From: Richard Levitte Date: Wed, 17 Apr 2024 09:31:31 +0000 (+0200) Subject: OSSL_STORE: Add reference docs for the built-in Windows store implementation X-Git-Tag: openssl-3.4.0-alpha1~667 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=faa4a10ebe5095765262c0e3c711fca08026c3d4;p=thirdparty%2Fopenssl.git OSSL_STORE: Add reference docs for the built-in Windows store implementation Fixes openssl/project#422 Reviewed-by: Matt Caswell Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24170) --- diff --git a/doc/build.info b/doc/build.info index b4815fcf23a..326c4ea34bb 100644 --- a/doc/build.info +++ b/doc/build.info @@ -4701,6 +4701,10 @@ DEPEND[html/man7/OSSL_PROVIDER-null.html]=man7/OSSL_PROVIDER-null.pod GENERATE[html/man7/OSSL_PROVIDER-null.html]=man7/OSSL_PROVIDER-null.pod DEPEND[man/man7/OSSL_PROVIDER-null.7]=man7/OSSL_PROVIDER-null.pod GENERATE[man/man7/OSSL_PROVIDER-null.7]=man7/OSSL_PROVIDER-null.pod +DEPEND[html/man7/OSSL_STORE-winstore.html]=man7/OSSL_STORE-winstore.pod +GENERATE[html/man7/OSSL_STORE-winstore.html]=man7/OSSL_STORE-winstore.pod +DEPEND[man/man7/OSSL_STORE-winstore.7]=man7/OSSL_STORE-winstore.pod +GENERATE[man/man7/OSSL_STORE-winstore.7]=man7/OSSL_STORE-winstore.pod DEPEND[html/man7/RAND.html]=man7/RAND.pod GENERATE[html/man7/RAND.html]=man7/RAND.pod DEPEND[man/man7/RAND.7]=man7/RAND.pod @@ -5023,6 +5027,7 @@ html/man7/OSSL_PROVIDER-base.html \ html/man7/OSSL_PROVIDER-default.html \ html/man7/OSSL_PROVIDER-legacy.html \ html/man7/OSSL_PROVIDER-null.html \ +html/man7/OSSL_STORE-winstore.html \ html/man7/RAND.html \ html/man7/RSA-PSS.html \ html/man7/X25519.html \ @@ -5166,6 +5171,7 @@ man/man7/OSSL_PROVIDER-base.7 \ man/man7/OSSL_PROVIDER-default.7 \ man/man7/OSSL_PROVIDER-legacy.7 \ man/man7/OSSL_PROVIDER-null.7 \ +man/man7/OSSL_STORE-winstore.7 \ man/man7/RAND.7 \ man/man7/RSA-PSS.7 \ man/man7/X25519.7 \ diff --git a/doc/man7/OSSL_PROVIDER-base.pod b/doc/man7/OSSL_PROVIDER-base.pod index 24d610f28c2..93a9029fd6f 100644 --- a/doc/man7/OSSL_PROVIDER-base.pod +++ b/doc/man7/OSSL_PROVIDER-base.pod @@ -140,7 +140,7 @@ combination with the FIPS provider. =item file -=item org.openssl.winstore +=item org.openssl.winstore, see L =back @@ -158,7 +158,7 @@ This functionality was added in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/OSSL_PROVIDER-default.pod b/doc/man7/OSSL_PROVIDER-default.pod index feba00aa763..edfd80d3547 100644 --- a/doc/man7/OSSL_PROVIDER-default.pod +++ b/doc/man7/OSSL_PROVIDER-default.pod @@ -358,7 +358,7 @@ combination with the FIPS provider. =item file -=item org.openssl.winstore +=item org.openssl.winstore, see L =back @@ -378,7 +378,7 @@ All other functionality was added in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/OSSL_STORE-winstore.pod b/doc/man7/OSSL_STORE-winstore.pod new file mode 100644 index 00000000000..f25a27e2014 --- /dev/null +++ b/doc/man7/OSSL_STORE-winstore.pod @@ -0,0 +1,86 @@ +=pod + +=head1 NAME + +OSSL_STORE-winstore - OpenSSL built in OSSL_STORE for Windows + +=head1 DESCRIPTION + +The OSSL_STORE implementation for Windows provides access to Windows' system +C certificate store through URIs, using the URI scheme +C. + +=head2 Supported URIs + +There is only one supported URI: + + org.openssl.winstore: + +No authority (host, etc), no path, no query, no fragment. + +=head2 Supported OSSL_STORE_SEARCH operations + +=over 4 + +=item L + +As a matter of fact, this must be used. It is not possible to enumerate all +available certificates in the store. + +=back + +=head2 Windows certificate store features + +Apart from diverse constraints present in the certificates themselves, the +Windows certificate store also has the ability to associate additional +constraining properties alongside a certificate in the store. This includes +both documented and undocumented capabilities: + +=over 4 + +=item * + +The documented capability to override EKU + +=item * + +The undocumented capability to add name constraints + +=item * + +The undocumented capability to override the certificate expiry date + +=back + +I. + +However, once extracted with L, certificates that have +constraints in their X.509 extensions will go through the usual constraint +checks when used by OpenSSL, and are thereby honoured. + +=head1 SEE ALSO + +L, L, L + +=head1 HISTORY + +The winstore (C) implementation was added in OpenSSL +3.2.0. + +=head1 NOTES + +OpenSSL uses L implementations under the hood. +To influence what L implementations are used, it's advisable +to use L and set the I argument. + +=head1 COPYRIGHT + +Copyright 2024 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut