From d35ff2c0ade0a12e84aaa2e9841b4983a2f3cf45 Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Fri, 31 Jul 2015 08:49:50 +0100 Subject: RT3951: Add X509_V_FLAG_NO_CHECK_TIME to suppress time check In some environments, such as firmware, the current system time is entirely meaningless. Provide a clean mechanism to suppress the checks against it. Signed-off-by: Rich Salz Reviewed-by: Tim Hudson --- doc/crypto/X509_VERIFY_PARAM_set_flags.pod | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'doc') diff --git a/doc/crypto/X509_VERIFY_PARAM_set_flags.pod b/doc/crypto/X509_VERIFY_PARAM_set_flags.pod index ec91d5dced..166e316a1e 100644 --- a/doc/crypto/X509_VERIFY_PARAM_set_flags.pod +++ b/doc/crypto/X509_VERIFY_PARAM_set_flags.pod @@ -203,6 +203,10 @@ chain found is not trusted, then OpenSSL will continue to check to see if an alternative chain can be found that is trusted. With this flag set the behaviour will match that of OpenSSL versions prior to 1.1.0. +The B flag suppresses checking the validity period +of certificates and CRLs against the current time. If X509_VERIFY_PARAM_set_time() +is used to specify a verification time, the check is not suppressed. + =head1 NOTES The above functions should be used to manipulate verification parameters -- cgit v1.2.3