X509\_STORE\_NEW(3ossl) OpenSSL X509\_STORE\_NEW(3ossl)

# [NAME](#NAME)

X509\_STORE\_new, X509\_STORE\_up\_ref, X509\_STORE\_free, X509\_STORE\_lock,X509\_STORE\_unlock - X509\_STORE allocation, freeing and locking functions

# [SYNOPSIS](#SYNOPSIS)

```
 #include <openssl/x509_vfy.h>
 X509_STORE *X509_STORE_new(void);
 void X509_STORE_free(X509_STORE *xs);
 int X509_STORE_lock(X509_STORE *xs);
 int X509_STORE_unlock(X509_STORE *xs);
 int X509_STORE_up_ref(X509_STORE *xs);
```

# [DESCRIPTION](#DESCRIPTION)

The **X509\_STORE\_new()** function returns a new X509\_STORE.

**X509\_STORE\_up\_ref()** increments the reference count associated with the X509\_STORE object.

**X509\_STORE\_lock()** locks the store from reads and writes by other threads, and **X509\_STORE\_unlock()** unlocks it. Not all operations require locking the store, see the notes on thread safety below.

**X509\_STORE\_free()** decrements the reference count of the X509\_STORE object. The store's memory is only freed when its reference count drops to zero. If the argument is NULL, nothing is done.

# [NOTES](#NOTES)

## [Thread Safety](#Thread_Safety)

When an **X509\_STORE** is shared across multiple threads, each thread or component that holds a pointer to it should call **X509\_STORE\_up\_ref()** to acquire a reference, and release the reference with **X509\_STORE\_free()** when done.

Adding certificates or CRLs, for example [**X509\_STORE\_add\_cert**(3)](/man/os/openssl-4.0/X509_STORE_add_cert.3) or [**X509\_STORE\_add\_crl**(3)](/man/os/openssl-4.0/X509_STORE_add_crl.3), as well as looking up objects from the cache with [**X509\_STORE\_CTX\_get\_by\_subject**(3)](/man/os/openssl-4.0/X509_STORE_CTX_get_by_subject.3) are safe to call concurrently from multiple threads on the same store without external synchronization, provided the ownership to the X509\_STORE is obtained by acquiring a reference in advance.

Store *configuration* functions (**X509\_STORE\_set\_flags()**, **X509\_STORE\_set\_depth()**, **X509\_STORE\_set\_purpose()**, **X509\_STORE\_set\_trust()**, and similar) are **not** safe to call concurrently with any other operation on the same store; the store must be fully configured before being shared with other threads.

One useful pattern is having a single owner thread that calls **X509\_STORE\_free()** only after joining with all threads that use the store.

# [RETURN VALUES](#RETURN_VALUES)

**X509\_STORE\_new()** returns a newly created X509\_STORE or NULL if the call fails.

**X509\_STORE\_up\_ref()**, **X509\_STORE\_lock()** and **X509\_STORE\_unlock()** return 1 for success and 0 for failure.

**X509\_STORE\_free()** does not return values.

# [SEE ALSO](#SEE_ALSO)

[**X509\_STORE\_set\_verify\_cb\_func**(3)](/man/os/openssl-4.0/X509_STORE_set_verify_cb_func.3) [**X509\_STORE\_get0\_param**(3)](/man/os/openssl-4.0/X509_STORE_get0_param.3)

# [HISTORY](#HISTORY)

The **X509\_STORE\_up\_ref()**, **X509\_STORE\_lock()** and **X509\_STORE\_unlock()** functions were added in OpenSSL 1.1.0.

# [COPYRIGHT](#COPYRIGHT)

Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at &lt;https://www.openssl.org/source/license.html&gt;.

2026-09-29 4.0.3

---

Document: X509_STORE_lock(3ossl) from openssl-4.0 4.0.3-r8 (Chainguard OS)