OSSL_STORE-WINSTORE(7ossl)

💅 OSSL_STORE-WINSTORE 💅

okay so this is the OSSL_STORE-WINSTORE(7ossl) page, and it's literally about the OpenSSL built-in OSSL_STORE for Windows 🪟✨ get comfy, bestie, we're going certificate shopping.

---

🌸 NAME 🌸

OSSL_STORE-winstore — the OpenSSL built in OSSL_STORE for Windows. that's it, that's the whole vibe 🎀

---

✨ DESCRIPTION ✨

So the OSSL_STORE implementation for Windows gives you access to Windows' system "ROOT" certificate store through URIs 🗂️👑 — using the URI scheme "org.openssl.winstore". cute, right?

🦋 Supported URIs 🦋

There is only one supported URI, and it's this one:

org.openssl.winstore:

and that's literally it — no authority (host, etc), no path, no query, no fragment. don't try to add extra stuff, she's a minimalist 💅

🎯 Supported OSSL_STORE_SEARCH operations 🎯

• OSSL_STORE_SEARCH_by_name(3) — okay so as a matter of fact, this one must be used. fr fr. it is not possible to enumerate all the available certificates in the store 😭 so like, you have to be specific about what you're looking for. iykyk.

🔥 Windows certificate store features 🔥

ngl, apart from the diverse constraints that are already sitting inside the certificates themselves, the Windows certificate store also has the ability to associate additional constraining properties alongside a certificate in the store. it's giving bonus features ✨ and this includes both documented and undocumented capabilities:

• the documented capability to override EKU 👀
• the undocumented capability to add name constraints 🤫
• the undocumented capability to override the certificate expiry date ⏰💀

🫶 heads up bestie: such constraints are not checked by this OSSL_STORE implementation, and thereby not honoured. periodt.

However — and this is the important part — once extracted with OSSL_STORE_load(3), certificates that have constraints in their X.509 extensions will go through the usual constraint checks when they're used by OpenSSL, and are thereby honoured ✅👑

---

👀 SEE ALSO 👀

ossl_store(7), OSSL_STORE_open_ex(3), OSSL_STORE_SEARCH(3) — go read those too, bestie, they're iconic 🌈

---

⭐ HISTORY ⭐

The winstore ("org.openssl.winstore") implementation was added in OpenSSL 3.2.0. so if you're on anything older, sorry babe, no winstore for you 🙈

---

💜 NOTES 💜

OpenSSL uses OSSL_DECODER(3) implementations under the hood 🧚 so to influence what OSSL_DECODER(3) implementations get used, it's advisable to use OSSL_STORE_open_ex(3) and set the propq argument. slay, that's the whole tip 🎀

---

🍓 COPYRIGHT 🍓

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's a wrap, bestie 💖 this lil beauty is from 3.5.6, dated 2026-04-07 — go forth and load those certs responsibly, ily 🫶🎀