Dave, thanks much. OK, SSL_CTX_set_default_verify_paths() won't do anything for me.
> There is definitely an engine for MS CAPI I ran into some references to capi and e_capi researching this question on the Google but I could not find any big picture. > Or of course you could just read the certs from MS truststore and put them in a file or dir in OpenSSL format That sounds like the way I will go if the customers want this. I'm not enough of an expert to undertake the extension. I think I might be able to do it as a pipe and not have to actually write the files to disk. Maybe. You know what would be a cool feature for OpenSSL (yeah, LOL, I'm sure you know a thousand)? If there were an API whereby one could set a callback routine that would get a particular type of data (certificate, key, CA cert, CRL, etc.) when OpenSSL needed it. Then it would be pretty trivial to read the data from some privately known store such as the Windows truststore. Thanks again. Amazing package. Enjoying working with it for the first time. Charles -----Original Message----- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dave Thompson Sent: Friday, August 31, 2012 3:58 PM To: openssl-users@openssl.org Subject: RE: SSL_CTX_set_default_verify_paths and Windows? > From: owner-openssl-us...@openssl.org On Behalf Of Charles Mills > Sent: Friday, 31 August, 2012 12:00 > To: openssl-users@openssl.org > Subject: SSL_CTX_set_default_verify_paths and Windows? > > Is there documentation for SSL_CTX_set_default_verify_paths()? > It's declared here http://www.openssl.org/docs/ssl/ssl.html > but there's no description and no link that I see. UTSL (although in this case you must go through several layers). _set_default_verify is effectively _load_verify_locations using env vars SSL_CERT_FILE SSL_CERT_DIR if they exist and otherwise X509_get_default_cert_{file,dir}() which return a compiled-in file and directory normally file "cert.pem" and subdir "certs" under OPENSSLDIR, which is configurable at build time and can be seen with commandline openssl version -d . If you're using the ShiningLight builds (as I am) they seem to make OPENSSLDIR /usr/local/ssl, a directory that doesn't normally exist on Windows systems (it does on many Unixes). It is still a file and/or directory in OpenSSL format, not MS. > > I have an application working on Windows using explicit PEM > certificate > files: SSL_CTX_load_verify_locations(SslCtx, "myCert.pem", NULL); > > My interest is in the possibility of using the "built-in" > certificate store > in Windows. Is that possible with OpenSSL? Is > SSL_CTX_set_default_verify_paths() relevant? Is there an overview > document somewhere? 1. OpenSSL X509_STORE logic (like several others) is extensible, i.e. you write code implementing the same interface and plug it in. I'm sure it's possible to write a store that fetches from MS instead of from a file or directory like the builtin ones do. But this looks like a pretty big job. Someone else may already have done this, but if so I haven't heard or seen of it. 2. OpenSSL has an "ENGINE" feature that was originally created to handle hardware devices mostly doing low-level crypto operations (a digest, a symmetric encrypt or decrypt, a publickey encrypt or decrypt, etc.) It has gradually been adding more functions, rather like a scifi movie monster feeding on nuclear bomb radiation. There is definitely an engine for MS CAPI, and I thought I had heard mention that the engine interface was adding at least some truststore function. But looking in 1.0.1c I don't see any trace of such, so maybe I misunderstood or maybe it isn't cooked yet. Or of course you could just read the certs from MS truststore and put them in a file or dir in OpenSSL format. The only downside of that I see is that you won't honor new inserts (or possibly deletes) unless and until you repeat the process. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
