Hi all, OpenSSL3+ added support for full certificate and key stores, based on their provider mechanism.
What this means in plain english is that you can point OpenSSL at a PEM file, a PKCS12 file, a pcks11: URI, the whole Windows certificate store, whatever is going, and it will just work. OpenSSL addresses each of these stores using a URI. I have added support for this to mod_ssl here: https://github.com/apache/httpd/pull/698 There are a series of new directives, for example in addition to SSLCertificateFile and SSLCertificatePath we have SSLCertificateURI. The URI directives are a completely clean break from the legacy OpenSSL functions like PEM_X509_INFO_read_bio() and SSL_CTX_load_verify_locations() that have weird historical quirks and inconsistencies. OpenSSL's OSSL_STORE_open_ex() appears to be the one ring to rule them all. You can now point at a whole certificate store and the correct certificate will be selected and the correct chain added. You can use File and URI directives in the same config to load a cert/key pair from the one, a a cert/key pair from the other, but they don't interact with one another. The quirks are left to history. Regards, Graham --
