diff options
| author | Matt Caswell <matt@openssl.org> | 2024-01-03 11:03:03 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2024-01-04 16:44:22 +0000 |
| commit | 132e9e750274e6de29e32a18344edc3513ee14d5 (patch) | |
| tree | 4b8f080c095b7cb7bd83d01b7d36fc39f84e209e | |
| parent | 740786771a05d13eb54f18578e80b205b1c38541 (diff) | |
Clarify the PKCS12 docs
Issue #23151 asks a question about the meaning of the PKCS12
documentation. This PR attempts to clarify how friendlyName and localKeyID
are added to the PKCS12 structure.
Fixes #23151
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23188)
(cherry picked from commit 3348713ad390372ba5a0a0f98b46b2f637475e47)
| -rw-r--r-- | doc/man3/PKCS12_create.pod | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/doc/man3/PKCS12_create.pod b/doc/man3/PKCS12_create.pod index 92e588062a..9d5403113a 100644 --- a/doc/man3/PKCS12_create.pod +++ b/doc/man3/PKCS12_create.pod @@ -57,9 +57,15 @@ export grade software which could use signing only keys of arbitrary size but had restrictions on the permissible sizes of keys which could be used for encryption. -If a certificate contains an I<alias> or I<keyid> then this will be -used for the corresponding B<friendlyName> or B<localKeyID> in the -PKCS12 structure. +If I<name> is B<NULL> and I<cert> contains an I<alias> then this will be +used for the corresponding B<friendlyName> in the PKCS12 structure instead. +Similarly, if I<pkey> is NULL and I<cert> contains a I<keyid> then this will be +used for the corresponding B<localKeyID> in the PKCS12 structure instead of the +id calculated from the I<pkey>. + +For all certificates in I<ca> then if a certificate contains an I<alias> or +I<keyid> then this will be used for the corresponding B<friendlyName> or +B<localKeyID> in the PKCS12 structure. Either I<pkey>, I<cert> or both can be B<NULL> to indicate that no key or certificate is required. In previous versions both had to be present or |