SSL_CONF additions.

[openssl.git] / doc / ssl / SSL_CONF_cmd.pod

diff --git a/doc/ssl/SSL_CONF_cmd.pod b/doc/ssl/SSL_CONF_cmd.pod
index c4f1309c03308c9e38a1d0237b86a30e915ab286..16b368a6f394159342af289bc770f0fc18f8094e 100644 (file)
--- a/doc/ssl/SSL_CONF_cmd.pod
+++ b/doc/ssl/SSL_CONF_cmd.pod
@@ -195,6 +195,12 @@ context. This option is only supported if certificate operations
 are permitted. Note: if no B<PrivateKey> option is set then a private key is
 not loaded unless the B<SSL_CONF_FLAG_REQUIRE_PRIVATE> is set.
 
+=item B<ChainCAFile>, B<ChainCAPath>, B<VerifyCAFile>, B<VerifyCAPath>
+
+These options indicate a file or directory used for building certificate
+chains or verifying certificate chains. These options are only supported
+if certificate operations are permitted.
+
 =item B<ServerInfoFile>
 
 Attempts to use the file B<value> in the "serverinfo" extension using the
@@ -306,6 +312,27 @@ B<UnsafeLegacyServerConnect> permits the use of unsafe legacy renegotiation
 for OpenSSL clients only. Equivalent to B<SSL_OP_LEGACY_SERVER_CONNECT>.
 Set by default.
 
+=item B<VerifyMode>
+
+The B<value> argument is a comma separated list of flags to set.
+
+B<Peer> enables peer verification: for clients only.
+
+B<Request> requests but does not require a certificate from the client.
+Servers only.
+
+B<Require> requests and requires a certificate from the client: an error
+occurs if the client does not present a certificate. Servers only.
+
+B<Once> requests a certificate from a client only on the initial connection:
+not when renegotiating. Servers only.
+
+=item B<ClientCAFile>, B<ClientCAPath>
+
+A file or directory of certificates in PEM format whose names are used as the
+set of acceptable names for client CAs. Servers only. This option is only
+supported if certificate operations are permitted.
+
 =back
 
 =head1 SUPPORTED COMMAND TYPES
@@ -332,6 +359,11 @@ The value is a file name.
 
 The value is a directory name.
 
+=item B<SSL_CONF_TYPE_NONE>
+
+The value string is not used e.g. a command line option which doesn't take an
+argument.
+
 =back
 
 =head1 NOTES
@@ -438,4 +470,8 @@ SSL_CONF_cmd() was first added to OpenSSL 1.0.2
 B<SSL_OP_NO_SSL2> doesn't have effect anymore since 1.1.0 but the define is kept
 for backward compatibility.
 
+B<SSL_CONF_TYPE_NONE> was first added to OpenSSL 1.1.0. In earlier versions of
+OpenSSL passing a command which didn't take an argument would return
+B<SSL_CONF_TYPE_UNKNOWN>.
+
 =cut