1.\" $OpenBSD: SSL_load_client_CA_file.3,v 1.5 2016/12/16 15:39:08 jmc Exp $ 2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100 3.\" 4.\" This file is a derived work. 5.\" The changes are covered by the following Copyright and license: 6.\" 7.\" Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org> 8.\" 9.\" Permission to use, copy, modify, and distribute this software for any 10.\" purpose with or without fee is hereby granted, provided that the above 11.\" copyright notice and this permission notice appear in all copies. 12.\" 13.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 14.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 15.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 16.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 17.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20.\" 21.\" The original file was written by Lutz Jaenicke <jaenicke@openssl.org>. 22.\" Copyright (c) 2000 The OpenSSL Project. All rights reserved. 23.\" 24.\" Redistribution and use in source and binary forms, with or without 25.\" modification, are permitted provided that the following conditions 26.\" are met: 27.\" 28.\" 1. Redistributions of source code must retain the above copyright 29.\" notice, this list of conditions and the following disclaimer. 30.\" 31.\" 2. Redistributions in binary form must reproduce the above copyright 32.\" notice, this list of conditions and the following disclaimer in 33.\" the documentation and/or other materials provided with the 34.\" distribution. 35.\" 36.\" 3. All advertising materials mentioning features or use of this 37.\" software must display the following acknowledgment: 38.\" "This product includes software developed by the OpenSSL Project 39.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 40.\" 41.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 42.\" endorse or promote products derived from this software without 43.\" prior written permission. For written permission, please contact 44.\" openssl-core@openssl.org. 45.\" 46.\" 5. Products derived from this software may not be called "OpenSSL" 47.\" nor may "OpenSSL" appear in their names without prior written 48.\" permission of the OpenSSL Project. 49.\" 50.\" 6. Redistributions of any form whatsoever must retain the following 51.\" acknowledgment: 52.\" "This product includes software developed by the OpenSSL Project 53.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)" 54.\" 55.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 56.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 57.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 58.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 59.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 60.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 61.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 62.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 63.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 64.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 65.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 66.\" OF THE POSSIBILITY OF SUCH DAMAGE. 67.\" 68.Dd $Mdocdate: December 16 2016 $ 69.Dt SSL_LOAD_CLIENT_CA_FILE 3 70.Os 71.Sh NAME 72.Nm SSL_load_client_CA_file , 73.Nm SSL_add_file_cert_subjects_to_stack , 74.Nm SSL_add_dir_cert_subjects_to_stack 75.Nd load certificate names from files 76.Sh SYNOPSIS 77.In openssl/ssl.h 78.Ft STACK_OF(X509_NAME) * 79.Fn SSL_load_client_CA_file "const char *file" 80.Ft int 81.Fo SSL_add_file_cert_subjects_to_stack 82.Fa "STACK_OF(X509_NAME) *stack" 83.Fa "const char *file" 84.Fc 85.Ft int 86.Fo SSL_add_dir_cert_subjects_to_stack 87.Fa "STACK_OF(X509_NAME) *stack" 88.Fa "const char *dir" 89.Fc 90.Sh DESCRIPTION 91.Fn SSL_load_client_CA_file 92reads PEM formatted certificates from 93.Fa file 94and returns a new 95.Vt STACK_OF(X509_NAME) 96with the subject names found. 97While the name suggests the specific usage as a support function for 98.Xr SSL_CTX_set_client_CA_list 3 , 99it is not limited to CA certificates. 100.Pp 101.Fn SSL_add_file_cert_subjects_to_stack 102is similar except that the names are added to the existing 103.Fa stack . 104.Pp 105.Fn SSL_add_dir_cert_subjects_to_stack 106calls 107.Fn SSL_add_file_cert_subjects_to_stack 108on every file in the directory 109.Fa dir . 110.Pp 111If a name is already on the stack, all these functions skip it and 112do not add it again. 113.Sh RETURN VALUES 114.Fn SSL_load_client_CA_file 115returns a pointer to the new 116.Vt STACK_OF(X509_NAME) 117or 118.Dv NULL on failure . 119.Pp 120.Fn SSL_add_file_cert_subjects_to_stack 121and 122.Fn SSL_add_dir_cert_subjects_to_stack 123return 1 for success or 0 for failure. 124.Pp 125All these functions treat empty files and directories as failures. 126.Pp 127In some cases of failure, the reason can be determined with 128.Xr ERR_get_error 3 . 129.Sh EXAMPLES 130Load names of CAs from a file and use it as a client CA list: 131.Bd -literal 132SSL_CTX *ctx; 133STACK_OF(X509_NAME) *cert_names; 134\&... 135cert_names = SSL_load_client_CA_file("/path/to/CAfile.pem"); 136if (cert_names != NULL) 137 SSL_CTX_set_client_CA_list(ctx, cert_names); 138else 139 error_handling(); 140\&... 141.Ed 142.Sh SEE ALSO 143.Xr PEM_read_bio_X509 3 , 144.Xr SSL_CTX_set_client_CA_list 3 , 145.Xr X509_get_subject_name 3 , 146.Xr X509_NAME_new 3 147.Sh HISTORY 148.Fn SSL_add_file_cert_subjects_to_stack 149and 150.Fn SSL_add_dir_cert_subjects_to_stack 151first appeared in OpenSSL 0.9.2b. 152.Sh AUTHORS 153.Fn SSL_add_file_cert_subjects_to_stack 154and 155.Fn SSL_add_dir_cert_subjects_to_stack 156were written by 157.An Ben Laurie Aq Mt ben@openssl.org 158in 1999. 159.Sh BUGS 160In some cases of failure, for example for empty files and directories, 161these functions fail to report an error, in the sense that 162.Xr ERR_get_error 3 163does not work. 164.Pp 165Even in case of failure, for example when parsing one of the 166files or certificates fails, 167.Fn SSL_add_file_cert_subjects_to_stack 168and 169.Fn SSL_add_dir_cert_subjects_to_stack 170may still have added some certificates to the stack. 171.Pp 172The behaviour of 173.Fn SSL_add_dir_cert_subjects_to_stack 174is non-deterministic. 175If parsing one file fails, parsing of the whole directory is aborted. 176Files in the directory are not parsed in any specific order. 177For example, adding an empty file to 178.Fa dir 179may or may not cause some of the other files to be ignored. 180