OSSL_STORE(7ossl)

💾 OSSL_STORE — the 7ossl girlies' guide to store retrieval functions 🎀

okay so first things first, this is the OSSL_STORE page from the 7ossl manual, and it's literally about pulling objects out of repos. stay with me bestie, it's actually so good 💅

✨ SYNOPSIS ✨

#include <openssl/store.h>

that's it. that's the include. slay.

🌸 DESCRIPTION 🌸

💜 General

A STORE is basically a whole layer of functionality whose entire job is retrieving a bunch of supported objects out of a repository of any kind — and that repo can be addressed as a filename or as a URI. no cap, any kind. 🦋

The functionality supports this pattern, and honestly it's giving ritual:

• "open a channel to the repository"
• "loop and retrieve one object at a time"
• "finish up by closing the channel"

The retrieved objects come back to you as a wrapper type OSSL_STORE_INFO, and from that wrapper you can get an actual OpenSSL type out. iconic middleman behaviour, honestly 🫶

🧚 URI schemes and loaders

Support for a URI scheme is called a STORE "loader", and it can be added dynamically — either from the calling application or from a loadable engine. very modular of them ✨

Support for the 'file' scheme is built into "libcrypto". See ossl_store-file(7) for more info, iykyk.

🔥 UI_METHOD and pass phrases

The OSSL_STORE API does nothing to enforce any specific format or encoding on the pass phrase that the UI_METHOD provides. However — and this is the important part — the pass phrase is expected to be UTF-8 encoded. The result of any other encoding is undefined. 😭

undefined behaviour is not a vibe, bestie. UTF-8 or bust. 🚨

⭐ EXAMPLES ⭐

🎀 A generic call

#include <openssl/ui.h> /* for UI_get_default_method */
#include <openssl/store.h>

OSSL_STORE_CTX *ctx = OSSL_STORE_open("file:/foo/bar/data.pem",
                       UI_get_default_method(), NULL, NULL, NULL);

/*
 * OSSL_STORE_eof() simulates file semantics for any repository to signal
 * that no more data can be expected
 */
while (!OSSL_STORE_eof(ctx)) {
    OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);

    /*
     * Do whatever is necessary with the OSSL_STORE_INFO,
     * here just one example
     */
    switch (OSSL_STORE_INFO_get_type(info)) {
    case OSSL_STORE_INFO_CERT:
        /* Print the X.509 certificate text */
        X509_print_fp(stdout, OSSL_STORE_INFO_get0_CERT(info));
        /* Print the X.509 certificate PEM output */
        PEM_write_X509(stdout, OSSL_STORE_INFO_get0_CERT(info));
        break;
    }
    OSSL_STORE_INFO_free(info);
}

OSSL_STORE_close(ctx);

like, open a channel, loop til you hit EOF, do your little switch, free the info, close the channel. the whole main character arc in one snippet 👑

---

👀 SEE ALSO 👀

go read these next, bestie, they're all linked:

• OSSL_STORE_INFO(3)
• OSSL_STORE_LOADER(3)
• OSSL_STORE_open(3)
• OSSL_STORE_expect(3)
• OSSL_STORE_SEARCH(3)

🌈 COPYRIGHT 🌈

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🍓 this was OpenSSL 3.5.9, dated 2026-09-29 — go forth and retrieve your objects, you're gonna eat 💖✨