diff options
author | nectar <nectar@FreeBSD.org> | 2002-07-30 12:44:15 +0000 |
---|---|---|
committer | nectar <nectar@FreeBSD.org> | 2002-07-30 12:44:15 +0000 |
commit | 0aed2eea83b351d68092e43b5a9496ce3dd5043d (patch) | |
tree | a6133c35ab337984fbbd26293f8b1ad7a958132b /crypto/openssl/doc/ssl | |
parent | 1f8c2aa1763b5d8a328b2fd4053396e94ea48d35 (diff) | |
download | FreeBSD-src-0aed2eea83b351d68092e43b5a9496ce3dd5043d.zip FreeBSD-src-0aed2eea83b351d68092e43b5a9496ce3dd5043d.tar.gz |
Import of OpenSSL 0.9.6d.
Diffstat (limited to 'crypto/openssl/doc/ssl')
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_CTX_add_extra_chain_cert.pod | 1 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_CTX_set_client_cert_cb.pod | 90 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_CTX_use_certificate.pod | 1 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_clear.pod | 22 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_get_client_CA_list.pod | 3 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/ssl.pod | 1 |
6 files changed, 116 insertions, 2 deletions
diff --git a/crypto/openssl/doc/ssl/SSL_CTX_add_extra_chain_cert.pod b/crypto/openssl/doc/ssl/SSL_CTX_add_extra_chain_cert.pod index 21a9db0..ee28f5c 100644 --- a/crypto/openssl/doc/ssl/SSL_CTX_add_extra_chain_cert.pod +++ b/crypto/openssl/doc/ssl/SSL_CTX_add_extra_chain_cert.pod @@ -33,6 +33,7 @@ error stack to find out the reason for failure otherwise. L<ssl(3)|ssl(3)>, L<SSL_CTX_use_certificate(3)|SSL_CTX_use_certificate(3)>, +L<SSL_CTX_set_client_cert_cb(3)|SSL_CTX_set_client_cert_cb(3)>, L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> =cut diff --git a/crypto/openssl/doc/ssl/SSL_CTX_set_client_cert_cb.pod b/crypto/openssl/doc/ssl/SSL_CTX_set_client_cert_cb.pod new file mode 100644 index 0000000..53e1827 --- /dev/null +++ b/crypto/openssl/doc/ssl/SSL_CTX_set_client_cert_cb.pod @@ -0,0 +1,90 @@ +=pod + +=head1 NAME + +SSL_CTX_set_client_cert_cb, SSL_CTX_get_client_cert_cb - handle client certificate callback function + +=head1 SYNOPSIS + + #include <openssl/ssl.h> + + void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey)); + int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey); + int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey); + +=head1 DESCRIPTION + +SSL_CTX_set_client_cert_cb() sets the B<client_cert_cb()> callback, that is +called when a client certificate is requested by a server. +When B<client_cert_cb()> is NULL, not callback function is used. + +SSL_CTX_get_client_cert_cb() returns a pointer to the currently set callback +function. + +client_cert_cb() is the application defined callback. If it wants to +set a certificate, a certificate/private key combination must be set +using the B<x509> and B<pkey> arguments and "1" must be returned. The +certificate will be installed into B<ssl>, see the NOTES and BUGS sections. +If no certificate should be set, "0" has to be returned and the default +certificate will be sent. A fatal error can be indicated by returning +a negative value, in which case the handshake will be canceled. + +=head1 NOTES + +During a handshake (or renegotiation) a server may request a certificate +from the client. A client certificate must only be sent, when the server +did send the request. + +When no callback function is set, an OpenSSL client will send the certificate +that was set using the +L<SSL_CTX_use_certificate(3)|SSL_CTX_use_certificate(3)> family of functions. +The TLS standard requires that only a certificate is sent, if it matches +the list of acceptable CAs sent by the server. This constraint is +violated by the default behavior of the OpenSSL library. Using the +callback function it is possible to implement a proper selection routine +or to allow a user interaction to choose the certificate to be sent. +The callback function can obtain the list of acceptable CAs using the +L<SSL_get_client_CA_list(3)|SSL_get_client_CA_list(3)> function. + +If a callback function is defined, the callback function will be called. +If the callback function returns a certificate, the OpenSSL library +will try to load the private key and certificate data into the SSL +object using SSL_use_certificate() and SSL_use_private_key() functions. +Thus it will permanently override the certificate and key previously +installed and will not be reset by calling L<SSL_clear(3)|SSL_clear(3)>. +If the callback returns no certificate, the OpenSSL library will send +the certificate previously installed for the SSL_CTX object or the specific +certificate of the SSL object, if available. + +=head1 BUGS + +The client_cert_cb() cannot return a complete certificate chain, it can +only return one client certificate. If the chain only has a length of 2, +the root CA certificate may be omitted according to the TLS standard and +thus a standard conforming answer can be sent to the server. For a +longer chain, the client must send the complete chain (with the option +to leave out the root CA certificate). This can only be accomplished by +either adding the intermediate CA certificates into the trusted +certificate store for the SSL_CTX object (resulting in having to add +CA certificates that otherwise maybe would not be trusted), or by adding +the chain certificates using the +L<SSL_CTX_add_extra_chain_cert(3)|SSL_CTX_add_extra_chain_cert(3)> +function, which is only available for the SSL_CTX object as a whole and that +therefore probably can only apply for one client certificate, making +the concept of the callback function (to allow the choice from several +certificates) questionable. + +Once the SSL object has been used in conjunction with the callback function, +the certificate will be set for the SSL object and will not be cleared +even when L<SSL_clear(3)|SSL_clear(3)> is being called. It is therefore +mandatory to destroy the SSL object using L<SSL_free(3)|SSL_free(3)> +and create a new one to return to the previous state. + +=head1 SEE ALSO + +L<ssl(3)|ssl(3)>, L<SSL_CTX_use_certificate(3)|SSL_CTX_use_certificate(3)>, +L<SSL_CTX_add_extra_chain_cert(3)|SSL_CTX_add_extra_chain_cert(3)>, +L<SSL_get_client_CA_list(3)|SSL_get_client_CA_list(3)>, +L<SSL_clear(3)|SSL_clear(3)>, L<SSL_free(3)|SSL_free(3)> + +=cut diff --git a/crypto/openssl/doc/ssl/SSL_CTX_use_certificate.pod b/crypto/openssl/doc/ssl/SSL_CTX_use_certificate.pod index 3b2fe6f..b8868f1 100644 --- a/crypto/openssl/doc/ssl/SSL_CTX_use_certificate.pod +++ b/crypto/openssl/doc/ssl/SSL_CTX_use_certificate.pod @@ -149,6 +149,7 @@ L<ssl(3)|ssl(3)>, L<SSL_new(3)|SSL_new(3)>, L<SSL_clear(3)|SSL_clear(3)>, L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)>, L<SSL_CTX_set_default_passwd_cb(3)|SSL_CTX_set_default_passwd_cb(3)>, L<SSL_CTX_set_cipher_list(3)|SSL_CTX_set_cipher_list(3)>, +L<SSL_CTX_set_client_cert_cb(3)|SSL_CTX_set_client_cert_cb(3)>, L<SSL_CTX_add_extra_chain_cert(3)|SSL_CTX_add_extra_chain_cert(3)> =cut diff --git a/crypto/openssl/doc/ssl/SSL_clear.pod b/crypto/openssl/doc/ssl/SSL_clear.pod index 8b735d8..8e077e31 100644 --- a/crypto/openssl/doc/ssl/SSL_clear.pod +++ b/crypto/openssl/doc/ssl/SSL_clear.pod @@ -25,6 +25,25 @@ if L<SSL_shutdown(3)|SSL_shutdown(3)> was not called for the connection or at least L<SSL_set_shutdown(3)|SSL_set_shutdown(3)> was used to set the SSL_SENT_SHUTDOWN state. +If a session was closed cleanly, the session object will be kept and all +settings corresponding. This explicitly means, that e.g. the special method +used during the session will be kept for the next handshake. So if the +session was a TLSv1 session, a SSL client object will use a TLSv1 client +method for the next handshake and a SSL server object will use a TLSv1 +server method, even if SSLv23_*_methods were chosen on startup. This +will might lead to connection failures (see L<SSL_new(3)|SSL_new(3)>) +for a description of the method's properties. + +=head1 WARNINGS + +SSL_clear() resets the SSL object to allow for another connection. The +reset operation however keeps several settings of the last sessions +(some of these settings were made automatically during the last +handshake). It only makes sense when opening a new session (or reusing +an old one) with the same peer that shares these settings. +SSL_clear() is not a short form for the sequence +L<SSL_free(3)|SSL_free(3)>; L<SSL_new(3)|SSL_new(3)>; . + =head1 RETURN VALUES The following return values can occur: @@ -44,6 +63,7 @@ The SSL_clear() operation was successful. L<SSL_new(3)|SSL_new(3)>, L<SSL_free(3)|SSL_free(3)>, L<SSL_shutdown(3)|SSL_shutdown(3)>, L<SSL_set_shutdown(3)|SSL_set_shutdown(3)>, -L<SSL_CTX_set_options(3)|SSL_CTX_set_options(3)>, L<ssl(3)|ssl(3)> +L<SSL_CTX_set_options(3)|SSL_CTX_set_options(3)>, L<ssl(3)|ssl(3)>, +L<SSL_CTX_set_client_cert_cb(3)|SSL_CTX_set_client_cert_cb(3)> =cut diff --git a/crypto/openssl/doc/ssl/SSL_get_client_CA_list.pod b/crypto/openssl/doc/ssl/SSL_get_client_CA_list.pod index 40e01cf..5693fde 100644 --- a/crypto/openssl/doc/ssl/SSL_get_client_CA_list.pod +++ b/crypto/openssl/doc/ssl/SSL_get_client_CA_list.pod @@ -47,6 +47,7 @@ the server did not send a list of CAs (client mode). =head1 SEE ALSO L<ssl(3)|ssl(3)>, -L<SSL_CTX_set_client_CA_list(3)|SSL_CTX_set_client_CA_list(3)> +L<SSL_CTX_set_client_CA_list(3)|SSL_CTX_set_client_CA_list(3)>, +L<SSL_CTX_set_client_cert_cb(3)|SSL_CTX_set_client_cert_cb(3)> =cut diff --git a/crypto/openssl/doc/ssl/ssl.pod b/crypto/openssl/doc/ssl/ssl.pod index a1ff455..79b19d9 100644 --- a/crypto/openssl/doc/ssl/ssl.pod +++ b/crypto/openssl/doc/ssl/ssl.pod @@ -667,6 +667,7 @@ L<SSL_CTX_set_cert_store(3)|SSL_CTX_set_cert_store(3)>, L<SSL_CTX_set_cert_verify_callback(3)|SSL_CTX_set_cert_verify_callback(3)>, L<SSL_CTX_set_cipher_list(3)|SSL_CTX_set_cipher_list(3)>, L<SSL_CTX_set_client_CA_list(3)|SSL_CTX_set_client_CA_list(3)>, +L<SSL_CTX_set_client_cert_cb(3)|SSL_CTX_set_client_cert_cb(3)>, L<SSL_CTX_set_default_passwd_cb(3)|SSL_CTX_set_default_passwd_cb(3)>, L<SSL_CTX_set_info_callback(3)|SSL_CTX_set_info_callback(3)>, L<SSL_CTX_set_mode(3)|SSL_CTX_set_mode(3)>, |