Re: Using certificates and keys from a list

> On Apr 3, 2026, at 21:17, Doug Hardie <[email protected]> wrote:
>=20
> I have an application that needs to dynamically select the certificates a=
nd keys.  Currently I have it using SSL_use_certificate_file(ssl, file, SSL=
_FILETYPE_PEM) to read the certificate from a file and SSL_use_PrivateKey_f=
ile(ssl, file, SSL_FILETYPE_PEM) to access the keys from a table of  file n=
ames of the certificates and keys.  This works if the key files are world r=
eadable.  However, the application starts as root, and they switches to use=
r nobody.  Hence it is then unable to access the keys if they are properly =
protected.
>=20
> The solution is to read the certificates and keys into memory while still=
 running as root.  However, it is not obvious which SSL calls should be use=
d.  Should I get the sizes of each, allocate memory and then read them into=
 that memory and use a table of those addresses.  Then use SSL_use_certific=
ate(SSL *ssl, X509 *x) to load the certificate into the SSL and then SSL_us=
e_PrivateKey(SSL *ssl, EVP_PKEY *pkey) to load the key?  It seems like I am=
 missing something.
>=20

Should have included that the certificates are chains containing the server=
 certificate and the intermediate certificates.

-- Doug

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/3C5771CD-E73F-49E5-980A-C816342169F9%40lafn.org.