Commit graph

971 commits

Author SHA1 Message Date
Rich Salz
491f3e4e8e Make OPENSSL_config truly ignore errors.
Per discussion: should not exit. Should not print to stderr.
Errors are ignored.  Updated doc to reflect that, and the fact
that this function is to be avoided.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(cherry picked from commit abdd677125)
2015-01-25 21:15:57 -05:00
Dr. Stephen Henson
37580f43b5 Only allow ephemeral RSA keys in export ciphersuites.
OpenSSL clients would tolerate temporary RSA keys in non-export
ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which
enabled this server side. Remove both options as they are a
protocol violation.

Thanks to Karthikeyan Bhargavan for reporting this issue.
(CVE-2015-0204)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

(cherry picked from commit 4b4c1fcc88)

Conflicts:
	doc/ssl/SSL_CTX_set_options.pod
2015-01-06 13:14:05 +00:00
Thorsten Glaser
cdf42d7b43 Document openssl dgst -hmac option
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2014-12-30 17:00:23 +01:00
Alok Menghrajani
5dad57536f Improves certificates HOWTO
* adds links to various related documents.
* fixes a few typos.
* rewords a few sentences.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 67472bd82b)
2014-12-22 16:26:12 +01:00
Richard Levitte
a5fad4d6bc Small typo
Reviewed-by: Stephen Henson <steve@openssl.org>
(cherry picked from commit 7cfab40f43)
2014-12-22 15:37:06 +01:00
Richard Levitte
2aca9b272e Correct some layout issues, convert all remaining tabs to appropriate amounts of spaces.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 8123d158ab)
2014-11-28 17:04:29 +01:00
Alok Menghrajani
26d7cb400e Improves the proxy certificates howto doc.
The current documentation contains a bunch of spelling and grammar mistakes. I also
found it hard to understand some paragraphs, so here is my attempt to improve its
readability.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 03b637a730)
2014-11-28 17:04:28 +01:00
André Guerreiro
6c3d948723 Add documentation on -timeout option in the ocsp utility
PR#3612

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit de87dd46c1)
(cherry picked from commit 4d3df37bc7)
2014-11-27 14:18:45 +00:00
Matt Caswell
ff60f33811 Updates to X509_NAME_get_index_by_NID.pod submitted by user Bernardh via the wiki
Minor changes made by Matt Caswell

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 6484958645)
2014-11-27 13:57:23 +00:00
Matt Caswell
2cfa5edb26 Updates to X509_NAME_add_entry_by_txt.pod submitted by user Bernardh via the wiki
Minor changes made by Matt Caswell.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit f281b8df70)
2014-11-27 13:57:23 +00:00
Matt Caswell
291a3e9629 Updates to EVP_PKEY_encrypt.pod submitted by user Bernardh via the wiki
Minor changes made by Matt Caswell.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 34890ac18e)
2014-11-27 13:57:23 +00:00
Alok Menghrajani
e7768ebbd2 Fixes a minor typo in the EVP docs.
Out is the buffer which needs to contain at least inl + cipher_block_size - 1 bytes. Outl
is just an int*.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 5211e094de)
2014-11-12 21:05:24 +00:00
Bodo Moeller
d47aebbb47 Fix and improve SSL_MODE_SEND_FALLBACK_SCSV documentation.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2014-10-21 22:40:41 +02:00
Dr. Stephen Henson
4ed98b6e25 Use correct function name: CMS_add1_signer()
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 5886354dcc)
2014-09-25 00:06:59 +01:00
Rich Salz
c2119214c2 RT2119,3407: Updated to dgst.pod
Re-order algorithm list.
Be consistent in command synopsis.
Add content about signing.
Add EXAMPLE section
Add some missing options: -r, -fips-fingerprint -non-fips-allow
Various other fixes.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 6aa9dbab0f)
2014-08-30 10:06:07 -04:00
James Westby
22387f00b6 RT1941: c_rehash.pod is missing
Add the file written by James Westby, graciously contributed
under the terms of the OpenSSL license.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit cf2239b3b3)
2014-08-30 09:51:56 -04:00
Rich Salz
4d16915381 RT2379: Bug in BIO_set_accept_port.pod
The doc says that port can be "*" to mean any port.
That's wrong.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 07e3b31fae)
2014-08-29 16:46:28 -04:00
Mihai Militaru
48ecdec7a0 RT2210: Add missing EVP_cleanup to example
I also removed some trailing whitespace and cleaned
up the "see also" list.

Reviewed-by: Emilia Kasper <emilia@openssl.org>
(cherry picked from commit 7b3e11c544)
2014-08-27 13:27:06 -04:00
David Gatwood
8f5f782253 RT1744: SSL_CTX_set_dump_dh() doc feedback
The description of when the server creates a DH key is
confusing.  This cleans it up.
(rsalz: also removed trailing whitespace.)

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2014-08-26 13:40:45 -04:00
Jan Schaumann
228a77a4ad RT1804: fix EXAMPLE in EVP_EncryptInit.pod
The EXAMPLE that used FILE and RC2 doesn't compile due to a
few minor errors.  Tweak to use IDEA and AES-128. Remove
examples about RC2 and RC5.

Reviewed-by: Emilia Kasper <emilia@openssl.org>
2014-08-25 10:26:57 -04:00
Matt Caswell
03b17a5789 Typo fixes to evp documentation.
This patch was submitted by user "Kox" via the wiki

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 2dd8cb3b95)
2014-08-24 21:26:40 +01:00
Emilia Kasper
9f96ea4c2b Improve EVP_PKEY_sign documentation
Clarify the intended use of EVP_PKEY_sign. Make the code example compile.

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
(cherry picked from commit d64c533a20)
2014-08-22 15:06:09 +02:00
Tim Hudson
690998f904 Minor documentation update removing "really" and a
statement of opinion rather than a fact.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit c8d133e4b6)
2014-07-21 20:24:47 +10:00
Dr. Stephen Henson
3221da845f Fix documentation for RSA_set_method(3)
PR#1675
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 197400c3f0d617d71ad8167b52fb73046d334320)
2014-07-19 18:26:12 +01:00
Jeffrey Walton
9aeb410419 Fix typo, add reference.
PR#3456
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit d48e78f0cf)
2014-07-17 12:08:52 +01:00
Matt Caswell
e967b94356 Add Matt Caswell's fingerprint, and general update on the fingerprints file to bring it up to date
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 3bd548192a)
2014-07-15 23:24:26 +01:00
Dr. Stephen Henson
2316286c0e Clarify -Verify and PSK.
PR#3452
(cherry picked from commit ca2015a617)
2014-07-15 20:23:35 +01:00
Hubert Kario
00579b98c4 document -nextprotoneg option in man pages
Add description of the option to advertise support of
Next Protocol Negotiation extension (-nextprotoneg) to
man pages of s_client and s_server.

PR#3444
(cherry picked from commit 7efd0e777e)

Conflicts:

	doc/apps/s_server.pod
2014-07-14 23:43:58 +01:00
Dr. Stephen Henson
b197c770a6 Document certificate status request options.
(cherry picked from commit cba3f1c739)

Conflicts:

	doc/apps/s_client.pod
	doc/apps/s_server.pod
2014-07-06 22:48:52 +01:00
Dr. Stephen Henson
a414bc8c3e Update ticket callback docs.
(cherry picked from commit a23a6e85d8)
2014-07-06 12:42:27 +01:00
Jeffrey Walton
157fd05aad Added reference to platform specific cryptographic acceleration such as AES-NI 2014-07-06 00:04:32 +01:00
Matt Caswell
9f510ceb5d Fixed error in pod files with latest versions of pod2man
(cherry picked from commit 07255f0a76d9d349d915e14f969b9ff2ee0d1953)
2014-07-06 00:04:32 +01:00
Dr. Stephen Henson
1864e3bed3 typo
(cherry picked from commit 2cfbec1cae)
(cherry picked from commit a9661e45ac)
2014-07-04 18:43:55 +01:00
Rich Salz
3fa2fff86f Merge branch 'rsalz-docfixes' 2014-07-03 12:53:36 -04:00
Matt Smart
a6cc0e0a0d Fix doc typo.
ERR_get_error(3) references the non-existent
ERR_get_last_error_line_data instead of the one that does exist,
ERR_peek_last_error_line_data.

PR#3283
(cherry picked from commit 5cc99c6cf5)
2014-07-02 03:45:07 +01:00
Jeffrey Walton
02e8d46119 Clarified that the signature's buffer size, s, is not used as an
IN parameter.

Under the old docs, the only thing stated was "at most
EVP_PKEY_size(pkey) bytes will be written". It was kind of misleading
since it appears EVP_PKEY_size(pkey) WILL be written regardless of the
signature's buffer size.

(cherry picked from commit 6e6ba36d98)
2014-06-29 23:36:51 +01:00
Ken Ballou
cb34cb1f23 Typo.
PR#3173
(cherry picked from commit 76ed5a42ea)
2014-06-29 13:39:24 +01:00
Dr. Stephen Henson
14999bcc59 Clarify protocols supported.
Update protocols supported and note that SSLv2 is effectively disabled
by default.

PR#3184
(cherry picked from commit 1b13a4f38dfc385d5e776f6b3e06c5795874cf9b)
2014-06-29 00:04:43 +01:00
Jeffrey Walton
86cac6d3b2 Clarify docs.
Document that the certificate passed to SSL_CTX_add_extra_chain_cert()
should not be freed by the application.

PR#3409
(cherry picked from commit 0535c2d67c)

Add restrictions section present in other branches.

Conflicts:

	doc/ssl/SSL_CTX_add_extra_chain_cert.pod
2014-06-27 16:41:45 +01:00
Hubert Kario
87887a7a65 backport changes to ciphers(1) man page
Backport of the patch:
add ECC strings to ciphers(1), point out difference between DH and ECDH
and few other changes applicable to the 1.0.1 code base.

 * Make a clear distinction between DH and ECDH key exchange.
 * Group all key exchange cipher suite identifiers, first DH then ECDH
 * add descriptions for all supported *DH* identifiers
 * add ECDSA authentication descriptions
 * add example showing how to disable all suites that offer no
   authentication or encryption
 * backport listing of elliptic curve cipher suites.
 * backport listing of TLS 1.2 cipher suites, add note that DH_RSA
   and DH_DSS is not implemented in this version
 * backport of description of PSK and listing of PSK cipher suites
 * backport description of AES128, AES256 and AESGCM options
 * backport description of CAMELLIA128, CAMELLIA256 options
2014-06-10 20:56:39 +01:00
Matt Caswell
151399a944 Fixed minor duplication in docs 2014-06-07 12:32:00 +01:00
Dr. Stephen Henson
aaed77c55e Option to disable padding extension.
Add TLS padding extension to SSL_OP_ALL so it is used with other
"bugs" options and can be turned off.

This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient
option referring to SSLv2 and SSLREF.

PR#3336
2014-06-01 16:50:37 +01:00
Hubert Kario
427a37ca3f add description of -attime to man page
the verify app man page didn't describe the usage of attime option
even though it was listed as a valid option in the -help message.

This patch fixes this omission.
2014-05-30 23:33:10 +01:00
Hubert Kario
39ae3b338f add description of -no_ecdhe option to s_server man page
While the -help message references this option, the man page
doesn't mention the -no_ecdhe option.
This patch fixes this omission.
2014-05-30 23:32:54 +01:00
Matt Caswell
67b9c82ea2 Fixed error in args for SSL_set_msg_callback and SSL_set_msg_callback_arg 2014-05-25 23:48:15 +01:00
Matt Caswell
0a084f7b3a Fixed minor copy&paste error, and stray space causing rendering problem 2014-05-22 00:12:14 +01:00
Dr. Stephen Henson
599fe418a1 Change default cipher in smime app to des3.
PR#3357
(cherry picked from commit ca3ffd9670f2b589bf8cc04923f953e06d6fbc58)
2014-05-21 11:14:33 +01:00
Matt Caswell
d6934a02b5 Moved note about lack of support for AEAD modes out of BUGS section to SUPPORTED CIPHERS section (bug has been fixed, but still no support for AEAD) 2014-05-15 21:17:19 +01:00
Jeffrey Walton
1f5e321ec1 Fix grammar error in verify pod. PR#3355 2014-05-14 22:59:48 +01:00
Jeffrey Walton
b6adb6ef58 Add information to BUGS section of enc documentation. PR#3354 2014-05-14 22:59:48 +01:00
Michal Bozon
bfdaf45141 Corrected POD syntax errors. PR#3353 2014-05-14 22:59:48 +01:00
Jean-Paul Calderone
778f2b648c Correct the return type on the signature for X509_STORE_CTX_get_ex_data given in the pod file. 2014-05-12 22:48:34 +01:00
Jeff Trawick
7fa18a63cb typo in SSL_get_peer_cert_chain docs
RT: 3304
2014-05-02 00:27:37 +01:00
Lubomir Rintel
23f5908ac7 POD: Fix item numbering
Newer pod2man considers =item [1-9] part of a numbered list, while =item
0 starts an unnumbered list. Add a zero effect formatting mark to override
this.

doc/apps/smime.pod around line 315: Expected text after =item, not a
number
...

PR#3146
2014-04-30 23:47:29 +01:00
mancha
e622237d12 Fix version documentation.
Specify -f is for compilation flags. Add -d to synopsis section.

(cherry picked from commit 006397ea62bbcae22c8664d53c2222b808c4bdd1)

Closes .
2014-04-26 11:21:34 +01:00
Dr. Stephen Henson
e3899ababb Document -debug_decrypt option.
(cherry picked from commit 0dd5b94aeb)
2014-04-16 12:36:06 +01:00
Dr. Stephen Henson
602b2790ca Clarify CMS_decrypt behaviour.
(cherry picked from commit 5f8e9a477a)
2014-04-15 18:19:40 +01:00
Dr. Stephen Henson
b05a3ad765 Add new key fingerprint.
(cherry picked from commit 3143a332e8)
2014-04-11 02:51:48 +01:00
Dr. Stephen Henson
0d7717fc9c Document -verify_return_error option.
(cherry picked from commit 4e6c12f308)
2014-04-07 13:04:21 +01:00
Dr. Stephen Henson
6042582b62 Document new crl option.
(cherry picked from commit dbb7654dc1)
2014-04-03 13:37:11 +01:00
Kurt Roeckx
d8ec8a4a65 Fix additional pod errors with numbered items.
(cherry picked from commit e547c45f1c)
2014-02-14 22:35:39 +00:00
Scott Schaefer
040ed7b4d0 Fix various spelling errors
(cherry picked from commit 2b4ffc659e)
2014-02-14 22:35:39 +00:00
Scott Schaefer
c76e5b08a1 Document pkcs12 -password behavior
apps/pkcs12.c accepts -password as an argument.  The document author
almost certainly meant to write "-password, -passin".

However, that is not correct, either.  Actually the code treats
-password as equivalent to -passin, EXCEPT when -export is also
specified, in which case -password as equivalent to -passout.
(cherry picked from commit 856c6dfb09)
2014-02-14 22:35:39 +00:00
Dr. Stephen Henson
f21e6b6ecb Clarify docs.
Remove reference to ERR_TXT_MALLOCED in the error library as that is
only used internally. Indicate that returned error data must not be
freed.
(cherry picked from commit f2d678e6e8)
2014-01-29 01:02:12 +00:00
Dr. Stephen Henson
62c2b6d944 Document RSAPublicKey_{in,out} options.
(cherry picked from commit 7040d73d22987532faa503630d6616cf2788c975)
2013-11-09 15:09:21 +00:00
Rob Stradling
4b61f6d2a6 Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.
OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-16 15:07:51 +01:00
Dr. Stephen Henson
55856a7b74 Correct ECDSA example.
(cherry picked from commit 3a918ea2bbf4175d9461f81be1403d3781b2c0dc)
2013-08-20 17:30:38 +01:00
Nick Alcock
08f8933fa3 Fix POD errors to stop make install_docs dying with pod2man 2.5.0+
podlators 2.5.0 has switched to dying on POD syntax errors. This means
that a bunch of long-standing erroneous POD in the openssl documentation
now leads to fatal errors from pod2man, halting installation.

Unfortunately POD constraints mean that you have to sort numeric lists
in ascending order if they start with 1: you cannot do 1, 0, 2 even if
you want 1 to appear first. I've reshuffled such (alas, I wish there
were a better way but I don't know of one).
(cherry picked from commit 5cc2707742)
2013-02-15 19:40:09 +01:00
Ben Laurie
9d75e765bc Correct EVP_PKEY_verifyrecover to EVP_PKEY_verify_recover (RT 2955). 2013-01-13 23:00:46 +00:00
Ben Laurie
bee0550397 Documentation improvements by Chris Palmer (Google). 2012-12-14 13:29:51 +00:00
Ben Laurie
fc57c58c81 Document -pubkey option. 2012-12-13 16:08:17 +00:00
Dr. Stephen Henson
d6342aab08 correct docs 2012-11-19 20:07:05 +00:00
Richard Levitte
7ad8e1fc4e Correct environment variable is OPENSSL_ALLOW_PROXY_CERTS. 2012-05-04 10:43:22 +00:00
Dr. Stephen Henson
6cbae10b5e update rather ancient EVP digest documentation 2012-04-10 22:28:22 +00:00
Andy Polyakov
1fb07a7de8 doc/apps: formatting fixes [from HEAD].
PR: 2683
Submitted by: Annie Yousar
2012-01-11 21:58:42 +00:00
Andy Polyakov
c6706a6f6c ecdsa.pod: typo.
PR: 2678
Submitted by: Annie Yousar
2012-01-11 21:41:50 +00:00
Dr. Stephen Henson
efbb7ee432 PR: 1794
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Reviewed by: steve

Document unknown_psk_identify alert, remove pre-RFC 5054 string from
ssl_stat.c
2011-11-13 13:13:14 +00:00
Bodo Möller
79571bb1ca Clarify warning 2011-10-13 13:25:03 +00:00
Bodo Möller
1dc4c8c727 Fix typo.
Submitted by: Jim Morrison
2011-07-11 12:13:56 +00:00
Bodo Möller
346601bc32 CVE-2010-4180 fix (from OpenSSL_1_0_0-stable) 2011-02-03 10:42:00 +00:00
Dr. Stephen Henson
61c10d42f6 fix doc typos 2010-12-02 13:45:25 +00:00
Dr. Stephen Henson
0172ad2902 Minor documentation fixes, PR#2345 2010-10-04 13:28:27 +00:00
Dr. Stephen Henson
d9aa352ff0 Minor documentation fixes, PR#2344 2010-10-04 13:24:07 +00:00
Dr. Stephen Henson
ca91057d50 PR: 2252
Submitted By: Ger Hobbelt <ger@hobbelt.com>

Update docs to BIO_f_buffer()
2010-05-03 15:29:51 +00:00
Andy Polyakov
336d1ee733 bss_file.c: reserve for option to encode file name in UTF-8 on Windows
[from HEAD].
2010-04-28 20:04:37 +00:00
Dr. Stephen Henson
acc9938ba5 Add SHA2 algorithms to SSL_library_init(). Although these aren't used
directly by SSL/TLS SHA2 certificates are becoming more common and
applications that only call SSL_library_init() and not
OpenSSL_add_all_alrgorithms() will fail when verifying certificates.

Update docs.
2010-04-07 13:18:30 +00:00
Dr. Stephen Henson
f6d13ac8cf Remove obsolete PRNG note. Add comment about use of SHA256 et al. 2010-04-06 15:05:47 +00:00
Dr. Stephen Henson
24cb653c6b PR: 2209
Submitted Daniel Mentz <danielml@sent.com>

Documentation typo.
2010-04-06 14:45:31 +00:00
Dr. Stephen Henson
6507653e72 The meaning of the X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY and
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT error codes were reversed in
the verify application documentation.
2010-02-23 14:09:22 +00:00
Dr. Stephen Henson
4f3d52fedc clarify documentation 2010-02-18 12:41:50 +00:00
Dr. Stephen Henson
989238802a Allow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as
initial connection to unpatched servers. There are no additional security
concerns in doing this as clients don't see renegotiation during an
attack anyway.
2010-02-17 18:38:10 +00:00
Dr. Stephen Henson
81d87a2a28 update references to new RI RFC 2010-02-12 21:59:57 +00:00
Dr. Stephen Henson
5a6ae115f8 reword RI description 2010-01-27 18:53:49 +00:00
Dr. Stephen Henson
5e5df40b9b update documentation to reflect new renegotiation options 2010-01-27 17:50:20 +00:00
Dr. Stephen Henson
a758f61793 PR: 2157
Submitted by: "Green, Paul" <Paul.Green@stratus.com>

Typo.
2010-01-27 12:55:52 +00:00
Dr. Stephen Henson
1699389a46 Tolerate PKCS#8 DSA format with negative private key. 2010-01-22 20:17:30 +00:00
Dr. Stephen Henson
39f0a4d8e9 typo 2010-01-21 18:46:28 +00:00
Dr. Stephen Henson
93fac08ec3 PR: 2136
Submitted by: Willy Weisz <weisz@vcpc.univie.ac.at>

Add options to output hash using older algorithm compatible with OpenSSL
versions before 1.0.0
2010-01-12 17:27:11 +00:00
Dr. Stephen Henson
4359b88bbe Typo 2010-01-05 17:50:01 +00:00
Dr. Stephen Henson
6e94156199 Remove tabs on blank lines: they produce warnings in pod2man 2010-01-05 17:17:20 +00:00