Re: Using certificates and keys from a list

On Sun, Apr 05, 2026 at 01:06:29PM -0700, Doug Hardie wrote:

> >> then read them into that memory and use a table of those addresses.
> >> Then use SSL_use_certificate(SSL *ssl, X509 *x) to load the
> >> certificate into the SSL and then SSL_use_PrivateKey(SSL *ssl,
> >> EVP_PKEY *pkey) to load the key?  It seems like I am missing
> >> something.

The pkey_type data flow is bit non-obvious, the NID stays NID_undef for
PKCS#8 keys (the norm), which can be decoded generically, otherwise it
is set to a type-specific NID for type-specific PEM encodings:

    https://github.com/vdukhovni/postfix/blob/250e75ebd980eafa3ed5f25e1d9d6=
a896b794c2e/postfix/src/tls/tls_certkey.c#L363-L370

    } else if (strcmp(name, PEM_STRING_PKCS8INF) =3D=3D 0
	       || ((pkey_type =3D EVP_PKEY_RSA) !=3D NID_undef
		   && strcmp(name, PEM_STRING_RSA) =3D=3D 0)
	       || ((pkey_type =3D EVP_PKEY_EC) !=3D NID_undef
		   && strcmp(name, PEM_STRING_ECPRIVATEKEY) =3D=3D 0)
	       || ((pkey_type =3D EVP_PKEY_DSA) !=3D NID_undef
		   && strcmp(name, PEM_STRING_DSA) =3D=3D 0)) {
	load_pkey(st, pkey_type, buf, buflen);

Those comparisons with `NID_undef` are assignments, the last one before
a strcmp() matches one wins.  Then in load_pkey() the NID is used to
either fall back to PKCS#8 or to pass to d2i_PrivateKey():

    https://github.com/vdukhovni/postfix/blob/250e75ebd980eafa3ed5f25e1d9d6=
a896b794c2e/postfix/src/tls/tls_certkey.c#L258-L266

    if (pkey_type !=3D NID_undef) {
	pkey =3D d2i_PrivateKey(pkey_type, 0, &p, buflen);
    } else {
	p8 =3D d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, buflen);
	if (p8) {
	    pkey =3D EVP_PKCS82PKEY(p8);
	    PKCS8_PRIV_KEY_INFO_free(p8);
	}
    }

--=20
    Viktor.  =F0=9F=87=BA=F0=9F=87=A6 =D0=A1=D0=BB=D0=B0=D0=B2=D0=B0 =D0=A3=
=D0=BA=D1=80=D0=B0=D1=97=D0=BD=D1=96!

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/adLGxl8egdOmdCjf%40chardros.imrryr.org.