diff options
author | Matt Caswell <matt@openssl.org> | 2024-01-03 11:03:03 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2024-01-04 16:42:41 +0000 |
commit | 3348713ad390372ba5a0a0f98b46b2f637475e47 (patch) | |
tree | 8f5ed827673e352752d86bb219511f3a859e6768 /doc/man3 | |
parent | 98d6016afec4c0bc7bb8f33b5061beb8528cc74a (diff) | |
download | openssl-3348713ad390372ba5a0a0f98b46b2f637475e47.tar.gz |
Clarify the PKCS12 docs
Issue #23151 asks a question about the meaning of the PKCS12
documentation. This PR attempts to clarify how friendlyName and localKeyID
are added to the PKCS12 structure.
Fixes #23151
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23188)
Diffstat (limited to 'doc/man3')
-rw-r--r-- | doc/man3/PKCS12_create.pod | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/doc/man3/PKCS12_create.pod b/doc/man3/PKCS12_create.pod index 7f913f2fc1..09fc895f18 100644 --- a/doc/man3/PKCS12_create.pod +++ b/doc/man3/PKCS12_create.pod @@ -72,9 +72,15 @@ export grade software which could use signing only keys of arbitrary size but had restrictions on the permissible sizes of keys which could be used for encryption. -If a certificate contains an I<alias> or I<keyid> then this will be -used for the corresponding B<friendlyName> or B<localKeyID> in the -PKCS12 structure. +If I<name> is B<NULL> and I<cert> contains an I<alias> then this will be +used for the corresponding B<friendlyName> in the PKCS12 structure instead. +Similarly, if I<pkey> is NULL and I<cert> contains a I<keyid> then this will be +used for the corresponding B<localKeyID> in the PKCS12 structure instead of the +id calculated from the I<pkey>. + +For all certificates in I<ca> then if a certificate contains an I<alias> or +I<keyid> then this will be used for the corresponding B<friendlyName> or +B<localKeyID> in the PKCS12 structure. Either I<pkey>, I<cert> or both can be B<NULL> to indicate that no key or certificate is required. In previous versions both had to be present or |