OSSL_STORE-WINSTORE(7ossl)

💖 OSSL_STORE-WINSTORE 💖

okay so this is the OSSL_STORE-WINSTORE page from the 7ossl manual family — the whole thing is about the built-in OpenSSL OSSL_STORE for Windows. bestie, it's short, it's sweet, and it's lowkey important, so let's get into it 🎀

🌸 NAME 🌸

OSSL_STORE-winstore — the OpenSSL built-in OSSL_STORE for Windows, periodt ✨

🦋 DESCRIPTION 🦋

So the OSSL_STORE implementation for Windows gives you access to Windows' system "ROOT" certificate store through URIs, using the URI scheme "org.openssl.winstore". that's the whole vibe 💅

✨ Supported URIs ✨

there is literally only one supported URI:

org.openssl.winstore:

and that's it, no cap. no authority (host, etc), no path, no query, no fragment. nothing extra. clean, minimal, iconic 🫶

🍓 Supported OSSL_STORE_SEARCH operations 🍓

• OSSL_STORE_SEARCH_by_name(3) — as a matter of fact, this one must be used. like, you don't get a choice, bestie. it is not possible to enumerate all available certificates in the store 😭 so don't come in here expecting a full list of everything chilling in there.

👑 Windows certificate store features 👑

okay so this is the part where it gets spicy 🔥 apart from all the diverse constraints that are already sitting inside the certificates themselves, the Windows certificate store also has this ability to associate additional constraining properties right alongside a certificate in the store. and this includes both documented and undocumented capabilities:

• the documented capability to override EKU ⭐
• the undocumented capability to add name constraints 🙈
• the undocumented capability to override the certificate expiry date 💀

ngl, here's the caveat that matters: such constraints are not checked by this OSSL_STORE implementation, and thereby not honoured. like, this implementation simply does not look at them, okay?

but — and this is the plot twist — once extracted with OSSL_STORE_load(3), certificates that have constraints in their X.509 extensions will go through the usual constraint checks when they're used by OpenSSL, and are thereby honoured. so the checks aren't cancelled, they're just... on a different shift 🦋

---

🌈 SEE ALSO 🌈

ossl_store(7), OSSL_STORE_open_ex(3), OSSL_STORE_SEARCH(3) — go read these, iykyk 💜

⭐ HISTORY ⭐

the winstore ("org.openssl.winstore") implementation was added in OpenSSL 3.2.0. so if you're on something older, that's a you problem, bestie 😌

💀 NOTES 💀

OpenSSL uses OSSL_DECODER(3) implementations under the hood 👀 so if you want to influence what OSSL_DECODER(3) implementations are used, it's advisable to use OSSL_STORE_open_ex(3) and set the propq argument. that's the move 🎯

🎀 COPYRIGHT 🎀

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page, you ate that 💅 this was version 3.5.9, dated 2026-09-29, and yes it's the OSSL_STORE-WINSTORE(7ossl) page — love u, go forth and read ur certs responsibly 🧚‍♀️💖