---
name: "libressl-SSL_load_client_CA_file"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_load_client_CA_file"
---

# libressl-SSL\_load\_client\_CA\_file(3)

load certificate names from files

## NAME

**SSL\_load\_client\_CA\_file**, **SSL\_add\_file\_cert\_subjects\_to\_stack**, **SSL\_add\_dir\_cert\_subjects\_to\_stack** – load certificate names from files

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*STACK\_OF(X509\_NAME)* *\**\

**SSL\_load\_client\_CA\_file**(*const char \*file*);

*int*\

**SSL\_add\_file\_cert\_subjects\_to\_stack**(*STACK\_OF(X509\_NAME) \*stack*, *const char \*file*);

*int*\

**SSL\_add\_dir\_cert\_subjects\_to\_stack**(*STACK\_OF(X509\_NAME) \*stack*, *const char \*dir*);

## DESCRIPTION

**SSL\_load\_client\_CA\_file**() reads PEM formatted certificates from *file* and returns a new *STACK\_OF(X509\_NAME)* with the subject names found. While the name suggests the specific usage as a support function for SSL\_CTX\_set\_client\_CA\_list(3), it is not limited to CA certificates.

**SSL\_add\_file\_cert\_subjects\_to\_stack**() is similar except that the names are added to the existing *stack*.

**SSL\_add\_dir\_cert\_subjects\_to\_stack**() calls **SSL\_add\_file\_cert\_subjects\_to\_stack**() on every file in the directory *dir*.

If a name is already on the stack, all these functions skip it and do not add it again.

## RETURN VALUES

**SSL\_load\_client\_CA\_file**() returns a pointer to the new *STACK\_OF(X509\_NAME)* or NULL on failure.

**SSL\_add\_file\_cert\_subjects\_to\_stack**() and **SSL\_add\_dir\_cert\_subjects\_to\_stack**() return 1 for success or 0 for failure.

All these functions treat empty files and directories as failures.

In some cases of failure, the reason can be determined with ERR\_get\_error(3).

## EXAMPLES

Load names of CAs from a file and use it as a client CA list:

```
SSL_CTX *ctx;
STACK_OF(X509_NAME) *cert_names;
...
cert_names = SSL_load_client_CA_file("/path/to/CAfile.pem");
if (cert_names != NULL)
	SSL_CTX_set_client_CA_list(ctx, cert_names);
else
	error_handling();
...
```

## SEE ALSO

PEM\_read\_bio\_X509(3), [ssl(3)](/ssl/3.md), SSL\_CTX\_set\_client\_CA\_list(3), X509\_get\_subject\_name(3), X509\_NAME\_new(3)

## HISTORY

**SSL\_load\_client\_CA\_file**() first appeared in SSLeay 0.8.0 and has been available since OpenBSD 2.4.

**SSL\_add\_file\_cert\_subjects\_to\_stack**() and **SSL\_add\_dir\_cert\_subjects\_to\_stack**() first appeared in OpenSSL 0.9.2b and have been available since OpenBSD 2.6.

## AUTHORS

**SSL\_add\_file\_cert\_subjects\_to\_stack**() and **SSL\_add\_dir\_cert\_subjects\_to\_stack**() were written by Ben Laurie ⟨*ben@openssl.org*⟩ in 1999.

## BUGS

In some cases of failure, for example for empty files and directories, these functions fail to report an error, in the sense that ERR\_get\_error(3) does not work.

Even in case of failure, for example when parsing one of the files or certificates fails, **SSL\_add\_file\_cert\_subjects\_to\_stack**() and **SSL\_add\_dir\_cert\_subjects\_to\_stack**() may still have added some certificates to the stack.

The behaviour of **SSL\_add\_dir\_cert\_subjects\_to\_stack**() is non-deterministic. If parsing one file fails, parsing of the whole directory is aborted. Files in the directory are not parsed in any specific order. For example, adding an empty file to *dir* may or may not cause some of the other files to be ignored.