926 lines
39 KiB
HTML
926 lines
39 KiB
HTML
|
<?xml version="1.0" ?>
|
||
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||
|
|
<head>
|
||
|
|
<title>verify</title>
|
||
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||
|
|
<link rev="made" href="mailto:root@localhost" />
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body style="background-color: white">
|
||
|
|
|
||
|
|
|
||
|
|
<!-- INDEX BEGIN -->
|
||
|
|
<div name="index">
|
||
|
|
<p><a name="__index__"></a></p>
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
|
||
|
|
<li><a href="#name">NAME</a></li>
|
||
|
|
<li><a href="#synopsis">SYNOPSIS</a></li>
|
||
|
|
<li><a href="#description">DESCRIPTION</a></li>
|
||
|
|
<li><a href="#options">OPTIONS</a></li>
|
||
|
|
<li><a href="#verify_operation">VERIFY OPERATION</a></li>
|
||
|
|
<li><a href="#diagnostics">DIAGNOSTICS</a></li>
|
||
|
|
<li><a href="#bugs">BUGS</a></li>
|
||
|
|
<li><a href="#see_also">SEE ALSO</a></li>
|
||
|
|
<li><a href="#history">HISTORY</a></li>
|
||
|
|
<li><a href="#copyright">COPYRIGHT</a></li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
<hr name="index" />
|
||
|
|
</div>
|
||
|
|
<!-- INDEX END -->
|
||
|
|
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="name">NAME</a></h1>
|
||
|
|
<p>openssl-verify,
|
||
|
|
verify - Utility to verify certificates</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="synopsis">SYNOPSIS</a></h1>
|
||
|
|
<p><strong>openssl</strong> <strong>verify</strong>
|
||
|
|
[<strong>-help</strong>]
|
||
|
|
[<strong>-CAfile file</strong>]
|
||
|
|
[<strong>-CApath directory</strong>]
|
||
|
|
[<strong>-no-CAfile</strong>]
|
||
|
|
[<strong>-no-CApath</strong>]
|
||
|
|
[<strong>-allow_proxy_certs</strong>]
|
||
|
|
[<strong>-attime timestamp</strong>]
|
||
|
|
[<strong>-check_ss_sig</strong>]
|
||
|
|
[<strong>-CRLfile file</strong>]
|
||
|
|
[<strong>-crl_download</strong>]
|
||
|
|
[<strong>-crl_check</strong>]
|
||
|
|
[<strong>-crl_check_all</strong>]
|
||
|
|
[<strong>-engine id</strong>]
|
||
|
|
[<strong>-explicit_policy</strong>]
|
||
|
|
[<strong>-extended_crl</strong>]
|
||
|
|
[<strong>-ignore_critical</strong>]
|
||
|
|
[<strong>-inhibit_any</strong>]
|
||
|
|
[<strong>-inhibit_map</strong>]
|
||
|
|
[<strong>-nameopt option</strong>]
|
||
|
|
[<strong>-no_check_time</strong>]
|
||
|
|
[<strong>-partial_chain</strong>]
|
||
|
|
[<strong>-policy arg</strong>]
|
||
|
|
[<strong>-policy_check</strong>]
|
||
|
|
[<strong>-policy_print</strong>]
|
||
|
|
[<strong>-purpose purpose</strong>]
|
||
|
|
[<strong>-suiteB_128</strong>]
|
||
|
|
[<strong>-suiteB_128_only</strong>]
|
||
|
|
[<strong>-suiteB_192</strong>]
|
||
|
|
[<strong>-trusted_first</strong>]
|
||
|
|
[<strong>-no_alt_chains</strong>]
|
||
|
|
[<strong>-untrusted file</strong>]
|
||
|
|
[<strong>-trusted file</strong>]
|
||
|
|
[<strong>-use_deltas</strong>]
|
||
|
|
[<strong>-verbose</strong>]
|
||
|
|
[<strong>-auth_level level</strong>]
|
||
|
|
[<strong>-verify_depth num</strong>]
|
||
|
|
[<strong>-verify_email email</strong>]
|
||
|
|
[<strong>-verify_hostname hostname</strong>]
|
||
|
|
[<strong>-verify_ip ip</strong>]
|
||
|
|
[<strong>-verify_name name</strong>]
|
||
|
|
[<strong>-x509_strict</strong>]
|
||
|
|
[<strong>-show_chain</strong>]
|
||
|
|
[<strong>-</strong>]
|
||
|
|
[certificates]</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="description">DESCRIPTION</a></h1>
|
||
|
|
<p>The <strong>verify</strong> command verifies certificate chains.</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="options">OPTIONS</a></h1>
|
||
|
|
<dl>
|
||
|
|
<dt><strong><a name="help" class="item"><strong>-help</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Print out a usage message.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="cafile_file" class="item"><strong>-CAfile file</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>A <strong>file</strong> of trusted certificates.
|
||
|
|
The file should contain one or more certificates in PEM format.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="capath_directory" class="item"><strong>-CApath directory</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>A directory of trusted certificates. The certificates should have names
|
||
|
|
of the form: hash.0 or have symbolic links to them of this
|
||
|
|
form ("hash" is the hashed certificate subject name: see the <strong>-hash</strong> option
|
||
|
|
of the <strong>x509</strong> utility). Under Unix the <strong>c_rehash</strong> script will automatically
|
||
|
|
create symbolic links to a directory of certificates.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="no_cafile" class="item"><strong>-no-CAfile</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Do not load the trusted CA certificates from the default file location.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="no_capath" class="item"><strong>-no-CApath</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Do not load the trusted CA certificates from the default directory location.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="allow_proxy_certs" class="item"><strong>-allow_proxy_certs</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Allow the verification of proxy certificates.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="attime_timestamp" class="item"><strong>-attime timestamp</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Perform validation checks using time specified by <strong>timestamp</strong> and not
|
||
|
|
current system time. <strong>timestamp</strong> is the number of seconds since
|
||
|
|
01.01.1970 (UNIX time).</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="check_ss_sig" class="item"><strong>-check_ss_sig</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Verify the signature on the self-signed root CA. This is disabled by default
|
||
|
|
because it doesn't add any security.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="crlfile_file" class="item"><strong>-CRLfile file</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The <strong>file</strong> should contain one or more CRLs in PEM format.
|
||
|
|
This option can be specified more than once to include CRLs from multiple
|
||
|
|
<strong>files</strong>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="crl_download" class="item"><strong>-crl_download</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Attempt to download CRL information for this certificate.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="crl_check" class="item"><strong>-crl_check</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Checks end entity certificate validity by attempting to look up a valid CRL.
|
||
|
|
If a valid CRL cannot be found an error occurs.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="crl_check_all" class="item"><strong>-crl_check_all</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Checks the validity of <strong>all</strong> certificates in the chain by attempting
|
||
|
|
to look up valid CRLs.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="engine_id" class="item"><strong>-engine id</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Specifying an engine <strong>id</strong> will cause <em>verify(1)</em> to attempt to load the
|
||
|
|
specified engine.
|
||
|
|
The engine will then be set as the default for all its supported algorithms.
|
||
|
|
If you want to load certificates or CRLs that require engine support via any of
|
||
|
|
the <strong>-trusted</strong>, <strong>-untrusted</strong> or <strong>-CRLfile</strong> options, the <strong>-engine</strong> option
|
||
|
|
must be specified before those options.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="explicit_policy" class="item"><strong>-explicit_policy</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Set policy variable require-explicit-policy (see <a href="http://www.ietf.org/rfc/rfc5280.txt" class="rfc">RFC5280</a>).</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="extended_crl" class="item"><strong>-extended_crl</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Enable extended CRL features such as indirect CRLs and alternate CRL
|
||
|
|
signing keys.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="ignore_critical" class="item"><strong>-ignore_critical</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Normally if an unhandled critical extension is present which is not
|
||
|
|
supported by OpenSSL the certificate is rejected (as required by <a href="http://www.ietf.org/rfc/rfc5280.txt" class="rfc">RFC5280</a>).
|
||
|
|
If this option is set critical extensions are ignored.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="inhibit_any" class="item"><strong>-inhibit_any</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Set policy variable inhibit-any-policy (see <a href="http://www.ietf.org/rfc/rfc5280.txt" class="rfc">RFC5280</a>).</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="inhibit_map" class="item"><strong>-inhibit_map</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Set policy variable inhibit-policy-mapping (see <a href="http://www.ietf.org/rfc/rfc5280.txt" class="rfc">RFC5280</a>).</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="nameopt_option" class="item"><strong>-nameopt option</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Option which determines how the subject or issuer names are displayed. The
|
||
|
|
<strong>option</strong> argument can be a single option or multiple options separated by
|
||
|
|
commas. Alternatively the <strong>-nameopt</strong> switch may be used more than once to
|
||
|
|
set multiple options. See the <em>x509(1)</em> manual page for details.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="no_check_time" class="item"><strong>-no_check_time</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>This option suppresses checking the validity period of certificates and CRLs
|
||
|
|
against the current time. If option <strong>-attime timestamp</strong> is used to specify
|
||
|
|
a verification time, the check is not suppressed.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="partial_chain" class="item"><strong>-partial_chain</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Allow verification to succeed even if a <em>complete</em> chain cannot be built to a
|
||
|
|
self-signed trust-anchor, provided it is possible to construct a chain to a
|
||
|
|
trusted certificate that might not be self-signed.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="policy_arg" class="item"><strong>-policy arg</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Enable policy processing and add <strong>arg</strong> to the user-initial-policy-set (see
|
||
|
|
<a href="http://www.ietf.org/rfc/rfc5280.txt" class="rfc">RFC5280</a>). The policy <strong>arg</strong> can be an object name an OID in numeric form.
|
||
|
|
This argument can appear more than once.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="policy_check" class="item"><strong>-policy_check</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Enables certificate policy processing.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="policy_print" class="item"><strong>-policy_print</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Print out diagnostics related to policy processing.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="purpose_purpose" class="item"><strong>-purpose purpose</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The intended use for the certificate. If this option is not specified,
|
||
|
|
<strong>verify</strong> will not consider certificate purpose during chain verification.
|
||
|
|
Currently accepted uses are <strong>sslclient</strong>, <strong>sslserver</strong>, <strong>nssslserver</strong>,
|
||
|
|
<strong>smimesign</strong>, <strong>smimeencrypt</strong>. See the <strong>VERIFY OPERATION</strong> section for more
|
||
|
|
information.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="suiteb_128_only_suiteb_128_suiteb_192" class="item"><strong>-suiteB_128_only</strong>, <strong>-suiteB_128</strong>, <strong>-suiteB_192</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
|
||
|
|
192 bit, or only 192 bit Level of Security respectively.
|
||
|
|
See <a href="http://www.ietf.org/rfc/rfc6460.txt" class="rfc">RFC6460</a> for details. In particular the supported signature algorithms are
|
||
|
|
reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves
|
||
|
|
P-256 and P-384.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="trusted_first" class="item"><strong>-trusted_first</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>When constructing the certificate chain, use the trusted certificates specified
|
||
|
|
via <strong>-CAfile</strong>, <strong>-CApath</strong> or <strong>-trusted</strong> before any certificates specified via
|
||
|
|
<strong>-untrusted</strong>.
|
||
|
|
This can be useful in environments with Bridge or Cross-Certified CAs.
|
||
|
|
As of OpenSSL 1.1.0 this option is on by default and cannot be disabled.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="no_alt_chains" class="item"><strong>-no_alt_chains</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>By default, unless <strong>-trusted_first</strong> is specified, when building a certificate
|
||
|
|
chain, if the first certificate chain found is not trusted, then OpenSSL will
|
||
|
|
attempt to replace untrusted issuer certificates with certificates from the
|
||
|
|
trust store to see if an alternative chain can be found that is trusted.
|
||
|
|
As of OpenSSL 1.1.0, with <strong>-trusted_first</strong> always on, this option has no
|
||
|
|
effect.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="untrusted_file" class="item"><strong>-untrusted file</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>A <strong>file</strong> of additional untrusted certificates (intermediate issuer CAs) used
|
||
|
|
to construct a certificate chain from the subject certificate to a trust-anchor.
|
||
|
|
The <strong>file</strong> should contain one or more certificates in PEM format.
|
||
|
|
This option can be specified more than once to include untrusted certificates
|
||
|
|
from multiple <strong>files</strong>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="trusted_file" class="item"><strong>-trusted file</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>A <strong>file</strong> of trusted certificates, which must be self-signed, unless the
|
||
|
|
<strong>-partial_chain</strong> option is specified.
|
||
|
|
The <strong>file</strong> contains one or more certificates in PEM format.
|
||
|
|
With this option, no additional (e.g., default) certificate lists are
|
||
|
|
consulted.
|
||
|
|
That is, the only trust-anchors are those listed in <strong>file</strong>.
|
||
|
|
This option can be specified more than once to include trusted certificates
|
||
|
|
from multiple <strong>files</strong>.
|
||
|
|
This option implies the <strong>-no-CAfile</strong> and <strong>-no-CApath</strong> options.
|
||
|
|
This option cannot be used in combination with either of the <strong>-CAfile</strong> or
|
||
|
|
<strong>-CApath</strong> options.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="use_deltas" class="item"><strong>-use_deltas</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Enable support for delta CRLs.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="verbose" class="item"><strong>-verbose</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Print extra information about the operations being performed.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="auth_level_level" class="item"><strong>-auth_level level</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Set the certificate chain authentication security level to <strong>level</strong>.
|
||
|
|
The authentication security level determines the acceptable signature and
|
||
|
|
public key strength when verifying certificate chains.
|
||
|
|
For a certificate chain to validate, the public keys of all the certificates
|
||
|
|
must meet the specified security <strong>level</strong>.
|
||
|
|
The signature algorithm security level is enforced for all the certificates in
|
||
|
|
the chain except for the chain's <em>trust anchor</em>, which is either directly
|
||
|
|
trusted or validated by means other than its signature.
|
||
|
|
See <em>SSL_CTX_set_security_level(3)</em> for the definitions of the available
|
||
|
|
levels.
|
||
|
|
The default security level is -1, or "not set".
|
||
|
|
At security level 0 or lower all algorithms are acceptable.
|
||
|
|
Security level 1 requires at least 80-bit-equivalent security and is broadly
|
||
|
|
interoperable, though it will, for example, reject MD5 signatures or RSA keys
|
||
|
|
shorter than 1024 bits.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="verify_depth_num" class="item"><strong>-verify_depth num</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Limit the certificate chain to <strong>num</strong> intermediate CA certificates.
|
||
|
|
A maximal depth chain can have up to <strong>num+2</strong> certificates, since neither the
|
||
|
|
end-entity certificate nor the trust-anchor certificate count against the
|
||
|
|
<strong>-verify_depth</strong> limit.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="verify_email_email" class="item"><strong>-verify_email email</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Verify if the <strong>email</strong> matches the email address in Subject Alternative Name or
|
||
|
|
the email in the subject Distinguished Name.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="verify_hostname_hostname" class="item"><strong>-verify_hostname hostname</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Verify if the <strong>hostname</strong> matches DNS name in Subject Alternative Name or
|
||
|
|
Common Name in the subject certificate.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="verify_ip_ip" class="item"><strong>-verify_ip ip</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Verify if the <strong>ip</strong> matches the IP address in Subject Alternative Name of
|
||
|
|
the subject certificate.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="verify_name_name" class="item"><strong>-verify_name name</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Use default verification policies like trust model and required certificate
|
||
|
|
policies identified by <strong>name</strong>.
|
||
|
|
The trust model determines which auxiliary trust or reject OIDs are applicable
|
||
|
|
to verifying the given certificate chain.
|
||
|
|
See the <strong>-addtrust</strong> and <strong>-addreject</strong> options of the <em>x509(1)</em> command-line
|
||
|
|
utility.
|
||
|
|
Supported policy names include: <strong>default</strong>, <strong>pkcs7</strong>, <strong>smime_sign</strong>,
|
||
|
|
<strong>ssl_client</strong>, <strong>ssl_server</strong>.
|
||
|
|
These mimics the combinations of purpose and trust settings used in SSL, CMS
|
||
|
|
and S/MIME.
|
||
|
|
As of OpenSSL 1.1.0, the trust model is inferred from the purpose when not
|
||
|
|
specified, so the <strong>-verify_name</strong> options are functionally equivalent to the
|
||
|
|
corresponding <strong>-purpose</strong> settings.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_strict" class="item"><strong>-x509_strict</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>For strict X.509 compliance, disable non-compliant workarounds for broken
|
||
|
|
certificates.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="show_chain" class="item"><strong>-show_chain</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Display information about the certificate chain that has been built (if
|
||
|
|
successful). Certificates in the chain that came from the untrusted list will be
|
||
|
|
flagged as "untrusted".</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="_" class="item"><strong>-</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Indicates the last option. All arguments following this are assumed to be
|
||
|
|
certificate files. This is useful if the first certificate filename begins
|
||
|
|
with a <strong>-</strong>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="certificates" class="item"><strong>certificates</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>One or more certificates to verify. If no certificates are given, <strong>verify</strong>
|
||
|
|
will attempt to read a certificate from standard input. Certificates must be
|
||
|
|
in PEM format.</p>
|
||
|
|
</dd>
|
||
|
|
</dl>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="verify_operation">VERIFY OPERATION</a></h1>
|
||
|
|
<p>The <strong>verify</strong> program uses the same functions as the internal SSL and S/MIME
|
||
|
|
verification, therefore this description applies to these verify operations
|
||
|
|
too.</p>
|
||
|
|
<p>There is one crucial difference between the verify operations performed
|
||
|
|
by the <strong>verify</strong> program: wherever possible an attempt is made to continue
|
||
|
|
after an error whereas normally the verify operation would halt on the
|
||
|
|
first error. This allows all the problems with a certificate chain to be
|
||
|
|
determined.</p>
|
||
|
|
<p>The verify operation consists of a number of separate steps.</p>
|
||
|
|
<p>Firstly a certificate chain is built up starting from the supplied certificate
|
||
|
|
and ending in the root CA.
|
||
|
|
It is an error if the whole chain cannot be built up.
|
||
|
|
The chain is built up by looking up the issuers certificate of the current
|
||
|
|
certificate.
|
||
|
|
If a certificate is found which is its own issuer it is assumed to be the root
|
||
|
|
CA.</p>
|
||
|
|
<p>The process of 'looking up the issuers certificate' itself involves a number of
|
||
|
|
steps.
|
||
|
|
After all certificates whose subject name matches the issuer name of the current
|
||
|
|
certificate are subject to further tests.
|
||
|
|
The relevant authority key identifier components of the current certificate (if
|
||
|
|
present) must match the subject key identifier (if present) and issuer and
|
||
|
|
serial number of the candidate issuer, in addition the keyUsage extension of
|
||
|
|
the candidate issuer (if present) must permit certificate signing.</p>
|
||
|
|
<p>The lookup first looks in the list of untrusted certificates and if no match
|
||
|
|
is found the remaining lookups are from the trusted certificates. The root CA
|
||
|
|
is always looked up in the trusted certificate list: if the certificate to
|
||
|
|
verify is a root certificate then an exact match must be found in the trusted
|
||
|
|
list.</p>
|
||
|
|
<p>The second operation is to check every untrusted certificate's extensions for
|
||
|
|
consistency with the supplied purpose. If the <strong>-purpose</strong> option is not included
|
||
|
|
then no checks are done. The supplied or "leaf" certificate must have extensions
|
||
|
|
compatible with the supplied purpose and all other certificates must also be valid
|
||
|
|
CA certificates. The precise extensions required are described in more detail in
|
||
|
|
the <strong>CERTIFICATE EXTENSIONS</strong> section of the <strong>x509</strong> utility.</p>
|
||
|
|
<p>The third operation is to check the trust settings on the root CA. The root CA
|
||
|
|
should be trusted for the supplied purpose.
|
||
|
|
For compatibility with previous versions of OpenSSL, a certificate with no
|
||
|
|
trust settings is considered to be valid for all purposes.</p>
|
||
|
|
<p>The final operation is to check the validity of the certificate chain. The validity
|
||
|
|
period is checked against the current system time and the notBefore and notAfter
|
||
|
|
dates in the certificate. The certificate signatures are also checked at this
|
||
|
|
point.</p>
|
||
|
|
<p>If all operations complete successfully then certificate is considered valid. If
|
||
|
|
any operation fails then the certificate is not valid.</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="diagnostics">DIAGNOSTICS</a></h1>
|
||
|
|
<p>When a verify operation fails the output messages can be somewhat cryptic. The
|
||
|
|
general form of the error message is:</p>
|
||
|
|
<pre>
|
||
|
|
server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
|
||
|
|
error 24 at 1 depth lookup:invalid CA certificate</pre>
|
||
|
|
<p>The first line contains the name of the certificate being verified followed by
|
||
|
|
the subject name of the certificate. The second line contains the error number
|
||
|
|
and the depth. The depth is number of the certificate being verified when a
|
||
|
|
problem was detected starting with zero for the certificate being verified itself
|
||
|
|
then 1 for the CA that signed the certificate and so on. Finally a text version
|
||
|
|
of the error number is presented.</p>
|
||
|
|
<p>A partial list of the error codes and messages is shown below, this also
|
||
|
|
includes the name of the error code as defined in the header file x509_vfy.h
|
||
|
|
Some of the error codes are defined but never returned: these are described
|
||
|
|
as "unused".</p>
|
||
|
|
<dl>
|
||
|
|
<dt><strong><a name="x509_v_ok" class="item"><strong>X509_V_OK</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The operation was successful.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unspecified" class="item"><strong>X509_V_ERR_UNSPECIFIED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unspecified error; should not happen.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_get_issuer_cert" class="item"><strong>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The issuer certificate of a looked up certificate could not be found. This
|
||
|
|
normally means the list of trusted certificates is not complete.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_get_crl" class="item"><strong>X509_V_ERR_UNABLE_TO_GET_CRL</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The CRL of a certificate could not be found.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_decrypt_cert_signature" class="item"><strong>X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate signature could not be decrypted. This means that the
|
||
|
|
actual signature value could not be determined rather than it not matching
|
||
|
|
the expected value, this is only meaningful for RSA keys.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_decrypt_crl_signature" class="item"><strong>X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The CRL signature could not be decrypted: this means that the actual
|
||
|
|
signature value could not be determined rather than it not matching the
|
||
|
|
expected value. Unused.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_decode_issuer_public_key" class="item"><strong>X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The public key in the certificate SubjectPublicKeyInfo could not be read.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_cert_signature_failure" class="item"><strong>X509_V_ERR_CERT_SIGNATURE_FAILURE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The signature of the certificate is invalid.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_crl_signature_failure" class="item"><strong>X509_V_ERR_CRL_SIGNATURE_FAILURE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The signature of the certificate is invalid.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_cert_not_yet_valid" class="item"><strong>X509_V_ERR_CERT_NOT_YET_VALID</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate is not yet valid: the notBefore date is after the
|
||
|
|
current time.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_cert_has_expired" class="item"><strong>X509_V_ERR_CERT_HAS_EXPIRED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate has expired: that is the notAfter date is before the
|
||
|
|
current time.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_crl_not_yet_valid" class="item"><strong>X509_V_ERR_CRL_NOT_YET_VALID</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The CRL is not yet valid.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_crl_has_expired" class="item"><strong>X509_V_ERR_CRL_HAS_EXPIRED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The CRL has expired.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_error_in_cert_not_before_field" class="item"><strong>X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate notBefore field contains an invalid time.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_error_in_cert_not_after_field" class="item"><strong>X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate notAfter field contains an invalid time.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_error_in_crl_last_update_field" class="item"><strong>X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The CRL lastUpdate field contains an invalid time.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_error_in_crl_next_update_field" class="item"><strong>X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The CRL nextUpdate field contains an invalid time.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_out_of_mem" class="item"><strong>X509_V_ERR_OUT_OF_MEM</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>An error occurred trying to allocate memory. This should never happen.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_depth_zero_self_signed_cert" class="item"><strong>X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The passed certificate is self-signed and the same certificate cannot
|
||
|
|
be found in the list of trusted certificates.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_self_signed_cert_in_chain" class="item"><strong>X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate chain could be built up using the untrusted certificates
|
||
|
|
but the root could not be found locally.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_get_issuer_cert_locally" class="item"><strong>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The issuer certificate could not be found: this occurs if the issuer
|
||
|
|
certificate of an untrusted certificate cannot be found.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_verify_leaf_signature" class="item"><strong>X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>No signatures could be verified because the chain contains only one
|
||
|
|
certificate and it is not self signed.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_cert_chain_too_long" class="item"><strong>X509_V_ERR_CERT_CHAIN_TOO_LONG</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate chain length is greater than the supplied maximum
|
||
|
|
depth. Unused.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_cert_revoked" class="item"><strong>X509_V_ERR_CERT_REVOKED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The certificate has been revoked.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_invalid_ca" class="item"><strong>X509_V_ERR_INVALID_CA</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>A CA certificate is invalid. Either it is not a CA or its extensions
|
||
|
|
are not consistent with the supplied purpose.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_path_length_exceeded" class="item"><strong>X509_V_ERR_PATH_LENGTH_EXCEEDED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The basicConstraints pathlength parameter has been exceeded.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_invalid_purpose" class="item"><strong>X509_V_ERR_INVALID_PURPOSE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The supplied certificate cannot be used for the specified purpose.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_cert_untrusted" class="item"><strong>X509_V_ERR_CERT_UNTRUSTED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The root CA is not marked as trusted for the specified purpose.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_cert_rejected" class="item"><strong>X509_V_ERR_CERT_REJECTED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The root CA is marked to reject the specified purpose.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_subject_issuer_mismatch" class="item"><strong>X509_V_ERR_SUBJECT_ISSUER_MISMATCH</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
|
||
|
|
<strong>-issuer_checks</strong> option.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_akid_skid_mismatch" class="item"><strong>X509_V_ERR_AKID_SKID_MISMATCH</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
|
||
|
|
<strong>-issuer_checks</strong> option.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_akid_issuer_serial_mismatch" class="item"><strong>X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
|
||
|
|
<strong>-issuer_checks</strong> option.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_keyusage_no_certsign" class="item"><strong>X509_V_ERR_KEYUSAGE_NO_CERTSIGN</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
|
||
|
|
<strong>-issuer_checks</strong> option.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unable_to_get_crl_issuer" class="item"><strong>X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unable to get CRL issuer certificate.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unhandled_critical_extension" class="item"><strong>X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unhandled critical extension.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_keyusage_no_crl_sign" class="item"><strong>X509_V_ERR_KEYUSAGE_NO_CRL_SIGN</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Key usage does not include CRL signing.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unhandled_critical_crl_extension" class="item"><strong>X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unhandled critical CRL extension.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_invalid_non_ca" class="item"><strong>X509_V_ERR_INVALID_NON_CA</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Invalid non-CA certificate has CA markings.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_proxy_path_length_exceeded" class="item"><strong>X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Proxy path length constraint exceeded.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_proxy_subject_invalid" class="item"><strong>X509_V_ERR_PROXY_SUBJECT_INVALID</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Proxy certificate subject is invalid. It MUST be the same as the issuer
|
||
|
|
with a single CN component added.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_keyusage_no_digital_signature" class="item"><strong>X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Key usage does not include digital signature.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_proxy_certificates_not_allowed" class="item"><strong>X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Proxy certificates not allowed, please use <strong>-allow_proxy_certs</strong>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_invalid_extension" class="item"><strong>X509_V_ERR_INVALID_EXTENSION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Invalid or inconsistent certificate extension.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_invalid_policy_extension" class="item"><strong>X509_V_ERR_INVALID_POLICY_EXTENSION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Invalid or inconsistent certificate policy extension.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_no_explicit_policy" class="item"><strong>X509_V_ERR_NO_EXPLICIT_POLICY</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>No explicit policy.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_different_crl_scope" class="item"><strong>X509_V_ERR_DIFFERENT_CRL_SCOPE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Different CRL scope.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unsupported_extension_feature" class="item"><strong>X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unsupported extension feature.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unnested_resource" class="item"><strong>X509_V_ERR_UNNESTED_RESOURCE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>RFC 3779 resource not subset of parent's resources.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_permitted_violation" class="item"><strong>X509_V_ERR_PERMITTED_VIOLATION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Permitted subtree violation.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_excluded_violation" class="item"><strong>X509_V_ERR_EXCLUDED_VIOLATION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Excluded subtree violation.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_subtree_minmax" class="item"><strong>X509_V_ERR_SUBTREE_MINMAX</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Name constraints minimum and maximum not supported.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_application_verification" class="item"><strong>X509_V_ERR_APPLICATION_VERIFICATION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Application verification failure. Unused.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unsupported_constraint_type" class="item"><strong>X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unsupported name constraint type.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unsupported_constraint_syntax" class="item"><strong>X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unsupported or invalid name constraint syntax.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_unsupported_name_syntax" class="item"><strong>X509_V_ERR_UNSUPPORTED_NAME_SYNTAX</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Unsupported or invalid name syntax.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_crl_path_validation_error" class="item"><strong>X509_V_ERR_CRL_PATH_VALIDATION_ERROR</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>CRL path validation error.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_path_loop" class="item"><strong>X509_V_ERR_PATH_LOOP</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Path loop.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_suite_b_invalid_version" class="item"><strong>X509_V_ERR_SUITE_B_INVALID_VERSION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Suite B: certificate version invalid.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_suite_b_invalid_algorithm" class="item"><strong>X509_V_ERR_SUITE_B_INVALID_ALGORITHM</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Suite B: invalid public key algorithm.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_suite_b_invalid_curve" class="item"><strong>X509_V_ERR_SUITE_B_INVALID_CURVE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Suite B: invalid ECC curve.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_suite_b_invalid_signature_algorithm" class="item"><strong>X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Suite B: invalid signature algorithm.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_suite_b_los_not_allowed" class="item"><strong>X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Suite B: curve not allowed for this LOS.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_suite_b_cannot_sign_p_384_with_p_256" class="item"><strong>X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Suite B: cannot sign P-384 with P-256.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_hostname_mismatch" class="item"><strong>X509_V_ERR_HOSTNAME_MISMATCH</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Hostname mismatch.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_email_mismatch" class="item"><strong>X509_V_ERR_EMAIL_MISMATCH</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Email address mismatch.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_ip_address_mismatch" class="item"><strong>X509_V_ERR_IP_ADDRESS_MISMATCH</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>IP address mismatch.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_dane_no_match" class="item"><strong>X509_V_ERR_DANE_NO_MATCH</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>DANE TLSA authentication is enabled, but no TLSA records matched the
|
||
|
|
certificate chain.
|
||
|
|
This error is only possible in <em>s_client(1)</em>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_ee_key_too_small" class="item"><strong>X509_V_ERR_EE_KEY_TOO_SMALL</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>EE certificate key too weak.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_err_ca_key_too_small" class="item"><strong>X509_ERR_CA_KEY_TOO_SMALL</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>CA certificate key too weak.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_err_ca_md_too_weak" class="item"><strong>X509_ERR_CA_MD_TOO_WEAK</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>CA signature digest algorithm too weak.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_invalid_call" class="item"><strong>X509_V_ERR_INVALID_CALL</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>nvalid certificate verification context.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_store_lookup" class="item"><strong>X509_V_ERR_STORE_LOOKUP</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Issuer certificate lookup error.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_no_valid_scts" class="item"><strong>X509_V_ERR_NO_VALID_SCTS</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Certificate Transparency required, but no valid SCTs found.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_proxy_subject_name_violation" class="item"><strong>X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Proxy subject name violation.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_ocsp_verify_needed" class="item"><strong>X509_V_ERR_OCSP_VERIFY_NEEDED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Returned by the verify callback to indicate an OCSP verification is needed.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_ocsp_verify_failed" class="item"><strong>X509_V_ERR_OCSP_VERIFY_FAILED</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Returned by the verify callback to indicate OCSP verification failed.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="x509_v_err_ocsp_cert_unknown" class="item"><strong>X509_V_ERR_OCSP_CERT_UNKNOWN</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Returned by the verify callback to indicate that the certificate is not recognized
|
||
|
|
by the OCSP responder.</p>
|
||
|
|
</dd>
|
||
|
|
</dl>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="bugs">BUGS</a></h1>
|
||
|
|
<p>Although the issuer checks are a considerable improvement over the old
|
||
|
|
technique they still suffer from limitations in the underlying X509_LOOKUP
|
||
|
|
API. One consequence of this is that trusted certificates with matching
|
||
|
|
subject name must either appear in a file (as specified by the <strong>-CAfile</strong>
|
||
|
|
option) or a directory (as specified by <strong>-CApath</strong>). If they occur in
|
||
|
|
both then only the certificates in the file will be recognised.</p>
|
||
|
|
<p>Previous versions of OpenSSL assume certificates with matching subject
|
||
|
|
name are identical and mishandled them.</p>
|
||
|
|
<p>Previous versions of this documentation swapped the meaning of the
|
||
|
|
<strong>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT</strong> and
|
||
|
|
<strong>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY</strong> error codes.</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="see_also">SEE ALSO</a></h1>
|
||
|
|
<p><em>x509(1)</em></p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="history">HISTORY</a></h1>
|
||
|
|
<p>The <strong>-show_chain</strong> option was added in OpenSSL 1.1.0.</p>
|
||
|
|
<p>The <strong>-issuer_checks</strong> option is deprecated as of OpenSSL 1.1.0 and
|
||
|
|
is silently ignored.</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="copyright">COPYRIGHT</a></h1>
|
||
|
|
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||
|
|
<p>Licensed under the OpenSSL license (the "License"). You may not use
|
||
|
|
this file except in compliance with the License. You can obtain a copy
|
||
|
|
in the file LICENSE in the source distribution or at
|
||
|
|
<a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||
|
|
|
||
|
|
</body>
|
||
|
|
|
||
|
|
</html>
|