summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2016-11-15Check that SCT timestamps are not in the futureRob Percival
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-11-14Allow CA.pl script user to pass extra arguments to openssl commandmarko asplund
Useful e.g. to fully script CA commands Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1797)
2016-11-12Update s_client and s_server documentation about some missing argumentsEasySec
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1837)
2016-11-12Replace the 'SSL' broken link with SSL_CTX_set_security_level which seems ↵EasySec
not being referenced from elsewhere Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1898)
2016-11-12EVP docs: chacha20, chacha20-poly1305enkore
CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1909)
2016-11-11Fix referenses in section 7 manualsRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1900)
2016-11-11Fix referenses in section 1 manualsRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1900)
2016-11-11Fix referenses in section 3 manualsRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1900)
2016-11-10Rename the Elliptic Curves extension to supported_groupsMatt Caswell
This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Add some documentation for the new HKDF modesMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Update HKDF to support separte Extract and Expand stepsMatt Caswell
At the moment you can only do an HKDF Extract and Expand in one go. For TLS1.3 we need to be able to do an Extract first, and the subsequently do a number of Expand steps on the same PRK. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Allow null in X509_CRL_METHOD_freeFdaSilvaYY
and fix documentation. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1634)
2016-11-07Improve PRF documentationAndrea Grandi
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1834
2016-11-07Make RSA_sign.pod less confusing.David Benjamin
PKCS #1 v2.0 is the name of a document which specifies an algorithm RSASSA-PKCS1-v1_5, often referred to as "PKCS #1 v1.5" after an earlier document which specified it. This gets further confusing because the document PKCS #1 v2.1 specifies two signature algorithms, RSASSA-PKCS1-v1_5 and RSASSA-PSS. RSA_sign implements RSASSA-PKCS1-v1_5. Refer to the document using the RFC number which is easier to find anyway, and refer to the algorithm by its name. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1474
2016-11-07Partial revert of "Fix client verify mode to check SSL_VERIFY_PEER"Matt Caswell
This partially reverts commit c636c1c47. It also tweaks the documentation and comments in this area. On the client side the documented interface for SSL_CTX_set_verify()/SSL_set_verify() is that setting the flag SSL_VERIFY_PEER causes verfication of the server certificate to take place. Previously what was implemented was that if *any* flag was set then verification would take place. The above commit improved the semantics to be as per the documented interface. However, we have had a report of at least one application where an application was incorrectly using the interface and used *only* SSL_VERIFY_FAIL_IF_NO_PEER_CERT on the client side. In OpenSSL prior to the above commit this still caused verification of the server certificate to take place. After this commit the application silently failed to verify the server certificate. Ideally SSL_CTX_set_verify()/SSL_set_verify() could be modified to indicate if invalid flags were being used. However these are void functions! The simplest short term solution is to revert to the previous behaviour which at least means we "fail closed" rather than "fail open". Thanks to Cory Benfield for reporting this issue. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-11-04Tweak the SSL_read()/SSL_write() text based on feedback received.Matt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Clarify the return values for SSL_read_ex()/SSL_write_ex()Matt Caswell
Give more detail on what constitutes success/failure. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Document the HMAC_size() functionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Clarify the return values for the peek functionsMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Updates various man pages based on review feedback received.Matt Caswell
Improvements to style, grammar etc. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Document the newly added SSL functionsMatt Caswell
Also document SSL_peek() which was missing from the docs. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-03Update CRYPTO_set_mem_debug() docRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1842)
2016-11-02Add documentation for DTLS_get_data_mtu()David Woodhouse
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-11-02Add the SSL_METHOD for TLSv1.3 and all other base changes requiredMatt Caswell
Includes addition of the various options to s_server/s_client. Also adds one of the new TLS1.3 ciphersuites. This isn't "real" TLS1.3!! It's identical to TLS1.2 apart from the protocol and the ciphersuite...and the ciphersuite is just a renamed TLS1.2 one (not a "real" TLS1.3 ciphersuite). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-01Add SSL_CTX_set1_cert_store()Todd Short
For convenience, combine getting a new ref for the new SSL_CTX with assigning the store and freeing the old one. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1755)
2016-10-29Try to unify BIO read/write parameter namesBenjamin Kaduk
After the recent reworking, not everything matched up, and some comments didn't catch up to the outl-->dlen and inl-->dlen renames that happened during the development of the recent patches. Try to make parameter names consistent across header, implementation, and manual pages. Also remove some trailing whitespace that was inadvertently introduced. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1798)
2016-10-28Document the new BIO functions introduced as part of the size_t workMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-10-26Move manpages to man[1357] structure.Rich Salz
Move manpages to manX directories Add Windows/VMS install fix from Richard Levitte Update README Fix typo's Remove some duplicates Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-10-21Fix grammar error in SSL_CTX_set_min_proto_versionClaus Assmann
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1762)
2016-10-19Fix broken link to ASYNC_get_wait_ctx and rewrap the paragraphAndrea Grandi
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1745)
2016-10-19Add missing .pod extension to EVP_PKEY_CTX_set_tls1_prf_mdAndrea Grandi
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-10-17Add SSL_OP_NO_ENCRYPT_THEN_MACDavid Woodhouse
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-10-17Add Postgres support to -starttlsValentin Vidic
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-10-17fix invalid use of incomplete type X509_STORE_CTXchoury
CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-10-15Fix signatures of EVP_Digest{Sign,Verify}UpdateSteven Fackler
These are implemented as macros delegating to `EVP_DigestUpdate`, which takes a `size_t` as its third argument, not an `unsigned int`. CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-10-11doc/crypto/OPENSSL_ia32cap.pod: update assembler requirements.Andy Polyakov
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-29Add -item option to asn1parseDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29Add ASN1_ITEM lookup and enumerate functions.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-22Add OCSP_RESPID_match()Matt Caswell
Add a function for testing whether a given OCSP_RESPID matches with a certificate. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-22Add the ability to set OCSP_RESPID fieldsMatt Caswell
OCSP_RESPID was made opaque in 1.1.0, but no accessors were provided for setting the name/key value for the OCSP_RESPID. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-21Dcoument -alpn flagRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-21Revert "Constify code about X509_VERIFY_PARAM"Rich Salz
This reverts commit 81f9ce1e1965e0e33db6d2391285c4c1b6af0434. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-09-20Documentation fixup; no more ECDHParametersRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-18Constify code about X509_VERIFY_PARAMFdaSilvaYY
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1594)
2016-09-14Make reference to other manpage more explicitRich Salz
Where -curves, etc., are defined: SSL_CONF_cmd Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-09-14Document the new SHA256 and SHA512 password generation optionsRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-14Add -h and -help for c_rehash script and appRich Salz
Resolves GH1515 and GH1509. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-09-06Misc BN fixesRich Salz
Never output -0; make "negative zero" an impossibility. Do better checking on BN_rand top/bottom requirements and #bits. Update doc. Ignoring trailing garbage in BN_asc2bn. Port this commit from boringSSL: https://boringssl.googlesource.com/boringssl/+/899b9b19a4cd3fe526aaf5047ab9234cdca19f7d%5E!/ Ensure |BN_div| never gives negative zero in the no_branch code. Have |bn_correct_top| fix |bn->neg| if the input is zero so that we don't have negative zeros lying around. Thanks to Brian Smith for noticing. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-24Un-delete still documented X509_STORE_CTX_set_verifyViktor Dukhovni
It should not have been removed. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24Typo fixesRob Percival
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-15 08:05:38 +0000