aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/x509/x509_txt.c
Commit message (Collapse)AuthorAgeFilesLines
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-145/+143
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Integrate host, email and IP address checks into X509_verify.Dr. Stephen Henson2012-12-051-0/+6
| | | | | | Add new verify options to set checks. Remove previous -check* commands from s_client and s_server.
* add suite B chain validation flags and associated verify errorsDr. Stephen Henson2012-08-031-0/+12
|
* avoid verification loops in trusted store when path buildingDr. Stephen Henson2010-12-251-0/+2
|
* Add support for CRLs partitioned by reason code.Dr. Stephen Henson2008-08-291-0/+2
| | | | | | Tidy CRL scoring system. Add new CRL path validation error.
* Initial support for name constraints certificate extension.Dr. Stephen Henson2008-08-081-0/+14
| | | | TODO: robustness checking on name forms.
* Typo in x509_txt.c.Andy Polyakov2007-05-191-1/+1
| | | | Submitted by: Martin.Kraemer@Fujitsu-Siemens.com
* Add RFC 3779 support.Ben Laurie2006-11-271-0/+2
|
* Support for AKID in CRLs and partial support for IDP. Overhaul of CRLDr. Stephen Henson2006-09-141-0/+4
| | | | handling to support this.
* Added restrictions on the use of proxy certificates, as they may poseRichard Levitte2005-04-091-0/+2
| | | | a security threat on unexpecting applications. Document and test.
* Add functionality needed to process proxy certificates.Richard Levitte2004-12-281-8/+4
|
* Make an explicit check during certificate validation to see that theRichard Levitte2004-11-291-0/+2
| | | | | | | | | | | CA setting in each certificate on the chain is correct. As a side- effect always do the following basic checks on extensions, not just when there's an associated purpose to the check: - if there is an unhandled critical extension (unless the user has chosen to ignore this fault) - if the path length has been exceeded (if one is set at all) - that certain extensions fit the associated purpose (if one has been given)
* New X509_VERIFY_PARAM structure and associated functionality.Dr. Stephen Henson2004-09-061-0/+9
| | | | | | | | | | This tidies up verify parameters and adds support for integrated policy checking. Add support for policy related command line options. Currently only in smime application. WARNING: experimental code subject to change.
* Various X509 fixes. Disable broken certificate workaroundsDr. Stephen Henson2004-03-051-0/+6
| | | | | | when X509_V_FLAG_X509_STRICT is set. Check for CRLSign in CRL issuer certificates. Reject CRLs with unhandled (any) critical extensions.
* Use BUF_strlcpy() instead of strcpy().Richard Levitte2003-12-271-1/+1
| | | | | | | Use BUF_strlcat() instead of strcat(). Use BIO_snprintf() instead of sprintf(). In some cases, keep better track of buffer lengths. This is part of a large change submitted by Markus Friedl <markus@openbsd.org>
* Reject certificates with unhandled critical extensions.Dr. Stephen Henson2001-10-211-0/+3
|
* Small documentation fixes (Howard Lum <howard@pumpkin.canada.sun.com>)Lutz Jänicke2001-10-081-1/+1
|
* Initial CRL based revocation checking.Dr. Stephen Henson2001-05-071-1/+4
|
* *BIG* verify code reorganisation.Dr. Stephen Henson2000-09-051-0/+9
| | | | | | | | | | | | | | | | | The old code was painfully primitive and couldn't handle distinct certificates using the same subject name. The new code performs several tests on a candidate issuer certificate based on certificate extensions. It also adds several callbacks to X509_VERIFY_CTX so its behaviour can be customised. Unfortunately some hackery was needed to persuade X509_STORE to tolerate this. This should go away when X509_STORE is replaced, sometime... This must have broken something though :-(
* Add trust setting support to the verify code. It now checks theDr. Stephen Henson1999-11-271-0/+4
| | | | | | | | trust settings of the root CA. After a few fixes it seems to work OK. Still need to add support to SSL and S/MIME code though.
* Initial chain verify code: not tested probably not workingDr. Stephen Henson1999-11-241-0/+6
| | | | | at present. However nothing enables it yet so this doesn't matter :-)
* Initial support for MacOS.Andy Polyakov1999-09-111-1/+0
| | | | | | | | | | | | | | This will soon be complemented with MacOS specific source code files and INSTALL.MacOS. I (Andy) have decided to get rid of a number of #include <sys/types.h>. I've verified it's ok (both by examining /usr/include/*.h and compiling) on a number of Unix platforms. Unfortunately I don't have Windows box to verify this on. I really appreciate if somebody could try to compile it and contact me a.s.a.p. in case a problem occurs. Submitted by: Roy Wood <roy@centricsystems.ca> Reviewed by: Andy Polyakov <appro@fy.chalmers.se>
* Change #include filenames from <foo.h> to <openssl.h>.Bodo Möller1999-04-231-6/+6
| | | | | | Submitted by: Reviewed by: PR:
* Change functions to ANSI C.Ulf Möller1999-04-191-2/+1
|
* Massive constification.Ben Laurie1999-04-171-1/+1
|
* Make sure a corresponding plain text error message exists for theRalf S. Engelschall1999-04-121-0/+2
| | | | | X509_V_ERR_CERT_REVOKED/23 error number which can occur when a verify callback function determined that a certificate was revoked.
* More pissing about to get pem.h to behave properly.Ben Laurie1999-01-301-1/+0
|
* Import of old SSLeay release: SSLeay 0.9.0bRalf S. Engelschall1998-12-211-6/+8
|
* Import of old SSLeay release: SSLeay 0.8.1bRalf S. Engelschall1998-12-211-0/+130
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-14 04:13:40 +0000