wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
13655 commits 20 branches 302 tags 153 MiB
Commit graph

1150 commits

Author SHA1 Message Date
Scott Schaefer
d4a4370050 RT 2517: Various typo's. 
Reviewed-by: Emilia Kasper

Many of these were already fixed, this catches the last
few that were missed.
 2014-08-11 13:43:31 -04:00
Tim Hudson
c8d133e4b6 Minor documentation update removing "really" and a 
statement of opinion rather than a fact.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
 2014-07-21 20:03:50 +10:00
Dr. Stephen Henson
f8c03d4dbf Fix documentation for RSA_set_method(3) 
PR#1675
Reviewed-by: Matt Caswell <matt@openssl.org>
 2014-07-19 22:57:37 +01:00
Jeffrey Walton
d48e78f0cf Fix typo, add reference. 
PR#3456
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
 2014-07-17 12:07:37 +01:00
Matt Caswell
3bd548192a Add Matt Caswell's fingerprint, and general update on the fingerprints file to bring it up to date 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2014-07-15 23:13:37 +01:00
Dr. Stephen Henson
ca2015a617 Clarify -Verify and PSK. 
PR#3452
 2014-07-15 20:22:39 +01:00
Hubert Kario
7efd0e777e document -nextprotoneg option in man pages 
Add description of the option to advertise support of
Next Protocol Negotiation extension (-nextprotoneg) to
man pages of s_client and s_server.

PR#3444
 2014-07-14 23:42:59 +01:00
Dr. Stephen Henson
aa224e9719 Fix typo. 2014-07-14 18:31:55 +01:00
Viktor Dukhovni
b73ac02735 Improve X509_check_host() documentation. 
Based on feedback from Jeffrey Walton.
 2014-07-07 20:34:06 +10:00
Viktor Dukhovni
297c67fcd8 Update API to use (char *) for email addresses and hostnames 
Reduces number of silly casts in OpenSSL code and likely most
applications.  Consistent with (char *) for "peername" value from
X509_check_host() and X509_VERIFY_PARAM_get0_peername().
 2014-07-07 19:11:38 +10:00
Dr. Stephen Henson
cba3f1c739 Document certificate status request options. 2014-07-06 22:40:01 +01:00
Jeffrey Walton
75b7606881 Added reference to platform specific cryptographic acceleration such as AES-NI 2014-07-06 00:03:13 +01:00
Matt Caswell
fd9e244370 Fixed error in pod files with latest versions of pod2man 2014-07-06 00:03:13 +01:00
Viktor Dukhovni
ced3d9158a Set optional peername when X509_check_host() succeeds. 
Pass address of X509_VERIFY_PARAM_ID peername to X509_check_host().
Document modified interface.
 2014-07-06 01:50:50 +10:00
Viktor Dukhovni
6e661d458f New peername element in X509_VERIFY_PARAM_ID 
Declaration, memory management, accessor and documentation.
 2014-07-06 01:50:50 +10:00
Dr. Stephen Henson
a9661e45ac typo 
(cherry picked from commit 2cfbec1cae)
 2014-07-04 13:50:55 +01:00
Dr. Stephen Henson
b948ee27b0 Remove all RFC5878 code. 
Remove RFC5878 code. It is no longer needed for CT and has numerous bugs
 2014-07-04 13:26:35 +01:00
Dr. Stephen Henson
a23a6e85d8 Update ticket callback docs. 2014-07-03 14:50:08 +01:00
Rich Salz
538860a3ce RT 1638; EVP_*Final() should mention they no longer cleanup the ctx. 2014-07-02 23:38:34 -04:00
Rich Salz
fc1d88f02f Close a whole bunch of documentation-related tickets: 
298 424 656 882 939 1630 1807 2263 2294 2311 2424 2623
    2637 2686 2697 2921 2922 2940 3055 3112 3156 3177 3277
 2014-07-02 22:42:40 -04:00
Matt Smart
5cc99c6cf5 Fix doc typo. 
ERR_get_error(3) references the non-existent
ERR_get_last_error_line_data instead of the one that does exist,
ERR_peek_last_error_line_data.

PR#3283
 2014-07-02 03:43:42 +01:00
Rich Salz
762a44de59 RT 3245; it's "bitwise or" not "logical or" 2014-07-01 13:00:18 -04:00
Rich Salz
854dfcd859 Fix RT 3211; "and are" -->"are" 2014-07-01 12:55:32 -04:00
Rich Salz
7b1d946051 Fix RT 2567; typo in pkeyutl page. 2014-07-01 12:49:20 -04:00
Rich Salz
42b91f28a6 Fix RT 2430; typo's in ca.pod 2014-07-01 12:47:52 -04:00
Rich Salz
d7003c4d7d Fix RT 3193 2014-07-01 12:44:32 -04:00
Jeffrey Walton
6e6ba36d98 Clarified that the signature's buffer size, s, is not used as an 
IN parameter.

Under the old docs, the only thing stated was "at most
EVP_PKEY_size(pkey) bytes will be written". It was kind of misleading
since it appears EVP_PKEY_size(pkey) WILL be written regardless of the
signature's buffer size.
 2014-06-29 23:34:21 +01:00
Ken Ballou
76ed5a42ea Typo. 
PR#3173
 2014-06-29 13:38:55 +01:00
Dr. Stephen Henson
528b1f9a9f Clarify protocols supported. 
Update protocols supported and note that SSLv2 is effectively disabled
by default.

PR#3184
 2014-06-29 00:07:08 +01:00
Rich Salz
a0490e02c7 RT 487. Mention that generated primes are "at least" B<bits> long. 2014-06-27 15:59:08 -04:00
Jeffrey Walton
0535c2d67c Clarify docs. 
Document that the certificate passed to SSL_CTX_add_extra_chain_cert()
should not be freed by the application.

PR#3409
 2014-06-27 16:39:11 +01:00
Viktor Dukhovni
8abffa4a73 Multiple verifier reference identities. 
Implemented as STACK_OF(OPENSSL_STRING).
 2014-06-22 20:32:35 -04:00
Viktor Dukhovni
d241b80409 More complete X509_check_host documentation. 2014-06-22 19:50:02 -04:00
Matt Caswell
115e480924 Fix minor typos 2014-06-19 23:45:21 +01:00
Hubert Kario
e42d84be33 add references to verify(1) man page for args_verify() options 
cms, ocsp, s_client, s_server and smime tools also use args_verify()
for parsing options, that makes them most of the same options
verify tool does. Add those options to man pages and reference
their explanation in the verify man page.
 2014-06-19 23:09:21 +01:00
Hubert Kario
2866441a90 sort the options in verify man page alphabetically 
just making sure the options are listed in the alphabetical order
both in SYNOPSIS and DESCRIPTION, no text changes
 2014-06-19 23:09:21 +01:00
Hubert Kario
cd028c8e66 add description of missing options to verify man page 
The options related to policy used for verification, verification
of subject names in certificate and certificate chain handling
were missing in the verify(1) man page. This fixes this issue.
 2014-06-19 23:09:21 +01:00
Hubert Kario
ce21d108bd smime man page: add missing options in SYNOPSIS 
-CAfile and -CApath is documented in OPTIONS but is missing
in SYNOPSIS, add them there
 2014-06-19 23:09:21 +01:00
Hubert Kario
6d3d579367 Document -trusted_first option in man pages and help. 
Add -trusted_first description to help messages and man pages
of tools that deal with certificate verification.
 2014-06-19 23:09:21 +01:00
rfkrocktk
96fc4b7250 Added documentation for -iter for PKCS#8 2014-06-17 23:10:14 +01:00
Viktor Dukhovni
a09e4d24ad Client-side namecheck wildcards. 
A client reference identity of ".example.com" matches a server
certificate presented identity that is any sub-domain of "example.com"
(e.g. "www.sub.example.com).

With the X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS flag, it matches
only direct child sub-domains (e.g. "www.sub.example.com").
 2014-06-12 23:19:25 +01:00
Hubert Kario
343e5cf194 add ECC strings to ciphers(1), point out difference between DH and ECDH 
* Make a clear distinction between DH and ECDH key exchange.
 * Group all key exchange cipher suite identifiers, first DH then ECDH
 * add descriptions for all supported *DH* identifiers
 * add ECDSA authentication descriptions
 * add example showing how to disable all suites that offer no
   authentication or encryption
 2014-06-10 20:53:07 +01:00
Matt Caswell
fa6bb85ae0 Fixed minor duplication in docs 2014-06-07 12:30:18 +01:00
Dr. Stephen Henson
01f2f18f3c Option to disable padding extension. 
Add TLS padding extension to SSL_OP_ALL so it is used with other
"bugs" options and can be turned off.

This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient
option referring to SSLv2 and SSLREF.

PR#3336
 2014-06-01 18:15:21 +01:00
Hubert Kario
9ed03faac4 add description of -attime to man page 
the verify app man page didn't describe the usage of attime option
even though it was listed as a valid option in the -help message.

This patch fixes this omission.
 2014-05-30 23:26:35 +01:00
Hubert Kario
08bef7be1e add description of -no_ecdhe option to s_server man page 
While the -help message references this option, the man page
doesn't mention the -no_ecdhe option.
This patch fixes this omission.
 2014-05-30 22:59:43 +01:00
Matt Caswell
3d9243f1b6 Changed -strictpem to use PEM_read_bio 2014-05-26 23:31:37 +01:00
Matt Caswell
6b5c1d940b Added -strictpem parameter to enable processing of PEM files with data prior to the BEGIN marker 2014-05-26 17:24:11 +01:00
Matt Caswell
15658d0cbf Fixed error in args for SSL_set_msg_callback and SSL_set_msg_callback_arg 2014-05-25 23:45:12 +01:00
Martin Kaiser
189ae368d9 Add an NSS output format to sess_id to export to export the session id and the master key in NSS keylog format. PR#3352 2014-05-24 00:02:24 +01:00
Matt Caswell
085ccc542a Fixed minor copy&paste error, and stray space causing rendering problem 2014-05-22 00:07:35 +01:00
Matt Caswell
df24f29ae6 Fixed unterminated B tag, causing build to fail with newer pod2man versions 2014-05-22 00:00:23 +01:00
Viktor Dukhovni
397a8e747d Fixes to host checking. 
Fixes to host checking wild card support and add support for
setting host checking flags when verifying a certificate
chain.
 2014-05-21 11:31:28 +01:00
Dr. Stephen Henson
6f719f063c Change default cipher in smime app to des3. 
PR#3357
 2014-05-21 11:28:57 +01:00
Matt Caswell
d4b47504de Moved note about lack of support for AEAD modes out of BUGS section to SUPPORTED CIPHERS section (bug has been fixed, but still no support for AEAD) 2014-05-15 21:13:38 +01:00
Jeffrey Walton
2af071c0bc Fix grammar error in verify pod. PR#3355 2014-05-14 22:49:30 +01:00
Jeffrey Walton
18c4f522f4 Add information to BUGS section of enc documentation. PR#3354 2014-05-14 22:48:26 +01:00
Michal Bozon
ab6577a46e Corrected POD syntax errors. PR#3353 2014-05-14 21:07:51 +01:00
Jean-Paul Calderone
a4a442cccf Correct the return type on the signature for X509_STORE_CTX_get_ex_data given in the pod file. 2014-05-12 22:41:13 +01:00
Dr. Stephen Henson
89e674744d Correct example. 2014-05-12 18:41:52 +01:00
Matt Caswell
c4afc40a9b Fixed CRLF in file 2014-05-10 01:19:50 +01:00
Jeff Trawick
e5676b8328 typo in SSL_get_peer_cert_chain docs 
RT: 3304
 2014-05-01 13:40:01 +02:00
Matt Caswell
ba1cb9a553 Fix SSL_CONF_cmd missing =back 2014-04-27 18:57:34 +01:00
Matt Caswell
b5450d6349 Fixed minor errors in docs 2014-04-26 21:56:36 +01:00
Matt Caswell
6bcc4475fc PKCS5_PBKDF2_HMAC documentation submitted by Jeffrey Walton 2014-04-26 21:44:26 +01:00
Chris Rorvick
fa9d77dcd2 doc: Add missing =back directive. 
Signed-off-by: Chris Rorvick <chris@rorvick.com>
 2014-04-26 12:32:53 -05:00
mancha
8acb953880 Fix version documentation. 
Specify -f is for compilation flags. Add -d to synopsis section.

Closes #77.
 2014-04-26 08:09:53 +01:00
Dr. Stephen Henson
0dd5b94aeb Document -debug_decrypt option. 2014-04-16 12:15:43 +01:00
Dr. Stephen Henson
5f8e9a477a Clarify CMS_decrypt behaviour. 2014-04-15 18:17:12 +01:00
Dr. Stephen Henson
3143a332e8 Add new key fingerprint. 2014-04-11 02:50:51 +01:00
Dr. Stephen Henson
4e6c12f308 Document -verify_return_error option. 2014-04-07 13:02:39 +01:00
Dr. Stephen Henson
b7e46a9bce Update security framework docs. 2014-04-05 13:29:41 +01:00
Dr. Stephen Henson
dbb7654dc1 Document new crl option. 2014-04-03 13:33:50 +01:00
Dr. Stephen Henson
0f817d3b27 Add initial security framework docs. 2014-03-28 16:42:18 +00:00
Dr. Stephen Henson
f0ef019da2 Add -no_resumption_on_reneg to SSL_CONF. 
(cherry picked from commit 1f44dac24d)
 2014-03-27 16:12:40 +00:00
Dr. Stephen Henson
e970f63dc0 Update chain building function. 
Don't clear verification errors from the error queue unless
SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR is set.

If errors occur during verification and SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR
is set return 2 so applications can issue warnings.
(cherry picked from commit 2dd6976f6d)
 2014-03-27 14:24:40 +00:00
Dr. Stephen Henson
5693a30813 PKCS#8 support for alternative PRFs. 
Add option to set an alternative to the default hmacWithSHA1 PRF
for PKCS#8 private key encryptions. This is used automatically
by PKCS8_encrypt if the nid specified is a PRF.

Add option to pkcs8 utility.

Update docs.
(cherry picked from commit b60272b01f)
 2014-03-01 23:16:08 +00:00
Dr. Stephen Henson
13dc3ce9ab New chain building flags. 
New flags to build certificate chains. The can be used to rearrange
the chain so all an application needs to do is add all certificates
in arbitrary order and then build the chain to check and correct them.

Add verify error code when building chain.

Update docs.
 2014-02-23 13:36:38 +00:00
Dr. Stephen Henson
daddd9a950 Option to set current cert to server certificate. 2014-02-21 19:44:09 +00:00
Kurt Roeckx
e547c45f1c Fix additional pod errors with numbered items. 2014-02-14 22:30:26 +00:00
Scott Schaefer
2b4ffc659e Fix various spelling errors 2014-02-14 22:29:12 +00:00
Scott Schaefer
856c6dfb09 Document pkcs12 -password behavior 
apps/pkcs12.c accepts -password as an argument.  The document author
almost certainly meant to write "-password, -passin".

However, that is not correct, either.  Actually the code treats
-password as equivalent to -passin, EXCEPT when -export is also
specified, in which case -password as equivalent to -passout.
 2014-02-14 22:28:37 +00:00
Dr. Stephen Henson
847865d0f9 Add suppot for ASCII with CRLF canonicalisation. 2014-02-13 14:35:56 +00:00
Dr. Stephen Henson
0f78819c8c New ctrl to set current certificate. 
New ctrl sets current certificate based on certain criteria. Currently
two options: set the first valid certificate as current and set the
next valid certificate as current. Using these an application can
iterate over all certificates in an SSL_CTX or SSL structure.
 2014-02-02 22:58:19 +00:00
Dr. Stephen Henson
30ea570f0f Clarify docs. 
Remove reference to ERR_TXT_MALLOCED in the error library as that is
only used internally. Indicate that returned error data must not be
freed.
(cherry picked from commit f2d678e6e8)
 2014-01-29 01:01:52 +00:00
Dr. Stephen Henson
46ab9bbd7f Certificate callback doc. 2014-01-26 16:29:43 +00:00
Jeff Trawick
4b64e0cbdb typo 2014-01-10 23:01:30 +00:00
Jeff Trawick
5edce5685f typo 2014-01-10 23:00:50 +00:00
Daniel Kahn Gillmor
0ecfd920e5 update remaining documentation to move from EDH to DHE 
change documentation and comments to indicate that we prefer the
standard "DHE" naming scheme everywhere over the older "EDH"
 2014-01-09 15:43:28 +00:00
Daniel Kahn Gillmor
0b30fc903f documentation should use "DHE" instead of "EDH" 2014-01-09 15:43:28 +00:00
Daniel Kahn Gillmor
5a21cadbeb use SSL_kDHE throughout instead of SSL_kEDH 
DHE is the standard term used by the RFCs and by other TLS
implementations.  It's useful to have the internal variables use the
standard terminology.

This patch leaves a synonym SSL_kEDH in place, though, so that older
code can still be built against it, since that has been the
traditional API.  SSL_kEDH should probably be deprecated at some
point, though.
 2014-01-09 15:43:28 +00:00
Dr. Stephen Henson
5b7f36e857 Add ServerInfoFile to SSL_CONF, update docs. 2014-01-03 23:14:23 +00:00
Dr. Stephen Henson
a4339ea3ba Use algorithm specific chains for certificates. 
Fix a limitation in SSL_CTX_use_certificate_chain_file(): use algorithm
specific chains instead of the shared chain.

Update docs.
 2014-01-03 22:39:49 +00:00
Dr. Stephen Henson
a25f9adc77 New functions to retrieve certificate from SSL_CTX 
New functions to retrieve current certificate or private key
from an SSL_CTX.

Constify SSL_get_private_key().
 2013-11-18 18:56:48 +00:00
Dr. Stephen Henson
0f7fa1b190 Constify. 
(cherry picked from commit 1abfa78a8b)
 2013-11-14 21:05:36 +00:00
Rob Stradling
7b6b246fd3 Additional "chain_cert" functions. 
PR#3169

This patch, which currently applies successfully against master and
1_0_2, adds the following functions:

SSL_[CTX_]select_current_cert() - set the current certificate without
disturbing the existing structure.

SSL_[CTX_]get0_chain_certs() - get the current certificate's chain.

SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain.

The patch also adds these functions to, and fixes some existing errors
in, SSL_CTX_add1_chain_cert.pod.
 2013-11-13 23:48:35 +00:00
Dr. Stephen Henson
9c75461bef Document RSAPublicKey_{in,out} options. 2013-11-09 15:09:23 +00:00
Dr. Stephen Henson
da15c61608 Add CMS_SignerInfo_get0_signature function. 
Add function to retrieve the signature from a CMS_SignerInfo structure:
applications can then read or modify it.
 2013-11-09 15:09:23 +00:00
Lubomir Rintel
ed77017b59 POD: Fix list termination 
This fixes problems in POD list formatting: extra or missing =back
sequences.

doc/ssl/SSL_CTX_set1_curves.pod around line 90: =back without =over
doc/ssl/SSL_CTX_set1_verify_cert_store.pod around line 73: =back without =over
doc/ssl/SSL_CTX_add1_chain_cert.pod around line 82: =back without =over
doc/crypto/evp.pod around line 40: '=item' outside of any '=over'
crypto/des/des.pod around line 184: You forgot a '=back' before '=head1'

PR#3147
 2013-10-22 07:38:25 +01:00
Lubomir Rintel
c8919dde09 POD: Fix item numbering 
Newer pod2man considers =item [1-9] part of a numbered list, while =item
0 starts an unnumbered list. Add a zero effect formatting mark to override
this.

doc/apps/smime.pod around line 315: Expected text after =item, not a
number
...

PR#3146
 2013-10-22 07:38:25 +01:00
Dr. Stephen Henson
c557f921dc Add SSL_CONF command to set DH Parameters. 2013-10-22 07:38:25 +01:00
Dr. Stephen Henson
ec2f7e568e Extend SSL_CONF 
Extend SSL_CONF to return command value types.

Add certificate and key options.

Update documentation.
 2013-10-20 22:07:36 +01:00
Trevor Perrin
deda5ea788 Update docs to mention "BEGIN SERVERINFO FOR ". 2013-09-13 19:48:09 -07:00
Scott Deboy
36086186a9 Add callbacks supporting generation and retrieval of supplemental data entries, facilitating RFC 5878 (TLS auth extensions) 
Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API
Tests exercising the new supplemental data registration and callback api can be found in ssltest.c.
Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
 2013-09-06 13:59:13 +01:00
Ben Laurie
cda01d55ba s/recommend/recommended/ 2013-09-05 21:43:50 +01:00
Veres Lajos
478b50cf67 misspellings fixes by https://github.com/vlajos/misspell_fixer 2013-09-05 21:39:42 +01:00
Carlos Alberto Lopez Perez
b98af49d97 Add an "-xmpphost" option to s_client 
* Many XMPP servers are configured with multiple domains (virtual hosts)
 * In order to establish successfully the TLS connection you have to specify
   which virtual host you are trying to connect.
 * Test this, for example with ::
   * Fail:
       openssl s_client -connect talk.google.com:5222 -starttls xmpp
   * Works:
       openssl s_client -connect talk.google.com:5222 -starttls xmpp -xmpphost gmail.com
 2013-09-05 17:24:56 +01:00
Carlos Alberto Lopez Perez
50f307a98f Add "xmpp" to the list of supported starttls protocols on s_client manpage 2013-09-05 17:24:56 +01:00
Rob Stradling
dece3209f2 Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. 
OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
 2013-09-05 13:09:03 +01:00
Dr. Stephen Henson
c3eb33763b Document supported curve functions. 2013-09-03 15:43:01 +01:00
Dr. Stephen Henson
902efde1cc Document -force_pubkey option. 2013-08-21 13:43:00 +01:00
Dr. Stephen Henson
36019f70e8 Correct ECDSA example. 2013-08-21 13:43:00 +01:00
Dr. Stephen Henson
eeb15452a0 Add documentation. 
Preliminary documentation for chain and verify stores and certificate chain
setting functions.
 2013-08-17 17:41:14 +01:00
Dr. Stephen Henson
dfcb42c68e Update cms docs. 2013-08-05 16:23:22 +01:00
Dr. Stephen Henson
4bf4a6501c Update cms docs. 
Document use of -keyopt to use RSA-PSS and RSA-OAEP modes.
 2013-06-21 23:43:06 +01:00
Trevor
9cd50f738f Cleanup of custom extension stuff. 
serverinfo rejects non-empty extensions.

Omit extension if no relevant serverinfo data.

Improve error-handling in serverinfo callback.

Cosmetic cleanups.

s_client documentation.

s_server documentation.

SSL_CTX_serverinfo documentation.

Cleaup -1 and NULL callback handling for custom extensions, add tests.

Cleanup ssl_rsa.c serverinfo code.

Whitespace cleanup.

Improve comments in ssl.h for serverinfo.

Whitespace.

Cosmetic cleanup.

Reject non-zero-len serverinfo extensions.

Whitespace.

Make it build.
 2013-06-18 16:13:08 +01:00
Matt Caswell
aafbe1ccd2 Document updates from wiki. 
PR#3071

The primary changes made are:
- Updates to the "NAME" section of many pages to correctly reflect the
functions defined on those pages. This section is automatically parsed
by the util/extract-names.pl script, so if it is not correct then
running "man" will not correctly locate the right manual pages.
- Updates to take account of where functions are now deprecated
- Full documentation of the ec sub-library
- A number of other typo corrections and other minor tweaks
 2013-06-12 23:42:08 +01:00
Dr. Stephen Henson
e1f1d28f34 Add function CMS_RecipientInfo_encrypt 
Add CMS_RecipientInfo_encrypt: this function encrypts an existing content
encryption key to match the key in the RecipientInfo structure: this is
useful if a new recpient is added to and existing enveloped data structure.

Add documentation.
 2013-02-26 16:59:56 +00:00
Dr. Stephen Henson
4365e4aad9 Update SSL_CONF docs. 
Fix some typos and update version number first added: it has now been
backported to OpenSSL 1.0.2.
 2013-02-26 15:29:11 +00:00
Nick Alcock
5cc2707742 Fix POD errors to stop make install_docs dying with pod2man 2.5.0+ 
podlators 2.5.0 has switched to dying on POD syntax errors. This means
that a bunch of long-standing erroneous POD in the openssl documentation
now leads to fatal errors from pod2man, halting installation.

Unfortunately POD constraints mean that you have to sort numeric lists
in ascending order if they start with 1: you cannot do 1, 0, 2 even if
you want 1 to appear first. I've reshuffled such (alas, I wish there
were a better way but I don't know of one).
 2013-02-15 19:36:26 +01:00
Ben Laurie
e54e123549 Correct EVP_PKEY_verifyrecover to EVP_PKEY_verify_recover (RT 2955). 2013-01-12 12:25:30 +00:00
Ben Laurie
3a778a2913 Documentation improvements by Chris Palmer (Google). 2012-12-14 13:28:49 +00:00
Ben Laurie
74cc3b583d Document -pubkey. 2012-12-13 16:17:55 +00:00
Dr. Stephen Henson
65f2a56580 documentation fixes 2012-12-06 23:26:11 +00:00
Dr. Stephen Henson
13cfb04343 reorganise SSL_CONF_cmd manual page and update some links 2012-11-20 01:01:33 +00:00
Dr. Stephen Henson
095db6bdb8 correct docs 2012-11-19 20:06:44 +00:00
Dr. Stephen Henson
8dbeb110fb document -trace and -msgfile options 2012-11-19 16:37:18 +00:00
Dr. Stephen Henson
765b413794 update docs for s_server/s_client 2012-11-19 16:07:53 +00:00
Dr. Stephen Henson
821244cf67 clarify docs 2012-11-18 18:06:16 +00:00
Dr. Stephen Henson
edb128ce00 fix manual page file name 2012-11-18 17:58:45 +00:00
Dr. Stephen Henson
642aa226db document -naccept option 2012-11-18 15:51:26 +00:00
Dr. Stephen Henson
d88926f181 PR: 2909 
Contributed by: Florian Weimer <fweimer@redhat.com>

Fixes to X509 hostname and email address checking. Wildcard matching support.
New test program and manual page.
 2012-11-18 15:13:55 +00:00
Andy Polyakov
c5cd28bd64 Extend OPENSSL_ia32cap_P with extra word to accomodate AVX2 capability. 2012-11-17 19:04:15 +00:00
Dr. Stephen Henson
aa714f3af4 initial decription of GCM/CCM usage via EVP 2012-11-17 14:38:20 +00:00
Dr. Stephen Henson
c7b7984ac9 fix typos in SSL_CONF documentation 2012-11-17 00:21:34 +00:00
Dr. Stephen Henson
3db935a9e5 add SSL_CONF functions and documentation 2012-11-16 19:12:24 +00:00
Dr. Stephen Henson
63d103ea48 typo 2012-11-16 12:49:14 +00:00
Dr. Stephen Henson
999ffeca6c update ciphers documentation to indicate implemented fixed DH ciphersuites 2012-11-16 01:15:15 +00:00
Dr. Stephen Henson
ffa4579679 initial update of ciphers doc 2012-11-16 00:42:38 +00:00
Richard Levitte
e0311481b8 Correct environment variable is OPENSSL_ALLOW_PROXY_CERTS. 2012-05-04 10:43:15 +00:00
Dr. Stephen Henson
5a34fcd76e update rather ancient EVP digest documentation 2012-04-10 22:28:01 +00:00
Andy Polyakov
677741f87a doc/apps: formatting fixes. 
PR: 2683
Submitted by: Annie Yousar
 2012-01-11 21:58:19 +00:00
Andy Polyakov
62d7dd5ffd ecdsa.pod: typo. 
PR: 2678
Submitted by: Annie Yousar
 2012-01-11 21:41:32 +00:00
Dr. Stephen Henson
618eb125f0 Document RFC5114 "generation" options. 2011-12-07 00:42:22 +00:00
Ben Laurie
ae55176091 Fix some warnings caused by __owur. Temporarily (I hope) remove the more 
aspirational __owur annotations.
 2011-11-14 00:36:10 +00:00
Dr. Stephen Henson
0c58d22ad9 PR: 1794 
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Reviewed by: steve

Document unknown_psk_identify alert, remove pre-RFC 5054 string from
ssl_stat.c
 2011-11-13 13:13:01 +00:00
Bodo Möller
9d74befd23 Clarify warning 2011-10-13 13:27:09 +00:00
Andy Polyakov
2667162d33 cryptlib.c: OPENSSL_ia32cap environment variable to interpret ~ as cpuid mask. 2011-07-23 12:10:26 +00:00
Bodo Möller
735ebc2de7 Fix typo. 
Submitted by: Jim Morrison
 2011-07-11 12:13:55 +00:00
Andy Polyakov
301799b803 x86[_64]cpuid.pl: add function accessing rdrand instruction. 2011-06-04 12:20:45 +00:00
Andy Polyakov
4bb90087d7 x86[_64]cpuid.pl: harmonize usage of reserved bits #20 and #30. 2011-05-27 15:32:43 +00:00
Andy Polyakov
b906422149 x86[_64]cpuid.pl: handle new extensions. 2011-05-16 20:35:11 +00:00
Andy Polyakov
5fabb88a78 Multiple assembler packs: add experimental memory bus instrumentation. 2011-04-17 12:46:00 +00:00
Bodo Möller
88f2a4cf9c CVE-2010-4180 fix (from OpenSSL_1_0_0-stable) 2011-02-03 10:43:00 +00:00
Dr. Stephen Henson
6f413ef406 fix doc typos 2010-12-02 13:44:53 +00:00
Dr. Stephen Henson
7e0de9e8a6 Minor documentation fixes, PR#2345 2010-10-04 13:28:46 +00:00
Dr. Stephen Henson
0d638dc1f6 Minor documentation fixes, PR#2344 2010-10-04 13:23:53 +00:00
Dr. Stephen Henson
827f3d5f39 PR: 2252 
Submitted By: Ger Hobbelt <ger@hobbelt.com>

Update docs to BIO_f_buffer()
 2010-05-03 15:30:07 +00:00
Andy Polyakov
bb92e2c89b bss_file.c: refine UTF-8 logic on Windows. 2010-04-28 20:02:28 +00:00
Dr. Stephen Henson
c0b8eb606f Add SHA2 algorithms to SSL_library_init(). Although these aren't used 
directly by SSL/TLS SHA2 certificates are becoming more common and
applications that only call SSL_library_init() and not
OpenSSL_add_all_alrgorithms() will fail when verifying certificates.

Update docs.
 2010-04-07 13:18:07 +00:00
Dr. Stephen Henson
d4a45bf31a Remove obsolete PRNG note. Add comment about use of SHA256 et al. 2010-04-06 15:03:27 +00:00
Dr. Stephen Henson
60e24554bb PR: 2209 
Submitted Daniel Mentz <danielml@sent.com>

Documentation typo.
 2010-04-06 14:45:18 +00:00
Dr. Stephen Henson
7d3d1788a5 The meaning of the X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY and 
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT error codes were reversed in
the verify application documentation.
 2010-02-23 14:09:09 +00:00
Dr. Stephen Henson
69582a592e clarify documentation 2010-02-18 12:41:33 +00:00
Dr. Stephen Henson
c2c49969e2 Allow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as 
initial connection to unpatched servers. There are no additional security
concerns in doing this as clients don't see renegotiation during an
attack anyway.
 2010-02-17 18:38:31 +00:00
Dr. Stephen Henson
f959598866 update references to new RI RFC 2010-02-12 21:59:31 +00:00
Dr. Stephen Henson
9fb6fd34f8 reword RI description 2010-01-27 18:53:33 +00:00
Dr. Stephen Henson
99b36a8c31 update documentation to reflect new renegotiation options 2010-01-27 17:46:24 +00:00
Dr. Stephen Henson
1e27847d4e PR: 2157 
Submitted by: "Green, Paul" <Paul.Green@stratus.com>

Typo.
 2010-01-27 12:54:58 +00:00
Dr. Stephen Henson
3243698f1d typo 2010-01-21 18:46:15 +00:00
Dr. Stephen Henson
0e0c6821fa PR: 2136 
Submitted by: Willy Weisz <weisz@vcpc.univie.ac.at>

Add options to output hash using older algorithm compatible with OpenSSL
versions before 1.0.0
 2010-01-12 17:29:34 +00:00
Dr. Stephen Henson
2a30fec786 Typo 2010-01-05 17:49:49 +00:00
Dr. Stephen Henson
6084c797a8 Remove tabs on blank lines: they produce warnings in pod2man 2010-01-05 17:16:54 +00:00
Dr. Stephen Henson
b5c002d5a8 clarify docs 2009-12-09 18:16:50 +00:00
Dr. Stephen Henson
4db82571ba Document option clearning functions. 
Initial secure renegotiation documentation.
 2009-12-09 17:59:29 +00:00
Dr. Stephen Henson
c2f0203da0 typo 2009-11-29 13:45:42 +00:00
Andy Polyakov
cca3ea1e71 OPENSSL_ia32cap.pod update. 2009-11-15 17:34:24 +00:00
Dr. Stephen Henson
d6245b8952 PR: 2078 
Submitted by: Dale Anderson <dra@redevised.net>
Approved by: steve@openssl.org

Corrections to bn_internal documentation.
 2009-10-28 13:52:07 +00:00
Dr. Stephen Henson
1e6b8d39f1 Document more error codes. 2009-10-18 14:01:17 +00:00
Dr. Stephen Henson
e05d6c7d3c Verification callback functions. 2009-10-18 13:26:08 +00:00
Dr. Stephen Henson
9074df8684 Clarification. 2009-10-17 23:08:32 +00:00
Dr. Stephen Henson
6c17629f91 Preliminary documentation for X509_VERIFY_PARAM. 2009-10-17 23:00:18 +00:00
Dr. Stephen Henson
db57663241 Add docs for X509_STORE_CTX_new() and related functions. 2009-10-17 18:05:53 +00:00
Dr. Stephen Henson
53246488bd More X509 verification docs. 2009-10-17 17:07:17 +00:00
Dr. Stephen Henson
1f164f5ed9 Typo. 2009-10-17 17:06:19 +00:00
Dr. Stephen Henson
b8c182a499 Manual page for X509_verify_cert() 2009-10-17 12:46:52 +00:00
Dr. Stephen Henson
11c4c02ce3 PR: 2074 
Submitted by: Bram Neijt <bneijt@gmail.com>
Approved by: steve@openssl.org

Typo: "contet".
 2009-10-16 15:30:13 +00:00
Dr. Stephen Henson
fb552ac616 Change version from 0.9.9 to 1.0.0 in docs 2009-09-30 23:43:01 +00:00
Dr. Stephen Henson
94480b57db PR: 2023 
Submitted by: James Beckett <jmb.openssl@nospam.hackery.net>, steve
Approved by: steve@openssl.org

Fix documentation errors in d2i_X509 manual pages.
 2009-09-12 23:34:41 +00:00
Dr. Stephen Henson
7689ed34d3 PR: 2025 
Submitted by: Tomas Mraz <tmraz@redhat.com>
Approved by: steve@openssl.org

Constify SSL_CIPHER_description
 2009-09-12 23:17:39 +00:00
Dr. Stephen Henson
88a3dd7896 Correction: salt is now default 2009-09-04 12:27:12 +00:00
Dr. Stephen Henson
3fa39ed723 Document removal of digest+signature algorithm link. 2009-07-24 13:01:40 +00:00
Dr. Stephen Henson
55a4a77a52 Update from 0.9.8-stable 2009-07-11 22:36:59 +00:00
Dr. Stephen Henson
f3be6c7b7d Update from 1.0.0-stable. 2009-06-26 11:29:26 +00:00
Dr. Stephen Henson
e30dd20c0e Update from 1.0.0-stable 2009-06-25 11:29:30 +00:00
Dr. Stephen Henson
f0288f05b9 Submitted by: Artem Chuprina <ran@cryptocom.ru> 
Reviewed by: steve@openssl.org

Various GOST ciphersuite and ENGINE fixes. Including...

Allow EVP_PKEY_set_derive_peerkey() in encryption operations.

New flag when certificate verify should be omitted in client key exchange.
 2009-06-16 16:38:47 +00:00
Dr. Stephen Henson
ff6e530359 PR: 1938 
Submitted by: Mark Phalan <Mark.Phalan@Sun.COM>
Reviewed by: steve@openssl.org

Patch to pem and hmac manual pages NAME sections.
 2009-06-02 11:05:33 +00:00
Dr. Stephen Henson
16cd15e688 Update from 1.0.0-stable. 2009-05-17 14:48:31 +00:00
Andy Polyakov
e303f55fc7 Expand OPENSS_ia32cap to 64 bits. 2009-04-26 17:49:41 +00:00
Dr. Stephen Henson
8711efb498 Updates from 1.0.0-stable branch. 2009-04-20 11:33:12 +00:00