summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/lib/libcrypto/man/Makefile8
-rw-r--r--src/lib/libcrypto/man/X509_get_pubkey.3147
-rw-r--r--src/lib/libcrypto/man/X509_get_serialNumber.3112
-rw-r--r--src/lib/libcrypto/man/X509_get_subject_name.3169
-rw-r--r--src/lib/libcrypto/man/X509_get_version.3149
-rw-r--r--src/lib/libcrypto/man/X509_sign.3202
-rw-r--r--src/lib/libcrypto/man/X509v3_get_ext_by_NID.3387
7 files changed, 1173 insertions, 1 deletions
diff --git a/src/lib/libcrypto/man/Makefile b/src/lib/libcrypto/man/Makefile
index 3c14577966..f6c0ef249a 100644
--- a/src/lib/libcrypto/man/Makefile
+++ b/src/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.65 2016/12/05 16:13:19 schwarze Exp $ 1# $OpenBSD: Makefile,v 1.66 2016/12/05 18:24:08 schwarze Exp $
2 2
3.include <bsd.own.mk> 3.include <bsd.own.mk>
4 4
@@ -190,8 +190,14 @@ MAN= \
190 X509_check_ca.3 \ 190 X509_check_ca.3 \
191 X509_check_host.3 \ 191 X509_check_host.3 \
192 X509_check_issued.3 \ 192 X509_check_issued.3 \
193 X509_get_pubkey.3 \
194 X509_get_serialNumber.3 \
195 X509_get_subject_name.3 \
196 X509_get_version.3 \
193 X509_new.3 \ 197 X509_new.3 \
198 X509_sign.3 \
194 X509_verify_cert.3 \ 199 X509_verify_cert.3 \
200 X509v3_get_ext_by_NID.3 \
195 bn.3 \ 201 bn.3 \
196 bn_dump.3 \ 202 bn_dump.3 \
197 crypto.3 \ 203 crypto.3 \
diff --git a/src/lib/libcrypto/man/X509_get_pubkey.3 b/src/lib/libcrypto/man/X509_get_pubkey.3
new file mode 100644
index 0000000000..8948f5cfda
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_get_pubkey.3
@@ -0,0 +1,147 @@
1.\" $OpenBSD: X509_get_pubkey.3,v 1.1 2016/12/05 18:24:08 schwarze Exp $
2.\" OpenSSL e7fabc5e Sep 7 13:41:20 2015 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2015 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: December 5 2016 $
52.Dt X509_GET_PUBKEY 3
53.Os
54.Sh NAME
55.Nm X509_get_pubkey ,
56.Nm X509_set_pubkey ,
57.Nm X509_get_X509_PUBKEY ,
58.Nm X509_REQ_get_pubkey ,
59.Nm X509_REQ_set_pubkey
60.Nd get or set certificate or certificate request public key
61.Sh SYNOPSIS
62.In openssl/x509.h
63.Ft EVP_PKEY *
64.Fo X509_get_pubkey
65.Fa "X509 *x"
66.Fc
67.Ft int
68.Fo X509_set_pubkey
69.Fa "X509 *x"
70.Fa "EVP_PKEY *pkey"
71.Fc
72.Ft X509_PUBKEY *
73.Fo X509_get_X509_PUBKEY
74.Fa "X509 *x"
75.Fc
76.Ft EVP_PKEY *
77.Fo X509_REQ_get_pubkey
78.Fa "X509_REQ *req"
79.Fc
80.Ft int
81.Fo X509_REQ_set_pubkey
82.Fa "X509_REQ *x"
83.Fa "EVP_PKEY *pkey"
84.Fc
85.Sh DESCRIPTION
86.Fn X509_get_pubkey
87attempts to decode the public key for certificate
88.Fa x .
89If successful it returns the public key as an
90.Vt EVP_PKEY
91pointer with its reference count incremented: this means the returned
92key must be freed up after use.
93.Pp
94.Fn X509_get_X509_PUBKEY
95returns an internal pointer to the
96.Vt X509_PUBKEY
97structure which encodes the certificate of
98.Fa x .
99The returned value must not be freed up after use.
100.Fn X509_get_X509_PUBKEY
101is implemented as a macro.
102.Pp
103.Fn X509_set_pubkey
104attempts to set the public key for certificate
105.Fa x
106to
107.Fa pkey .
108The key
109.Fa pkey
110should be freed up after use.
111.Pp
112.Fn X509_REQ_get_pubkey
113and
114.Fn X509_REQ_set_pubkey
115are similar but operate on certificate request
116.Fa req .
117.Pp
118The first time a public key is decoded, the
119.Vt EVP_PKEY
120structure is cached in the certificate or certificate request itself.
121Subsequent calls return the cached structure with its reference count
122incremented to improve performance.
123.Sh RETURN VALUES
124.Fn X509_get_pubkey ,
125.Fn X509_get_X509_PUBKEY ,
126and
127.Fn X509_REQ_get_pubkey
128return a public key or
129.Dv NULL
130if an error occurred.
131.Pp
132.Fn X509_set_pubkey
133and
134.Fn X509_REQ_set_pubkey
135return 1 for success or 0 for failure.
136.Sh SEE ALSO
137.Xr d2i_X509 3 ,
138.Xr ERR_get_error 3 ,
139.Xr X509_CRL_get0_by_serial 3 ,
140.Xr X509_NAME_add_entry_by_txt 3 ,
141.Xr X509_NAME_ENTRY_get_object 3 ,
142.Xr X509_NAME_get_index_by_NID 3 ,
143.Xr X509_NAME_print_ex 3 ,
144.Xr X509_new 3 ,
145.Xr X509_sign 3 ,
146.Xr X509_verify_cert 3 ,
147.Xr X509V3_get_d2i 3
diff --git a/src/lib/libcrypto/man/X509_get_serialNumber.3 b/src/lib/libcrypto/man/X509_get_serialNumber.3
new file mode 100644
index 0000000000..9f2b14ec10
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_get_serialNumber.3
@@ -0,0 +1,112 @@
1.\" $OpenBSD: X509_get_serialNumber.3,v 1.1 2016/12/05 18:24:08 schwarze Exp $
2.\" OpenSSL bb9ad09e Jun 6 00:43:05 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: December 5 2016 $
52.Dt X509_GET_SERIALNUMBER 3
53.Os
54.Sh NAME
55.Nm X509_get_serialNumber ,
56.Nm X509_set_serialNumber
57.Nd get or set certificate serial number
58.Sh SYNOPSIS
59.In openssl/x509.h
60.Ft ASN1_INTEGER *
61.Fo X509_get_serialNumber
62.Fa "X509 *x"
63.Fc
64.Ft int
65.Fo X509_set_serialNumber
66.Fa "X509 *x"
67.Fa "ASN1_INTEGER *serial"
68.Fc
69.Sh DESCRIPTION
70.Fn X509_get_serialNumber
71returns the serial number of certificate
72.Fa x
73as an
74.Vt ASN1_INTEGER
75structure which can be examined or initialised.
76The value returned is an internal pointer which must not be freed
77up after the call.
78.Pp
79.Fn X509_set_serialNumber
80sets the serial number of certificate
81.Fa x
82to
83.Fa serial .
84A copy of the serial number is used internally so
85.Fa serial
86should be freed up after use.
87.Sh RETURN VALUES
88.Fn X509_get_serialNumber
89returns an
90.Vt ASN1_INTEGER
91structure.
92.Pp
93.Fn X509_set_serialNumber
94returns 1 for success and 0 for failure.
95.Sh SEE ALSO
96.Xr d2i_X509 3 ,
97.Xr ERR_get_error 3 ,
98.Xr X509_CRL_get0_by_serial 3 ,
99.Xr X509_get_pubkey 3 ,
100.Xr X509_NAME_add_entry_by_txt 3 ,
101.Xr X509_NAME_ENTRY_get_object 3 ,
102.Xr X509_NAME_get_index_by_NID 3 ,
103.Xr X509_NAME_print_ex 3 ,
104.Xr X509_new 3 ,
105.Xr X509_sign 3 ,
106.Xr X509_verify_cert 3 ,
107.Xr X509V3_get_d2i 3
108.Sh HISTORY
109.Fn X509_get_serialNumber
110and
111.Fn X509_set_serialNumber
112are available in all versions of OpenSSL.
diff --git a/src/lib/libcrypto/man/X509_get_subject_name.3 b/src/lib/libcrypto/man/X509_get_subject_name.3
new file mode 100644
index 0000000000..1b5814286f
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_get_subject_name.3
@@ -0,0 +1,169 @@
1.\" $OpenBSD: X509_get_subject_name.3,v 1.1 2016/12/05 18:24:08 schwarze Exp $
2.\" OpenSSL 0ad69cd6 Jun 14 23:02:16 2016 +0200
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2015 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: December 5 2016 $
52.Dt X509_GET_SUBJECT_NAME 3
53.Os
54.Sh NAME
55.Nm X509_get_subject_name ,
56.Nm X509_set_subject_name ,
57.Nm X509_get_issuer_name ,
58.Nm X509_set_issuer_name ,
59.Nm X509_REQ_get_subject_name ,
60.Nm X509_REQ_set_subject_name ,
61.Nm X509_CRL_get_issuer ,
62.Nm X509_CRL_set_issuer_name
63.Nd get and set issuer or subject names
64.Sh SYNOPSIS
65.In openssl/x509.h
66.Ft X509_NAME *
67.Fo X509_get_subject_name
68.Fa "X509 *x"
69.Fc
70.Ft int
71.Fo X509_set_subject_name
72.Fa "X509 *x"
73.Fa "X509_NAME *name"
74.Fc
75.Ft X509_NAME *
76.Fo X509_get_issuer_name
77.Fa "X509 *x"
78.Fc
79.Ft int
80.Fo X509_set_issuer_name
81.Fa "X509 *x"
82.Fa "X509_NAME *name"
83.Fc
84.Ft X509_NAME *
85.Fo X509_REQ_get_subject_name
86.Fa "const X509_REQ *req"
87.Fc
88.Ft int
89.Fo X509_REQ_set_subject_name
90.Fa "X509_REQ *req"
91.Fa "X509_NAME *name"
92.Fc
93.Ft X509_NAME *
94.Fo X509_CRL_get_issuer
95.Fa "const X509_CRL *crl"
96.Fc
97.Ft int
98.Fo X509_CRL_set_issuer_name
99.Fa "X509_CRL *x"
100.Fa "X509_NAME *name"
101.Fc
102.Sh DESCRIPTION
103.Fn X509_get_subject_name
104returns the subject name of certificate
105.Fa x .
106The returned value is an internal pointer which must not be freed.
107.Pp
108.Fn X509_set_subject_name
109sets the issuer name of certificate
110.Fa x
111to
112.Fa name .
113The
114.Fa name
115parameter is copied internally and should be freed up when it is no
116longer needed.
117.Pp
118.Fn X509_get_issuer_name
119and
120.Fn X509_set_issuer_name
121are identical to
122.Fn X509_get_subject_name
123and
124.Fn X509_set_subject_name
125except that they get and set the issuer name of
126.Fa x .
127.Pp
128Similarly
129.Fn X509_REQ_get_subject_name ,
130.Fn X509_REQ_set_subject_name ,
131.Fn X509_CRL_get_issuer ,
132and
133.Fn X509_CRL_set_issuer_name
134get or set the subject or issuer names of certificate requests
135of CRLs, respectively.
136.Pp
137.Fn X509_REQ_get_subject_name
138and
139.Fn X509_CRL_get_issuer
140are implemented as macros.
141.Sh RETURN VALUES
142.Fn X509_get_subject_name ,
143.Fn X509_get_issuer_name ,
144.Fn X509_REQ_get_subject_name ,
145and
146.Fn X509_CRL_get_issuer
147return a pointer to an
148.Vt X509_NAME
149object.
150.Pp
151.Fn X509_set_subject_name ,
152.Fn X509_set_issuer_name ,
153.Fn X509_REQ_set_subject_name ,
154and
155.Fn X509_CRL_set_issuer_name
156return 1 for success or 0 for failure.
157.Sh SEE ALSO
158.Xr d2i_X509 3 ,
159.Xr ERR_get_error 3 ,
160.Xr X509_CRL_get0_by_serial 3 ,
161.Xr X509_get_pubkey 3 ,
162.Xr X509_NAME_add_entry_by_txt 3 ,
163.Xr X509_NAME_ENTRY_get_object 3 ,
164.Xr X509_NAME_get_index_by_NID 3 ,
165.Xr X509_NAME_print_ex 3 ,
166.Xr X509_new 3 ,
167.Xr X509_sign 3 ,
168.Xr X509_verify_cert 3 ,
169.Xr X509V3_get_d2i 3
diff --git a/src/lib/libcrypto/man/X509_get_version.3 b/src/lib/libcrypto/man/X509_get_version.3
new file mode 100644
index 0000000000..6e35f3df31
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_get_version.3
@@ -0,0 +1,149 @@
1.\" $OpenBSD: X509_get_version.3,v 1.1 2016/12/05 18:24:08 schwarze Exp $
2.\" OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2015, 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: December 5 2016 $
52.Dt X509_GET_VERSION 3
53.Os
54.Sh NAME
55.Nm X509_get_version ,
56.Nm X509_set_version ,
57.Nm X509_REQ_get_version ,
58.Nm X509_REQ_set_version ,
59.Nm X509_CRL_get_version ,
60.Nm X509_CRL_set_version
61.Nd get or set certificate, certificate request, or CRL version
62.Sh SYNOPSIS
63.In openssl/x509.h
64.Ft long
65.Fo X509_get_version
66.Fa "const X509 *x"
67.Fc
68.Ft int
69.Fo X509_set_version
70.Fa "X509 *x"
71.Fa "long version"
72.Fc
73.Ft long
74.Fo X509_REQ_get_version
75.Fa "const X509_REQ *req"
76.Fc
77.Ft int
78.Fo X509_REQ_set_version
79.Fa "X509_REQ *x"
80.Fa "long version"
81.Fc
82.Ft long
83.Fo X509_CRL_get_version
84.Fa "const X509_CRL *crl"
85.Fc
86.Ft int
87.Fo X509_CRL_set_version
88.Fa "X509_CRL *x"
89.Fa "long version"
90.Fc
91.Sh DESCRIPTION
92.Fn X509_get_version
93returns the numerical value of the version field of certificate
94.Fa x .
95Note: this is defined by standards (X.509 et al.) to be one less
96than the certificate version.
97So a version 3 certificate will return 2 and a version 1 certificate
98will return 0.
99.Pp
100.Fn X509_set_version
101sets the numerical value of the version field of certificate
102.Fa x
103to
104.Fa version .
105.Pp
106Similarly
107.Fn X509_REQ_get_version ,
108.Fn X509_REQ_set_version ,
109.Fn X509_CRL_get_version ,
110and
111.Fn X509_CRL_set_version
112get and set the version number of certificate requests and CRLs.
113.Pp
114The version field of certificates, certificate requests, and CRLs
115has a DEFAULT value of v1(0) meaning the field should be omitted
116for version 1.
117This is handled transparently by these functions.
118.Pp
119.Fn X509_get_version ,
120.Fn X509_REQ_get_version
121and
122.Fn X509_CRL_get_version
123are implemented as macros.
124.Sh RETURN VALUES
125.Fn X509_get_version ,
126.Fn X509_REQ_get_version ,
127and
128.Fn X509_CRL_get_version
129return the numerical value of the version field.
130.Pp
131.Fn X509_set_version ,
132.Fn X509_REQ_set_version ,
133and
134.Fn X509_CRL_set_version
135return 1 for success or 0 for failure.
136.Sh SEE ALSO
137.Xr d2i_X509 3 ,
138.Xr ERR_get_error 3 ,
139.Xr X509_CRL_get0_by_serial 3 ,
140.Xr X509_get_pubkey 3 ,
141.Xr X509_get_subject_name 3 ,
142.Xr X509_NAME_add_entry_by_txt 3 ,
143.Xr X509_NAME_ENTRY_get_object 3 ,
144.Xr X509_NAME_get_index_by_NID 3 ,
145.Xr X509_NAME_print_ex 3 ,
146.Xr X509_new 3 ,
147.Xr X509_sign 3 ,
148.Xr X509_verify_cert 3 ,
149.Xr X509V3_get_d2i 3
diff --git a/src/lib/libcrypto/man/X509_sign.3 b/src/lib/libcrypto/man/X509_sign.3
new file mode 100644
index 0000000000..2680f0b095
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_sign.3
@@ -0,0 +1,202 @@
1.\" $OpenBSD: X509_sign.3,v 1.1 2016/12/05 18:24:08 schwarze Exp $
2.\" OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2015, 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: December 5 2016 $
52.Dt X509_SIGN 3
53.Os
54.Sh NAME
55.Nm X509_sign ,
56.Nm X509_sign_ctx ,
57.Nm X509_verify ,
58.Nm X509_REQ_sign ,
59.Nm X509_REQ_sign_ctx ,
60.Nm X509_REQ_verify ,
61.Nm X509_CRL_sign ,
62.Nm X509_CRL_sign_ctx ,
63.Nm X509_CRL_verify
64.Nd sign or verify certificate, certificate request, or CRL signature
65.Sh SYNOPSIS
66.In openssl/x509.h
67.Ft int
68.Fo X509_sign
69.Fa "X509 *x"
70.Fa "EVP_PKEY *pkey"
71.Fa "const EVP_MD *md"
72.Fc
73.Ft int
74.Fo X509_sign_ctx
75.Fa "X509 *x"
76.Fa "EVP_MD_CTX *ctx"
77.Fc
78.Ft int
79.Fo X509_verify
80.Fa "X509 *a"
81.Fa "EVP_PKEY *r"
82.Fc
83.Ft int
84.Fo X509_REQ_sign
85.Fa "X509_REQ *x"
86.Fa "EVP_PKEY *pkey"
87.Fa "const EVP_MD *md"
88.Fc
89.Ft int
90.Fo X509_REQ_sign_ctx
91.Fa "X509_REQ *x"
92.Fa "EVP_MD_CTX *ctx"
93.Fc
94.Ft int
95.Fo X509_REQ_verify
96.Fa "X509_REQ *a"
97.Fa "EVP_PKEY *r"
98.Fc
99.Ft int
100.Fo X509_CRL_sign
101.Fa "X509_CRL *x"
102.Fa "EVP_PKEY *pkey"
103.Fa "const EVP_MD *md"
104.Fc
105.Ft int
106.Fo X509_CRL_sign_ctx
107.Fa "X509_CRL *x"
108.Fa "EVP_MD_CTX *ctx"
109.Fc
110.Ft int
111.Fo X509_CRL_verify
112.Fa "X509_CRL *a"
113.Fa "EVP_PKEY *r"
114.Fc
115.Sh DESCRIPTION
116.Fn X509_sign
117signs the certificate
118.Fa x
119using the private key
120.Fa pkey
121and the message digest
122.Fa md
123and sets the signature in
124.Fa x .
125.Fn X509_sign_ctx
126also signs the certificate
127.Fa x
128but uses the parameters contained in digest context
129.Fa ctx .
130.Pp
131.Fn X509_verify
132verifies the signature of certificate
133.Fa x
134using the public key
135.Fa pkey .
136Only the signature is checked: no other checks (such as certificate
137chain validity) are performed.
138.Pp
139.Fn X509_REQ_sign ,
140.Fn X509_REQ_sign_ctx ,
141.Fn X509_REQ_verify ,
142.Fn X509_CRL_sign ,
143.Fn X509_CRL_sign_ctx ,
144and
145.Fn X509_CRL_verify
146sign and verify certificate requests and CRLs, respectively.
147.Pp
148.Fn X509_sign_ctx
149is used where the default parameters for the corresponding public key
150and digest are not suitable.
151It can be used to sign keys using RSA-PSS for example.
152.Pp
153For efficiency reasons and to work around ASN.1 encoding issues, the
154encoding of the signed portion of a certificate, certificate request,
155and CRL is cached internally.
156If the signed portion of the structure is modified, the encoding is not
157always updated, meaning a stale version is sometimes used.
158This is not normally a problem because modifying the signed portion will
159invalidate the signature and signing will always update the encoding.
160.Sh RETURN VALUES
161.Fn X509_sign ,
162.Fn X509_sign_ctx ,
163.Fn X509_REQ_sign ,
164.Fn X509_REQ_sign_ctx ,
165.Fn X509_CRL_sign ,
166and
167.Fn X509_CRL_sign_ctx
168return the size of the signature in bytes for success or 0 for failure.
169.Pp
170.Fn X509_verify ,
171.Fn X509_REQ_verify ,
172and
173.Fn X509_CRL_verify
174return 1 if the signature is valid or 0 if the signature check fails.
175If the signature could not be checked at all because it was invalid or
176some other error occurred, then -1 is returned.
177.Sh SEE ALSO
178.Xr d2i_X509 3 ,
179.Xr ERR_get_error 3 ,
180.Xr X509_CRL_get0_by_serial 3 ,
181.Xr X509_get_pubkey 3 ,
182.Xr X509_get_subject_name 3 ,
183.Xr X509_get_version 3 ,
184.Xr X509_NAME_add_entry_by_txt 3 ,
185.Xr X509_NAME_ENTRY_get_object 3 ,
186.Xr X509_NAME_get_index_by_NID 3 ,
187.Xr X509_NAME_print_ex 3 ,
188.Xr X509_new 3 ,
189.Xr X509_verify_cert 3 ,
190.Xr X509V3_get_d2i 3
191.Sh HISTORY
192.Fn X509_sign ,
193.Fn X509_REQ_sign ,
194and
195.Fn X509_CRL_sign
196are available in all versions of OpenSSL.
197.Pp
198.Fn X509_sign_ctx ,
199.Fn X509_REQ_sign_ctx ,
200and
201.Fn X509_CRL_sign_ctx
202were first added to OpenSSL 1.0.1.
diff --git a/src/lib/libcrypto/man/X509v3_get_ext_by_NID.3 b/src/lib/libcrypto/man/X509v3_get_ext_by_NID.3
new file mode 100644
index 0000000000..32d828f230
--- /dev/null
+++ b/src/lib/libcrypto/man/X509v3_get_ext_by_NID.3
@@ -0,0 +1,387 @@
1.\" $OpenBSD: X509v3_get_ext_by_NID.3,v 1.1 2016/12/05 18:24:08 schwarze Exp $
2.\" OpenSSL c952780c Jun 21 07:03:34 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2015 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: December 5 2016 $
52.Dt X509V3_GET_EXT_BY_NID 3
53.Os
54.Sh NAME
55.Nm X509v3_get_ext_count ,
56.Nm X509v3_get_ext ,
57.Nm X509v3_get_ext_by_NID ,
58.Nm X509v3_get_ext_by_OBJ ,
59.Nm X509v3_get_ext_by_critical ,
60.Nm X509v3_delete_ext ,
61.Nm X509v3_add_ext ,
62.Nm X509_get_ext_count ,
63.Nm X509_get_ext ,
64.Nm X509_get_ext_by_NID ,
65.Nm X509_get_ext_by_OBJ ,
66.Nm X509_get_ext_by_critical ,
67.Nm X509_delete_ext ,
68.Nm X509_add_ext ,
69.Nm X509_CRL_get_ext_count ,
70.Nm X509_CRL_get_ext ,
71.Nm X509_CRL_get_ext_by_NID ,
72.Nm X509_CRL_get_ext_by_OBJ ,
73.Nm X509_CRL_get_ext_by_critical ,
74.Nm X509_CRL_delete_ext ,
75.Nm X509_CRL_add_ext ,
76.Nm X509_REVOKED_get_ext_count ,
77.Nm X509_REVOKED_get_ext ,
78.Nm X509_REVOKED_get_ext_by_NID ,
79.Nm X509_REVOKED_get_ext_by_OBJ ,
80.Nm X509_REVOKED_get_ext_by_critical ,
81.Nm X509_REVOKED_delete_ext ,
82.Nm X509_REVOKED_add_ext
83.Nd extension stack utility functions
84.Sh SYNOPSIS
85.In openssl/x509.h
86.Ft int
87.Fo X509v3_get_ext_count
88.Fa "const STACK_OF(X509_EXTENSION) *x"
89.Fc
90.Ft X509_EXTENSION *
91.Fo X509v3_get_ext
92.Fa "const STACK_OF(X509_EXTENSION) *x"
93.Fa "int loc"
94.Fc
95.Ft int
96.Fo X509v3_get_ext_by_NID
97.Fa "const STACK_OF(X509_EXTENSION) *x"
98.Fa "int nid"
99.Fa "int lastpos"
100.Fc
101.Ft int
102.Fo X509v3_get_ext_by_OBJ
103.Fa "const STACK_OF(X509_EXTENSION) *x"
104.Fa "ASN1_OBJECT *obj"
105.Fa "int lastpos"
106.Fc
107.Ft int
108.Fo X509v3_get_ext_by_critical
109.Fa "const STACK_OF(X509_EXTENSION) *x"
110.Fa "int crit"
111.Fa "int lastpos"
112.Fc
113.Ft X509_EXTENSION *
114.Fo X509v3_delete_ext
115.Fa "STACK_OF(X509_EXTENSION) *x"
116.Fa "int loc"
117.Fc
118.Ft STACK_OF(X509_EXTENSION) *
119.Fo X509v3_add_ext
120.Fa "STACK_OF(X509_EXTENSION) **x"
121.Fa "X509_EXTENSION *ex"
122.Fa "int loc"
123.Fc
124.Ft int
125.Fo X509_get_ext_count
126.Fa "X509 *x"
127.Fc
128.Ft X509_EXTENSION *
129.Fo X509_get_ext
130.Fa "X509 *x"
131.Fa "int loc"
132.Fc
133.Ft int
134.Fo X509_get_ext_by_NID
135.Fa "X509 *x"
136.Fa "int nid"
137.Fa "int lastpos"
138.Fc
139.Ft int
140.Fo X509_get_ext_by_OBJ
141.Fa "X509 *x"
142.Fa "ASN1_OBJECT *obj"
143.Fa "int lastpos"
144.Fc
145.Ft int
146.Fo X509_get_ext_by_critical
147.Fa "X509 *x"
148.Fa "int crit"
149.Fa "int lastpos"
150.Fc
151.Ft X509_EXTENSION *
152.Fo X509_delete_ext
153.Fa "X509 *x"
154.Fa "int loc"
155.Fc
156.Ft int
157.Fo X509_add_ext
158.Fa "X509 *x"
159.Fa "X509_EXTENSION *ex"
160.Fa "int loc"
161.Fc
162.Ft int
163.Fo X509_CRL_get_ext_count
164.Fa "X509_CRL *x"
165.Fc
166.Ft X509_EXTENSION *
167.Fo X509_CRL_get_ext
168.Fa "X509_CRL *x"
169.Fa "int loc"
170.Fc
171.Ft int
172.Fo X509_CRL_get_ext_by_NID
173.Fa "X509_CRL *x"
174.Fa "int nid"
175.Fa "int lastpos"
176.Fc
177.Ft int
178.Fo X509_CRL_get_ext_by_OBJ
179.Fa "X509_CRL *x"
180.Fa "ASN1_OBJECT *obj"
181.Fa "int lastpos"
182.Fc
183.Ft int
184.Fo X509_CRL_get_ext_by_critical
185.Fa "X509_CRL *x"
186.Fa "int crit"
187.Fa "int lastpos"
188.Fc
189.Ft X509_EXTENSION *
190.Fo X509_CRL_delete_ext
191.Fa "X509_CRL *x"
192.Fa "int loc"
193.Fc
194.Ft int
195.Fo X509_CRL_add_ext
196.Fa "X509_CRL *x"
197.Fa "X509_EXTENSION *ex"
198.Fa "int loc"
199.Fc
200.Ft int
201.Fo X509_REVOKED_get_ext_count
202.Fa "X509_REVOKED *x"
203.Fc
204.Ft X509_EXTENSION *
205.Fo X509_REVOKED_get_ext
206.Fa "X509_REVOKED *x"
207.Fa "int loc"
208.Fc
209.Ft int
210.Fo X509_REVOKED_get_ext_by_NID
211.Fa "X509_REVOKED *x"
212.Fa "int nid"
213.Fa "int lastpos"
214.Fc
215.Ft int
216.Fo X509_REVOKED_get_ext_by_OBJ
217.Fa "X509_REVOKED *x"
218.Fa "ASN1_OBJECT *obj"
219.Fa "int lastpos"
220.Fc
221.Ft int
222.Fo X509_REVOKED_get_ext_by_critical
223.Fa "X509_REVOKED *x"
224.Fa "int crit"
225.Fa "int lastpos"
226.Fc
227.Ft X509_EXTENSION *
228.Fo X509_REVOKED_delete_ext
229.Fa "X509_REVOKED *x"
230.Fa "int loc"
231.Fc
232.Ft int
233.Fo X509_REVOKED_add_ext
234.Fa "X509_REVOKED *x"
235.Fa "X509_EXTENSION *ex"
236.Fa "int loc"
237.Fc
238.Sh DESCRIPTION
239.Fn X509v3_get_ext_count
240retrieves the number of extensions in
241.Fa x .
242.Pp
243.Fn X509v3_get_ext
244retrieves extension
245.Fa loc
246from
247.Fa x .
248The index
249.Fa loc
250can take any value from 0 to
251.Fn X509_get_ext_count x No - 1 .
252The returned extension is an internal pointer which must not be
253freed up by the application.
254.Pp
255.Fn X509v3_get_ext_by_NID
256and
257.Fn X509v3_get_ext_by_OBJ
258look for an extension with
259.Fa nid
260or
261.Fa obj
262from extension stack
263.Fa x .
264The search starts from the extension after
265.Fa lastpos
266or from the beginning if
267.Fa lastpos
268is -1.
269If the extension is found, its index is returned; otherwise, -1 is
270returned.
271.Pp
272.Fn X509v3_get_ext_by_critical
273is similar to
274.Fn X509v3_get_ext_by_NID
275except that it looks for an extension of criticality
276.Fa crit .
277A zero value for
278.Fa crit
279looks for a non-critical extension; a non-zero value looks for a
280critical extension.
281.Pp
282.Fn X509v3_delete_ext
283deletes the extension with index
284.Fa loc
285from
286.Fa x .
287The deleted extension is returned and must be freed by the caller.
288If
289.Fa loc
290is in invalid index value,
291.Dv NULL
292is returned.
293.Pp
294.Xr X509v3_add_ext 3
295adds the extension
296.Fa ex
297to the stack
298.Pf * Fa x
299at position
300.Fa loc .
301If
302.Fa loc
303is -1, the new extension is added to the end.
304If
305.Pf * Fa x
306is
307.Dv NULL ,
308a new stack will be allocated.
309The passed extension
310.Fa ex
311is duplicated internally so it must be freed after use.
312.Pp
313.Fn X509_get_ext_count ,
314.Fn X509_get_ext ,
315.Fn X509_get_ext_by_NID ,
316.Fn X509_get_ext_by_OBJ ,
317.Fn X509_get_ext_by_critical ,
318.Fn X509_delete_ext ,
319and
320.Fn X509_add_ext
321operate on the extensions of certificate
322.Fa x .
323They are otherwise identical to the X509v3 functions.
324.Pp
325.Fn X509_CRL_get_ext_count ,
326.Fn X509_CRL_get_ext ,
327.Fn X509_CRL_get_ext_by_NID ,
328.Fn X509_CRL_get_ext_by_OBJ ,
329.Fn X509_CRL_get_ext_by_critical ,
330.Fn X509_CRL_delete_ext ,
331and
332.Fn X509_CRL_add_ext
333operate on the extensions of the CRL
334.Fa x .
335They are otherwise identical to the X509v3 functions.
336.Pp
337.Fn X509_REVOKED_get_ext_count ,
338.Fn X509_REVOKED_get_ext ,
339.Fn X509_REVOKED_get_ext_by_NID ,
340.Fn X509_REVOKED_get_ext_by_OBJ ,
341.Fn X509_REVOKED_get_ext_by_critical ,
342.Fn X509_REVOKED_delete_ext ,
343and
344.Fn X509_REVOKED_add_ext
345operate on the extensions of the CRL entry
346.Fa x .
347They are otherwise identical to the X509v3 functions.
348.Pp
349These functions are used to examine stacks of extensions directly.
350Many applications will want to parse or encode and add an extension:
351they should use the extension encode and decode functions instead
352such as
353.Xr X509_get_ext_d2i 3 .
354.Pp
355Extension indices start from zero, so a zero index return value is
356not an error.
357These search functions start from the extension
358.Em after
359the
360.Fa lastpos
361parameter, so it should initially be set to -1.
362If it is set to 0, the initial extension will not be checked.
363.Sh RETURN VALUES
364.Fn X509v3_get_ext_count
365returns the extension count.
366.Pp
367.Fn X509v3_get_ext
368and
369.Fn X509v3_delete_ext
370return an
371.Vt X509_EXTENSION
372pointer or
373.Dv NULL
374if an error occurs.
375.Pp
376.Fn X509v3_get_ext_by_NID ,
377.Fn X509v3_get_ext_by_OBJ ,
378and
379.Fn X509v3_get_ext_by_critical
380return the an extension index or -1 if an error occurs.
381.Pp
382.Xr X509v3_add_ext 3
383returns a stack of extensions or
384.Dv NULL
385on error.
386.Sh SEE ALSO
387.Xr X509V3_get_d2i 3
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-11-01 06:03:28 +0000