55a6250f1e
Only check the CN against DNS name contraints if the `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` flag is not set, and either the certificate has no DNS subject alternative names or the `X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT` flag is set. Add pertinent documentation, and touch up some stale text about name checks and DANE. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> |
||
---|---|---|
.. | ||
HOWTO | ||
man1 | ||
man3 | ||
man5 | ||
man7 | ||
dir-locals.example.el | ||
fingerprints.txt | ||
openssl-c-indent.el | ||
README |
README This file fingerprints.txt PGP fingerprints of authorised release signers standards.txt Moved to the web, https://www.openssl.org/docs/standards.html HOWTO/ A few how-to documents; not necessarily up-to-date man1/ The openssl command-line tools; start with openssl.pod man3/ The SSL library and the crypto library man5/ File formats man7/ Overviews; start with crypto.pod and ssl.pod, for example Algorithm specific EVP_PKEY documentation. Formatted versions of the manpages (apps,ssl,crypto) can be found at https://www.openssl.org/docs/manpages.html