OSSL_STORE(7ossl)

🌸 OSSL_STORE(7ossl) — store retrieval functions 🌸

okay so bestie, welcome to ossl_store, aka the 7ossl manual page, and honestly? it's giving "backstage pass to how OpenSSL fetches stuff." let's get into it 💅

---

✨ SYNOPSIS ✨

#include <openssl/store.h>

that's it. one include. iconic. 🎀

---

💖 DESCRIPTION 💖

🌈 General

so a STORE is this whole layer of functionality whose entire job is to retrieve a bunch of supported objects from a repository of any kind — and that repository can be addressed either as a filename or as a URI. fr fr, any kind. 🦋

the vibe of the whole thing is a three-step pattern, and it's literally:

1. "open a channel to the repository"
2. "loop and retrieve one object at a time"
3. "finish up by closing the channel"

every object you pull out comes back to you as a wrapper type — OSSL_STORE_INFO — and from that wrapper you can grab the actual OpenSSL type you wanted. lowkey elegant. 👑

🧚 URI schemes and loaders

support for a URI scheme is called a STORE "loader", and bestie, loaders can be added dynamically — either from the calling application or from a loadable engine. so you're not stuck with whatever ships in the box. 💫

support for the 'file' scheme is built right into "libcrypto". yes, built in. see ossl_store-file(7) for the whole story on that one. 📁

🔥 UI_METHOD and pass phrases

okay important: the OSS_STORE API does nothing to enforce any specific format or encoding on the pass phrase that the UI_METHOD provides. none. zero. 🙈

however — the pass phrase is expected to be UTF-8 encoded, and the result of any other encoding is undefined. so like, don't test fate, okay? 💀

---

⭐ EXAMPLES ⭐

💜 A generic call

here's the whole generic flow, and yes i'm giving it to you exactly, no edits, because it slays as-is:

#include <openssl/ui.h> /* for UI_get_default_method */
#include <openssl/store.h>

OSSL_STORE_CTX *ctx = OSSL_STORE_open("file:/foo/bar/data.pem",
                       UI_get_default_method(), NULL, NULL, NULL);

/*
 * OSSL_STORE_eof() simulates file semantics for any repository to signal
 * that no more data can be expected
 */
while (!OSSL_STORE_eof(ctx)) {
    OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);

    /*
     * Do whatever is necessary with the OSSL_STORE_INFO,
     * here just one example
     */
    switch (OSSL_STORE_INFO_get_type(info)) {
    case OSSL_STORE_INFO_CERT:
        /* Print the X.509 certificate text */
        X509_print_fp(stdout, OSSL_STORE_INFO_get0_CERT(info));
        /* Print the X.509 certificate PEM output */
        PEM_write_X509(stdout, OSSL_STORE_INFO_get0_CERT(info));
        break;
    }
    OSSL_STORE_INFO_free(info);
}

OSSL_STORE_close(ctx);

see how OSSL_STORE_eof() pretends to be a file for any repository, just to say "no more data coming"? that's the trick that makes the loop work everywhere. 🫶 and don't forget OSSL_STORE_INFO_free(info) — free your stuff, bestie. 🧹

---

👑 SEE ALSO 👑

go read these next, they're the friend group:

• OSSL_STORE_INFO(3)
• OSSL_STORE_LOADER(3)
• OSSL_STORE_open(3)
• OSSL_STORE_expect(3)
• OSSL_STORE_SEARCH(3)

---

🍓 COPYRIGHT 🍓

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

ngl that license bit is not the fun part, but it's literally required, so we keep it. periodt. 💅

okay that's the whole page!! this bad boy is version 3.5.0, dated 2026-09-25, and it's the OSSL_STORE(7ossl) page — go forth and retrieve objects, you absolute main character 🌈✨🎀