summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3')
-rw-r--r--src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3188
1 files changed, 0 insertions, 188 deletions
diff --git a/src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3 b/src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3
deleted file mode 100644
index 5980f8f80d..0000000000
--- a/src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3
+++ /dev/null
@@ -1,188 +0,0 @@
1.\" $OpenBSD: X509_LOOKUP_hash_dir.3,v 1.13 2024/09/02 07:20:21 tb Exp $
2.\" full merge up to: OpenSSL 61f805c1 Jan 16 01:01:46 2018 +0800
3.\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100
4.\"
5.\" This file is a derived work.
6.\" The changes are covered by the following Copyright and license:
7.\"
8.\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
9.\"
10.\" Permission to use, copy, modify, and distribute this software for any
11.\" purpose with or without fee is hereby granted, provided that the above
12.\" copyright notice and this permission notice appear in all copies.
13.\"
14.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21.\"
22.\" The original file was written by Victor B. Wagner <vitus@cryptocom.ru>
23.\" and Claus Assmann.
24.\" Copyright (c) 2015, 2016 The OpenSSL Project. All rights reserved.
25.\"
26.\" Redistribution and use in source and binary forms, with or without
27.\" modification, are permitted provided that the following conditions
28.\" are met:
29.\"
30.\" 1. Redistributions of source code must retain the above copyright
31.\" notice, this list of conditions and the following disclaimer.
32.\"
33.\" 2. Redistributions in binary form must reproduce the above copyright
34.\" notice, this list of conditions and the following disclaimer in
35.\" the documentation and/or other materials provided with the
36.\" distribution.
37.\"
38.\" 3. All advertising materials mentioning features or use of this
39.\" software must display the following acknowledgment:
40.\" "This product includes software developed by the OpenSSL Project
41.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
42.\"
43.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
44.\" endorse or promote products derived from this software without
45.\" prior written permission. For written permission, please contact
46.\" openssl-core@openssl.org.
47.\"
48.\" 5. Products derived from this software may not be called "OpenSSL"
49.\" nor may "OpenSSL" appear in their names without prior written
50.\" permission of the OpenSSL Project.
51.\"
52.\" 6. Redistributions of any form whatsoever must retain the following
53.\" acknowledgment:
54.\" "This product includes software developed by the OpenSSL Project
55.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
56.\"
57.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
58.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
59.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
60.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
61.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
62.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
63.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
64.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
65.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
66.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
67.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
68.\" OF THE POSSIBILITY OF SUCH DAMAGE.
69.\"
70.Dd $Mdocdate: September 2 2024 $
71.Dt X509_LOOKUP_HASH_DIR 3
72.Os
73.Sh NAME
74.Nm X509_LOOKUP_hash_dir ,
75.Nm X509_LOOKUP_file ,
76.Nm X509_LOOKUP_mem
77.Nd certificate lookup methods
78.Sh SYNOPSIS
79.In openssl/x509_vfy.h
80.Ft const X509_LOOKUP_METHOD *
81.Fn X509_LOOKUP_hash_dir void
82.Ft const X509_LOOKUP_METHOD *
83.Fn X509_LOOKUP_file void
84.Ft const X509_LOOKUP_METHOD *
85.Fn X509_LOOKUP_mem void
86.Sh DESCRIPTION
87.Fn X509_LOOKUP_hash_dir ,
88.Fn X509_LOOKUP_file ,
89and
90.Fn X509_LOOKUP_mem
91return pointers to static certificate lookup method objects
92built into the library, for use with
93.Vt X509_STORE .
94.Pp
95Users of the library typically do not need
96to retrieve pointers to these method objects manually.
97They are automatically used by the
98.Xr X509_STORE_load_locations 3
99or
100.Xr SSL_CTX_load_verify_locations 3
101functions.
102.Ss File Method
103The
104.Fn X509_LOOKUP_file
105method loads all the certificates or CRLs present in a file into memory
106at the time the file is added as a lookup source.
107.Pp
108The file format is ASCII text which contains concatenated PEM
109certificates and CRLs.
110.Pp
111This method should be used by applications which work with a small set
112of CAs.
113.Ss Hashed Directory Method
114.Fa X509_LOOKUP_hash_dir
115is a more advanced method which loads certificates and CRLs on demand,
116and caches them in memory once they are loaded.
117As of OpenSSL 1.0.0, it also checks for newer CRLs upon each lookup, so
118that newer CRLs are used as soon as they appear in the directory.
119.Pp
120The directory should contain one certificate or CRL per file in PEM
121format, with a filename of the form
122.Ar hash . Ns Ar N
123for a certificate, or
124.Ar hash . Ns Sy r Ns Ar N
125for a CRL.
126The
127.Ar hash
128is the value returned by the
129.Xr X509_NAME_hash 3
130function applied to the subject name for certificates or issuer
131name for CRLs.
132The hash can also be obtained via the
133.Fl hash
134option of the
135.Xr openssl 1
136.Cm x509
137or
138.Cm crl
139commands.
140.Pp
141The
142.Ar N
143suffix is a sequence number that starts at zero and is incremented
144consecutively for each certificate or CRL with the same
145.Ar hash
146value.
147Gaps in the sequence numbers are not supported.
148It is assumed that there are no more objects with the same hash
149beyond the first missing number in the sequence.
150.Pp
151Sequence numbers make it possible for the directory to contain multiple
152certificates with the same subject name hash value.
153For example, it is possible to have in the store several certificates
154with the same subject or several CRLs with the same issuer (and, for
155example, a different validity period).
156.Pp
157When checking for new CRLs, once one CRL for a given hash value is
158loaded, hash_dir lookup method checks only for certificates with
159sequence number greater than that of the already cached CRL.
160.Pp
161Note that the hash algorithm used for subject name hashing changed in
162OpenSSL 1.0.0, and all certificate stores have to be rehashed when
163moving from OpenSSL 0.9.8 to 1.0.0.
164.Ss Memory Method
165The
166.Fn X509_LOOKUP_mem
167method supports loading PEM-encoded certificates and revocation lists
168that are already stored in memory, using the function
169.Xr X509_LOOKUP_add_mem 3 .
170This is particularly useful in processes using
171.Xr chroot 2 .
172.Sh RETURN VALUES
173These functions always return a pointer to a static object.
174.Sh SEE ALSO
175.Xr SSL_CTX_load_verify_locations 3 ,
176.Xr X509_LOOKUP_new 3 ,
177.Xr X509_STORE_load_locations 3 ,
178.Xr X509_STORE_new 3
179.Sh HISTORY
180.Fn X509_LOOKUP_hash_dir
181and
182.Fn X509_LOOKUP_file
183first appeared in SSLeay 0.8.0 and have been available since
184.Ox 2.4 .
185.Pp
186.Fn X509_LOOKUP_mem
187first appeared in
188.Ox 5.7 .
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-08 04:39:15 +0000