X509_STORE_ADD_CERT(3SSL)

📦

version 4.0.3 · 14 versions

🎀 NAME 🎀

okay so bestie, this page is the whole girl squad of X509_STORE and her besties:

X509_STORE, X509_STORE_add_cert, X509_STORE_add_crl
X509_STORE_set_depth, X509_STORE_set_flags, X509_STORE_set_purpose, X509_STORE_set_trust
X509_STORE_add_lookup
X509_STORE_load_file_ex, X509_STORE_load_file, X509_STORE_load_path
X509_STORE_load_store_ex, X509_STORE_load_store
X509_STORE_set_default_paths_ex, X509_STORE_set_default_paths
X509_STORE_load_locations_ex, X509_STORE_load_locations

...and what they collectively are is X509_STORE manipulation. that's the vibe. 💅

✨ SYNOPSIS ✨

#include <openssl/x509_vfy.h>

typedef x509_store_st X509_STORE;

int X509_STORE_add_cert(X509_STORE *xs, const X509 *x);
int X509_STORE_add_crl(X509_STORE *xs, X509_CRL *x);
int X509_STORE_set_depth(X509_STORE *store, int depth);
int X509_STORE_set_flags(X509_STORE *xs, unsigned long flags);
int X509_STORE_set_purpose(X509_STORE *xs, int purpose);
int X509_STORE_set_trust(X509_STORE *xs, int trust);

X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *store,
                                   X509_LOOKUP_METHOD *meth);

int X509_STORE_set_default_paths_ex(X509_STORE *xs, OSSL_LIB_CTX *libctx,
                                    const char *propq);
int X509_STORE_set_default_paths(X509_STORE *xs);
int X509_STORE_load_file_ex(X509_STORE *xs, const char *file,
                            OSSL_LIB_CTX *libctx, const char *propq);
int X509_STORE_load_file(X509_STORE *xs, const char *file);
int X509_STORE_load_path(X509_STORE *xs, const char *dir);
int X509_STORE_load_store_ex(X509_STORE *xs, const char *uri,
                             OSSL_LIB_CTX *libctx, const char *propq);
int X509_STORE_load_store(X509_STORE *xs, const char *uri);
int X509_STORE_load_locations_ex(X509_STORE *xs, const char *file,
                                 const char *dir, OSSL_LIB_CTX *libctx,
                                 const char *propq);
int X509_STORE_load_locations(X509_STORE *xs,
                              const char *file, const char *dir);

🦋 DESCRIPTION 🦋

so the X509_STORE structure is, like, the consolidated mechanism for holding info about X.509 certificates and CRLs, and for constructing and validating chains of certificates that terminate in trusted roots. she's the main character. she admits multiple lookup mechanisms, scales efficiently with huge numbers of certificates, and gives you a whole lot of flexibility in how validation and policy checks get performed. iconic behaviour, honestly. 👑

details of the chain building and checking process are described in "Certification Path Building" in openssl-verification-options(1) and "Certification Path Validation" in openssl-verification-options(1). go read those if you want the deep lore. 📚

X509_STORE_new(3) creates an empty X509_STORE structure. and like… she contains no information about trusted certificates or where such certificates live on disk, and she's generally not usable. 😭 she's just a shell. normally you add trusted certificates to the X509_STORE to get her ready, through mechanisms such as X509_STORE_add_lookup() and X509_LOOKUP_file(), or PEM_read_bio_X509_AUX() and X509_STORE_add_cert(). CRLs can be added too, and lots of behaviours can be configured however you want. glow-up complete. ✨

once the X509_STORE is suitably configured, X509_STORE_CTX_new() is used to instantiate a single-use X509_STORE_CTX for each chain-building and verification operation. that whole process includes providing the end-entity certificate to be verified plus an additional set of untrusted certificates that may be used in chain-building. so basically: the certificates you put in the X509_STORE are expected to be the ones representing trusted entities, like root certificate authorities (CAs). OpenSSL represents these trusted certificates internally as X509 objects with an associated X509_CERT_AUX, exactly like the ones produced by PEM_read_bio_X509_AUX() and similar routines that refer to X509_AUX. the public interfaces that operate on those trusted certificates still operate on pointers to X509 objects though. iykyk. 🫶

💖 the functions, one by one 💖

X509_STORE_add_cert() and X509_STORE_add_crl() — these add the respective object to the X509_STORE's local storage. untrusted objects should NOT be added this way, bestie, i'm serious. 🙈 the added object's reference count is incremented by one, so the caller keeps ownership of the object and needs to free it when it's no longer needed. don't forget, or that's a leak. 💀
X509_STORE_set_depth(), X509_STORE_set_flags(), X509_STORE_set_purpose(), X509_STORE_set_trust(), and X509_STORE_set1_param() — these set the default values for the corresponding values used in certificate chain validation. their behaviour is documented in the corresponding X509_VERIFY_PARAM manual pages, e.g. X509_VERIFY_PARAM_set_depth(3).

⚠️ the X509_STORE MUST NOT be NULL. periodt.

X509_STORE_add_lookup() — finds or creates an X509_LOOKUP(3) using the X509_LOOKUP_METHOD(3) meth, and adds it to the X509_STORE store. this also associates the X509_STORE with the lookup, so X509_LOOKUP functions can look up objects in that store. matchmaker energy. 💞
X509_STORE_load_file_ex() — loads trusted certificate(s) into an X509_STORE from a given file. the library context libctx and property query propq are used when fetching algorithms from providers.
X509_STORE_load_file() — same as X509_STORE_load_file_ex() but uses NULL for the library context libctx and property query propq.
X509_STORE_load_path() — loads trusted certificate(s) into an X509_STORE from a given directory path dir. the certificates in the directory must be in hashed form, as documented in X509_LOOKUP_hash_dir(3).
X509_STORE_load_store_ex() — loads trusted certificate(s) into an X509_STORE from a store at a given URI uri. the library context libctx and property query propq are used when fetching algorithms from providers.
X509_STORE_load_store() — same as X509_STORE_load_store_ex() but uses NULL for the library context libctx and property query propq.
X509_STORE_load_locations_ex() — combines X509_STORE_load_file_ex() and X509_STORE_load_path() for a given file and/or directory path dir. it's permitted to specify just a file, just a directory, or both paths. choose your own adventure bestie. 🌈
X509_STORE_load_locations() — same as X509_STORE_load_locations_ex() but uses NULL for the library context libctx and property query propq.
X509_STORE_set_default_paths_ex() — okay so this one is somewhat misnamed 💀, in that it does not set what default paths should be used for loading certificates. instead, it loads certificates into the X509_STORE from the hardcoded default paths. the library context libctx and property query propq are used when fetching algorithms from providers.
X509_STORE_set_default_paths() — same as X509_STORE_set_default_paths_ex() but uses NULL for the library context libctx and property query propq.

🔥 RETURN VALUES 🔥

X509_STORE_add_cert(), X509_STORE_add_crl(), X509_STORE_set_depth(), X509_STORE_set_flags(), X509_STORE_set_purpose(), X509_STORE_set_trust(), X509_STORE_load_file_ex(), X509_STORE_load_file(), X509_STORE_load_path(), X509_STORE_load_store_ex(), X509_STORE_load_store(), X509_STORE_load_locations_ex(), X509_STORE_load_locations(), X509_STORE_set_default_paths_ex() and X509_STORE_set_default_paths() — return 1 on success or 0 on failure.
X509_STORE_add_lookup() — returns the found or created X509_LOOKUP(3), or NULL on error.

🌸 SEE ALSO 🌸

⭐ HISTORY ⭐

the functions X509_STORE_set_default_paths_ex(), X509_STORE_load_file_ex(), X509_STORE_load_store_ex() and X509_STORE_load_locations_ex() were added in OpenSSL 3.0. so those are the newer girlies. 🎀

👑 COPYRIGHT 👑

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole X509_STORE_ADD_CERT(3SSL) page bestie, from the OpenSSL docs, version 4.0.3, dated 2026-09-29. you ate that. no cap. 💅✨🦋

📦 where this page comes from

ubuntu stonking: libssl-doc 4.0.3-1ubuntu1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms