OSSL_STORE(7ossl)

💅 OSSL_STORE — store retrieval functions 💅

okay so real talk, this is the 7ossl page from the OpenSSL manual set, and it's genuinely one of the cuter corners of libcrypto once you get it. let's go 🫶

---

✨ SYNOPSIS ✨

#include <openssl/store.h>

that's it. that's the whole include. iconic behavior honestly 💖

---

🌸 DESCRIPTION 🌸

🌈 General 🌈

okay so picture this: a STORE is a whole little layer of functionality whose entire job is retrieving a bunch of supported objects from a repository of any kind — and that repository can be addressed either as a filename or as a URI. no cap. 💅

the whole functionality supports this pattern, and it is lowkey elegant:

• "open a channel to the repository"
• "loop and retrieve one object at a time"
• "finish up by closing the channel"

the objects you get back are wrapped up in a wrapper type called OSSL_STORE_INFO, and from that wrapper you can pull out an actual OpenSSL type. it's giving gift-wrapped data 🎀

🦋 URI schemes and loaders 🦋

support for a URI scheme is called a STORE "loader", and here's the slay part: it can be added dynamically — either from the calling application, or from a loadable engine. so you're not stuck with whatever's baked in, iykyk ✨

support for the 'file' scheme is built right into "libcrypto". for the deets on that one, go read ossl_store-file(7) 💜

🧚 UI_METHOD and pass phrases 🧚

okay important, pay attention bestie: the OSS_STORE API does nothing to enforce any specific format or encoding on the pass phrase that the UI_METHOD provides. it just... doesn't. 🙈

however — the pass phrase is expected to be UTF-8 encoded. and the result of any other encoding is undefined. so like. don't do that. 😭

---

🍓 EXAMPLES 🍓

💫 A generic call 💫

here's the whole vibe, one generic call, written out for you:

#include <openssl/ui.h> /* for UI_get_default_method */
#include <openssl/store.h>

OSSL_STORE_CTX *ctx = OSSL_STORE_open("file:/foo/bar/data.pem",
                       UI_get_default_method(), NULL, NULL, NULL);

/*
 * OSSL_STORE_eof() simulates file semantics for any repository to signal
 * that no more data can be expected
 */
while (!OSSL_STORE_eof(ctx)) {
    OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);

    /*
     * Do whatever is necessary with the OSSL_STORE_INFO,
     * here just one example
     */
    switch (OSSL_STORE_INFO_get_type(info)) {
    case OSSL_STORE_INFO_CERT:
        /* Print the X.509 certificate text */
        X509_print_fp(stdout, OSSL_STORE_INFO_get0_CERT(info));
        /* Print the X.509 certificate PEM output */
        PEM_write_X509(stdout, OSSL_STORE_INFO_get0_CERT(info));
        break;
    }
    OSSL_STORE_INFO_free(info);
}

OSSL_STORE_close(ctx);

like. open the channel, loop while OSSL_STORE_eof() says there's more, switch on the type, print your cert, free your info, close the channel. the way that whole flow just works?? obsessed 🔥

little heads-up that the comments in there are doing real work: OSSL_STORE_eof() simulates file semantics for any repository, to signal that no more data can be expected. so it's not literally checking a file, it's vibing at the concept of one 💀

---

👑 SEE ALSO 👑

go give these your attention, they're all main characters too:

• OSSL_STORE_INFO(3)
• OSSL_STORE_LOADER(3)
• OSSL_STORE_open(3)
• OSSL_STORE_expect(3)
• OSSL_STORE_SEARCH(3)

---

💜 COPYRIGHT 💜

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page, bestie 🌈 this one's from OpenSSL 3.5.6, dated 2026-04-07 — like, go off, future manual. OSSL_STORE(7ossl) out. 🎀✨💅