From faa4a10ebe5095765262c0e3c711fca08026c3d4 Mon Sep 17 00:00:00 2001 From: Richard Levitte Date: Wed, 17 Apr 2024 11:31:31 +0200 Subject: [PATCH] OSSL_STORE: Add reference docs for the built-in Windows store implementation Fixes openssl/project#422 Reviewed-by: Matt Caswell Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24170) --- doc/build.info | 6 +++ doc/man7/OSSL_PROVIDER-base.pod | 4 +- doc/man7/OSSL_PROVIDER-default.pod | 4 +- doc/man7/OSSL_STORE-winstore.pod | 86 ++++++++++++++++++++++++++++++ 4 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 doc/man7/OSSL_STORE-winstore.pod diff --git a/doc/build.info b/doc/build.info index b4815fcf23..326c4ea34b 100644 --- a/doc/build.info +++ b/doc/build.info @@ -4701,6 +4701,10 @@ DEPEND[html/man7/OSSL_PROVIDER-null.html]=man7/OSSL_PROVIDER-null.pod GENERATE[html/man7/OSSL_PROVIDER-null.html]=man7/OSSL_PROVIDER-null.pod DEPEND[man/man7/OSSL_PROVIDER-null.7]=man7/OSSL_PROVIDER-null.pod GENERATE[man/man7/OSSL_PROVIDER-null.7]=man7/OSSL_PROVIDER-null.pod +DEPEND[html/man7/OSSL_STORE-winstore.html]=man7/OSSL_STORE-winstore.pod +GENERATE[html/man7/OSSL_STORE-winstore.html]=man7/OSSL_STORE-winstore.pod +DEPEND[man/man7/OSSL_STORE-winstore.7]=man7/OSSL_STORE-winstore.pod +GENERATE[man/man7/OSSL_STORE-winstore.7]=man7/OSSL_STORE-winstore.pod DEPEND[html/man7/RAND.html]=man7/RAND.pod GENERATE[html/man7/RAND.html]=man7/RAND.pod DEPEND[man/man7/RAND.7]=man7/RAND.pod @@ -5023,6 +5027,7 @@ html/man7/OSSL_PROVIDER-base.html \ html/man7/OSSL_PROVIDER-default.html \ html/man7/OSSL_PROVIDER-legacy.html \ html/man7/OSSL_PROVIDER-null.html \ +html/man7/OSSL_STORE-winstore.html \ html/man7/RAND.html \ html/man7/RSA-PSS.html \ html/man7/X25519.html \ @@ -5166,6 +5171,7 @@ man/man7/OSSL_PROVIDER-base.7 \ man/man7/OSSL_PROVIDER-default.7 \ man/man7/OSSL_PROVIDER-legacy.7 \ man/man7/OSSL_PROVIDER-null.7 \ +man/man7/OSSL_STORE-winstore.7 \ man/man7/RAND.7 \ man/man7/RSA-PSS.7 \ man/man7/X25519.7 \ diff --git a/doc/man7/OSSL_PROVIDER-base.pod b/doc/man7/OSSL_PROVIDER-base.pod index 24d610f28c..93a9029fd6 100644 --- a/doc/man7/OSSL_PROVIDER-base.pod +++ b/doc/man7/OSSL_PROVIDER-base.pod @@ -140,7 +140,7 @@ combination with the FIPS provider. =item file -=item org.openssl.winstore +=item org.openssl.winstore, see L =back @@ -158,7 +158,7 @@ This functionality was added in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/OSSL_PROVIDER-default.pod b/doc/man7/OSSL_PROVIDER-default.pod index feba00aa76..edfd80d354 100644 --- a/doc/man7/OSSL_PROVIDER-default.pod +++ b/doc/man7/OSSL_PROVIDER-default.pod @@ -358,7 +358,7 @@ combination with the FIPS provider. =item file -=item org.openssl.winstore +=item org.openssl.winstore, see L =back @@ -378,7 +378,7 @@ All other functionality was added in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/OSSL_STORE-winstore.pod b/doc/man7/OSSL_STORE-winstore.pod new file mode 100644 index 0000000000..f25a27e201 --- /dev/null +++ b/doc/man7/OSSL_STORE-winstore.pod @@ -0,0 +1,86 @@ +=pod + +=head1 NAME + +OSSL_STORE-winstore - OpenSSL built in OSSL_STORE for Windows + +=head1 DESCRIPTION + +The OSSL_STORE implementation for Windows provides access to Windows' system +C certificate store through URIs, using the URI scheme +C. + +=head2 Supported URIs + +There is only one supported URI: + + org.openssl.winstore: + +No authority (host, etc), no path, no query, no fragment. + +=head2 Supported OSSL_STORE_SEARCH operations + +=over 4 + +=item L + +As a matter of fact, this must be used. It is not possible to enumerate all +available certificates in the store. + +=back + +=head2 Windows certificate store features + +Apart from diverse constraints present in the certificates themselves, the +Windows certificate store also has the ability to associate additional +constraining properties alongside a certificate in the store. This includes +both documented and undocumented capabilities: + +=over 4 + +=item * + +The documented capability to override EKU + +=item * + +The undocumented capability to add name constraints + +=item * + +The undocumented capability to override the certificate expiry date + +=back + +I. + +However, once extracted with L, certificates that have +constraints in their X.509 extensions will go through the usual constraint +checks when used by OpenSSL, and are thereby honoured. + +=head1 SEE ALSO + +L, L, L + +=head1 HISTORY + +The winstore (C) implementation was added in OpenSSL +3.2.0. + +=head1 NOTES + +OpenSSL uses L implementations under the hood. +To influence what L implementations are used, it's advisable +to use L and set the I argument. + +=head1 COPYRIGHT + +Copyright 2024 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut