Re: Using certificates and keys from a list

=D0=92 Fri, 3 Apr 2026 21:17:41 -0700
Doug Hardie <[email protected]> =D0=BF=D0=B8=D1=88=D0=B5=D1=82:

> I have an application that needs to dynamically select the
> certificates and keys.  Currently I have it using

> SSL_use_certificate_file(ssl, file, SSL_FILETYPE_PEM) to read the
> certificate from a file and SSL_use_PrivateKey_file(ssl, file,
> SSL_FILETYPE_PEM) to access the keys from a table of  file names of
> the certificates and keys.  This works if the key files are world
> readable.  However, the application starts as root, and they switches
> to user nobody.  Hence it is then unable to access the keys if they
> are properly protected.

I recommend you to study source code of Apache Web Server. It has
similar workflow, and its code solves this problem and many others.


>=20
> The solution is to read the certificates and keys into memory while
> still running as root.  However, it is not obvious which SSL calls
> should be used.  Should I get the sizes of each, allocate memory and
> then read them into that memory and use a table of those addresses.
> Then use SSL_use_certificate(SSL *ssl, X509 *x) to load the
> certificate into the SSL and then SSL_use_PrivateKey(SSL *ssl,
> EVP_PKEY *pkey) to load the key?  It seems like I am missing
> something.
>=20
> -- Doug
>=20



--=20
                                   Victor Wagner <[email protected]>

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/20260404094942.782558eb%40wagner.wagner.home.