Add documentation for the -no_alt_chains option for various apps, as well as
the X509_V_FLAG_NO_ALT_CHAINS flag. Conflicts: doc/apps/cms.pod doc/apps/ocsp.pod doc/apps/s_client.pod doc/apps/s_server.pod doc/apps/smime.pod doc/apps/verify.pod Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Matt Caswell
parent
017a06c7d1
commit
be856c0391
@ -35,6 +35,7 @@ B<openssl> B<cms>
|
||||
[B<-print>]
|
||||
[B<-CAfile file>]
|
||||
[B<-CApath dir>]
|
||||
[B<-no_alt_chains>]
|
||||
[B<-md digest>]
|
||||
[B<-[cipher]>]
|
||||
[B<-nointern>]
|
||||
@ -419,7 +420,7 @@ portion of a message so they may be included manually. If signing
|
||||
then many S/MIME mail clients check the signers certificate's email
|
||||
address matches that specified in the From: address.
|
||||
|
||||
=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig>
|
||||
=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig -no_alt_chains>
|
||||
|
||||
Set various certificate chain valiadition option. See the
|
||||
L<B<verify>|verify(1)> manual page for details.
|
||||
@ -655,4 +656,6 @@ Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.1.0.
|
||||
The use of non-RSA keys with B<-encrypt> and B<-decrypt> was first added
|
||||
to OpenSSL 1.1.0.
|
||||
|
||||
The -no_alt_chains options was first added to OpenSSL 1.0.2b.
|
||||
|
||||
=cut
|
||||
|
||||
@ -29,6 +29,7 @@ B<openssl> B<ocsp>
|
||||
[B<-path>]
|
||||
[B<-CApath dir>]
|
||||
[B<-CAfile file>]
|
||||
[B<-no_alt_chains>]]
|
||||
[B<-VAfile file>]
|
||||
[B<-validity_period n>]
|
||||
[B<-status_age n>]
|
||||
@ -143,6 +144,10 @@ connection timeout to the OCSP responder in seconds
|
||||
file or pathname containing trusted CA certificates. These are used to verify
|
||||
the signature on the OCSP response.
|
||||
|
||||
=item B<-no_alt_chains>
|
||||
|
||||
See L<B<verify>|verify(1)> manual page for details.
|
||||
|
||||
=item B<-verify_other file>
|
||||
|
||||
file containing additional certificates to search when attempting to locate
|
||||
@ -379,3 +384,9 @@ second file.
|
||||
|
||||
openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
|
||||
-reqin req.der -respout resp.der
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
The -no_alt_chains options was first added to OpenSSL 1.0.2b.
|
||||
|
||||
=cut
|
||||
|
||||
@ -19,6 +19,7 @@ B<openssl> B<s_client>
|
||||
[B<-pass arg>]
|
||||
[B<-CApath directory>]
|
||||
[B<-CAfile filename>]
|
||||
[B<-no_alt_chains>]
|
||||
[B<-reconnect>]
|
||||
[B<-pause>]
|
||||
[B<-showcerts>]
|
||||
@ -120,7 +121,7 @@ also used when building the client certificate chain.
|
||||
A file containing trusted certificates to use during server authentication
|
||||
and to use when attempting to build the client certificate chain.
|
||||
|
||||
=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig>
|
||||
=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig -no_alt_chains>
|
||||
|
||||
Set various certificate chain valiadition option. See the
|
||||
L<B<verify>|verify(1)> manual page for details.
|
||||
@ -361,4 +362,8 @@ information whenever a session is renegotiated.
|
||||
|
||||
L<sess_id(1)|sess_id(1)>, L<s_server(1)|s_server(1)>, L<ciphers(1)|ciphers(1)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
The -no_alt_chains options was first added to OpenSSL 1.0.2b.
|
||||
|
||||
=cut
|
||||
|
||||
@ -33,6 +33,7 @@ B<openssl> B<s_server>
|
||||
[B<-state>]
|
||||
[B<-CApath directory>]
|
||||
[B<-CAfile filename>]
|
||||
[B<-no_alt_chains>]
|
||||
[B<-nocert>]
|
||||
[B<-cipher cipherlist>]
|
||||
[B<-serverpref>]
|
||||
@ -174,6 +175,10 @@ and to use when attempting to build the server certificate chain. The list
|
||||
is also used in the list of acceptable client CAs passed to the client when
|
||||
a certificate is requested.
|
||||
|
||||
=item B<-no_alt_chains>
|
||||
|
||||
See the L<B<verify>|verify(1)> manual page for details.
|
||||
|
||||
=item B<-state>
|
||||
|
||||
prints out the SSL session states.
|
||||
@ -406,4 +411,8 @@ unknown cipher suites a client says it supports.
|
||||
|
||||
L<sess_id(1)|sess_id(1)>, L<s_client(1)|s_client(1)>, L<ciphers(1)|ciphers(1)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
The -no_alt_chains options was first added to OpenSSL 1.0.2b.
|
||||
|
||||
=cut
|
||||
|
||||
@ -15,6 +15,7 @@ B<openssl> B<smime>
|
||||
[B<-pk7out>]
|
||||
[B<-[cipher]>]
|
||||
[B<-in file>]
|
||||
[B<-no_alt_chains>]
|
||||
[B<-certfile file>]
|
||||
[B<-signer file>]
|
||||
[B<-recip file>]
|
||||
@ -259,7 +260,7 @@ portion of a message so they may be included manually. If signing
|
||||
then many S/MIME mail clients check the signers certificate's email
|
||||
address matches that specified in the From: address.
|
||||
|
||||
=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig>
|
||||
=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig -no_alt_chains>
|
||||
|
||||
Set various options of certificate chain verification. See
|
||||
L<B<verify>|verify(1)> manual page for details.
|
||||
@ -441,5 +442,6 @@ structures may cause parsing errors.
|
||||
The use of multiple B<-signer> options and the B<-resign> command were first
|
||||
added in OpenSSL 1.0.0
|
||||
|
||||
The -no_alt_chains options was first added to OpenSSL 1.0.2b.
|
||||
|
||||
=cut
|
||||
|
||||
@ -25,6 +25,7 @@ B<openssl> B<verify>
|
||||
[B<-extended_crl>]
|
||||
[B<-use_deltas>]
|
||||
[B<-policy_print>]
|
||||
[B<-no_alt_chains>]
|
||||
[B<-untrusted file>]
|
||||
[B<-help>]
|
||||
[B<-issuer_checks>]
|
||||
@ -124,6 +125,14 @@ Set policy variable inhibit-any-policy (see RFC5280).
|
||||
|
||||
Set policy variable inhibit-policy-mapping (see RFC5280).
|
||||
|
||||
=item B<-no_alt_chains>
|
||||
|
||||
When building a certificate chain, if the first certificate chain found is not
|
||||
trusted, then OpenSSL will continue to check to see if an alternative chain can
|
||||
be found that is trusted. With this option that behaviour is suppressed so that
|
||||
only the first chain found is ever used. Using this option will force the
|
||||
behaviour to match that of previous OpenSSL versions.
|
||||
|
||||
=item B<-policy_print>
|
||||
|
||||
Print out diagnostics related to policy processing.
|
||||
@ -425,4 +434,8 @@ B<20 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY> error codes.
|
||||
|
||||
L<x509(1)|x509(1)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
The -no_alt_chains options was first added to OpenSSL 1.0.2b.
|
||||
|
||||
=cut
|
||||
|
||||
@ -197,6 +197,12 @@ verification. If this flag is set then additional status codes will be sent
|
||||
to the verification callback and it B<must> be prepared to handle such cases
|
||||
without assuming they are hard errors.
|
||||
|
||||
The B<X509_V_FLAG_NO_ALT_CHAINS> flag suppresses checking for alternative
|
||||
chains. By default, when building a certificate chain, if the first certificate
|
||||
chain found is not trusted, then OpenSSL will continue to check to see if an
|
||||
alternative chain can be found that is trusted. With this flag set the behaviour
|
||||
will match that of OpenSSL versions prior to 1.0.2b.
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
The above functions should be used to manipulate verification parameters
|
||||
@ -233,6 +239,6 @@ L<X509_check_ip(3)|X509_check_ip(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
TBA
|
||||
The B<X509_V_FLAG_NO_ALT_CHAINS> flag was added in OpenSSL 1.0.2b
|
||||
|
||||
=cut
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user