diff options
author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2021-02-16 11:17:07 +0100 |
---|---|---|
committer | Dr. David von Oheimb <dev@ddvo.net> | 2021-06-26 15:38:40 +0200 |
commit | 4acda8635ed55ddf831d1bb3dc6086054f01cc61 (patch) | |
tree | f366f096ef49946d775a738463cc7d89f12858e0 /doc/man1 | |
parent | 426005eea5afd64bb76006f0fda69502ab3e008d (diff) |
DOC: Clarify the role of EKUs including defaults for TLS client and server use
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14199)
Diffstat (limited to 'doc/man1')
-rw-r--r-- | doc/man1/openssl-verification-options.pod | 27 | ||||
-rw-r--r-- | doc/man1/openssl-x509.pod.in | 10 |
2 files changed, 24 insertions, 13 deletions
diff --git a/doc/man1/openssl-verification-options.pod b/doc/man1/openssl-verification-options.pod index 1c91c77852..c634ccae15 100644 --- a/doc/man1/openssl-verification-options.pod +++ b/doc/man1/openssl-verification-options.pod @@ -151,10 +151,13 @@ The first step is to check that each certificate is well-formed. Part of these checks are enabled only if the B<-x509_strict> option is given. The second step is to check the extensions of every untrusted certificate -for consistency with the given purpose. -If the B<-purpose> option is not included then no such checks are done. -The target certificate must not have an EKU extension that is incompatible with -the given purpose, and all other certificates must be valid CA certificates. +for consistency with the supplied purpose. +If the B<-purpose> option is not given then no such checks are done +except for SSL/TLS connection setup, +where by default C<sslserver> or C<sslclient>, are checked. +The target or "leaf" certificate, as well as any other untrusted certificates, +must have extensions compatible with the specified purpose. +All certificates except the target or "leaf" must also be valid CA certificates. The precise extensions required are described in more detail in L<openssl-x509(1)/CERTIFICATE EXTENSIONS>. @@ -452,11 +455,17 @@ Set policy variable inhibit-policy-mapping (see RFC5280). =item B<-purpose> I<purpose> -The intended use for the certificate. If this option is not specified, this -command will not consider certificate purpose during chain verification. -Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>, -B<smimesign>, B<smimeencrypt>, B<crlsign>, B<ocsphelper>, B<timestampsign>, -and <any>. +The intended use for the certificate. +Currently defined purposes are C<sslclient>, C<sslserver>, C<nssslserver>, +C<smimesign>, C<smimeencrypt>, C<crlsign>, C<ocsphelper>, C<timestampsign>, +and C<any>. +If peer certificate verification is enabled, by default the TLS implementation +as well as the commands B<s_client> and B<s_server> check for consistency +with TLS server or TLS client use, respectively. + +While IETF RFC 5280 says that B<id-kp-serverAuth> and B<id-kp-clientAuth> +are only for WWW use, in practice they are used for all kinds of TLS clients +and servers, and this is what OpenSSL assumes as well. =item B<-verify_depth> I<num> diff --git a/doc/man1/openssl-x509.pod.in b/doc/man1/openssl-x509.pod.in index 0e073d6b05..9c77a216c2 100644 --- a/doc/man1/openssl-x509.pod.in +++ b/doc/man1/openssl-x509.pod.in @@ -551,10 +551,12 @@ Clears all the permitted or trusted uses of the certificate. =item B<-addtrust> I<arg> -Adds an allowed trust anchor purpose. -Any object name can be used here but currently only those -listed in L<openssl-verification-options(1)/Trust Anchors> are supported. -Other OpenSSL applications may define additional purposes. +Adds a trusted certificate use. +Any object name can be used here but currently only B<clientAuth>, +B<serverAuth>, B<emailProtection>, and B<anyExtendedKeyUsage> are defined. +As of OpenSSL 1.1.0, the last of these blocks all purposes when rejected or +enables all purposes when trusted. +Other OpenSSL applications may define additional uses. =item B<-clrreject> |