TLS_LOAD_FILE(3)

💖 TLS_LOAD_FILE — the manual, but make it make sense 💖

okay bestie, sit down, grab a boba 🧋, because we're about to talk about tls_load_file, tls_unload_file, tls_config_set_ca_file, tls_config_set_ca_path, tls_config_set_ca_mem, tls_config_set_cert_file, tls_config_set_cert_mem, tls_config_set_crl_file, tls_config_set_crl_mem, tls_config_set_key_file, tls_config_set_key_mem, tls_config_set_ocsp_staple_mem, tls_config_set_ocsp_staple_file, tls_config_set_keypair_file, tls_config_set_keypair_mem, tls_config_set_keypair_ocsp_file, tls_config_set_keypair_ocsp_mem, tls_config_add_keypair_file, tls_config_add_keypair_ocsp_mem, tls_config_add_keypair_ocsp_file, tls_config_add_keypair_mem, tls_config_clear_keys, tls_config_set_verify_depth, tls_config_verify_client, tls_config_verify_client_optional, and tls_default_ca_cert_file — which is a LOT of names, I know, but it's literally all just TLS certificate and key configuration. This is a Library Functions Manual page, section 3, and it is iconic.

---

✨ NAME ✨

tls_load_file, tls_unload_file, tls_config_set_ca_file, tls_config_set_ca_path, tls_config_set_ca_mem, tls_config_set_cert_file, tls_config_set_cert_mem, tls_config_set_crl_file, tls_config_set_crl_mem, tls_config_set_key_file, tls_config_set_key_mem, tls_config_set_ocsp_staple_mem, tls_config_set_ocsp_staple_file, tls_config_set_keypair_file, tls_config_set_keypair_mem, tls_config_set_keypair_ocsp_file, tls_config_set_keypair_ocsp_mem, tls_config_add_keypair_file, tls_config_add_keypair_ocsp_mem, tls_config_add_keypair_ocsp_file, tls_config_add_keypair_mem, tls_config_clear_keys, tls_config_set_verify_depth, tls_config_verify_client, tls_config_verify_client_optional, tls_default_ca_cert_file — TLS certificate and key configuration 🌸

---

🎀 SYNOPSIS 🎀

#include <tls.h>

uint8_t *
tls_load_file(const char *file, size_t *len, char *password);

void
tls_unload_file(uint8_t *buf, size_t len);

int
tls_config_set_ca_file(struct tls_config *config, const char *ca_file);

int
tls_config_set_ca_path(struct tls_config *config, const char *ca_path);

int
tls_config_set_ca_mem(struct tls_config *config, const uint8_t *cert,
    size_t len);

int
tls_config_set_cert_file(struct tls_config *config,
    const char *cert_file);

int
tls_config_set_cert_mem(struct tls_config *config, const uint8_t *cert,
    size_t len);

int
tls_config_set_crl_file(struct tls_config *config,
    const char *crl_file);

int
tls_config_set_crl_mem(struct tls_config *config, const uint8_t *crl,
    size_t len);

int
tls_config_set_key_file(struct tls_config *config,
    const char *key_file);

int
tls_config_set_key_mem(struct tls_config *config, const uint8_t *key,
    size_t len);

int
tls_config_set_ocsp_staple_mem(struct tls_config *config,
    const uint8_t *staple, size_t len);

int
tls_config_set_ocsp_staple_file(struct tls_config *config,
    const char *staple_file);

int
tls_config_set_keypair_file(struct tls_config *config,
    const char *cert_file, const char *key_file);

int
tls_config_set_keypair_mem(struct tls_config *config,
    const uint8_t *cert, size_t cert_len, const uint8_t *key,
    size_t key_len);

int
tls_config_set_keypair_ocsp_file(struct tls_config *config,
    const char *cert_file, const char *key_file,
    const char *staple_file);

int
tls_config_set_keypair_ocsp_mem(struct tls_config *config,
    const uint8_t *cert, size_t cert_len, const uint8_t *key,
    size_t key_len, const uint8_t *staple, size_t staple_len);

int
tls_config_add_keypair_file(struct tls_config *config,
    const char *cert_file, const char *key_file);

int
tls_config_add_keypair_mem(struct tls_config *config,
    const uint8_t *cert, size_t cert_len, const uint8_t *key,
    size_t key_len);

int
tls_config_add_keypair_ocsp_file(struct tls_config *config,
    const char *cert_file, const char *key_file,
    const char *staple_file);

int
tls_config_add_keypair_ocsp_mem(struct tls_config *config,
    const uint8_t *cert, size_t cert_len, const uint8_t *key,
    size_t key_len, const uint8_t *staple, size_t staple_len);

void
tls_config_clear_keys(struct tls_config *config);

int
tls_config_set_verify_depth(struct tls_config *config,
    int verify_depth);

void
tls_config_verify_client(struct tls_config *config);

void
tls_config_verify_client_optional(struct tls_config *config);

const char *
tls_default_ca_cert_file(void);

---

🦋 DESCRIPTION 🦋

okay so here's the tea ☕ — this whole page is about telling libtls where your certs and keys live. File on disk? Memory? Both? We got options, and honestly? slay.

• tls_load_file() — reads a certificate or key off the disk and yeets it into memory, so you can hand it to tls_config_set_ca_mem(), tls_config_set_cert_mem(), tls_config_set_crl_mem() or tls_config_set_key_mem(). If you pass the optional password argument, a private key will get decrypted. 🔓
• tls_unload_file() — frees the memory that an earlier tls_load_file() call gave you, and makes sure the contents are actually discarded (goodbye, secrets 👋). tls_unload_file() unloads the memory that was returned from an earlier tls_load_file() call, ensuring that the memory contents is discarded.
• tls_default_ca_cert_file() — hands you back the path of the file that holds the default root certificates. 📁
• tls_config_set_ca_file() — loads a file containing the root certificates.
• tls_config_set_ca_path() — sets the path (directory) that should be searched for root certificates.
• tls_config_set_ca_mem() — sets the root certificates directly from memory.
• tls_config_set_cert_file() — loads a file containing the public certificate.
• tls_config_set_cert_mem() — sets the public certificate directly from memory.
• tls_config_set_crl_file() — loads a file containing the Certificate Revocation List (CRL).
• tls_config_set_crl_mem() — sets the CRL directly from memory.
• tls_config_set_key_file() — loads a file containing the private key.
• tls_config_set_key_mem() — directly sets the private key from memory.
• tls_config_set_ocsp_staple_file() — loads a file containing a DER-encoded OCSP response to be stapled during the TLS handshake. 📎
• tls_config_set_ocsp_staple_mem() — sets a DER-encoded OCSP response to be stapled during the TLS handshake from memory.
• tls_config_set_keypair_file() — loads two files, from which the public certificate and private key will be read.
• tls_config_set_keypair_mem() — directly sets the public certificate and private key from memory.
• tls_config_set_keypair_ocsp_file() — loads three files containing the public certificate, private key, and DER-encoded OCSP staple.
• tls_config_set_keypair_ocsp_mem() — directly sets the public certificate, private key, and DER-encoded OCSP staple from memory.
• tls_config_add_keypair_file() — adds an additional public certificate and private key from the specified files, used as an alternative certificate for Server Name Indication (server only). 👑
• tls_config_add_keypair_mem() — adds an additional public certificate and private key from memory, used as an alternative certificate for Server Name Indication (server only).
• tls_config_add_keypair_ocsp_file() — adds an additional public certificate, private key, and DER-encoded OCSP staple from the specified files, used as an alternative certificate for Server Name Indication (server only).
• tls_config_add_keypair_ocsp_mem() — adds an additional public certificate, private key, and DER-encoded OCSP staple from memory, used as an alternative certificate for Server Name Indication (server only).
• tls_config_clear_keys() — clears any secret keys from memory. 🧹 no cap, this one matters.
• tls_config_set_verify_depth() — limits the number of intermediate certificates that will be followed during certificate validation. (Think of it like a chain of besties you're willing to follow down before you're like "okay that's enough".)
• tls_config_verify_client() — enables client certificate verification, requiring the client to send a certificate (server only).
• tls_config_verify_client_optional() — enables client certificate verification, without requiring the client to send a certificate (server only).

the "server only" girlies are just that — these only do anything when you're acting as a server, okurrr? 💅

---

🌈 RETURN VALUES 🌈

• tls_load_file() returns NULL on error or an out of memory condition. 😭
• The other functions return 0 on success or -1 on error.

---

💜 SEE ALSO 💜

tls_config_ocsp_require_stapling(3), tls_config_set_protocols(3), tls_config_set_session_id(3), tls_configure(3), tls_init(3)

---

⭐ HISTORY ⭐

• tls_config_set_ca_file(), tls_config_set_ca_path(), tls_config_set_cert_file(), tls_config_set_cert_mem(), tls_config_set_key_file(), tls_config_set_key_mem(), and tls_config_set_verify_depth() appeared in OpenBSD 5.6 and got their final names in OpenBSD 5.7. glow-up era ✨
• tls_load_file(), tls_config_set_ca_mem(), and tls_config_clear_keys() appeared in OpenBSD 5.7.
• tls_config_verify_client() and tls_config_verify_client_optional() appeared in OpenBSD 5.9.
• tls_config_set_keypair_file() and tls_config_set_keypair_mem() appeared in OpenBSD 6.0, and tls_config_add_keypair_file() and tls_config_add_keypair_mem() in OpenBSD 6.1.
• tls_config_set_crl_file() and tls_config_set_crl_mem() appeared in OpenBSD 6.2.

---

👑 AUTHORS 👑

Joel Sing <jsing@openbsd.org> with contributions from Ted Unangst <tedu@openbsd.org> and Bob Beck <beck@openbsd.org>. 🫶

tls_load_file() and tls_config_set_ca_mem() were written by Reyk Floeter <reyk@openbsd.org>.

---

aaaand that's the whole page bestie, we ate and left no crumbs 🍓💅 this cutie came from the Debian crew, dated January 1, 2022 — go forth and configure your TLS, mwah 😘