summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
diff options
context:
space:
mode:
authorjim <>2014-05-04 22:26:33 +0000
committerjim <>2014-05-04 22:26:33 +0000
commitcc8925bff081ec36ac69be8b3681bff98f5d07da (patch)
treec61ab0faf9a25b5fa4c1daeb8248a7e8deff66d2 /src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
parente591b58894a6d621ba00c14da39becb1a0d16335 (diff)
downloadopenbsd-cc8925bff081ec36ac69be8b3681bff98f5d07da.tar.gz
openbsd-cc8925bff081ec36ac69be8b3681bff98f5d07da.tar.bz2
openbsd-cc8925bff081ec36ac69be8b3681bff98f5d07da.zip
Improve line wrapping for lines exceeding 80 chars.
ok jmc@
Diffstat (limited to 'src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod')
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod62
1 files changed, 42 insertions, 20 deletions
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
index 60e8332ae9..5760f64fcb 100644
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
+++ b/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
@@ -2,7 +2,10 @@
2 2
3=head1 NAME 3=head1 NAME
4 4
5X509_STORE_CTX_get_error, X509_STORE_CTX_set_error, X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert, X509_STORE_CTX_get1_chain, X509_verify_cert_error_string - get or set certificate verification status information 5X509_STORE_CTX_get_error, X509_STORE_CTX_set_error,
6X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert,
7X509_STORE_CTX_get1_chain, X509_verify_cert_error_string - get or set
8certificate verification status information
6 9
7=head1 SYNOPSIS 10=head1 SYNOPSIS
8 11
@@ -82,19 +85,22 @@ of an untrusted certificate cannot be found.
82 85
83the CRL of a certificate could not be found. 86the CRL of a certificate could not be found.
84 87
85=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: unable to decrypt certificate's signature> 88=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: unable to decrypt
89certificate's signature>
86 90
87the certificate signature could not be decrypted. This means that the actual 91the certificate signature could not be decrypted. This means that the actual
88signature value could not be determined rather than it not matching the 92signature value could not be determined rather than it not matching the
89expected value, this is only meaningful for RSA keys. 93expected value, this is only meaningful for RSA keys.
90 94
91=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: unable to decrypt CRL's signature> 95=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: unable to decrypt CRL's
96signature>
92 97
93the CRL signature could not be decrypted: this means that the actual signature 98the CRL signature could not be decrypted: this means that the actual signature
94value could not be determined rather than it not matching the expected value. 99value could not be determined rather than it not matching the expected value.
95Unused. 100Unused.
96 101
97=item B<X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: unable to decode issuer public key> 102=item B<X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: unable to decode issuer
103public key>
98 104
99the public key in the certificate SubjectPublicKeyInfo could not be read. 105the public key in the certificate SubjectPublicKeyInfo could not be read.
100 106
@@ -112,7 +118,8 @@ the certificate is not yet valid: the notBefore date is after the current time.
112 118
113=item B<X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired> 119=item B<X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired>
114 120
115the certificate has expired: that is the notAfter date is before the current time. 121the certificate has expired: that is the notAfter date is before the current
122time.
116 123
117=item B<X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid> 124=item B<X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid>
118 125
@@ -122,19 +129,23 @@ the CRL is not yet valid.
122 129
123the CRL has expired. 130the CRL has expired.
124 131
125=item B<X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: format error in certificate's notBefore field> 132=item B<X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: format error in
133certificate's notBefore field>
126 134
127the certificate notBefore field contains an invalid time. 135the certificate notBefore field contains an invalid time.
128 136
129=item B<X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: format error in certificate's notAfter field> 137=item B<X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: format error in certificate's
138notAfter field>
130 139
131the certificate notAfter field contains an invalid time. 140the certificate notAfter field contains an invalid time.
132 141
133=item B<X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: format error in CRL's lastUpdate field> 142=item B<X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: format error in CRL's
143lastUpdate field>
134 144
135the CRL lastUpdate field contains an invalid time. 145the CRL lastUpdate field contains an invalid time.
136 146
137=item B<X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: format error in CRL's nextUpdate field> 147=item B<X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: format error in CRL's
148nextUpdate field>
138 149
139the CRL nextUpdate field contains an invalid time. 150the CRL nextUpdate field contains an invalid time.
140 151
@@ -147,17 +158,20 @@ an error occurred trying to allocate memory. This should never happen.
147the passed certificate is self signed and the same certificate cannot be found 158the passed certificate is self signed and the same certificate cannot be found
148in the list of trusted certificates. 159in the list of trusted certificates.
149 160
150=item B<X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in certificate chain> 161=item B<X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in
162certificate chain>
151 163
152the certificate chain could be built up using the untrusted certificates but 164the certificate chain could be built up using the untrusted certificates but
153the root could not be found locally. 165the root could not be found locally.
154 166
155=item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local issuer certificate> 167=item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local
168issuer certificate>
156 169
157the issuer certificate of a locally looked up certificate could not be found. 170the issuer certificate of a locally looked up certificate could not be found.
158This normally means the list of trusted certificates is not complete. 171This normally means the list of trusted certificates is not complete.
159 172
160=item B<X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: unable to verify the first certificate> 173=item B<X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: unable to verify the first
174certificate>
161 175
162no signatures could be verified because the chain contains only one certificate 176no signatures could be verified because the chain contains only one certificate
163and it is not self signed. 177and it is not self signed.
@@ -198,34 +212,39 @@ did not match the issuer name of the current certificate. This is only set
198if issuer check debugging is enabled it is used for status notification and 212if issuer check debugging is enabled it is used for status notification and
199is B<not> in itself an error. 213is B<not> in itself an error.
200 214
201=item B<X509_V_ERR_AKID_SKID_MISMATCH: authority and subject key identifier mismatch> 215=item B<X509_V_ERR_AKID_SKID_MISMATCH: authority and subject key identifier
216mismatch>
202 217
203the current candidate issuer certificate was rejected because its subject key 218the current candidate issuer certificate was rejected because its subject key
204identifier was present and did not match the authority key identifier current 219identifier was present and did not match the authority key identifier current
205certificate. This is only set if issuer check debugging is enabled it is used 220certificate. This is only set if issuer check debugging is enabled it is used
206for status notification and is B<not> in itself an error. 221for status notification and is B<not> in itself an error.
207 222
208=item B<X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: authority and issuer serial number mismatch> 223=item B<X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: authority and issuer serial
224number mismatch>
209 225
210the current candidate issuer certificate was rejected because its issuer name 226the current candidate issuer certificate was rejected because its issuer name
211and serial number was present and did not match the authority key identifier of 227and serial number was present and did not match the authority key identifier of
212the current certificate. This is only set if issuer check debugging is enabled 228the current certificate. This is only set if issuer check debugging is enabled
213it is used for status notification and is B<not> in itself an error. 229it is used for status notification and is B<not> in itself an error.
214 230
215=item B<X509_V_ERR_KEYUSAGE_NO_CERTSIGN:key usage does not include certificate signing> 231=item B<X509_V_ERR_KEYUSAGE_NO_CERTSIGN:key usage does not include certificate
232signing>
216 233
217the current candidate issuer certificate was rejected because its keyUsage 234the current candidate issuer certificate was rejected because its keyUsage
218extension does not permit certificate signing. This is only set if issuer check 235extension does not permit certificate signing. This is only set if issuer check
219debugging is enabled it is used for status notification and is B<not> in itself 236debugging is enabled it is used for status notification and is B<not> in itself
220an error. 237an error.
221 238
222=item B<X509_V_ERR_INVALID_EXTENSION: invalid or inconsistent certificate extension> 239=item B<X509_V_ERR_INVALID_EXTENSION: invalid or inconsistent certificate
240extension>
223 241
224A certificate extension had an invalid value (for example an incorrect 242A certificate extension had an invalid value (for example an incorrect
225encoding) or some value inconsistent with other extensions. 243encoding) or some value inconsistent with other extensions.
226 244
227 245
228=item B<X509_V_ERR_INVALID_POLICY_EXTENSION: invalid or inconsistent certificate policy extension> 246=item B<X509_V_ERR_INVALID_POLICY_EXTENSION: invalid or inconsistent
247certificate policy extension>
229 248
230A certificate policies extension had an invalid value (for example an incorrect 249A certificate policies extension had an invalid value (for example an incorrect
231encoding) or some value inconsistent with other extensions. This error only 250encoding) or some value inconsistent with other extensions. This error only
@@ -252,17 +271,20 @@ A name constraint violation occured in the permitted subtrees.
252 271
253A name constraint violation occured in the excluded subtrees. 272A name constraint violation occured in the excluded subtrees.
254 273
255=item B<X509_V_ERR_SUBTREE_MINMAX: name constraints minimum and maximum not supported> 274=item B<X509_V_ERR_SUBTREE_MINMAX: name constraints minimum and maximum not
275supported>
256 276
257A certificate name constraints extension included a minimum or maximum field: 277A certificate name constraints extension included a minimum or maximum field:
258this is not supported. 278this is not supported.
259 279
260=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: unsupported name constraint type> 280=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: unsupported name constraint
281type>
261 282
262An unsupported name constraint type was encountered. OpenSSL currently only 283An unsupported name constraint type was encountered. OpenSSL currently only
263supports directory name, DNS name, email and URI types. 284supports directory name, DNS name, email and URI types.
264 285
265=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: unsupported or invalid name constraint syntax> 286=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: unsupported or invalid name
287constraint syntax>
266 288
267The format of the name constraint is not recognised: for example an email 289The format of the name constraint is not recognised: for example an email
268address format of a form not mentioned in RFC3280. This could be caused by 290address format of a form not mentioned in RFC3280. This could be caused by