Re: Using certificates and keys from a list

> On Apr 3, 2026, at 21:45, Viktor Dukhovni <[email protected]> wr=
ote:
>=20
> On Fri, Apr 03, 2026 at 09:17:41PM -0700, Doug Hardie wrote:
>=20
>> The solution is to read the certificates and keys into memory while
>> still running as root.  However, it is not obvious which SSL calls
>> should be used.  Should I get the sizes of each, allocate memory and
>> then read them into that memory and use a table of those addresses.
>> Then use SSL_use_certificate(SSL *ssl, X509 *x) to load the
>> certificate into the SSL and then SSL_use_PrivateKey(SSL *ssl,
>> EVP_PKEY *pkey) to load the key?  It seems like I am missing
>> something.
>=20
> The functions you're looking for are SSL_CTX_use_cert_and_key(3) and
> SSL_use_cert_and_key(3).
>=20
>  int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x, EVP_PKEY *pkey, STAC=
K_OF(X509) *chain, int override);
>  int SSL_use_cert_and_key(SSL *ssl, X509 *x, EVP_PKEY *pkey, STACK_OF(X50=
9) *chain, int override);
>=20
> These operate on already decoded keys, certificates and CA certificate
> chains.  This has been in use in Postfix for some time:
>=20
>    https://github.com/vdukhovni/postfix/blob/250e75ebd980eafa3ed5f25e1d9d=
6a896b794c2e/postfix/src/tls/tls_certkey.c#L152-L181
>=20
> In general the Postfix src/tls directory is a good source of clear
> examples of correct OpenSSL usage.  You can start with tls_server.c
> and tls_client.c, and then follow the call chain into supporting
> code.
>=20

Should have known that would be the case.  I tried chasing down apache, but=
 it is just too convoluted to figure out quickly.  I believe I now have the=
 cert and key handled correctly.  Still have to work on the chain.  However=
, I did notice in load_pem_object that pkey_type is defined with initial va=
lue NID_undef.  I can't find anywhere that is changed, but yet it is tested=
 for a variety of different values.  I am looking at the source for postfix=
-3.10.2.  Did I miss something?

-- Doug


--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/C87E8645-52B2-4EEB-8F44-CFAB720255D3%40sermon-archive.info=
.