aboutsummaryrefslogtreecommitdiffstats
path: root/doc/apps
Commit message (Collapse)AuthorAgeFilesLines
* Fix various doc nits.Rich Salz2016-06-016-67/+93
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add dhparam sanity check and update DH_check documentationMatt Caswell2016-06-011-1/+2
| | | | | | | | | | | | | The -check argument to dhparam should never identify any problems if we have just generated the parameters. Add a sanity check for this and print an error and fail if necessary. Also updates the documentation for the -check argument, and the DH_check() function. RT#4244 Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT4539: Add section for renamed ciphers.Rich Salz2016-05-311-0/+7
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Support for traditional format private keys.Dr. Stephen Henson2016-05-232-24/+57
| | | | | | | | Add new function PEM_write_bio_PrivateKey_traditional() to enforce the use of legacy "traditional" private key format. Add -traditional option to pkcs8 and pkey utilities. Reviewed-by: Matt Caswell <matt@openssl.org>
* Doc nits cleanup, round 2Rich Salz2016-05-2048-183/+84
| | | | | | | | | | | Fix some code examples, trailing whitespace Fix TBA sections in verify, remove others. Remove empty sections Use Mixed Case not ALL CAPS in head2 Enhance doc-nits script. Remove extra =cut line Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix nits in pod files.Rich Salz2016-05-2037-265/+251
| | | | | | | | | Add doc-nit-check to help find future issues. Make podchecker be almost clean. Remove trailing whitespace. Tab expansion Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use correct EOL in headers.Dr. Stephen Henson2016-05-192-0/+13
| | | | | | RT#1817 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add copyright to manpagesRich Salz2016-05-1948-0/+528
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Ensure =cut is last line in every file.Rich Salz2016-05-197-3/+7
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Document the esc_2254 command line name optionRichard Levitte2016-05-181-1/+6
| | | | | | RT#1466 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Correct documentation on digest used.Dr. Stephen Henson2016-05-131-3/+2
| | | | | | RT#4302 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Correctly check for trailing digest options.Dr. Stephen Henson2016-05-121-15/+16
| | | | | | | | | | Multiple digest options to the ocsp utility are allowed: e.g. to use different digests for different certificate IDs. A digest option without a following certificate is however illegal. RT#4215 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update pkcs8 defaults.Dr. Stephen Henson2016-05-111-24/+22
| | | | | | | | Update pkcs8 utility to use 256 bit AES using SHA256 by default. Update documentation. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add -srp option to ciphers command.Dr. Stephen Henson2016-05-101-6/+10
| | | | | | RT#4224 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Typo.Dr. Stephen Henson2016-05-101-1/+1
| | | | | | RT#4538 Reviewed-by: Matt Caswell <matt@openssl.org>
* GH875: Document -no_check_timeRich Salz2016-05-025-4/+15
| | | | | | | | | | | | Date: Tue Mar 15 15:19:44 2016 +0100 This commit updates the documentation of cms, ocsp, s_client, s_server, and verify to reflect the new "-no_check_time" option introduced in commit d35ff2c0ade0a12e84aaa2e9841b4983a2f3cf45 on 2015-07-31. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix spelling in pod filesFdaSilvaYY2016-05-011-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Suppress CT callback as appropriateViktor Dukhovni2016-04-071-8/+6
| | | | | | | | | | | | | | | | | | | | | | Suppress CT callbacks with aNULL or PSK ciphersuites that involve no certificates. Ditto when the certificate chain is validated via DANE-TA(2) or DANE-EE(3) TLSA records. Also skip SCT processing when the chain is fails verification. Move and consolidate CT callbacks from libcrypto to libssl. We also simplify the interface to SSL_{,CTX_}_enable_ct() which can specify either a permissive mode that just collects information or a strict mode that requires at least one valid SCT or else asks to abort the connection. Simplified SCT processing and options in s_client(1) which now has just a simple pair of "-noct" vs. "-ct" options, the latter enables the permissive callback so that we can complete the handshake and report all relevant information. When printing SCTs, print the validation status if set and not valid. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Move peer chain security checks into x509_vfy.cViktor Dukhovni2016-04-037-23/+49
| | | | | | | | | | | | | | | | | | | A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Fixed languageAlex Gaynor2016-03-191-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fixed a bunch of typos in the docsAlex Gaynor2016-03-1918-24/+24
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* General verify options to openssl tsfbroda2016-03-151-11/+51
| | | | | | | | | | | | | | This commit adds the general verify options of ocsp, verify, cms, etc. to the openssl timestamping app as suggested by Stephen N. Henson in [openssl.org #4287]. The conflicting "-policy" option of "openssl ts" has been renamed to "-tspolicy". Documentation and tests have been updated. CAVE: This will break code, which currently uses the "-policy" option. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add blake2 support.Bill Cox2016-03-111-1/+1
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update ciphers -s documentationKurt Roeckx2016-03-091-3/+15
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Add documentation for new s_server/s_client optionsMatt Caswell2016-03-072-0/+52
| | | | | | Document the new split_send_frag, max_pipelines and read_buf options. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix pkeyutl to KDF lnks.Rich Salz2016-03-071-1/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Update documentationDr. Stephen Henson2016-03-071-23/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* use saner default parameters for scryptDr. Stephen Henson2016-03-051-1/+1
| | | | | | Thanks to Colin Percival for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Documentation for new CT s_client flagsRob Percival2016-03-041-0/+19
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Don't build RC4 ciphersuites into libssl by defaultMatt Caswell2016-03-041-2/+3
| | | | | | | | RC4 based ciphersuites in libssl have been disabled by default. They can be added back by building OpenSSL with the "enable-weak-ssl-ciphers" Configure option at compile time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Improved HKDF and TLS1-PRF documentationViktor Dukhovni2016-03-041-5/+8
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add KDF support to pkeyutl. Update documentation.Dr. Stephen Henson2016-03-031-0/+17
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update documentation of SSL METHODs and ciphersViktor Dukhovni2016-02-233-146/+176
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove unused parameters from internal functionsRich Salz2016-02-221-6/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH721: Duplicated flags in docRich Salz2016-02-221-10/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove "experimental" in code and comments, too.Rich Salz2016-02-173-4/+2
| | | | | | Thanks to Viktor for additional review. Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH650: Minor tidying around the ocsp appBenjamin Kaduk2016-02-131-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ocsp utility is something of a jack-of-all-trades; most anything related to the OCSP can be done with it. In particular, the manual page calls out that it can be used as either a client or a server of the protocol, but there are also a few things that it can do which do not quite fit into either role, such as encoding an OCSP request but not sending it, printing out a text form of an OCSP response (or request) from a file akin to the asn1parse utility, or performing a lookup into the server-side revocation database without actually sending a request or response. All three of these are documented as examples in the manual page, but the documentation prior to this commit is somewhat misleading, in that when printing the text form of an OCSP response, the code also attempts to verify the response, displaying an error message and returning failure if the response does not verify. (It is possible that the response would be able to verify with the given example, since the default trust roots are used for that verification, but OCSP responses frequently have alternate certification authorities that would require passing -CAfile or -CApath for verification.) Tidy up the documentation by passing -noverify for the case of converting from binary to textual representation, and also change a few instances of -respin to -reqin as appropriate, note that the -url option provides the same functionality as the -host and -path options, clarify that the example that saves an OCSP response to a file will also perform verification on that response, and fix a couple grammar nits in the manual page. Also remove an always-true conditional for rdb != NULL -- there are no codepaths in which it could be initialized at the time of this check. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RT 3854: Update apps/reqEmilia Kasper2016-02-121-3/+6
| | | | | | Change the default keysize to 2048 bits, and the minimum to 512 bits. Reviewed-by: Rich Salz <rsalz@openssl.org>
* update ciphers manual pageDr. Stephen Henson2016-02-111-38/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add CHACHA20 alias for ciphers.Todd Short2016-02-101-0/+14
| | | | | | | | | Update ciphers documentation as well (based on -04 rev of ID). Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> RT: #4206, GH: #642
* Make it possible to get ENGINESDIR info from OpenSSL_versionsRichard Levitte2016-02-101-0/+5
| | | | | | | | Have apps/openssl display the result along with OPENSSLDIR As part of this, add ENGINESDIR in util/mk1mf.pl Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate the -issuer_checks debugging optionViktor Dukhovni2016-02-106-54/+175
| | | | | | | | | | | | This was a developer debugging feature and was never a useful public interface. Added all missing X509 error codes to the verify(1) manpage, but many still need a description beyond the associated text string. Sorted the errors in x509_txt.c by error number. Reviewed-by: Stephen Henson <steve@openssl.org>
* Rename INIT funtions, deprecate old ones.Rich Salz2016-02-101-4/+1
| | | | | | Man, there were a lot of renamings :) Reviewed-by: Richard Levitte <levitte@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-081-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* more doc fixesRich Salz2016-02-073-21/+48
| | | | | | | | | | | | | | | | | dgst: using digest instead of specific digest commands the digest list specified in man dgst may be inaccurate, hence using digest and referring to the list in digest-commands 'sha' as a digest name is no longer supported dgst,pkeyutl cmds help cleanup - In dgst, pkeyutl cmds, some options help was missing. - fixed a minor typo in openssl.pod, that fixes make install. - digest-commands was showing ‘sha’, which is not a supported digest anymore. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* commands help cleanupA J Mohan Rao2016-02-062-12/+15
| | | | | | | | opt_valtype 0 is same as '-' while printing cmd usage asn1parse/ca/ciphers help cleanup Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* RT4194: Restore old engine parameter parsing.Rich Salz2016-02-062-1/+96
| | | | | | | | | Allow initial engine names as first parameters before flags. Also add engine param to help summary Wrote manpage Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH601: Various spelling fixes.FdaSilvaYY2016-02-051-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* RT4292: Remove ===== lineRich Salz2016-02-052-1018/+0
| | | | | | Also remove two mistakenly checked-in files. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* RT1596: Add clarifying doc.Rich Salz2016-02-051-1/+2
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-23 05:46:34 +0000