Command docs: more reference fixes

[openssl.git] / doc / man1 / openssl-verify.pod

diff --git a/doc/man1/openssl-verify.pod b/doc/man1/openssl-verify.pod
index 6c1f3ed..d795afc 100644 (file)
--- a/doc/man1/openssl-verify.pod
+++ b/doc/man1/openssl-verify.pod
@@ -161,7 +161,7 @@ Set policy variable inhibit-policy-mapping (see RFC5280).
 Option which determines how the subject or issuer names are displayed. The
 I<option> argument can be a single option or multiple options separated by
 commas.  Alternatively the B<-nameopt> switch may be used more than once to
-set multiple options. See the L<x509(1)> manual page for details.
+set multiple options. See the L<openssl-x509(1)> manual page for details.
 
 =item B<-no_check_time>
 
@@ -195,7 +195,7 @@ The intended use for the certificate. If this option is not specified,
 this command will not consider certificate purpose during chain
 verification.
 Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
-B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
+B<smimesign>, B<smimeencrypt>. See the L</VERIFY OPERATION> section for more
 information.
 
 =item B<-suiteB_128_only>, B<-suiteB_128>, B<-suiteB_192>
@@ -333,7 +333,7 @@ certificate. The argument for this option is string of hexadecimal digits.
 
 Indicates the last option. All arguments following this are assumed to be
 certificate files. This is useful if the first certificate filename begins
-with a B<->.
+with a B<-->.
 
 =item I<certificate> ...
 
@@ -383,19 +383,19 @@ list.
 The second operation is to check every untrusted certificate's extensions for
 consistency with the supplied purpose. If the B<-purpose> option is not included
 then no checks are done. The supplied or "leaf" certificate must have extensions
-compatible with the supplied purpose and all other certificates must also be valid
-CA certificates. The precise extensions required are described in more detail in
-the B<CERTIFICATE EXTENSIONS> section of the B<x509> utility.
+compatible with the supplied purpose and all other certificates must also be
+valid CA certificates. The precise extensions required are described in more
+detail in L<openssl-x509(1)/CERTIFICATE EXTENSIONS>.
 
 The third operation is to check the trust settings on the root CA. The root CA
 should be trusted for the supplied purpose.
 For compatibility with previous versions of OpenSSL, a certificate with no
 trust settings is considered to be valid for all purposes.
 
-The final operation is to check the validity of the certificate chain. The validity
-period is checked against the current system time and the notBefore and notAfter
-dates in the certificate. The certificate signatures are also checked at this
-point.
+The final operation is to check the validity of the certificate chain. The
+validity period is checked against the current system time and the notBefore
+and notAfter dates in the certificate. The certificate signatures are also
+checked at this point.
 
 If all operations complete successfully then certificate is considered valid. If
 any operation fails then the certificate is not valid.
@@ -416,7 +416,8 @@ then 1 for the CA that signed the certificate and so on. Finally a text version
 of the error number is presented.
 
 A partial list of the error codes and messages is shown below, this also
-includes the name of the error code as defined in the header file x509_vfy.h
+includes the name of the error code as defined in the header file
+F<< <openssl/x509_vfy.h> >>.
 Some of the error codes are defined but never returned: these are described
 as "unused".
 
@@ -708,7 +709,7 @@ IP address mismatch.
 
 DANE TLSA authentication is enabled, but no TLSA records matched the
 certificate chain.
-This error is only possible in L<s_client(1)>.
+This error is only possible in L<openssl-s_client(1)>.
 
 =item B<X509_V_ERR_EE_KEY_TOO_SMALL>