Update X509v3 doc.

[openssl.git] / doc / apps / x509v3_config.pod

diff --git a/doc/apps/x509v3_config.pod b/doc/apps/x509v3_config.pod
index b19f52136cbd74b6d7987bfe9b004efec06d7a4c..049e854ee894693d17b56075f1afc976ff969c0b 100644 (file)
--- a/doc/apps/x509v3_config.pod
+++ b/doc/apps/x509v3_config.pod
@@ -50,7 +50,7 @@ use is defined by the extension code itself: check out the certificate
 policies extension for an example.
 
 If an extension type is unsupported then the I<arbitrary> extension syntax
-must be used, see the ARBITRARY EXTENSION section for more details.
+must be used, see the L<ARBITRART EXTENSIONS|/"ARBITRARY EXTENSIONS"> section for more details.
 
 =head1 STANDARD EXTENSIONS
 
@@ -148,8 +148,12 @@ identifier from the parent certificate. If the value "always" is present
 then an error is returned if the option fails.
 
 The issuer option copies the issuer and serial number from the issuer
-certificate. Normally this will only be done if the keyid option fails or
-is not included: the "always" flag will always include the value.
+certificate. This will only be done if the keyid option fails or
+is not included unless the "always" flag will always include the value.
+
+Example:
+
+ authorityKeyIdentifier=keyid,issuer
 
 
 =head2 Subject Alternative Name.
@@ -164,6 +168,8 @@ The email option include a special 'copy' value. This will automatically
 include and email addresses contained in the certificate subject name in
 the extension.
 
+The IP address used in the B<IP> options can be in either IPv4 or IPv6 format.
+
 The value of B<dirName> should point to a section containing the distinguished
 name to use as a set of name value pairs. Multi values AVAs can be formed by
 preceeding the name with a B<+> character.
@@ -175,6 +181,8 @@ ASN1_generate_nconf() format.
 Examples:
 
  subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/
+ subjectAltName=IP:192.168.7.1
+ subjectAltName=IP:13::17
  subjectAltName=email:my@other.address,RID:1.2.3.4
  subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
 
@@ -233,7 +241,7 @@ Examples:
 
 =head2 Certificate Policies.
 
-This is a B<raw> extension. All the fields of this extension can be set by
+This is a I<raw> extension. All the fields of this extension can be set by
 using the appropriate syntax.
 
 If you follow the PKIX recommendations and just using one OID then you just
@@ -284,11 +292,46 @@ The B<ia5org> option changes the type of the I<organization> field. In RFC2459
 it can only be of type DisplayText. In RFC3280 IA5Strring is also permissible.
 Some software (for example some versions of MSIE) may require ia5org.
 
+=head2 Policy Constraints
+
+This is a multi-valued extension which consisting of the names
+B<requireExplicitPolicy> or B<inhibitPolicyMapping> and a non negative intger
+value. At least one component must be present.
+
+Example:
+
+ policyConstraints = requireExplicitPolicy:3
+
+
+=head2 Inhibit Any Policy
+
+This is a string extension whose value must be a non negative integer.
+
+Example:
+
+ inhibitAnyPolicy = 2
+
+
+=head2 Name Constraints
+
+The name constraints extension is a multi-valued extension. The name should
+begin with the word B<permitted> or B<excluded> followed by a B<;>. The rest of
+the name and the value follows the syntax of subjectAltName except email:copy
+is not supported and the B<IP> form should consist of an IP addresses and 
+subnet mask separated by a B</>.
+
+Examples:
+
+ nameConstraints=permitted;IP:192.168.0.0/255.255.0.0
+
+ nameConstraints=permitted;email:.somedomain.com
+
+ nameConstraints=excluded;email:.com
 
 =head1 DEPRECATED EXTENSIONS
 
-The following extensions are considered non standard, Netscape specific and
-largely obsolete. Their use in new applications is discouraged.
+The following extensions are non standard, Netscape specific and largely
+obsolete. Their use in new applications is discouraged.
 
 =head2 Netscape String extensions.
 
@@ -392,3 +435,20 @@ will only recognize the last value. This can be worked around by using the form:
 
  email.1=steve@here
  email.2=steve@there
+
+=head1 HISTORY
+
+The X509v3 extension code was first added to OpenSSL 0.9.2.
+
+Policy mappings, name constraints, inhibit any policy and name
+constraints support was added in OpenSSL 0.9.8
+
+The B<directoryName> and B<otherName> option as well as the B<ASN1> option
+for arbitrary extensions was added in OpenSSL 0.9.8
+
+=head1 SEE ALSO
+
+L<req(1)|req(1)>, L<ca(1)|ca(1)>, L<x509(1)|x509(1)>
+
+
+=cut