summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/man/X509_get_extension_flags.3
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/man/X509_get_extension_flags.3')
-rw-r--r--src/lib/libcrypto/man/X509_get_extension_flags.3234
1 files changed, 0 insertions, 234 deletions
diff --git a/src/lib/libcrypto/man/X509_get_extension_flags.3 b/src/lib/libcrypto/man/X509_get_extension_flags.3
deleted file mode 100644
index 1d7f29c687..0000000000
--- a/src/lib/libcrypto/man/X509_get_extension_flags.3
+++ /dev/null
@@ -1,234 +0,0 @@
1.\" $OpenBSD: X509_get_extension_flags.3,v 1.4 2023/04/30 19:40:23 tb Exp $
2.\" full merge up to: OpenSSL 361136f4 Sep 1 18:56:58 2015 +0100
3.\" selective merge up to: OpenSSL 2b2e3106f Feb 16 15:04:45 2021 +0000
4.\"
5.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
6.\" Copyright (c) 2015 The OpenSSL Project. All rights reserved.
7.\"
8.\" Redistribution and use in source and binary forms, with or without
9.\" modification, are permitted provided that the following conditions
10.\" are met:
11.\"
12.\" 1. Redistributions of source code must retain the above copyright
13.\" notice, this list of conditions and the following disclaimer.
14.\"
15.\" 2. Redistributions in binary form must reproduce the above copyright
16.\" notice, this list of conditions and the following disclaimer in
17.\" the documentation and/or other materials provided with the
18.\" distribution.
19.\"
20.\" 3. All advertising materials mentioning features or use of this
21.\" software must display the following acknowledgment:
22.\" "This product includes software developed by the OpenSSL Project
23.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
24.\"
25.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26.\" endorse or promote products derived from this software without
27.\" prior written permission. For written permission, please contact
28.\" openssl-core@openssl.org.
29.\"
30.\" 5. Products derived from this software may not be called "OpenSSL"
31.\" nor may "OpenSSL" appear in their names without prior written
32.\" permission of the OpenSSL Project.
33.\"
34.\" 6. Redistributions of any form whatsoever must retain the following
35.\" acknowledgment:
36.\" "This product includes software developed by the OpenSSL Project
37.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
38.\"
39.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50.\" OF THE POSSIBILITY OF SUCH DAMAGE.
51.\"
52.Dd $Mdocdate: April 30 2023 $
53.Dt X509_GET_EXTENSION_FLAGS 3
54.Os
55.Sh NAME
56.Nm X509_get_extension_flags ,
57.Nm X509_get_key_usage ,
58.Nm X509_get_extended_key_usage
59.Nd retrieve certificate extension data
60.Sh SYNOPSIS
61.In openssl/x509v3.h
62.Ft uint32_t
63.Fo X509_get_extension_flags
64.Fa "X509 *x"
65.Fc
66.Ft uint32_t
67.Fo X509_get_key_usage
68.Fa "X509 *x"
69.Fc
70.Ft uint32_t
71.Fo X509_get_extended_key_usage
72.Fa "X509 *x"
73.Fc
74.Sh DESCRIPTION
75These functions retrieve information related to commonly used
76certificate extensions.
77.Pp
78.Fn X509_get_extension_flags
79retrieves general information about a certificate.
80It returns one or more of the following flags OR'ed together.
81.Bl -tag -width Ds
82.It Dv EXFLAG_V1
83The certificate is an obsolete version 1 certificate.
84.It Dv EXFLAG_BCONS
85The certificate contains a basic constraints extension.
86.It Dv EXFLAG_CA
87The certificate contains basic constraints and asserts the CA flag.
88.It Dv EXFLAG_PROXY
89The certificate is a valid proxy certificate.
90In LibreSSL this flag is never set.
91.It Dv EXFLAG_SI
92The certificate is self issued (that is subject and issuer names match).
93.It Dv EXFLAG_SS
94The subject and issuer names match and extension values imply it is self
95signed.
96.It Dv EXFLAG_FRESHEST
97The freshest CRL extension is present in the certificate.
98.It Dv EXFLAG_CRITICAL
99The certificate contains an unhandled critical extension.
100.It Dv EXFLAG_INVALID
101Some certificate extension values are invalid or inconsistent.
102The certificate should be rejected.
103This bit may also be raised after an out-of-memory error while
104processing the X509 object, so it may not be related to the processed
105ASN1 object itself.
106.\" EXFLAG_NO_FINGERPRINT is not available in LibreSSL. Do we need
107.\" https://github.com/openssl/openssl/issues/13698 and the fix it fixes?
108.\".It Dv EXFLAG_NO_FINGERPRINT
109.\" Failed to compute the internal SHA1 hash value of the certificate.
110.\" This may be due to malloc failure or because no SHA1 implementation was
111.\" found.
112.It Dv EXFLAG_INVALID_POLICY
113The
114.Dv NID_certificate_policies
115certificate extension is invalid or inconsistent.
116The certificate should be rejected.
117This bit may also be raised after an out-of-memory error while
118processing the X509 object, so it may not be related to the processed
119ASN1 object itself.
120.It Dv EXFLAG_KUSAGE
121The certificate contains a key usage extension.
122The value can be retrieved using
123.Fn X509_get_key_usage .
124.It Dv EXFLAG_XKUSAGE
125The certificate contains an extended key usage extension.
126The value can be retrieved using
127.Fn X509_get_extended_key_usage .
128.El
129.Pp
130.Fn X509_get_key_usage
131returns the value of the key usage extension.
132If key usage is present, it returns zero or more of these flags:
133.Dv KU_DIGITAL_SIGNATURE ,
134.Dv KU_NON_REPUDIATION ,
135.Dv KU_KEY_ENCIPHERMENT ,
136.Dv KU_DATA_ENCIPHERMENT ,
137.Dv KU_KEY_AGREEMENT ,
138.Dv KU_KEY_CERT_SIGN ,
139.Dv KU_CRL_SIGN ,
140.Dv KU_ENCIPHER_ONLY ,
141or
142.Dv KU_DECIPHER_ONLY ,
143corresponding to individual key usage bits.
144If key usage is absent,
145.Dv UINT32_MAX
146is returned.
147.Pp
148The following aliases for these flags are defined in
149.In openssl/x509.h :
150.Dv X509v3_KU_DIGITAL_SIGNATURE ,
151.Dv X509v3_KU_NON_REPUDIATION ,
152.Dv X509v3_KU_KEY_ENCIPHERMENT ,
153.Dv X509v3_KU_DATA_ENCIPHERMENT ,
154.Dv X509v3_KU_KEY_AGREEMENT ,
155.Dv X509v3_KU_KEY_CERT_SIGN ,
156.Dv X509v3_KU_CRL_SIGN ,
157.Dv X509v3_KU_ENCIPHER_ONLY ,
158and
159.Dv X509v3_KU_DECIPHER_ONLY .
160.\" X509v3_KU_UNDEF is intentionally undocumented because nothing uses it.
161.Pp
162.Fn X509_get_extended_key_usage
163returns the value of the extended key usage extension.
164If extended key usage is present, it returns zero or more of these
165flags:
166.Dv XKU_SSL_SERVER ,
167.Dv XKU_SSL_CLIENT ,
168.Dv XKU_SMIME ,
169.Dv XKU_CODE_SIGN
170.Dv XKU_OCSP_SIGN ,
171.Dv XKU_TIMESTAMP ,
172.Dv XKU_DVCS ,
173or
174.Dv XKU_ANYEKU .
175These correspond to the OIDs
176.Qq id-kp-serverAuth ,
177.Qq id-kp-clientAuth ,
178.Qq id-kp-emailProtection ,
179.Qq id-kp-codeSigning ,
180.Qq id-kp-OCSPSigning ,
181.Qq id-kp-timeStamping ,
182.Qq id-kp-dvcs ,
183and
184.Qq anyExtendedKeyUsage ,
185respectively.
186Additionally,
187.Dv XKU_SGC
188is set if either Netscape or Microsoft SGC OIDs are present.
189.Pp
190The value of the flags correspond to extension values which are cached
191in the
192.Vt X509
193structure.
194If the flags returned do not provide sufficient information,
195an application should examine extension values directly,
196for example using
197.Xr X509_get_ext_d2i 3 .
198.Pp
199If the key usage or extended key usage extension is absent then
200typically usage is unrestricted.
201For this reason
202.Fn X509_get_key_usage
203and
204.Fn X509_get_extended_key_usage
205return
206.Dv UINT32_MAX
207when the corresponding extension is absent.
208Applications can additionally check the return value of
209.Fn X509_get_extension_flags
210and take appropriate action if an extension is absent.
211.Sh RETURN VALUES
212.Fn X509_get_extension_flags ,
213.Fn X509_get_key_usage
214and
215.Fn X509_get_extended_key_usage
216return sets of flags corresponding to the certificate extension values.
217.Sh SEE ALSO
218.Xr BASIC_CONSTRAINTS_new 3 ,
219.Xr EXTENDED_KEY_USAGE_new 3 ,
220.Xr POLICYINFO_new 3 ,
221.Xr X509_check_ca 3 ,
222.Xr X509_check_purpose 3 ,
223.Xr X509_EXTENSION_new 3 ,
224.Xr X509_get_ext_d2i 3 ,
225.Xr X509_get_subject_name 3 ,
226.Xr X509_get_version 3 ,
227.Xr X509_new 3
228.Sh HISTORY
229.Nm X509_get_extension_flags ,
230.Nm X509_get_key_usage ,
231and
232.Nm X509_get_extended_key_usage
233first appeared in OpenSSL 1.1.0 and have been available since
234.Ox 7.1 .
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-06 16:15:43 +0000