=head1 DESCRIPTION
-The B<verify> command verifies certificate chains.
+This command verifies certificate chains.
=head1 OPTIONS
=item B<-CApath> I<directory>
A directory of trusted certificates. The certificates should have names
-of the form: F<I<hash>.0> or have symbolic links to them of this
-form (I<hash> is the hashed certificate subject name: see the B<-hash> option
-of the B<x509> utility). Under Unix the B<c_rehash> script will automatically
-create symbolic links to a directory of certificates.
+of the form: F<I<hash>.0> or have symbolic links to them of this form
+(I<hash> is the hashed certificate subject name: see the L<openssl-x509(1)>
+B<-hash> option). Under Unix, L<openssl-rehash(1)> will automatically create
+symbolic links to a directory of certificates.
=item B<-no-CAfile>
=item B<-engine> I<id>
-Specifying an engine I<id> will cause L<verify(1)> to attempt to load the
+Specifying an engine I<id> will cause this command to attempt to load the
specified engine.
The engine will then be set as the default for all its supported algorithms.
If you want to load certificates or CRLs that require engine support via any of
Option which determines how the subject or issuer names are displayed. The
I<option> argument can be a single option or multiple options separated by
commas. Alternatively the B<-nameopt> switch may be used more than once to
-set multiple options. See the L<x509(1)> manual page for details.
+set multiple options. See the L<openssl-x509(1)> manual page for details.
=item B<-no_check_time>
=item B<-purpose> I<purpose>
The intended use for the certificate. If this option is not specified,
-B<verify> will not consider certificate purpose during chain verification.
+this command will not consider certificate purpose during chain
+verification.
Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
-B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
+B<smimesign>, B<smimeencrypt>. See the L</VERIFY OPERATION> section for more
information.
=item B<-suiteB_128_only>, B<-suiteB_128>, B<-suiteB_192>
policies identified by I<name>.
The trust model determines which auxiliary trust or reject OIDs are applicable
to verifying the given certificate chain.
-See the B<-addtrust> and B<-addreject> options of the L<x509(1)> command-line
-utility.
+See the B<-addtrust> and B<-addreject> options for L<openssl-x509(1)>.
Supported policy names include: B<default>, B<pkcs7>, B<smime_sign>,
B<ssl_client>, B<ssl_server>.
These mimics the combinations of purpose and trust settings used in SSL, CMS
Indicates the last option. All arguments following this are assumed to be
certificate files. This is useful if the first certificate filename begins
-with a B<->.
+with a B<-->.
=item I<certificate> ...
-One or more certificates to verify. If no certificates are given, B<verify>
-will attempt to read a certificate from standard input. Certificates must be
-in PEM format.
+One or more certificates to verify. If no certificates are given,
+this command will attempt to read a certificate from standard input.
+Certificates must be in PEM format.
=back
=head1 VERIFY OPERATION
-The B<verify> program uses the same functions as the internal SSL and S/MIME
-verification, therefore this description applies to these verify operations
-too.
+This command uses the same functions as the internal SSL
+and S/MIME verification, therefore this description applies to these verify
+operations too.
There is one crucial difference between the verify operations performed
-by the B<verify> program: wherever possible an attempt is made to continue
-after an error whereas normally the verify operation would halt on the
-first error. This allows all the problems with a certificate chain to be
+by this command: wherever possible an attempt is made to
+continue after an error whereas normally the verify operation would halt on
+the first error. This allows all the problems with a certificate chain to be
determined.
The verify operation consists of a number of separate steps.
The second operation is to check every untrusted certificate's extensions for
consistency with the supplied purpose. If the B<-purpose> option is not included
then no checks are done. The supplied or "leaf" certificate must have extensions
-compatible with the supplied purpose and all other certificates must also be valid
-CA certificates. The precise extensions required are described in more detail in
-the B<CERTIFICATE EXTENSIONS> section of the B<x509> utility.
+compatible with the supplied purpose and all other certificates must also be
+valid CA certificates. The precise extensions required are described in more
+detail in L<openssl-x509(1)/CERTIFICATE EXTENSIONS>.
The third operation is to check the trust settings on the root CA. The root CA
should be trusted for the supplied purpose.
For compatibility with previous versions of OpenSSL, a certificate with no
trust settings is considered to be valid for all purposes.
-The final operation is to check the validity of the certificate chain. The validity
-period is checked against the current system time and the notBefore and notAfter
-dates in the certificate. The certificate signatures are also checked at this
-point.
+The final operation is to check the validity of the certificate chain. The
+validity period is checked against the current system time and the notBefore
+and notAfter dates in the certificate. The certificate signatures are also
+checked at this point.
If all operations complete successfully then certificate is considered valid. If
any operation fails then the certificate is not valid.
of the error number is presented.
A partial list of the error codes and messages is shown below, this also
-includes the name of the error code as defined in the header file x509_vfy.h
+includes the name of the error code as defined in the header file
+F<< <openssl/x509_vfy.h> >>.
Some of the error codes are defined but never returned: these are described
as "unused".
DANE TLSA authentication is enabled, but no TLSA records matched the
certificate chain.
-This error is only possible in L<s_client(1)>.
+This error is only possible in L<openssl-s_client(1)>.
=item B<X509_V_ERR_EE_KEY_TOO_SMALL>
projects / openssl.git / blobdiff