327 lines
15 KiB
Groff
Executable File
327 lines
15 KiB
Groff
Executable File
.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
|
|
.\"
|
|
.\" Standard preamble:
|
|
.\" ========================================================================
|
|
.de Sp \" Vertical space (when we can't use .PP)
|
|
.if t .sp .5v
|
|
.if n .sp
|
|
..
|
|
.de Vb \" Begin verbatim text
|
|
.ft CW
|
|
.nf
|
|
.ne \\$1
|
|
..
|
|
.de Ve \" End verbatim text
|
|
.ft R
|
|
.fi
|
|
..
|
|
.\" Set up some character translations and predefined strings. \*(-- will
|
|
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
|
|
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
|
|
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
|
|
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
|
|
.\" nothing in troff, for use with C<>.
|
|
.tr \(*W-
|
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
|
.ie n \{\
|
|
. ds -- \(*W-
|
|
. ds PI pi
|
|
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
|
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
|
. ds L" ""
|
|
. ds R" ""
|
|
. ds C` ""
|
|
. ds C' ""
|
|
'br\}
|
|
.el\{\
|
|
. ds -- \|\(em\|
|
|
. ds PI \(*p
|
|
. ds L" ``
|
|
. ds R" ''
|
|
'br\}
|
|
.\"
|
|
.\" Escape single quotes in literal strings from groff's Unicode transform.
|
|
.ie \n(.g .ds Aq \(aq
|
|
.el .ds Aq '
|
|
.\"
|
|
.\" If the F register is turned on, we'll generate index entries on stderr for
|
|
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
|
|
.\" entries marked with X<> in POD. Of course, you'll have to process the
|
|
.\" output yourself in some meaningful fashion.
|
|
.ie \nF \{\
|
|
. de IX
|
|
. tm Index:\\$1\t\\n%\t"\\$2"
|
|
..
|
|
. nr % 0
|
|
. rr F
|
|
.\}
|
|
.el \{\
|
|
. de IX
|
|
..
|
|
.\}
|
|
.\"
|
|
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
|
|
.\" Fear. Run. Save yourself. No user-serviceable parts.
|
|
. \" fudge factors for nroff and troff
|
|
.if n \{\
|
|
. ds #H 0
|
|
. ds #V .8m
|
|
. ds #F .3m
|
|
. ds #[ \f1
|
|
. ds #] \fP
|
|
.\}
|
|
.if t \{\
|
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
|
. ds #V .6m
|
|
. ds #F 0
|
|
. ds #[ \&
|
|
. ds #] \&
|
|
.\}
|
|
. \" simple accents for nroff and troff
|
|
.if n \{\
|
|
. ds ' \&
|
|
. ds ` \&
|
|
. ds ^ \&
|
|
. ds , \&
|
|
. ds ~ ~
|
|
. ds /
|
|
.\}
|
|
.if t \{\
|
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
|
.\}
|
|
. \" troff and (daisy-wheel) nroff accents
|
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
|
. \" corrections for vroff
|
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
|
. \" for low resolution devices (crt and lpr)
|
|
.if \n(.H>23 .if \n(.V>19 \
|
|
\{\
|
|
. ds : e
|
|
. ds 8 ss
|
|
. ds o a
|
|
. ds d- d\h'-1'\(ga
|
|
. ds D- D\h'-1'\(hy
|
|
. ds th \o'bp'
|
|
. ds Th \o'LP'
|
|
. ds ae ae
|
|
. ds Ae AE
|
|
.\}
|
|
.rm #[ #] #H #V #F C
|
|
.\" ========================================================================
|
|
.\"
|
|
.IX Title "SSL_CTX_USE_CERTIFICATE 3"
|
|
.TH SSL_CTX_USE_CERTIFICATE 3 "2020-03-02" "3.0.0-dev" "OpenSSL"
|
|
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
|
|
.\" way too many mistakes in technical documents.
|
|
.if n .ad l
|
|
.nh
|
|
.SH "NAME"
|
|
SSL_CTX_use_certificate, SSL_CTX_use_certificate_ASN1,
|
|
SSL_CTX_use_certificate_file, SSL_use_certificate, SSL_use_certificate_ASN1,
|
|
SSL_use_certificate_file, SSL_CTX_use_certificate_chain_file,
|
|
SSL_use_certificate_chain_file,
|
|
SSL_CTX_use_PrivateKey, SSL_CTX_use_PrivateKey_ASN1,
|
|
SSL_CTX_use_PrivateKey_file, SSL_CTX_use_RSAPrivateKey,
|
|
SSL_CTX_use_RSAPrivateKey_ASN1, SSL_CTX_use_RSAPrivateKey_file,
|
|
SSL_use_PrivateKey_file, SSL_use_PrivateKey_ASN1, SSL_use_PrivateKey,
|
|
SSL_use_RSAPrivateKey, SSL_use_RSAPrivateKey_ASN1,
|
|
SSL_use_RSAPrivateKey_file, SSL_CTX_check_private_key, SSL_check_private_key,
|
|
SSL_CTX_use_cert_and_key, SSL_use_cert_and_key
|
|
\&\- load certificate and key data
|
|
.SH "SYNOPSIS"
|
|
.IX Header "SYNOPSIS"
|
|
.Vb 1
|
|
\& #include <openssl/ssl.h>
|
|
\&
|
|
\& int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x);
|
|
\& int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d);
|
|
\& int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type);
|
|
\& int SSL_use_certificate(SSL *ssl, X509 *x);
|
|
\& int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len);
|
|
\& int SSL_use_certificate_file(SSL *ssl, const char *file, int type);
|
|
\&
|
|
\& int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file);
|
|
\& int SSL_use_certificate_chain_file(SSL *ssl, const char *file);
|
|
\&
|
|
\& int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey);
|
|
\& int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, unsigned char *d,
|
|
\& long len);
|
|
\& int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type);
|
|
\& int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa);
|
|
\& int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len);
|
|
\& int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type);
|
|
\& int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey);
|
|
\& int SSL_use_PrivateKey_ASN1(int pk, SSL *ssl, unsigned char *d, long len);
|
|
\& int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type);
|
|
\& int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);
|
|
\& int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len);
|
|
\& int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type);
|
|
\&
|
|
\& int SSL_CTX_check_private_key(const SSL_CTX *ctx);
|
|
\& int SSL_check_private_key(const SSL *ssl);
|
|
\&
|
|
\& int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x, EVP_PKEY *pkey, STACK_OF(X509) *chain, int override);
|
|
\& int SSL_use_cert_and_key(SSL *ssl, X509 *x, EVP_PKEY *pkey, STACK_OF(X509) *chain, int override);
|
|
.Ve
|
|
.SH "DESCRIPTION"
|
|
.IX Header "DESCRIPTION"
|
|
These functions load the certificates and private keys into the \s-1SSL_CTX\s0
|
|
or \s-1SSL\s0 object, respectively.
|
|
.PP
|
|
The SSL_CTX_* class of functions loads the certificates and keys into the
|
|
\&\s-1SSL_CTX\s0 object \fBctx\fR. The information is passed to \s-1SSL\s0 objects \fBssl\fR
|
|
created from \fBctx\fR with \fISSL_new\fR\|(3) by copying, so that
|
|
changes applied to \fBctx\fR do not propagate to already existing \s-1SSL\s0 objects.
|
|
.PP
|
|
The SSL_* class of functions only loads certificates and keys into a
|
|
specific \s-1SSL\s0 object. The specific information is kept, when
|
|
\&\fISSL_clear\fR\|(3) is called for this \s-1SSL\s0 object.
|
|
.PP
|
|
\&\fISSL_CTX_use_certificate()\fR loads the certificate \fBx\fR into \fBctx\fR,
|
|
\&\fISSL_use_certificate()\fR loads \fBx\fR into \fBssl\fR. The rest of the
|
|
certificates needed to form the complete certificate chain can be
|
|
specified using the
|
|
\&\fISSL_CTX_add_extra_chain_cert\fR\|(3)
|
|
function.
|
|
.PP
|
|
\&\fISSL_CTX_use_certificate_ASN1()\fR loads the \s-1ASN1\s0 encoded certificate from
|
|
the memory location \fBd\fR (with length \fBlen\fR) into \fBctx\fR,
|
|
\&\fISSL_use_certificate_ASN1()\fR loads the \s-1ASN1\s0 encoded certificate into \fBssl\fR.
|
|
.PP
|
|
\&\fISSL_CTX_use_certificate_file()\fR loads the first certificate stored in \fBfile\fR
|
|
into \fBctx\fR. The formatting \fBtype\fR of the certificate must be specified
|
|
from the known types \s-1SSL_FILETYPE_PEM\s0, \s-1SSL_FILETYPE_ASN1\s0.
|
|
\&\fISSL_use_certificate_file()\fR loads the certificate from \fBfile\fR into \fBssl\fR.
|
|
See the \s-1NOTES\s0 section on why \fISSL_CTX_use_certificate_chain_file()\fR
|
|
should be preferred.
|
|
.PP
|
|
\&\fISSL_CTX_use_certificate_chain_file()\fR loads a certificate chain from
|
|
\&\fBfile\fR into \fBctx\fR. The certificates must be in \s-1PEM\s0 format and must
|
|
be sorted starting with the subject's certificate (actual client or server
|
|
certificate), followed by intermediate \s-1CA\s0 certificates if applicable, and
|
|
ending at the highest level (root) \s-1CA\s0. \fISSL_use_certificate_chain_file()\fR is
|
|
similar except it loads the certificate chain into \fBssl\fR.
|
|
.PP
|
|
\&\fISSL_CTX_use_PrivateKey()\fR adds \fBpkey\fR as private key to \fBctx\fR.
|
|
\&\fISSL_CTX_use_RSAPrivateKey()\fR adds the private key \fBrsa\fR of type \s-1RSA\s0
|
|
to \fBctx\fR. \fISSL_use_PrivateKey()\fR adds \fBpkey\fR as private key to \fBssl\fR;
|
|
\&\fISSL_use_RSAPrivateKey()\fR adds \fBrsa\fR as private key of type \s-1RSA\s0 to \fBssl\fR.
|
|
If a certificate has already been set and the private does not belong
|
|
to the certificate an error is returned. To change a certificate, private
|
|
key pair the new certificate needs to be set with \fISSL_use_certificate()\fR
|
|
or \fISSL_CTX_use_certificate()\fR before setting the private key with
|
|
\&\fISSL_CTX_use_PrivateKey()\fR or \fISSL_use_PrivateKey()\fR.
|
|
.PP
|
|
\&\fISSL_CTX_use_cert_and_key()\fR and \fISSL_use_cert_and_key()\fR assign the X.509
|
|
certificate \fBx\fR, private key \fBkey\fR, and certificate \fBchain\fR onto the
|
|
corresponding \fBssl\fR or \fBctx\fR. The \fBpkey\fR argument must be the private
|
|
key of the X.509 certificate \fBx\fR. If the \fBoverride\fR argument is 0, then
|
|
\&\fBx\fR, \fBpkey\fR and \fBchain\fR are set only if all were not previously set.
|
|
If \fBoverride\fR is non\-0, then the certificate, private key and chain certs
|
|
are always set. If \fBpkey\fR is \s-1NULL\s0, then the public key of \fBx\fR is used as
|
|
the private key. This is intended to be used with hardware (via the \s-1ENGINE\s0
|
|
interface) that stores the private key securely, such that it cannot be
|
|
accessed by OpenSSL. The reference count of the public key is incremented
|
|
(twice if there is no private key); it is not copied nor duplicated. This
|
|
allows all private key validations checks to succeed without an actual
|
|
private key being assigned via \fISSL_CTX_use_PrivateKey()\fR, etc.
|
|
.PP
|
|
\&\fISSL_CTX_use_PrivateKey_ASN1()\fR adds the private key of type \fBpk\fR
|
|
stored at memory location \fBd\fR (length \fBlen\fR) to \fBctx\fR.
|
|
\&\fISSL_CTX_use_RSAPrivateKey_ASN1()\fR adds the private key of type \s-1RSA\s0
|
|
stored at memory location \fBd\fR (length \fBlen\fR) to \fBctx\fR.
|
|
\&\fISSL_use_PrivateKey_ASN1()\fR and \fISSL_use_RSAPrivateKey_ASN1()\fR add the private
|
|
key to \fBssl\fR.
|
|
.PP
|
|
\&\fISSL_CTX_use_PrivateKey_file()\fR adds the first private key found in
|
|
\&\fBfile\fR to \fBctx\fR. The formatting \fBtype\fR of the private key must be specified
|
|
from the known types \s-1SSL_FILETYPE_PEM\s0, \s-1SSL_FILETYPE_ASN1\s0.
|
|
\&\fISSL_CTX_use_RSAPrivateKey_file()\fR adds the first private \s-1RSA\s0 key found in
|
|
\&\fBfile\fR to \fBctx\fR. \fISSL_use_PrivateKey_file()\fR adds the first private key found
|
|
in \fBfile\fR to \fBssl\fR; \fISSL_use_RSAPrivateKey_file()\fR adds the first private
|
|
\&\s-1RSA\s0 key found to \fBssl\fR.
|
|
.PP
|
|
\&\fISSL_CTX_check_private_key()\fR checks the consistency of a private key with
|
|
the corresponding certificate loaded into \fBctx\fR. If more than one
|
|
key/certificate pair (\s-1RSA/DSA\s0) is installed, the last item installed will
|
|
be checked. If e.g. the last item was a \s-1RSA\s0 certificate or key, the \s-1RSA\s0
|
|
key/certificate pair will be checked. \fISSL_check_private_key()\fR performs
|
|
the same check for \fBssl\fR. If no key/certificate was explicitly added for
|
|
this \fBssl\fR, the last item added into \fBctx\fR will be checked.
|
|
.SH "NOTES"
|
|
.IX Header "NOTES"
|
|
The internal certificate store of OpenSSL can hold several private
|
|
key/certificate pairs at a time. The certificate used depends on the
|
|
cipher selected, see also \fISSL_CTX_set_cipher_list\fR\|(3).
|
|
.PP
|
|
When reading certificates and private keys from file, files of type
|
|
\&\s-1SSL_FILETYPE_ASN1\s0 (also known as \fB\s-1DER\s0\fR, binary encoding) can only contain
|
|
one certificate or private key, consequently
|
|
\&\fISSL_CTX_use_certificate_chain_file()\fR is only applicable to \s-1PEM\s0 formatting.
|
|
Files of type \s-1SSL_FILETYPE_PEM\s0 can contain more than one item.
|
|
.PP
|
|
\&\fISSL_CTX_use_certificate_chain_file()\fR adds the first certificate found
|
|
in the file to the certificate store. The other certificates are added
|
|
to the store of chain certificates using \fISSL_CTX_add1_chain_cert\fR\|(3). Note: versions of OpenSSL before 1.0.2 only had a single
|
|
certificate chain store for all certificate types, OpenSSL 1.0.2 and later
|
|
have a separate chain store for each type. \fISSL_CTX_use_certificate_chain_file()\fR
|
|
should be used instead of the \fISSL_CTX_use_certificate_file()\fR function in order
|
|
to allow the use of complete certificate chains even when no trusted \s-1CA\s0
|
|
storage is used or when the \s-1CA\s0 issuing the certificate shall not be added to
|
|
the trusted \s-1CA\s0 storage.
|
|
.PP
|
|
If additional certificates are needed to complete the chain during the
|
|
\&\s-1TLS\s0 negotiation, \s-1CA\s0 certificates are additionally looked up in the
|
|
locations of trusted \s-1CA\s0 certificates, see
|
|
\&\fISSL_CTX_load_verify_locations\fR\|(3).
|
|
.PP
|
|
The private keys loaded from file can be encrypted. In order to successfully
|
|
load encrypted keys, a function returning the passphrase must have been
|
|
supplied, see
|
|
\&\fISSL_CTX_set_default_passwd_cb\fR\|(3).
|
|
(Certificate files might be encrypted as well from the technical point
|
|
of view, it however does not make sense as the data in the certificate
|
|
is considered public anyway.)
|
|
.PP
|
|
All of the functions to set a new certificate will replace any existing
|
|
certificate of the same type that has already been set. Similarly all of the
|
|
functions to set a new private key will replace any private key that has already
|
|
been set. Applications should call \fISSL_CTX_check_private_key\fR\|(3) or
|
|
\&\fISSL_check_private_key\fR\|(3) as appropriate after loading a new certificate and
|
|
private key to confirm that the certificate and key match.
|
|
.SH "RETURN VALUES"
|
|
.IX Header "RETURN VALUES"
|
|
On success, the functions return 1.
|
|
Otherwise check out the error stack to find out the reason.
|
|
.SH "SEE ALSO"
|
|
.IX Header "SEE ALSO"
|
|
\&\fIssl\fR\|(7), \fISSL_new\fR\|(3), \fISSL_clear\fR\|(3),
|
|
\&\fISSL_CTX_load_verify_locations\fR\|(3),
|
|
\&\fISSL_CTX_set_default_passwd_cb\fR\|(3),
|
|
\&\fISSL_CTX_set_cipher_list\fR\|(3),
|
|
\&\fISSL_CTX_set_client_CA_list\fR\|(3),
|
|
\&\fISSL_CTX_set_client_cert_cb\fR\|(3),
|
|
\&\fISSL_CTX_add_extra_chain_cert\fR\|(3)
|
|
.SH "COPYRIGHT"
|
|
.IX Header "COPYRIGHT"
|
|
Copyright 2000\-2018 The OpenSSL Project Authors. All Rights Reserved.
|
|
.PP
|
|
Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file \s-1LICENSE\s0 in the source distribution or at
|
|
<https://www.openssl.org/source/license.html>.
|