summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2015-03-18Add support for ServerInfo SSL_CONF option.Dr. Stephen Henson
Add support for ServerInfo SSL_CONF option and update documentation. This was wrongly omitted from the 1.0.2 release. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-12additional configuration documentationDr. Stephen Henson
Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit 3d764db7a24e3dca1a3ee57202ce3c818d592141)
2015-03-08Additional CMS documentation.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit e3013932df2d899e8600c305342bc14b682dc0d1)
2015-03-07Remove export ciphers from the DEFAULT cipher listKurt Roeckx
They are moved to the COMPLEMENTOFDEFAULT instead. This also fixes SSLv2 to be part of COMPLEMENTOFDEFAULT. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-02-25Update the SHA* documentationMatt Caswell
Updates to include SHA224, SHA256, SHA384 and SHA512. In particular note the restriction on setting md to NULL with regards to thread safety. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit f7812493a0da6b740274135ce340ff7505027057)
2015-02-25Fix NAME section of d2i_ECPKParameters to prevent broken symlinks when usingRainer Jung
the extract-names.pl script. RT#3718 Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-02-25Fix some minor documentation issuesMatt Caswell
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-02-25Add dire warnings about the "reuse" capability of the d2i_* functions.Matt Caswell
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-02-25Provide documentation for i2d_ECPrivateKey and d2i_ECPrivateKeyMatt Caswell
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-02-24Document -no_explicitDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 384dee51242e950c56b3bac32145957bfbf3cd4b)
2015-02-22typoDr. Stephen Henson
Reviewed-by: Kurt Roeckx <kurt@openssl.org> (cherry picked from commit 15b5d6585de098e48acebc8366a9956ee57c8f2d)
2015-02-10Fix hostname validation in the command-line tool to honour negative return ↵Emilia Kasper
values. Specifically, an ASN.1 NumericString in the certificate CN will fail UTF-8 conversion and result in a negative return value, which the "x509 -checkhost" command-line option incorrectly interpreted as success. Also update X509_check_host docs to reflect reality. Thanks to Sean Burford (Google) for reporting this issue. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 0923e7df9eafec6db9c75405d7085ec8581f01bd)
2015-02-03Preliminary ASN1_TIME documentation.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit a724e79ed761ea535a6c7457c90da5ff4b1cea69)
2015-01-27Provide documentation for all SSL(_CTX)?_(get|set)(_default)?_read_aheadMatt Caswell
functions. Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit 8507474564f3f743f5daa3468ca97a9b707b3583)
2015-01-25Make OPENSSL_config truly ignore errors.Rich Salz
Per discussion: should not exit. Should not print to stderr. Errors are ignored. Updated doc to reflect that, and the fact that this function is to be avoided. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit abdd677125f3a9e3082f8c5692203590fdb9b860)
2015-01-06Only allow ephemeral RSA keys in export ciphersuites.Dr. Stephen Henson
OpenSSL clients would tolerate temporary RSA keys in non-export ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which enabled this server side. Remove both options as they are a protocol violation. Thanks to Karthikeyan Bhargavan for reporting this issue. (CVE-2015-0204) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-02Remove MS SGCDr. Stephen Henson
MS Server gated cryptography is obsolete and dates from the time of export restrictions on strong encryption and is only used by ancient versions of MSIE. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 63eab8a620944a990ab3985620966ccd9f48d681)
2014-12-30Document openssl dgst -hmac optionThorsten Glaser
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
2014-12-22Improves certificates HOWTOAlok Menghrajani
* adds links to various related documents. * fixes a few typos. * rewords a few sentences. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 67472bd82bed9d5e481b0d75926aab93618902be)
2014-12-22Small typoRichard Levitte
Reviewed-by: Stephen Henson <steve@openssl.org> (cherry picked from commit 7cfab40f43afac2f46652886e260d1c4de058806)
2014-12-05Clarify the return values for SSL_get_shared_curve.Emilia Kasper
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 376e2ca3e3525290619602dc6013c97c9653c037)
2014-11-28Correct some layout issues, convert all remaining tabs to appropriate ↵Richard Levitte
amounts of spaces. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 8123d158ab6f0a6a468748c133e33c2063ff36b5)
2014-11-28Improves the proxy certificates howto doc.Alok Menghrajani
The current documentation contains a bunch of spelling and grammar mistakes. I also found it hard to understand some paragraphs, so here is my attempt to improve its readability. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 03b637a730e4a298c360cc143de7564060c06324)
2014-11-27Add documentation on -timeout option in the ocsp utilityAndré Guerreiro
PR#3612 Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit de87dd46c1283f899a9ecf4ccc72db74f36afbf2)
2014-11-27Updates to X509_NAME_get_index_by_NID.pod submitted by user Bernardh via the ↵Matt Caswell
wiki Minor changes made by Matt Caswell Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 648495864513da788246f9b75dbbbce0614ed5e8)
2014-11-27Updates to X509_NAME_add_entry_by_txt.pod submitted by user Bernardh via the ↵Matt Caswell
wiki Minor changes made by Matt Caswell. Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit f281b8df704ce0123fa2193f2890a25da1756528)
2014-11-27Updates to EVP_PKEY_encrypt.pod submitted by user Bernardh via the wikiMatt Caswell
Minor changes made by Matt Caswell. Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 34890ac18eb5ee7bffe9d460480164e1546b491e)
2014-11-12Fixes a minor typo in the EVP docs.Alok Menghrajani
Out is the buffer which needs to contain at least inl + cipher_block_size - 1 bytes. Outl is just an int*. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 5211e094dec9486a540ac480f345df1a8d2b2862)
2014-11-10Allow ECDHE and DHE as forward-compatible aliases for EECDH and EDHDaniel Kahn Gillmor
see RT #3203 Future versions of OpenSSL use the canonical terms "ECDHE" and "DHE" as configuration strings and compilation constants. This patch introduces aliases so that the stable 1.0.2 branch can be forward-compatible with code and configuration scripts that use the normalized terms, while avoiding changing any library output for stable users. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-10-21Fix and improve SSL_MODE_SEND_FALLBACK_SCSV documentation.Bodo Moeller
Reviewed-by: Rich Salz <rsalz@openssl.org>
2014-10-15Add TLS_FALLBACK_SCSV documentation, and move s_client -fallback_scsvBodo Moeller
handling out of #ifndef OPENSSL_NO_DTLS1 section. Reviewed-by: Rich Salz <rsalz@openssl.org>
2014-10-03RT3462: Document actions when data==NULLRich Salz
If data is NULL, return the size needed to hold the derived key. No other API to do this, so document the behavior. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 5aed169305941fb1eba15fd4bacc0f998b0e43f7)
2014-09-30RT2309: Fix podpage MMNNFFPPS->MNNFFPPSRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 9208640a36228b10fcdf75c8853d9410aaff19a3)
2014-09-25Use correct function name: CMS_add1_signer()Dr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 5886354dcca4f8445ed35b6995a035b75409590c)
2014-09-23Add i2d_re_X509_tbsEmilia Kasper
i2d_re_X509_tbs re-encodes the TBS portion of the certificate. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr Stephen Henson <steve@openssl.org> (cherry picked from commit 95b1752cc7531e4b609aea166f2db1c155ab5bdd)
2014-09-08RT2272: Add old-style hash to c_rehashMatthias Andree
In addition to Matthias's change, I also added -n to not remove links. And updated the manpage. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit a787c2590e468585a1a19738e0c7f481ec91b762)
2014-09-08RT468: SSL_CTX_sess_set_cache_size wrongRich Salz
The documentation is wrong about what happens when the session cache fills up. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit e9edfc419674f20b482a9beff9c246519f9c503e)
2014-09-08RT2518: fix pod2man errorsScott Schaefer
pod2man now complains when item tags are not sequential. Also complains about missing =back and other tags. Silence the warnings; most were already done. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit fe7573042fa7f406fedb78d959659b39a7a1dcfb)
2014-09-08RT1834: Fix PKCS7_verify return valueRich Salz
The function returns 0 or 1, only. Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit b0e659cfaca9ff4a481cc63b7f6b6e97303ad8fe)
2014-08-31RT3511: doc fix; req default serial is randomAdam Williamson
RT842, closed back in 2004, changed the default serial number to be a random number rather than zero. Finally time to update the doc Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 3aba132d61baeecffb9a6f8da7d0809352cbfb2d)
2014-08-31RT1325,2973: Add more extensions to c_rehashTANABE Hiroyasu
Add .crt/.cer/.crl to the filenames parsed. I also updated the podpage (since it didn't exist when this ticket was first created, nor when it was re-created seven years later). Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 80ec8d4e3ee212786dc3092b1c97305b871827f0)
2014-08-30RT2119,3407: Updated to dgst.podRich Salz
Re-order algorithm list. Be consistent in command synopsis. Add content about signing. Add EXAMPLE section Add some missing options: -r, -fips-fingerprint -non-fips-allow Various other fixes. Reviewed-by: Andy Polyakov <appro@openssl.org>
2014-08-30RT1941: c_rehash.pod is missingJames Westby
Add the file written by James Westby, graciously contributed under the terms of the OpenSSL license. Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit cf2239b3b397174a8a6b1cc84ff68aba34ed5941)
2014-08-29RT2379: Bug in BIO_set_accept_port.podRich Salz
The doc says that port can be "*" to mean any port. That's wrong. Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 07e3b31fae98b985d3d2aad7066144b11833f688)
2014-08-28Custom extension documentation.Dr. Stephen Henson
Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit f3f56c2a87951e115a7f82d06826e72c9e13987f)
2014-08-27RT3065: automatically generate a missing EC public keyMatt Caswell
When d2i_ECPrivateKey reads a private key with a missing (optional) public key, generate one automatically from the group and private key. Reviewed-by: Dr Stephen Henson <steve@openssl.org> (cherry picked from commit ed383f847156940e93f256fed78599873a4a9b28)
2014-08-27RT2210: Add missing EVP_cleanup to exampleMihai Militaru
I also removed some trailing whitespace and cleaned up the "see also" list. Reviewed-by: Emilia Kasper <emilia@openssl.org> (cherry picked from commit 7b3e11c54466f1da8b707c932e308d345fd61101)
2014-08-26RT1744: SSL_CTX_set_dump_dh() doc feedbackDavid Gatwood
The description of when the server creates a DH key is confusing. This cleans it up. (rsalz: also removed trailing whitespace.) Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2014-08-25RT1804: fix EXAMPLE in EVP_EncryptInit.podJan Schaumann
The EXAMPLE that used FILE and RC2 doesn't compile due to a few minor errors. Tweak to use IDEA and AES-128. Remove examples about RC2 and RC5. Reviewed-by: Emilia Kasper <emilia@openssl.org>
2014-08-24Typo fixes to evp documentation.Matt Caswell
This patch was submitted by user "Kox" via the wiki Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 2dd8cb3b9593f528d9537aa6a003d5c93df1e3c5)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-16 22:17:02 +0000