=head1 NAME
+openssl-verify,
verify - Utility to verify certificates
=head1 SYNOPSIS
[B<-ignore_critical>]
[B<-inhibit_any>]
[B<-inhibit_map>]
+[B<-nameopt option>]
[B<-no_check_time>]
[B<-partial_chain>]
[B<-policy arg>]
The B<verify> command verifies certificate chains.
-=head1 COMMAND OPTIONS
+=head1 OPTIONS
=over 4
=item B<-no-CAfile>
-Do not load the trusted CA certificates from the default file location
+Do not load the trusted CA certificates from the default file location.
=item B<-no-CApath>
-Do not load the trusted CA certificates from the default directory location
+Do not load the trusted CA certificates from the default directory location.
=item B<-allow_proxy_certs>
-Allow the verification of proxy certificates
+Allow the verification of proxy certificates.
=item B<-attime timestamp>
Set policy variable inhibit-policy-mapping (see RFC5280).
+=item B<-nameopt option>
+
+Option which determines how the subject or issuer names are displayed. The
+B<option> argument can be a single option or multiple options separated by
+commas. Alternatively the B<-nameopt> switch may be used more than once to
+set multiple options. See the L<x509(1)> manual page for details.
+
=item B<-no_check_time>
This option suppresses checking the validity period of certificates and CRLs
=item B<-suiteB_128_only>, B<-suiteB_128>, B<-suiteB_192>
-enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
+Enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
192 bit, or only 192 bit Level of Security respectively.
See RFC6460 for details. In particular the supported signature algorithms are
reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves
=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE>
-The certificate signature could not be decrypted. This means that the actual signature value
-could not be determined rather than it not matching the expected value, this is only
-meaningful for RSA keys.
+The certificate signature could not be decrypted. This means that the
+actual signature value could not be determined rather than it not matching
+the expected value, this is only meaningful for RSA keys.
=item B<X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE>
-The CRL signature could not be decrypted: this means that the actual signature value
-could not be determined rather than it not matching the expected value. Unused.
+The CRL signature could not be decrypted: this means that the actual
+signature value could not be determined rather than it not matching the
+expected value. Unused.
=item B<X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY>
=item B<X509_V_ERR_CERT_NOT_YET_VALID>
-The certificate is not yet valid: the notBefore date is after the current time.
+The certificate is not yet valid: the notBefore date is after the
+current time.
=item B<X509_V_ERR_CERT_HAS_EXPIRED>
-The certificate has expired: that is the notAfter date is before the current time.
+The certificate has expired: that is the notAfter date is before the
+current time.
=item B<X509_V_ERR_CRL_NOT_YET_VALID>
=item B<X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT>
-The passed certificate is self-signed and the same certificate cannot be found in the list of
-trusted certificates.
+The passed certificate is self-signed and the same certificate cannot
+be found in the list of trusted certificates.
=item B<X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN>
-The certificate chain could be built up using the untrusted certificates but the root could not
-be found locally.
+The certificate chain could be built up using the untrusted certificates
+but the root could not be found locally.
=item B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY>
=item B<X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE>
-No signatures could be verified because the chain contains only one certificate and it is not
-self signed.
+No signatures could be verified because the chain contains only one
+certificate and it is not self signed.
=item B<X509_V_ERR_CERT_CHAIN_TOO_LONG>
-The certificate chain length is greater than the supplied maximum depth. Unused.
+The certificate chain length is greater than the supplied maximum
+depth. Unused.
=item B<X509_V_ERR_CERT_REVOKED>
=item B<X509_V_ERR_INVALID_CA>
-A CA certificate is invalid. Either it is not a CA or its extensions are not consistent
-with the supplied purpose.
+A CA certificate is invalid. Either it is not a CA or its extensions
+are not consistent with the supplied purpose.
=item B<X509_V_ERR_PATH_LENGTH_EXCEEDED>
=item B<X509_V_ERR_CERT_UNTRUSTED>
-the root CA is not marked as trusted for the specified purpose.
+The root CA is not marked as trusted for the specified purpose.
=item B<X509_V_ERR_CERT_REJECTED>
=item B<X509_V_ERR_SUBJECT_ISSUER_MISMATCH>
-not used as of OpenSSL 1.1.0 as a result of the deprecation of the
+Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
B<-issuer_checks> option.
=item B<X509_V_ERR_AKID_SKID_MISMATCH>
certificate chain.
This error is only possible in L<s_client(1)>.
+=item B<X509_V_ERR_EE_KEY_TOO_SMALL>
+
+EE certificate key too weak.
+
+=item B<X509_ERR_CA_KEY_TOO_SMALL>
+
+CA certificate key too weak.
+
+=item B<X509_ERR_CA_MD_TOO_WEAK>
+
+CA signature digest algorithm too weak.
+
+=item B<X509_V_ERR_INVALID_CALL>
+
+nvalid certificate verification context.
+
+=item B<X509_V_ERR_STORE_LOOKUP>
+
+Issuer certificate lookup error.
+
+=item B<X509_V_ERR_NO_VALID_SCTS>
+
+Certificate Transparency required, but no valid SCTs found.
+
+=item B<X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION>
+
+Proxy subject name violation.
+
+=item B<X509_V_ERR_OCSP_VERIFY_NEEDED>
+
+Returned by the verify callback to indicate an OCSP verification is needed.
+
+=item B<X509_V_ERR_OCSP_VERIFY_FAILED>
+
+Returned by the verify callback to indicate OCSP verification failed.
+
+=item B<X509_V_ERR_OCSP_CERT_UNKNOWN>
+
+Returned by the verify callback to indicate that the certificate is not recognized
+by the OCSP responder.
+
=back
=head1 BUGS
-Although the issuer checks are a considerable improvement over the old technique they still
-suffer from limitations in the underlying X509_LOOKUP API. One consequence of this is that
-trusted certificates with matching subject name must either appear in a file (as specified by the
-B<-CAfile> option) or a directory (as specified by B<-CApath>). If they occur in both then only
-the certificates in the file will be recognised.
+Although the issuer checks are a considerable improvement over the old
+technique they still suffer from limitations in the underlying X509_LOOKUP
+API. One consequence of this is that trusted certificates with matching
+subject name must either appear in a file (as specified by the B<-CAfile>
+option) or a directory (as specified by B<-CApath>). If they occur in
+both then only the certificates in the file will be recognised.
-Previous versions of OpenSSL assume certificates with matching subject name are identical and
-mishandled them.
+Previous versions of OpenSSL assume certificates with matching subject
+name are identical and mishandled them.
Previous versions of this documentation swapped the meaning of the
B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT> and
=head1 HISTORY
-The B<-show_chain> option was first added to OpenSSL 1.1.0.
+The B<-show_chain> option was added in OpenSSL 1.1.0.
The B<-issuer_checks> option is deprecated as of OpenSSL 1.1.0 and
is silently ignored.
=head1 COPYRIGHT
-Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
projects / openssl.git / blobdiff