summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjmc <>2016-12-03 13:36:03 +0000
committerjmc <>2016-12-03 13:36:03 +0000
commit767bff4409ce6a123bd88bf933cd119b0224b542 (patch)
treea73acb78b90989de6c4e159825f7290f7f3e87b0
parent23857f34c1e1f6362c4594df7a9ebaaaad450986 (diff)
downloadopenbsd-767bff4409ce6a123bd88bf933cd119b0224b542.tar.gz
openbsd-767bff4409ce6a123bd88bf933cd119b0224b542.tar.bz2
openbsd-767bff4409ce6a123bd88bf933cd119b0224b542.zip
various cleanup;
-rw-r--r--src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.318
-rw-r--r--src/lib/libcrypto/man/X509_NAME_get_index_by_NID.310
-rw-r--r--src/lib/libcrypto/man/X509_NAME_print_ex.320
-rw-r--r--src/lib/libcrypto/man/X509_STORE_CTX_get_error.320
-rw-r--r--src/lib/libcrypto/man/X509_STORE_CTX_new.312
-rw-r--r--src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.310
-rw-r--r--src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.318
-rw-r--r--src/lib/libcrypto/man/X509_new.38
-rw-r--r--src/lib/libcrypto/man/X509_verify_cert.39
-rw-r--r--src/lib/libcrypto/man/bn_dump.320
-rw-r--r--src/lib/libcrypto/man/crypto.312
11 files changed, 77 insertions, 80 deletions
diff --git a/src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 b/src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3
index b83ac6d478..3c3348135b 100644
--- a/src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3
+++ b/src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: X509_NAME_add_entry_by_txt.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_NAME_add_entry_by_txt.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_NAME_ADD_ENTRY_BY_TXT 3 4.Dt X509_NAME_ADD_ENTRY_BY_TXT 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -81,7 +81,7 @@ which can either be a definition of the type of
81.Fa bytes 81.Fa bytes
82(such as 82(such as
83.Dv MBSTRING_ASC ) 83.Dv MBSTRING_ASC )
84or a standard ASN1 type (such as 84or a standard ASN.1 type (such as
85.Dv V_ASN1_IA5STRING ) . 85.Dv V_ASN1_IA5STRING ) .
86The new entry is added to a position determined by 86The new entry is added to a position determined by
87.Fa loc 87.Fa loc
@@ -89,7 +89,7 @@ and
89.Fa set . 89.Fa set .
90.Pp 90.Pp
91.Fn X509_NAME_add_entry 91.Fn X509_NAME_add_entry
92adds a copy of a 92adds a copy of an
93.Vt X509_NAME_ENTRY 93.Vt X509_NAME_ENTRY
94structure 94structure
95.Fa ne 95.Fa ne
@@ -124,7 +124,7 @@ field and to apply length checks according to the relevant standards.
124This is done using 124This is done using
125.Xr ASN1_STRING_set_by_NID 3 . 125.Xr ASN1_STRING_set_by_NID 3 .
126.Pp 126.Pp
127If instead an ASN1 type is used, no checks are performed and the supplied 127If instead an ASN.1 type is used, no checks are performed and the supplied
128data in 128data in
129.Fa bytes 129.Fa bytes
130is used directly. 130is used directly.
@@ -162,7 +162,7 @@ If
162.Fa set 162.Fa set
163is -1 or 1 it is added to the previous or next RDN structure 163is -1 or 1 it is added to the previous or next RDN structure
164respectively. 164respectively.
165This will then be a multivalued RDN: since multivalues RDNs are very 165This will then be a multivalued RDN: since multivalue RDNs are very
166seldom used, 166seldom used,
167.Fa set 167.Fa set
168is almost always set to zero. 168is almost always set to zero.
@@ -184,9 +184,9 @@ if an error occurred.
184Create an 184Create an
185.Vt X509_NAME 185.Vt X509_NAME
186structure: 186structure:
187.Pp 187.Bd -literal -offset indent
188.D1 C=UK, O=Disorganized Organization, CN=Joe Bloggs 188C=UK, O=Disorganized Organization, CN=Joe Bloggs
189.Bd -literal 189
190X509_NAME *nm; 190X509_NAME *nm;
191nm = X509_NAME_new(); 191nm = X509_NAME_new();
192if (nm == NULL) 192if (nm == NULL)
diff --git a/src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 b/src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3
index efd74f07e9..fdf8bb1a81 100644
--- a/src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3
+++ b/src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3
@@ -1,13 +1,13 @@
1.\" $OpenBSD: X509_NAME_get_index_by_NID.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_NAME_get_index_by_NID.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_NAME_GET_INDEX_BY_NID 3 4.Dt X509_NAME_GET_INDEX_BY_NID 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
7.Nm X509_NAME_get_index_by_NID , 7.Nm X509_NAME_get_index_by_NID ,
8.Nm X509_NAME_get_index_by_OBJ , 8.Nm X509_NAME_get_index_by_OBJ ,
9.Nm X509_NAME_get_entry ,
10.Nm X509_NAME_entry_count , 9.Nm X509_NAME_entry_count ,
10.Nm X509_NAME_get_entry ,
11.Nm X509_NAME_get_text_by_NID , 11.Nm X509_NAME_get_text_by_NID ,
12.Nm X509_NAME_get_text_by_OBJ 12.Nm X509_NAME_get_text_by_OBJ
13.Nd X509_NAME lookup and enumeration functions 13.Nd X509_NAME lookup and enumeration functions
@@ -56,8 +56,8 @@ The
56.Vt X509_NAME 56.Vt X509_NAME
57structure is the same as the 57structure is the same as the
58.Sy Name 58.Sy Name
59type defined in RFC2459 (and elsewhere) and used for example in 59type defined in RFC 2459 (and elsewhere) and used, for example,
60certificate subject and issuer names. 60in certificate subject and issuer names.
61.Pp 61.Pp
62.Fn X509_NAME_get_index_by_NID 62.Fn X509_NAME_get_index_by_NID
63and 63and
diff --git a/src/lib/libcrypto/man/X509_NAME_print_ex.3 b/src/lib/libcrypto/man/X509_NAME_print_ex.3
index 6692765c99..54f08511f1 100644
--- a/src/lib/libcrypto/man/X509_NAME_print_ex.3
+++ b/src/lib/libcrypto/man/X509_NAME_print_ex.3
@@ -1,13 +1,13 @@
1.\" $OpenBSD: X509_NAME_print_ex.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_NAME_print_ex.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_NAME_PRINT_EX 3 4.Dt X509_NAME_PRINT_EX 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
7.Nm X509_NAME_print_ex , 7.Nm X509_NAME_print_ex ,
8.Nm X509_NAME_print_ex_fp , 8.Nm X509_NAME_print_ex_fp ,
9.Nm X509_NAME_print , 9.Nm X509_NAME_oneline ,
10.Nm X509_NAME_oneline 10.Nm X509_NAME_print
11.Nd X509_NAME printing routines 11.Nd X509_NAME printing routines
12.Sh SYNOPSIS 12.Sh SYNOPSIS
13.In openssl/x509.h 13.In openssl/x509.h
@@ -90,8 +90,8 @@ The functions
90.Fn X509_NAME_oneline 90.Fn X509_NAME_oneline
91and 91and
92.Fn X509_NAME_print 92.Fn X509_NAME_print
93are legacy functions which produce a non standard output form. 93are legacy functions which produce a non-standard output form.
94They don't handle multi character fields and have various quirks 94They don't handle multi-character fields and have various quirks
95and inconsistencies. 95and inconsistencies.
96Their use is strongly discouraged in new applications. 96Their use is strongly discouraged in new applications.
97.Pp 97.Pp
@@ -149,9 +149,9 @@ The fields
149and 149and
150.Dv XN_FLAG_FN_NONE 150.Dv XN_FLAG_FN_NONE
151determine how a field name is displayed. 151determine how a field name is displayed.
152It will use the short name (e.g. CN) the long name (e.g. commonName) 152It will use the short name (e.g. CN), the long name (e.g. commonName),
153always use OID numerical form (normally OIDs are only used if the 153always use OID numerical form (normally OIDs are only used if the
154field name is not recognised) and no field name respectively. 154field name is not recognised) and no field name, respectively.
155.Pp 155.Pp
156If 156If
157.Dv XN_FLAG_SPC_EQ 157.Dv XN_FLAG_SPC_EQ
@@ -173,10 +173,10 @@ Additionally, all the options supported by
173.Xr ASN1_STRING_print_ex 3 173.Xr ASN1_STRING_print_ex 3
174can be used to control how each field value is displayed. 174can be used to control how each field value is displayed.
175.Pp 175.Pp
176In addition a number options can be set for commonly used formats. 176In addition a number of options can be set for commonly used formats.
177.Pp 177.Pp
178.Dv XN_FLAG_RFC2253 178.Dv XN_FLAG_RFC2253
179sets options which produce an output compatible with RFC2253. 179sets options which produce an output compatible with RFC 2253.
180It is equivalent to 180It is equivalent to
181.Dv ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV | 181.Dv ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV |
182.Dv XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS . 182.Dv XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS .
diff --git a/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3 b/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
index 85b7ac06f0..36f153af5a 100644
--- a/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
+++ b/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: X509_STORE_CTX_get_error.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_STORE_CTX_get_error.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_STORE_CTX_GET_ERROR 3 4.Dt X509_STORE_CTX_GET_ERROR 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -86,7 +86,7 @@ successful, the returned chain may be incomplete or invalid.
86The returned chain persists after the 86The returned chain persists after the
87.Fa ctx 87.Fa ctx
88structure is freed. 88structure is freed.
89When it is no longer needed, it should be free up using 89When it is no longer needed, it should be freed up using
90.Fn sk_X509_pop_free chain X509_free . 90.Fn sk_X509_pop_free chain X509_free .
91.Pp 91.Pp
92.Fn X509_verify_cert_error_string 92.Fn X509_verify_cert_error_string
@@ -144,8 +144,8 @@ The CRL of a certificate could not be found.
144 No unable to decrypt certificate's signature 144 No unable to decrypt certificate's signature
145The certificate signature could not be decrypted. 145The certificate signature could not be decrypted.
146This means that the actual signature value could not be determined 146This means that the actual signature value could not be determined
147rather than it not matching the expected value, this is only meaningful 147rather than it not matching the expected value.
148for RSA keys. 148This is only meaningful for RSA keys.
149.It Dv X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE : \ 149.It Dv X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE : \
150 No unable to decrypt CRL's signature 150 No unable to decrypt CRL's signature
151The CRL signature could not be decrypted: this means that the actual 151The CRL signature could not be decrypted: this means that the actual
@@ -219,7 +219,7 @@ The root CA is marked to reject the specified purpose.
219.It Dv X509_V_ERR_SUBJECT_ISSUER_MISMATCH : No subject issuer mismatch 219.It Dv X509_V_ERR_SUBJECT_ISSUER_MISMATCH : No subject issuer mismatch
220The current candidate issuer certificate was rejected because its 220The current candidate issuer certificate was rejected because its
221subject name did not match the issuer name of the current certificate. 221subject name did not match the issuer name of the current certificate.
222This is only set if issuer check debugging is enabled it is used for 222This is only set if issuer check debugging is enabled; it is used for
223status notification and is 223status notification and is
224.Sy not 224.Sy not
225in itself an error. 225in itself an error.
@@ -228,7 +228,7 @@ in itself an error.
228The current candidate issuer certificate was rejected because its 228The current candidate issuer certificate was rejected because its
229subject key identifier was present and did not match the authority key 229subject key identifier was present and did not match the authority key
230identifier current certificate. 230identifier current certificate.
231This is only set if issuer check debugging is enabled it is used for 231This is only set if issuer check debugging is enabled; it is used for
232status notification and is 232status notification and is
233.Sy not 233.Sy not
234in itself an error. 234in itself an error.
@@ -237,7 +237,7 @@ in itself an error.
237The current candidate issuer certificate was rejected because its issuer 237The current candidate issuer certificate was rejected because its issuer
238name and serial number was present and did not match the authority key 238name and serial number was present and did not match the authority key
239identifier of the current certificate. 239identifier of the current certificate.
240This is only set if issuer check debugging is enabled it is used for 240This is only set if issuer check debugging is enabled; it is used for
241status notification and is 241status notification and is
242.Sy not 242.Sy not
243in itself an error. 243in itself an error.
@@ -259,7 +259,7 @@ A certificate policies extension had an invalid value (for example an
259incorrect encoding) or some value inconsistent with other extensions. 259incorrect encoding) or some value inconsistent with other extensions.
260This error only occurs if policy processing is enabled. 260This error only occurs if policy processing is enabled.
261.It Dv X509_V_ERR_NO_EXPLICIT_POLICY : No no explicit policy 261.It Dv X509_V_ERR_NO_EXPLICIT_POLICY : No no explicit policy
262The verification flags were set to require and explicit policy but none 262The verification flags were set to require an explicit policy but none
263was present. 263was present.
264.It Dv X509_V_ERR_DIFFERENT_CRL_SCOPE : No different CRL scope 264.It Dv X509_V_ERR_DIFFERENT_CRL_SCOPE : No different CRL scope
265The only CRLs that could be found did not match the scope of the 265The only CRLs that could be found did not match the scope of the
@@ -284,7 +284,7 @@ types.
284.It Dv X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX : \ 284.It Dv X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX : \
285 No unsupported or invalid name constraint syntax 285 No unsupported or invalid name constraint syntax
286The format of the name constraint is not recognised: for example an 286The format of the name constraint is not recognised: for example an
287email address format of a form not mentioned in RFC3280. 287email address format of a form not mentioned in RFC 3280.
288This could be caused by a garbage extension or some new feature not 288This could be caused by a garbage extension or some new feature not
289currently supported. 289currently supported.
290.It Dv X509_V_ERR_CRL_PATH_VALIDATION_ERROR : No CRL path validation error 290.It Dv X509_V_ERR_CRL_PATH_VALIDATION_ERROR : No CRL path validation error
diff --git a/src/lib/libcrypto/man/X509_STORE_CTX_new.3 b/src/lib/libcrypto/man/X509_STORE_CTX_new.3
index ffb50b6564..ae88020e77 100644
--- a/src/lib/libcrypto/man/X509_STORE_CTX_new.3
+++ b/src/lib/libcrypto/man/X509_STORE_CTX_new.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: X509_STORE_CTX_new.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_STORE_CTX_new.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_STORE_CTX_NEW 3 4.Dt X509_STORE_CTX_NEW 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -84,7 +84,7 @@ structure.
84internally cleans up an 84internally cleans up an
85.Vt X509_STORE_CTX 85.Vt X509_STORE_CTX
86structure. 86structure.
87The context can then be reused with an new call to 87The context can then be reused with a new call to
88.Fn X509_STORE_CTX_init . 88.Fn X509_STORE_CTX_init .
89.Pp 89.Pp
90.Fn X509_STORE_CTX_free 90.Fn X509_STORE_CTX_free
@@ -144,7 +144,6 @@ structure.
144This might be used where additional "useful" CRLs are supplied as part 144This might be used where additional "useful" CRLs are supplied as part
145of a protocol, for example in a PKCS#7 structure. 145of a protocol, for example in a PKCS#7 structure.
146.Pp 146.Pp
147X509_VERIFY_PARAM
148.Fn X509_STORE_CTX_get0_param 147.Fn X509_STORE_CTX_get0_param
149retrieves an internal pointer to the verification parameters associated 148retrieves an internal pointer to the verification parameters associated
150with 149with
@@ -180,7 +179,8 @@ X509_STORE_CTX_init(&ctx, store, cert, chain);
180.Pp 179.Pp
181This is 180This is
182.Sy not 181.Sy not
183recommended in new applications they should instead do: 182recommended in new applications.
183They should instead do:
184.Bd -literal -offset indent 184.Bd -literal -offset indent
185X509_STORE_CTX *ctx; 185X509_STORE_CTX *ctx;
186ctx = X509_STORE_CTX_new(); 186ctx = X509_STORE_CTX_new();
@@ -190,7 +190,7 @@ X509_STORE_CTX_init(ctx, store, cert, chain);
190.Ed 190.Ed
191.Sh RETURN VALUES 191.Sh RETURN VALUES
192.Fn X509_STORE_CTX_new 192.Fn X509_STORE_CTX_new
193returns an newly allocates context or 193returns a newly allocated context or
194.Dv NULL 194.Dv NULL
195if an error occurred. 195if an error occurred.
196.Pp 196.Pp
diff --git a/src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 b/src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3
index 32a6d7c329..48a65d82f3 100644
--- a/src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3
+++ b/src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3
@@ -1,11 +1,11 @@
1.\" $OpenBSD: X509_STORE_set_verify_cb_func.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_STORE_set_verify_cb_func.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_STORE_SET_VERIFY_CB_FUNC 3 4.Dt X509_STORE_SET_VERIFY_CB_FUNC 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
7.Nm X509_STORE_set_verify_cb_func , 7.Nm X509_STORE_set_verify_cb ,
8.Nm X509_STORE_set_verify_cb 8.Nm X509_STORE_set_verify_cb_func
9.Nd set verification callback 9.Nd set verification callback
10.Sh SYNOPSIS 10.Sh SYNOPSIS
11.In openssl/x509_vfy.h 11.In openssl/x509_vfy.h
@@ -24,7 +24,7 @@
24sets the verification callback of 24sets the verification callback of
25.Sy ctx 25.Sy ctx
26to 26to
27.Sy verify_cb 27.Sy verify_cb ,
28overwriting any existing callback. 28overwriting any existing callback.
29.Pp 29.Pp
30.Fn X509_STORE_set_verify_cb_func 30.Fn X509_STORE_set_verify_cb_func
diff --git a/src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 b/src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3
index 43da66c6d1..67d336977f 100644
--- a/src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3
+++ b/src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: X509_VERIFY_PARAM_set_flags.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_VERIFY_PARAM_set_flags.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_VERIFY_PARAM_SET_FLAGS 3 4.Dt X509_VERIFY_PARAM_SET_FLAGS 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -9,11 +9,11 @@
9.Nm X509_VERIFY_PARAM_get_flags , 9.Nm X509_VERIFY_PARAM_get_flags ,
10.Nm X509_VERIFY_PARAM_set_purpose , 10.Nm X509_VERIFY_PARAM_set_purpose ,
11.Nm X509_VERIFY_PARAM_set_trust , 11.Nm X509_VERIFY_PARAM_set_trust ,
12.Nm X509_VERIFY_PARAM_set_depth ,
13.Nm X509_VERIFY_PARAM_get_depth ,
14.Nm X509_VERIFY_PARAM_set_time , 12.Nm X509_VERIFY_PARAM_set_time ,
15.Nm X509_VERIFY_PARAM_add0_policy , 13.Nm X509_VERIFY_PARAM_add0_policy ,
16.Nm X509_VERIFY_PARAM_set1_policies 14.Nm X509_VERIFY_PARAM_set1_policies ,
15.Nm X509_VERIFY_PARAM_set_depth ,
16.Nm X509_VERIFY_PARAM_get_depth
17.Nd X509 verification parameters 17.Nd X509 verification parameters
18.Sh SYNOPSIS 18.Sh SYNOPSIS
19.In openssl/x509_vfy.h 19.In openssl/x509_vfy.h
@@ -170,7 +170,7 @@ An error occurs if a suitable CRL cannot be found.
170enables CRL checking for the entire certificate chain. 170enables CRL checking for the entire certificate chain.
171.Pp 171.Pp
172.Dv X509_V_FLAG_IGNORE_CRITICAL 172.Dv X509_V_FLAG_IGNORE_CRITICAL
173disabled critical extension checking. 173disables critical extension checking.
174By default any unhandled critical extensions in certificates or (if 174By default any unhandled critical extensions in certificates or (if
175checked) CRLs results in a fatal error. 175checked) CRLs results in a fatal error.
176If this flag is set unhandled critical extensions are ignored. 176If this flag is set unhandled critical extensions are ignored.
@@ -189,7 +189,7 @@ verification strictly apply X509 rules.
189enables proxy certificate verification. 189enables proxy certificate verification.
190.Pp 190.Pp
191.Dv X509_V_FLAG_POLICY_CHECK 191.Dv X509_V_FLAG_POLICY_CHECK
192enables certificate policy checking, by default no policy checking is 192enables certificate policy checking; by default no policy checking is
193performed. 193performed.
194Additional information is sent to the verification callback relating to 194Additional information is sent to the verification callback relating to
195policy checking. 195policy checking.
@@ -203,7 +203,7 @@ set the
203.Dq inhibit any policy , 203.Dq inhibit any policy ,
204and 204and
205.Dq inhibit policy mapping 205.Dq inhibit policy mapping
206flags, respectively, as defined in RFC3280. 206flags, respectively, as defined in RFC 3280.
207Policy checking is automatically enabled if any of these flags are set. 207Policy checking is automatically enabled if any of these flags are set.
208.Pp 208.Pp
209If 209If
@@ -250,7 +250,7 @@ SSL connections associated with an
250.Vt SSL_CTX 250.Vt SSL_CTX
251structure 251structure
252.Fa ctx : 252.Fa ctx :
253.Bd -literal 253.Bd -literal -offset indent
254X509_VERIFY_PARAM *param; 254X509_VERIFY_PARAM *param;
255param = X509_VERIFY_PARAM_new(); 255param = X509_VERIFY_PARAM_new();
256X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK); 256X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
diff --git a/src/lib/libcrypto/man/X509_new.3 b/src/lib/libcrypto/man/X509_new.3
index 00343e1764..705f4b2816 100644
--- a/src/lib/libcrypto/man/X509_new.3
+++ b/src/lib/libcrypto/man/X509_new.3
@@ -1,12 +1,12 @@
1.\" $OpenBSD: X509_new.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_new.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_NEW 3 4.Dt X509_NEW 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
7.Nm X509_new , 7.Nm X509_new ,
8.Nm X509_free 8.Nm X509_free
9.Nd X509 certificate ASN1 allocation functions 9.Nd X509 certificate ASN.1 allocation functions
10.Sh SYNOPSIS 10.Sh SYNOPSIS
11.In openssl/x509.h 11.In openssl/x509.h
12.Ft X509 * 12.Ft X509 *
@@ -16,7 +16,7 @@
16.Fa "X509 *a" 16.Fa "X509 *a"
17.Fc 17.Fc
18.Sh DESCRIPTION 18.Sh DESCRIPTION
19The X509 ASN1 allocation routines allocate and free an 19The X509 ASN.1 allocation routines allocate and free an
20.Vt X509 20.Vt X509
21structure, which represents an X509 certificate. 21structure, which represents an X509 certificate.
22.Pp 22.Pp
diff --git a/src/lib/libcrypto/man/X509_verify_cert.3 b/src/lib/libcrypto/man/X509_verify_cert.3
index fab813ffaa..b359a380ed 100644
--- a/src/lib/libcrypto/man/X509_verify_cert.3
+++ b/src/lib/libcrypto/man/X509_verify_cert.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: X509_verify_cert.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: X509_verify_cert.3,v 1.3 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt X509_VERIFY_CERT 3 4.Dt X509_VERIFY_CERT 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -41,11 +41,8 @@ by examining
41for example using 41for example using
42.Xr X509_STORE_CTX_get_error 3 . 42.Xr X509_STORE_CTX_get_error 3 .
43.Sh SEE ALSO 43.Sh SEE ALSO
44.Xr openssl 1 ,
44.Xr X509_STORE_CTX_get_error 3 45.Xr X509_STORE_CTX_get_error 3
45and the
46.Cm verify
47entry in
48.Xr openssl 1
49.Sh HISTORY 46.Sh HISTORY
50.Fn X509_verify_cert 47.Fn X509_verify_cert
51is available in all versions of SSLeay and OpenSSL. 48is available in all versions of SSLeay and OpenSSL.
diff --git a/src/lib/libcrypto/man/bn_dump.3 b/src/lib/libcrypto/man/bn_dump.3
index 9c4b06e9b3..b912e3a473 100644
--- a/src/lib/libcrypto/man/bn_dump.3
+++ b/src/lib/libcrypto/man/bn_dump.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: bn_dump.3,v 1.3 2016/11/21 22:19:15 jmc Exp $ 1.\" $OpenBSD: bn_dump.3,v 1.4 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 21 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt BN_DUMP 3 4.Dt BN_DUMP 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -324,7 +324,7 @@ calls, the
324.Vt BN_CTX 324.Vt BN_CTX
325structure is used. 325structure is used.
326This structure contains BN_CTX_NUM 326This structure contains BN_CTX_NUM
327.Vt BIGNUM Ns s, 327.Vt BIGNUM Ns s ;
328see 328see
329.Xr BN_CTX_start 3 . 329.Xr BN_CTX_start 3 .
330.Ss Low level arithmetic operations 330.Ss Low level arithmetic operations
@@ -427,7 +427,7 @@ operates on the 4 word arrays
427.Fa a 427.Fa a
428and 428and
429.Fa b 429.Fa b
430and the 8 word array 430and the 8-word array
431.Fa r . 431.Fa r .
432It computes 432It computes
433.Fa a Ns * Ns Fa b 433.Fa a Ns * Ns Fa b
@@ -435,11 +435,11 @@ and places the result in
435.Fa r . 435.Fa r .
436.Pp 436.Pp
437.Fn bn_mul_comba8 r a b 437.Fn bn_mul_comba8 r a b
438operates on the 8 word arrays 438operates on the 8-word arrays
439.Fa a 439.Fa a
440and 440and
441.Fa b 441.Fa b
442and the 16 word array 442and the 16-word array
443.Fa r . 443.Fa r .
444It computes 444It computes
445.Fa a Ns * Ns Fa b 445.Fa a Ns * Ns Fa b
@@ -447,15 +447,15 @@ and places the result in
447.Fa r . 447.Fa r .
448.Pp 448.Pp
449.Fn bn_sqr_comba4 r a b 449.Fn bn_sqr_comba4 r a b
450operates on the 4 word arrays 450operates on the 4-word arrays
451.Fa a 451.Fa a
452and 452and
453.Fa b 453.Fa b
454and the 8 word array 454and the 8-word array
455.Fa r . 455.Fa r .
456.Pp 456.Pp
457.Fn bn_sqr_comba8 r a b 457.Fn bn_sqr_comba8 r a b
458operates on the 8 word arrays 458operates on the 8-word arrays
459.Fa a 459.Fa a
460and 460and
461.Fa b 461.Fa b
@@ -681,7 +681,7 @@ prints
681.Fa n 681.Fa n
682words at 682words at
683.Fa d 683.Fa d
684(in reverse order, i.e. 684(in reverse order, i.e.\&
685most significant word first) to 685most significant word first) to
686.Dv stderr . 686.Dv stderr .
687.Pp 687.Pp
diff --git a/src/lib/libcrypto/man/crypto.3 b/src/lib/libcrypto/man/crypto.3
index 20b139bf74..7e7572ea67 100644
--- a/src/lib/libcrypto/man/crypto.3
+++ b/src/lib/libcrypto/man/crypto.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: crypto.3,v 1.5 2016/11/21 09:56:35 schwarze Exp $ 1.\" $OpenBSD: crypto.3,v 1.6 2016/12/03 13:36:03 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 21 2016 $ 3.Dd $Mdocdate: December 3 2016 $
4.Dt CRYPTO 3 4.Dt CRYPTO 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -12,7 +12,7 @@ algorithms used in various Internet standards.
12The services provided by this library are used by the OpenSSL 12The services provided by this library are used by the OpenSSL
13implementations of SSL, TLS and S/MIME, and they have also been used to 13implementations of SSL, TLS and S/MIME, and they have also been used to
14implement SSH, OpenPGP, and other cryptographic standards. 14implement SSH, OpenPGP, and other cryptographic standards.
15.Sh OVERVIEW 15.Pp
16.Sy libcrypto 16.Sy libcrypto
17consists of a number of sub-libraries that implement the individual 17consists of a number of sub-libraries that implement the individual
18algorithms. 18algorithms.
@@ -20,7 +20,7 @@ algorithms.
20The functionality includes symmetric encryption, public key cryptography 20The functionality includes symmetric encryption, public key cryptography
21and key agreement, certificate handling, cryptographic hash functions 21and key agreement, certificate handling, cryptographic hash functions
22and a cryptographic pseudo-random number generator. 22and a cryptographic pseudo-random number generator.
23.Bl -tag -width Ds 23.Bl -tag -width Ds -offset indent
24.It SYMMETRIC CIPHERS 24.It SYMMETRIC CIPHERS
25.Xr blowfish 3 , 25.Xr blowfish 3 ,
26CAST, DES, IDEA, RC2, 26CAST, DES, IDEA, RC2,
@@ -51,7 +51,7 @@ x509v3
51asn1, 51asn1,
52.Xr BIO 3 , 52.Xr BIO 3 ,
53.Xr evp 3 , 53.Xr evp 3 ,
54.Xr PEM 3 , 54PEM,
55pkcs7, 55pkcs7,
56pkcs12 56pkcs12
57.It INTERNAL FUNCTIONS 57.It INTERNAL FUNCTIONS
@@ -63,7 +63,7 @@ objects,
63stack, 63stack,
64txt_db 64txt_db
65.El 65.El
66.Sh NOTES 66.Pp
67Some of the newer functions follow a naming convention using the numbers 67Some of the newer functions follow a naming convention using the numbers
68.Sq 0 68.Sq 0
69and 69and