summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
authorschwarze <>2016-11-04 15:29:03 +0000
committerschwarze <>2016-11-04 15:29:03 +0000
commite23d00ab37299e14c06d5d2b599a3793e3d0575c (patch)
treef91172cf4f459119421ea45c97eb6fa4aec563bc /src/lib
parentf34ab28d6356aae4d0458dd2076438a042314790 (diff)
downloadopenbsd-e23d00ab37299e14c06d5d2b599a3793e3d0575c.tar.gz
openbsd-e23d00ab37299e14c06d5d2b599a3793e3d0575c.tar.bz2
openbsd-e23d00ab37299e14c06d5d2b599a3793e3d0575c.zip
convert X509 manuals from pod to mdoc
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod70
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod117
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod102
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_print_ex.pod103
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod323
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod43
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_new.pod126
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod165
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod54
-rw-r--r--src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod172
-rw-r--r--src/lib/libcrypto/doc/X509_new.pod38
-rw-r--r--src/lib/libcrypto/doc/X509_verify_cert.pod53
-rw-r--r--src/lib/libcrypto/doc/d2i_X509.pod231
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_ALGOR.pod26
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_CRL.pod33
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_NAME.pod27
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_REQ.pod32
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_SIG.pod26
-rw-r--r--src/lib/libcrypto/doc/x509.pod64
-rw-r--r--src/lib/libcrypto/man/Makefile40
-rw-r--r--src/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3133
-rw-r--r--src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3212
-rw-r--r--src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3177
-rw-r--r--src/lib/libcrypto/man/X509_NAME_print_ex.3199
-rw-r--r--src/lib/libcrypto/man/X509_STORE_CTX_get_error.3297
-rw-r--r--src/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.354
-rw-r--r--src/lib/libcrypto/man/X509_STORE_CTX_new.3229
-rw-r--r--src/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3185
-rw-r--r--src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.354
-rw-r--r--src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3271
-rw-r--r--src/lib/libcrypto/man/X509_new.349
-rw-r--r--src/lib/libcrypto/man/X509_verify_cert.354
-rw-r--r--src/lib/libcrypto/man/d2i_X509.3346
-rw-r--r--src/lib/libcrypto/man/d2i_X509_ALGOR.333
-rw-r--r--src/lib/libcrypto/man/d2i_X509_CRL.354
-rw-r--r--src/lib/libcrypto/man/d2i_X509_NAME.334
-rw-r--r--src/lib/libcrypto/man/d2i_X509_REQ.353
-rw-r--r--src/lib/libcrypto/man/d2i_X509_SIG.333
-rw-r--r--src/lib/libcrypto/man/x509.379
39 files changed, 2566 insertions, 1825 deletions
diff --git a/src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod b/src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod
deleted file mode 100644
index 4603202db8..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod
+++ /dev/null
@@ -1,70 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_ENTRY_get_object, X509_NAME_ENTRY_get_data,
6X509_NAME_ENTRY_set_object, X509_NAME_ENTRY_set_data,
7X509_NAME_ENTRY_create_by_txt, X509_NAME_ENTRY_create_by_NID,
8X509_NAME_ENTRY_create_by_OBJ - X509_NAME_ENTRY utility functions
9
10=head1 SYNOPSIS
11
12 #include <openssl/x509.h>
13
14 ASN1_OBJECT * X509_NAME_ENTRY_get_object(X509_NAME_ENTRY *ne);
15 ASN1_STRING * X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne);
16
17 int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, ASN1_OBJECT *obj);
18 int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type, const unsigned char *bytes, int len);
19
20 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne, const char *field, int type, const unsigned char *bytes, int len);
21 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid, int type,unsigned char *bytes, int len);
22 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne, ASN1_OBJECT *obj, int type, const unsigned char *bytes, int len);
23
24=head1 DESCRIPTION
25
26X509_NAME_ENTRY_get_object() retrieves the field name of B<ne> in
27and B<ASN1_OBJECT> structure.
28
29X509_NAME_ENTRY_get_data() retrieves the field value of B<ne> in
30and B<ASN1_STRING> structure.
31
32X509_NAME_ENTRY_set_object() sets the field name of B<ne> to B<obj>.
33
34X509_NAME_ENTRY_set_data() sets the field value of B<ne> to string type
35B<type> and value determined by B<bytes> and B<len>.
36
37X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_NID()
38and X509_NAME_ENTRY_create_by_OBJ() create and return an
39B<X509_NAME_ENTRY> structure.
40
41=head1 NOTES
42
43X509_NAME_ENTRY_get_object() and X509_NAME_ENTRY_get_data() can be
44used to examine an B<X509_NAME_ENTRY> function as returned by
45X509_NAME_get_entry() for example.
46
47X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_NID(),
48and X509_NAME_ENTRY_create_by_OBJ() create and return an
49
50X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_OBJ(),
51X509_NAME_ENTRY_create_by_NID() and X509_NAME_ENTRY_set_data()
52are seldom used in practice because B<X509_NAME_ENTRY> structures
53are almost always part of B<X509_NAME> structures and the
54corresponding B<X509_NAME> functions are typically used to
55create and add new entries in a single operation.
56
57The arguments of these functions support similar options to the similarly
58named ones of the corresponding B<X509_NAME> functions such as
59X509_NAME_add_entry_by_txt(). So for example B<type> can be set to
60B<MBSTRING_ASC> but in the case of X509_set_data() the field name must be
61set first so the relevant field information can be looked up internally.
62
63=head1 RETURN VALUES
64
65=head1 SEE ALSO
66
67L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>,
68L<OBJ_nid2obj(3)|OBJ_nid2obj(3)>
69
70=cut
diff --git a/src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod b/src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod
deleted file mode 100644
index f97e05e683..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod
+++ /dev/null
@@ -1,117 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_add_entry_by_txt, X509_NAME_add_entry_by_OBJ,
6X509_NAME_add_entry_by_NID, X509_NAME_add_entry, X509_NAME_delete_entry -
7X509_NAME modification functions
8
9=head1 SYNOPSIS
10
11 #include <openssl/x509.h>
12
13 int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type, const unsigned char *bytes, int len, int loc, int set);
14
15 int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type, unsigned char *bytes, int len, int loc, int set);
16
17 int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type, unsigned char *bytes, int len, int loc, int set);
18
19 int X509_NAME_add_entry(X509_NAME *name,X509_NAME_ENTRY *ne, int loc, int set);
20
21 X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);
22
23=head1 DESCRIPTION
24
25X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ() and
26X509_NAME_add_entry_by_NID() add a field whose name is defined
27by a string B<field>, an object B<obj> or a NID B<nid> respectively.
28The field value to be added is in B<bytes> of length B<len>. If
29B<len> is -1 then the field length is calculated internally using
30strlen(bytes).
31
32The type of field is determined by B<type> which can either be a
33definition of the type of B<bytes> (such as B<MBSTRING_ASC>) or a
34standard ASN1 type (such as B<V_ASN1_IA5STRING>). The new entry is
35added to a position determined by B<loc> and B<set>.
36
37X509_NAME_add_entry() adds a copy of B<X509_NAME_ENTRY> structure B<ne>
38to B<name>. The new entry is added to a position determined by B<loc>
39and B<set>. Since a copy of B<ne> is added B<ne> must be freed up after
40the call.
41
42X509_NAME_delete_entry() deletes an entry from B<name> at position
43B<loc>. The deleted entry is returned and must be freed up.
44
45=head1 NOTES
46
47The use of string types such as B<MBSTRING_ASC> or B<MBSTRING_UTF8>
48is strongly recommended for the B<type> parameter. This allows the
49internal code to correctly determine the type of the field and to
50apply length checks according to the relevant standards. This is
51done using ASN1_STRING_set_by_NID().
52
53If instead an ASN1 type is used no checks are performed and the
54supplied data in B<bytes> is used directly.
55
56In X509_NAME_add_entry_by_txt() the B<field> string represents
57the field name using OBJ_txt2obj(field, 0).
58
59The B<loc> and B<set> parameters determine where a new entry should
60be added. For almost all applications B<loc> can be set to -1 and B<set>
61to 0. This adds a new entry to the end of B<name> as a single valued
62RelativeDistinguishedName (RDN).
63
64B<loc> actually determines the index where the new entry is inserted:
65if it is -1 it is appended.
66
67B<set> determines how the new type is added. If it is zero a
68new RDN is created.
69
70If B<set> is -1 or 1 it is added to the previous or next RDN
71structure respectively. This will then be a multivalued RDN:
72since multivalues RDNs are very seldom used B<set> is almost
73always set to zero.
74
75=head1 EXAMPLES
76
77Create an B<X509_NAME> structure:
78
79"C=UK, O=Disorganized Organization, CN=Joe Bloggs"
80
81 X509_NAME *nm;
82 nm = X509_NAME_new();
83 if (nm == NULL)
84 /* Some error */
85 if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
86 "C", "UK", -1, -1, 0))
87 /* Error */
88 if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
89 "O", "Disorganized Organization", -1, -1, 0))
90 /* Error */
91 if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
92 "CN", "Joe Bloggs", -1, -1, 0))
93 /* Error */
94
95=head1 RETURN VALUES
96
97X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ(),
98X509_NAME_add_entry_by_NID() and X509_NAME_add_entry() return 1 for
99success of 0 if an error occurred.
100
101X509_NAME_delete_entry() returns either the deleted B<X509_NAME_ENTRY>
102structure of B<NULL> if an error occurred.
103
104=head1 BUGS
105
106B<type> can still be set to B<V_ASN1_APP_CHOOSE> to use a
107different algorithm to determine field types. Since this form does
108not understand multicharacter types, performs no length checks and
109can result in invalid field types its use is strongly discouraged.
110
111=head1 SEE ALSO
112
113L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>
114
115=head1 HISTORY
116
117=cut
diff --git a/src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod b/src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod
deleted file mode 100644
index 48510890e8..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod
+++ /dev/null
@@ -1,102 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_get_index_by_NID, X509_NAME_get_index_by_OBJ, X509_NAME_get_entry,
6X509_NAME_entry_count, X509_NAME_get_text_by_NID, X509_NAME_get_text_by_OBJ -
7X509_NAME lookup and enumeration functions
8
9=head1 SYNOPSIS
10
11 #include <openssl/x509.h>
12
13 int X509_NAME_get_index_by_NID(X509_NAME *name,int nid,int lastpos);
14 int X509_NAME_get_index_by_OBJ(X509_NAME *name,ASN1_OBJECT *obj, int lastpos);
15
16 int X509_NAME_entry_count(X509_NAME *name);
17 X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
18
19 int X509_NAME_get_text_by_NID(X509_NAME *name, int nid, char *buf,int len);
20 int X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, char *buf,int len);
21
22=head1 DESCRIPTION
23
24These functions allow an B<X509_NAME> structure to be examined. The
25B<X509_NAME> structure is the same as the B<Name> type defined in
26RFC2459 (and elsewhere) and used for example in certificate subject
27and issuer names.
28
29X509_NAME_get_index_by_NID() and X509_NAME_get_index_by_OBJ() retrieve
30the next index matching B<nid> or B<obj> after B<lastpos>. B<lastpos>
31should initially be set to -1. If there are no more entries -1 is returned.
32
33X509_NAME_entry_count() returns the total number of entries in B<name>.
34
35X509_NAME_get_entry() retrieves the B<X509_NAME_ENTRY> from B<name>
36corresponding to index B<loc>. Acceptable values for B<loc> run from
370 to (X509_NAME_entry_count(name) - 1). The value returned is an
38internal pointer which must not be freed.
39
40X509_NAME_get_text_by_NID(), X509_NAME_get_text_by_OBJ() retrieve
41the "text" from the first entry in B<name> which matches B<nid> or
42B<obj>, if no such entry exists -1 is returned. At most B<len> bytes
43will be written and the text written to B<buf> will be null
44terminated. The length of the output string written is returned
45excluding the terminating null. If B<buf> is <NULL> then the amount
46of space needed in B<buf> (excluding the final null) is returned.
47
48=head1 NOTES
49
50X509_NAME_get_text_by_NID() and X509_NAME_get_text_by_OBJ() are
51legacy functions which have various limitations which make them
52of minimal use in practice. They can only find the first matching
53entry and will copy the contents of the field verbatim: this can
54be highly confusing if the target is a multicharacter string type
55like a BMPString or a UTF8String.
56
57For a more general solution X509_NAME_get_index_by_NID() or
58X509_NAME_get_index_by_OBJ() should be used followed by
59X509_NAME_get_entry() on any matching indices and then the
60various B<X509_NAME_ENTRY> utility functions on the result.
61
62=head1 EXAMPLES
63
64Process all entries:
65
66 int i;
67 X509_NAME_ENTRY *e;
68
69 for (i = 0; i < X509_NAME_entry_count(nm); i++) {
70 e = X509_NAME_get_entry(nm, i);
71 /* Do something with e */
72 }
73
74Process all commonName entries:
75
76 int loc;
77 X509_NAME_ENTRY *e;
78
79 loc = -1;
80 for (;;) {
81 lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos);
82 if (lastpos == -1)
83 break;
84 e = X509_NAME_get_entry(nm, lastpos);
85 /* Do something with e */
86 }
87
88=head1 RETURN VALUES
89
90X509_NAME_get_index_by_NID() and X509_NAME_get_index_by_OBJ()
91return the index of the next matching entry or -1 if not found.
92
93X509_NAME_entry_count() returns the total number of entries.
94
95X509_NAME_get_entry() returns an B<X509_NAME> pointer to the
96requested entry or B<NULL> if the index is invalid.
97
98=head1 SEE ALSO
99
100L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>
101
102=cut
diff --git a/src/lib/libcrypto/doc/X509_NAME_print_ex.pod b/src/lib/libcrypto/doc/X509_NAME_print_ex.pod
deleted file mode 100644
index 5cdf636c16..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_print_ex.pod
+++ /dev/null
@@ -1,103 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_print_ex, X509_NAME_print_ex_fp, X509_NAME_print,
6X509_NAME_oneline - X509_NAME printing routines.
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 int X509_NAME_print_ex(BIO *out, X509_NAME *nm, int indent, unsigned long flags);
13 int X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long flags);
14 char * X509_NAME_oneline(X509_NAME *a,char *buf,int size);
15 int X509_NAME_print(BIO *bp, X509_NAME *name, int obase);
16
17=head1 DESCRIPTION
18
19X509_NAME_print_ex() prints a human readable version of B<nm> to BIO B<out>.
20Each line (for multiline formats) is indented by B<indent> spaces. The output
21format can be extensively customised by use of the B<flags> parameter.
22
23X509_NAME_print_ex_fp() is identical to X509_NAME_print_ex() except the output
24is written to FILE pointer B<fp>.
25
26X509_NAME_oneline() prints an ASCII version of B<a> to B<buf>. At most B<size>
27bytes will be written. If B<buf> is B<NULL> then a buffer is dynamically
28allocated and returned, otherwise B<buf> is returned.
29
30X509_NAME_print() prints out B<name> to B<bp> indenting each line by B<obase>
31characters. Multiple lines are used if the output (including indent) exceeds
3280 characters.
33
34=head1 NOTES
35
36The functions X509_NAME_oneline() and X509_NAME_print() are legacy functions
37which produce a non standard output form, they don't handle multi character
38fields and have various quirks and inconsistencies. Their use is strongly
39discouraged in new applications.
40
41Although there are a large number of possible flags for most purposes
42B<XN_FLAG_ONELINE>, B<XN_FLAG_MULTILINE> or B<XN_FLAG_RFC2253> will suffice.
43As noted on the L<ASN1_STRING_print_ex(3)|ASN1_STRING_print_ex(3)> manual page
44for UTF8 terminals the B<ASN1_STRFLGS_ESC_MSB> should be unset: so for example
45B<XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB> would be used.
46
47The complete set of the flags supported by X509_NAME_print_ex() is listed below.
48
49Several options can be ored together.
50
51The options B<XN_FLAG_SEP_COMMA_PLUS>, B<XN_FLAG_SEP_CPLUS_SPC>,
52B<XN_FLAG_SEP_SPLUS_SPC> and B<XN_FLAG_SEP_MULTILINE> determine the field
53separators to use. Two distinct separators are used between distinct
54RelativeDistinguishedName components and separate values in the same RDN for a
55multi-valued RDN. Multi-valued RDNs are currently very rare so the second
56separator will hardly ever be used.
57
58B<XN_FLAG_SEP_COMMA_PLUS> uses comma and plus as separators.
59B<XN_FLAG_SEP_CPLUS_SPC> uses comma and plus with spaces: this is more readable
60that plain comma and plus. B<XN_FLAG_SEP_SPLUS_SPC> uses spaced semicolon and
61plus. B<XN_FLAG_SEP_MULTILINE> uses spaced newline and plus respectively.
62
63If B<XN_FLAG_DN_REV> is set the whole DN is printed in reversed order.
64
65The fields B<XN_FLAG_FN_SN>, B<XN_FLAG_FN_LN>, B<XN_FLAG_FN_OID>,
66B<XN_FLAG_FN_NONE> determine how a field name is displayed. It will
67use the short name (e.g. CN) the long name (e.g. commonName) always
68use OID numerical form (normally OIDs are only used if the field name is not
69recognised) and no field name respectively.
70
71If B<XN_FLAG_SPC_EQ> is set then spaces will be placed around the '=' character
72separating field names and values.
73
74If B<XN_FLAG_DUMP_UNKNOWN_FIELDS> is set then the encoding of unknown fields is
75printed instead of the values.
76
77If B<XN_FLAG_FN_ALIGN> is set then field names are padded to 20 characters: this
78is only of use for multiline format.
79
80Additionally all the options supported by ASN1_STRING_print_ex() can be used to
81control how each field value is displayed.
82
83In addition a number options can be set for commonly used formats.
84
85B<XN_FLAG_RFC2253> sets options which produce an output compatible with RFC2253 it
86is equivalent to:
87 B<ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV | XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS>
88
89
90B<XN_FLAG_ONELINE> is a more readable one line format which is the same as:
91 B<ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_SPC_EQ | XN_FLAG_FN_SN>
92
93B<XN_FLAG_MULTILINE> is a multiline format which is the same as:
94 B<ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE | XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN>
95
96B<XN_FLAG_COMPAT> uses a format identical to X509_NAME_print(): in fact it
97calls X509_NAME_print() internally.
98
99=head1 SEE ALSO
100
101L<ASN1_STRING_print_ex(3)|ASN1_STRING_print_ex(3)>
102
103=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
deleted file mode 100644
index 270b265ce5..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
+++ /dev/null
@@ -1,323 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_get_error, X509_STORE_CTX_set_error,
6X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert,
7X509_STORE_CTX_get1_chain, X509_verify_cert_error_string - get or set
8certificate verification status information
9
10=head1 SYNOPSIS
11
12 #include <openssl/x509.h>
13 #include <openssl/x509_vfy.h>
14
15 int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
16 void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
17 int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
18 X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
19
20 STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
21
22 const char *X509_verify_cert_error_string(long n);
23
24=head1 DESCRIPTION
25
26These functions are typically called after X509_verify_cert() has indicated
27an error or in a verification callback to determine the nature of an error.
28
29X509_STORE_CTX_get_error() returns the error code of B<ctx>, see
30the B<ERROR CODES> section for a full description of all error codes.
31
32X509_STORE_CTX_set_error() sets the error code of B<ctx> to B<s>. For example
33it might be used in a verification callback to set an error based on additional
34checks.
35
36X509_STORE_CTX_get_error_depth() returns the B<depth> of the error. This is a
37non-negative integer representing where in the certificate chain the error
38occurred. If it is zero it occurred in the end entity certificate, one if
39it is the certificate which signed the end entity certificate and so on.
40
41X509_STORE_CTX_get_current_cert() returns the certificate in B<ctx> which
42caused the error or B<NULL> if no certificate is relevant.
43
44X509_STORE_CTX_get1_chain() returns a complete validate chain if a previous
45call to X509_verify_cert() is successful. If the call to X509_verify_cert()
46is B<not> successful the returned chain may be incomplete or invalid. The
47returned chain persists after the B<ctx> structure is freed, when it is
48no longer needed it should be free up using:
49
50 sk_X509_pop_free(chain, X509_free);
51
52X509_verify_cert_error_string() returns a human readable error string for
53verification error B<n>.
54
55=head1 RETURN VALUES
56
57X509_STORE_CTX_get_error() returns B<X509_V_OK> or an error code.
58
59X509_STORE_CTX_get_error_depth() returns a non-negative error depth.
60
61X509_STORE_CTX_get_current_cert() returns the certificate which caused the
62error or B<NULL> if no certificate is relevant to the error.
63
64X509_verify_cert_error_string() returns a human readable error string for
65verification error B<n>.
66
67=head1 ERROR CODES
68
69A list of error codes and messages is shown below. Some of the
70error codes are defined but currently never returned: these are described as
71"unused".
72
73=over 4
74
75=item B<X509_V_OK: ok>
76
77the operation was successful.
78
79=item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: unable to get issuer certificate>
80
81the issuer certificate could not be found: this occurs if the issuer certificate
82of an untrusted certificate cannot be found.
83
84=item B<X509_V_ERR_UNABLE_TO_GET_CRL: unable to get certificate CRL>
85
86the CRL of a certificate could not be found.
87
88=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: unable to decrypt
89certificate's signature>
90
91the certificate signature could not be decrypted. This means that the actual
92signature value could not be determined rather than it not matching the
93expected value, this is only meaningful for RSA keys.
94
95=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: unable to decrypt CRL's
96signature>
97
98the CRL signature could not be decrypted: this means that the actual signature
99value could not be determined rather than it not matching the expected value.
100Unused.
101
102=item B<X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: unable to decode issuer
103public key>
104
105the public key in the certificate SubjectPublicKeyInfo could not be read.
106
107=item B<X509_V_ERR_CERT_SIGNATURE_FAILURE: certificate signature failure>
108
109the signature of the certificate is invalid.
110
111=item B<X509_V_ERR_CRL_SIGNATURE_FAILURE: CRL signature failure>
112
113the signature of the certificate is invalid.
114
115=item B<X509_V_ERR_CERT_NOT_YET_VALID: certificate is not yet valid>
116
117the certificate is not yet valid: the notBefore date is after the current time.
118
119=item B<X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired>
120
121the certificate has expired: that is the notAfter date is before the current
122time.
123
124=item B<X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid>
125
126the CRL is not yet valid.
127
128=item B<X509_V_ERR_CRL_HAS_EXPIRED: CRL has expired>
129
130the CRL has expired.
131
132=item B<X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: format error in
133certificate's notBefore field>
134
135the certificate notBefore field contains an invalid time.
136
137=item B<X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: format error in certificate's
138notAfter field>
139
140the certificate notAfter field contains an invalid time.
141
142=item B<X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: format error in CRL's
143lastUpdate field>
144
145the CRL lastUpdate field contains an invalid time.
146
147=item B<X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: format error in CRL's
148nextUpdate field>
149
150the CRL nextUpdate field contains an invalid time.
151
152=item B<X509_V_ERR_OUT_OF_MEM: out of memory>
153
154an error occurred trying to allocate memory. This should never happen.
155
156=item B<X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: self signed certificate>
157
158the passed certificate is self signed and the same certificate cannot be found
159in the list of trusted certificates.
160
161=item B<X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in
162certificate chain>
163
164the certificate chain could be built up using the untrusted certificates but
165the root could not be found locally.
166
167=item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local
168issuer certificate>
169
170the issuer certificate of a locally looked up certificate could not be found.
171This normally means the list of trusted certificates is not complete.
172
173=item B<X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: unable to verify the first
174certificate>
175
176no signatures could be verified because the chain contains only one certificate
177and it is not self signed.
178
179=item B<X509_V_ERR_CERT_CHAIN_TOO_LONG: certificate chain too long>
180
181the certificate chain length is greater than the supplied maximum depth. Unused.
182
183=item B<X509_V_ERR_CERT_REVOKED: certificate revoked>
184
185the certificate has been revoked.
186
187=item B<X509_V_ERR_INVALID_CA: invalid CA certificate>
188
189a CA certificate is invalid. Either it is not a CA or its extensions are not
190consistent with the supplied purpose.
191
192=item B<X509_V_ERR_PATH_LENGTH_EXCEEDED: path length constraint exceeded>
193
194the basicConstraints pathlength parameter has been exceeded.
195
196=item B<X509_V_ERR_INVALID_PURPOSE: unsupported certificate purpose>
197
198the supplied certificate cannot be used for the specified purpose.
199
200=item B<X509_V_ERR_CERT_UNTRUSTED: certificate not trusted>
201
202the root CA is not marked as trusted for the specified purpose.
203
204=item B<X509_V_ERR_CERT_REJECTED: certificate rejected>
205
206the root CA is marked to reject the specified purpose.
207
208=item B<X509_V_ERR_SUBJECT_ISSUER_MISMATCH: subject issuer mismatch>
209
210the current candidate issuer certificate was rejected because its subject name
211did not match the issuer name of the current certificate. This is only set
212if issuer check debugging is enabled it is used for status notification and
213is B<not> in itself an error.
214
215=item B<X509_V_ERR_AKID_SKID_MISMATCH: authority and subject key identifier
216mismatch>
217
218the current candidate issuer certificate was rejected because its subject key
219identifier was present and did not match the authority key identifier current
220certificate. This is only set if issuer check debugging is enabled it is used
221for status notification and is B<not> in itself an error.
222
223=item B<X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: authority and issuer serial
224number mismatch>
225
226the current candidate issuer certificate was rejected because its issuer name
227and serial number was present and did not match the authority key identifier of
228the current certificate. This is only set if issuer check debugging is enabled
229it is used for status notification and is B<not> in itself an error.
230
231=item B<X509_V_ERR_KEYUSAGE_NO_CERTSIGN:key usage does not include certificate
232signing>
233
234the current candidate issuer certificate was rejected because its keyUsage
235extension does not permit certificate signing. This is only set if issuer check
236debugging is enabled it is used for status notification and is B<not> in itself
237an error.
238
239=item B<X509_V_ERR_INVALID_EXTENSION: invalid or inconsistent certificate
240extension>
241
242A certificate extension had an invalid value (for example an incorrect
243encoding) or some value inconsistent with other extensions.
244
245
246=item B<X509_V_ERR_INVALID_POLICY_EXTENSION: invalid or inconsistent
247certificate policy extension>
248
249A certificate policies extension had an invalid value (for example an incorrect
250encoding) or some value inconsistent with other extensions. This error only
251occurs if policy processing is enabled.
252
253=item B<X509_V_ERR_NO_EXPLICIT_POLICY: no explicit policy>
254
255The verification flags were set to require and explicit policy but none was
256present.
257
258=item B<X509_V_ERR_DIFFERENT_CRL_SCOPE: Different CRL scope>
259
260The only CRLs that could be found did not match the scope of the certificate.
261
262=item B<X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE: Unsupported extension feature>
263
264Some feature of a certificate extension is not supported. Unused.
265
266=item B<X509_V_ERR_PERMITTED_VIOLATION: permitted subtree violation>
267
268A name constraint violation occurred in the permitted subtrees.
269
270=item B<X509_V_ERR_EXCLUDED_VIOLATION: excluded subtree violation>
271
272A name constraint violation occurred in the excluded subtrees.
273
274=item B<X509_V_ERR_SUBTREE_MINMAX: name constraints minimum and maximum not
275supported>
276
277A certificate name constraints extension included a minimum or maximum field:
278this is not supported.
279
280=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: unsupported name constraint
281type>
282
283An unsupported name constraint type was encountered. OpenSSL currently only
284supports directory name, DNS name, email and URI types.
285
286=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: unsupported or invalid name
287constraint syntax>
288
289The format of the name constraint is not recognised: for example an email
290address format of a form not mentioned in RFC3280. This could be caused by
291a garbage extension or some new feature not currently supported.
292
293=item B<X509_V_ERR_CRL_PATH_VALIDATION_ERROR: CRL path validation error>
294
295An error occurred when attempting to verify the CRL path. This error can only
296happen if extended CRL checking is enabled.
297
298=item B<X509_V_ERR_APPLICATION_VERIFICATION: application verification failure>
299
300an application specific error. This will never be returned unless explicitly
301set by an application.
302
303=back
304
305=head1 NOTES
306
307The above functions should be used instead of directly referencing the fields
308in the B<X509_VERIFY_CTX> structure.
309
310In versions of OpenSSL before 1.0 the current certificate returned by
311X509_STORE_CTX_get_current_cert() was never B<NULL>. Applications should
312check the return value before printing out any debugging information relating
313to the current certificate.
314
315If an unrecognised error code is passed to X509_verify_cert_error_string() the
316numerical value of the unknown code is returned in a static buffer. This is not
317thread safe but will never happen unless an invalid code is passed.
318
319=head1 SEE ALSO
320
321L<X509_verify_cert(3)|X509_verify_cert(3)>
322
323=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod
deleted file mode 100644
index 25224cef1b..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod
+++ /dev/null
@@ -1,43 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_get_ex_new_index, X509_STORE_CTX_set_ex_data,
6X509_STORE_CTX_get_ex_data - add application specific data to X509_STORE_CTX
7structures
8
9=head1 SYNOPSIS
10
11 #include <openssl/x509_vfy.h>
12
13 int X509_STORE_CTX_get_ex_new_index(long argl, void *argp,
14 CRYPTO_EX_new *new_func,
15 CRYPTO_EX_dup *dup_func,
16 CRYPTO_EX_free *free_func);
17
18 int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *d, int idx, void *arg);
19
20 void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *d, int idx);
21
22=head1 DESCRIPTION
23
24These functions handle application specific data in X509_STORE_CTX structures.
25Their usage is identical to that of RSA_get_ex_new_index(), RSA_set_ex_data()
26and RSA_get_ex_data() as described in L<RSA_get_ex_new_index(3)>.
27
28=head1 NOTES
29
30This mechanism is used internally by the B<ssl> library to store the B<SSL>
31structure associated with a verification operation in an B<X509_STORE_CTX>
32structure.
33
34=head1 SEE ALSO
35
36L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>
37
38=head1 HISTORY
39
40X509_STORE_CTX_get_ex_new_index(), X509_STORE_CTX_set_ex_data() and
41X509_STORE_CTX_get_ex_data() are available since OpenSSL 0.9.5.
42
43=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_new.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_new.pod
deleted file mode 100644
index 66c0da04d2..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_new.pod
+++ /dev/null
@@ -1,126 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_new, X509_STORE_CTX_cleanup, X509_STORE_CTX_free,
6X509_STORE_CTX_init, X509_STORE_CTX_trusted_stack, X509_STORE_CTX_set_cert,
7X509_STORE_CTX_set_chain, X509_STORE_CTX_set0_crls, X509_STORE_CTX_get0_param,
8X509_STORE_CTX_set0_param, X509_STORE_CTX_set_default - X509_STORE_CTX
9initialisation
10
11=head1 SYNOPSIS
12
13 #include <openssl/x509_vfy.h>
14
15 X509_STORE_CTX *X509_STORE_CTX_new(void);
16 void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
17 void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
18
19 int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
20 X509 *x509, STACK_OF(X509) *chain);
21
22 void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
23
24 void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx,X509 *x);
25 void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx,STACK_OF(X509) *sk);
26 void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk);
27
28 X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
29 void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
30 int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
31
32=head1 DESCRIPTION
33
34These functions initialise an B<X509_STORE_CTX> structure for subsequent use
35by X509_verify_cert().
36
37X509_STORE_CTX_new() returns a newly initialised B<X509_STORE_CTX> structure.
38
39X509_STORE_CTX_cleanup() internally cleans up an B<X509_STORE_CTX> structure.
40The context can then be reused with an new call to X509_STORE_CTX_init().
41
42X509_STORE_CTX_free() completely frees up B<ctx>. After this call B<ctx>
43is no longer valid.
44
45X509_STORE_CTX_init() sets up B<ctx> for a subsequent verification operation.
46The trusted certificate store is set to B<store>, the end entity certificate
47to be verified is set to B<x509> and a set of additional certificates (which
48will be untrusted but may be used to build the chain) in B<chain>. Any or
49all of the B<store>, B<x509> and B<chain> parameters can be B<NULL>.
50
51X509_STORE_CTX_trusted_stack() sets the set of trusted certificates of B<ctx>
52to B<sk>. This is an alternative way of specifying trusted certificates
53instead of using an B<X509_STORE>.
54
55X509_STORE_CTX_set_cert() sets the certificate to be verified in B<ctx> to
56B<x>.
57
58X509_STORE_CTX_set_chain() sets the additional certificate chain used by B<ctx>
59to B<sk>.
60
61X509_STORE_CTX_set0_crls() sets a set of CRLs to use to aid certificate
62verification to B<sk>. These CRLs will only be used if CRL verification is
63enabled in the associated B<X509_VERIFY_PARAM> structure. This might be
64used where additional "useful" CRLs are supplied as part of a protocol,
65for example in a PKCS#7 structure.
66
67X509_VERIFY_PARAM *X509_STORE_CTX_get0_param() retrieves an internal pointer
68to the verification parameters associated with B<ctx>.
69
70X509_STORE_CTX_set0_param() sets the internal verification parameter pointer
71to B<param>. After this call B<param> should not be used.
72
73X509_STORE_CTX_set_default() looks up and sets the default verification
74method to B<name>. This uses the function X509_VERIFY_PARAM_lookup() to
75find an appropriate set of parameters from B<name>.
76
77=head1 NOTES
78
79The certificates and CRLs in a store are used internally and should B<not>
80be freed up until after the associated B<X509_STORE_CTX> is freed. Legacy
81applications might implicitly use an B<X509_STORE_CTX> like this:
82
83 X509_STORE_CTX ctx;
84 X509_STORE_CTX_init(&ctx, store, cert, chain);
85
86this is B<not> recommended in new applications they should instead do:
87
88 X509_STORE_CTX *ctx;
89 ctx = X509_STORE_CTX_new();
90 if (ctx == NULL)
91 /* Bad error */
92 X509_STORE_CTX_init(ctx, store, cert, chain);
93
94=head1 BUGS
95
96The certificates and CRLs in a context are used internally and should B<not>
97be freed up until after the associated B<X509_STORE_CTX> is freed. Copies
98should be made or reference counts increased instead.
99
100=head1 RETURN VALUES
101
102X509_STORE_CTX_new() returns an newly allocates context or B<NULL> is an
103error occurred.
104
105X509_STORE_CTX_init() returns 1 for success or 0 if an error occurred.
106
107X509_STORE_CTX_get0_param() returns a pointer to an B<X509_VERIFY_PARAM>
108structure or B<NULL> if an error occurred.
109
110X509_STORE_CTX_cleanup(), X509_STORE_CTX_free(), X509_STORE_CTX_trusted_stack(),
111X509_STORE_CTX_set_cert(), X509_STORE_CTX_set_chain(),
112X509_STORE_CTX_set0_crls() and X509_STORE_CTX_set0_param() do not return
113values.
114
115X509_STORE_CTX_set_default() returns 1 for success or 0 if an error occurred.
116
117=head1 SEE ALSO
118
119L<X509_verify_cert(3)|X509_verify_cert(3)>
120L<X509_VERIFY_PARAM_set_flags(3)|X509_VERIFY_PARAM_set_flags(3)>
121
122=head1 HISTORY
123
124X509_STORE_CTX_set0_crls() was first added to OpenSSL 1.0.0
125
126=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod
deleted file mode 100644
index 7dfe430c4c..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod
+++ /dev/null
@@ -1,165 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_set_verify_cb - set verification callback
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509_vfy.h>
10
11 void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
12 int (*verify_cb)(int ok, X509_STORE_CTX *ctx));
13
14=head1 DESCRIPTION
15
16X509_STORE_CTX_set_verify_cb() sets the verification callback of B<ctx> to
17B<verify_cb> overwriting any existing callback.
18
19The verification callback can be used to customise the operation of certificate
20verification, either by overriding error conditions or logging errors for
21debugging purposes.
22
23However a verification callback is B<not> essential and the default operation
24is often sufficient.
25
26The B<ok> parameter to the callback indicates the value the callback should
27return to retain the default behaviour. If it is zero then and error condition
28is indicated. If it is 1 then no error occurred. If the flag
29B<X509_V_FLAG_NOTIFY_POLICY> is set then B<ok> is set to 2 to indicate the
30policy checking is complete.
31
32The B<ctx> parameter to the callback is the B<X509_STORE_CTX> structure that
33is performing the verification operation. A callback can examine this
34structure and receive additional information about the error, for example
35by calling X509_STORE_CTX_get_current_cert(). Additional application data can
36be passed to the callback via the B<ex_data> mechanism.
37
38=head1 WARNING
39
40In general a verification callback should B<NOT> unconditionally return 1 in
41all circumstances because this will allow verification to succeed no matter
42what the error. This effectively removes all security from the application
43because B<any> certificate (including untrusted generated ones) will be
44accepted.
45
46=head1 NOTES
47
48The verification callback can be set and inherited from the parent structure
49performing the operation. In some cases (such as S/MIME verification) the
50B<X509_STORE_CTX> structure is created and destroyed internally and the
51only way to set a custom verification callback is by inheriting it from the
52associated B<X509_STORE>.
53
54=head1 RETURN VALUES
55
56X509_STORE_CTX_set_verify_cb() does not return a value.
57
58=head1 EXAMPLES
59
60Default callback operation:
61
62 int
63 verify_callback(int ok, X509_STORE_CTX *ctx)
64 {
65 return ok;
66 }
67
68Simple example, suppose a certificate in the chain is expired and we wish
69to continue after this error:
70
71 int
72 verify_callback(int ok, X509_STORE_CTX *ctx)
73 {
74 /* Tolerate certificate expiration */
75 if (X509_STORE_CTX_get_error(ctx) == X509_V_ERR_CERT_HAS_EXPIRED)
76 return 1;
77 /* Otherwise don't override */
78 return ok;
79 }
80
81More complex example, we don't wish to continue after B<any> certificate has
82expired just one specific case:
83
84 int
85 verify_callback(int ok, X509_STORE_CTX *ctx)
86 {
87 int err = X509_STORE_CTX_get_error(ctx);
88 X509 *err_cert = X509_STORE_CTX_get_current_cert(ctx);
89
90 if (err == X509_V_ERR_CERT_HAS_EXPIRED) {
91 if (check_is_acceptable_expired_cert(err_cert)
92 return 1;
93 }
94 return ok;
95 }
96
97Full featured logging callback. In this case the B<bio_err> is assumed to be
98a global logging B<BIO>, an alternative would to store a BIO in B<ctx> using
99B<ex_data>.
100
101 int
102 verify_callback(int ok, X509_STORE_CTX *ctx)
103 {
104 X509 *err_cert;
105 int err,depth;
106
107 err_cert = X509_STORE_CTX_get_current_cert(ctx);
108 err = X509_STORE_CTX_get_error(ctx);
109 depth = X509_STORE_CTX_get_error_depth(ctx);
110
111 BIO_printf(bio_err,"depth=%d ",depth);
112 if (err_cert) {
113 X509_NAME_print_ex(bio_err,
114 X509_get_subject_name(err_cert), 0,
115 XN_FLAG_ONELINE);
116 BIO_puts(bio_err, "\n");
117 } else
118 BIO_puts(bio_err, "<no cert>\n");
119 if (!ok)
120 BIO_printf(bio_err, "verify error:num=%d:%s\n",
121 err, X509_verify_cert_error_string(err));
122 switch (err) {
123 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
124 BIO_puts(bio_err, "issuer= ");
125 X509_NAME_print_ex(bio_err,
126 X509_get_issuer_name(err_cert), 0,
127 XN_FLAG_ONELINE);
128 BIO_puts(bio_err, "\n");
129 break;
130 case X509_V_ERR_CERT_NOT_YET_VALID:
131 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
132 BIO_printf(bio_err, "notBefore=");
133 ASN1_TIME_print(bio_err,
134 X509_get_notBefore(err_cert));
135 BIO_printf(bio_err, "\n");
136 break;
137 case X509_V_ERR_CERT_HAS_EXPIRED:
138 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
139 BIO_printf(bio_err, "notAfter=");
140 ASN1_TIME_print(bio_err, X509_get_notAfter(err_cert));
141 BIO_printf(bio_err, "\n");
142 break;
143 case X509_V_ERR_NO_EXPLICIT_POLICY:
144 policies_print(bio_err, ctx);
145 break;
146 }
147 if (err == X509_V_OK && ok == 2)
148 /* print out policies */
149
150 BIO_printf(bio_err,"verify return:%d\n",ok);
151 return(ok);
152 }
153
154=head1 SEE ALSO
155
156L<X509_STORE_CTX_get_error(3)|X509_STORE_CTX_get_error(3)>
157L<X509_STORE_set_verify_cb_func(3)|X509_STORE_set_verify_cb_func(3)>
158L<X509_STORE_CTX_get_ex_new_index(3)|X509_STORE_CTX_get_ex_new_index(3)>
159
160=head1 HISTORY
161
162X509_STORE_CTX_set_verify_cb() is available in all versions of SSLeay and
163OpenSSL.
164
165=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod b/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod
deleted file mode 100644
index 754512341c..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod
+++ /dev/null
@@ -1,54 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_set_verify_cb_func, X509_STORE_set_verify_cb - set verification
6callback
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509_vfy.h>
11
12 void X509_STORE_set_verify_cb(X509_STORE *st,
13 int (*verify_cb)(int ok, X509_STORE_CTX *ctx));
14
15 void X509_STORE_set_verify_cb_func(X509_STORE *st,
16 int (*verify_cb)(int ok, X509_STORE_CTX *ctx));
17
18=head1 DESCRIPTION
19
20X509_STORE_set_verify_cb() sets the verification callback of B<ctx> to
21B<verify_cb> overwriting any existing callback.
22
23X509_STORE_set_verify_cb_func() also sets the verification callback but it
24is implemented as a macro.
25
26=head1 NOTES
27
28The verification callback from an B<X509_STORE> is inherited by
29the corresponding B<X509_STORE_CTX> structure when it is initialized. This can
30be used to set the verification callback when the B<X509_STORE_CTX> is
31otherwise inaccessible (for example during S/MIME verification).
32
33=head1 BUGS
34
35The macro version of this function was the only one available before
36OpenSSL 1.0.0.
37
38=head1 RETURN VALUES
39
40X509_STORE_set_verify_cb() and X509_STORE_set_verify_cb_func() do not return
41a value.
42
43=head1 SEE ALSO
44
45L<X509_STORE_CTX_set_verify_cb(3)|X509_STORE_CTX_set_verify_cb(3)>
46
47=head1 HISTORY
48
49X509_STORE_set_verify_cb_func() is available in all versions of SSLeay and
50OpenSSL.
51
52X509_STORE_set_verify_cb() was added to OpenSSL 1.0.0.
53
54=cut
diff --git a/src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod b/src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod
deleted file mode 100644
index 6c88aec49e..0000000000
--- a/src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod
+++ /dev/null
@@ -1,172 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_VERIFY_PARAM_set_flags, X509_VERIFY_PARAM_clear_flags,
6X509_VERIFY_PARAM_get_flags, X509_VERIFY_PARAM_set_purpose,
7X509_VERIFY_PARAM_set_trust, X509_VERIFY_PARAM_set_depth,
8X509_VERIFY_PARAM_get_depth, X509_VERIFY_PARAM_set_time,
9X509_VERIFY_PARAM_add0_policy, X509_VERIFY_PARAM_set1_policies - X509
10verification parameters
11
12=head1 SYNOPSIS
13
14 #include <openssl/x509_vfy.h>
15
16 int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);
17 int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
18 unsigned long flags);
19 unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);
20
21 int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
22 int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
23
24 void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
25
26 int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
27 ASN1_OBJECT *policy);
28 int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
29 STACK_OF(ASN1_OBJECT) *policies);
30
31 void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
32 int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);
33
34=head1 DESCRIPTION
35
36These functions manipulate the B<X509_VERIFY_PARAM> structure associated with
37a certificate verification operation.
38
39The X509_VERIFY_PARAM_set_flags() function sets the flags in B<param> by oring
40it with B<flags>. See the B<VERIFICATION FLAGS> section for a complete
41description of values the B<flags> parameter can take.
42
43X509_VERIFY_PARAM_get_flags() returns the flags in B<param>.
44
45X509_VERIFY_PARAM_clear_flags() clears the flags B<flags> in B<param>.
46
47X509_VERIFY_PARAM_set_purpose() sets the verification purpose in B<param>
48to B<purpose>. This determines the acceptable purpose of the certificate
49chain, for example SSL client or SSL server.
50
51X509_VERIFY_PARAM_set_trust() sets the trust setting in B<param> to
52B<trust>.
53
54X509_VERIFY_PARAM_set_time() sets the verification time in B<param> to
55B<t>. Normally the current time is used.
56
57X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled
58by default) and adds B<policy> to the acceptable policy set.
59
60X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled
61by default) and sets the acceptable policy set to B<policies>. Any existing
62policy set is cleared. The B<policies> parameter can be B<NULL> to clear
63an existing policy set.
64
65X509_VERIFY_PARAM_set_depth() sets the maximum verification depth to B<depth>.
66That is the maximum number of untrusted CA certificates that can appear in a
67chain.
68
69=head1 RETURN VALUES
70
71X509_VERIFY_PARAM_set_flags(), X509_VERIFY_PARAM_clear_flags(),
72X509_VERIFY_PARAM_set_purpose(), X509_VERIFY_PARAM_set_trust(),
73X509_VERIFY_PARAM_add0_policy() and X509_VERIFY_PARAM_set1_policies() return 1
74for success and 0 for failure.
75
76X509_VERIFY_PARAM_get_flags() returns the current verification flags.
77
78X509_VERIFY_PARAM_set_time() and X509_VERIFY_PARAM_set_depth() do not return
79values.
80
81X509_VERIFY_PARAM_get_depth() returns the current verification depth.
82
83=head1 VERIFICATION FLAGS
84
85The verification flags consists of zero or more of the following flags
86ored together.
87
88B<X509_V_FLAG_CRL_CHECK> enables CRL checking for the certificate chain leaf
89certificate. An error occurs if a suitable CRL cannot be found.
90
91B<X509_V_FLAG_CRL_CHECK_ALL> enables CRL checking for the entire certificate
92chain.
93
94B<X509_V_FLAG_IGNORE_CRITICAL> disabled critical extension checking. By default
95any unhandled critical extensions in certificates or (if checked) CRLs results
96in a fatal error. If this flag is set unhandled critical extensions are
97ignored. B<WARNING> setting this option for anything other than debugging
98purposes can be a security risk. Finer control over which extensions are
99supported can be performed in the verification callback.
100
101THe B<X509_V_FLAG_X509_STRICT> flag disables workarounds for some broken
102certificates and makes the verification strictly apply B<X509> rules.
103
104B<X509_V_FLAG_ALLOW_PROXY_CERTS> enables proxy certificate verification.
105
106B<X509_V_FLAG_POLICY_CHECK> enables certificate policy checking, by default
107no policy checking is performed. Additional information is sent to the
108verification callback relating to policy checking.
109
110B<X509_V_FLAG_EXPLICIT_POLICY>, B<X509_V_FLAG_INHIBIT_ANY> and
111B<X509_V_FLAG_INHIBIT_MAP> set the B<require explicit policy>, B<inhibit any
112policy> and B<inhibit policy mapping> flags respectively as defined in
113B<RFC3280>. Policy checking is automatically enabled if any of these flags
114are set.
115
116If B<X509_V_FLAG_NOTIFY_POLICY> is set and the policy checking is successful
117a special status code is set to the verification callback. This permits it
118to examine the valid policy tree and perform additional checks or simply
119log it for debugging purposes.
120
121By default some additional features such as indirect CRLs and CRLs signed by
122different keys are disabled. If B<X509_V_FLAG_EXTENDED_CRL_SUPPORT> is set
123they are enabled.
124
125If B<X509_V_FLAG_USE_DELTAS> ise set delta CRLs (if present) are used to
126determine certificate status. If not set deltas are ignored.
127
128B<X509_V_FLAG_CHECK_SS_SIGNATURE> enables checking of the root CA self signed
129certificate signature. By default this check is disabled because it doesn't
130add any additional security but in some cases applications might want to
131check the signature anyway. A side effect of not checking the root CA
132signature is that disabled or unsupported message digests on the root CA
133are not treated as fatal errors.
134
135The B<X509_V_FLAG_CB_ISSUER_CHECK> flag enables debugging of certificate
136issuer checks. It is B<not> needed unless you are logging certificate
137verification. If this flag is set then additional status codes will be sent
138to the verification callback and it B<must> be prepared to handle such cases
139without assuming they are hard errors.
140
141=head1 NOTES
142
143The above functions should be used to manipulate verification parameters
144instead of legacy functions which work in specific structures such as
145X509_STORE_CTX_set_flags().
146
147=head1 BUGS
148
149Delta CRL checking is currently primitive. Only a single delta can be used and
150(partly due to limitations of B<X509_STORE>) constructed CRLs are not
151maintained.
152
153If CRLs checking is enable CRLs are expected to be available in the
154corresponding B<X509_STORE> structure. No attempt is made to download
155CRLs from the CRL distribution points extension.
156
157=head1 EXAMPLE
158
159Enable CRL checking when performing certificate verification during SSL
160connections associated with an B<SSL_CTX> structure B<ctx>:
161
162 X509_VERIFY_PARAM *param;
163 param = X509_VERIFY_PARAM_new();
164 X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
165 SSL_CTX_set1_param(ctx, param);
166 X509_VERIFY_PARAM_free(param);
167
168=head1 SEE ALSO
169
170L<X509_verify_cert(3)|X509_verify_cert(3)>
171
172=cut
diff --git a/src/lib/libcrypto/doc/X509_new.pod b/src/lib/libcrypto/doc/X509_new.pod
deleted file mode 100644
index a36808b825..0000000000
--- a/src/lib/libcrypto/doc/X509_new.pod
+++ /dev/null
@@ -1,38 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_new, X509_free - X509 certificate ASN1 allocation functions
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509 *X509_new(void);
12 void X509_free(X509 *a);
13
14=head1 DESCRIPTION
15
16The X509 ASN1 allocation routines, allocate and free an
17X509 structure, which represents an X509 certificate.
18
19X509_new() allocates and initializes a X509 structure.
20
21X509_free() frees up the B<X509> structure B<a>.
22If B<a> is a B<NULL> pointer, no action occurs.
23
24=head1 RETURN VALUES
25
26If the allocation fails, X509_new() returns B<NULL> and sets an error
27code that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
28Otherwise it returns a pointer to the newly allocated structure.
29
30=head1 SEE ALSO
31
32L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509(3)|d2i_X509(3)>
33
34=head1 HISTORY
35
36X509_new() and X509_free() are available in all versions of SSLeay and OpenSSL.
37
38=cut
diff --git a/src/lib/libcrypto/doc/X509_verify_cert.pod b/src/lib/libcrypto/doc/X509_verify_cert.pod
deleted file mode 100644
index f05edd8333..0000000000
--- a/src/lib/libcrypto/doc/X509_verify_cert.pod
+++ /dev/null
@@ -1,53 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_verify_cert - discover and verify X509 certificate chain
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 int X509_verify_cert(X509_STORE_CTX *ctx);
12
13=head1 DESCRIPTION
14
15The X509_verify_cert() function attempts to discover and validate a
16certificate chain based on parameters in B<ctx>. A complete description of
17the process is contained in the L<verify(1)|verify(1)> manual page.
18
19=head1 RETURN VALUES
20
21If a complete chain can be built and validated this function returns 1,
22otherwise it return zero, in exceptional circumstances it can also
23return a negative code.
24
25If the function fails additional error information can be obtained by
26examining B<ctx> using, for example X509_STORE_CTX_get_error().
27
28=head1 NOTES
29
30Applications rarely call this function directly but it is used by
31OpenSSL internally for certificate validation, in both the S/MIME and
32SSL/TLS code.
33
34The negative return value from X509_verify_cert() can only occur if no
35certificate is set in B<ctx> (due to a programming error) or if a retry
36operation is requested during internal lookups (which never happens with
37standard lookup methods). It is however recommended that application check
38for <= 0 return value on error.
39
40=head1 BUGS
41
42This function uses the header B<x509.h> as opposed to most chain verification
43functions which use B<x509_vfy.h>.
44
45=head1 SEE ALSO
46
47L<X509_STORE_CTX_get_error(3)|X509_STORE_CTX_get_error(3)>
48
49=head1 HISTORY
50
51X509_verify_cert() is available in all versions of SSLeay and OpenSSL.
52
53=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509.pod b/src/lib/libcrypto/doc/d2i_X509.pod
deleted file mode 100644
index fad4e8c35b..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509.pod
+++ /dev/null
@@ -1,231 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509, i2d_X509, d2i_X509_bio, d2i_X509_fp, i2d_X509_bio,
6i2d_X509_fp - X509 encode and decode functions
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 X509 *d2i_X509(X509 **px, const unsigned char **in, int len);
13 int i2d_X509(X509 *x, unsigned char **out);
14
15 X509 *d2i_X509_bio(BIO *bp, X509 **x);
16 X509 *d2i_X509_fp(FILE *fp, X509 **x);
17
18 int i2d_X509_bio(BIO *bp, X509 *x);
19 int i2d_X509_fp(FILE *fp, X509 *x);
20
21=head1 DESCRIPTION
22
23The X509 encode and decode routines encode and parse an
24B<X509> structure, which represents an X509 certificate.
25
26d2i_X509() attempts to decode B<len> bytes at B<*in>. If
27successful a pointer to the B<X509> structure is returned. If an error
28occurred then B<NULL> is returned. If B<px> is not B<NULL> then the
29returned structure is written to B<*px>. If B<*px> is not B<NULL>
30then it is assumed that B<*px> contains a valid B<X509>
31structure and an attempt is made to reuse it. If the call is
32successful B<*in> is incremented to the byte following the
33parsed data.
34
35i2d_X509() encodes the structure pointed to by B<x> into DER format.
36If B<out> is not B<NULL> is writes the DER encoded data to the buffer
37at B<*out>, and increments it to point after the data just written.
38If the return value is negative an error occurred, otherwise it
39returns the length of the encoded data.
40
41For OpenSSL 0.9.7 and later if B<*out> is B<NULL> memory will be
42allocated for a buffer and the encoded data written to it. In this
43case B<*out> is not incremented and it points to the start of the
44data just written.
45
46d2i_X509_bio() is similar to d2i_X509() except it attempts
47to parse data from BIO B<bp>.
48
49d2i_X509_fp() is similar to d2i_X509() except it attempts
50to parse data from FILE pointer B<fp>.
51
52i2d_X509_bio() is similar to i2d_X509() except it writes
53the encoding of the structure B<x> to BIO B<bp> and it
54returns 1 for success and 0 for failure.
55
56i2d_X509_fp() is similar to i2d_X509() except it writes
57the encoding of the structure B<x> to BIO B<bp> and it
58returns 1 for success and 0 for failure.
59
60=head1 NOTES
61
62The letters B<i> and B<d> in for example B<i2d_X509> stand for
63"internal" (that is an internal C structure) and "DER". So that
64B<i2d_X509> converts from internal to DER.
65
66The functions can also understand B<BER> forms.
67
68The actual X509 structure passed to i2d_X509() must be a valid
69populated B<X509> structure it can B<not> simply be fed with an
70empty structure such as that returned by X509_new().
71
72The encoded data is in binary form and may contain embedded zeroes.
73Therefore any FILE pointers or BIOs should be opened in binary mode.
74Functions such as B<strlen()> will B<not> return the correct length
75of the encoded structure.
76
77The ways that B<*in> and B<*out> are incremented after the operation
78can trap the unwary. See the B<WARNINGS> section for some common
79errors.
80
81The reason for the auto increment behaviour is to reflect a typical
82usage of ASN1 functions: after one structure is encoded or decoded
83another will processed after it.
84
85=head1 EXAMPLES
86
87Allocate and encode the DER encoding of an X509 structure:
88
89 int len;
90 unsigned char *buf, *p;
91
92 len = i2d_X509(x, NULL);
93
94 buf = malloc(len);
95
96 if (buf == NULL)
97 /* error */
98
99 p = buf;
100
101 i2d_X509(x, &p);
102
103If you are using OpenSSL 0.9.7 or later then this can be
104simplified to:
105
106
107 int len;
108 unsigned char *buf;
109
110 buf = NULL;
111
112 len = i2d_X509(x, &buf);
113
114 if (len < 0)
115 /* error */
116
117Attempt to decode a buffer:
118
119 X509 *x;
120
121 unsigned char *buf, *p;
122
123 int len;
124
125 /* Something to setup buf and len */
126
127 p = buf;
128
129 x = d2i_X509(NULL, &p, len);
130
131 if (x == NULL)
132 /* Some error */
133
134Alternative technique:
135
136 X509 *x;
137
138 unsigned char *buf, *p;
139
140 int len;
141
142 /* Something to setup buf and len */
143
144 p = buf;
145
146 x = NULL;
147
148 if(!d2i_X509(&x, &p, len))
149 /* Some error */
150
151
152=head1 WARNINGS
153
154The use of temporary variable is mandatory. A common
155mistake is to attempt to use a buffer directly as follows:
156
157 int len;
158 unsigned char *buf;
159
160 len = i2d_X509(x, NULL);
161
162 buf = malloc(len);
163
164 if (buf == NULL)
165 /* error */
166
167 i2d_X509(x, &buf);
168
169 /* Other stuff ... */
170
171 free(buf);
172
173This code will result in B<buf> apparently containing garbage because
174it was incremented after the call to point after the data just written.
175Also B<buf> will no longer contain the pointer allocated by B<malloc()>
176and the subsequent call to B<free()> may well crash.
177
178The auto allocation feature (setting buf to NULL) only works on OpenSSL
1790.9.7 and later. Attempts to use it on earlier versions will typically
180cause a segmentation violation.
181
182Another trap to avoid is misuse of the B<xp> argument to B<d2i_X509()>:
183
184 X509 *x;
185
186 if (!d2i_X509(&x, &p, len))
187 /* Some error */
188
189This will probably crash somewhere in B<d2i_X509()>. The reason for this
190is that the variable B<x> is uninitialized and an attempt will be made to
191interpret its (invalid) value as an B<X509> structure, typically causing
192a segmentation violation. If B<x> is set to NULL first then this will not
193happen.
194
195=head1 BUGS
196
197In some versions of OpenSSL the "reuse" behaviour of d2i_X509() when
198B<*px> is valid is broken and some parts of the reused structure may
199persist if they are not present in the new one. As a result the use
200of this "reuse" behaviour is strongly discouraged.
201
202i2d_X509() will not return an error in many versions of OpenSSL,
203if mandatory fields are not initialized due to a programming error
204then the encoded structure may contain invalid data or omit the
205fields entirely and will not be parsed by d2i_X509(). This may be
206fixed in future so code should not assume that i2d_X509() will
207always succeed.
208
209=head1 RETURN VALUES
210
211d2i_X509(), d2i_X509_bio() and d2i_X509_fp() return a valid B<X509> structure
212or B<NULL> if an error occurs. The error code that can be obtained by
213L<ERR_get_error(3)|ERR_get_error(3)>.
214
215i2d_X509() returns the number of bytes successfully encoded or a negative
216value if an error occurs. The error code can be obtained by
217L<ERR_get_error(3)|ERR_get_error(3)>.
218
219i2d_X509_bio() and i2d_X509_fp() return 1 for success and 0 if an error
220occurs The error code can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
221
222=head1 SEE ALSO
223
224L<ERR_get_error(3)|ERR_get_error(3)>
225
226=head1 HISTORY
227
228d2i_X509, i2d_X509, d2i_X509_bio, d2i_X509_fp, i2d_X509_bio and i2d_X509_fp
229are available in all versions of SSLeay and OpenSSL.
230
231=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_ALGOR.pod b/src/lib/libcrypto/doc/d2i_X509_ALGOR.pod
deleted file mode 100644
index 68011679fd..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_ALGOR.pod
+++ /dev/null
@@ -1,26 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_ALGOR, i2d_X509_ALGOR - AlgorithmIdentifier functions.
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509_ALGOR *d2i_X509_ALGOR(X509_ALGOR **a, unsigned char **pp, long length);
12 int i2d_X509_ALGOR(X509_ALGOR *a, unsigned char **pp);
13
14=head1 DESCRIPTION
15
16These functions decode and encode an B<X509_ALGOR> structure which is
17equivalent to the B<AlgorithmIdentifier> structure.
18
19Othewise these behave in a similar way to d2i_X509() and i2d_X509()
20described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
21
22=head1 SEE ALSO
23
24L<d2i_X509(3)|d2i_X509(3)>
25
26=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_CRL.pod b/src/lib/libcrypto/doc/d2i_X509_CRL.pod
deleted file mode 100644
index 563e4de8e0..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_CRL.pod
+++ /dev/null
@@ -1,33 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_CRL, i2d_X509_CRL, d2i_X509_CRL_bio, d2i_X509_CRL_fp,
6i2d_X509_CRL_bio, i2d_X509_CRL_fp - PKCS#10 certificate request functions.
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 X509_CRL *d2i_X509_CRL(X509_CRL **a, const unsigned char **pp, long length);
13 int i2d_X509_CRL(X509_CRL *a, unsigned char **pp);
14
15 X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **x);
16 X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **x);
17
18 int i2d_X509_CRL_bio(BIO *bp, X509_CRL *x);
19 int i2d_X509_CRL_fp(FILE *fp, X509_CRL *x);
20
21=head1 DESCRIPTION
22
23These functions decode and encode an X509 CRL (certificate revocation
24list).
25
26Othewise the functions behave in a similar way to d2i_X509() and i2d_X509()
27described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
28
29=head1 SEE ALSO
30
31L<d2i_X509(3)|d2i_X509(3)>
32
33=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_NAME.pod b/src/lib/libcrypto/doc/d2i_X509_NAME.pod
deleted file mode 100644
index 2219885338..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_NAME.pod
+++ /dev/null
@@ -1,27 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_NAME, i2d_X509_NAME - X509_NAME encoding functions
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length);
12 int i2d_X509_NAME(X509_NAME *a, unsigned char **pp);
13
14=head1 DESCRIPTION
15
16These functions decode and encode an B<X509_NAME> structure which is the
17same as the B<Name> type defined in RFC2459 (and elsewhere) and used
18for example in certificate subject and issuer names.
19
20Othewise the functions behave in a similar way to d2i_X509() and i2d_X509()
21described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
22
23=head1 SEE ALSO
24
25L<d2i_X509(3)|d2i_X509(3)>
26
27=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_REQ.pod b/src/lib/libcrypto/doc/d2i_X509_REQ.pod
deleted file mode 100644
index baa8ae391e..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_REQ.pod
+++ /dev/null
@@ -1,32 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_REQ, i2d_X509_REQ, d2i_X509_REQ_bio, d2i_X509_REQ_fp,
6i2d_X509_REQ_bio, i2d_X509_REQ_fp - PKCS#10 certificate request functions.
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 X509_REQ *d2i_X509_REQ(X509_REQ **a, const unsigned char **pp, long length);
13 int i2d_X509_REQ(X509_REQ *a, unsigned char **pp);
14
15 X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **x);
16 X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **x);
17
18 int i2d_X509_REQ_bio(BIO *bp, X509_REQ *x);
19 int i2d_X509_REQ_fp(FILE *fp, X509_REQ *x);
20
21=head1 DESCRIPTION
22
23These functions decode and encode a PKCS#10 certificate request.
24
25Othewise these behave in a similar way to d2i_X509() and i2d_X509()
26described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
27
28=head1 SEE ALSO
29
30L<d2i_X509(3)|d2i_X509(3)>
31
32=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_SIG.pod b/src/lib/libcrypto/doc/d2i_X509_SIG.pod
deleted file mode 100644
index 00d03f5ba1..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_SIG.pod
+++ /dev/null
@@ -1,26 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_SIG, i2d_X509_SIG - DigestInfo functions.
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509_SIG *d2i_X509_SIG(X509_SIG **a, unsigned char **pp, long length);
12 int i2d_X509_SIG(X509_SIG *a, unsigned char **pp);
13
14=head1 DESCRIPTION
15
16These functions decode and encode an X509_SIG structure which is
17equivalent to the B<DigestInfo> structure defined in PKCS#1 and PKCS#7.
18
19Othewise these behave in a similar way to d2i_X509() and i2d_X509()
20described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
21
22=head1 SEE ALSO
23
24L<d2i_X509(3)|d2i_X509(3)>
25
26=cut
diff --git a/src/lib/libcrypto/doc/x509.pod b/src/lib/libcrypto/doc/x509.pod
deleted file mode 100644
index f9e58e0e41..0000000000
--- a/src/lib/libcrypto/doc/x509.pod
+++ /dev/null
@@ -1,64 +0,0 @@
1=pod
2
3=head1 NAME
4
5x509 - X.509 certificate handling
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11=head1 DESCRIPTION
12
13A X.509 certificate is a structured grouping of information about
14an individual, a device, or anything one can imagine. A X.509 CRL
15(certificate revocation list) is a tool to help determine if a
16certificate is still valid. The exact definition of those can be
17found in the X.509 document from ITU-T, or in RFC3280 from PKIX.
18In OpenSSL, the type X509 is used to express such a certificate, and
19the type X509_CRL is used to express a CRL.
20
21A related structure is a certificate request, defined in PKCS#10 from
22RSA Security, Inc, also reflected in RFC2896. In OpenSSL, the type
23X509_REQ is used to express such a certificate request.
24
25To handle some complex parts of a certificate, there are the types
26X509_NAME (to express a certificate name), X509_ATTRIBUTE (to express
27a certificate attributes), X509_EXTENSION (to express a certificate
28extension) and a few more.
29
30Finally, there's the supertype X509_INFO, which can contain a CRL, a
31certificate and a corresponding private key.
32
33B<X509_>I<...>, B<d2i_X509_>I<...> and B<i2d_X509_>I<...> handle X.509
34certificates, with some exceptions, shown below.
35
36B<X509_CRL_>I<...>, B<d2i_X509_CRL_>I<...> and B<i2d_X509_CRL_>I<...>
37handle X.509 CRLs.
38
39B<X509_REQ_>I<...>, B<d2i_X509_REQ_>I<...> and B<i2d_X509_REQ_>I<...>
40handle PKCS#10 certificate requests.
41
42B<X509_NAME_>I<...> handle certificate names.
43
44B<X509_ATTRIBUTE_>I<...> handle certificate attributes.
45
46B<X509_EXTENSION_>I<...> handle certificate extensions.
47
48=head1 SEE ALSO
49
50L<X509_NAME_ENTRY_get_object(3)|X509_NAME_ENTRY_get_object(3)>,
51L<X509_NAME_add_entry_by_txt(3)|X509_NAME_add_entry_by_txt(3)>,
52L<X509_NAME_add_entry_by_NID(3)|X509_NAME_add_entry_by_NID(3)>,
53L<X509_NAME_print_ex(3)|X509_NAME_print_ex(3)>,
54L<X509_NAME_new(3)|X509_NAME_new(3)>,
55L<d2i_X509(3)|d2i_X509(3)>,
56L<d2i_X509_ALGOR(3)|d2i_X509_ALGOR(3)>,
57L<d2i_X509_CRL(3)|d2i_X509_CRL(3)>,
58L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>,
59L<d2i_X509_REQ(3)|d2i_X509_REQ(3)>,
60L<d2i_X509_SIG(3)|d2i_X509_SIG(3)>,
61L<crypto(3)|crypto(3)>,
62L<x509v3(3)|x509v3(3)>
63
64=cut
diff --git a/src/lib/libcrypto/man/Makefile b/src/lib/libcrypto/man/Makefile
index 8bc8ffb6aa..a76a03c78a 100644
--- a/src/lib/libcrypto/man/Makefile
+++ b/src/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.45 2016/11/04 10:17:17 schwarze Exp $ 1# $OpenBSD: Makefile,v 1.46 2016/11/04 15:29:03 schwarze Exp $
2 2
3.include <bsd.own.mk> # for NOMAN 3.include <bsd.own.mk> # for NOMAN
4 4
@@ -153,49 +153,49 @@ MAN= \
153 SMIME_read_PKCS7.3 \ 153 SMIME_read_PKCS7.3 \
154 SMIME_write_PKCS7.3 \ 154 SMIME_write_PKCS7.3 \
155 UI_new.3 \ 155 UI_new.3 \
156 X509_NAME_ENTRY_get_object.3 \
157 X509_NAME_add_entry_by_txt.3 \
158 X509_NAME_get_index_by_NID.3 \
159 X509_NAME_print_ex.3 \
160 X509_STORE_CTX_get_error.3 \
161 X509_STORE_CTX_get_ex_new_index.3 \
162 X509_STORE_CTX_new.3 \
163 X509_STORE_CTX_set_verify_cb.3 \
164 X509_STORE_set_verify_cb_func.3 \
165 X509_VERIFY_PARAM_set_flags.3 \
166 X509_new.3 \
167 X509_verify_cert.3 \
156 bn_dump.3 \ 168 bn_dump.3 \
157 crypto.3 \ 169 crypto.3 \
158 d2i_ASN1_OBJECT.3 \ 170 d2i_ASN1_OBJECT.3 \
159 d2i_PKCS8PrivateKey_bio.3 \ 171 d2i_PKCS8PrivateKey_bio.3 \
160 d2i_RSAPublicKey.3 \ 172 d2i_RSAPublicKey.3 \
173 d2i_X509.3 \
174 d2i_X509_ALGOR.3 \
175 d2i_X509_CRL.3 \
176 d2i_X509_NAME.3 \
177 d2i_X509_REQ.3 \
178 d2i_X509_SIG.3 \
161 des_read_pw.3 \ 179 des_read_pw.3 \
162 evp.3 \ 180 evp.3 \
163 i2d_PKCS7_bio_stream.3 \ 181 i2d_PKCS7_bio_stream.3 \
164 lh_new.3 \ 182 lh_new.3 \
165 rsa.3 \ 183 rsa.3 \
184 x509.3
166 185
167GENMAN= \ 186GENMAN= \
168 RC4.3 \ 187 RC4.3 \
169 RIPEMD160.3 \ 188 RIPEMD160.3 \
170 SHA1.3 \ 189 SHA1.3 \
171 X509_NAME_ENTRY_get_object.3 \
172 X509_NAME_add_entry_by_txt.3 \
173 X509_NAME_get_index_by_NID.3 \
174 X509_NAME_print_ex.3 \
175 X509_STORE_CTX_get_error.3 \
176 X509_STORE_CTX_get_ex_new_index.3 \
177 X509_STORE_CTX_new.3 \
178 X509_STORE_CTX_set_verify_cb.3 \
179 X509_STORE_set_verify_cb_func.3 \
180 X509_VERIFY_PARAM_set_flags.3 \
181 X509_new.3 \
182 X509_verify_cert.3 \
183 bn.3 \ 190 bn.3 \
184 d2i_DHparams.3 \ 191 d2i_DHparams.3 \
185 d2i_DSAPublicKey.3 \ 192 d2i_DSAPublicKey.3 \
186 d2i_ECPKParameters.3 \ 193 d2i_ECPKParameters.3 \
187 d2i_X509.3 \
188 d2i_X509_ALGOR.3 \
189 d2i_X509_CRL.3 \
190 d2i_X509_NAME.3 \
191 d2i_X509_REQ.3 \
192 d2i_X509_SIG.3 \
193 dh.3 \ 194 dh.3 \
194 dsa.3 \ 195 dsa.3 \
195 ec.3 \ 196 ec.3 \
196 engine.3 \ 197 engine.3 \
197 lh_stats.3 \ 198 lh_stats.3 \
198 x509.3 \
199 199
200MAN+= ${GENMAN} 200MAN+= ${GENMAN}
201 201
diff --git a/src/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 b/src/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3
new file mode 100644
index 0000000000..97978ea542
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3
@@ -0,0 +1,133 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_NAME_ENTRY_GET_OBJECT 3
3.Os
4.Sh NAME
5.Nm X509_NAME_ENTRY_get_object ,
6.Nm X509_NAME_ENTRY_get_data ,
7.Nm X509_NAME_ENTRY_set_object ,
8.Nm X509_NAME_ENTRY_set_data ,
9.Nm X509_NAME_ENTRY_create_by_txt ,
10.Nm X509_NAME_ENTRY_create_by_NID ,
11.Nm X509_NAME_ENTRY_create_by_OBJ
12.Nd X509_NAME_ENTRY utility functions
13.Sh SYNOPSIS
14.In openssl/x509.h
15.Ft ASN1_OBJECT *
16.Fo X509_NAME_ENTRY_get_object
17.Fa "X509_NAME_ENTRY *ne"
18.Fc
19.Ft ASN1_STRING *
20.Fo X509_NAME_ENTRY_get_data
21.Fa "X509_NAME_ENTRY *ne"
22.Fc
23.Ft int
24.Fo X509_NAME_ENTRY_set_object
25.Fa "X509_NAME_ENTRY *ne"
26.Fa "ASN1_OBJECT *obj"
27.Fc
28.Ft int
29.Fo X509_NAME_ENTRY_set_data
30.Fa "X509_NAME_ENTRY *ne"
31.Fa "int type"
32.Fa "const unsigned char *bytes"
33.Fa "int len"
34.Fc
35.Ft X509_NAME_ENTRY *
36.Fo X509_NAME_ENTRY_create_by_txt
37.Fa "X509_NAME_ENTRY **ne"
38.Fa "const char *field"
39.Fa "int type"
40.Fa "const unsigned char *bytes"
41.Fa "int len"
42.Fc
43.Ft X509_NAME_ENTRY *
44.Fo X509_NAME_ENTRY_create_by_NID
45.Fa "X509_NAME_ENTRY **ne"
46.Fa "int nid"
47.Fa "int type"
48.Fa "unsigned char *bytes"
49.Fa "int len"
50.Fc
51.Ft X509_NAME_ENTRY *
52.Fo X509_NAME_ENTRY_create_by_OBJ
53.Fa "X509_NAME_ENTRY **ne"
54.Fa "ASN1_OBJECT *obj"
55.Fa "int type"
56.Fa "const unsigned char *bytes"
57.Fa "int len"
58.Fc
59.Sh DESCRIPTION
60.Fn X509_NAME_ENTRY_get_object
61retrieves the field name of
62.Fa ne
63in an
64.Vt ASN1_OBJECT
65structure.
66.Pp
67.Fn X509_NAME_ENTRY_get_data
68retrieves the field value of
69.Fa ne
70in an
71.Vt ASN1_STRING
72structure.
73.Pp
74.Fn X509_NAME_ENTRY_set_object
75sets the field name of
76.Fa ne
77to
78.Fa obj .
79.Pp
80.Fn X509_NAME_ENTRY_set_data
81sets the field value of
82.Fa ne
83to string type
84.Fa type
85and the value determined by
86.Fa bytes
87and
88.Fa len .
89.Pp
90.Fn X509_NAME_ENTRY_create_by_txt ,
91.Fn X509_NAME_ENTRY_create_by_NID ,
92and
93.Fn X509_NAME_ENTRY_create_by_OBJ
94create and return an
95.Vt X509_NAME_ENTRY
96structure.
97.Pp
98.Fn X509_NAME_ENTRY_get_object
99and
100.Fn X509_NAME_ENTRY_get_data
101can be used to examine an
102.Vt X509_NAME_ENTRY
103function as returned by
104.Xr X509_NAME_get_entry 3
105for example.
106.Pp
107.Fn X509_NAME_ENTRY_create_by_txt ,
108.Fn X509_NAME_ENTRY_create_by_OBJ ,
109.Fn X509_NAME_ENTRY_create_by_NID ,
110and
111.Fn X509_NAME_ENTRY_set_data
112are seldom used in practice because
113.Vt X509_NAME_ENTRY
114structures are almost always part of
115.Vt X509_NAME
116structures and the corresponding X509_NAME functions are typically
117used to create and add new entries in a single operation.
118.Pp
119The arguments of these functions support similar options to the
120similarly named ones of the corresponding X509_NAME functions such as
121.Xr X509_NAME_add_entry_by_txt 3 .
122So for example
123.Fa type
124can be set to
125.Dv MBSTRING_ASC ,
126but in the case of
127.Fn X509_NAME_ENTRY_set_data
128the field name must be set first so the relevant field information
129can be looked up internally.
130.Sh SEE ALSO
131.Xr d2i_X509_NAME 3 ,
132.Xr ERR_get_error 3 ,
133.Xr OBJ_nid2obj 3
diff --git a/src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 b/src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3
new file mode 100644
index 0000000000..c77763cc68
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3
@@ -0,0 +1,212 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_NAME_ADD_ENTRY_BY_TXT 3
3.Os
4.Sh NAME
5.Nm X509_NAME_add_entry_by_txt ,
6.Nm X509_NAME_add_entry_by_OBJ ,
7.Nm X509_NAME_add_entry_by_NID ,
8.Nm X509_NAME_add_entry ,
9.Nm X509_NAME_delete_entry
10.Nd X509_NAME modification functions
11.Sh SYNOPSIS
12.In openssl/x509.h
13.Ft int
14.Fo X509_NAME_add_entry_by_txt
15.Fa "X509_NAME *name"
16.Fa "const char *field"
17.Fa "int type"
18.Fa "const unsigned char *bytes"
19.Fa "int len"
20.Fa "int loc"
21.Fa "int set"
22.Fc
23.Ft int
24.Fo X509_NAME_add_entry_by_OBJ
25.Fa "X509_NAME *name"
26.Fa "ASN1_OBJECT *obj"
27.Fa "int type"
28.Fa "unsigned char *bytes"
29.Fa "int len"
30.Fa "int loc"
31.Fa "int set"
32.Fc
33.Ft int
34.Fo X509_NAME_add_entry_by_NID
35.Fa "X509_NAME *name"
36.Fa "int nid"
37.Fa "int type"
38.Fa "unsigned char *bytes"
39.Fa "int len"
40.Fa "int loc"
41.Fa "int set"
42.Fc
43.Ft int
44.Fo X509_NAME_add_entry
45.Fa "X509_NAME *name"
46.Fa "X509_NAME_ENTRY *ne"
47.Fa "int loc"
48.Fa "int set"
49.Fc
50.Ft X509_NAME_ENTRY *
51.Fo X509_NAME_delete_entry
52.Fa "X509_NAME *name"
53.Fa "int loc"
54.Fc
55.Sh DESCRIPTION
56.Fn X509_NAME_add_entry_by_txt ,
57.Fn X509_NAME_add_entry_by_OBJ ,
58and
59.Fn X509_NAME_add_entry_by_NID
60add a field whose name is defined by a string
61.Fa field ,
62an object
63.Fa obj
64or a NID
65.Fa nid ,
66respectively.
67The field value to be added is in
68.Fa bytes
69of length
70.Fa len .
71If
72.Fa len
73is -1 then the field length is calculated internally using
74.Fn strlen bytes .
75.Pp
76The type of field is determined by
77.Fa type
78which can either be a definition of the type of
79.Fa bytes
80(such as
81.Dv MBSTRING_ASC )
82or a standard ASN1 type (such as
83.Dv V_ASN1_IA5STRING ) .
84The new entry is added to a position determined by
85.Fa loc
86and
87.Fa set .
88.Pp
89.Fn X509_NAME_add_entry
90adds a copy of a
91.Vt X509_NAME_ENTRY
92structure
93.Fa ne
94to
95.Fa name .
96The new entry is added to a position determined by
97.Fa loc
98and
99.Fa set .
100Since a copy of
101.Fa ne
102is added,
103.Fa ne
104must be freed up after the call.
105.Pp
106.Fn X509_NAME_delete_entry
107deletes an entry from
108.Fa name
109at position
110.Fa loc .
111The deleted entry is returned and must be freed up.
112.Pp
113The use of string types such as
114.Dv MBSTRING_ASC
115or
116.Dv MBSTRING_UTF8
117is strongly recommended for the
118.Fa type
119parameter.
120This allows the internal code to correctly determine the type of the
121field and to apply length checks according to the relevant standards.
122This is done using
123.Xr ASN1_STRING_set_by_NID 3 .
124.Pp
125If instead an ASN1 type is used, no checks are performed and the supplied
126data in
127.Fa bytes
128is used directly.
129.Pp
130In
131.Fn X509_NAME_add_entry_by_txt
132the
133.Fa field
134string represents the field name using
135.Fn OBJ_txt2obj field 0 .
136.Pp
137The
138.Fa loc
139and
140.Fa set
141parameters determine where a new entry should be added.
142For almost all applications,
143.Fa loc
144can be set to -1 and
145.Fa set
146to 0.
147This adds a new entry to the end of
148.Fa name
149as a single valued RelativeDistinguishedName (RDN).
150.Pp
151.Fa loc
152actually determines the index where the new entry is inserted:
153if it is -1 it is appended.
154.Pp
155.Fa set
156determines how the new type is added.
157If it is zero a new RDN is created.
158.Pp
159If
160.Fa set
161is -1 or 1 it is added to the previous or next RDN structure
162respectively.
163This will then be a multivalued RDN: since multivalues RDNs are very
164seldom used,
165.Fa set
166is almost always set to zero.
167.Sh RETURN VALUES
168.Fn X509_NAME_add_entry_by_txt ,
169.Fn X509_NAME_add_entry_by_OBJ ,
170.Fn X509_NAME_add_entry_by_NID ,
171and
172.Fn X509_NAME_add_entry
173return 1 for success or 0 if an error occurred.
174.Pp
175.Fn X509_NAME_delete_entry
176returns either the deleted
177.Vt X509_NAME_ENTRY
178structure or
179.Dv NULL
180if an error occurred.
181.Sh EXAMPLES
182Create an
183.Vt X509_NAME
184structure:
185.Pp
186.D1 C=UK, O=Disorganized Organization, CN=Joe Bloggs
187.Bd -literal
188X509_NAME *nm;
189nm = X509_NAME_new();
190if (nm == NULL)
191 /* Some error */
192if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
193 "C", "UK", -1, -1, 0))
194 /* Error */
195if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
196 "O", "Disorganized Organization", -1, -1, 0))
197 /* Error */
198if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
199 "CN", "Joe Bloggs", -1, -1, 0))
200 /* Error */
201.Ed
202.Sh SEE ALSO
203.Xr d2i_X509_NAME 3 ,
204.Xr ERR_get_error 3
205.Sh BUGS
206.Fa type
207can still be set to
208.Dv V_ASN1_APP_CHOOSE
209to use a different algorithm to determine field types.
210Since this form does not understand multicharacter types, performs
211no length checks, and can result in invalid field types, its use
212is strongly discouraged.
diff --git a/src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 b/src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3
new file mode 100644
index 0000000000..4710fd1ec2
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_NAME_get_index_by_NID.3
@@ -0,0 +1,177 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_NAME_GET_INDEX_BY_NID 3
3.Os
4.Sh NAME
5.Nm X509_NAME_get_index_by_NID ,
6.Nm X509_NAME_get_index_by_OBJ ,
7.Nm X509_NAME_get_entry ,
8.Nm X509_NAME_entry_count ,
9.Nm X509_NAME_get_text_by_NID ,
10.Nm X509_NAME_get_text_by_OBJ
11.Nd X509_NAME lookup and enumeration functions
12.Sh SYNOPSIS
13.In openssl/x509.h
14.Ft int
15.Fo X509_NAME_get_index_by_NID
16.Fa "X509_NAME *name"
17.Fa "int nid"
18.Fa "int lastpos"
19.Fc
20.Ft int
21.Fo X509_NAME_get_index_by_OBJ
22.Fa "X509_NAME *name"
23.Fa "ASN1_OBJECT *obj"
24.Fa "int lastpos"
25.Fc
26.Ft int
27.Fo X509_NAME_entry_count
28.Fa "X509_NAME *name"
29.Fc
30.Ft X509_NAME_ENTRY *
31.Fo X509_NAME_get_entry
32.Fa "X509_NAME *name"
33.Fa "int loc"
34.Fc
35.Ft int
36.Fo X509_NAME_get_text_by_NID
37.Fa "X509_NAME *name"
38.Fa "int nid"
39.Fa "char *buf"
40.Fa "int len"
41.Fc
42.Ft int
43.Fo X509_NAME_get_text_by_OBJ
44.Fa "X509_NAME *name"
45.Fa "ASN1_OBJECT *obj"
46.Fa "char *buf"
47.Fa "int len"
48.Fc
49.Sh DESCRIPTION
50These functions allow an
51.Vt X509_NAME
52structure to be examined.
53The
54.Vt X509_NAME
55structure is the same as the
56.Sy Name
57type defined in RFC2459 (and elsewhere) and used for example in
58certificate subject and issuer names.
59.Pp
60.Fn X509_NAME_get_index_by_NID
61and
62.Fn X509_NAME_get_index_by_OBJ
63retrieve the next index matching
64.Fa nid
65or
66.Fa obj
67after
68.Fa lastpos .
69.Fa lastpos
70should initially be set to -1.
71If there are no more entries, -1 is returned.
72.Pp
73.Fn X509_NAME_entry_count
74returns the total number of entries in
75.Fa name .
76.Pp
77.Fn X509_NAME_get_entry
78retrieves the
79.Vt X509_NAME_ENTRY
80from
81.Fa name
82corresponding to index
83.Fa loc .
84Acceptable values for
85.Fa loc
86run from 0 to
87.Fn X509_NAME_entry_count name
88- 1.
89The value returned is an internal pointer which must not be freed.
90.Pp
91.Fn X509_NAME_get_text_by_NID
92and
93.Fn X509_NAME_get_text_by_OBJ
94retrieve the "text" from the first entry in
95.Fa name
96which matches
97.Fa nid
98or
99.Fa obj .
100If no such entry exists, -1 is returned.
101At most
102.Fa len
103bytes will be written and the text written to
104.Fa buf
105will be NUL terminated.
106The length of the output string written is returned excluding the
107terminating NUL.
108If
109.Fa buf
110is
111.Dv NULL
112then the amount of space needed in
113.Fa buf
114(excluding the final NUL) is returned.
115.Sh RETURN VALUES
116.Fn X509_NAME_get_index_by_NID
117and
118.Fn X509_NAME_get_index_by_OBJ
119return the index of the next matching entry or -1 if not found.
120.Pp
121.Fn X509_NAME_entry_count
122returns the total number of entries.
123.Pp
124.Fn X509_NAME_get_entry
125returns an
126.Vt X509_NAME
127pointer to the requested entry or
128.Dv NULL
129if the index is invalid.
130.Sh EXAMPLES
131Process all entries:
132.Bd -literal
133int i;
134X509_NAME_ENTRY *e;
135
136for (i = 0; i < X509_NAME_entry_count(nm); i++) {
137 e = X509_NAME_get_entry(nm, i);
138 /* Do something with e */
139}
140.Ed
141.Pp
142Process all commonName entries:
143.Bd -literal
144int loc;
145X509_NAME_ENTRY *e;
146
147loc = -1;
148for (;;) {
149 lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos);
150 if (lastpos == -1)
151 break;
152 e = X509_NAME_get_entry(nm, lastpos);
153 /* Do something with e */
154}
155.Ed
156.Sh SEE ALSO
157.Xr d2i_X509_NAME 3 ,
158.Xr ERR_get_error 3
159.Sh CAVEATS
160.Fn X509_NAME_get_text_by_NID
161and
162.Fn X509_NAME_get_text_by_OBJ
163are legacy functions which have various limitations which make them of
164minimal use in practice.
165They can only find the first matching entry and will copy the contents
166of the field verbatim: this can be highly confusing if the target is a
167multicharacter string type like a BMPString or a UTF8String.
168.Pp
169For a more general solution,
170.Fn X509_NAME_get_index_by_NID
171or
172.Fn X509_NAME_get_index_by_OBJ
173should be used, followed by
174.Fn X509_NAME_get_entry
175on any matching indices and then the various
176.Vt X509_NAME_ENTRY
177utility functions on the result.
diff --git a/src/lib/libcrypto/man/X509_NAME_print_ex.3 b/src/lib/libcrypto/man/X509_NAME_print_ex.3
new file mode 100644
index 0000000000..ca5fc61e18
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_NAME_print_ex.3
@@ -0,0 +1,199 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_NAME_PRINT_EX 3
3.Os
4.Sh NAME
5.Nm X509_NAME_print_ex ,
6.Nm X509_NAME_print_ex_fp ,
7.Nm X509_NAME_print ,
8.Nm X509_NAME_oneline
9.Nd X509_NAME printing routines
10.Sh SYNOPSIS
11.In openssl/x509.h
12.Ft int
13.Fo X509_NAME_print_ex
14.Fa "BIO *out"
15.Fa "X509_NAME *nm"
16.Fa "int indent"
17.Fa "unsigned long flags"
18.Fc
19.Ft int
20.Fo X509_NAME_print_ex_fp
21.Fa "FILE *fp"
22.Fa "X509_NAME *nm"
23.Fa "int indent"
24.Fa "unsigned long flags"
25.Fc
26.Ft char *
27.Fo X509_NAME_oneline
28.Fa "X509_NAME *a"
29.Fa "char *buf"
30.Fa "int size"
31.Fc
32.Ft int
33.Fo X509_NAME_print
34.Fa "BIO *bp"
35.Fa "X509_NAME *name"
36.Fa "int obase"
37.Fc
38.Sh DESCRIPTION
39.Fn X509_NAME_print_ex
40prints a human readable version of
41.Fa nm
42to
43.Vt BIO
44.Fa out .
45Each line (for multiline formats) is indented by
46.Fa indent
47spaces.
48The output format can be extensively customised by use of the
49.Fa flags
50parameter.
51.Pp
52.Fn X509_NAME_print_ex_fp
53is identical to
54.Fn X509_NAME_print_ex
55except the output is written to the
56.Vt FILE
57pointer
58.Fa fp .
59.Pp
60.Fn X509_NAME_oneline
61prints an ASCII version of
62.Fa a
63to
64.Fa buf .
65At most
66.Fa size
67bytes will be written.
68If
69.Fa buf
70is
71.Dv NULL ,
72then a buffer is dynamically allocated and returned, otherwise
73.Fa buf
74is returned.
75.Pp
76.Fn X509_NAME_print
77prints out
78.Fa name
79to
80.Fa bp
81indenting each line by
82.Fa obase
83characters.
84Multiple lines are used if the output (including indent) exceeds 80
85characters.
86.Pp
87The functions
88.Fn X509_NAME_oneline
89and
90.Fn X509_NAME_print
91are legacy functions which produce a non standard output form.
92They don't handle multi character fields and have various quirks
93and inconsistencies.
94Their use is strongly discouraged in new applications.
95.Pp
96Although there are a large number of possible flags, for most purposes
97.Dv XN_FLAG_ONELINE ,
98.Dv XN_FLAG_MULTILINE ,
99or
100.Dv XN_FLAG_RFC2253
101will suffice.
102As noted on the
103.Xr ASN1_STRING_print_ex 3
104manual page, for UTF-8 terminals the
105.Dv ASN1_STRFLGS_ESC_MSB
106should be unset: so for example
107.Dv XN_FLAG_ONELINE No & Pf ~ Dv ASN1_STRFLGS_ESC_MSB
108would be used.
109.Pp
110The complete set of the flags supported by
111.Dv X509_NAME_print_ex
112is listed below.
113.Pp
114Several options can be OR'ed together.
115.Pp
116The options
117.Dv XN_FLAG_SEP_COMMA_PLUS ,
118.Dv XN_FLAG_SEP_CPLUS_SPC ,
119.Dv XN_FLAG_SEP_SPLUS_SPC ,
120and
121.Dv XN_FLAG_SEP_MULTILINE
122determine the field separators to use.
123Two distinct separators are used between distinct
124RelativeDistinguishedName components and separate values in the same RDN
125for a multi-valued RDN.
126Multi-valued RDNs are currently very rare so the second separator
127will hardly ever be used.
128.Pp
129.Dv XN_FLAG_SEP_COMMA_PLUS
130uses comma and plus as separators.
131.Dv XN_FLAG_SEP_CPLUS_SPC
132uses comma and plus with spaces:
133this is more readable that plain comma and plus.
134.Dv XN_FLAG_SEP_SPLUS_SPC
135uses spaced semicolon and plus.
136.Dv XN_FLAG_SEP_MULTILINE
137uses spaced newline and plus respectively.
138.Pp
139If
140.Dv XN_FLAG_DN_REV
141is set, the whole DN is printed in reversed order.
142.Pp
143The fields
144.Dv XN_FLAG_FN_SN ,
145.Dv XN_FLAG_FN_LN ,
146.Dv XN_FLAG_FN_OID ,
147and
148.Dv XN_FLAG_FN_NONE
149determine how a field name is displayed.
150It will use the short name (e.g. CN) the long name (e.g. commonName)
151always use OID numerical form (normally OIDs are only used if the
152field name is not recognised) and no field name respectively.
153.Pp
154If
155.Dv XN_FLAG_SPC_EQ
156is set, then spaces will be placed around the
157.Ql =
158character separating field names and values.
159.Pp
160If
161.Dv XN_FLAG_DUMP_UNKNOWN_FIELDS
162is set, then the encoding of unknown fields is printed instead of the
163values.
164.Pp
165If
166.Dv XN_FLAG_FN_ALIGN
167is set, then field names are padded to 20 characters:
168this is only of use for multiline format.
169.Pp
170Additionally, all the options supported by
171.Xr ASN1_STRING_print_ex 3
172can be used to control how each field value is displayed.
173.Pp
174In addition a number options can be set for commonly used formats.
175.Pp
176.Dv XN_FLAG_RFC2253
177sets options which produce an output compatible with RFC2253.
178It is equivalent to
179.Dv ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV |
180.Dv XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS .
181.Pp
182.Dv XN_FLAG_ONELINE
183is a more readable one line format which is the same as:
184.Dv ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC |
185.Dv XN_FLAG_SPC_EQ | XN_FLAG_FN_SN .
186.Pp
187.Dv XN_FLAG_MULTILINE
188is a multiline format which is the same as:
189.Dv ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE |
190.Dv XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN .
191.Pp
192.Dv XN_FLAG_COMPAT
193uses a format identical to
194.Fn X509_NAME_print :
195in fact it calls
196.Fn X509_NAME_print
197internally.
198.Sh SEE ALSO
199.Xr ASN1_STRING_print_ex 3
diff --git a/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3 b/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
new file mode 100644
index 0000000000..f31e438cde
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
@@ -0,0 +1,297 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_STORE_CTX_GET_ERROR 3
3.Os
4.Sh NAME
5.Nm X509_STORE_CTX_get_error ,
6.Nm X509_STORE_CTX_set_error ,
7.Nm X509_STORE_CTX_get_error_depth ,
8.Nm X509_STORE_CTX_get_current_cert ,
9.Nm X509_STORE_CTX_get1_chain ,
10.Nm X509_verify_cert_error_string
11.Nd get or set certificate verification status information
12.Sh SYNOPSIS
13.In openssl/x509.h
14.In openssl/x509_vfy.h
15.Ft int
16.Fo X509_STORE_CTX_get_error
17.Fa "X509_STORE_CTX *ctx"
18.Fc
19.Ft void
20.Fo X509_STORE_CTX_set_error
21.Fa "X509_STORE_CTX *ctx"
22.Fa "int s"
23.Fc
24.Ft int
25.Fo X509_STORE_CTX_get_error_depth
26.Fa "X509_STORE_CTX *ctx"
27.Fc
28.Ft X509 *
29.Fo X509_STORE_CTX_get_current_cert
30.Fa "X509_STORE_CTX *ctx"
31.Fc
32.Ft STACK_OF(X509) *
33.Fo X509_STORE_CTX_get1_chain
34.Fa "X509_STORE_CTX *ctx"
35.Fc
36.Ft const char *
37.Fo X509_verify_cert_error_string
38.Fa "long n"
39.Fc
40.Sh DESCRIPTION
41These functions are typically called after
42.Xr X509_verify_cert 3
43has indicated an error or in a verification callback to determine the
44nature of an error.
45.Pp
46.Fn X509_STORE_CTX_get_error
47returns the error code of
48.Fa ctx .
49See the
50.Sy ERROR CODES
51section for a full description of all error codes.
52.Pp
53.Fn X509_STORE_CTX_set_error
54sets the error code of
55.Fa ctx
56to
57.Fa s .
58For example it might be used in a verification callback to set an error
59based on additional checks.
60.Pp
61.Fn X509_STORE_CTX_get_error_depth
62returns the depth of the error.
63This is a non-negative integer representing where in the certificate
64chain the error occurred.
65If it is zero, it occurred in the end entity certificate, one if it is
66the certificate which signed the end entity certificate, and so on.
67.Pp
68.Fn X509_STORE_CTX_get_current_cert
69returns the certificate in
70.Fa ctx
71which caused the error or
72.Dv NULL
73if no certificate is relevant.
74.Pp
75.Fn X509_STORE_CTX_get1_chain
76returns a complete validate chain if a previous call to
77.Xr X509_verify_cert 3
78is successful.
79If the call to
80.Xr X509_verify_cert 3
81is
82.Sy not
83successful, the returned chain may be incomplete or invalid.
84The returned chain persists after the
85.Fa ctx
86structure is freed.
87When it is no longer needed, it should be free up using
88.Fn sk_X509_pop_free chain X509_free .
89.Pp
90.Fn X509_verify_cert_error_string
91returns a human readable error string for verification error
92.Fa n .
93.Pp
94The above functions should be used instead of directly referencing the
95fields in the
96.Sy X509_VERIFY_CTX
97structure.
98.Pp
99In versions of OpenSSL before 1.0, the current certificate returned by
100.Fn X509_STORE_CTX_get_current_cert
101was never
102.Dv NULL .
103Applications should check the return value before printing out any
104debugging information relating to the current certificate.
105.Pp
106If an unrecognised error code is passed to
107.Fn X509_verify_cert_error_string ,
108the numerical value of the unknown code is returned in a static buffer.
109This is not thread safe but will never happen unless an invalid code is
110passed.
111.Sh RETURN VALUES
112.Fn X509_STORE_CTX_get_error
113returns
114.Dv X509_V_OK
115or an error code.
116.Pp
117.Fn X509_STORE_CTX_get_error_depth
118returns a non-negative error depth.
119.Pp
120.Fn X509_STORE_CTX_get_current_cert
121returns the certificate which caused the error or
122.Dv NULL
123if no certificate is relevant to the error.
124.Pp
125.Fn X509_verify_cert_error_string
126returns a human readable error string for verification error
127.Fa n .
128.Sh ERROR CODES
129A list of error codes and messages is shown below.
130Some of the error codes are defined but currently never returned:
131these are described as "unused".
132.Bl -tag -width Ds
133.It Dv X509_V_OK : No ok
134The operation was successful.
135.It Dv X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT : \
136 No unable to get issuer certificate
137The issuer certificate could not be found: this occurs if the issuer
138certificate of an untrusted certificate cannot be found.
139.It Dv X509_V_ERR_UNABLE_TO_GET_CRL : No unable to get certificate CRL
140The CRL of a certificate could not be found.
141.It Dv X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE : \
142 No unable to decrypt certificate's signature
143The certificate signature could not be decrypted.
144This means that the actual signature value could not be determined
145rather than it not matching the expected value, this is only meaningful
146for RSA keys.
147.It Dv X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE : \
148 No unable to decrypt CRL's signature
149The CRL signature could not be decrypted: this means that the actual
150signature value could not be determined rather than it not matching the
151expected value.
152Unused.
153.It Dv X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY : \
154 No unable to decode issuer public key
155The public key in the certificate SubjectPublicKeyInfo could not be read.
156.It Dv X509_V_ERR_CERT_SIGNATURE_FAILURE : No certificate signature failure
157The signature of the certificate is invalid.
158.It Dv X509_V_ERR_CRL_SIGNATURE_FAILURE : No CRL signature failure
159The signature of the certificate is invalid.
160.It Dv X509_V_ERR_CERT_NOT_YET_VALID : No certificate is not yet valid
161The certificate is not yet valid: the notBefore date is after the
162current time.
163.It Dv X509_V_ERR_CERT_HAS_EXPIRED : No certificate has expired
164The certificate has expired: that is the notAfter date is before the
165current time.
166.It Dv X509_V_ERR_CRL_NOT_YET_VALID : No CRL is not yet valid
167The CRL is not yet valid.
168.It Dv X509_V_ERR_CRL_HAS_EXPIRED : No CRL has expired
169The CRL has expired.
170.It Dv X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD : \
171 No format error in certificate's notBefore field
172The certificate notBefore field contains an invalid time.
173.It Dv X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD : \
174 No format error in certificate's notAfter field
175The certificate notAfter field contains an invalid time.
176.It Dv X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD : \
177 No format error in CRL's lastUpdate field
178The CRL lastUpdate field contains an invalid time.
179.It Dv X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD : \
180 No format error in CRL's nextUpdate field
181The CRL nextUpdate field contains an invalid time.
182.It Dv X509_V_ERR_OUT_OF_MEM : No out of memory
183An error occurred trying to allocate memory.
184This should never happen.
185.It Dv X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT : No self signed certificate
186The passed certificate is self signed and the same certificate cannot be
187found in the list of trusted certificates.
188.It Dv X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN : \
189 No self signed certificate in certificate chain
190The certificate chain could be built up using the untrusted certificates
191but the root could not be found locally.
192.It Dv X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY : \
193 No unable to get local issuer certificate
194The issuer certificate of a locally looked up certificate could not be found.
195This normally means the list of trusted certificates is not complete.
196.It Dv X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE : \
197 No unable to verify the first certificate
198No signatures could be verified because the chain contains only one
199certificate and it is not self signed.
200.It Dv X509_V_ERR_CERT_CHAIN_TOO_LONG : No certificate chain too long
201The certificate chain length is greater than the supplied maximum depth.
202Unused.
203.It Dv X509_V_ERR_CERT_REVOKED : No certificate revoked
204The certificate has been revoked.
205.It Dv X509_V_ERR_INVALID_CA : No invalid CA certificate
206A CA certificate is invalid.
207Either it is not a CA or its extensions are not consistent with the
208supplied purpose.
209.It Dv X509_V_ERR_PATH_LENGTH_EXCEEDED : No path length constraint exceeded
210The basicConstraints pathlength parameter has been exceeded.
211.It Dv X509_V_ERR_INVALID_PURPOSE : No unsupported certificate purpose
212The supplied certificate cannot be used for the specified purpose.
213.It Dv X509_V_ERR_CERT_UNTRUSTED : No certificate not trusted
214The root CA is not marked as trusted for the specified purpose.
215.It Dv X509_V_ERR_CERT_REJECTED : No certificate rejected
216The root CA is marked to reject the specified purpose.
217.It Dv X509_V_ERR_SUBJECT_ISSUER_MISMATCH : No subject issuer mismatch
218The current candidate issuer certificate was rejected because its
219subject name did not match the issuer name of the current certificate.
220This is only set if issuer check debugging is enabled it is used for
221status notification and is
222.Sy not
223in itself an error.
224.It Dv X509_V_ERR_AKID_SKID_MISMATCH : \
225 No authority and subject key identifier mismatch
226The current candidate issuer certificate was rejected because its
227subject key identifier was present and did not match the authority key
228identifier current certificate.
229This is only set if issuer check debugging is enabled it is used for
230status notification and is
231.Sy not
232in itself an error.
233.It Dv X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH : \
234 Noauthority and issuer serial number mismatch
235The current candidate issuer certificate was rejected because its issuer
236name and serial number was present and did not match the authority key
237identifier of the current certificate.
238This is only set if issuer check debugging is enabled it is used for
239status notification and is
240.Sy not
241in itself an error.
242.It Dv X509_V_ERR_KEYUSAGE_NO_CERTSIGN : \
243 No key usage does not include certificate signing
244The current candidate issuer certificate was rejected because its
245keyUsage extension does not permit certificate signing.
246This is only set if issuer check debugging is enabled it is used for
247status notification and is
248.Sy not
249in itself an error.
250.It Dv X509_V_ERR_INVALID_EXTENSION : \
251 No invalid or inconsistent certificate extension
252A certificate extension had an invalid value (for example an incorrect
253encoding) or some value inconsistent with other extensions.
254.It Dv X509_V_ERR_INVALID_POLICY_EXTENSION : \
255 No invalid or inconsistent certificate policy extension
256A certificate policies extension had an invalid value (for example an
257incorrect encoding) or some value inconsistent with other extensions.
258This error only occurs if policy processing is enabled.
259.It Dv X509_V_ERR_NO_EXPLICIT_POLICY : No no explicit policy
260The verification flags were set to require and explicit policy but none
261was present.
262.It Dv X509_V_ERR_DIFFERENT_CRL_SCOPE : No different CRL scope
263The only CRLs that could be found did not match the scope of the
264certificate.
265.It Dv X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE : \
266 No unsupported extension feature
267Some feature of a certificate extension is not supported.
268Unused.
269.It Dv X509_V_ERR_PERMITTED_VIOLATION : No permitted subtree violation
270A name constraint violation occurred in the permitted subtrees.
271.It Dv X509_V_ERR_EXCLUDED_VIOLATION : No excluded subtree violation
272A name constraint violation occurred in the excluded subtrees.
273.It Dv X509_V_ERR_SUBTREE_MINMAX : \
274 No name constraints minimum and maximum not supported
275A certificate name constraints extension included a minimum or maximum
276field: this is not supported.
277.It Dv X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE : \
278 No unsupported name constraint type
279An unsupported name constraint type was encountered.
280OpenSSL currently only supports directory name, DNS name, email and URI
281types.
282.It Dv X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX : \
283 No unsupported or invalid name constraint syntax
284The format of the name constraint is not recognised: for example an
285email address format of a form not mentioned in RFC3280.
286This could be caused by a garbage extension or some new feature not
287currently supported.
288.It Dv X509_V_ERR_CRL_PATH_VALIDATION_ERROR : No CRL path validation error
289An error occurred when attempting to verify the CRL path.
290This error can only happen if extended CRL checking is enabled.
291.It Dv X509_V_ERR_APPLICATION_VERIFICATION : \
292 No application verification failure
293An application specific error.
294This will never be returned unless explicitly set by an application.
295.El
296.Sh SEE ALSO
297.Xr X509_verify_cert 3
diff --git a/src/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 b/src/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3
new file mode 100644
index 0000000000..511933d4a1
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3
@@ -0,0 +1,54 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_STORE_CTX_GET_EX_NEW_INDEX 3
3.Os
4.Sh NAME
5.Nm X509_STORE_CTX_get_ex_new_index ,
6.Nm X509_STORE_CTX_set_ex_data ,
7.Nm X509_STORE_CTX_get_ex_data
8.Nd add application specific data to X509_STORE_CTX structures
9.Sh SYNOPSIS
10.In openssl/x509_vfy.h
11.Ft int
12.Fo X509_STORE_CTX_get_ex_new_index
13.Fa "long argl"
14.Fa "void *argp"
15.Fa "CRYPTO_EX_new *new_func"
16.Fa "CRYPTO_EX_dup *dup_func"
17.Fa "CRYPTO_EX_free *free_func"
18.Fc
19.Ft int
20.Fo X509_STORE_CTX_set_ex_data
21.Fa "X509_STORE_CTX *d"
22.Fa "int idx"
23.Fa "void *arg"
24.Fc
25.Ft void *
26.Fo X509_STORE_CTX_get_ex_data
27.Fa "X509_STORE_CTX *d"
28.Fa "int idx"
29.Fc
30.Sh DESCRIPTION
31These functions handle application specific data in
32.Vt X509_STORE_CTX
33structures.
34Their usage is identical to that of
35.Xr RSA_get_ex_new_index 3 ,
36.Xr RSA_set_ex_data 3 ,
37and
38.Xr RSA_get_ex_data 3 .
39.Pp
40This mechanism is used internally by the
41.Xr ssl 3
42library to store the
43.Vt SSL
44structure associated with a verification operation in an
45.Vt X509_STORE_CTX
46structure.
47.Sh SEE ALSO
48.Xr RSA_get_ex_new_index 3
49.Sh HISTORY
50.Fn X509_STORE_CTX_get_ex_new_index ,
51.Fn X509_STORE_CTX_set_ex_data ,
52and
53.Fn X509_STORE_CTX_get_ex_data
54are available since OpenSSL 0.9.5.
diff --git a/src/lib/libcrypto/man/X509_STORE_CTX_new.3 b/src/lib/libcrypto/man/X509_STORE_CTX_new.3
new file mode 100644
index 0000000000..6a4b9e3e53
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_STORE_CTX_new.3
@@ -0,0 +1,229 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_STORE_CTX_NEW 3
3.Os
4.Sh NAME
5.Nm X509_STORE_CTX_new ,
6.Nm X509_STORE_CTX_cleanup ,
7.Nm X509_STORE_CTX_free ,
8.Nm X509_STORE_CTX_init ,
9.Nm X509_STORE_CTX_trusted_stack ,
10.Nm X509_STORE_CTX_set_cert ,
11.Nm X509_STORE_CTX_set_chain ,
12.Nm X509_STORE_CTX_set0_crls ,
13.Nm X509_STORE_CTX_get0_param ,
14.Nm X509_STORE_CTX_set0_param ,
15.Nm X509_STORE_CTX_set_default
16.Nd X509_STORE_CTX initialisation
17.Sh SYNOPSIS
18.In openssl/x509_vfy.h
19.Ft X509_STORE_CTX *
20.Fn X509_STORE_CTX_new void
21.Ft void
22.Fo X509_STORE_CTX_cleanup
23.Fa "X509_STORE_CTX *ctx"
24.Fc
25.Ft void
26.Fo X509_STORE_CTX_free
27.Fa "X509_STORE_CTX *ctx"
28.Fc
29.Ft int
30.Fo X509_STORE_CTX_init
31.Fa "X509_STORE_CTX *ctx"
32.Fa "X509_STORE *store"
33.Fa "X509 *x509"
34.Fa "STACK_OF(X509) *chain"
35.Fc
36.Ft void
37.Fo X509_STORE_CTX_trusted_stack
38.Fa "X509_STORE_CTX *ctx"
39.Fa "STACK_OF(X509) *sk"
40.Fc
41.Ft void
42.Fo X509_STORE_CTX_set_cert
43.Fa "X509_STORE_CTX *ctx"
44.Fa "X509 *x"
45.Fc
46.Ft void
47.Fo X509_STORE_CTX_set_chain
48.Fa "X509_STORE_CTX *ctx"
49.Fa "STACK_OF(X509) *sk"
50.Fc
51.Ft void
52.Fo X509_STORE_CTX_set0_crls
53.Fa "X509_STORE_CTX *ctx"
54.Fa "STACK_OF(X509_CRL) *sk"
55.Fc
56.Ft X509_VERIFY_PARAM *
57.Fo X509_STORE_CTX_get0_param
58.Fa "X509_STORE_CTX *ctx"
59.Fc
60.Ft void
61.Fo X509_STORE_CTX_set0_param
62.Fa "X509_STORE_CTX *ctx"
63.Fa "X509_VERIFY_PARAM *param"
64.Fc
65.Ft int
66.Fo X509_STORE_CTX_set_default
67.Fa "X509_STORE_CTX *ctx"
68.Fa "const char *name"
69.Fc
70.Sh DESCRIPTION
71These functions initialise an
72.Vt X509_STORE_CTX
73structure for subsequent use by
74.Xr X509_verify_cert 3 .
75.Pp
76.Fn X509_STORE_CTX_new
77returns a newly initialised
78.Vt X509_STORE_CTX
79structure.
80.Pp
81.Fn X509_STORE_CTX_cleanup
82internally cleans up an
83.Vt X509_STORE_CTX
84structure.
85The context can then be reused with an new call to
86.Fn X509_STORE_CTX_init .
87.Pp
88.Fn X509_STORE_CTX_free
89completely frees up
90.Fa ctx .
91After this call
92.Fa ctx
93is no longer valid.
94.Pp
95.Fn X509_STORE_CTX_init
96sets up
97.Fa ctx
98for a subsequent verification operation.
99The trusted certificate store is set to
100.Fa store ,
101the end entity certificate to be verified is set to
102.Fa x509
103and a set of additional certificates (which will be untrusted but may be
104used to build the chain) in
105.Fa chain .
106Any or all of the
107.Fa store ,
108.Fa x509 ,
109and
110.Fa chain
111parameters can be
112.Dv NULL .
113.Pp
114.Fn X509_STORE_CTX_trusted_stack
115sets the set of trusted certificates of
116.Fa ctx
117to
118.Fa sk .
119This is an alternative way of specifying trusted certificates instead of
120using an
121.Vt X509_STORE .
122.Pp
123.Fn X509_STORE_CTX_set_cert
124sets the certificate to be verified in
125.Fa ctx
126to
127.Fa x .
128.Pp
129.Fn X509_STORE_CTX_set_chain
130sets the additional certificate chain used by
131.Fa ctx
132to
133.Fa sk .
134.Pp
135.Fn X509_STORE_CTX_set0_crls
136sets a set of CRLs to use to aid certificate verification to
137.Fa sk .
138These CRLs will only be used if CRL verification is enabled in the
139associated
140.Vt X509_VERIFY_PARAM
141structure.
142This might be used where additional "useful" CRLs are supplied as part
143of a protocol, for example in a PKCS#7 structure.
144.Pp
145X509_VERIFY_PARAM
146.Fn X509_STORE_CTX_get0_param
147retrieves an internal pointer to the verification parameters associated
148with
149.Fa ctx .
150.Pp
151.Fn X509_STORE_CTX_set0_param
152sets the internal verification parameter pointer to
153.Fa param .
154After this call
155.Fa param
156should not be used.
157.Pp
158.Fn X509_STORE_CTX_set_default
159looks up and sets the default verification method to
160.Fa name .
161This uses the function
162.Xr X509_VERIFY_PARAM_lookup 3
163to find an appropriate set of parameters from
164.Fa name .
165.Pp
166The certificates and CRLs in a store are used internally and should
167.Sy not
168be freed up until after the associated
169.Vt X509_STORE_CTX
170is freed.
171Legacy applications might implicitly use an
172.Vt X509_STORE_CTX
173like this:
174.Bd -literal -offset indent
175X509_STORE_CTX ctx;
176X509_STORE_CTX_init(&ctx, store, cert, chain);
177.Ed
178.Pp
179This is
180.Sy not
181recommended in new applications they should instead do:
182.Bd -literal -offset indent
183X509_STORE_CTX *ctx;
184ctx = X509_STORE_CTX_new();
185if (ctx == NULL)
186 /* Bad error */
187X509_STORE_CTX_init(ctx, store, cert, chain);
188.Ed
189.Sh RETURN VALUES
190.Fn X509_STORE_CTX_new
191returns an newly allocates context or
192.Dv NULL
193if an error occurred.
194.Pp
195.Fn X509_STORE_CTX_init
196returns 1 for success or 0 if an error occurred.
197.Pp
198.Fn X509_STORE_CTX_get0_param
199returns a pointer to an
200.Vt X509_VERIFY_PARAM
201structure or
202.Dv NULL
203if an error occurred.
204.Pp
205.Fn X509_STORE_CTX_cleanup ,
206.Fn X509_STORE_CTX_free ,
207.Fn X509_STORE_CTX_trusted_stack ,
208.Fn X509_STORE_CTX_set_cert ,
209.Fn X509_STORE_CTX_set_chain ,
210.Fn X509_STORE_CTX_set0_crls ,
211and
212.Fn X509_STORE_CTX_set0_param
213do not return values.
214.Pp
215.Fn X509_STORE_CTX_set_default
216returns 1 for success or 0 if an error occurred.
217.Sh SEE ALSO
218.Xr X509_verify_cert 3 ,
219.Xr X509_VERIFY_PARAM_set_flags 3
220.Sh HISTORY
221.Fn X509_STORE_CTX_set0_crls
222was first added to OpenSSL 1.0.0.
223.Sh BUGS
224The certificates and CRLs in a context are used internally and should
225.Sy not
226be freed up until after the associated
227.Vt X509_STORE_CTX
228is freed.
229Copies should be made or reference counts increased instead.
diff --git a/src/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 b/src/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3
new file mode 100644
index 0000000000..f588bd7d70
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3
@@ -0,0 +1,185 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_STORE_CTX_SET_VERIFY_CB 3
3.Os
4.Sh NAME
5.Nm X509_STORE_CTX_set_verify_cb
6.Nd set verification callback
7.Sh SYNOPSIS
8.In openssl/x509_vfy.h
9.Ft void
10.Fo X509_STORE_CTX_set_verify_cb
11.Fa "X509_STORE_CTX *ctx"
12.Fa "int (*verify_cb)(int ok, X509_STORE_CTX *ctx)"
13.Fc
14.Sh DESCRIPTION
15.Fn X509_STORE_CTX_set_verify_cb
16sets the verification callback of
17.Fa ctx
18to
19.Fa verify_cb
20overwriting any existing callback.
21.Pp
22The verification callback can be used to customise the operation of
23certificate verification, either by overriding error conditions or
24logging errors for debugging purposes.
25.Pp
26However a verification callback is
27.Sy not
28essential and the default operation is often sufficient.
29.Pp
30The
31.Fa ok
32parameter to the callback indicates the value the callback should return
33to retain the default behaviour.
34If it is zero then and error condition is indicated.
35If it is 1 then no error occurred.
36If the flag
37.Dv X509_V_FLAG_NOTIFY_POLICY
38is set, then
39.Fa ok
40is set to 2 to indicate the policy checking is complete.
41.Pp
42The
43.Fa ctx
44parameter to the callback is the
45.Vt X509_STORE_CTX
46structure that is performing the verification operation.
47A callback can examine this structure and receive additional information
48about the error, for example by calling
49.Xr X509_STORE_CTX_get_current_cert 3 .
50Additional application data can be passed to the callback via the
51.Sy ex_data
52mechanism.
53.Pp
54The verification callback can be set and inherited from the parent
55structure performing the operation.
56In some cases (such as S/MIME verification) the
57.Vt X509_STORE_CTX
58structure is created and destroyed internally and the only way to set a
59custom verification callback is by inheriting it from the associated
60.Vt X509_STORE .
61.Sh RETURN VALUES
62.Fn X509_STORE_CTX_set_verify_cb
63does not return a value.
64.Sh EXAMPLES
65Default callback operation:
66.Bd -literal
67int
68verify_callback(int ok, X509_STORE_CTX *ctx)
69 {
70 return ok;
71}
72.Ed
73.Pp
74Simple example, suppose a certificate in the chain is expired and we
75wish to continue after this error:
76.Bd -literal
77int
78verify_callback(int ok, X509_STORE_CTX *ctx)
79{
80 /* Tolerate certificate expiration */
81 if (X509_STORE_CTX_get_error(ctx) == X509_V_ERR_CERT_HAS_EXPIRED)
82 return 1;
83 /* Otherwise don't override */
84 return ok;
85}
86.Ed
87.Pp
88More complex example, we don't wish to continue after
89.Sy any
90certificate has expired just one specific case:
91.Bd -literal
92int
93verify_callback(int ok, X509_STORE_CTX *ctx)
94{
95 int err = X509_STORE_CTX_get_error(ctx);
96 X509 *err_cert = X509_STORE_CTX_get_current_cert(ctx);
97
98 if (err == X509_V_ERR_CERT_HAS_EXPIRED) {
99 if (check_is_acceptable_expired_cert(err_cert)
100 return 1;
101 }
102 return ok;
103}
104.Ed
105.Pp
106Full featured logging callback.
107In this case the
108.Fa bio_err
109is assumed to be a global logging
110.Vt BIO ,
111an alternative would to store a
112.Vt BIO
113in
114.Fa ctx
115using
116.Sy ex_data .
117.Bd -literal
118int
119verify_callback(int ok, X509_STORE_CTX *ctx)
120{
121 X509 *err_cert;
122 int err,depth;
123
124 err_cert = X509_STORE_CTX_get_current_cert(ctx);
125 err = X509_STORE_CTX_get_error(ctx);
126 depth = X509_STORE_CTX_get_error_depth(ctx);
127
128 BIO_printf(bio_err,"depth=%d ",depth);
129 if (err_cert) {
130 X509_NAME_print_ex(bio_err,
131 X509_get_subject_name(err_cert), 0,
132 XN_FLAG_ONELINE);
133 BIO_puts(bio_err, "\en");
134 } else
135 BIO_puts(bio_err, "<no cert>\en");
136 if (!ok)
137 BIO_printf(bio_err, "verify error:num=%d:%s\en",
138 err, X509_verify_cert_error_string(err));
139 switch (err) {
140 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
141 BIO_puts(bio_err, "issuer= ");
142 X509_NAME_print_ex(bio_err,
143 X509_get_issuer_name(err_cert), 0,
144 XN_FLAG_ONELINE);
145 BIO_puts(bio_err, "\en");
146 break;
147 case X509_V_ERR_CERT_NOT_YET_VALID:
148 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
149 BIO_printf(bio_err, "notBefore=");
150 ASN1_TIME_print(bio_err,
151 X509_get_notBefore(err_cert));
152 BIO_printf(bio_err, "\en");
153 break;
154 case X509_V_ERR_CERT_HAS_EXPIRED:
155 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
156 BIO_printf(bio_err, "notAfter=");
157 ASN1_TIME_print(bio_err, X509_get_notAfter(err_cert));
158 BIO_printf(bio_err, "\en");
159 break;
160 case X509_V_ERR_NO_EXPLICIT_POLICY:
161 policies_print(bio_err, ctx);
162 break;
163 }
164 if (err == X509_V_OK && ok == 2)
165 /* print out policies */
166
167 BIO_printf(bio_err,"verify return:%d\en",ok);
168 return(ok);
169}
170.Ed
171.Sh SEE ALSO
172.Xr X509_STORE_CTX_get_error 3 ,
173.Xr X509_STORE_CTX_get_ex_new_index 3 ,
174.Xr X509_STORE_set_verify_cb_func 3
175.Sh HISTORY
176.Fn X509_STORE_CTX_set_verify_cb
177is available in all versions of SSLeay and OpenSSL.
178.Sh CAVEATS
179In general a verification callback should
180.Sy NOT
181unconditionally return 1 in all circumstances because this will allow
182verification to succeed no matter what the error.
183This effectively removes all security from the application because
184.Sy any
185certificate (including untrusted generated ones) will be accepted.
diff --git a/src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 b/src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3
new file mode 100644
index 0000000000..5db4313047
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3
@@ -0,0 +1,54 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_STORE_SET_VERIFY_CB_FUNC 3
3.Os
4.Sh NAME
5.Nm X509_STORE_set_verify_cb_func ,
6.Nm X509_STORE_set_verify_cb
7.Nd set verification callback
8.Sh SYNOPSIS
9.In openssl/x509_vfy.h
10.Ft void
11.Fo X509_STORE_set_verify_cb
12.Fa "X509_STORE *st"
13.Fa "int (*verify_cb)(int ok, X509_STORE_CTX *ctx)"
14.Fc
15.Ft void
16.Fo X509_STORE_set_verify_cb_func
17.Fa "X509_STORE *st"
18.Fa "int (*verify_cb)(int ok, X509_STORE_CTX *ctx)"
19.Fc
20.Sh DESCRIPTION
21.Fn X509_STORE_set_verify_cb
22sets the verification callback of
23.Sy ctx
24to
25.Sy verify_cb
26overwriting any existing callback.
27.Pp
28.Fn X509_STORE_set_verify_cb_func
29also sets the verification callback but it is implemented as a macro.
30.Pp
31The verification callback from an
32.Vt X509_STORE
33is inherited by the corresponding
34.Vt X509_STORE_CTX
35structure when it is initialized.
36This can be used to set the verification callback when the
37.Vt X509_STORE_CTX
38is otherwise inaccessible (for example during S/MIME verification).
39.Sh RETURN VALUES
40.Fn X509_STORE_set_verify_cb
41and
42.Fn X509_STORE_set_verify_cb_func
43do not return a value.
44.Sh SEE ALSO
45.Xr X509_STORE_CTX_set_verify_cb 3
46.Sh HISTORY
47.Fn X509_STORE_set_verify_cb_func
48is available in all versions of SSLeay and OpenSSL.
49.Pp
50.Fn X509_STORE_set_verify_cb
51was added to OpenSSL 1.0.0.
52.Sh BUGS
53The macro version of this function was the only one available before
54OpenSSL 1.0.0.
diff --git a/src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 b/src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3
new file mode 100644
index 0000000000..66724ed169
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3
@@ -0,0 +1,271 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_VERIFY_PARAM_SET_FLAGS 3
3.Os
4.Sh NAME
5.Nm X509_VERIFY_PARAM_set_flags ,
6.Nm X509_VERIFY_PARAM_clear_flags ,
7.Nm X509_VERIFY_PARAM_get_flags ,
8.Nm X509_VERIFY_PARAM_set_purpose ,
9.Nm X509_VERIFY_PARAM_set_trust ,
10.Nm X509_VERIFY_PARAM_set_depth ,
11.Nm X509_VERIFY_PARAM_get_depth ,
12.Nm X509_VERIFY_PARAM_set_time ,
13.Nm X509_VERIFY_PARAM_add0_policy ,
14.Nm X509_VERIFY_PARAM_set1_policies
15.Nd X509 verification parameters
16.Sh SYNOPSIS
17.In openssl/x509_vfy.h
18.Ft int
19.Fo X509_VERIFY_PARAM_set_flags
20.Fa "X509_VERIFY_PARAM *param"
21.Fa "unsigned long flags"
22.Fc
23.Ft int
24.Fo X509_VERIFY_PARAM_clear_flags
25.Fa "X509_VERIFY_PARAM *param"
26.Fa "unsigned long flags"
27.Fc
28.Ft unsigned long
29.Fo X509_VERIFY_PARAM_get_flags
30.Fa "X509_VERIFY_PARAM *param"
31.Fc
32.Ft int
33.Fo X509_VERIFY_PARAM_set_purpose
34.Fa "X509_VERIFY_PARAM *param"
35.Fa "int purpose"
36.Fc
37.Ft int
38.Fo X509_VERIFY_PARAM_set_trust
39.Fa "X509_VERIFY_PARAM *param"
40.Fa "int trust"
41.Fc
42.Ft void
43.Fo X509_VERIFY_PARAM_set_time
44.Fa "X509_VERIFY_PARAM *param"
45.Fa "time_t t"
46.Fc
47.Ft int
48.Fo X509_VERIFY_PARAM_add0_policy
49.Fa "X509_VERIFY_PARAM *param"
50.Fa "ASN1_OBJECT *policy"
51.Fc
52.Ft int
53.Fo X509_VERIFY_PARAM_set1_policies
54.Fa "X509_VERIFY_PARAM *param"
55.Fa "STACK_OF(ASN1_OBJECT) *policies"
56.Fc
57.Ft void
58.Fo X509_VERIFY_PARAM_set_depth
59.Fa "X509_VERIFY_PARAM *param"
60.Fa "int depth"
61.Fc
62.Ft int
63.Fo X509_VERIFY_PARAM_get_depth
64.Fa "const X509_VERIFY_PARAM *param"
65.Fc
66.Sh DESCRIPTION
67These functions manipulate the
68.Vt X509_VERIFY_PARAM
69structure associated with a certificate verification operation.
70.Pp
71The
72.Fn X509_VERIFY_PARAM_set_flags
73function sets the flags in
74.Fa param
75by OR'ing it with
76.Fa flags .
77See the
78.Sx VERIFICATION FLAGS
79section for a complete description of values the
80.Fa flags
81parameter can take.
82.Pp
83.Fn X509_VERIFY_PARAM_get_flags
84returns the flags in
85.Fa param .
86.Pp
87.Fn X509_VERIFY_PARAM_clear_flags
88clears the flags
89.Fa flags
90in
91.Fa param .
92.Pp
93.Fn X509_VERIFY_PARAM_set_purpose
94sets the verification purpose in
95.Fa param
96to
97.Fa purpose .
98This determines the acceptable purpose of the certificate chain, for
99example SSL client or SSL server.
100.Pp
101.Fn X509_VERIFY_PARAM_set_trust
102sets the trust setting in
103.Fa param
104to
105.Fa trust .
106.Pp
107.Fn X509_VERIFY_PARAM_set_time
108sets the verification time in
109.Fa param
110to
111.Fa t .
112Normally the current time is used.
113.Pp
114.Fn X509_VERIFY_PARAM_add0_policy
115enables policy checking (it is disabled by default) and adds
116.Fa policy
117to the acceptable policy set.
118.Pp
119.Fn X509_VERIFY_PARAM_set1_policies
120enables policy checking (it is disabled by default) and sets the
121acceptable policy set to
122.Fa policies .
123Any existing policy set is cleared.
124The
125.Fa policies
126parameter can be
127.Dv NULL
128to clear an existing policy set.
129.Pp
130.Fn X509_VERIFY_PARAM_set_depth
131sets the maximum verification depth to
132.Fa depth .
133That is the maximum number of untrusted CA certificates that can appear
134in a chain.
135.Pp
136The above functions should be used to manipulate verification parameters
137instead of legacy functions which work in specific structures such as
138.Xr X509_STORE_CTX_set_flags 3 .
139.Sh RETURN VALUES
140.Fn X509_VERIFY_PARAM_set_flags ,
141.Fn X509_VERIFY_PARAM_clear_flags ,
142.Fn X509_VERIFY_PARAM_set_purpose ,
143.Fn X509_VERIFY_PARAM_set_trust ,
144.Fn X509_VERIFY_PARAM_add0_policy ,
145and
146.Fn X509_VERIFY_PARAM_set1_policies
147return 1 for success or 0 for failure.
148.Pp
149.Fn X509_VERIFY_PARAM_get_flags
150returns the current verification flags.
151.Pp
152.Fn X509_VERIFY_PARAM_set_time
153and
154.Fn X509_VERIFY_PARAM_set_depth
155do not return values.
156.Pp
157.Fn X509_VERIFY_PARAM_get_depth
158returns the current verification depth.
159.Sh VERIFICATION FLAGS
160The verification flags consists of zero or more of the following
161flags OR'ed together.
162.Pp
163.Dv X509_V_FLAG_CRL_CHECK
164enables CRL checking for the certificate chain leaf certificate.
165An error occurs if a suitable CRL cannot be found.
166.Pp
167.Dv X509_V_FLAG_CRL_CHECK_ALL
168enables CRL checking for the entire certificate chain.
169.Pp
170.Dv X509_V_FLAG_IGNORE_CRITICAL
171disabled critical extension checking.
172By default any unhandled critical extensions in certificates or (if
173checked) CRLs results in a fatal error.
174If this flag is set unhandled critical extensions are ignored.
175.Sy WARNING :
176setting this option for anything other than debugging purposes can be a
177security risk.
178Finer control over which extensions are supported can be performed in
179the verification callback.
180.Pp
181The
182.Dv X509_V_FLAG_X509_STRICT
183flag disables workarounds for some broken certificates and makes the
184verification strictly apply X509 rules.
185.Pp
186.Dv X509_V_FLAG_ALLOW_PROXY_CERTS
187enables proxy certificate verification.
188.Pp
189.Dv X509_V_FLAG_POLICY_CHECK
190enables certificate policy checking, by default no policy checking is
191performed.
192Additional information is sent to the verification callback relating to
193policy checking.
194.Pp
195.Dv X509_V_FLAG_EXPLICIT_POLICY ,
196.Dv X509_V_FLAG_INHIBIT_ANY ,
197and
198.Dv X509_V_FLAG_INHIBIT_MAP
199set the
200.Dq require explicit policy ,
201.Dq inhibit any policy ,
202and
203.Dq inhibit policy mapping
204flags, respectively, as defined in RFC3280.
205Policy checking is automatically enabled if any of these flags are set.
206.Pp
207If
208.Dv X509_V_FLAG_NOTIFY_POLICY
209is set and the policy checking is successful a special status code is
210set to the verification callback.
211This permits it to examine the valid policy tree and perform additional
212checks or simply log it for debugging purposes.
213.Pp
214By default some additional features such as indirect CRLs and CRLs
215signed by different keys are disabled.
216If
217.Dv X509_V_FLAG_EXTENDED_CRL_SUPPORT
218is set they are enabled.
219.Pp
220If
221.Dv X509_V_FLAG_USE_DELTAS
222is set, delta CRLs (if present) are used to determine certificate
223status.
224If not set, deltas are ignored.
225.Pp
226.Dv X509_V_FLAG_CHECK_SS_SIGNATURE
227enables checking of the root CA self signed certificate signature.
228By default this check is disabled because it doesn't add any additional
229security but in some cases applications might want to check the
230signature anyway.
231A side effect of not checking the root CA signature is that disabled or
232unsupported message digests on the root CA are not treated as fatal
233errors.
234.Pp
235The
236.Dv X509_V_FLAG_CB_ISSUER_CHECK
237flag enables debugging of certificate issuer checks.
238It is
239.Sy not
240needed unless you are logging certificate verification.
241If this flag is set then additional status codes will be sent to the
242verification callback and it
243.Sy must
244be prepared to handle such cases without assuming they are hard errors.
245.Sh EXAMPLES
246Enable CRL checking when performing certificate verification during
247SSL connections associated with an
248.Vt SSL_CTX
249structure
250.Fa ctx :
251.Bd -literal
252X509_VERIFY_PARAM *param;
253param = X509_VERIFY_PARAM_new();
254X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
255SSL_CTX_set1_param(ctx, param);
256X509_VERIFY_PARAM_free(param);
257.Ed
258.Sh SEE ALSO
259.Xr X509_verify_cert 3
260.Sh BUGS
261Delta CRL checking is currently primitive.
262Only a single delta can be used and (partly due to limitations of
263.Vt X509_STORE )
264constructed CRLs are not maintained.
265.Pp
266If CRLs checking is enabled, CRLs are expected to be available in
267the corresponding
268.Vt X509_STORE
269structure.
270No attempt is made to download CRLs from the CRL distribution points
271extension.
diff --git a/src/lib/libcrypto/man/X509_new.3 b/src/lib/libcrypto/man/X509_new.3
new file mode 100644
index 0000000000..26c46ae3a9
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_new.3
@@ -0,0 +1,49 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_NEW 3
3.Os
4.Sh NAME
5.Nm X509_new ,
6.Nm X509_free
7.Nd X509 certificate ASN1 allocation functions
8.Sh SYNOPSIS
9.In openssl/x509.h
10.Ft X509 *
11.Fn X509_new void
12.Ft void
13.Fo X509_free
14.Fa "X509 *a"
15.Fc
16.Sh DESCRIPTION
17The X509 ASN1 allocation routines allocate and free an
18.Vt X509
19structure, which represents an X509 certificate.
20.Pp
21.Fn X509_new
22allocates and initializes a X509 structure.
23.Pp
24.Fn X509_free
25frees up the
26.Vt X509
27structure
28.Fa a .
29If
30.Fa a
31is a
32.Dv NULL
33pointer, no action occurs.
34.Sh RETURN VALUES
35If the allocation fails,
36.Fn X509_new
37returns
38.Dv NULL
39and sets an error code that can be obtained by
40.Xr ERR_get_error 3 .
41Otherwise it returns a pointer to the newly allocated structure.
42.Sh SEE ALSO
43.Xr d2i_X509 3 ,
44.Xr ERR_get_error 3
45.Sh HISTORY
46.Fn X509_new
47and
48.Fn X509_free
49are available in all versions of SSLeay and OpenSSL.
diff --git a/src/lib/libcrypto/man/X509_verify_cert.3 b/src/lib/libcrypto/man/X509_verify_cert.3
new file mode 100644
index 0000000000..fd3d6bebda
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_verify_cert.3
@@ -0,0 +1,54 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509_VERIFY_CERT 3
3.Os
4.Sh NAME
5.Nm X509_verify_cert
6.Nd discover and verify X509 certificate chain
7.Sh SYNOPSIS
8.In openssl/x509.h
9.Ft int
10.Fo X509_verify_cert
11.Fa "X509_STORE_CTX *ctx"
12.Fc
13.Sh DESCRIPTION
14The
15.Fn X509_verify_cert
16function attempts to discover and validate a certificate chain based on
17parameters in
18.Fa ctx .
19.Pp
20Applications rarely call this function directly, but it is used by
21OpenSSL internally for certificate validation, in both the S/MIME and
22SSL/TLS code.
23.Sh RETURN VALUES
24If a complete chain can be built and validated this function returns 1,
25otherwise it return 0.
26.Pp
27In exceptional circumstances, it can also return a negative code,
28but only if no certificate is set in
29.Fa ctx
30due to a programming error or if a retry operation is requested
31during internal lookups, which never happens with standard lookup
32methods.
33It is however recommended that application check for <= 0 return
34value on error.
35.Pp
36If the function fails, additional error information can be obtained
37by examining
38.Fa ctx ,
39for example using
40.Xr X509_STORE_CTX_get_error 3 .
41.Sh SEE ALSO
42.Xr X509_STORE_CTX_get_error 3
43and the
44.Cm verify
45entry in
46.Xr openssl 1
47.Sh HISTORY
48.Fn X509_verify_cert
49is available in all versions of SSLeay and OpenSSL.
50.Sh BUGS
51This function uses the header
52.In openssl/x509.h
53as opposed to most chain verification functions which use
54.In openssl/x509_vfy.h .
diff --git a/src/lib/libcrypto/man/d2i_X509.3 b/src/lib/libcrypto/man/d2i_X509.3
new file mode 100644
index 0000000000..09c65afa58
--- /dev/null
+++ b/src/lib/libcrypto/man/d2i_X509.3
@@ -0,0 +1,346 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt D2I_X509 3
3.Os
4.Sh NAME
5.Nm d2i_X509 ,
6.Nm i2d_X509 ,
7.Nm d2i_X509_bio ,
8.Nm d2i_X509_fp ,
9.Nm i2d_X509_bio ,
10.Nm i2d_X509_fp
11.Nd X509 encode and decode functions
12.Sh SYNOPSIS
13.In openssl/x509.h
14.Ft X509 *
15.Fo d2i_X509
16.Fa "X509 **px"
17.Fa "const unsigned char **in"
18.Fa "int len"
19.Fc
20.Ft int
21.Fo i2d_X509
22.Fa "X509 *x"
23.Fa "unsigned char **out"
24.Fc
25.Ft X509 *
26.Fo d2i_X509_bio
27.Fa "BIO *bp"
28.Fa "X509 **x"
29.Fc
30.Ft X509 *
31.Fo d2i_X509_fp
32.Fa "FILE *fp"
33.Fa "X509 **x"
34.Fc
35.Ft int
36.Fo i2d_X509_bio
37.Fa "BIO *bp"
38.Fa "X509 *x"
39.Fc
40.Ft int
41.Fo i2d_X509_fp
42.Fa "FILE *fp"
43.Fa "X509 *x"
44.Fc
45.Sh DESCRIPTION
46The X509 encode and decode routines encode and parse an
47.Vt X509
48structure, which represents an X509 certificate.
49.Pp
50.Fn d2i_X509
51attempts to decode
52.Fa len
53bytes at
54.Pf * Fa in .
55If successful, a pointer to the
56.Vt X509
57structure is returned.
58If an error occurred,
59.Dv NULL
60is returned.
61If
62.Fa px
63is not
64.Dv NULL ,
65the returned structure is written to
66.Pf * Fa px .
67If
68.Pf * Fa px
69is not
70.Dv NULL ,
71then it is assumed that
72.Pf * Fa px
73contains a valid
74.Vt X509
75structure and an attempt is made to reuse it.
76If the call is successful,
77.Pf * Fa in
78is incremented to the byte following the parsed data.
79.Pp
80.Fn i2d_X509
81encodes the structure pointed to by
82.Fa x
83into DER format.
84If
85.Fa out
86is not
87.Dv NULL ,
88it writes the DER encoded data to the buffer at
89.Pf * Fa out
90and increments it to point after the data just written.
91If the return value is negative an error occurred, otherwise it returns
92the length of the encoded data.
93.Pp
94For OpenSSL 0.9.7 and later if
95.Pf * Fa out
96is
97.Dv NULL ,
98memory will be allocated for a buffer and the encoded data written to it.
99In this case
100.Pf * Fa out
101is not incremented and it points to the start of the data just written.
102.Pp
103.Fn d2i_X509_bio
104is similar to
105.Fn d2i_X509
106except it attempts to parse data from
107.Vt BIO
108.Fa bp .
109.Pp
110.Fn d2i_X509_fp
111is similar to
112.Fn d2i_X509
113except it attempts to parse data from the
114.Vt FILE
115pointer
116.Fa fp .
117.Pp
118.Fn i2d_X509_bio
119is similar to
120.Fn i2d_X509
121except it writes the encoding of the structure
122.Fa x
123to
124.Vt BIO
125.Fa bp
126and it returns 1 for success or 0 for failure.
127.Pp
128.Fn i2d_X509_fp
129is similar to
130.Fn i2d_X509
131except it writes the encoding of the structure
132.Fa x
133to
134.Vt BIO
135.Fa bp
136and it returns 1 for success or 0 for failure.
137.Pp
138The letters
139.Sy i
140and
141.Sy d
142in for example
143.Fn i2d_X509
144stand for "internal" (that is an internal C structure) and "DER",
145so that
146.Fn i2d_X509
147converts from internal to DER.
148.Pp
149The functions can also understand BER forms.
150.Pp
151The actual
152.Vt X509
153structure passed to
154.Fn i2d_X509
155must be a valid populated
156.Vt X509
157structure.
158It cannot simply be fed with an empty structure such as that returned by
159.Xr X509_new 3 .
160.Pp
161The encoded data is in binary form and may contain embedded zeroes.
162Therefore any
163.Vt FILE
164pointers or
165.Vt BIO Ns s
166should be opened in binary mode.
167Functions such as
168.Xr strlen 3
169will
170.Sy not
171return the correct length of the encoded structure.
172.Pp
173The ways that
174.Pf * Fa in
175and
176.Pf * Fa out
177are incremented after the operation can trap the unwary.
178See the
179.Sx CAVEATS
180section for some common errors.
181.Pp
182The reason for the auto increment behaviour is to reflect a typical
183usage of ASN1 functions: after one structure is encoded or decoded,
184another will processed after it.
185.Sh RETURN VALUES
186.Fn d2i_X509 ,
187.Fn d2i_X509_bio ,
188and
189.Fn d2i_X509_fp
190return a valid
191.Vt X509
192structure or
193.Dv NULL
194if an error occurs.
195.Pp
196.Fn i2d_X509
197returns the number of bytes successfully encoded or a negative value if
198an error occurs.
199.Pp
200.Fn i2d_X509_bio
201and
202.Fn i2d_X509_fp
203return 1 for success or 0 if an error occurs.
204.Pp
205For all functions, the error code can be obtained by
206.Xr ERR_get_error 3 .
207.Sh EXAMPLES
208Allocate and encode the DER encoding of an X509 structure:
209.Bd -literal -offset indent
210int len;
211unsigned char *buf, *p;
212
213len = i2d_X509(x, NULL);
214buf = malloc(len);
215if (buf == NULL)
216 /* error */
217p = buf;
218i2d_X509(x, &p);
219.Ed
220.Pp
221If you are using OpenSSL 0.9.7 or later then this can be simplified to:
222.Bd -literal -offset indent
223int len;
224unsigned char *buf;
225
226buf = NULL;
227len = i2d_X509(x, &buf);
228if (len < 0)
229 /* error */
230.Ed
231.Pp
232Attempt to decode a buffer:
233.Bd -literal -offset indent
234X509 *x;
235unsigned char *buf, *p;
236int len;
237
238/* Something to setup buf and len */
239p = buf;
240x = d2i_X509(NULL, &p, len);
241if (x == NULL)
242 /* Some error */
243.Ed
244.Pp
245Alternative technique:
246.Bd -literal -offset indent
247X509 *x;
248unsigned char *buf, *p;
249int len;
250
251/* Something to setup buf and len */
252p = buf;
253x = NULL;
254if(!d2i_X509(&x, &p, len))
255 /* Some error */
256.Ed
257.Sh SEE ALSO
258.Xr ERR_get_error 3
259.Sh HISTORY
260.Fn d2i_X509 ,
261.Fn i2d_X509 ,
262.Fn d2i_X509_bio ,
263.Fn d2i_X509_fp ,
264.Fn i2d_X509_bio ,
265and
266.Fn i2d_X509_fp
267are available in all versions of SSLeay and OpenSSL.
268.Sh CAVEATS
269The use of a temporary variable is mandatory.
270A common mistake is to attempt to use a buffer directly as follows:
271.Bd -literal -offset indent
272int len;
273unsigned char *buf;
274
275len = i2d_X509(x, NULL);
276buf = malloc(len);
277if (buf == NULL)
278 /* error */
279i2d_X509(x, &buf);
280/* Other stuff ... */
281free(buf);
282.Ed
283.Pp
284This code will result in
285.Fa buf
286apparently containing garbage because it was incremented after the
287call to point after the data just written.
288Also
289.Fa buf
290will no longer contain the pointer allocated by
291.Xr malloc 3
292and the subsequent call to
293.Xr free 3
294may well crash.
295.Pp
296The auto allocation feature (setting
297.Fa buf
298to
299.Dv NULL
300only works on OpenSSL 0.9.7 and later.
301Attempts to use it on earlier versions will typically cause a
302segmentation violation.
303.Pp
304Another trap to avoid is misuse of the
305.Fa px
306argument to
307.Sy d2i_X509() :
308.Bd -literal -offset indent
309X509 *x;
310
311if (!d2i_X509(&x, &p, len))
312 /* Some error */
313.Ed
314.Pp
315This will probably crash somewhere in
316.Fn d2i_X509 .
317The reason for this is that the variable
318.Fa x
319is uninitialized and an attempt will be made to interpret its (invalid)
320value as an
321.Vt X509
322structure, typically causing a segmentation violation.
323If
324.Fa x
325is set to
326.Dv NULL
327first then this will not happen.
328.Sh BUGS
329In some versions of OpenSSL the "reuse" behaviour of
330.Fn d2i_X509
331when
332.Pf * Fa px
333is valid is broken and some parts of the reused structure may persist
334if they are not present in the new one.
335As a result the use of this "reuse" behaviour is strongly discouraged.
336.Pp
337In many versions of OpenSSL,
338.Fn i2d_X509
339will not return an error if mandatory fields are not initialized
340due to a programming error.
341Then the encoded structure may contain invalid data or omit the
342fields entirely and will not be parsed by
343.Fn d2i_X509 .
344This may be fixed in future so code should not assume that
345.Fn i2d_X509
346will always succeed.
diff --git a/src/lib/libcrypto/man/d2i_X509_ALGOR.3 b/src/lib/libcrypto/man/d2i_X509_ALGOR.3
new file mode 100644
index 0000000000..e17678019b
--- /dev/null
+++ b/src/lib/libcrypto/man/d2i_X509_ALGOR.3
@@ -0,0 +1,33 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt D2I_X509_ALGOR 3
3.Os
4.Sh NAME
5.Nm d2i_X509_ALGOR ,
6.Nm i2d_X509_ALGOR
7.Nd AlgorithmIdentifier functions
8.Sh SYNOPSIS
9.In openssl/x509.h
10.Ft X509_ALGOR *
11.Fo d2i_X509_ALGOR
12.Fa "X509_ALGOR **a"
13.Fa "unsigned char **pp"
14.Fa "long length"
15.Fc
16.Ft int
17.Fo i2d_X509_ALGOR
18.Fa "X509_ALGOR *a"
19.Fa "unsigned char **pp"
20.Fc
21.Sh DESCRIPTION
22These functions decode and encode an
23.Vt X509_ALGOR
24structure which is equivalent to the
25.Sy AlgorithmIdentifier
26structure.
27.Pp
28Otherwise these behave in a way similar to
29.Xr d2i_X509 3
30and
31.Xr i2d_X509 3 .
32.Sh SEE ALSO
33.Xr d2i_X509 3
diff --git a/src/lib/libcrypto/man/d2i_X509_CRL.3 b/src/lib/libcrypto/man/d2i_X509_CRL.3
new file mode 100644
index 0000000000..e487da16d0
--- /dev/null
+++ b/src/lib/libcrypto/man/d2i_X509_CRL.3
@@ -0,0 +1,54 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt D2I_X509_CRL 3
3.Os
4.Sh NAME
5.Nm d2i_X509_CRL ,
6.Nm i2d_X509_CRL ,
7.Nm d2i_X509_CRL_bio ,
8.Nm d2i_X509_CRL_fp ,
9.Nm i2d_X509_CRL_bio ,
10.Nm i2d_X509_CRL_fp
11.Nd PKCS#10 certificate request functions
12.Sh SYNOPSIS
13.In openssl/x509.h
14.Ft X509_CRL *
15.Fo d2i_X509_CRL
16.Fa "X509_CRL **a"
17.Fa "const unsigned char **pp"
18.Fa "long length"
19.Fc
20.Ft int
21.Fo i2d_X509_CRL
22.Fa "X509_CRL *a"
23.Fa "unsigned char **pp"
24.Fc
25.Ft X509_CRL *
26.Fo d2i_X509_CRL_bio
27.Fa "BIO *bp"
28.Fa "X509_CRL **x"
29.Fc
30.Ft X509_CRL *
31.Fo d2i_X509_CRL_fp
32.Fa "FILE *fp"
33.Fa "X509_CRL **x"
34.Fc
35.Ft int
36.Fo i2d_X509_CRL_bio
37.Fa "BIO *bp"
38.Fa "X509_CRL *x"
39.Fc
40.Ft int
41.Fo i2d_X509_CRL_fp
42.Fa "FILE *fp"
43.Fa "X509_CRL *x"
44.Fc
45.Sh DESCRIPTION
46These functions decode and encode an X509 CRL (certificate revocation
47list).
48.Pp
49Otherwise the functions behave in a way similar to
50.Xr d2i_X509 3
51and
52.Xr i2d_X509 3 .
53.Sh SEE ALSO
54.Xr d2i_X509 3
diff --git a/src/lib/libcrypto/man/d2i_X509_NAME.3 b/src/lib/libcrypto/man/d2i_X509_NAME.3
new file mode 100644
index 0000000000..b145bf5b58
--- /dev/null
+++ b/src/lib/libcrypto/man/d2i_X509_NAME.3
@@ -0,0 +1,34 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt D2I_X509_NAME 3
3.Os
4.Sh NAME
5.Nm d2i_X509_NAME ,
6.Nm i2d_X509_NAME
7.Nd X509_NAME encoding functions
8.Sh SYNOPSIS
9.In openssl/x509.h
10.Ft X509_NAME *
11.Fo d2i_X509_NAME
12.Fa "X509_NAME **a"
13.Fa "unsigned char **pp"
14.Fa "long length"
15.Fc
16.Ft int
17.Fo i2d_X509_NAME
18.Fa "X509_NAME *a"
19.Fa "unsigned char **pp"
20.Fc
21.Sh DESCRIPTION
22These functions decode and encode an
23.Vt X509_NAME
24structure which is the same as the
25.Sy Name
26type defined in RFC2459 (and elsewhere) and used for example in
27certificate subject and issuer names.
28.Pp
29Otherwise the functions behave in a way similar to
30.Xr d2i_X509 3
31and
32.Xr i2d_X509 3 .
33.Sh SEE ALSO
34.Xr d2i_X509 3
diff --git a/src/lib/libcrypto/man/d2i_X509_REQ.3 b/src/lib/libcrypto/man/d2i_X509_REQ.3
new file mode 100644
index 0000000000..c69cd00fb1
--- /dev/null
+++ b/src/lib/libcrypto/man/d2i_X509_REQ.3
@@ -0,0 +1,53 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt D2I_X509_REQ 3
3.Os
4.Sh NAME
5.Nm d2i_X509_REQ ,
6.Nm i2d_X509_REQ ,
7.Nm d2i_X509_REQ_bio ,
8.Nm d2i_X509_REQ_fp ,
9.Nm i2d_X509_REQ_bio ,
10.Nm i2d_X509_REQ_fp
11.Nd PKCS#10 certificate request functions
12.Sh SYNOPSIS
13.In openssl/x509.h
14.Ft X509_REQ *
15.Fo d2i_X509_REQ
16.Fa "X509_REQ **a"
17.Fa "const unsigned char **pp"
18.Fa "long length"
19.Fc
20.Ft int
21.Fo i2d_X509_REQ
22.Fa "X509_REQ *a"
23.Fa "unsigned char **pp"
24.Fc
25.Ft X509_REQ *
26.Fo d2i_X509_REQ_bio
27.Fa "BIO *bp"
28.Fa "X509_REQ **x"
29.Fc
30.Ft X509_REQ *
31.Fo d2i_X509_REQ_fp
32.Fa "FILE *fp"
33.Fa "X509_REQ **x"
34.Fc
35.Ft int
36.Fo i2d_X509_REQ_bio
37.Fa "BIO *bp"
38.Fa "X509_REQ *x"
39.Fc
40.Ft int
41.Fo i2d_X509_REQ_fp
42.Fa "FILE *fp"
43.Fa "X509_REQ *x"
44.Fc
45.Sh DESCRIPTION
46These functions decode and encode a PKCS#10 certificate request.
47.Pp
48Otherwise these behave in a way similar to
49.Xr d2i_X509 3
50and
51.Xr i2d_X509 3 .
52.Sh SEE ALSO
53.Xr d2i_X509 3
diff --git a/src/lib/libcrypto/man/d2i_X509_SIG.3 b/src/lib/libcrypto/man/d2i_X509_SIG.3
new file mode 100644
index 0000000000..5356dd67de
--- /dev/null
+++ b/src/lib/libcrypto/man/d2i_X509_SIG.3
@@ -0,0 +1,33 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt D2I_X509_SIG 3
3.Os
4.Sh NAME
5.Nm d2i_X509_SIG ,
6.Nm i2d_X509_SIG
7.Nd DigestInfo functions
8.Sh SYNOPSIS
9.In openssl/x509.h
10.Ft X509_SIG *
11.Fo d2i_X509_SIG
12.Fa "X509_SIG **a"
13.Fa "unsigned char **pp"
14.Fa "long length"
15.Fc
16.Ft int
17.Fo i2d_X509_SIG
18.Fa "X509_SIG *a"
19.Fa "unsigned char **pp"
20.Fc
21.Sh DESCRIPTION
22These functions decode and encode an
23.Vt X509_SIG
24structure which is equivalent to the
25.Sy DigestInfo
26structure defined in PKCS#1 and PKCS#7.
27.Pp
28Otherwise these behave in a way similar to
29.Xr d2i_X509 3
30and
31.Xr i2d_X509 3 .
32.Sh SEE ALSO
33.Xr d2i_X509 3
diff --git a/src/lib/libcrypto/man/x509.3 b/src/lib/libcrypto/man/x509.3
new file mode 100644
index 0000000000..1f7b7f4128
--- /dev/null
+++ b/src/lib/libcrypto/man/x509.3
@@ -0,0 +1,79 @@
1.Dd $Mdocdate: November 4 2016 $
2.Dt X509 3
3.Os
4.Sh NAME
5.Nm x509
6.Nd X.509 certificate handling
7.Sh SYNOPSIS
8.In openssl/x509.h
9.Sh DESCRIPTION
10A X.509 certificate is a structured grouping of information about an
11individual, a device, or anything one can imagine.
12A X.509 CRL (certificate revocation list) is a tool to help determine if
13a certificate is still valid.
14The exact definition of those can be found in the X.509 document from
15ITU-T, or in RFC3280 from PKIX.
16In OpenSSL, the type
17.Vt X509
18is used to express such a certificate, and the type
19.Vt X509_CRL
20is used to express a CRL.
21.Pp
22A related structure is a certificate request, defined in PKCS#10 from
23RSA Security, Inc., also reflected in RFC2896.
24In OpenSSL, the type
25.Vt X509_REQ
26is used to express such a certificate request.
27.Pp
28To handle some complex parts of a certificate, there are the types
29.Vt X509_NAME
30to express a certificate name,
31.Vt X509_ATTRIBUTE
32to express a certificate attribute,
33.Vt X509_EXTENSION
34to express a certificate extension, and a few more.
35.Pp
36Finally, there's the supertype
37.Vt X509_INFO ,
38which can contain a CRL, a certificate, and a corresponding private key.
39.Pp
40The functions
41.Fa X509_* ,
42.Fa d2i_X509_* ,
43and
44.Fa i2d_X509_*
45handle X.509 certificates, with some exceptions shown below.
46.Pp
47.Fa X509_CRL_* ,
48.Fa d2i_X509_CRL_* ,
49and
50.Fa i2d_X509_CRL_*
51handle X.509 CRLs.
52.Pp
53.Fa X509_REQ_* ,
54.Fa d2i_X509_REQ_* ,
55and
56.Fa i2d_X509_REQ_*
57handle PKCS#10 certificate requests.
58.Pp
59.Fa X509_NAME_*
60handle certificate names.
61.Pp
62.Fa X509_ATTRIBUTE_*
63handle certificate attributes.
64.Pp
65.Fa X509_EXTENSION_*
66handle certificate extensions.
67.Sh SEE ALSO
68.Xr crypto 3 ,
69.Xr d2i_X509 3 ,
70.Xr d2i_X509_ALGOR 3 ,
71.Xr d2i_X509_CRL 3 ,
72.Xr d2i_X509_NAME 3 ,
73.Xr d2i_X509_REQ 3 ,
74.Xr d2i_X509_SIG 3 ,
75.Xr X509_NAME_add_entry_by_NID 3 ,
76.Xr X509_NAME_add_entry_by_txt 3 ,
77.Xr X509_NAME_ENTRY_get_object 3 ,
78.Xr X509_NAME_new 3 ,
79.Xr X509_NAME_print_ex 3
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 12:19:30 +0000