Commit 33ed820ea7 for openssl.org

commit 33ed820ea765ba13044c51328c400acd7b3faa37
Author: Dr. David von Oheimb <dev@ddvo.net>
Date:   Sat Apr 26 15:20:00 2025 +0200

    doc/man3: fix doc of uri parameters of X509_LOOKUP_add_store{,_ex}() etc: filenames are allowed as well

    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Simo Sorce <simo@redhat.com>
    MergeDate: Thu Sep 10 13:32:52 2026
    (Merged from https://github.com/openssl/openssl/pull/27507)

diff --git a/doc/man3/X509_LOOKUP.pod b/doc/man3/X509_LOOKUP.pod
index cabab4a3fa..7f5178af9c 100644
--- a/doc/man3/X509_LOOKUP.pod
+++ b/doc/man3/X509_LOOKUP.pod
@@ -116,16 +116,18 @@ L<X509_LOOKUP_file(3)>.
 X509_LOOKUP_load_file() is similar to X509_LOOKUP_load_file_ex() but
 uses NULL for the library context I<libctx> and property query I<propq>.

-X509_LOOKUP_add_dir() passes a directory specification from which
-certificates and CRLs are loaded on demand into the associated
-B<X509_STORE>.
+X509_LOOKUP_add_dir() adds to the given store lookup list I<ctx>
+a directory specification, from which trusted certificates and CRLs
+may be looked up later on demand,
+typically when building a certificate chain or verifying a certificate.
 I<type> indicates what type of object is expected.
 This can only be used with a lookup using the implementation
 L<X509_LOOKUP_hash_dir(3)>.

-X509_LOOKUP_add_store_ex() passes a URI for a directory-like or file-like
-structure from which containers with certificates and CRLs are loaded on demand
-into the associated B<X509_STORE>. The library context I<libctx> and property
+X509_LOOKUP_add_store_ex() adds to the given store lookup list I<ctx>
+a URI or filename for a directory-like or file-like structure. As with
+X509_LOOKUP_add_dir(), certificates and CRLs will be loaded only on demand.
+The library context I<libctx> and property
 query I<propq> are used when fetching algorithms from providers.
 If I<uri> is not NULL, it must be a URI to a store, which may
 represent a single container or a whole catalogue of containers.
diff --git a/doc/man3/X509_STORE_add_cert.pod b/doc/man3/X509_STORE_add_cert.pod
index cb083dc1d0..ca447213e6 100644
--- a/doc/man3/X509_STORE_add_cert.pod
+++ b/doc/man3/X509_STORE_add_cert.pod
@@ -102,16 +102,18 @@ query I<propq> are used when fetching algorithms from providers.
 X509_STORE_load_file() is similar to X509_STORE_load_file_ex() but
 uses NULL for the library context I<libctx> and property query I<propq>.

-X509_STORE_load_path() sets in B<X509_STORE> the given directory with
-certificate files in PEM format as source of trusted certificate(s).
-The certificate files in I<dir> are only looked up when required, e.g., when
-building the certificate chain or when verifying a peer certificate.
+X509_STORE_load_path() adds to B<X509_STORE> the given directory, which should
+contain certificate files in PEM format, as a source of trusted certificates.
+The certificate files in I<dir> are only looked up when required,
+typically on building a certificate chain when verifying a certificate.
 The certificates in the directory must be in hashed form, as
 documented in L<X509_LOOKUP_hash_dir(3)>.
 Use the L<openssl-rehash(1)> utility to create the necessary links.

-X509_STORE_load_store_ex() loads trusted certificate(s) into an B<X509_STORE>
-from a given URI. The library context I<libctx> and
+X509_STORE_load_store_ex() adds to the given B<X509_STORE> a URI or filename
+for a directory-like or file-like structure. As with X509_STORE_load_path(),
+the trusted certificates that may be found there will be loaded only on demand.
+The library context I<libctx> and
 property query I<propq> are used when fetching algorithms from providers.
 I<uri> must not be NULL. It must be a URI to a store, which may
 represent a single container or a whole catalogue of containers.