 4.0.3, dated 2026-09-29, from the CTLOG_STORE_NEW(3SSL) manual — go populate some logs, you're gonna eat 🫶✨

📦 where this page comes from