aboutsummaryrefslogtreecommitdiffstats
path: root/doc/apps
Commit message (Collapse)AuthorAgeFilesLines
* Fixed languageAlex Gaynor2016-03-191-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fixed a bunch of typos in the docsAlex Gaynor2016-03-1918-24/+24
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* General verify options to openssl tsfbroda2016-03-151-11/+51
| | | | | | | | | | | | | | This commit adds the general verify options of ocsp, verify, cms, etc. to the openssl timestamping app as suggested by Stephen N. Henson in [openssl.org #4287]. The conflicting "-policy" option of "openssl ts" has been renamed to "-tspolicy". Documentation and tests have been updated. CAVE: This will break code, which currently uses the "-policy" option. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add blake2 support.Bill Cox2016-03-111-1/+1
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update ciphers -s documentationKurt Roeckx2016-03-091-3/+15
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Add documentation for new s_server/s_client optionsMatt Caswell2016-03-072-0/+52
| | | | | | Document the new split_send_frag, max_pipelines and read_buf options. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix pkeyutl to KDF lnks.Rich Salz2016-03-071-1/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Update documentationDr. Stephen Henson2016-03-071-23/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* use saner default parameters for scryptDr. Stephen Henson2016-03-051-1/+1
| | | | | | Thanks to Colin Percival for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Documentation for new CT s_client flagsRob Percival2016-03-041-0/+19
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Don't build RC4 ciphersuites into libssl by defaultMatt Caswell2016-03-041-2/+3
| | | | | | | | RC4 based ciphersuites in libssl have been disabled by default. They can be added back by building OpenSSL with the "enable-weak-ssl-ciphers" Configure option at compile time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Improved HKDF and TLS1-PRF documentationViktor Dukhovni2016-03-041-5/+8
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add KDF support to pkeyutl. Update documentation.Dr. Stephen Henson2016-03-031-0/+17
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update documentation of SSL METHODs and ciphersViktor Dukhovni2016-02-233-146/+176
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove unused parameters from internal functionsRich Salz2016-02-221-6/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH721: Duplicated flags in docRich Salz2016-02-221-10/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove "experimental" in code and comments, too.Rich Salz2016-02-173-4/+2
| | | | | | Thanks to Viktor for additional review. Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH650: Minor tidying around the ocsp appBenjamin Kaduk2016-02-131-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ocsp utility is something of a jack-of-all-trades; most anything related to the OCSP can be done with it. In particular, the manual page calls out that it can be used as either a client or a server of the protocol, but there are also a few things that it can do which do not quite fit into either role, such as encoding an OCSP request but not sending it, printing out a text form of an OCSP response (or request) from a file akin to the asn1parse utility, or performing a lookup into the server-side revocation database without actually sending a request or response. All three of these are documented as examples in the manual page, but the documentation prior to this commit is somewhat misleading, in that when printing the text form of an OCSP response, the code also attempts to verify the response, displaying an error message and returning failure if the response does not verify. (It is possible that the response would be able to verify with the given example, since the default trust roots are used for that verification, but OCSP responses frequently have alternate certification authorities that would require passing -CAfile or -CApath for verification.) Tidy up the documentation by passing -noverify for the case of converting from binary to textual representation, and also change a few instances of -respin to -reqin as appropriate, note that the -url option provides the same functionality as the -host and -path options, clarify that the example that saves an OCSP response to a file will also perform verification on that response, and fix a couple grammar nits in the manual page. Also remove an always-true conditional for rdb != NULL -- there are no codepaths in which it could be initialized at the time of this check. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RT 3854: Update apps/reqEmilia Kasper2016-02-121-3/+6
| | | | | | Change the default keysize to 2048 bits, and the minimum to 512 bits. Reviewed-by: Rich Salz <rsalz@openssl.org>
* update ciphers manual pageDr. Stephen Henson2016-02-111-38/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add CHACHA20 alias for ciphers.Todd Short2016-02-101-0/+14
| | | | | | | | | Update ciphers documentation as well (based on -04 rev of ID). Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> RT: #4206, GH: #642
* Make it possible to get ENGINESDIR info from OpenSSL_versionsRichard Levitte2016-02-101-0/+5
| | | | | | | | Have apps/openssl display the result along with OPENSSLDIR As part of this, add ENGINESDIR in util/mk1mf.pl Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate the -issuer_checks debugging optionViktor Dukhovni2016-02-106-54/+175
| | | | | | | | | | | | This was a developer debugging feature and was never a useful public interface. Added all missing X509 error codes to the verify(1) manpage, but many still need a description beyond the associated text string. Sorted the errors in x509_txt.c by error number. Reviewed-by: Stephen Henson <steve@openssl.org>
* Rename INIT funtions, deprecate old ones.Rich Salz2016-02-101-4/+1
| | | | | | Man, there were a lot of renamings :) Reviewed-by: Richard Levitte <levitte@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-081-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* more doc fixesRich Salz2016-02-073-21/+48
| | | | | | | | | | | | | | | | | dgst: using digest instead of specific digest commands the digest list specified in man dgst may be inaccurate, hence using digest and referring to the list in digest-commands 'sha' as a digest name is no longer supported dgst,pkeyutl cmds help cleanup - In dgst, pkeyutl cmds, some options help was missing. - fixed a minor typo in openssl.pod, that fixes make install. - digest-commands was showing ‘sha’, which is not a supported digest anymore. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* commands help cleanupA J Mohan Rao2016-02-062-12/+15
| | | | | | | | opt_valtype 0 is same as '-' while printing cmd usage asn1parse/ca/ciphers help cleanup Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* RT4194: Restore old engine parameter parsing.Rich Salz2016-02-062-1/+96
| | | | | | | | | Allow initial engine names as first parameters before flags. Also add engine param to help summary Wrote manpage Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH601: Various spelling fixes.FdaSilvaYY2016-02-051-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* RT4292: Remove ===== lineRich Salz2016-02-052-1018/+0
| | | | | | Also remove two mistakenly checked-in files. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* RT1596: Add clarifying doc.Rich Salz2016-02-051-1/+2
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH628: Add -help to all apps docs.A J Mohan Rao2016-02-0540-15/+1218
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* GH628: Add -help to all apps docs.Rich Salz2016-02-053-0/+15
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Various RT doc fixesRich Salz2016-02-051-0/+16
| | | | | | | | | | | | | | | | RT1556: doc/crypto/threads.pod RT2024: Missing pages mentioned in crypto.pod RT2890: Wrong size in ERR_string_error description. RT3461: Better description of PEM Encryption (Jeffrey Walton <noloader@gmail.com>) Also, fix up formatting and removed some code examples that encourage unsafe patterns, like unencrypted private keys (Rich Salz) RT4240: Document some speed flags (Tomas Mraz <tmraz@redhat.com>) RT4260: Fix return value doc for X509_REQ_sign and X509_sign (Laetitia Baudoin <lbaudoin@google.com>) Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Restore -no_comp switch for backwards compatible behaviourViktor Dukhovni2016-02-052-0/+30
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Add ec -check optionDr. Stephen Henson2016-02-041-0/+5
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* Fix pkeyutl/rsautl empty encrypt-input/decrypt-output handlingViktor Dukhovni2016-02-022-4/+9
| | | | | | | | | | | | | Also fix option processing in pkeyutl to allow use of (formerly) "out-of-order" switches that were needless implementation limitations. Handle documented "ENGINE" form with -keyform and -peerform. Better handling of OPENSSL_NO_ENGINE and OPENSSL_NO_RSA. RT2018 Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT2353: Add ipsec IKE OIDRich Salz2016-02-021-0/+2
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* GH554: Improve pkeyutl docHubert Kario2016-02-011-0/+13
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* add option to exclude public key from EC keysDr. Stephen Henson2016-02-011-0/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Check chain extensions also for trusted certificatesViktor Dukhovni2016-01-312-13/+22
| | | | | | | | | This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Multiple -trusted/-untrusted/-CRLfile options in verifyViktor Dukhovni2016-01-201-37/+73
| | | | | | | | | | | | | | It is sometimes useful (especially in automated tests) to supply multiple trusted or untrusted certificates via separate files rather than have to prepare a single file containing them all. To that end, change verify(1) to accept these options zero or more times. Also automatically set -no-CAfile and -no-CApath when -trusted is specified. Improve verify(1) documentation, which could still use some work. Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT4232: Extra space in help message.Rich Salz2016-01-141-5/+0
| | | | | | | | | It turns out that -pause calls the undocumented function SSL_set_debug. That just sets flag inside the SSL structure. That flag, despite the command is never used. So remove the flag, the field, and the function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH528: "cipher -v" output is confusing.Rich Salz2016-01-111-5/+3
| | | | | | Fix the docs, and refactor some common code. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* File is about s_time, not s_clientKurt Roeckx2016-01-101-2/+2
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* DANE s_client supportViktor Dukhovni2016-01-071-0/+41
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* mem functions cleanupRich Salz2016-01-071-1/+1
| | | | | | | | | | | | | | | | | Only two macros CRYPTO_MDEBUG and CRYPTO_MDEBUG_ABORT to control this. If CRYPTO_MDEBUG is not set, #ifdef out the whole debug machinery. (Thanks to Jakob Bohm for the suggestion!) Make the "change wrapper functions" be the only paradigm. Wrote documentation! Format the 'set func' functions so their paramlists are legible. Format some multi-line comments. Remove ability to get/set the "memory debug" functions at runtme. Remove MemCheck_* and CRYPTO_malloc_debug_init macros. Add CRYPTO_mem_debug(int flag) function. Add test/memleaktest. Rename CRYPTO_malloc_init to OPENSSL_malloc_init; remove needless calls. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove more (rest?) of FIPS build stuff.Rich Salz2016-01-061-11/+1
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* SSL configuration module docsDr. Stephen Henson2015-12-221-0/+28
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix s_server problem with no-ecMatt Caswell2015-12-151-6/+0
| | | | | | | | | | s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-29 16:59:05 +0000