aboutsummaryrefslogtreecommitdiffstats
path: root/doc/apps
diff options
context:
space:
mode:
authorJung-uk Kim <jkim@FreeBSD.org>2015-03-20 15:28:40 +0000
committerJung-uk Kim <jkim@FreeBSD.org>2015-03-20 15:28:40 +0000
commit3d2030852da420b820a661e7b19bb757487e2599 (patch)
tree787cdff35e35be75e53f378b098bba3237a8deb7 /doc/apps
parent8f5086671f06c811be16442eb6d6fe68e5ba71fc (diff)
downloadsrc-3d2030852da420b820a661e7b19bb757487e2599.tar.gz
src-3d2030852da420b820a661e7b19bb757487e2599.zip
Import OpenSSL 1.0.1m.vendor/openssl/1.0.1m
Notes
Notes: svn path=/vendor-crypto/openssl/dist/; revision=280288 svn path=/vendor-crypto/openssl/1.0.1m/; revision=280289; tag=vendor/openssl/1.0.1m
Diffstat (limited to 'doc/apps')
-rw-r--r--doc/apps/ciphers.pod4
-rw-r--r--doc/apps/config.pod22
-rw-r--r--doc/apps/ocsp.pod10
3 files changed, 30 insertions, 6 deletions
diff --git a/doc/apps/ciphers.pod b/doc/apps/ciphers.pod
index 6086d0a7154f..0aa1bad111c5 100644
--- a/doc/apps/ciphers.pod
+++ b/doc/apps/ciphers.pod
@@ -109,8 +109,8 @@ The following is a list of all permitted cipher strings and their meanings.
=item B<DEFAULT>
-the default cipher list. This is determined at compile time and, as of OpenSSL
-1.0.0, is normally B<ALL:!aNULL:!eNULL>. This must be the first cipher string
+the default cipher list. This is determined at compile time and
+is normally B<ALL:!EXPORT:!aNULL:!eNULL:!SSLv2>. This must be the firstcipher string
specified.
=item B<COMPLEMENTOFDEFAULT>
diff --git a/doc/apps/config.pod b/doc/apps/config.pod
index 25c5381b9d6b..d5cce54f44a8 100644
--- a/doc/apps/config.pod
+++ b/doc/apps/config.pod
@@ -89,8 +89,7 @@ section containing configuration module specific information. E.g.
... engine stuff here ...
-Currently there are two configuration modules. One for ASN1 objects another
-for ENGINE configuration.
+The features of each configuration module are described below.
=head2 ASN1 OBJECT CONFIGURATION MODULE
@@ -191,6 +190,25 @@ For example:
# Supply all default algorithms
default_algorithms = ALL
+=head2 EVP CONFIGURATION MODULE
+
+This modules has the name B<alg_section> which points to a section containing
+algorithm commands.
+
+Currently the only algorithm command supported is B<fips_mode> whose
+value should be a boolean string such as B<on> or B<off>. If the value is
+B<on> this attempt to enter FIPS mode. If the call fails or the library is
+not FIPS capable then an error occurs.
+
+For example:
+
+ alg_section = evp_settings
+
+ [evp_settings]
+
+ fips_mode = on
+
+
=head1 NOTES
If a configuration file attempts to expand a variable that doesn't exist
diff --git a/doc/apps/ocsp.pod b/doc/apps/ocsp.pod
index 38f026afc1b6..2372b373cdc1 100644
--- a/doc/apps/ocsp.pod
+++ b/doc/apps/ocsp.pod
@@ -40,6 +40,7 @@ B<openssl> B<ocsp>
[B<-no_cert_verify>]
[B<-no_chain>]
[B<-no_cert_checks>]
+[B<-no_explicit>]
[B<-port num>]
[B<-index file>]
[B<-CA file>]
@@ -189,6 +190,10 @@ testing purposes.
do not use certificates in the response as additional untrusted CA
certificates.
+=item B<-no_explicit>
+
+do not explicitly trust the root CA if it is set to be trusted for OCSP signing.
+
=item B<-no_cert_checks>
don't perform any additional checks on the OCSP response signers certificate.
@@ -301,8 +306,9 @@ CA certificate in the request. If there is a match and the OCSPSigning
extended key usage is present in the OCSP responder certificate then the
OCSP verify succeeds.
-Otherwise the root CA of the OCSP responders CA is checked to see if it
-is trusted for OCSP signing. If it is the OCSP verify succeeds.
+Otherwise, if B<-no_explicit> is B<not> set the root CA of the OCSP responders
+CA is checked to see if it is trusted for OCSP signing. If it is the OCSP
+verify succeeds.
If none of these checks is successful then the OCSP verify fails.