=head1 SYNOPSIS
B<openssl> B<verify>
-[B<-CApath directory>]
[B<-CAfile file>]
+[B<-CApath directory>]
+[B<-attime timestamp>]
[B<-check_ss_sig>]
-[B<-trusted_first>]
-[B<-purpose purpose>]
-[B<-policy arg>]
-[B<-ignore_critical>]
[B<-crl_check>]
[B<-crl_check_all>]
-[B<-policy_check>]
[B<-explicit_policy>]
-[B<-inhibit_any>]
-[B<-inhibit_map>]
-[B<-x509_strict>]
[B<-extended_crl>]
-[B<-use_deltas>]
-[B<-policy_print>]
-[B<-untrusted file>]
[B<-help>]
+[B<-ignore_critical>]
+[B<-inhibit_any>]
+[B<-inhibit_map>]
[B<-issuer_checks>]
-[B<-attime timestamp>]
[B<-partial_chain>]
+[B<-policy arg>]
+[B<-policy_check>]
+[B<-policy_print>]
+[B<-purpose purpose>]
[B<-suiteB_128>]
[B<-suiteB_128_only>]
[B<-suiteB_192>]
+[B<-trusted_first>]
+[B<-untrusted file>]
+[B<-use_deltas>]
[B<-verbose>]
[B<-verify_depth num>]
[B<-verify_email email>]
[B<-verify_hostname hostname>]
[B<-verify_ip ip>]
[B<-verify_name name>]
+[B<-x509_strict>]
[B<->]
[certificates]
=over 4
+=item B<-CAfile file>
+
+A file of trusted certificates. The file should contain multiple certificates
+in PEM format concatenated together.
+
=item B<-CApath directory>
A directory of trusted certificates. The certificates should have names
of the B<x509> utility). Under Unix the B<c_rehash> script will automatically
create symbolic links to a directory of certificates.
-=item B<-CAfile file>
+=item B<-attime timestamp>
-A file of trusted certificates. The file should contain multiple certificates
-in PEM format concatenated together.
+Perform validation checks using time specified by B<timestamp> and not
+current system time. B<timestamp> is the number of seconds since
+01.01.1970 (UNIX time).
-=item B<-untrusted file>
+=item B<-check_ss_sig>
-A file of untrusted certificates. The file should contain multiple certificates
-in PEM format concatenated together.
+Verify the signature on the self-signed root CA. This is disabled by default
+because it doesn't add any security.
-=item B<-trusted_first>
+=item B<-crl_check>
-Use certificates in CA file or CA directory before certificates in untrusted
-file when building the trust chain to verify certificates.
-This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
+Checks end entity certificate validity by attempting to look up a valid CRL.
+If a valid CRL cannot be found an error occurs.
-=item B<-purpose purpose>
+=item B<-crl_check_all>
-The intended use for the certificate. If this option is not specified,
-B<verify> will not consider certificate purpose during chain verification.
-Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
-B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
-information.
+Checks the validity of B<all> certificates in the chain by attempting
+to look up valid CRLs.
+
+=item B<-explicit_policy>
+
+Set policy variable require-explicit-policy (see RFC5280).
+
+=item B<-extended_crl>
+
+Enable extended CRL features such as indirect CRLs and alternate CRL
+signing keys.
=item B<-help>
Print out a usage message.
-=item B<-verbose>
+=item B<-ignore_critical>
-Print extra information about the operations being performed.
+Normally if an unhandled critical extension is present which is not
+supported by OpenSSL the certificate is rejected (as required by RFC5280).
+If this option is set critical extensions are ignored.
+
+=item B<-inhibit_any>
+
+Set policy variable inhibit-any-policy (see RFC5280).
+
+=item B<-inhibit_map>
+
+Set policy variable inhibit-policy-mapping (see RFC5280).
=item B<-issuer_checks>
anything is wrong; during the normal verification process, several
rejections may take place.
-=item B<-attime timestamp>
+=item B<-partial_chain>
-Perform validation checks using time specified by B<timestamp> and not
-current system time. B<timestamp> is the number of seconds since
-01.01.1970 (UNIX time).
+Allow partial certificate chain if at least one certificate is in trusted store.
=item B<-policy arg>
Enables certificate policy processing.
-=item B<-explicit_policy>
-
-Set policy variable require-explicit-policy (see RFC5280).
-
-=item B<-inhibit_any>
-
-Set policy variable inhibit-any-policy (see RFC5280).
-
-=item B<-inhibit_map>
-
-Set policy variable inhibit-policy-mapping (see RFC5280).
-
=item B<-policy_print>
Print out diagnostics related to policy processing.
-=item B<-crl_check>
-
-Checks end entity certificate validity by attempting to look up a valid CRL.
-If a valid CRL cannot be found an error occurs.
-
-=item B<-crl_check_all>
+=item B<-purpose purpose>
-Checks the validity of B<all> certificates in the chain by attempting
-to look up valid CRLs.
+The intended use for the certificate. If this option is not specified,
+B<verify> will not consider certificate purpose during chain verification.
+Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
+B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
+information.
-=item B<-ignore_critical>
+=item B<-suiteB_128_only>, B<-suiteB_128>, B<-suiteB_192>
-Normally if an unhandled critical extension is present which is not
-supported by OpenSSL the certificate is rejected (as required by RFC5280).
-If this option is set critical extensions are ignored.
+enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
+192 bit, or only 192 bit Level of Security respectively.
+See RFC6460 for details. In particular the supported signature algorithms are
+reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves
+P-256 and P-384.
-=item B<-x509_strict>
+=item B<-trusted_first>
-For strict X.509 compliance, disable non-compliant workarounds for broken
-certificates.
+Use certificates in CA file or CA directory before certificates in untrusted
+file when building the trust chain to verify certificates.
+This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
-=item B<-extended_crl>
+=item B<-untrusted file>
-Enable extended CRL features such as indirect CRLs and alternate CRL
-signing keys.
+A file of untrusted certificates. The file should contain multiple certificates
+in PEM format concatenated together.
=item B<-use_deltas>
Enable support for delta CRLs.
-=item B<-check_ss_sig>
-
-Verify the signature on the self-signed root CA. This is disabled by default
-because it doesn't add any security.
-
-=item B<-partial_chain>
-
-Allow partial certificate chain if at least one certificate is in trusted store.
-
-=item B<-suiteB_128_only>, B<-suiteB_128>, B<-suiteB_192>
+=item B<-verbose>
-enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
-192 bit, or only 192 bit Level of Security respectively.
-See RFC6460 for details. In particular the supported signature algorithms are
-reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves
-P-256 and P-384.
+Print extra information about the operations being performed.
=item B<-verify_depth num>
policies identified by B<name>.
Supported usages include: default, pkcs7, smime_sign, ssl_client, ssl_server.
+=item B<-x509_strict>
+
+For strict X.509 compliance, disable non-compliant workarounds for broken
+certificates.
+
=item B<->
Indicates the last option. All arguments following this are assumed to be
projects / openssl.git / blobdiff