diff options
author | Matt Caswell <matt@openssl.org> | 2015-06-25 12:28:28 +0100 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2015-07-07 21:57:12 +0100 |
commit | 7f3f41d816bb80e362a5978420f59030b3132c81 (patch) | |
tree | ec3a2e9bf351d8772c257ab495e6491f4000d9ce /doc | |
parent | a64ba70dbb7e4886d7bae0b85a2a1070e22dd8fb (diff) |
Extend -show_chain option to verify to show more info
The -show_chain flag to the verify command line app shows information about
the chain that has been built. This commit adds the text "untrusted" against
those certificates that have been used from the untrusted list.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'doc')
-rw-r--r-- | doc/apps/verify.pod | 9 | ||||
-rw-r--r-- | doc/crypto/X509_STORE_CTX_new.pod | 9 |
2 files changed, 17 insertions, 1 deletions
diff --git a/doc/apps/verify.pod b/doc/apps/verify.pod index 242b9ee9fa..9cc7fcb817 100644 --- a/doc/apps/verify.pod +++ b/doc/apps/verify.pod @@ -42,6 +42,7 @@ B<openssl> B<verify> [B<-verify_ip ip>] [B<-verify_name name>] [B<-x509_strict>] +[B<-show_chain>] [B<->] [certificates] @@ -227,6 +228,12 @@ Supported usages include: default, pkcs7, smime_sign, ssl_client, ssl_server. For strict X.509 compliance, disable non-compliant workarounds for broken certificates. +=item B<-show_chain> + +Display information about the certificate chain that has been built (if +successful). Certificates in the chain that came from the untrusted list will be +flagged as "untrusted". + =item B<-> Indicates the last option. All arguments following this are assumed to be @@ -491,6 +498,6 @@ L<x509(1)|x509(1)> =head1 HISTORY -The -no_alt_chains options was first added to OpenSSL 1.1.0. +The -show_chain option was first added to OpenSSL 1.1.0. =cut diff --git a/doc/crypto/X509_STORE_CTX_new.pod b/doc/crypto/X509_STORE_CTX_new.pod index 7c154572ec..f8907d7ebb 100644 --- a/doc/crypto/X509_STORE_CTX_new.pod +++ b/doc/crypto/X509_STORE_CTX_new.pod @@ -25,6 +25,8 @@ X509_STORE_CTX_new, X509_STORE_CTX_cleanup, X509_STORE_CTX_free, X509_STORE_CTX_ void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param); int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name); + int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx); + =head1 DESCRIPTION These functions initialise an B<X509_STORE_CTX> structure for subsequent use @@ -76,6 +78,9 @@ X509_STORE_CTX_set_default() looks up and sets the default verification method to B<name>. This uses the function X509_VERIFY_PARAM_lookup() to find an appropriate set of parameters from B<name>. +X509_STORE_CTX_get_num_untrusted() returns the number of untrusted certificates +that were used in building the chain following a call to X509_verify_cert(). + =head1 NOTES The certificates and CRLs in a store are used internally and should B<not> @@ -116,6 +121,9 @@ values. X509_STORE_CTX_set_default() returns 1 for success or 0 if an error occurred. +X509_STORE_CTX_get_num_untrusted() returns the number of untrusted certificates +used. + =head1 SEE ALSO L<X509_verify_cert(3)|X509_verify_cert(3)> @@ -124,5 +132,6 @@ L<X509_VERIFY_PARAM_set_flags(3)|X509_VERIFY_PARAM_set_flags(3)> =head1 HISTORY X509_STORE_CTX_set0_crls() was first added to OpenSSL 1.0.0 +X509_STORE_CTX_get_num_untrusted() was first added to OpenSSL 1.1.0 =cut |