23 Commits

Author	SHA1	Message	Date
Dr. David von Oheimb	dcac2c9e29	openssl-verification-options.pod: improve description of certificate validation ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18764)	2025-09-09 09:50:04 +02:00
Dr. David von Oheimb	f93fe8c471	openssl-verification-options.pod: better explain trust anchors and chain building ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18764)	2025-09-09 09:50:04 +02:00
Dr. David von Oheimb	adfcb82ca6	openssl-verification-options.pod: Move reference to changes brought by OpenSSL 1.1.0 to HISTORY section ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18764)	2025-09-09 09:50:04 +02:00
openssl-machine	e66332418f	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Release: yes	2025-09-02 13:05:45 +00:00
Clemens Lang	6b93db7bfd	x509: Accept 'contentCommitment' as alias ... ITU-T X.509 (10/2019) section 9.2.2.3 [1] defines 'contentCommitment' as the current name for what had previously been called 'nonRepudiation', and deprecates the old name: > It is not incorrect to refer to this keyUsage bit using the identifier > nonRepudiation. However, the use of this identifier has been > deprecated. Allow 'contentCommitment' as an alias wherever 'nonRepudiation' has been accepted before, so that passing -addext keyUsage=critical,contentCommitment works as expected. Add a test that checks that contentCommitment sets the same keyUsage bit as nonRepudiation. Adjust the docs to mention the available alias name. [1]: https://www.itu.int/rec/T-REC-X.509-201910-I/en Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28161)	2025-08-11 12:00:38 +02:00
Collin Funk	fb6ae00713	doc: fix misspellings of certificate(s) ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27754)	2025-06-05 20:05:30 +10:00
Dr. David von Oheimb	a82c2bf5c9	X509: document non-standard behavior checking EKU extensions in CA and TA certs ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26142)	2024-12-13 08:26:19 +01:00
Tomas Mraz	7ed6de997f	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-09-05 09:35:49 +02:00
Jaime Hablutzel	f159d861e2	Fix typo in openssl-verification-options documentation. ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24662)	2024-06-19 12:57:32 +02:00
Matt Caswell	da1c088f59	Copyright year updates ... Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes	2023-09-07 09:59:15 +01:00
Dr. David von Oheimb	57c0205b4d	APPS: make sure the -CAfile argument can be in DER format ... Note that PKCS#12 input is still not supported here- Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18917)	2023-04-27 15:45:38 +01:00
Lutz Jaenicke	178696d602	X509: Add "code sign" as purpose for verification of certificates ... Code signing certificates have other properties as for example described in CA Browser Forum documents. This leads to "unsupported certificate purpose" errors when verifying signed objects. This patch adds the purpose "codesign" to the table in X.509 certificate verification and the verification parameter "code_sign" to X509_VERIFY_PARAM. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18567)	2022-08-18 10:24:53 +02:00
Matt Caswell	fecb3aae22	Update copyright year ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes	2022-05-03 13:34:51 +01:00
Dimitris Apostolou	e304aa87b3	Fix typos ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17392)	2022-01-05 12:37:20 +01:00
Jaime Hablutzel	028593f546	Typo correction. ... CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16470)	2021-08-30 19:44:52 -05:00
Beat Bolli	c727cddc9c	doc: fix a mistyped "=item" perldoc marker ... Searching didn't reveal any other similar cases. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16354)	2021-08-20 12:06:19 +10:00
Beat Bolli	2fc02378ff	doc: use the documented =item markers ... The generated lists[1] look weird when using a dash as the list item character. Perlpod documents[2] '*' for unordered lists and '1.' (note the period) for ordered lists. Use these characters instead. [1] e.g. https://www.openssl.org/docs/manmaster/man7/migration_guide.html#New-Algorithms [2] https://perldoc.perl.org/perlpod Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16190)	2021-08-04 15:02:27 +10:00
Dr. David von Oheimb	4acda8635e	DOC: Clarify the role of EKUs including defaults for TLS client and server use ... Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14199)	2021-06-26 15:38:40 +02:00
Dr. David von Oheimb	f9ac6f6956	Improve the documentation of cert path building and validation ... Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13735)	2021-06-08 07:47:41 +02:00
Richard Levitte	4333b89f50	Update copyright year ... Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)	2021-01-28 13:54:57 +01:00
Dr. David von Oheimb	c476c06f50	find_issuer(): When returning an expired issuer, take the most recently expired one ... Also point out in the documenting comment that a non-expired issuer is preferred. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13805)	2021-01-14 14:34:00 +01:00
Ankita Shetty	ac093b3fe6	openssl.pod: Carve out Trusted Certificate, Pass Phrase, Name Format, and Format Options ... Move detailed doc to specific new files in doc/man1/openssl-*-options.pod Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13315)	2020-12-05 18:05:30 +01:00
David von Oheimb	b6f18ed2ef	openssl.pod: Move verification doc to new doc/man1/openssl-verification-options.pod ... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13315)	2020-12-05 18:05:30 +01:00