summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/doc
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/doc')
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod70
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod117
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod102
-rw-r--r--src/lib/libcrypto/doc/X509_NAME_print_ex.pod103
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod323
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod43
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_new.pod126
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod165
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod54
-rw-r--r--src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod172
-rw-r--r--src/lib/libcrypto/doc/X509_new.pod38
-rw-r--r--src/lib/libcrypto/doc/X509_verify_cert.pod53
-rw-r--r--src/lib/libcrypto/doc/d2i_X509.pod231
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_ALGOR.pod26
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_CRL.pod33
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_NAME.pod27
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_REQ.pod32
-rw-r--r--src/lib/libcrypto/doc/d2i_X509_SIG.pod26
-rw-r--r--src/lib/libcrypto/doc/x509.pod64
19 files changed, 0 insertions, 1805 deletions
diff --git a/src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod b/src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod
deleted file mode 100644
index 4603202db8..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_ENTRY_get_object.pod
+++ /dev/null
@@ -1,70 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_ENTRY_get_object, X509_NAME_ENTRY_get_data,
6X509_NAME_ENTRY_set_object, X509_NAME_ENTRY_set_data,
7X509_NAME_ENTRY_create_by_txt, X509_NAME_ENTRY_create_by_NID,
8X509_NAME_ENTRY_create_by_OBJ - X509_NAME_ENTRY utility functions
9
10=head1 SYNOPSIS
11
12 #include <openssl/x509.h>
13
14 ASN1_OBJECT * X509_NAME_ENTRY_get_object(X509_NAME_ENTRY *ne);
15 ASN1_STRING * X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne);
16
17 int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, ASN1_OBJECT *obj);
18 int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type, const unsigned char *bytes, int len);
19
20 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne, const char *field, int type, const unsigned char *bytes, int len);
21 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid, int type,unsigned char *bytes, int len);
22 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne, ASN1_OBJECT *obj, int type, const unsigned char *bytes, int len);
23
24=head1 DESCRIPTION
25
26X509_NAME_ENTRY_get_object() retrieves the field name of B<ne> in
27and B<ASN1_OBJECT> structure.
28
29X509_NAME_ENTRY_get_data() retrieves the field value of B<ne> in
30and B<ASN1_STRING> structure.
31
32X509_NAME_ENTRY_set_object() sets the field name of B<ne> to B<obj>.
33
34X509_NAME_ENTRY_set_data() sets the field value of B<ne> to string type
35B<type> and value determined by B<bytes> and B<len>.
36
37X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_NID()
38and X509_NAME_ENTRY_create_by_OBJ() create and return an
39B<X509_NAME_ENTRY> structure.
40
41=head1 NOTES
42
43X509_NAME_ENTRY_get_object() and X509_NAME_ENTRY_get_data() can be
44used to examine an B<X509_NAME_ENTRY> function as returned by
45X509_NAME_get_entry() for example.
46
47X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_NID(),
48and X509_NAME_ENTRY_create_by_OBJ() create and return an
49
50X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_OBJ(),
51X509_NAME_ENTRY_create_by_NID() and X509_NAME_ENTRY_set_data()
52are seldom used in practice because B<X509_NAME_ENTRY> structures
53are almost always part of B<X509_NAME> structures and the
54corresponding B<X509_NAME> functions are typically used to
55create and add new entries in a single operation.
56
57The arguments of these functions support similar options to the similarly
58named ones of the corresponding B<X509_NAME> functions such as
59X509_NAME_add_entry_by_txt(). So for example B<type> can be set to
60B<MBSTRING_ASC> but in the case of X509_set_data() the field name must be
61set first so the relevant field information can be looked up internally.
62
63=head1 RETURN VALUES
64
65=head1 SEE ALSO
66
67L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>,
68L<OBJ_nid2obj(3)|OBJ_nid2obj(3)>
69
70=cut
diff --git a/src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod b/src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod
deleted file mode 100644
index f97e05e683..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_add_entry_by_txt.pod
+++ /dev/null
@@ -1,117 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_add_entry_by_txt, X509_NAME_add_entry_by_OBJ,
6X509_NAME_add_entry_by_NID, X509_NAME_add_entry, X509_NAME_delete_entry -
7X509_NAME modification functions
8
9=head1 SYNOPSIS
10
11 #include <openssl/x509.h>
12
13 int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type, const unsigned char *bytes, int len, int loc, int set);
14
15 int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type, unsigned char *bytes, int len, int loc, int set);
16
17 int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type, unsigned char *bytes, int len, int loc, int set);
18
19 int X509_NAME_add_entry(X509_NAME *name,X509_NAME_ENTRY *ne, int loc, int set);
20
21 X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);
22
23=head1 DESCRIPTION
24
25X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ() and
26X509_NAME_add_entry_by_NID() add a field whose name is defined
27by a string B<field>, an object B<obj> or a NID B<nid> respectively.
28The field value to be added is in B<bytes> of length B<len>. If
29B<len> is -1 then the field length is calculated internally using
30strlen(bytes).
31
32The type of field is determined by B<type> which can either be a
33definition of the type of B<bytes> (such as B<MBSTRING_ASC>) or a
34standard ASN1 type (such as B<V_ASN1_IA5STRING>). The new entry is
35added to a position determined by B<loc> and B<set>.
36
37X509_NAME_add_entry() adds a copy of B<X509_NAME_ENTRY> structure B<ne>
38to B<name>. The new entry is added to a position determined by B<loc>
39and B<set>. Since a copy of B<ne> is added B<ne> must be freed up after
40the call.
41
42X509_NAME_delete_entry() deletes an entry from B<name> at position
43B<loc>. The deleted entry is returned and must be freed up.
44
45=head1 NOTES
46
47The use of string types such as B<MBSTRING_ASC> or B<MBSTRING_UTF8>
48is strongly recommended for the B<type> parameter. This allows the
49internal code to correctly determine the type of the field and to
50apply length checks according to the relevant standards. This is
51done using ASN1_STRING_set_by_NID().
52
53If instead an ASN1 type is used no checks are performed and the
54supplied data in B<bytes> is used directly.
55
56In X509_NAME_add_entry_by_txt() the B<field> string represents
57the field name using OBJ_txt2obj(field, 0).
58
59The B<loc> and B<set> parameters determine where a new entry should
60be added. For almost all applications B<loc> can be set to -1 and B<set>
61to 0. This adds a new entry to the end of B<name> as a single valued
62RelativeDistinguishedName (RDN).
63
64B<loc> actually determines the index where the new entry is inserted:
65if it is -1 it is appended.
66
67B<set> determines how the new type is added. If it is zero a
68new RDN is created.
69
70If B<set> is -1 or 1 it is added to the previous or next RDN
71structure respectively. This will then be a multivalued RDN:
72since multivalues RDNs are very seldom used B<set> is almost
73always set to zero.
74
75=head1 EXAMPLES
76
77Create an B<X509_NAME> structure:
78
79"C=UK, O=Disorganized Organization, CN=Joe Bloggs"
80
81 X509_NAME *nm;
82 nm = X509_NAME_new();
83 if (nm == NULL)
84 /* Some error */
85 if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
86 "C", "UK", -1, -1, 0))
87 /* Error */
88 if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
89 "O", "Disorganized Organization", -1, -1, 0))
90 /* Error */
91 if (!X509_NAME_add_entry_by_txt(nm, MBSTRING_ASC,
92 "CN", "Joe Bloggs", -1, -1, 0))
93 /* Error */
94
95=head1 RETURN VALUES
96
97X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ(),
98X509_NAME_add_entry_by_NID() and X509_NAME_add_entry() return 1 for
99success of 0 if an error occurred.
100
101X509_NAME_delete_entry() returns either the deleted B<X509_NAME_ENTRY>
102structure of B<NULL> if an error occurred.
103
104=head1 BUGS
105
106B<type> can still be set to B<V_ASN1_APP_CHOOSE> to use a
107different algorithm to determine field types. Since this form does
108not understand multicharacter types, performs no length checks and
109can result in invalid field types its use is strongly discouraged.
110
111=head1 SEE ALSO
112
113L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>
114
115=head1 HISTORY
116
117=cut
diff --git a/src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod b/src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod
deleted file mode 100644
index 48510890e8..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_get_index_by_NID.pod
+++ /dev/null
@@ -1,102 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_get_index_by_NID, X509_NAME_get_index_by_OBJ, X509_NAME_get_entry,
6X509_NAME_entry_count, X509_NAME_get_text_by_NID, X509_NAME_get_text_by_OBJ -
7X509_NAME lookup and enumeration functions
8
9=head1 SYNOPSIS
10
11 #include <openssl/x509.h>
12
13 int X509_NAME_get_index_by_NID(X509_NAME *name,int nid,int lastpos);
14 int X509_NAME_get_index_by_OBJ(X509_NAME *name,ASN1_OBJECT *obj, int lastpos);
15
16 int X509_NAME_entry_count(X509_NAME *name);
17 X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
18
19 int X509_NAME_get_text_by_NID(X509_NAME *name, int nid, char *buf,int len);
20 int X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, char *buf,int len);
21
22=head1 DESCRIPTION
23
24These functions allow an B<X509_NAME> structure to be examined. The
25B<X509_NAME> structure is the same as the B<Name> type defined in
26RFC2459 (and elsewhere) and used for example in certificate subject
27and issuer names.
28
29X509_NAME_get_index_by_NID() and X509_NAME_get_index_by_OBJ() retrieve
30the next index matching B<nid> or B<obj> after B<lastpos>. B<lastpos>
31should initially be set to -1. If there are no more entries -1 is returned.
32
33X509_NAME_entry_count() returns the total number of entries in B<name>.
34
35X509_NAME_get_entry() retrieves the B<X509_NAME_ENTRY> from B<name>
36corresponding to index B<loc>. Acceptable values for B<loc> run from
370 to (X509_NAME_entry_count(name) - 1). The value returned is an
38internal pointer which must not be freed.
39
40X509_NAME_get_text_by_NID(), X509_NAME_get_text_by_OBJ() retrieve
41the "text" from the first entry in B<name> which matches B<nid> or
42B<obj>, if no such entry exists -1 is returned. At most B<len> bytes
43will be written and the text written to B<buf> will be null
44terminated. The length of the output string written is returned
45excluding the terminating null. If B<buf> is <NULL> then the amount
46of space needed in B<buf> (excluding the final null) is returned.
47
48=head1 NOTES
49
50X509_NAME_get_text_by_NID() and X509_NAME_get_text_by_OBJ() are
51legacy functions which have various limitations which make them
52of minimal use in practice. They can only find the first matching
53entry and will copy the contents of the field verbatim: this can
54be highly confusing if the target is a multicharacter string type
55like a BMPString or a UTF8String.
56
57For a more general solution X509_NAME_get_index_by_NID() or
58X509_NAME_get_index_by_OBJ() should be used followed by
59X509_NAME_get_entry() on any matching indices and then the
60various B<X509_NAME_ENTRY> utility functions on the result.
61
62=head1 EXAMPLES
63
64Process all entries:
65
66 int i;
67 X509_NAME_ENTRY *e;
68
69 for (i = 0; i < X509_NAME_entry_count(nm); i++) {
70 e = X509_NAME_get_entry(nm, i);
71 /* Do something with e */
72 }
73
74Process all commonName entries:
75
76 int loc;
77 X509_NAME_ENTRY *e;
78
79 loc = -1;
80 for (;;) {
81 lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos);
82 if (lastpos == -1)
83 break;
84 e = X509_NAME_get_entry(nm, lastpos);
85 /* Do something with e */
86 }
87
88=head1 RETURN VALUES
89
90X509_NAME_get_index_by_NID() and X509_NAME_get_index_by_OBJ()
91return the index of the next matching entry or -1 if not found.
92
93X509_NAME_entry_count() returns the total number of entries.
94
95X509_NAME_get_entry() returns an B<X509_NAME> pointer to the
96requested entry or B<NULL> if the index is invalid.
97
98=head1 SEE ALSO
99
100L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>
101
102=cut
diff --git a/src/lib/libcrypto/doc/X509_NAME_print_ex.pod b/src/lib/libcrypto/doc/X509_NAME_print_ex.pod
deleted file mode 100644
index 5cdf636c16..0000000000
--- a/src/lib/libcrypto/doc/X509_NAME_print_ex.pod
+++ /dev/null
@@ -1,103 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_NAME_print_ex, X509_NAME_print_ex_fp, X509_NAME_print,
6X509_NAME_oneline - X509_NAME printing routines.
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 int X509_NAME_print_ex(BIO *out, X509_NAME *nm, int indent, unsigned long flags);
13 int X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long flags);
14 char * X509_NAME_oneline(X509_NAME *a,char *buf,int size);
15 int X509_NAME_print(BIO *bp, X509_NAME *name, int obase);
16
17=head1 DESCRIPTION
18
19X509_NAME_print_ex() prints a human readable version of B<nm> to BIO B<out>.
20Each line (for multiline formats) is indented by B<indent> spaces. The output
21format can be extensively customised by use of the B<flags> parameter.
22
23X509_NAME_print_ex_fp() is identical to X509_NAME_print_ex() except the output
24is written to FILE pointer B<fp>.
25
26X509_NAME_oneline() prints an ASCII version of B<a> to B<buf>. At most B<size>
27bytes will be written. If B<buf> is B<NULL> then a buffer is dynamically
28allocated and returned, otherwise B<buf> is returned.
29
30X509_NAME_print() prints out B<name> to B<bp> indenting each line by B<obase>
31characters. Multiple lines are used if the output (including indent) exceeds
3280 characters.
33
34=head1 NOTES
35
36The functions X509_NAME_oneline() and X509_NAME_print() are legacy functions
37which produce a non standard output form, they don't handle multi character
38fields and have various quirks and inconsistencies. Their use is strongly
39discouraged in new applications.
40
41Although there are a large number of possible flags for most purposes
42B<XN_FLAG_ONELINE>, B<XN_FLAG_MULTILINE> or B<XN_FLAG_RFC2253> will suffice.
43As noted on the L<ASN1_STRING_print_ex(3)|ASN1_STRING_print_ex(3)> manual page
44for UTF8 terminals the B<ASN1_STRFLGS_ESC_MSB> should be unset: so for example
45B<XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB> would be used.
46
47The complete set of the flags supported by X509_NAME_print_ex() is listed below.
48
49Several options can be ored together.
50
51The options B<XN_FLAG_SEP_COMMA_PLUS>, B<XN_FLAG_SEP_CPLUS_SPC>,
52B<XN_FLAG_SEP_SPLUS_SPC> and B<XN_FLAG_SEP_MULTILINE> determine the field
53separators to use. Two distinct separators are used between distinct
54RelativeDistinguishedName components and separate values in the same RDN for a
55multi-valued RDN. Multi-valued RDNs are currently very rare so the second
56separator will hardly ever be used.
57
58B<XN_FLAG_SEP_COMMA_PLUS> uses comma and plus as separators.
59B<XN_FLAG_SEP_CPLUS_SPC> uses comma and plus with spaces: this is more readable
60that plain comma and plus. B<XN_FLAG_SEP_SPLUS_SPC> uses spaced semicolon and
61plus. B<XN_FLAG_SEP_MULTILINE> uses spaced newline and plus respectively.
62
63If B<XN_FLAG_DN_REV> is set the whole DN is printed in reversed order.
64
65The fields B<XN_FLAG_FN_SN>, B<XN_FLAG_FN_LN>, B<XN_FLAG_FN_OID>,
66B<XN_FLAG_FN_NONE> determine how a field name is displayed. It will
67use the short name (e.g. CN) the long name (e.g. commonName) always
68use OID numerical form (normally OIDs are only used if the field name is not
69recognised) and no field name respectively.
70
71If B<XN_FLAG_SPC_EQ> is set then spaces will be placed around the '=' character
72separating field names and values.
73
74If B<XN_FLAG_DUMP_UNKNOWN_FIELDS> is set then the encoding of unknown fields is
75printed instead of the values.
76
77If B<XN_FLAG_FN_ALIGN> is set then field names are padded to 20 characters: this
78is only of use for multiline format.
79
80Additionally all the options supported by ASN1_STRING_print_ex() can be used to
81control how each field value is displayed.
82
83In addition a number options can be set for commonly used formats.
84
85B<XN_FLAG_RFC2253> sets options which produce an output compatible with RFC2253 it
86is equivalent to:
87 B<ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV | XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS>
88
89
90B<XN_FLAG_ONELINE> is a more readable one line format which is the same as:
91 B<ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_SPC_EQ | XN_FLAG_FN_SN>
92
93B<XN_FLAG_MULTILINE> is a multiline format which is the same as:
94 B<ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE | XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN>
95
96B<XN_FLAG_COMPAT> uses a format identical to X509_NAME_print(): in fact it
97calls X509_NAME_print() internally.
98
99=head1 SEE ALSO
100
101L<ASN1_STRING_print_ex(3)|ASN1_STRING_print_ex(3)>
102
103=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
deleted file mode 100644
index 270b265ce5..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_get_error.pod
+++ /dev/null
@@ -1,323 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_get_error, X509_STORE_CTX_set_error,
6X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert,
7X509_STORE_CTX_get1_chain, X509_verify_cert_error_string - get or set
8certificate verification status information
9
10=head1 SYNOPSIS
11
12 #include <openssl/x509.h>
13 #include <openssl/x509_vfy.h>
14
15 int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
16 void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
17 int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
18 X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
19
20 STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
21
22 const char *X509_verify_cert_error_string(long n);
23
24=head1 DESCRIPTION
25
26These functions are typically called after X509_verify_cert() has indicated
27an error or in a verification callback to determine the nature of an error.
28
29X509_STORE_CTX_get_error() returns the error code of B<ctx>, see
30the B<ERROR CODES> section for a full description of all error codes.
31
32X509_STORE_CTX_set_error() sets the error code of B<ctx> to B<s>. For example
33it might be used in a verification callback to set an error based on additional
34checks.
35
36X509_STORE_CTX_get_error_depth() returns the B<depth> of the error. This is a
37non-negative integer representing where in the certificate chain the error
38occurred. If it is zero it occurred in the end entity certificate, one if
39it is the certificate which signed the end entity certificate and so on.
40
41X509_STORE_CTX_get_current_cert() returns the certificate in B<ctx> which
42caused the error or B<NULL> if no certificate is relevant.
43
44X509_STORE_CTX_get1_chain() returns a complete validate chain if a previous
45call to X509_verify_cert() is successful. If the call to X509_verify_cert()
46is B<not> successful the returned chain may be incomplete or invalid. The
47returned chain persists after the B<ctx> structure is freed, when it is
48no longer needed it should be free up using:
49
50 sk_X509_pop_free(chain, X509_free);
51
52X509_verify_cert_error_string() returns a human readable error string for
53verification error B<n>.
54
55=head1 RETURN VALUES
56
57X509_STORE_CTX_get_error() returns B<X509_V_OK> or an error code.
58
59X509_STORE_CTX_get_error_depth() returns a non-negative error depth.
60
61X509_STORE_CTX_get_current_cert() returns the certificate which caused the
62error or B<NULL> if no certificate is relevant to the error.
63
64X509_verify_cert_error_string() returns a human readable error string for
65verification error B<n>.
66
67=head1 ERROR CODES
68
69A list of error codes and messages is shown below. Some of the
70error codes are defined but currently never returned: these are described as
71"unused".
72
73=over 4
74
75=item B<X509_V_OK: ok>
76
77the operation was successful.
78
79=item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: unable to get issuer certificate>
80
81the issuer certificate could not be found: this occurs if the issuer certificate
82of an untrusted certificate cannot be found.
83
84=item B<X509_V_ERR_UNABLE_TO_GET_CRL: unable to get certificate CRL>
85
86the CRL of a certificate could not be found.
87
88=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: unable to decrypt
89certificate's signature>
90
91the certificate signature could not be decrypted. This means that the actual
92signature value could not be determined rather than it not matching the
93expected value, this is only meaningful for RSA keys.
94
95=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: unable to decrypt CRL's
96signature>
97
98the CRL signature could not be decrypted: this means that the actual signature
99value could not be determined rather than it not matching the expected value.
100Unused.
101
102=item B<X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: unable to decode issuer
103public key>
104
105the public key in the certificate SubjectPublicKeyInfo could not be read.
106
107=item B<X509_V_ERR_CERT_SIGNATURE_FAILURE: certificate signature failure>
108
109the signature of the certificate is invalid.
110
111=item B<X509_V_ERR_CRL_SIGNATURE_FAILURE: CRL signature failure>
112
113the signature of the certificate is invalid.
114
115=item B<X509_V_ERR_CERT_NOT_YET_VALID: certificate is not yet valid>
116
117the certificate is not yet valid: the notBefore date is after the current time.
118
119=item B<X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired>
120
121the certificate has expired: that is the notAfter date is before the current
122time.
123
124=item B<X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid>
125
126the CRL is not yet valid.
127
128=item B<X509_V_ERR_CRL_HAS_EXPIRED: CRL has expired>
129
130the CRL has expired.
131
132=item B<X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: format error in
133certificate's notBefore field>
134
135the certificate notBefore field contains an invalid time.
136
137=item B<X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: format error in certificate's
138notAfter field>
139
140the certificate notAfter field contains an invalid time.
141
142=item B<X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: format error in CRL's
143lastUpdate field>
144
145the CRL lastUpdate field contains an invalid time.
146
147=item B<X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: format error in CRL's
148nextUpdate field>
149
150the CRL nextUpdate field contains an invalid time.
151
152=item B<X509_V_ERR_OUT_OF_MEM: out of memory>
153
154an error occurred trying to allocate memory. This should never happen.
155
156=item B<X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: self signed certificate>
157
158the passed certificate is self signed and the same certificate cannot be found
159in the list of trusted certificates.
160
161=item B<X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in
162certificate chain>
163
164the certificate chain could be built up using the untrusted certificates but
165the root could not be found locally.
166
167=item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local
168issuer certificate>
169
170the issuer certificate of a locally looked up certificate could not be found.
171This normally means the list of trusted certificates is not complete.
172
173=item B<X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: unable to verify the first
174certificate>
175
176no signatures could be verified because the chain contains only one certificate
177and it is not self signed.
178
179=item B<X509_V_ERR_CERT_CHAIN_TOO_LONG: certificate chain too long>
180
181the certificate chain length is greater than the supplied maximum depth. Unused.
182
183=item B<X509_V_ERR_CERT_REVOKED: certificate revoked>
184
185the certificate has been revoked.
186
187=item B<X509_V_ERR_INVALID_CA: invalid CA certificate>
188
189a CA certificate is invalid. Either it is not a CA or its extensions are not
190consistent with the supplied purpose.
191
192=item B<X509_V_ERR_PATH_LENGTH_EXCEEDED: path length constraint exceeded>
193
194the basicConstraints pathlength parameter has been exceeded.
195
196=item B<X509_V_ERR_INVALID_PURPOSE: unsupported certificate purpose>
197
198the supplied certificate cannot be used for the specified purpose.
199
200=item B<X509_V_ERR_CERT_UNTRUSTED: certificate not trusted>
201
202the root CA is not marked as trusted for the specified purpose.
203
204=item B<X509_V_ERR_CERT_REJECTED: certificate rejected>
205
206the root CA is marked to reject the specified purpose.
207
208=item B<X509_V_ERR_SUBJECT_ISSUER_MISMATCH: subject issuer mismatch>
209
210the current candidate issuer certificate was rejected because its subject name
211did not match the issuer name of the current certificate. This is only set
212if issuer check debugging is enabled it is used for status notification and
213is B<not> in itself an error.
214
215=item B<X509_V_ERR_AKID_SKID_MISMATCH: authority and subject key identifier
216mismatch>
217
218the current candidate issuer certificate was rejected because its subject key
219identifier was present and did not match the authority key identifier current
220certificate. This is only set if issuer check debugging is enabled it is used
221for status notification and is B<not> in itself an error.
222
223=item B<X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: authority and issuer serial
224number mismatch>
225
226the current candidate issuer certificate was rejected because its issuer name
227and serial number was present and did not match the authority key identifier of
228the current certificate. This is only set if issuer check debugging is enabled
229it is used for status notification and is B<not> in itself an error.
230
231=item B<X509_V_ERR_KEYUSAGE_NO_CERTSIGN:key usage does not include certificate
232signing>
233
234the current candidate issuer certificate was rejected because its keyUsage
235extension does not permit certificate signing. This is only set if issuer check
236debugging is enabled it is used for status notification and is B<not> in itself
237an error.
238
239=item B<X509_V_ERR_INVALID_EXTENSION: invalid or inconsistent certificate
240extension>
241
242A certificate extension had an invalid value (for example an incorrect
243encoding) or some value inconsistent with other extensions.
244
245
246=item B<X509_V_ERR_INVALID_POLICY_EXTENSION: invalid or inconsistent
247certificate policy extension>
248
249A certificate policies extension had an invalid value (for example an incorrect
250encoding) or some value inconsistent with other extensions. This error only
251occurs if policy processing is enabled.
252
253=item B<X509_V_ERR_NO_EXPLICIT_POLICY: no explicit policy>
254
255The verification flags were set to require and explicit policy but none was
256present.
257
258=item B<X509_V_ERR_DIFFERENT_CRL_SCOPE: Different CRL scope>
259
260The only CRLs that could be found did not match the scope of the certificate.
261
262=item B<X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE: Unsupported extension feature>
263
264Some feature of a certificate extension is not supported. Unused.
265
266=item B<X509_V_ERR_PERMITTED_VIOLATION: permitted subtree violation>
267
268A name constraint violation occurred in the permitted subtrees.
269
270=item B<X509_V_ERR_EXCLUDED_VIOLATION: excluded subtree violation>
271
272A name constraint violation occurred in the excluded subtrees.
273
274=item B<X509_V_ERR_SUBTREE_MINMAX: name constraints minimum and maximum not
275supported>
276
277A certificate name constraints extension included a minimum or maximum field:
278this is not supported.
279
280=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: unsupported name constraint
281type>
282
283An unsupported name constraint type was encountered. OpenSSL currently only
284supports directory name, DNS name, email and URI types.
285
286=item B<X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: unsupported or invalid name
287constraint syntax>
288
289The format of the name constraint is not recognised: for example an email
290address format of a form not mentioned in RFC3280. This could be caused by
291a garbage extension or some new feature not currently supported.
292
293=item B<X509_V_ERR_CRL_PATH_VALIDATION_ERROR: CRL path validation error>
294
295An error occurred when attempting to verify the CRL path. This error can only
296happen if extended CRL checking is enabled.
297
298=item B<X509_V_ERR_APPLICATION_VERIFICATION: application verification failure>
299
300an application specific error. This will never be returned unless explicitly
301set by an application.
302
303=back
304
305=head1 NOTES
306
307The above functions should be used instead of directly referencing the fields
308in the B<X509_VERIFY_CTX> structure.
309
310In versions of OpenSSL before 1.0 the current certificate returned by
311X509_STORE_CTX_get_current_cert() was never B<NULL>. Applications should
312check the return value before printing out any debugging information relating
313to the current certificate.
314
315If an unrecognised error code is passed to X509_verify_cert_error_string() the
316numerical value of the unknown code is returned in a static buffer. This is not
317thread safe but will never happen unless an invalid code is passed.
318
319=head1 SEE ALSO
320
321L<X509_verify_cert(3)|X509_verify_cert(3)>
322
323=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod
deleted file mode 100644
index 25224cef1b..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_get_ex_new_index.pod
+++ /dev/null
@@ -1,43 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_get_ex_new_index, X509_STORE_CTX_set_ex_data,
6X509_STORE_CTX_get_ex_data - add application specific data to X509_STORE_CTX
7structures
8
9=head1 SYNOPSIS
10
11 #include <openssl/x509_vfy.h>
12
13 int X509_STORE_CTX_get_ex_new_index(long argl, void *argp,
14 CRYPTO_EX_new *new_func,
15 CRYPTO_EX_dup *dup_func,
16 CRYPTO_EX_free *free_func);
17
18 int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *d, int idx, void *arg);
19
20 void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *d, int idx);
21
22=head1 DESCRIPTION
23
24These functions handle application specific data in X509_STORE_CTX structures.
25Their usage is identical to that of RSA_get_ex_new_index(), RSA_set_ex_data()
26and RSA_get_ex_data() as described in L<RSA_get_ex_new_index(3)>.
27
28=head1 NOTES
29
30This mechanism is used internally by the B<ssl> library to store the B<SSL>
31structure associated with a verification operation in an B<X509_STORE_CTX>
32structure.
33
34=head1 SEE ALSO
35
36L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>
37
38=head1 HISTORY
39
40X509_STORE_CTX_get_ex_new_index(), X509_STORE_CTX_set_ex_data() and
41X509_STORE_CTX_get_ex_data() are available since OpenSSL 0.9.5.
42
43=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_new.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_new.pod
deleted file mode 100644
index 66c0da04d2..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_new.pod
+++ /dev/null
@@ -1,126 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_new, X509_STORE_CTX_cleanup, X509_STORE_CTX_free,
6X509_STORE_CTX_init, X509_STORE_CTX_trusted_stack, X509_STORE_CTX_set_cert,
7X509_STORE_CTX_set_chain, X509_STORE_CTX_set0_crls, X509_STORE_CTX_get0_param,
8X509_STORE_CTX_set0_param, X509_STORE_CTX_set_default - X509_STORE_CTX
9initialisation
10
11=head1 SYNOPSIS
12
13 #include <openssl/x509_vfy.h>
14
15 X509_STORE_CTX *X509_STORE_CTX_new(void);
16 void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
17 void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
18
19 int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
20 X509 *x509, STACK_OF(X509) *chain);
21
22 void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
23
24 void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx,X509 *x);
25 void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx,STACK_OF(X509) *sk);
26 void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk);
27
28 X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
29 void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
30 int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
31
32=head1 DESCRIPTION
33
34These functions initialise an B<X509_STORE_CTX> structure for subsequent use
35by X509_verify_cert().
36
37X509_STORE_CTX_new() returns a newly initialised B<X509_STORE_CTX> structure.
38
39X509_STORE_CTX_cleanup() internally cleans up an B<X509_STORE_CTX> structure.
40The context can then be reused with an new call to X509_STORE_CTX_init().
41
42X509_STORE_CTX_free() completely frees up B<ctx>. After this call B<ctx>
43is no longer valid.
44
45X509_STORE_CTX_init() sets up B<ctx> for a subsequent verification operation.
46The trusted certificate store is set to B<store>, the end entity certificate
47to be verified is set to B<x509> and a set of additional certificates (which
48will be untrusted but may be used to build the chain) in B<chain>. Any or
49all of the B<store>, B<x509> and B<chain> parameters can be B<NULL>.
50
51X509_STORE_CTX_trusted_stack() sets the set of trusted certificates of B<ctx>
52to B<sk>. This is an alternative way of specifying trusted certificates
53instead of using an B<X509_STORE>.
54
55X509_STORE_CTX_set_cert() sets the certificate to be verified in B<ctx> to
56B<x>.
57
58X509_STORE_CTX_set_chain() sets the additional certificate chain used by B<ctx>
59to B<sk>.
60
61X509_STORE_CTX_set0_crls() sets a set of CRLs to use to aid certificate
62verification to B<sk>. These CRLs will only be used if CRL verification is
63enabled in the associated B<X509_VERIFY_PARAM> structure. This might be
64used where additional "useful" CRLs are supplied as part of a protocol,
65for example in a PKCS#7 structure.
66
67X509_VERIFY_PARAM *X509_STORE_CTX_get0_param() retrieves an internal pointer
68to the verification parameters associated with B<ctx>.
69
70X509_STORE_CTX_set0_param() sets the internal verification parameter pointer
71to B<param>. After this call B<param> should not be used.
72
73X509_STORE_CTX_set_default() looks up and sets the default verification
74method to B<name>. This uses the function X509_VERIFY_PARAM_lookup() to
75find an appropriate set of parameters from B<name>.
76
77=head1 NOTES
78
79The certificates and CRLs in a store are used internally and should B<not>
80be freed up until after the associated B<X509_STORE_CTX> is freed. Legacy
81applications might implicitly use an B<X509_STORE_CTX> like this:
82
83 X509_STORE_CTX ctx;
84 X509_STORE_CTX_init(&ctx, store, cert, chain);
85
86this is B<not> recommended in new applications they should instead do:
87
88 X509_STORE_CTX *ctx;
89 ctx = X509_STORE_CTX_new();
90 if (ctx == NULL)
91 /* Bad error */
92 X509_STORE_CTX_init(ctx, store, cert, chain);
93
94=head1 BUGS
95
96The certificates and CRLs in a context are used internally and should B<not>
97be freed up until after the associated B<X509_STORE_CTX> is freed. Copies
98should be made or reference counts increased instead.
99
100=head1 RETURN VALUES
101
102X509_STORE_CTX_new() returns an newly allocates context or B<NULL> is an
103error occurred.
104
105X509_STORE_CTX_init() returns 1 for success or 0 if an error occurred.
106
107X509_STORE_CTX_get0_param() returns a pointer to an B<X509_VERIFY_PARAM>
108structure or B<NULL> if an error occurred.
109
110X509_STORE_CTX_cleanup(), X509_STORE_CTX_free(), X509_STORE_CTX_trusted_stack(),
111X509_STORE_CTX_set_cert(), X509_STORE_CTX_set_chain(),
112X509_STORE_CTX_set0_crls() and X509_STORE_CTX_set0_param() do not return
113values.
114
115X509_STORE_CTX_set_default() returns 1 for success or 0 if an error occurred.
116
117=head1 SEE ALSO
118
119L<X509_verify_cert(3)|X509_verify_cert(3)>
120L<X509_VERIFY_PARAM_set_flags(3)|X509_VERIFY_PARAM_set_flags(3)>
121
122=head1 HISTORY
123
124X509_STORE_CTX_set0_crls() was first added to OpenSSL 1.0.0
125
126=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod b/src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod
deleted file mode 100644
index 7dfe430c4c..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_CTX_set_verify_cb.pod
+++ /dev/null
@@ -1,165 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_CTX_set_verify_cb - set verification callback
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509_vfy.h>
10
11 void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
12 int (*verify_cb)(int ok, X509_STORE_CTX *ctx));
13
14=head1 DESCRIPTION
15
16X509_STORE_CTX_set_verify_cb() sets the verification callback of B<ctx> to
17B<verify_cb> overwriting any existing callback.
18
19The verification callback can be used to customise the operation of certificate
20verification, either by overriding error conditions or logging errors for
21debugging purposes.
22
23However a verification callback is B<not> essential and the default operation
24is often sufficient.
25
26The B<ok> parameter to the callback indicates the value the callback should
27return to retain the default behaviour. If it is zero then and error condition
28is indicated. If it is 1 then no error occurred. If the flag
29B<X509_V_FLAG_NOTIFY_POLICY> is set then B<ok> is set to 2 to indicate the
30policy checking is complete.
31
32The B<ctx> parameter to the callback is the B<X509_STORE_CTX> structure that
33is performing the verification operation. A callback can examine this
34structure and receive additional information about the error, for example
35by calling X509_STORE_CTX_get_current_cert(). Additional application data can
36be passed to the callback via the B<ex_data> mechanism.
37
38=head1 WARNING
39
40In general a verification callback should B<NOT> unconditionally return 1 in
41all circumstances because this will allow verification to succeed no matter
42what the error. This effectively removes all security from the application
43because B<any> certificate (including untrusted generated ones) will be
44accepted.
45
46=head1 NOTES
47
48The verification callback can be set and inherited from the parent structure
49performing the operation. In some cases (such as S/MIME verification) the
50B<X509_STORE_CTX> structure is created and destroyed internally and the
51only way to set a custom verification callback is by inheriting it from the
52associated B<X509_STORE>.
53
54=head1 RETURN VALUES
55
56X509_STORE_CTX_set_verify_cb() does not return a value.
57
58=head1 EXAMPLES
59
60Default callback operation:
61
62 int
63 verify_callback(int ok, X509_STORE_CTX *ctx)
64 {
65 return ok;
66 }
67
68Simple example, suppose a certificate in the chain is expired and we wish
69to continue after this error:
70
71 int
72 verify_callback(int ok, X509_STORE_CTX *ctx)
73 {
74 /* Tolerate certificate expiration */
75 if (X509_STORE_CTX_get_error(ctx) == X509_V_ERR_CERT_HAS_EXPIRED)
76 return 1;
77 /* Otherwise don't override */
78 return ok;
79 }
80
81More complex example, we don't wish to continue after B<any> certificate has
82expired just one specific case:
83
84 int
85 verify_callback(int ok, X509_STORE_CTX *ctx)
86 {
87 int err = X509_STORE_CTX_get_error(ctx);
88 X509 *err_cert = X509_STORE_CTX_get_current_cert(ctx);
89
90 if (err == X509_V_ERR_CERT_HAS_EXPIRED) {
91 if (check_is_acceptable_expired_cert(err_cert)
92 return 1;
93 }
94 return ok;
95 }
96
97Full featured logging callback. In this case the B<bio_err> is assumed to be
98a global logging B<BIO>, an alternative would to store a BIO in B<ctx> using
99B<ex_data>.
100
101 int
102 verify_callback(int ok, X509_STORE_CTX *ctx)
103 {
104 X509 *err_cert;
105 int err,depth;
106
107 err_cert = X509_STORE_CTX_get_current_cert(ctx);
108 err = X509_STORE_CTX_get_error(ctx);
109 depth = X509_STORE_CTX_get_error_depth(ctx);
110
111 BIO_printf(bio_err,"depth=%d ",depth);
112 if (err_cert) {
113 X509_NAME_print_ex(bio_err,
114 X509_get_subject_name(err_cert), 0,
115 XN_FLAG_ONELINE);
116 BIO_puts(bio_err, "\n");
117 } else
118 BIO_puts(bio_err, "<no cert>\n");
119 if (!ok)
120 BIO_printf(bio_err, "verify error:num=%d:%s\n",
121 err, X509_verify_cert_error_string(err));
122 switch (err) {
123 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
124 BIO_puts(bio_err, "issuer= ");
125 X509_NAME_print_ex(bio_err,
126 X509_get_issuer_name(err_cert), 0,
127 XN_FLAG_ONELINE);
128 BIO_puts(bio_err, "\n");
129 break;
130 case X509_V_ERR_CERT_NOT_YET_VALID:
131 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
132 BIO_printf(bio_err, "notBefore=");
133 ASN1_TIME_print(bio_err,
134 X509_get_notBefore(err_cert));
135 BIO_printf(bio_err, "\n");
136 break;
137 case X509_V_ERR_CERT_HAS_EXPIRED:
138 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
139 BIO_printf(bio_err, "notAfter=");
140 ASN1_TIME_print(bio_err, X509_get_notAfter(err_cert));
141 BIO_printf(bio_err, "\n");
142 break;
143 case X509_V_ERR_NO_EXPLICIT_POLICY:
144 policies_print(bio_err, ctx);
145 break;
146 }
147 if (err == X509_V_OK && ok == 2)
148 /* print out policies */
149
150 BIO_printf(bio_err,"verify return:%d\n",ok);
151 return(ok);
152 }
153
154=head1 SEE ALSO
155
156L<X509_STORE_CTX_get_error(3)|X509_STORE_CTX_get_error(3)>
157L<X509_STORE_set_verify_cb_func(3)|X509_STORE_set_verify_cb_func(3)>
158L<X509_STORE_CTX_get_ex_new_index(3)|X509_STORE_CTX_get_ex_new_index(3)>
159
160=head1 HISTORY
161
162X509_STORE_CTX_set_verify_cb() is available in all versions of SSLeay and
163OpenSSL.
164
165=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod b/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod
deleted file mode 100644
index 754512341c..0000000000
--- a/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod
+++ /dev/null
@@ -1,54 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_STORE_set_verify_cb_func, X509_STORE_set_verify_cb - set verification
6callback
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509_vfy.h>
11
12 void X509_STORE_set_verify_cb(X509_STORE *st,
13 int (*verify_cb)(int ok, X509_STORE_CTX *ctx));
14
15 void X509_STORE_set_verify_cb_func(X509_STORE *st,
16 int (*verify_cb)(int ok, X509_STORE_CTX *ctx));
17
18=head1 DESCRIPTION
19
20X509_STORE_set_verify_cb() sets the verification callback of B<ctx> to
21B<verify_cb> overwriting any existing callback.
22
23X509_STORE_set_verify_cb_func() also sets the verification callback but it
24is implemented as a macro.
25
26=head1 NOTES
27
28The verification callback from an B<X509_STORE> is inherited by
29the corresponding B<X509_STORE_CTX> structure when it is initialized. This can
30be used to set the verification callback when the B<X509_STORE_CTX> is
31otherwise inaccessible (for example during S/MIME verification).
32
33=head1 BUGS
34
35The macro version of this function was the only one available before
36OpenSSL 1.0.0.
37
38=head1 RETURN VALUES
39
40X509_STORE_set_verify_cb() and X509_STORE_set_verify_cb_func() do not return
41a value.
42
43=head1 SEE ALSO
44
45L<X509_STORE_CTX_set_verify_cb(3)|X509_STORE_CTX_set_verify_cb(3)>
46
47=head1 HISTORY
48
49X509_STORE_set_verify_cb_func() is available in all versions of SSLeay and
50OpenSSL.
51
52X509_STORE_set_verify_cb() was added to OpenSSL 1.0.0.
53
54=cut
diff --git a/src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod b/src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod
deleted file mode 100644
index 6c88aec49e..0000000000
--- a/src/lib/libcrypto/doc/X509_VERIFY_PARAM_set_flags.pod
+++ /dev/null
@@ -1,172 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_VERIFY_PARAM_set_flags, X509_VERIFY_PARAM_clear_flags,
6X509_VERIFY_PARAM_get_flags, X509_VERIFY_PARAM_set_purpose,
7X509_VERIFY_PARAM_set_trust, X509_VERIFY_PARAM_set_depth,
8X509_VERIFY_PARAM_get_depth, X509_VERIFY_PARAM_set_time,
9X509_VERIFY_PARAM_add0_policy, X509_VERIFY_PARAM_set1_policies - X509
10verification parameters
11
12=head1 SYNOPSIS
13
14 #include <openssl/x509_vfy.h>
15
16 int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);
17 int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
18 unsigned long flags);
19 unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);
20
21 int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
22 int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
23
24 void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
25
26 int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
27 ASN1_OBJECT *policy);
28 int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
29 STACK_OF(ASN1_OBJECT) *policies);
30
31 void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
32 int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);
33
34=head1 DESCRIPTION
35
36These functions manipulate the B<X509_VERIFY_PARAM> structure associated with
37a certificate verification operation.
38
39The X509_VERIFY_PARAM_set_flags() function sets the flags in B<param> by oring
40it with B<flags>. See the B<VERIFICATION FLAGS> section for a complete
41description of values the B<flags> parameter can take.
42
43X509_VERIFY_PARAM_get_flags() returns the flags in B<param>.
44
45X509_VERIFY_PARAM_clear_flags() clears the flags B<flags> in B<param>.
46
47X509_VERIFY_PARAM_set_purpose() sets the verification purpose in B<param>
48to B<purpose>. This determines the acceptable purpose of the certificate
49chain, for example SSL client or SSL server.
50
51X509_VERIFY_PARAM_set_trust() sets the trust setting in B<param> to
52B<trust>.
53
54X509_VERIFY_PARAM_set_time() sets the verification time in B<param> to
55B<t>. Normally the current time is used.
56
57X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled
58by default) and adds B<policy> to the acceptable policy set.
59
60X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled
61by default) and sets the acceptable policy set to B<policies>. Any existing
62policy set is cleared. The B<policies> parameter can be B<NULL> to clear
63an existing policy set.
64
65X509_VERIFY_PARAM_set_depth() sets the maximum verification depth to B<depth>.
66That is the maximum number of untrusted CA certificates that can appear in a
67chain.
68
69=head1 RETURN VALUES
70
71X509_VERIFY_PARAM_set_flags(), X509_VERIFY_PARAM_clear_flags(),
72X509_VERIFY_PARAM_set_purpose(), X509_VERIFY_PARAM_set_trust(),
73X509_VERIFY_PARAM_add0_policy() and X509_VERIFY_PARAM_set1_policies() return 1
74for success and 0 for failure.
75
76X509_VERIFY_PARAM_get_flags() returns the current verification flags.
77
78X509_VERIFY_PARAM_set_time() and X509_VERIFY_PARAM_set_depth() do not return
79values.
80
81X509_VERIFY_PARAM_get_depth() returns the current verification depth.
82
83=head1 VERIFICATION FLAGS
84
85The verification flags consists of zero or more of the following flags
86ored together.
87
88B<X509_V_FLAG_CRL_CHECK> enables CRL checking for the certificate chain leaf
89certificate. An error occurs if a suitable CRL cannot be found.
90
91B<X509_V_FLAG_CRL_CHECK_ALL> enables CRL checking for the entire certificate
92chain.
93
94B<X509_V_FLAG_IGNORE_CRITICAL> disabled critical extension checking. By default
95any unhandled critical extensions in certificates or (if checked) CRLs results
96in a fatal error. If this flag is set unhandled critical extensions are
97ignored. B<WARNING> setting this option for anything other than debugging
98purposes can be a security risk. Finer control over which extensions are
99supported can be performed in the verification callback.
100
101THe B<X509_V_FLAG_X509_STRICT> flag disables workarounds for some broken
102certificates and makes the verification strictly apply B<X509> rules.
103
104B<X509_V_FLAG_ALLOW_PROXY_CERTS> enables proxy certificate verification.
105
106B<X509_V_FLAG_POLICY_CHECK> enables certificate policy checking, by default
107no policy checking is performed. Additional information is sent to the
108verification callback relating to policy checking.
109
110B<X509_V_FLAG_EXPLICIT_POLICY>, B<X509_V_FLAG_INHIBIT_ANY> and
111B<X509_V_FLAG_INHIBIT_MAP> set the B<require explicit policy>, B<inhibit any
112policy> and B<inhibit policy mapping> flags respectively as defined in
113B<RFC3280>. Policy checking is automatically enabled if any of these flags
114are set.
115
116If B<X509_V_FLAG_NOTIFY_POLICY> is set and the policy checking is successful
117a special status code is set to the verification callback. This permits it
118to examine the valid policy tree and perform additional checks or simply
119log it for debugging purposes.
120
121By default some additional features such as indirect CRLs and CRLs signed by
122different keys are disabled. If B<X509_V_FLAG_EXTENDED_CRL_SUPPORT> is set
123they are enabled.
124
125If B<X509_V_FLAG_USE_DELTAS> ise set delta CRLs (if present) are used to
126determine certificate status. If not set deltas are ignored.
127
128B<X509_V_FLAG_CHECK_SS_SIGNATURE> enables checking of the root CA self signed
129certificate signature. By default this check is disabled because it doesn't
130add any additional security but in some cases applications might want to
131check the signature anyway. A side effect of not checking the root CA
132signature is that disabled or unsupported message digests on the root CA
133are not treated as fatal errors.
134
135The B<X509_V_FLAG_CB_ISSUER_CHECK> flag enables debugging of certificate
136issuer checks. It is B<not> needed unless you are logging certificate
137verification. If this flag is set then additional status codes will be sent
138to the verification callback and it B<must> be prepared to handle such cases
139without assuming they are hard errors.
140
141=head1 NOTES
142
143The above functions should be used to manipulate verification parameters
144instead of legacy functions which work in specific structures such as
145X509_STORE_CTX_set_flags().
146
147=head1 BUGS
148
149Delta CRL checking is currently primitive. Only a single delta can be used and
150(partly due to limitations of B<X509_STORE>) constructed CRLs are not
151maintained.
152
153If CRLs checking is enable CRLs are expected to be available in the
154corresponding B<X509_STORE> structure. No attempt is made to download
155CRLs from the CRL distribution points extension.
156
157=head1 EXAMPLE
158
159Enable CRL checking when performing certificate verification during SSL
160connections associated with an B<SSL_CTX> structure B<ctx>:
161
162 X509_VERIFY_PARAM *param;
163 param = X509_VERIFY_PARAM_new();
164 X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
165 SSL_CTX_set1_param(ctx, param);
166 X509_VERIFY_PARAM_free(param);
167
168=head1 SEE ALSO
169
170L<X509_verify_cert(3)|X509_verify_cert(3)>
171
172=cut
diff --git a/src/lib/libcrypto/doc/X509_new.pod b/src/lib/libcrypto/doc/X509_new.pod
deleted file mode 100644
index a36808b825..0000000000
--- a/src/lib/libcrypto/doc/X509_new.pod
+++ /dev/null
@@ -1,38 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_new, X509_free - X509 certificate ASN1 allocation functions
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509 *X509_new(void);
12 void X509_free(X509 *a);
13
14=head1 DESCRIPTION
15
16The X509 ASN1 allocation routines, allocate and free an
17X509 structure, which represents an X509 certificate.
18
19X509_new() allocates and initializes a X509 structure.
20
21X509_free() frees up the B<X509> structure B<a>.
22If B<a> is a B<NULL> pointer, no action occurs.
23
24=head1 RETURN VALUES
25
26If the allocation fails, X509_new() returns B<NULL> and sets an error
27code that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
28Otherwise it returns a pointer to the newly allocated structure.
29
30=head1 SEE ALSO
31
32L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509(3)|d2i_X509(3)>
33
34=head1 HISTORY
35
36X509_new() and X509_free() are available in all versions of SSLeay and OpenSSL.
37
38=cut
diff --git a/src/lib/libcrypto/doc/X509_verify_cert.pod b/src/lib/libcrypto/doc/X509_verify_cert.pod
deleted file mode 100644
index f05edd8333..0000000000
--- a/src/lib/libcrypto/doc/X509_verify_cert.pod
+++ /dev/null
@@ -1,53 +0,0 @@
1=pod
2
3=head1 NAME
4
5X509_verify_cert - discover and verify X509 certificate chain
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 int X509_verify_cert(X509_STORE_CTX *ctx);
12
13=head1 DESCRIPTION
14
15The X509_verify_cert() function attempts to discover and validate a
16certificate chain based on parameters in B<ctx>. A complete description of
17the process is contained in the L<verify(1)|verify(1)> manual page.
18
19=head1 RETURN VALUES
20
21If a complete chain can be built and validated this function returns 1,
22otherwise it return zero, in exceptional circumstances it can also
23return a negative code.
24
25If the function fails additional error information can be obtained by
26examining B<ctx> using, for example X509_STORE_CTX_get_error().
27
28=head1 NOTES
29
30Applications rarely call this function directly but it is used by
31OpenSSL internally for certificate validation, in both the S/MIME and
32SSL/TLS code.
33
34The negative return value from X509_verify_cert() can only occur if no
35certificate is set in B<ctx> (due to a programming error) or if a retry
36operation is requested during internal lookups (which never happens with
37standard lookup methods). It is however recommended that application check
38for <= 0 return value on error.
39
40=head1 BUGS
41
42This function uses the header B<x509.h> as opposed to most chain verification
43functions which use B<x509_vfy.h>.
44
45=head1 SEE ALSO
46
47L<X509_STORE_CTX_get_error(3)|X509_STORE_CTX_get_error(3)>
48
49=head1 HISTORY
50
51X509_verify_cert() is available in all versions of SSLeay and OpenSSL.
52
53=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509.pod b/src/lib/libcrypto/doc/d2i_X509.pod
deleted file mode 100644
index fad4e8c35b..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509.pod
+++ /dev/null
@@ -1,231 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509, i2d_X509, d2i_X509_bio, d2i_X509_fp, i2d_X509_bio,
6i2d_X509_fp - X509 encode and decode functions
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 X509 *d2i_X509(X509 **px, const unsigned char **in, int len);
13 int i2d_X509(X509 *x, unsigned char **out);
14
15 X509 *d2i_X509_bio(BIO *bp, X509 **x);
16 X509 *d2i_X509_fp(FILE *fp, X509 **x);
17
18 int i2d_X509_bio(BIO *bp, X509 *x);
19 int i2d_X509_fp(FILE *fp, X509 *x);
20
21=head1 DESCRIPTION
22
23The X509 encode and decode routines encode and parse an
24B<X509> structure, which represents an X509 certificate.
25
26d2i_X509() attempts to decode B<len> bytes at B<*in>. If
27successful a pointer to the B<X509> structure is returned. If an error
28occurred then B<NULL> is returned. If B<px> is not B<NULL> then the
29returned structure is written to B<*px>. If B<*px> is not B<NULL>
30then it is assumed that B<*px> contains a valid B<X509>
31structure and an attempt is made to reuse it. If the call is
32successful B<*in> is incremented to the byte following the
33parsed data.
34
35i2d_X509() encodes the structure pointed to by B<x> into DER format.
36If B<out> is not B<NULL> is writes the DER encoded data to the buffer
37at B<*out>, and increments it to point after the data just written.
38If the return value is negative an error occurred, otherwise it
39returns the length of the encoded data.
40
41For OpenSSL 0.9.7 and later if B<*out> is B<NULL> memory will be
42allocated for a buffer and the encoded data written to it. In this
43case B<*out> is not incremented and it points to the start of the
44data just written.
45
46d2i_X509_bio() is similar to d2i_X509() except it attempts
47to parse data from BIO B<bp>.
48
49d2i_X509_fp() is similar to d2i_X509() except it attempts
50to parse data from FILE pointer B<fp>.
51
52i2d_X509_bio() is similar to i2d_X509() except it writes
53the encoding of the structure B<x> to BIO B<bp> and it
54returns 1 for success and 0 for failure.
55
56i2d_X509_fp() is similar to i2d_X509() except it writes
57the encoding of the structure B<x> to BIO B<bp> and it
58returns 1 for success and 0 for failure.
59
60=head1 NOTES
61
62The letters B<i> and B<d> in for example B<i2d_X509> stand for
63"internal" (that is an internal C structure) and "DER". So that
64B<i2d_X509> converts from internal to DER.
65
66The functions can also understand B<BER> forms.
67
68The actual X509 structure passed to i2d_X509() must be a valid
69populated B<X509> structure it can B<not> simply be fed with an
70empty structure such as that returned by X509_new().
71
72The encoded data is in binary form and may contain embedded zeroes.
73Therefore any FILE pointers or BIOs should be opened in binary mode.
74Functions such as B<strlen()> will B<not> return the correct length
75of the encoded structure.
76
77The ways that B<*in> and B<*out> are incremented after the operation
78can trap the unwary. See the B<WARNINGS> section for some common
79errors.
80
81The reason for the auto increment behaviour is to reflect a typical
82usage of ASN1 functions: after one structure is encoded or decoded
83another will processed after it.
84
85=head1 EXAMPLES
86
87Allocate and encode the DER encoding of an X509 structure:
88
89 int len;
90 unsigned char *buf, *p;
91
92 len = i2d_X509(x, NULL);
93
94 buf = malloc(len);
95
96 if (buf == NULL)
97 /* error */
98
99 p = buf;
100
101 i2d_X509(x, &p);
102
103If you are using OpenSSL 0.9.7 or later then this can be
104simplified to:
105
106
107 int len;
108 unsigned char *buf;
109
110 buf = NULL;
111
112 len = i2d_X509(x, &buf);
113
114 if (len < 0)
115 /* error */
116
117Attempt to decode a buffer:
118
119 X509 *x;
120
121 unsigned char *buf, *p;
122
123 int len;
124
125 /* Something to setup buf and len */
126
127 p = buf;
128
129 x = d2i_X509(NULL, &p, len);
130
131 if (x == NULL)
132 /* Some error */
133
134Alternative technique:
135
136 X509 *x;
137
138 unsigned char *buf, *p;
139
140 int len;
141
142 /* Something to setup buf and len */
143
144 p = buf;
145
146 x = NULL;
147
148 if(!d2i_X509(&x, &p, len))
149 /* Some error */
150
151
152=head1 WARNINGS
153
154The use of temporary variable is mandatory. A common
155mistake is to attempt to use a buffer directly as follows:
156
157 int len;
158 unsigned char *buf;
159
160 len = i2d_X509(x, NULL);
161
162 buf = malloc(len);
163
164 if (buf == NULL)
165 /* error */
166
167 i2d_X509(x, &buf);
168
169 /* Other stuff ... */
170
171 free(buf);
172
173This code will result in B<buf> apparently containing garbage because
174it was incremented after the call to point after the data just written.
175Also B<buf> will no longer contain the pointer allocated by B<malloc()>
176and the subsequent call to B<free()> may well crash.
177
178The auto allocation feature (setting buf to NULL) only works on OpenSSL
1790.9.7 and later. Attempts to use it on earlier versions will typically
180cause a segmentation violation.
181
182Another trap to avoid is misuse of the B<xp> argument to B<d2i_X509()>:
183
184 X509 *x;
185
186 if (!d2i_X509(&x, &p, len))
187 /* Some error */
188
189This will probably crash somewhere in B<d2i_X509()>. The reason for this
190is that the variable B<x> is uninitialized and an attempt will be made to
191interpret its (invalid) value as an B<X509> structure, typically causing
192a segmentation violation. If B<x> is set to NULL first then this will not
193happen.
194
195=head1 BUGS
196
197In some versions of OpenSSL the "reuse" behaviour of d2i_X509() when
198B<*px> is valid is broken and some parts of the reused structure may
199persist if they are not present in the new one. As a result the use
200of this "reuse" behaviour is strongly discouraged.
201
202i2d_X509() will not return an error in many versions of OpenSSL,
203if mandatory fields are not initialized due to a programming error
204then the encoded structure may contain invalid data or omit the
205fields entirely and will not be parsed by d2i_X509(). This may be
206fixed in future so code should not assume that i2d_X509() will
207always succeed.
208
209=head1 RETURN VALUES
210
211d2i_X509(), d2i_X509_bio() and d2i_X509_fp() return a valid B<X509> structure
212or B<NULL> if an error occurs. The error code that can be obtained by
213L<ERR_get_error(3)|ERR_get_error(3)>.
214
215i2d_X509() returns the number of bytes successfully encoded or a negative
216value if an error occurs. The error code can be obtained by
217L<ERR_get_error(3)|ERR_get_error(3)>.
218
219i2d_X509_bio() and i2d_X509_fp() return 1 for success and 0 if an error
220occurs The error code can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
221
222=head1 SEE ALSO
223
224L<ERR_get_error(3)|ERR_get_error(3)>
225
226=head1 HISTORY
227
228d2i_X509, i2d_X509, d2i_X509_bio, d2i_X509_fp, i2d_X509_bio and i2d_X509_fp
229are available in all versions of SSLeay and OpenSSL.
230
231=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_ALGOR.pod b/src/lib/libcrypto/doc/d2i_X509_ALGOR.pod
deleted file mode 100644
index 68011679fd..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_ALGOR.pod
+++ /dev/null
@@ -1,26 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_ALGOR, i2d_X509_ALGOR - AlgorithmIdentifier functions.
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509_ALGOR *d2i_X509_ALGOR(X509_ALGOR **a, unsigned char **pp, long length);
12 int i2d_X509_ALGOR(X509_ALGOR *a, unsigned char **pp);
13
14=head1 DESCRIPTION
15
16These functions decode and encode an B<X509_ALGOR> structure which is
17equivalent to the B<AlgorithmIdentifier> structure.
18
19Othewise these behave in a similar way to d2i_X509() and i2d_X509()
20described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
21
22=head1 SEE ALSO
23
24L<d2i_X509(3)|d2i_X509(3)>
25
26=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_CRL.pod b/src/lib/libcrypto/doc/d2i_X509_CRL.pod
deleted file mode 100644
index 563e4de8e0..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_CRL.pod
+++ /dev/null
@@ -1,33 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_CRL, i2d_X509_CRL, d2i_X509_CRL_bio, d2i_X509_CRL_fp,
6i2d_X509_CRL_bio, i2d_X509_CRL_fp - PKCS#10 certificate request functions.
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 X509_CRL *d2i_X509_CRL(X509_CRL **a, const unsigned char **pp, long length);
13 int i2d_X509_CRL(X509_CRL *a, unsigned char **pp);
14
15 X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **x);
16 X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **x);
17
18 int i2d_X509_CRL_bio(BIO *bp, X509_CRL *x);
19 int i2d_X509_CRL_fp(FILE *fp, X509_CRL *x);
20
21=head1 DESCRIPTION
22
23These functions decode and encode an X509 CRL (certificate revocation
24list).
25
26Othewise the functions behave in a similar way to d2i_X509() and i2d_X509()
27described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
28
29=head1 SEE ALSO
30
31L<d2i_X509(3)|d2i_X509(3)>
32
33=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_NAME.pod b/src/lib/libcrypto/doc/d2i_X509_NAME.pod
deleted file mode 100644
index 2219885338..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_NAME.pod
+++ /dev/null
@@ -1,27 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_NAME, i2d_X509_NAME - X509_NAME encoding functions
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509_NAME *d2i_X509_NAME(X509_NAME **a, unsigned char **pp, long length);
12 int i2d_X509_NAME(X509_NAME *a, unsigned char **pp);
13
14=head1 DESCRIPTION
15
16These functions decode and encode an B<X509_NAME> structure which is the
17same as the B<Name> type defined in RFC2459 (and elsewhere) and used
18for example in certificate subject and issuer names.
19
20Othewise the functions behave in a similar way to d2i_X509() and i2d_X509()
21described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
22
23=head1 SEE ALSO
24
25L<d2i_X509(3)|d2i_X509(3)>
26
27=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_REQ.pod b/src/lib/libcrypto/doc/d2i_X509_REQ.pod
deleted file mode 100644
index baa8ae391e..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_REQ.pod
+++ /dev/null
@@ -1,32 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_REQ, i2d_X509_REQ, d2i_X509_REQ_bio, d2i_X509_REQ_fp,
6i2d_X509_REQ_bio, i2d_X509_REQ_fp - PKCS#10 certificate request functions.
7
8=head1 SYNOPSIS
9
10 #include <openssl/x509.h>
11
12 X509_REQ *d2i_X509_REQ(X509_REQ **a, const unsigned char **pp, long length);
13 int i2d_X509_REQ(X509_REQ *a, unsigned char **pp);
14
15 X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **x);
16 X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **x);
17
18 int i2d_X509_REQ_bio(BIO *bp, X509_REQ *x);
19 int i2d_X509_REQ_fp(FILE *fp, X509_REQ *x);
20
21=head1 DESCRIPTION
22
23These functions decode and encode a PKCS#10 certificate request.
24
25Othewise these behave in a similar way to d2i_X509() and i2d_X509()
26described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
27
28=head1 SEE ALSO
29
30L<d2i_X509(3)|d2i_X509(3)>
31
32=cut
diff --git a/src/lib/libcrypto/doc/d2i_X509_SIG.pod b/src/lib/libcrypto/doc/d2i_X509_SIG.pod
deleted file mode 100644
index 00d03f5ba1..0000000000
--- a/src/lib/libcrypto/doc/d2i_X509_SIG.pod
+++ /dev/null
@@ -1,26 +0,0 @@
1=pod
2
3=head1 NAME
4
5d2i_X509_SIG, i2d_X509_SIG - DigestInfo functions.
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11 X509_SIG *d2i_X509_SIG(X509_SIG **a, unsigned char **pp, long length);
12 int i2d_X509_SIG(X509_SIG *a, unsigned char **pp);
13
14=head1 DESCRIPTION
15
16These functions decode and encode an X509_SIG structure which is
17equivalent to the B<DigestInfo> structure defined in PKCS#1 and PKCS#7.
18
19Othewise these behave in a similar way to d2i_X509() and i2d_X509()
20described in the L<d2i_X509(3)|d2i_X509(3)> manual page.
21
22=head1 SEE ALSO
23
24L<d2i_X509(3)|d2i_X509(3)>
25
26=cut
diff --git a/src/lib/libcrypto/doc/x509.pod b/src/lib/libcrypto/doc/x509.pod
deleted file mode 100644
index f9e58e0e41..0000000000
--- a/src/lib/libcrypto/doc/x509.pod
+++ /dev/null
@@ -1,64 +0,0 @@
1=pod
2
3=head1 NAME
4
5x509 - X.509 certificate handling
6
7=head1 SYNOPSIS
8
9 #include <openssl/x509.h>
10
11=head1 DESCRIPTION
12
13A X.509 certificate is a structured grouping of information about
14an individual, a device, or anything one can imagine. A X.509 CRL
15(certificate revocation list) is a tool to help determine if a
16certificate is still valid. The exact definition of those can be
17found in the X.509 document from ITU-T, or in RFC3280 from PKIX.
18In OpenSSL, the type X509 is used to express such a certificate, and
19the type X509_CRL is used to express a CRL.
20
21A related structure is a certificate request, defined in PKCS#10 from
22RSA Security, Inc, also reflected in RFC2896. In OpenSSL, the type
23X509_REQ is used to express such a certificate request.
24
25To handle some complex parts of a certificate, there are the types
26X509_NAME (to express a certificate name), X509_ATTRIBUTE (to express
27a certificate attributes), X509_EXTENSION (to express a certificate
28extension) and a few more.
29
30Finally, there's the supertype X509_INFO, which can contain a CRL, a
31certificate and a corresponding private key.
32
33B<X509_>I<...>, B<d2i_X509_>I<...> and B<i2d_X509_>I<...> handle X.509
34certificates, with some exceptions, shown below.
35
36B<X509_CRL_>I<...>, B<d2i_X509_CRL_>I<...> and B<i2d_X509_CRL_>I<...>
37handle X.509 CRLs.
38
39B<X509_REQ_>I<...>, B<d2i_X509_REQ_>I<...> and B<i2d_X509_REQ_>I<...>
40handle PKCS#10 certificate requests.
41
42B<X509_NAME_>I<...> handle certificate names.
43
44B<X509_ATTRIBUTE_>I<...> handle certificate attributes.
45
46B<X509_EXTENSION_>I<...> handle certificate extensions.
47
48=head1 SEE ALSO
49
50L<X509_NAME_ENTRY_get_object(3)|X509_NAME_ENTRY_get_object(3)>,
51L<X509_NAME_add_entry_by_txt(3)|X509_NAME_add_entry_by_txt(3)>,
52L<X509_NAME_add_entry_by_NID(3)|X509_NAME_add_entry_by_NID(3)>,
53L<X509_NAME_print_ex(3)|X509_NAME_print_ex(3)>,
54L<X509_NAME_new(3)|X509_NAME_new(3)>,
55L<d2i_X509(3)|d2i_X509(3)>,
56L<d2i_X509_ALGOR(3)|d2i_X509_ALGOR(3)>,
57L<d2i_X509_CRL(3)|d2i_X509_CRL(3)>,
58L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>,
59L<d2i_X509_REQ(3)|d2i_X509_REQ(3)>,
60L<d2i_X509_SIG(3)|d2i_X509_SIG(3)>,
61L<crypto(3)|crypto(3)>,
62L<x509v3(3)|x509v3(3)>
63
64=cut
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-20 09:24:29 +0000