Help Center/ Object Storage Service/ SDK Reference/ C/ Initialization (SDK for C)/ Configuring Server-Side Certificate Verification
Updated on 2026-08-03 GMT+08:00
View PDF
Share

Configuring Server-Side Certificate Verification

If you have any questions during development, post them on the Issues page of GitHub.

OBS SDK for C supports server-side certificate verification to ensure that OBS is provided by the trusted server. To configure server-side verification, perform the following:

If the root certificate of the OBS server was issued by a certificate authority, skip steps 1 and 2. (Root certificates issued by certificate authorities are already in the certificate library of SDK for C.)

  1. Obtain the root certificate of the OBS server and save it as a file. For example, open the certificate from the lock icon in the address bar of a browser, view the details, and then export it. Alternatively, use certmgr.msc in Windows to open the certificate manager and export the certificate.
  2. Save the certificate file to the directory where the executable file is located. When OBS_DEFAULT_CERTIFICATE is used, the certificate file name must be client.pem in Linux and client.crt in Windows. When OBS_DEFINED_CERTIFICATE is used, you can specify any path through the path parameter when calling init_certificate_by_path.
  3. Applications use HTTPS to communicate with each other. For details about how to call the API, see Usage of HTTPS Service APIs.

Usage of HTTPS Service APIs

Method 1: Certificate path configuration (init_certificate_by_path)

You can call init_certificate_by_path before init_obs_options to implement HTTPS communication. The root certificate path can be specified by a parameter, or the default system certificate can be used.

Parameter description

Parameter

Type

Mandatory (Yes/No)

Description

protocol

obs_protocol

Yes

Protocol parameter. The value is OBS_PROTOCOL_HTTPS or OBS_PROTOCOL_HTTP.

ca_conf

obs_certificate_conf

Yes only when protocol is set to OBS_PROTOCOL_HTTPS

Certificate configuration policy. The value can be OBS_NO_CERTIFICATE, OBS_DEFAULT_CERTIFICATE, or OBS_DEFINED_CERTIFICATE.

path

char *

This parameter is optional. If ca_conf is set to OBS_DEFINED_CERTIFICATE, this parameter is mandatory.

Certificate path

path_length

int

This parameter is optional. If path is not set to NULL, this parameter is mandatory.

Certificate path length

Sample code

obs_options options;
obs_status ret_status;
// Example 1: HTTP is used for communication and the certificate is not verified.
ret_status = init_certificate_by_path(OBS_PROTOCOL_HTTP, OBS_NO_CERTIFICATE, NULL, 0);
if (OBS_STATUS_OK != ret_status)
{
    printf("init_certificate_by_path failed(%s).\n", obs_get_status_name(ret_status));
    return -1;
}
init_obs_options(&options);
// Example 2: HTTPS is used for communication and the default certificate (client.pem in the lib directory) is used.
ret_status = init_certificate_by_path(OBS_PROTOCOL_HTTPS, OBS_DEFAULT_CERTIFICATE, NULL, 0);
if (OBS_STATUS_OK != ret_status)
{
    printf("init_certificate_by_path failed(%s).\n", obs_get_status_name(ret_status));
    return -1;
}
init_obs_options(&options);
// Example 3: HTTPS is used for communication and the certificate path is specified.
const char *cert_path = "/path/to/obs.cer";
ret_status = init_certificate_by_path(OBS_PROTOCOL_HTTPS, OBS_DEFINED_CERTIFICATE, cert_path, strlen(cert_path));
if (OBS_STATUS_OK != ret_status)
{
    printf("init_certificate_by_path failed(%s).\n", obs_get_status_name(ret_status));
    return -1;
}
init_obs_options(&options);

Method 2: Certificate content configuration (init_certificate_by_buffer)

You can call init_certificate_by_buffer before init_obs_options to implement HTTPS communication and then directly transfer the certificate content.

Parameter description

Parameter

Type

Mandatory (Yes/No)

Description

buffer

char *

Mandatory

Certificate content

buffer_length

int

Mandatory

The length of the certificate content

Sample code

obs_options options;
obs_status ret_status;
// Read the certificate content to the buffer. (The reading logic is omitted in this example.)
const char *ca_buffer = "...";  // Certificate content
int buffer_length = strlen(ca_buffer);
ret_status = init_certificate_by_buffer(ca_buffer, buffer_length);
if (OBS_STATUS_OK != ret_status)
{
    printf("init_certificate_by_buffer failed(%s).\n", obs_get_status_name(ret_status));
    return -1;
}
init_obs_options(&options);