OSSL_STORE-WINSTORE(7SSL)

📦
version 4.0.3 · 6 versions
, in ubuntu stonking

💖 OSSL_STORE-WINSTORE 💖

okay so bestie, you're reading the manual page for OSSL_STORE-winstore, section 7SSL — it's the OpenSSL built in OSSL_STORE for Windows. yes, that Windows. 🪟✨

🌸 DESCRIPTION 🌸

The OSSL_STORE implementation for Windows gives you access to Windows' system "ROOT" certificate store through URIs, using the URI scheme org.openssl.winstore. that's the vibe. that's the whole thing. 💅

🔗 Supported URIs

there is literally only one supported URI, no cap:

org.openssl.winstore:

and that's it — no authority (no host, no etc), no path, no query, no fragment. none of it. she's minimal, she's clean, she's serving nothing extra. 🎀

🔎 Supported OSSL_STORE_SEARCH operations

  • OSSL_STORE_SEARCH_by_name(3) — as a matter of fact, this one must be used. periodt. it is not possible to enumerate all available certificates in the store, so don't even try, bestie. 😭

🗂️ Windows certificate store features

so besides the various constraints that live inside the certificates themselves, the Windows certificate store can also associate extra constraining properties right alongside a certificate in the store. and it's giving both documented and undocumented energy:

  • the documented capability to override EKU
  • the undocumented capability to add name constraints
  • the undocumented capability to override the certificate expiry date
⚠️ these constraints are NOT checked by this OSSL_STORE implementation, and thereby not honoured. so if you were counting on them, you were counting wrong, bestie. 🙈

but here's the slay part: once extracted with OSSL_STORE_load(3), certificates that have constraints in their X.509 extensions will go through the usual constraint checks when used by OpenSSL, and are thereby honoured. so the checks come back, just later, like a comeback arc. 🔥👑

👀 SEE ALSO 👀

ossl_store(7), OSSL_STORE_open_ex(3), OSSL_STORE_SEARCH(3)

⭐ HISTORY ⭐

the winstore (org.openssl.winstore) implementation was added in OpenSSL 3.2.0. she's new-ish, she's iconic. 🌈

📝 NOTES 📝

OpenSSL uses OSSL_DECODER(3) implementations under the hood — sneaky little workers, doing the most behind the scenes. 🧚 so if you wanna influence which OSSL_DECODER(3) implementations get used, it's advisable to call OSSL_STORE_open_ex(3) and set the propq argument. do with that what you will. 💜

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you ate it, you understood it, we love that for you. 🫶 version 4.0.3, dated 2026-09-29 — write it down, timestamp it, screenshot it, frame it, whatever you gotta do. k byeee 💖🦋🌸

📦 where this page comes from