From: Dr. Stephen Henson <steve@openssl.org>
Date: Tue, 24 Feb 2015 13:52:21 +0000 (+0000)
Subject: Document -no_explicit
X-Git-Tag: OpenSSL_1_1_0-pre1~1617
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=384dee51242e950c56b3bac32145957bfbf3cd4b;ds=sidebyside

Document -no_explicit

Reviewed-by: Rich Salz <rsalz@openssl.org>
---

diff --git a/doc/apps/ocsp.pod b/doc/apps/ocsp.pod
index 296b13ce50..b32086cd2a 100644
--- a/doc/apps/ocsp.pod
+++ b/doc/apps/ocsp.pod
@@ -66,6 +66,7 @@ B<openssl> B<ocsp>
 [B<-no_cert_verify>]
 [B<-no_chain>]
 [B<-no_cert_checks>]
+[B<-no_explicit>]
 [B<-port num>]
 [B<-index file>]
 [B<-CA file>]
@@ -226,6 +227,10 @@ testing purposes.
 do not use certificates in the response as additional untrusted CA
 certificates.
 
+=item B<-no_explicit>
+
+do not explicitly trust the root CA if it is set to be trusted for OCSP signing.
+
 =item B<-no_cert_checks>
 
 don't perform any additional checks on the OCSP response signers certificate.
@@ -338,8 +343,9 @@ CA certificate in the request. If there is a match and the OCSPSigning
 extended key usage is present in the OCSP responder certificate then the
 OCSP verify succeeds.
 
-Otherwise the root CA of the OCSP responders CA is checked to see if it
-is trusted for OCSP signing. If it is the OCSP verify succeeds.
+Otherwise, if B<-no_explicit> is B<not> set the root CA of the OCSP responders
+CA is checked to see if it is trusted for OCSP signing. If it is the OCSP
+verify succeeds.
 
 If none of these checks is successful then the OCSP verify fails.