Re: Using certificates and keys from a list

On Fri, Apr 03, 2026 at 09:17:41PM -0700, Doug Hardie wrote:

> The solution is to read the certificates and keys into memory while
> still running as root.  However, it is not obvious which SSL calls
> should be used.  Should I get the sizes of each, allocate memory and
> then read them into that memory and use a table of those addresses.
> Then use SSL_use_certificate(SSL *ssl, X509 *x) to load the
> certificate into the SSL and then SSL_use_PrivateKey(SSL *ssl,
> EVP_PKEY *pkey) to load the key?  It seems like I am missing
> something.

The functions you're looking for are SSL_CTX_use_cert_and_key(3) and
SSL_use_cert_and_key(3).

  int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x, EVP_PKEY *pkey, STACK=
_OF(X509) *chain, int override);
  int SSL_use_cert_and_key(SSL *ssl, X509 *x, EVP_PKEY *pkey, STACK_OF(X509=
) *chain, int override);

These operate on already decoded keys, certificates and CA certificate
chains.  This has been in use in Postfix for some time:

    https://github.com/vdukhovni/postfix/blob/250e75ebd980eafa3ed5f25e1d9d6=
a896b794c2e/postfix/src/tls/tls_certkey.c#L152-L181

In general the Postfix src/tls directory is a good source of clear
examples of correct OpenSSL usage.  You can start with tls_server.c
and tls_client.c, and then follow the call chain into supporting
code.

--=20
    Viktor.  =F0=9F=87=BA=F0=9F=87=A6 =D0=A1=D0=BB=D0=B0=D0=B2=D0=B0 =D0=A3=
=D0=BA=D1=80=D0=B0=D1=97=D0=BD=D1=96!

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/adCXhM-IOd0NUYGF%40chardros.imrryr.org.