man.bsd.lv manual page server

NAME

X509_VERIFY_PARAM_new, X509_VERIFY_PARAM_free, X509_VERIFY_PARAM_get0_name, X509_VERIFY_PARAM_set1_name, X509_VERIFY_PARAM_set_flags, X509_VERIFY_PARAM_clear_flags, X509_VERIFY_PARAM_get_flags, X509_VERIFY_PARAM_set_purpose, X509_VERIFY_PARAM_set_trust, X509_VERIFY_PARAM_set_time, X509_VERIFY_PARAM_add0_policy, X509_VERIFY_PARAM_set1_policies, X509_VERIFY_PARAM_set_depth, X509_VERIFY_PARAM_get_depth, X509_VERIFY_PARAM_set1_host, X509_VERIFY_PARAM_add1_host, X509_VERIFY_PARAM_set_hostflags, X509_VERIFY_PARAM_get0_peername, X509_VERIFY_PARAM_set1_email, X509_VERIFY_PARAM_set1_ip, X509_VERIFY_PARAM_set1_ip_asc, X509_VERIFY_PARAM_add0_table, X509_VERIFY_PARAM_lookup, X509_VERIFY_PARAM_get_count, X509_VERIFY_PARAM_get0, X509_VERIFY_PARAM_table_cleanup — X509 verification parameters

SYNOPSIS

#include <openssl/x509_vfy.h>

X509_VERIFY_PARAM *
X509_VERIFY_PARAM_new(void);

void
X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param);

const char *
X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param);

int
X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name);

int
X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);

int
X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, unsigned long flags);

unsigned long
X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);

int
X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);

int
X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);

void
X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);

int
X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, ASN1_OBJECT *policy);

int
X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, STACK_OF(ASN1_OBJECT) *policies);

void
X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);

int
X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);

int
X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, const char *name, size_t namelen);

int
X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param, const char *name, size_t namelen);

void
X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param, unsigned int flags);

char *
X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param);

int
X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param, const char *email, size_t emaillen);

int
X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param, const unsigned char *ip, size_t iplen);

int
X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc);

int
X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param);

const X509_VERIFY_PARAM *
X509_VERIFY_PARAM_lookup(const char *name);

int
X509_VERIFY_PARAM_get_count(void);

const X509_VERIFY_PARAM *
X509_VERIFY_PARAM_get0(int id);

void
X509_VERIFY_PARAM_table_cleanup(void);

RETURN VALUES

X509_VERIFY_PARAM_new() returns a pointer to the new object, or NULL on allocation failure.

X509_VERIFY_PARAM_set1_name(), X509_VERIFY_PARAM_set_flags(), X509_VERIFY_PARAM_clear_flags(), X509_VERIFY_PARAM_set_purpose(), X509_VERIFY_PARAM_set_trust(), X509_VERIFY_PARAM_add0_policy(), X509_VERIFY_PARAM_set1_policies(), and X509_VERIFY_PARAM_add0_table() return 1 for success or 0 for failure.

X509_VERIFY_PARAM_set1_host(), X509_VERIFY_PARAM_add1_host(), X509_VERIFY_PARAM_set1_email(), X509_VERIFY_PARAM_set1_ip(), and X509_VERIFY_PARAM_set1_ip_asc(), return 1 for success or 0 for failure. A failure from these routines will poison the X509_VERIFY_PARAM object so that future calls to X509_verify_cert(3) using the poisoned object will fail.

X509_VERIFY_PARAM_get_flags() returns the current verification flags.

X509_VERIFY_PARAM_get_depth() returns the current verification depth.

X509_VERIFY_PARAM_get0_name() and X509_VERIFY_PARAM_get0_peername() return pointers to strings that are only valid during the lifetime of the given param object and that must not be freed by the application program.

X509_VERIFY_PARAM_lookup() and X509_VERIFY_PARAM_get0() return a pointer to an existing built-in or user-defined object, or NULL if no object with the given name is found, or if id is at least X509_VERIFY_PARAM_get_count().

X509_VERIFY_PARAM_get_count() returns a number of objects.

VERIFICATION FLAGS

The verification flags consists of zero or more of the following flags OR'ed together.

X509_V_FLAG_CRL_CHECK enables CRL checking for the certificate chain leaf certificate. An error occurs if a suitable CRL cannot be found.

X509_V_FLAG_CRL_CHECK_ALL enables CRL checking for the entire certificate chain.

X509_V_FLAG_IGNORE_CRITICAL disables critical extension checking. By default any unhandled critical extensions in certificates or (if checked) CRLs results in a fatal error. If this flag is set unhandled critical extensions are ignored. WARNING: setting this option for anything other than debugging purposes can be a security risk. Finer control over which extensions are supported can be performed in the verification callback.

The X509_V_FLAG_X509_STRICT flag disables workarounds for some broken certificates and makes the verification strictly apply X509 rules.

X509_V_FLAG_ALLOW_PROXY_CERTS enables proxy certificate verification.

X509_V_FLAG_POLICY_CHECK enables certificate policy checking; by default no policy checking is performed. Additional information is sent to the verification callback relating to policy checking.

X509_V_FLAG_EXPLICIT_POLICY, X509_V_FLAG_INHIBIT_ANY, and X509_V_FLAG_INHIBIT_MAP set the “require explicit policy”, “inhibit any policy”, and “inhibit policy mapping” flags, respectively, as defined in RFC 3280. Policy checking is automatically enabled if any of these flags are set.

If X509_V_FLAG_NOTIFY_POLICY is set and the policy checking is successful a special status code is set to the verification callback. This permits it to examine the valid policy tree and perform additional checks or simply log it for debugging purposes.

By default some additional features such as indirect CRLs and CRLs signed by different keys are disabled. If X509_V_FLAG_EXTENDED_CRL_SUPPORT is set they are enabled.

If X509_V_FLAG_USE_DELTAS is set, delta CRLs (if present) are used to determine certificate status. If not set, deltas are ignored.

X509_V_FLAG_CHECK_SS_SIGNATURE enables checking of the root CA self signed certificate signature. By default this check is disabled because it doesn't add any additional security but in some cases applications might want to check the signature anyway. A side effect of not checking the root CA signature is that disabled or unsupported message digests on the root CA are not treated as fatal errors.

The X509_V_FLAG_CB_ISSUER_CHECK flag enables debugging of certificate issuer checks. It is not needed unless you are logging certificate verification. If this flag is set then additional status codes will be sent to the verification callback and it must be prepared to handle such cases without assuming they are hard errors.

When X509_V_FLAG_TRUSTED_FIRST is set, construction of the certificate chain in X509_verify_cert(3) will search the trust store for issuer certificates before searching the provided untrusted certificates. Local issuer certificates are often more likely to satisfy local security requirements and lead to a locally trusted root. This is especially important when some certificates in the trust store have explicit trust settings; see the trust settings options of the x509 command in openssl(1).

The X509_V_FLAG_NO_ALT_CHAINS flag suppresses checking for alternative chains. By default, unless X509_V_FLAG_TRUSTED_FIRST is set, when building a certificate chain, if the first certificate chain found is not trusted, then OpenSSL will attempt to replace untrusted certificates supplied by the peer with certificates from the trust store to see if an alternative chain can be found that is trusted.

The X509_V_FLAG_PARTIAL_CHAIN flag causes intermediate certificates in the trust store to be treated as trust-anchors, in the same way as the self-signed root CA certificates. This makes it possible to trust certificates issued by an intermediate CA without having to trust its ancestor root CA.

The X509_V_FLAG_NO_CHECK_TIME flag suppresses checking the validity period of certificates and CRLs against the current time. If X509_VERIFY_PARAM_set_time() is used to specify a verification time, the check is not suppressed.

EXAMPLES

Enable CRL checking when performing certificate verification during SSL connections associated with an SSL_CTX structure ctx:

X509_VERIFY_PARAM *param;

param = X509_VERIFY_PARAM_new();
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
SSL_CTX_set1_param(ctx, param);
X509_VERIFY_PARAM_free(param);

SEE ALSO

SSL_set1_param(3), X509_check_host(3), X509_STORE_CTX_set0_param(3), X509_STORE_set1_param(3), X509_verify_cert(3)

HISTORY

X509_VERIFY_PARAM_new(), X509_VERIFY_PARAM_free(), X509_VERIFY_PARAM_set1_name(), X509_VERIFY_PARAM_set_flags(), X509_VERIFY_PARAM_set_purpose(), X509_VERIFY_PARAM_set_trust(), X509_VERIFY_PARAM_set_time(), X509_VERIFY_PARAM_add0_policy(), X509_VERIFY_PARAM_set1_policies(), X509_VERIFY_PARAM_set_depth(), X509_VERIFY_PARAM_get_depth(), X509_VERIFY_PARAM_add0_table(), X509_VERIFY_PARAM_lookup(), and X509_VERIFY_PARAM_table_cleanup() first appeared in OpenSSL 0.9.8. X509_VERIFY_PARAM_clear_flags() and X509_VERIFY_PARAM_get_flags() first appeared in OpenSSL 0.9.8a. All these functions have been available since OpenBSD 4.5.

X509_VERIFY_PARAM_get0_name() X509_VERIFY_PARAM_set1_host(), X509_VERIFY_PARAM_add1_host(), X509_VERIFY_PARAM_set_hostflags(), X509_VERIFY_PARAM_get0_peername(), X509_VERIFY_PARAM_set1_email(), X509_VERIFY_PARAM_set1_ip(), X509_VERIFY_PARAM_set1_ip_asc(), X509_VERIFY_PARAM_get_count(), and X509_VERIFY_PARAM_get0() first appeared in OpenSSL 1.0.2 and have been available since OpenBSD 6.3.

BUGS

Delta CRL checking is currently primitive. Only a single delta can be used and (partly due to limitations of X509_STORE) constructed CRLs are not maintained.

If CRLs checking is enabled, CRLs are expected to be available in the corresponding X509_STORE structure. No attempt is made to download CRLs from the CRL distribution points extension.