diff options
author | jim <> | 2014-05-04 22:26:33 +0000 |
---|---|---|
committer | jim <> | 2014-05-04 22:26:33 +0000 |
commit | cc8925bff081ec36ac69be8b3681bff98f5d07da (patch) | |
tree | c61ab0faf9a25b5fa4c1daeb8248a7e8deff66d2 /src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod | |
parent | e591b58894a6d621ba00c14da39becb1a0d16335 (diff) | |
download | openbsd-cc8925bff081ec36ac69be8b3681bff98f5d07da.tar.gz openbsd-cc8925bff081ec36ac69be8b3681bff98f5d07da.tar.bz2 openbsd-cc8925bff081ec36ac69be8b3681bff98f5d07da.zip |
Improve line wrapping for lines exceeding 80 chars.
ok jmc@
Diffstat (limited to 'src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod')
-rw-r--r-- | src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod | 62 |
1 files changed, 42 insertions, 20 deletions
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod index 60e8332ae9..5760f64fcb 100644 --- a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod +++ b/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod | |||
@@ -2,7 +2,10 @@ | |||
2 | 2 | ||
3 | =head1 NAME | 3 | =head1 NAME |
4 | 4 | ||
5 | X509_STORE_CTX_get_error, X509_STORE_CTX_set_error, X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert, X509_STORE_CTX_get1_chain, X509_verify_cert_error_string - get or set certificate verification status information | 5 | X509_STORE_CTX_get_error, X509_STORE_CTX_set_error, |
6 | X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert, | ||
7 | X509_STORE_CTX_get1_chain, X509_verify_cert_error_string - get or set | ||
8 | certificate verification status information | ||
6 | 9 | ||
7 | =head1 SYNOPSIS | 10 | =head1 SYNOPSIS |
8 | 11 | ||
@@ -82,19 +85,22 @@ of an untrusted certificate cannot be found. | |||
82 | 85 | ||
83 | the CRL of a certificate could not be found. | 86 | the CRL of a certificate could not be found. |
84 | 87 | ||
85 | =item B<X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: unable to decrypt certificate's signature> | 88 | =item B<X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: unable to decrypt |
89 | certificate's signature> | ||
86 | 90 | ||
87 | the certificate signature could not be decrypted. This means that the actual | 91 | the certificate signature could not be decrypted. This means that the actual |
88 | signature value could not be determined rather than it not matching the | 92 | signature value could not be determined rather than it not matching the |
89 | expected value, this is only meaningful for RSA keys. | 93 | expected value, this is only meaningful for RSA keys. |
90 | 94 | ||
91 | =item B<X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: unable to decrypt CRL's signature> | 95 | =item B<X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: unable to decrypt CRL's |
96 | signature> | ||
92 | 97 | ||
93 | the CRL signature could not be decrypted: this means that the actual signature | 98 | the CRL signature could not be decrypted: this means that the actual signature |
94 | value could not be determined rather than it not matching the expected value. | 99 | value could not be determined rather than it not matching the expected value. |
95 | Unused. | 100 | Unused. |
96 | 101 | ||
97 | =item B<X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: unable to decode issuer public key> | 102 | =item B<X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: unable to decode issuer |
103 | public key> | ||
98 | 104 | ||
99 | the public key in the certificate SubjectPublicKeyInfo could not be read. | 105 | the public key in the certificate SubjectPublicKeyInfo could not be read. |
100 | 106 | ||
@@ -112,7 +118,8 @@ the certificate is not yet valid: the notBefore date is after the current time. | |||
112 | 118 | ||
113 | =item B<X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired> | 119 | =item B<X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired> |
114 | 120 | ||
115 | the certificate has expired: that is the notAfter date is before the current time. | 121 | the certificate has expired: that is the notAfter date is before the current |
122 | time. | ||
116 | 123 | ||
117 | =item B<X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid> | 124 | =item B<X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid> |
118 | 125 | ||
@@ -122,19 +129,23 @@ the CRL is not yet valid. | |||
122 | 129 | ||
123 | the CRL has expired. | 130 | the CRL has expired. |
124 | 131 | ||
125 | =item B<X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: format error in certificate's notBefore field> | 132 | =item B<X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: format error in |
133 | certificate's notBefore field> | ||
126 | 134 | ||
127 | the certificate notBefore field contains an invalid time. | 135 | the certificate notBefore field contains an invalid time. |
128 | 136 | ||
129 | =item B<X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: format error in certificate's notAfter field> | 137 | =item B<X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: format error in certificate's |
138 | notAfter field> | ||
130 | 139 | ||
131 | the certificate notAfter field contains an invalid time. | 140 | the certificate notAfter field contains an invalid time. |
132 | 141 | ||
133 | =item B<X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: format error in CRL's lastUpdate field> | 142 | =item B<X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: format error in CRL's |
143 | lastUpdate field> | ||
134 | 144 | ||
135 | the CRL lastUpdate field contains an invalid time. | 145 | the CRL lastUpdate field contains an invalid time. |
136 | 146 | ||
137 | =item B<X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: format error in CRL's nextUpdate field> | 147 | =item B<X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: format error in CRL's |
148 | nextUpdate field> | ||
138 | 149 | ||
139 | the CRL nextUpdate field contains an invalid time. | 150 | the CRL nextUpdate field contains an invalid time. |
140 | 151 | ||
@@ -147,17 +158,20 @@ an error occurred trying to allocate memory. This should never happen. | |||
147 | the passed certificate is self signed and the same certificate cannot be found | 158 | the passed certificate is self signed and the same certificate cannot be found |
148 | in the list of trusted certificates. | 159 | in the list of trusted certificates. |
149 | 160 | ||
150 | =item B<X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in certificate chain> | 161 | =item B<X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in |
162 | certificate chain> | ||
151 | 163 | ||
152 | the certificate chain could be built up using the untrusted certificates but | 164 | the certificate chain could be built up using the untrusted certificates but |
153 | the root could not be found locally. | 165 | the root could not be found locally. |
154 | 166 | ||
155 | =item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local issuer certificate> | 167 | =item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local |
168 | issuer certificate> | ||
156 | 169 | ||
157 | the issuer certificate of a locally looked up certificate could not be found. | 170 | the issuer certificate of a locally looked up certificate could not be found. |
158 | This normally means the list of trusted certificates is not complete. | 171 | This normally means the list of trusted certificates is not complete. |
159 | 172 | ||
160 | =item B<X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: unable to verify the first certificate> | 173 | =item B<X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: unable to verify the first |
174 | certificate> | ||
161 | 175 | ||
162 | no signatures could be verified because the chain contains only one certificate | 176 | no signatures could be verified because the chain contains only one certificate |
163 | and it is not self signed. | 177 | and it is not self signed. |
@@ -198,34 +212,39 @@ did not match the issuer name of the current certificate. This is only set | |||
198 | if issuer check debugging is enabled it is used for status notification and | 212 | if issuer check debugging is enabled it is used for status notification and |
199 | is B<not> in itself an error. | 213 | is B<not> in itself an error. |
200 | 214 | ||
201 | =item B<X509_V_ERR_AKID_SKID_MISMATCH: authority and subject key identifier mismatch> | 215 | =item B<X509_V_ERR_AKID_SKID_MISMATCH: authority and subject key identifier |
216 | mismatch> | ||
202 | 217 | ||
203 | the current candidate issuer certificate was rejected because its subject key | 218 | the current candidate issuer certificate was rejected because its subject key |
204 | identifier was present and did not match the authority key identifier current | 219 | identifier was present and did not match the authority key identifier current |
205 | certificate. This is only set if issuer check debugging is enabled it is used | 220 | certificate. This is only set if issuer check debugging is enabled it is used |
206 | for status notification and is B<not> in itself an error. | 221 | for status notification and is B<not> in itself an error. |
207 | 222 | ||
208 | =item B<X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: authority and issuer serial number mismatch> | 223 | =item B<X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: authority and issuer serial |
224 | number mismatch> | ||
209 | 225 | ||
210 | the current candidate issuer certificate was rejected because its issuer name | 226 | the current candidate issuer certificate was rejected because its issuer name |
211 | and serial number was present and did not match the authority key identifier of | 227 | and serial number was present and did not match the authority key identifier of |
212 | the current certificate. This is only set if issuer check debugging is enabled | 228 | the current certificate. This is only set if issuer check debugging is enabled |
213 | it is used for status notification and is B<not> in itself an error. | 229 | it is used for status notification and is B<not> in itself an error. |
214 | 230 | ||
215 | =item B<X509_V_ERR_KEYUSAGE_NO_CERTSIGN:key usage does not include certificate signing> | 231 | =item B<X509_V_ERR_KEYUSAGE_NO_CERTSIGN:key usage does not include certificate |
232 | signing> | ||
216 | 233 | ||
217 | the current candidate issuer certificate was rejected because its keyUsage | 234 | the current candidate issuer certificate was rejected because its keyUsage |
218 | extension does not permit certificate signing. This is only set if issuer check | 235 | extension does not permit certificate signing. This is only set if issuer check |
219 | debugging is enabled it is used for status notification and is B<not> in itself | 236 | debugging is enabled it is used for status notification and is B<not> in itself |
220 | an error. | 237 | an error. |
221 | 238 | ||
222 | =item B<X509_V_ERR_INVALID_EXTENSION: invalid or inconsistent certificate extension> | 239 | =item B<X509_V_ERR_INVALID_EXTENSION: invalid or inconsistent certificate |
240 | extension> | ||
223 | 241 | ||
224 | A certificate extension had an invalid value (for example an incorrect | 242 | A certificate extension had an invalid value (for example an incorrect |
225 | encoding) or some value inconsistent with other extensions. | 243 | encoding) or some value inconsistent with other extensions. |
226 | 244 | ||
227 | 245 | ||
228 | =item B<X509_V_ERR_INVALID_POLICY_EXTENSION: invalid or inconsistent certificate policy extension> | 246 | =item B<X509_V_ERR_INVALID_POLICY_EXTENSION: invalid or inconsistent |
247 | certificate policy extension> | ||
229 | 248 | ||
230 | A certificate policies extension had an invalid value (for example an incorrect | 249 | A certificate policies extension had an invalid value (for example an incorrect |
231 | encoding) or some value inconsistent with other extensions. This error only | 250 | encoding) or some value inconsistent with other extensions. This error only |
@@ -252,17 +271,20 @@ A name constraint violation occured in the permitted subtrees. | |||
252 | 271 | ||
253 | A name constraint violation occured in the excluded subtrees. | 272 | A name constraint violation occured in the excluded subtrees. |
254 | 273 | ||
255 | =item B<X509_V_ERR_SUBTREE_MINMAX: name constraints minimum and maximum not supported> | 274 | =item B<X509_V_ERR_SUBTREE_MINMAX: name constraints minimum and maximum not |
275 | supported> | ||
256 | 276 | ||
257 | A certificate name constraints extension included a minimum or maximum field: | 277 | A certificate name constraints extension included a minimum or maximum field: |
258 | this is not supported. | 278 | this is not supported. |
259 | 279 | ||
260 | =item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: unsupported name constraint type> | 280 | =item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: unsupported name constraint |
281 | type> | ||
261 | 282 | ||
262 | An unsupported name constraint type was encountered. OpenSSL currently only | 283 | An unsupported name constraint type was encountered. OpenSSL currently only |
263 | supports directory name, DNS name, email and URI types. | 284 | supports directory name, DNS name, email and URI types. |
264 | 285 | ||
265 | =item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: unsupported or invalid name constraint syntax> | 286 | =item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: unsupported or invalid name |
287 | constraint syntax> | ||
266 | 288 | ||
267 | The format of the name constraint is not recognised: for example an email | 289 | The format of the name constraint is not recognised: for example an email |
268 | address format of a form not mentioned in RFC3280. This could be caused by | 290 | address format of a form not mentioned in RFC3280. This could be caused by |