CTLOG_STORE_new.3ossl - Man Page

Create and populate a Certificate Transparency log list

Synopsis

 #include <openssl/ct.h>

 CTLOG_STORE *CTLOG_STORE_new_ex(OSSL_LIB_CTX *libctx, const char *propq);
 CTLOG_STORE *CTLOG_STORE_new(void);
 void CTLOG_STORE_free(CTLOG_STORE *store);

 int CTLOG_STORE_load_default_file(CTLOG_STORE *store);
 int CTLOG_STORE_load_file(CTLOG_STORE *store, const char *file);

Description

A CTLOG_STORE is a container for a list of CTLOGs (Certificate Transparency logs). The list can be loaded from one or more files and then searched by LogID (see RFC 6962, Section 3.2, for the definition of a LogID).

CTLOG_STORE_new_ex() creates an empty list of CT logs associated with the library context libctx and the property query string propq.

CTLOG_STORE_new() does the same thing as CTLOG_STORE_new_ex() but with the default library context and property query string.

The CTLOG_STORE is then populated by CTLOG_STORE_load_default_file() or CTLOG_STORE_load_file(). CTLOG_STORE_load_default_file() loads from the default file, which is named ct_log_list.cnf in OPENSSLDIR (see the output of openssl-version(1)). This can be overridden using an environment variable named CTLOG_FILE. CTLOG_STORE_load_file() loads from a caller-specified file path instead. Both of these functions append any loaded CT logs to the CTLOG_STORE.

The expected format of the file is:

 enabled_logs=foo,bar

 [foo]
 description = Log 1
 key = <base64-encoded DER SubjectPublicKeyInfo here>

 [bar]
 description = Log 2
 key = <base64-encoded DER SubjectPublicKeyInfo here>

Once a CTLOG_STORE is no longer required, it should be passed to CTLOG_STORE_free(). This will delete all of the CTLOGs stored within, along with the CTLOG_STORE itself.

Notes

If there are any invalid CT logs in a file, they are skipped and the remaining valid logs will still be added to the CTLOG_STORE. A CT log will be considered invalid if it is missing a “key” or “description” field.

Return Values

Both CTLOG_STORE_load_default_file and CTLOG_STORE_load_file return 1 if all CT logs in the file are successfully parsed and loaded, 0 otherwise.

See Also

ct(7), CTLOG_STORE_get0_log_by_id(3), SSL_CTX_set_ctlog_list_file(3)

History

CTLOG_STORE_new_ex was added in OpenSSL 3.0. All other functions were added in OpenSSL 1.1.0.

Referenced By

ct.7ossl(7), CTLOG_STORE_get0_log_by_id.3ossl(3), migration_guide.7ossl(7), openssl-env.7ossl(7), SCT_print.3ossl(3), SSL_CTX_set_ctlog_list_file.3ossl(3).

The man pages CTLOG_STORE_free.3ossl(3), CTLOG_STORE_load_default_file.3ossl(3), CTLOG_STORE_load_file.3ossl(3) and CTLOG_STORE_new_ex.3ossl(3) are aliases of CTLOG_STORE_new.3ossl(3).

2021-09-09 3.0.0 OpenSSL