SSL_CTX_SET_CERT_STORE(3SSL)

💖 SSL_CTX_SET_CERT_STORE 💖

okay bestie, buckle up, because we're doing the OpenSSL 3SSL manual page for SSL_CTX_set_cert_store, SSL_CTX_set1_cert_store and SSL_CTX_get_cert_store — aka the girlies who handle your X509 certificate verification storage. yes, that's the whole vibe. let's go 💅

---

✨ NAME ✨

SSL_CTX_set_cert_store, SSL_CTX_set1_cert_store, SSL_CTX_get_cert_store — manipulate X509 certificate verification storage 🎀

---

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store);
void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store);
X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx);

like, that's it. three little functions. icon behavior honestly 🌸

---

✨ DESCRIPTION ✨

okay so, three functions, three totally different personalities:

• SSL_CTX_set_cert_store() — sets/replaces the certificate verification storage of ctx to/with store. and here's the thing, bestie: if another X509_STORE object is currently set in ctx, it will be X509_STORE_free()ed. SSL_CTX_set_cert_store() will take ownership of the store, i.e., the call X509_STORE_free(store) is no longer needed. it's giving "hand me your keys, i'm the main character now" 🔑👑
• SSL_CTX_set1_cert_store() — sets/replaces the certificate verification storage of ctx to/with store too, but this one is respectful. the store's reference count is incremented. and yeah, if another X509_STORE object is currently set in ctx, it will be X509_STORE_free()ed. shared custody energy, we love to see it 🫶
• SSL_CTX_get_cert_store() — returns a pointer to the current certificate verification storage. and listen, ctx MUST NOT be NULL. like that's not a suggestion, that's a hard boundary. 🚫

---

✨ NOTES ✨

okay so context, because you deserve it 💖

In order to verify the certificates presented by the peer, trusted CA certificates must be accessed. These CA certificates are made available via lookup methods, handled inside the X509_STORE. From the X509_STORE the X509_STORE_CTX used when verifying certificates is created. it's a whole pipeline, iykyk 🦋

Typically the trusted certificate store is handled indirectly via using SSL_CTX_load_verify_locations(3). but if you're feeling ✨extra✨, using the SSL_CTX_set_cert_store() and SSL_CTX_get_cert_store() functions it is possible to manipulate the X509_STORE object beyond the SSL_CTX_load_verify_locations(3) call. no cap 🙈

Currently no detailed documentation on how to use the X509_STORE object is available. and ngl, not all members of the X509_STORE are used when the verification takes place. so will e.g. the verify_callback() be overridden with the verify_callback() set via the SSL_CTX_set_verify(3) family of functions. This document must therefore be updated when documentation about the X509_STORE object and its handling becomes available. yes bestie, the manpage is literally admitting it's a work in progress 💀

⚠️ very important, do not skip this one: SSL_CTX_set_cert_store() does not increment the store's reference count, so it should not be used to assign an X509_STORE that is owned by another SSL_CTX. that's a whole mess and we are not doing that. periodt.

To share X509_STOREs between two SSL_CTXs, use SSL_CTX_get_cert_store() to get the X509_STORE from the first SSL_CTX, and then use SSL_CTX_set1_cert_store() to assign to the second SSL_CTX and increment the reference count of the X509_STORE. that's the correct way, bestie. matching best friend bracelets energy 💖💖

---

✨ RESTRICTIONS ✨

The X509_STORE structure used by an SSL_CTX is used for verifying peer certificates and building certificate chains, and it's also shared by every child SSL structure. so like, everybody's using the same one, no secrets in this friend group 🌈

Applications wanting finer control can use functions such as SSL_CTX_set1_verify_cert_store() instead. so if you're a control freak about your certs (valid), there's a whole other function for you 💅

---

✨ RETURN VALUES ✨

• SSL_CTX_set_cert_store() does not return diagnostic output. it's mysterious like that 🤫
• SSL_CTX_set1_cert_store() does not return diagnostic output. also mysterious. twins.
• SSL_CTX_get_cert_store() returns the current setting. finally, someone who communicates ✨

---

✨ SEE ALSO ✨

ssl(7), SSL_CTX_load_verify_locations(3), SSL_CTX_set_verify(3) — go read those next, bestie, they're in the same universe 🦋

---

✨ COPYRIGHT ✨

Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

aaaand that's the whole page, bestie!! 💜 this was OpenSSL version 4.0.3, dated 2026-09-29, from the SSL_CTX_SET_CERT_STORE(3SSL) manual. go forth and manage your cert stores responsibly, mwah 🎀✨👑