info
Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
SSL_CTX_set_default_verify_paths and Windows?
174 views
Skip to first unread message
Charles Mills
Aug 31, 2012, 11:59:53 AM8/31/12
to
Is there documentation for SSL_CTX_set_default_verify_paths()? It's declared
here http://www.openssl.org/docs/ssl/ssl.html but there's no description and
no link that I see.
I have an application working on Windows using explicit PEM certificate
files: SSL_CTX_load_verify_locations(SslCtx, "myCert.pem", NULL);
My interest is in the possibility of using the "built-in" certificate store
in Windows. Is that possible with OpenSSL? Is
SSL_CTX_set_default_verify_paths() relevant? Is there an overview document
somewhere?
Thanks much,
Charles
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openss...@openssl.org
Automated List Manager majo...@openssl.org
here http://www.openssl.org/docs/ssl/ssl.html but there's no description and
no link that I see.
I have an application working on Windows using explicit PEM certificate
files: SSL_CTX_load_verify_locations(SslCtx, "myCert.pem", NULL);
My interest is in the possibility of using the "built-in" certificate store
in Windows. Is that possible with OpenSSL? Is
SSL_CTX_set_default_verify_paths() relevant? Is there an overview document
somewhere?
Thanks much,
Charles
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openss...@openssl.org
Automated List Manager majo...@openssl.org
Dave Thompson
Aug 31, 2012, 6:57:47 PM8/31/12
to
> From: owner-ope...@openssl.org On Behalf Of Charles Mills
> Sent: Friday, 31 August, 2012 12:00
> To: openss...@openssl.org
> Subject: SSL_CTX_set_default_verify_paths and Windows?
_set_default_verify is effectively _load_verify_locations
using env vars SSL_CERT_FILE SSL_CERT_DIR if they exist
and otherwise X509_get_default_cert_{file,dir}() which return
a compiled-in file and directory normally file "cert.pem" and
subdir "certs" under OPENSSLDIR, which is configurable at build
time and can be seen with commandline openssl version -d .
If you're using the ShiningLight builds (as I am) they seem
to make OPENSSLDIR /usr/local/ssl, a directory that doesn't
normally exist on Windows systems (it does on many Unixes).
It is still a file and/or directory in OpenSSL format, not MS.
>
> I have an application working on Windows using explicit PEM
> certificate
> files: SSL_CTX_load_verify_locations(SslCtx, "myCert.pem", NULL);
>
> My interest is in the possibility of using the "built-in"
> certificate store
> in Windows. Is that possible with OpenSSL? Is
> SSL_CTX_set_default_verify_paths() relevant? Is there an
> overview document
> somewhere?
1. OpenSSL X509_STORE logic (like several others) is extensible,
i.e. you write code implementing the same interface and plug it
in. I'm sure it's possible to write a store that fetches from MS
instead of from a file or directory like the builtin ones do.
But this looks like a pretty big job. Someone else may already
have done this, but if so I haven't heard or seen of it.
2. OpenSSL has an "ENGINE" feature that was originally created
to handle hardware devices mostly doing low-level crypto operations
(a digest, a symmetric encrypt or decrypt, a publickey encrypt or
decrypt, etc.) It has gradually been adding more functions, rather
like a scifi movie monster feeding on nuclear bomb radiation.
There is definitely an engine for MS CAPI, and I thought I had
heard mention that the engine interface was adding at least some
truststore function. But looking in 1.0.1c I don't see any trace
of such, so maybe I misunderstood or maybe it isn't cooked yet.
Or of course you could just read the certs from MS truststore
and put them in a file or dir in OpenSSL format. The only downside
of that I see is that you won't honor new inserts (or possibly
deletes) unless and until you repeat the process.
> Sent: Friday, 31 August, 2012 12:00
> To: openss...@openssl.org
> Subject: SSL_CTX_set_default_verify_paths and Windows?
>
> Is there documentation for SSL_CTX_set_default_verify_paths()?
> It's declared here http://www.openssl.org/docs/ssl/ssl.html
> but there's no description and no link that I see.
UTSL (although in this case you must go through several layers).
> Is there documentation for SSL_CTX_set_default_verify_paths()?
> It's declared here http://www.openssl.org/docs/ssl/ssl.html
> but there's no description and no link that I see.
_set_default_verify is effectively _load_verify_locations
using env vars SSL_CERT_FILE SSL_CERT_DIR if they exist
and otherwise X509_get_default_cert_{file,dir}() which return
a compiled-in file and directory normally file "cert.pem" and
subdir "certs" under OPENSSLDIR, which is configurable at build
time and can be seen with commandline openssl version -d .
If you're using the ShiningLight builds (as I am) they seem
to make OPENSSLDIR /usr/local/ssl, a directory that doesn't
normally exist on Windows systems (it does on many Unixes).
It is still a file and/or directory in OpenSSL format, not MS.
>
> I have an application working on Windows using explicit PEM
> certificate
> files: SSL_CTX_load_verify_locations(SslCtx, "myCert.pem", NULL);
>
> My interest is in the possibility of using the "built-in"
> certificate store
> in Windows. Is that possible with OpenSSL? Is
> SSL_CTX_set_default_verify_paths() relevant? Is there an
> overview document
> somewhere?
i.e. you write code implementing the same interface and plug it
in. I'm sure it's possible to write a store that fetches from MS
instead of from a file or directory like the builtin ones do.
But this looks like a pretty big job. Someone else may already
have done this, but if so I haven't heard or seen of it.
2. OpenSSL has an "ENGINE" feature that was originally created
to handle hardware devices mostly doing low-level crypto operations
(a digest, a symmetric encrypt or decrypt, a publickey encrypt or
decrypt, etc.) It has gradually been adding more functions, rather
like a scifi movie monster feeding on nuclear bomb radiation.
There is definitely an engine for MS CAPI, and I thought I had
heard mention that the engine interface was adding at least some
truststore function. But looking in 1.0.1c I don't see any trace
of such, so maybe I misunderstood or maybe it isn't cooked yet.
Or of course you could just read the certs from MS truststore
and put them in a file or dir in OpenSSL format. The only downside
of that I see is that you won't honor new inserts (or possibly
deletes) unless and until you repeat the process.
Charles Mills
Aug 31, 2012, 7:32:59 PM8/31/12
to
Dave, thanks much.
OK, SSL_CTX_set_default_verify_paths() won't do anything for me.
> There is definitely an engine for MS CAPI
I ran into some references to capi and e_capi researching this question on
the Google but I could not find any big picture.
> Or of course you could just read the certs from MS truststore and put them
in a file or dir in OpenSSL format
That sounds like the way I will go if the customers want this. I'm not
enough of an expert to undertake the extension. I think I might be able to
do it as a pipe and not have to actually write the files to disk. Maybe.
You know what would be a cool feature for OpenSSL (yeah, LOL, I'm sure you
know a thousand)? If there were an API whereby one could set a callback
routine that would get a particular type of data (certificate, key, CA cert,
CRL, etc.) when OpenSSL needed it. Then it would be pretty trivial to read
the data from some privately known store such as the Windows truststore.
Thanks again. Amazing package. Enjoying working with it for the first time.
Charles
OK, SSL_CTX_set_default_verify_paths() won't do anything for me.
> There is definitely an engine for MS CAPI
the Google but I could not find any big picture.
> Or of course you could just read the certs from MS truststore and put them
in a file or dir in OpenSSL format
enough of an expert to undertake the extension. I think I might be able to
do it as a pipe and not have to actually write the files to disk. Maybe.
You know what would be a cool feature for OpenSSL (yeah, LOL, I'm sure you
know a thousand)? If there were an API whereby one could set a callback
routine that would get a particular type of data (certificate, key, CA cert,
CRL, etc.) when OpenSSL needed it. Then it would be pretty trivial to read
the data from some privately known store such as the Windows truststore.
Thanks again. Amazing package. Enjoying working with it for the first time.
Charles
Dr. Stephen Henson
Sep 1, 2012, 9:02:52 AM9/1/12
to
On Fri, Aug 31, 2012, Dave Thompson wrote:
> like a scifi movie monster feeding on nuclear bomb radiation.
> There is definitely an engine for MS CAPI, and I thought I had
> heard mention that the engine interface was adding at least some
> truststore function. But looking in 1.0.1c I don't see any trace
> of such, so maybe I misunderstood or maybe it isn't cooked yet.
>
No it isn't there at present. Some research is needed on how to retrieve the
> like a scifi movie monster feeding on nuclear bomb radiation.
> There is definitely an engine for MS CAPI, and I thought I had
> heard mention that the engine interface was adding at least some
> truststore function. But looking in 1.0.1c I don't see any trace
> of such, so maybe I misunderstood or maybe it isn't cooked yet.
>
trust setting for CAPI stores first (so email CAs don't get trusted for
servers).
It is possible to dump the contents of a cert store using some of the ctrl
options though, but that only dumps them to standard output.
Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
Farah NAaz
Jun 3, 2023, 9:20:14 AM6/3/23
to
https://tereishqmeinghayaltv.com
muhammad saad
Jun 6, 2023, 9:55:38 AM6/6/23
to
Hi I found here very Good Information thanks so much for sharing
<a href="https://bekabooserial.com">Bekaboo</a>
<a href="https://bekabooserial.com">Bekaboo</a>
muhammad saad
Jun 6, 2023, 9:55:57 AM6/6/23
to
Hi I found here very Good Information thanks so much for sharing
<a href="https://sapnokichhalang.com">Sapno Ki Chhalaang</a>
muhammad saad
Jun 6, 2023, 9:56:11 AM6/6/23
to
muhammad saad
Jun 6, 2023, 9:56:25 AM6/6/23
to
Hi I found here very Good Information thanks so much for sharing
<a href="https://wohtohhayalbela.com">woh toh hay albela</a>
Fast Seller6
Jun 18, 2023, 4:38:15 AM6/18/23
to
On Tuesday, June 6, 2023 at 6:56:25 AM UTC-7, muhammad saad wrote:
> Hi I found here very Good Information thanks so much for sharing
> <a href="https://wohtohhayalbela.com">woh toh hay albela</a>
Hum Rahe Na Rahe Hum Is Indain Tv Drama By Sony tv Hum Rahe Na Rahe Hum is Hindi Serial Tv
> Hi I found here very Good Information thanks so much for sharing
> <a href="https://wohtohhayalbela.com">woh toh hay albela</a>
<a href="https://humrahenarahe.com/">Hum Rahe Na Rahe Hum</a>
Fast Seller6
Jun 18, 2023, 4:39:19 AM6/18/23
to
Suhagan Is Indain Tv Drama By Colors tv Suhagan is Hindi Serial Tv
<a href="https://suhaganserial.com/">Suhagan</a>
Robert Rodriguez
Jun 25, 2023, 7:14:40 AM6/25/23
to
If you’re looking for a reliable company that can handle your garage door spring replacement in Poquoson, VA, we’re here to help! Give us a call today!
https://garagedoorrepairwilliamsburg.com/garage-door-replacement/
https://garagedoorrepairwilliamsburg.com/garage-door-replacement/
wat wat
Jul 13, 2023, 6:40:21 AM7/13/23
to
These experts may recommend a variety of strategies and solutions, including developing or upgrading digital platforms, implementing automation tools, utilising data-driven insights for informed decision-making, adopting emerging technologies for a competitive advantage, optimising online presence and customer experience, and ensuring robust cybersecurity measures to protect digital assets.
https://techzone-agency.com/
https://techzone-agency.com/
wat wat
Jul 17, 2023, 6:47:20 AM7/17/23
to
You may choose from a huge selection of entertainment shows, TV series, and dramas on sdarot TV, depending on what you want to watch. Only a few episodes were available to watch because the website wasn't developed for another ten years, but it sometimes expanded. With more than one billion views globally, it is the most popular streaming service in Israel. https://isratvinfo.com/sdarot-tv-latest-official-links
Ali
Oct 4, 2023, 4:39:31 AM10/4/23
to
source: https://techzone-agency.com/
0 new messages