summaryrefslogtreecommitdiffstats
path: root/doc/apps
AgeCommit message (Collapse)Author
2016-10-26Move manpages to man[1357] structure.Rich Salz
Move manpages to manX directories Add Windows/VMS install fix from Richard Levitte Update README Fix typo's Remove some duplicates Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-10-17Add Postgres support to -starttlsValentin Vidic
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-09-29Add -item option to asn1parseDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-21Dcoument -alpn flagRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-14Make reference to other manpage more explicitRich Salz
Where -curves, etc., are defined: SSL_CONF_cmd Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-09-14Document the new SHA256 and SHA512 password generation optionsRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-14Add -h and -help for c_rehash script and appRich Salz
Resolves GH1515 and GH1509. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-22crypto/pkcs12: facilitate accessing data with non-interoperable password.Andy Polyakov
Originally PKCS#12 subroutines treated password strings as ASCII. It worked as long as they were pure ASCII, but if there were some none-ASCII characters result was non-interoperable. But fixing it poses problem accessing data protected with broken password. In order to make asscess to old data possible add retry with old-style password. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-19Add -dane_ee_no_namechecks s_client(1) optionViktor Dukhovni
The DANE API supports a DANE_FLAG_NO_DANE_EE_NAMECHECKS option, but there was no way to exercise/enable it via s_client. This commit addresses that gap. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-19RT3940: For now, just document the issue.Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-13add documentationDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-11Fix doc and help about ca -valid optionFdaSilvaYY
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-05spelling fixes, just comments and readme.klemens
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1413)
2016-07-28Various doc fixes.Rich Salz
Cannot nest B<> tags Document "openssl speed" command. Fix doc nits: missing NAME/SYNOPSIS stuff Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-07-19RT4593: Add space after comma (doc nits)Rich Salz
Update find-doc-nits to find errors in SYNOPSIS (the most common place where they were missing). Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-24Add -ciphers flag to enc commandRich Salz
Don't print the full list of ciphers as part of the -help output. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-22Spelling... and more spellingFdaSilvaYY
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1245)
2016-06-20Allow proxy certs to be present when verifying a chainRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-06-16Spelling fixesFdaSilvaYY
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1219)
2016-06-13RT3809: basicConstraints is criticalRich Salz
This is really a security bugfix, not enhancement any more. Everyone knows critical extensions. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-06-08Fix some typos in pod filesFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1189)
2016-06-06More doc nitsRich Salz
Update script to look for period or POD markup in NAME section, and fix them. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-03Fix documentation error in x509 app certopt flagMatt Caswell
According to the x509 man page in the section discussing -certopt it says that the ca_default option is the same as that used by the ca utility and (amongst other things) has the effect of suppressing printing of the signature - but in fact it doesn't. This error seems to have been present since the documentation was written back in 2001. It never had this effect. The default config file sets the certopt value to ca_default. The ca utility takes that and THEN adds additional options to suppress printing of the signature. So the ca utility DOES suppress printing of the signature - but it is not as a result of using the ca_default option. GitHub Issue #247 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-01Fix various doc nits.Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01Add dhparam sanity check and update DH_check documentationMatt Caswell
The -check argument to dhparam should never identify any problems if we have just generated the parameters. Add a sanity check for this and print an error and fail if necessary. Also updates the documentation for the -check argument, and the DH_check() function. RT#4244 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-31RT4539: Add section for renamed ciphers.Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-23Support for traditional format private keys.Dr. Stephen Henson
Add new function PEM_write_bio_PrivateKey_traditional() to enforce the use of legacy "traditional" private key format. Add -traditional option to pkcs8 and pkey utilities. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-20Doc nits cleanup, round 2Rich Salz
Fix some code examples, trailing whitespace Fix TBA sections in verify, remove others. Remove empty sections Use Mixed Case not ALL CAPS in head2 Enhance doc-nits script. Remove extra =cut line Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-20Fix nits in pod files.Rich Salz
Add doc-nit-check to help find future issues. Make podchecker be almost clean. Remove trailing whitespace. Tab expansion Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-19Use correct EOL in headers.Dr. Stephen Henson
RT#1817 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-19Add copyright to manpagesRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-19Ensure =cut is last line in every file.Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-18Document the esc_2254 command line name optionRichard Levitte
RT#1466 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-13Correct documentation on digest used.Dr. Stephen Henson
RT#4302 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-05-12Correctly check for trailing digest options.Dr. Stephen Henson
Multiple digest options to the ocsp utility are allowed: e.g. to use different digests for different certificate IDs. A digest option without a following certificate is however illegal. RT#4215 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-11Update pkcs8 defaults.Dr. Stephen Henson
Update pkcs8 utility to use 256 bit AES using SHA256 by default. Update documentation. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-05-10Add -srp option to ciphers command.Dr. Stephen Henson
RT#4224 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-10Typo.Dr. Stephen Henson
RT#4538 Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-02GH875: Document -no_check_timeRich Salz
Date: Tue Mar 15 15:19:44 2016 +0100 This commit updates the documentation of cms, ocsp, s_client, s_server, and verify to reflect the new "-no_check_time" option introduced in commit d35ff2c0ade0a12e84aaa2e9841b4983a2f3cf45 on 2015-07-31. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-01Fix spelling in pod filesFdaSilvaYY
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-07Suppress CT callback as appropriateViktor Dukhovni
Suppress CT callbacks with aNULL or PSK ciphersuites that involve no certificates. Ditto when the certificate chain is validated via DANE-TA(2) or DANE-EE(3) TLSA records. Also skip SCT processing when the chain is fails verification. Move and consolidate CT callbacks from libcrypto to libssl. We also simplify the interface to SSL_{,CTX_}_enable_ct() which can specify either a permissive mode that just collects information or a strict mode that requires at least one valid SCT or else asks to abort the connection. Simplified SCT processing and options in s_client(1) which now has just a simple pair of "-noct" vs. "-ct" options, the latter enables the permissive callback so that we can complete the handshake and report all relevant information. When printing SCTs, print the validation status if set and not valid. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-04-03Move peer chain security checks into x509_vfy.cViktor Dukhovni
A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-03-19Fixed languageAlex Gaynor
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-19Fixed a bunch of typos in the docsAlex Gaynor
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-15General verify options to openssl tsfbroda
This commit adds the general verify options of ocsp, verify, cms, etc. to the openssl timestamping app as suggested by Stephen N. Henson in [openssl.org #4287]. The conflicting "-policy" option of "openssl ts" has been renamed to "-tspolicy". Documentation and tests have been updated. CAVE: This will break code, which currently uses the "-policy" option. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-11Add blake2 support.Bill Cox
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Update ciphers -s documentationKurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-03-07Add documentation for new s_server/s_client optionsMatt Caswell
Document the new split_send_frag, max_pipelines and read_buf options. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-03-07Fix pkeyutl to KDF lnks.Rich Salz
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-07Update documentationDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-03 14:02:30 +0000