diff options
33 files changed, 378 insertions, 51 deletions
diff --git a/doc/apps/asn1parse.pod b/doc/apps/asn1parse.pod index 5acea8cfc5..b44fb9fd3d 100644 --- a/doc/apps/asn1parse.pod +++ b/doc/apps/asn1parse.pod @@ -15,6 +15,8 @@ B<openssl> B<asn1parse> [B<-length number>] [B<-i>] [B<-oid filename>] +[B<-dump>] +[B<-dlimit num>] [B<-strparse offset>] [B<-genstr string>] [B<-genconf file>] @@ -65,6 +67,14 @@ indents the output according to the "depth" of the structures. a file containing additional OBJECT IDENTIFIERs (OIDs). The format of this file is described in the NOTES section below. +=item B<-dump> + +dump unknown data in hex format. + +=item B<-dlimit num> + +like B<-dump>, but only the first B<num> bytes are output. + =item B<-strparse offset> parse the contents octets of the ASN.1 object starting at B<offset>. This diff --git a/doc/apps/ca.pod b/doc/apps/ca.pod index 8f7229a285..42d7f83ab7 100644 --- a/doc/apps/ca.pod +++ b/doc/apps/ca.pod @@ -13,6 +13,8 @@ B<openssl> B<ca> [B<-name section>] [B<-gencrl>] [B<-revoke file>] +[B<-status serial>] +[B<-updatedb>] [B<-crl_reason reason>] [B<-crl_hold instruction>] [B<-crl_compromise time>] @@ -26,6 +28,7 @@ B<openssl> B<ca> [B<-md arg>] [B<-policy arg>] [B<-keyfile arg>] +[B<-keyform PEM|DER>] [B<-key arg>] [B<-passin arg>] [B<-cert file>] @@ -83,7 +86,7 @@ a single self signed certificate to be signed by the CA. a file containing a single Netscape signed public key and challenge and additional field values to be signed by the CA. See the B<SPKAC FORMAT> -section for information on the required format. +section for information on the required input and output format. =item B<-infiles> @@ -94,7 +97,7 @@ are assumed to the the names of files containing certificate requests. the output file to output certificates to. The default is standard output. The certificate details will also be printed out to this -file. +file in PEM format (except that B<-spkac> outputs DER format). =item B<-outdir directory> @@ -110,6 +113,11 @@ the CA certificate file. the private key to sign requests with. +=item B<-keyform PEM|DER> + +the format of the data in the private key file. +The default is PEM. + =item B<-key password> the password used to encrypt the private key. Since on some @@ -267,6 +275,15 @@ the number of hours before the next CRL is due. a filename containing a certificate to revoke. +=item B<-status serial> + +displays the revocation status of the certificate with the specified +serial number and exits. + +=item B<-updatedb> + +Updates the database index to purge expired certificates. + =item B<-crl_reason reason> revocation reason, where B<reason> is one of: B<unspecified>, B<keyCompromise>, @@ -499,6 +516,10 @@ the SPKAC and also the required DN components as name value pairs. If you need to include the same component twice then it can be preceded by a number and a '.'. +When processing SPKAC format, the output is DER if the B<-out> +flag is used, but PEM format if sending to stdout or the B<-outdir> +flag is used. + =head1 EXAMPLES Note: these examples assume that the B<ca> directory structure is diff --git a/doc/apps/crl.pod b/doc/apps/crl.pod index 1ad76a5f8c..044a9da915 100644 --- a/doc/apps/crl.pod +++ b/doc/apps/crl.pod @@ -12,6 +12,7 @@ B<openssl> B<crl> [B<-text>] [B<-in filename>] [B<-out filename>] +[B<-nameopt option>] [B<-noout>] [B<-hash>] [B<-issuer>] @@ -53,6 +54,11 @@ default. print out the CRL in text form. +=item B<-nameopt option> + +option which determines how the subject or issuer names are displayed. See +the description of B<-nameopt> in L<x509(1)|x509(1)>. + =item B<-noout> don't output the encoded version of the CRL. diff --git a/doc/apps/dhparam.pod b/doc/apps/dhparam.pod index 9edb4ff4e1..6e27cf5c15 100644 --- a/doc/apps/dhparam.pod +++ b/doc/apps/dhparam.pod @@ -12,6 +12,7 @@ B<openssl dhparam> [B<-in> I<filename>] [B<-out> I<filename>] [B<-dsaparam>] +[B<-check>] [B<-noout>] [B<-text>] [B<-C>] @@ -64,6 +65,10 @@ exchange more efficient. Beware that with such DSA-style DH parameters, a fresh DH key should be created for each use to avoid small-subgroup attacks that may be possible otherwise. +=item B<-check> + +check if the parameters are valid primes and generator. + =item B<-2>, B<-5> The generator to use, either 2 or 5. 2 is the default. If present then the diff --git a/doc/apps/dsa.pod b/doc/apps/dsa.pod index ddbc9327fa..8bf6cc9dca 100644 --- a/doc/apps/dsa.pod +++ b/doc/apps/dsa.pod @@ -13,6 +13,12 @@ B<openssl> B<dsa> [B<-passin arg>] [B<-out filename>] [B<-passout arg>] +[B<-aes128>] +[B<-aes192>] +[B<-aes256>] +[B<-camellia128>] +[B<-camellia192>] +[B<-camellia256>] [B<-des>] [B<-des3>] [B<-idea>] @@ -74,10 +80,10 @@ filename. the output file password source. For more information about the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>. -=item B<-des|-des3|-idea> +=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea> -These options encrypt the private key with the DES, triple DES, or the -IDEA ciphers respectively before outputting it. A pass phrase is prompted for. +These options encrypt the private key with the specified +cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the B<dsa> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by diff --git a/doc/apps/ecparam.pod b/doc/apps/ecparam.pod index 788c074d7b..88e9d1e83d 100644 --- a/doc/apps/ecparam.pod +++ b/doc/apps/ecparam.pod @@ -16,7 +16,7 @@ B<openssl ecparam> [B<-C>] [B<-check>] [B<-name arg>] -[B<-list_curve>] +[B<-list_curves>] [B<-conv_form arg>] [B<-param_enc arg>] [B<-no_seed>] diff --git a/doc/apps/gendsa.pod b/doc/apps/gendsa.pod index 8c7f114ca0..d9f56be890 100644 --- a/doc/apps/gendsa.pod +++ b/doc/apps/gendsa.pod @@ -8,6 +8,12 @@ gendsa - generate a DSA private key from a set of parameters B<openssl> B<gendsa> [B<-out filename>] +[B<-aes128>] +[B<-aes192>] +[B<-aes256>] +[B<-camellia128>] +[B<-camellia192>] +[B<-camellia256>] [B<-des>] [B<-des3>] [B<-idea>] @@ -24,10 +30,10 @@ The B<gendsa> command generates a DSA private key from a DSA parameter file =over 4 -=item B<-des|-des3|-idea> +=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea> -These options encrypt the private key with the DES, triple DES, or the -IDEA ciphers respectively before outputting it. A pass phrase is prompted for. +These options encrypt the private key with specified +cipher before outputting it. A pass phrase is prompted for. If none of these options is specified no encryption is used. =item B<-rand file(s)> diff --git a/doc/apps/genrsa.pod b/doc/apps/genrsa.pod index 7dcac2a779..cb03d09b95 100644 --- a/doc/apps/genrsa.pod +++ b/doc/apps/genrsa.pod @@ -9,6 +9,18 @@ genrsa - generate an RSA private key B<openssl> B<genrsa> [B<-out filename>] [B<-passout arg>] +[B<-aes128>] +[B<-aes128>] +[B<-aes192>] +[B<-aes256>] +[B<-camellia128>] +[B<-camellia192>] +[B<-camellia256>] +[B<-aes192>] +[B<-aes256>] +[B<-camellia128>] +[B<-camellia192>] +[B<-camellia256>] [B<-des>] [B<-des3>] [B<-idea>] @@ -36,10 +48,10 @@ used. the output file password source. For more information about the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>. -=item B<-des|-des3|-idea> +=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea> -These options encrypt the private key with the DES, triple DES, or the -IDEA ciphers respectively before outputting it. If none of these options is +These options encrypt the private key with specified +cipher before outputting it. If none of these options is specified no encryption is used. If encryption is used a pass phrase is prompted for if it is not supplied via the B<-passout> argument. diff --git a/doc/apps/rsa.pod b/doc/apps/rsa.pod index d7d784d52b..21cbf8ee00 100644 --- a/doc/apps/rsa.pod +++ b/doc/apps/rsa.pod @@ -15,6 +15,12 @@ B<openssl> B<rsa> [B<-out filename>] [B<-passout arg>] [B<-sgckey>] +[B<-aes128>] +[B<-aes192>] +[B<-aes256>] +[B<-camellia128>] +[B<-camellia192>] +[B<-camellia256>] [B<-des>] [B<-des3>] [B<-idea>] @@ -82,10 +88,10 @@ see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>. use the modified NET algorithm used with some versions of Microsoft IIS and SGC keys. -=item B<-des|-des3|-idea> +=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea> -These options encrypt the private key with the DES, triple DES, or the -IDEA ciphers respectively before outputting it. A pass phrase is prompted for. +These options encrypt the private key with the specified +cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the B<rsa> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by diff --git a/doc/apps/s_client.pod b/doc/apps/s_client.pod index 27764486d8..e5fe26b190 100644 --- a/doc/apps/s_client.pod +++ b/doc/apps/s_client.pod @@ -9,6 +9,7 @@ s_client - SSL/TLS client program B<openssl> B<s_client> [B<-connect host:port>] +[B<-servername name>] [B<-verify depth>] [B<-verify_return_error>] [B<-cert filename>] @@ -55,6 +56,7 @@ B<openssl> B<s_client> [B<-nbio>] [B<-crlf>] [B<-ign_eof>] +[B<-no_ign_eof>] [B<-quiet>] [B<-ssl2>] [B<-ssl3>] @@ -64,6 +66,7 @@ B<openssl> B<s_client> [B<-no_tls1>] [B<-bugs>] [B<-cipher cipherlist>] +[B<-serverpref>] [B<-starttls protocol>] [B<-xmpphost hostname>] [B<-engine id>] @@ -96,6 +99,10 @@ manual page. This specifies the host and optional port to connect to. If not specified then an attempt is made to connect to the local host on port 4433. +=item B<-servername name> + +Set the TLS SNI (Server Name Indication) extension in the ClientHello message. + =item B<-cert certname> The certificate to use, if one is requested by the server. The default is @@ -223,6 +230,11 @@ input. inhibit printing of session and certificate information. This implicitly turns on B<-ign_eof> as well. +=item B<-no_ign_eof> + +shut down the connection when end of file is reached in the input. +Can be used to override the implicit B<-ign_eof> after B<-quiet>. + =item B<-psk_identity identity> Use the PSK identity B<identity> when using a PSK cipher suite. @@ -261,6 +273,10 @@ the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See the B<ciphers> command for more information. +=item B<-serverpref> + +use the server's cipher preferences; only used for SSLV2. + =item B<-starttls protocol> send the protocol-specific message(s) to switch to TLS for communication. diff --git a/doc/apps/s_server.pod b/doc/apps/s_server.pod index 1006b43f2e..9d4633cf7c 100644 --- a/doc/apps/s_server.pod +++ b/doc/apps/s_server.pod @@ -60,6 +60,7 @@ B<openssl> B<s_server> [B<-x509_strict>] [B<-nocert>] [B<-cipher cipherlist>] +[B<-serverpref>] [B<-quiet>] [B<-no_tmp_rsa>] [B<-ssl2>] @@ -293,6 +294,10 @@ also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist irrelevant. See the B<ciphers> command for more information. +=item B<-serverpref> + +use the server's cipher preferences, rather than the client's preferences. + =item B<-tlsextdebug> print out a hex dump of any TLS extensions received from the server. diff --git a/doc/apps/verify.pod b/doc/apps/verify.pod index 1e9680286b..a5a00638be 100644 --- a/doc/apps/verify.pod +++ b/doc/apps/verify.pod @@ -11,6 +11,7 @@ B<openssl> B<verify> [B<-CApath directory>] [B<-attime timestamp>] [B<-check_ss_sig>] +[B<-crlfile file>] [B<-crl_check>] [B<-crl_check_all>] [B<-explicit_policy>] @@ -74,6 +75,10 @@ current system time. B<timestamp> is the number of seconds since Verify the signature on the self-signed root CA. This is disabled by default because it doesn't add any security. +=item B<-crlfile file> + +File containing one or more CRL's (in PEM format) to load. + =item B<-crl_check> Checks end entity certificate validity by attempting to look up a valid CRL. diff --git a/doc/apps/x509.pod b/doc/apps/x509.pod index 19fae07e48..a1326edeef 100644 --- a/doc/apps/x509.pod +++ b/doc/apps/x509.pod @@ -19,6 +19,7 @@ B<openssl> B<x509> [B<-hash>] [B<-subject_hash>] [B<-issuer_hash>] +[B<-ocspid>] [B<-subject>] [B<-issuer>] [B<-nameopt option>] @@ -28,6 +29,7 @@ B<openssl> B<x509> [B<-enddate>] [B<-purpose>] [B<-dates>] +[B<-checkend num>] [B<-modulus>] [B<-pubkey>] [B<-fingerprint>] @@ -42,6 +44,7 @@ B<openssl> B<x509> [B<-days arg>] [B<-set_serial n>] [B<-signkey filename>] +[B<-passin arg>] [B<-x509toreq>] [B<-req>] [B<-CA filename>] @@ -50,6 +53,7 @@ B<openssl> B<x509> [B<-CAserial filename>] [B<-force_pubkey key>] [B<-text>] +[B<-certopt option>] [B<-C>] [B<-md2|-md5|-sha1|-mdc2>] [B<-clrext>] @@ -160,6 +164,10 @@ name. outputs the "hash" of the certificate issuer name. +=item B<-ocspid> + +outputs the OCSP hash values for the subject name and public key. + =item B<-hash> synonym for "-subject_hash" for backward compatibility reasons. @@ -209,6 +217,11 @@ prints out the expiry date of the certificate, that is the notAfter date. prints out the start and expiry dates of a certificate. +=item B<-checkend arg> + +checks if the certificate expires within the next B<arg> seconds and exits +non-zero if yes it will expire or zero if not. + =item B<-fingerprint> prints out the digest of the DER encoded version of the whole certificate @@ -314,6 +327,11 @@ If the input is a certificate request then a self signed certificate is created using the supplied private key using the subject name in the request. +=item B<-passin arg> + +the key password source. For more information about the format of B<arg> +see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>. + =item B<-clrext> delete any extensions from a certificate. This option is used when a @@ -478,7 +496,7 @@ using the format \UXXXX for 16 bits and \WXXXXXXXX for 32 bits. Also if this option is off any UTF8Strings will be converted to their character form first. -=item B<no_type> +=item B<ignore_type> this option does not attempt to interpret multibyte characters in any way. That is their content octets are merely dumped as though one octet diff --git a/doc/apps/x509v3_config.pod b/doc/apps/x509v3_config.pod index fe9b750166..c82cea1da2 100644 --- a/doc/apps/x509v3_config.pod +++ b/doc/apps/x509v3_config.pod @@ -174,7 +174,7 @@ The IP address used in the B<IP> options can be in either IPv4 or IPv6 format. The value of B<dirName> should point to a section containing the distinguished name to use as a set of name value pairs. Multi values AVAs can be formed by -preceding the name with a B<+> character. +prefacing the name with a B<+> character. otherName can include arbitrary data associated with an OID: the value should be the OID followed by a semicolon and the content in standard diff --git a/doc/crypto/ASN1_generate_nconf.pod b/doc/crypto/ASN1_generate_nconf.pod index f21f189a38..bfa0a04ff9 100644 --- a/doc/crypto/ASN1_generate_nconf.pod +++ b/doc/crypto/ASN1_generate_nconf.pod @@ -61,7 +61,7 @@ Encode the B<NULL> type, the B<value> string must not be present. =item B<INTEGER>, B<INT> Encodes an ASN1 B<INTEGER> type. The B<value> string represents -the value of the integer, it can be preceded by a minus sign and +the value of the integer, it can be prefaced by a minus sign and is normally interpreted as a decimal value unless the prefix B<0x> is included. diff --git a/doc/crypto/BIO_f_base64.pod b/doc/crypto/BIO_f_base64.pod index 438af3b6b6..d1d7bf0bd0 100644 --- a/doc/crypto/BIO_f_base64.pod +++ b/doc/crypto/BIO_f_base64.pod @@ -46,11 +46,11 @@ to standard output: b64 = BIO_new(BIO_f_base64()); bio = BIO_new_fp(stdout, BIO_NOCLOSE); - bio = BIO_push(b64, bio); - BIO_write(bio, message, strlen(message)); - BIO_flush(bio); + BIO_push(b64, bio); + BIO_write(b64, message, strlen(message)); + BIO_flush(b64); - BIO_free_all(bio); + BIO_free_all(b64); Read Base64 encoded data from standard input and write the decoded data to standard output: @@ -62,11 +62,12 @@ data to standard output: b64 = BIO_new(BIO_f_base64()); bio = BIO_new_fp(stdin, BIO_NOCLOSE); bio_out = BIO_new_fp(stdout, BIO_NOCLOSE); - bio = BIO_push(b64, bio); - while((inlen = BIO_read(bio, inbuf, 512)) > 0) + BIO_push(b64, bio); + while((inlen = BIO_read(b64, inbuf, 512)) > 0) BIO_write(bio_out, inbuf, inlen); - BIO_free_all(bio); + BIO_flush(bio_out); + BIO_free_all(b64); =head1 BUGS diff --git a/doc/crypto/RSA_sign.pod b/doc/crypto/RSA_sign.pod index 8553be8e99..fc16b1f4f8 100644 --- a/doc/crypto/RSA_sign.pod +++ b/doc/crypto/RSA_sign.pod @@ -20,6 +20,10 @@ RSA_sign() signs the message digest B<m> of size B<m_len> using the private key B<rsa> as specified in PKCS #1 v2.0. It stores the signature in B<sigret> and the signature size in B<siglen>. B<sigret> must point to RSA_size(B<rsa>) bytes of memory. +Note that PKCS #1 adds meta-data, placing limits on the size of the +key that can be used. +See L<RSA_private_encrypt(3)|RSA_private_encrypt(3)> for lower-level +operations. B<type> denotes the message digest algorithm that was used to generate B<m>. It usually is one of B<NID_sha1>, B<NID_ripemd160> and B<NID_md5>; diff --git a/doc/crypto/err.pod b/doc/crypto/err.pod index 6f729554d2..4a5dc6935c 100644 --- a/doc/crypto/err.pod +++ b/doc/crypto/err.pod @@ -171,7 +171,6 @@ ERR_get_string_table(void) respectively. =head1 SEE ALSO -L<CRYPTO_set_id_callback(3)|CRYPTO_set_id_callback(3)>, L<CRYPTO_set_locking_callback(3)|CRYPTO_set_locking_callback(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>, diff --git a/doc/ssl/SSL_CIPHER_get_name.pod b/doc/ssl/SSL_CIPHER_get_name.pod index 908fbd172f..2048bfb8a1 100644 --- a/doc/ssl/SSL_CIPHER_get_name.pod +++ b/doc/ssl/SSL_CIPHER_get_name.pod @@ -23,8 +23,12 @@ SSL_CIPHER_get_bits() returns the number of secret bits used for B<cipher>. If B<alg_bits> is not NULL, it contains the number of bits processed by the chosen algorithm. If B<cipher> is NULL, 0 is returned. -SSL_CIPHER_get_version() returns the protocol version for B<cipher>, currently -"SSLv2", "SSLv3", or "TLSv1". If B<cipher> is NULL, "(NONE)" is returned. +SSL_CIPHER_get_version() returns string which indicates the SSL/TLS protocol +version that first defined the cipher. +This is currently B<SSLv2> or B<TLSv1/SSLv3>. +In some cases it should possibly return "TLSv1.2" but does not; +use SSL_CIPHER_description() instead. +If B<cipher> is NULL, "(NONE)" is returned. SSL_CIPHER_description() returns a textual description of the cipher used into the buffer B<buf> of length B<len> provided. B<len> must be at least @@ -52,7 +56,8 @@ Textual representation of the cipher name. =item <protocol version> -Protocol version: B<SSLv2>, B<SSLv3>. The TLSv1 ciphers are flagged with SSLv3. +Protocol version: B<SSLv2>, B<SSLv3>, B<TLSv1.2>. The TLSv1.0 ciphers are +flagged with SSLv3. No new ciphers were added by TLSv1.1. =item Kx=<key exchange> @@ -91,6 +96,10 @@ Some examples for the output of SSL_CIPHER_description(): RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export +A comp[lete list can be retrieved by invoking the following command: + + openssl ciphers -v ALL + =head1 BUGS If SSL_CIPHER_description() is called with B<cipher> being NULL, the diff --git a/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod b/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod index 4fc8f06d9e..2049a53362 100644 --- a/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod +++ b/doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod @@ -14,12 +14,12 @@ SSL_CONF_CTX_set_ssl_ctx, SSL_CONF_CTX_set_ssl - set context to configure =head1 DESCRIPTION SSL_CONF_CTX_set_ssl_ctx() sets the context associated with B<cctx> to the -B<SSL_CTX> structure B<ctx>. Any previos B<SSL> or B<SSL_CTX> associated with +B<SSL_CTX> structure B<ctx>. Any previous B<SSL> or B<SSL_CTX> associated with B<cctx> is cleared. Subsequent calls to SSL_CONF_cmd() will be sent to B<ctx>. SSL_CONF_CTX_set_ssl() sets the context associated with B<cctx> to the -B<SSL> structure B<ssl>. Any previos B<SSL> or B<SSL_CTX> associated with +B<SSL> structure B<ssl>. Any previous B<SSL> or B<SSL_CTX> associated with B<cctx> is cleared. Subsequent calls to SSL_CONF_cmd() will be sent to B<ssl>. diff --git a/doc/ssl/SSL_CONF_cmd.pod b/doc/ssl/SSL_CONF_cmd.pod index 2a4019c871..f96d8d941d 100644 --- a/doc/ssl/SSL_CONF_cmd.pod +++ b/doc/ssl/SSL_CONF_cmd.pod @@ -91,8 +91,8 @@ associated with B<cctx>. =item B<-cert> Attempts to use the file B<value> as the certificate for the appropriate -context. It currently uses SSL_CTX_use_cerificate_chain_file if an B<SSL_CTX> -structure is set or SSL_use_certifcate_file with filetype PEM if an B<SSL> +context. It currently uses SSL_CTX_use_certificate_chain_file() if an B<SSL_CTX> +structure is set or SSL_use_certificate_file() with filetype PEM if an B<SSL> structure is set. This option is only supported if certificate operations are permitted. @@ -183,8 +183,8 @@ associated with B<cctx>. =item B<Certificate> Attempts to use the file B<value> as the certificate for the appropriate -context. It currently uses SSL_CTX_use_cerificate_chain_file if an B<SSL_CTX> -structure is set or SSL_use_certifcate_file with filetype PEM if an B<SSL> +context. It currently uses SSL_CTX_use_certificate_chain_file() if an B<SSL_CTX> +structure is set or SSL_use_certificate_file() with filetype PEM if an B<SSL> structure is set. This option is only supported if certificate operations are permitted. diff --git a/doc/ssl/SSL_CONF_cmd_argv.pod b/doc/ssl/SSL_CONF_cmd_argv.pod index 246eaa5bd3..6e66441cd1 100644 --- a/doc/ssl/SSL_CONF_cmd_argv.pod +++ b/doc/ssl/SSL_CONF_cmd_argv.pod @@ -14,7 +14,7 @@ SSL_CONF_cmd_argv - SSL configuration command line processing. The function SSL_CONF_cmd_argv() processes at most two command line arguments from B<pargv> and B<pargc>. The values of B<pargv> and B<pargc> -are updated to reflect the number of command options procesed. The B<pargc> +are updated to reflect the number of command options processed. The B<pargc> argument can be set to B<NULL> is it is not used. =head1 RETURN VALUES diff --git a/doc/ssl/SSL_CTX_add_session.pod b/doc/ssl/SSL_CTX_add_session.pod index 8e0abd36cd..c660a18fc2 100644 --- a/doc/ssl/SSL_CTX_add_session.pod +++ b/doc/ssl/SSL_CTX_add_session.pod @@ -41,7 +41,7 @@ If a server SSL_CTX is configured with the SSL_SESS_CACHE_NO_INTERNAL_STORE flag then the internal cache will not be populated automatically by new sessions negotiated by the SSL/TLS implementation, even though the internal cache will be searched automatically for session-resume requests (the -latter can be surpressed by SSL_SESS_CACHE_NO_INTERNAL_LOOKUP). So the +latter can be suppressed by SSL_SESS_CACHE_NO_INTERNAL_LOOKUP). So the application can use SSL_CTX_add_session() directly to have full control over the sessions that can be resumed if desired. diff --git a/doc/ssl/SSL_CTX_set_cert_cb.pod b/doc/ssl/SSL_CTX_set_cert_cb.pod index 98bd2f1e58..141d828f5b 100644 --- a/doc/ssl/SSL_CTX_set_cert_cb.pod +++ b/doc/ssl/SSL_CTX_set_cert_cb.pod @@ -26,7 +26,7 @@ the passed B<ssl> structure and set or clear any appropriate certificates. If the callback is successful it B<MUST> return 1 even if no certificates have been set. A zero is returned on error which will abort the handshake with a fatal internal error alert. A negative return value will suspend the handshake -and the handshake function will return immediatly. +and the handshake function will return immediately. L<SSL_get_error(3)|SSL_get_error(3)> will return SSL_ERROR_WANT_X509_LOOKUP to indicate, that the handshake was suspended. The next call to the handshake function will again lead to the call of cert_cb(). It is the job of the diff --git a/doc/ssl/SSL_CTX_set_client_CA_list.pod b/doc/ssl/SSL_CTX_set_client_CA_list.pod index 5e97392668..4965385e97 100644 --- a/doc/ssl/SSL_CTX_set_client_CA_list.pod +++ b/doc/ssl/SSL_CTX_set_client_CA_list.pod @@ -35,7 +35,7 @@ the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object. =head1 NOTES Whe |