diff options
author | Viktor Dukhovni <ietf-dane@dukhovni.org> | 2014-07-07 20:34:06 +1000 |
---|---|---|
committer | Viktor Dukhovni <ietf-dane@dukhovni.org> | 2014-07-07 20:34:06 +1000 |
commit | b73ac027357da29d9e393f24cd224999c94028d1 (patch) | |
tree | 7ed7a98d246b6d6b072e7d403ec31877e622aba0 | |
parent | 297c67fcd817ea643de2fdeff4e434b050d571e2 (diff) |
Improve X509_check_host() documentation.
Based on feedback from Jeffrey Walton.
-rw-r--r-- | doc/crypto/X509_check_host.pod | 67 |
1 files changed, 39 insertions, 28 deletions
diff --git a/doc/crypto/X509_check_host.pod b/doc/crypto/X509_check_host.pod index 56ea38de2f..f8b530df9b 100644 --- a/doc/crypto/X509_check_host.pod +++ b/doc/crypto/X509_check_host.pod @@ -18,38 +18,41 @@ X509_check_host, X509_check_email, X509_check_ip, X509_check_ip_asc - X.509 cert =head1 DESCRIPTION -The certificate matching functions are intended to be called to check -if a certificate matches a given host name, email address, or IP -address. The validity of the certificate and its trust level has to -be checked by other means. - -X509_check_host() checks if the certificate matches the specified -host name, which must be encoded in the preferred name syntax -described in section 3.5 of RFC 1034. Per section 6.4.2 of RFC 6125, -B<name> values representing international domain names must be given -in A-label form. The B<namelen> argument must be the number of -characters in the name string or zero in which case the length is -calculated with strlen(name). When B<name> starts with a dot (e.g -".example.com"), it will be matched by a certificate valid for any -sub-domain of B<name>, (see also B<X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS> -below). When the certificate is matched and B<peername> is not -NULL a pointer to a copy of the matching hostname or CommonName -from the peer certificate is stored at the address passed in -B<peername>. The application is responsible for freeing the peername -via OPENSSL_free() when it is no longer needed. Applications are -advised to use X509_VERIFY_PARAM_set1_host() in preference to -explicitly calling L<X509_check_host(3)>, hostname checks are out -of scope with the DANE-EE(3) certificate usage, and the internal -check will be suppressed as appropriate when DANE support is added -to OpenSSL. +The certificate matching functions are used to check whether a +certificate matches a given host name, email address, or IP address. +The validity of the certificate and its trust level has to be checked by +other means. + +X509_check_host() checks if the certificate Subject Alternative +Name (SAN) or Subject CommonName (CN) matches the specified host +name, which must be encoded in the preferred name syntax described +in section 3.5 of RFC 1034. By default, wildcards are supported +and they match only in the left-most label; but they may match +part of that label with an explicit prefix or suffix. For example, +by default, the host B<name> "www.example.com" would match a +certificate with a SAN or CN value of "*.example.com", "w*.example.com" +or "*w.example.com". + +Per section 6.4.2 of RFC 6125, B<name> values representing international +domain names must be given in A-label form. The B<namelen> argument +must be the number of characters in the name string or zero in which +case the length is calculated with strlen(B<name>). When B<name> starts +with a dot (e.g ".example.com"), it will be matched by a certificate +valid for any sub-domain of B<name>, (see also +B<X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS> below). + +When the certificate is matched, and B<peername> is not NULL, a +pointer to a copy of the matching SAN or CN from the peer certificate +is stored at the address passed in B<peername>. The application +is responsible for freeing the peername via OPENSSL_free() when it +is no longer needed. X509_check_email() checks if the certificate matches the specified -email address. Only the mailbox syntax of RFC 822 is supported, +email B<address>. Only the mailbox syntax of RFC 822 is supported, comments are not allowed, and no attempt is made to normalize quoted characters. The B<addresslen> argument must be the number of -characters in the address string. The B<namelen> argument must be -the number of characters in the name string or zero in which case the -length is calculated with strlen(name). +characters in the address string or zero in which case the length +is calculated with strlen(B<address>). X509_check_ip() checks if the certificate matches a specified IPv4 or IPv6 address. The B<address> array is in binary format, in network @@ -110,6 +113,14 @@ and -1 for an internal error: typically a memory allocation failure. X509_check_ip_asc() can also return -2 if the IP address string is malformed. +=head1 NOTES + +Applications are encouraged to use X509_VERIFY_PARAM_set1_host() +rather than explicitly calling L<X509_check_host(3)>. Host name +checks are out of scope with the DANE-EE(3) certificate usage, +and the internal checks will be suppressed as appropriate when +DANE support is added to OpenSSL. + =head1 SEE ALSO L<SSL_get_verify_result(3)|SSL_get_verify_result(3)>, |