1.\" $OpenBSD: X509_LOOKUP_hash_dir.3,v 1.13 2024/09/02 07:20:21 tb Exp $ 2.\" full merge up to: OpenSSL 61f805c1 Jan 16 01:01:46 2018 +0800 3.\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100 4.\" 5.\" This file is a derived work. 6.\" The changes are covered by the following Copyright and license: 7.\" 8.\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org> 9.\" 10.\" Permission to use, copy, modify, and distribute this software for any 11.\" purpose with or without fee is hereby granted, provided that the above 12.\" copyright notice and this permission notice appear in all copies. 13.\" 14.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 15.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 16.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 17.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 18.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 19.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 20.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 21.\" 22.\" The original file was written by Victor B. Wagner <vitus@cryptocom.ru> 23.\" and Claus Assmann. 24.\" Copyright (c) 2015, 2016 The OpenSSL Project. All rights reserved. 25.\" 26.\" Redistribution and use in source and binary forms, with or without 27.\" modification, are permitted provided that the following conditions 28.\" are met: 29.\" 30.\" 1. Redistributions of source code must retain the above copyright 31.\" notice, this list of conditions and the following disclaimer. 32.\" 33.\" 2. Redistributions in binary form must reproduce the above copyright 34.\" notice, this list of conditions and the following disclaimer in 35.\" the documentation and/or other materials provided with the 36.\" distribution. 37.\" 38.\" 3. All advertising materials mentioning features or use of this 39.\" software must display the following acknowledgment: 40.\" "This product includes software developed by the OpenSSL Project 41.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 42.\" 43.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 44.\" endorse or promote products derived from this software without 45.\" prior written permission. For written permission, please contact 46.\" openssl-core@openssl.org. 47.\" 48.\" 5. Products derived from this software may not be called "OpenSSL" 49.\" nor may "OpenSSL" appear in their names without prior written 50.\" permission of the OpenSSL Project. 51.\" 52.\" 6. Redistributions of any form whatsoever must retain the following 53.\" acknowledgment: 54.\" "This product includes software developed by the OpenSSL Project 55.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)" 56.\" 57.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 58.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 59.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 60.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 61.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 62.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 63.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 64.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 65.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 66.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 67.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 68.\" OF THE POSSIBILITY OF SUCH DAMAGE. 69.\" 70.Dd $Mdocdate: September 2 2024 $ 71.Dt X509_LOOKUP_HASH_DIR 3 72.Os 73.Sh NAME 74.Nm X509_LOOKUP_hash_dir , 75.Nm X509_LOOKUP_file , 76.Nm X509_LOOKUP_mem 77.Nd certificate lookup methods 78.Sh SYNOPSIS 79.In openssl/x509_vfy.h 80.Ft const X509_LOOKUP_METHOD * 81.Fn X509_LOOKUP_hash_dir void 82.Ft const X509_LOOKUP_METHOD * 83.Fn X509_LOOKUP_file void 84.Ft const X509_LOOKUP_METHOD * 85.Fn X509_LOOKUP_mem void 86.Sh DESCRIPTION 87.Fn X509_LOOKUP_hash_dir , 88.Fn X509_LOOKUP_file , 89and 90.Fn X509_LOOKUP_mem 91return pointers to static certificate lookup method objects 92built into the library, for use with 93.Vt X509_STORE . 94.Pp 95Users of the library typically do not need 96to retrieve pointers to these method objects manually. 97They are automatically used by the 98.Xr X509_STORE_load_locations 3 99or 100.Xr SSL_CTX_load_verify_locations 3 101functions. 102.Ss File Method 103The 104.Fn X509_LOOKUP_file 105method loads all the certificates or CRLs present in a file into memory 106at the time the file is added as a lookup source. 107.Pp 108The file format is ASCII text which contains concatenated PEM 109certificates and CRLs. 110.Pp 111This method should be used by applications which work with a small set 112of CAs. 113.Ss Hashed Directory Method 114.Fa X509_LOOKUP_hash_dir 115is a more advanced method which loads certificates and CRLs on demand, 116and caches them in memory once they are loaded. 117As of OpenSSL 1.0.0, it also checks for newer CRLs upon each lookup, so 118that newer CRLs are used as soon as they appear in the directory. 119.Pp 120The directory should contain one certificate or CRL per file in PEM 121format, with a filename of the form 122.Ar hash . Ns Ar N 123for a certificate, or 124.Ar hash . Ns Sy r Ns Ar N 125for a CRL. 126The 127.Ar hash 128is the value returned by the 129.Xr X509_NAME_hash 3 130function applied to the subject name for certificates or issuer 131name for CRLs. 132The hash can also be obtained via the 133.Fl hash 134option of the 135.Xr openssl 1 136.Cm x509 137or 138.Cm crl 139commands. 140.Pp 141The 142.Ar N 143suffix is a sequence number that starts at zero and is incremented 144consecutively for each certificate or CRL with the same 145.Ar hash 146value. 147Gaps in the sequence numbers are not supported. 148It is assumed that there are no more objects with the same hash 149beyond the first missing number in the sequence. 150.Pp 151Sequence numbers make it possible for the directory to contain multiple 152certificates with the same subject name hash value. 153For example, it is possible to have in the store several certificates 154with the same subject or several CRLs with the same issuer (and, for 155example, a different validity period). 156.Pp 157When checking for new CRLs, once one CRL for a given hash value is 158loaded, hash_dir lookup method checks only for certificates with 159sequence number greater than that of the already cached CRL. 160.Pp 161Note that the hash algorithm used for subject name hashing changed in 162OpenSSL 1.0.0, and all certificate stores have to be rehashed when 163moving from OpenSSL 0.9.8 to 1.0.0. 164.Ss Memory Method 165The 166.Fn X509_LOOKUP_mem 167method supports loading PEM-encoded certificates and revocation lists 168that are already stored in memory, using the function 169.Xr X509_LOOKUP_add_mem 3 . 170This is particularly useful in processes using 171.Xr chroot 2 . 172.Sh RETURN VALUES 173These functions always return a pointer to a static object. 174.Sh SEE ALSO 175.Xr SSL_CTX_load_verify_locations 3 , 176.Xr X509_LOOKUP_new 3 , 177.Xr X509_STORE_load_locations 3 , 178.Xr X509_STORE_new 3 179.Sh HISTORY 180.Fn X509_LOOKUP_hash_dir 181and 182.Fn X509_LOOKUP_file 183first appeared in SSLeay 0.8.0 and have been available since 184.Ox 2.4 . 185.Pp 186.Fn X509_LOOKUP_mem 187first appeared in 188.Ox 5.7 . 189