SSL_LOAD_CLIENT_CA_FILE(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

✨ SSL_LOAD_CLIENT_CA_FILE ✨

okay bestie, this is the OpenSSL manual page for SSL_load_client_CA_file and its little friend group, straight out of the OpenSSL 3SSL section 🎀 these are the functions that go dig certificate names out of files and directories and stores and hand you back a lil stack of subject names. no cap, very useful, very demure. let's get into it 💅

🌸 NAME 🌸

SSL_load_client_CA_file_ex, SSL_load_client_CA_file, SSL_add_file_cert_subjects_to_stack, SSL_add_dir_cert_subjects_to_stack, SSL_add_store_cert_subjects_to_stack — load certificate names 🦋

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

STACK_OF(X509_NAME) *SSL_load_client_CA_file_ex(const char *file,
                                                OSSL_LIB_CTX *libctx,
                                                const char *propq);
STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file);

int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
                                        const char *file);
int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
                                       const char *dir);
int SSL_add_store_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
                                         const char *store);

💖 DESCRIPTION 💖

okay so here's the whole squad, one by one 👑

  • SSL_load_client_CA_file_ex() — reads certificates from file and returns a STACK_OF(X509_NAME) with the subject names it found. when it goes fetching algorithms from providers, it uses the library context libctx and the property query propq. main character energy, honestly.
  • SSL_load_client_CA_file() — literally the same vibe as SSL_load_client_CA_file_ex(), except it just passes NULL for both the library context libctx and the property query propq. the low-effort icon.
  • SSL_add_file_cert_subjects_to_stack() — reads certificates from file, and adds their subject name to the stack you already have. it doesn't make a new stack, it adds to yours 🫶
  • SSL_add_dir_cert_subjects_to_stack() — reads certificates from every single file in the directory dir, and adds their subject name to the already existing stack. yes, every file. it's thorough like that.
  • SSL_add_store_cert_subjects_to_stack() — loads certificates from the store URI, and adds their subject name to the already existing stack. store girlies rise 🌈

📝 NOTES 📝

SSL_load_client_CA_file() reads a file of PEM formatted certificates and extracts the X509_NAMES of the certificates found. and listen — even though the name is giving "I'm a support function specifically for SSL_CTX_set_client_CA_list(3)", it is not limited to CA certificates. the name is just a name, bestie 💅

💫 RETURN VALUES 💫

here's what you get back from SSL_load_client_CA_file_ex() and SSL_load_client_CA_file():

  • NULL — the operation failed 😭 go check out the error stack for the reason, that's where the tea is.
  • Pointer to STACK_OF(X509_NAME) — a pointer to the subject names of the successfully read certificates. slay ✨

and here's what you get from SSL_add_file_cert_subjects_to_stack(), SSL_add_dir_cert_subjects_to_stack(), and SSL_add_store_cert_subjects_to_stack():

  • 0 (Failure) — the operation failed 💀
  • 1 (Success) — the operation succeeded 🎉

🌟 EXAMPLES 🌟

load names of CAs from a file and use it as a client CA list, iconic behavior:

SSL_CTX *ctx;
STACK_OF(X509_NAME) *cert_names;

...
cert_names = SSL_load_client_CA_file("/path/to/CAfile.pem");
if (cert_names != NULL)
    SSL_CTX_set_client_CA_list(ctx, cert_names);
else
    /* error */
...

🔍 SEE ALSO 🔍

ssl(7), ossl_store(7), SSL_CTX_set_client_CA_list(3)

🕰️ HISTORY 🕰️

SSL_load_client_CA_file_ex() and SSL_add_store_cert_subjects_to_stack() were added in OpenSSL 3.0. the new kids on the block fr fr 🦋

Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 💖 this was OpenSSL 4.0.3, dated 2026-09-29, and it's the SSL_LOAD_CLIENT_CA_FILE(3SSL) manual page from the OpenSSL project. go forth and load those certificate names, you're literally doing amazing 🎀✨

📦 where this page comes from