| /freebsd-9-stable/crypto/heimdal/lib/hx509/ |
| D | test_ca.in | 58 ${hxtool} issue-certificate \
59 --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
62 --certificate="FILE:cert-ee.pem" || exit 1
106 ${hxtool} issue-certificate \
107 --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
111 --certificate="FILE:cert-ee.pem" || exit 1
114 ${hxtool} issue-certificate \
115 --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
120 --certificate="FILE:cert-ee.pem" || exit 1
123 ${hxtool} issue-certificate \
[all …]
|
| D | hxtool-commands.in | 38 long = "certificate"
41 argument = "certificate-store"
42 help = "certificate stores to pull certificates from"
49 help = "certificate to sign with"
54 argument = "certificate-store"
60 argument = "certificate-pool"
61 help = "certificate store to pull certificates from"
111 argument = "certificate-store"
115 long = "certificate"
118 argument = "certificate-store"
[all …]
|
| D | test_cms.in | 53 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
66 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
88 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test-pw.key \
101 --certificate=FILE:$srcdir/data/test.combined.crt \
114 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
129 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
143 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
150 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
159 --certificate=PKCS12:$srcdir/data/test.p12 \
192 --certificate=FILE:$srcdir/data/test.crt \
[all …]
|
| D | test_windows.in | 52 ${hxtool} issue-certificate \
58 --certificate="FILE:wca.pem" || exit 1
61 ${hxtool} issue-certificate \
67 --certificate="FILE:wdc.pem" \
70 --ca-certificate=FILE:wca.pem || exit 1
74 ${hxtool} issue-certificate \
81 --certificate="FILE:wuser.pem" \
82 --ca-certificate=FILE:wca.pem || exit 1
|
| /freebsd-9-stable/crypto/openssl/doc/apps/ |
| D | verify.pod | 37 The B<verify> command verifies certificate chains.
52 form ("hash" is the hashed certificate subject name: see the B<-hash> option
69 Checks end entity certificate validity by attempting to look up a valid CRL.
88 supported by OpenSSL the certificate is rejected (as required by RFC5280).
101 Print out diagnostics relating to searches for the issuer certificate of the
102 current certificate. This shows why each candidate issuer certificate was
115 Enables certificate policy processing.
123 The intended use for the certificate. If this option is not specified,
124 B<verify> will not consider certificate purpose during chain verification.
144 Limit the maximum depth of the certificate chain to B<num> certificates.
[all …]
|
| D | x509.pod | 63 The B<x509> command is a multi purpose certificate utility. It can be
64 used to display certificate information, convert certificates to
65 various forms, sign certificate requests like a "mini CA" or edit
66 certificate trust settings.
80 certificate but this can change if other options such as B<-req> are
81 present. The DER format is the DER encoding of the certificate and PEM
93 This specifies the input filename to read a certificate from or standard input
126 prints out the certificate in text form. Full details are output including the
144 contained in the certificate.
148 outputs the certificate serial number.
[all …]
|
| D | nseq.pod | 5 nseq - create or examine a netscape certificate sequence
16 The B<nseq> command takes a file containing a Netscape certificate
18 file of certificates and converts it into a Netscape certificate
36 normally a Netscape certificate sequence will be input and the output
38 situation is reversed: a Netscape certificate sequence is created from
45 Output the certificates in a Netscape certificate sequence
49 Create a Netscape certificate sequence
55 The B<PEM> encoded form uses the same headers and footers as a certificate:
60 A Netscape certificate sequence is a Netscape specific form that can be sent
62 certificates are sent to the browser: for example during certificate enrollment.
[all …]
|
| D | ocsp.pod | 58 determine the (revocation) state of an identified certificate (RFC 2560).
74 This specifies the current issuer certificate. This option can be used
75 multiple times. The certificate specified in B<filename> must be in
80 Add the certificate B<filename> to the request. The issuer certificate
82 issuer certificate is specified.
86 Same as the B<cert> option except the certificate with serial number
93 Sign the OCSP request using the certificate specified in the B<signer>
96 from the same file as the certificate. If neither option is specified then
117 write out the DER encoded certificate request or response to B<file>.
143 the OCSP response signing certificate. Some responders omit the actual signer's
[all …]
|
| D | CA.pl.pod | 6 CA.pl - friendlier interface for OpenSSL certificate programs
28 arguments to the B<openssl> command for some common certificate operations.
29 It is intended to simplify the process of certificate creation and management
42 creates a new self signed certificate. The private key is written to the file
47 creates a new certificate request. The private key is written to the file
64 create a PKCS#12 file containing the user certificate, private key and CA
65 certificate. It expects the user certificate and private key to be in the
66 file "newcert.pem" and the CA certificate to be in the file demoCA/cacert.pem,
70 "friendly name" for the certificate (which is typically displayed in the browser
75 calls the B<ca> program to sign a certificate request. It expects the request
[all …]
|
| D | ca.pod | 57 to sign certificate requests in a variety of forms and generate
78 an input filename containing a single certificate request to be
83 a single self signed certificate to be signed by the CA.
94 are assumed to be the names of files containing certificate requests.
99 output. The certificate details will also be printed out to this
104 the directory to output certificates to. The certificate will be
110 the CA certificate file.
130 the certificate requests were signed with (given with B<-keyfile>).
136 certificate appears among the entries in the certificate database
139 self-signed certificate.
[all …]
|
| D | s_server.pod | 79 The certificate to use, most servers cipher suites require the use of a
80 certificate and some require a certificate with a certain public key type:
81 for example the DSS cipher suites require a certificate containing a DSS
86 The certificate format to use: DER or PEM. PEM is the default.
90 The private key to use. If not specified then the certificate file will
104 specify an additional certificate and private key, these behave in the
106 if they are not specified (no additional certificate and key is used). As
107 noted above some cipher suites require a certificate containing a key of
108 a certain type. Some cipher suites need a certificate carrying an RSA key
111 by using an appropriate certificate.
[all …]
|
| /freebsd-9-stable/crypto/openssl/doc/HOWTO/ |
| D | certificates.txt | 13 This file is for users who wish to get a certificate of their own.
29 keys, so before you create a certificate or a certificate request, you
39 3. Creating a certificate request
41 To create a certificate, you need to start with a certificate
42 request (or, as some certificate authorities like to put
43 it, "certificate signing request", since that's exactly what they do,
45 according to their policies). A certificate request can then be sent
46 to a certificate authority to get it signed into a certificate, or if
47 you have your own certificate authority, you may sign it yourself, or
48 if you need a self-signed certificate (because you just want a test
[all …]
|
| D | proxy_certificates.txt | 16 either directly with the EE certificate as issuing certificate, or by
17 extension through an already issued proxy certificate.. They are used
20 name of the owner of the EE certificate.
32 to be the certificate to check for authorisation data, and since proxy
33 certificates are controlled by the EE certificate owner alone, it's
34 would be normal to consider what the EE certificate owner could do
58 - in all other cases, proxy certificate validation can be enabled
74 # A proxy certificate MUST NEVER be a CA certificate.
80 # Now, for the extension that marks this certificate as a proxy one
132 granted to the process using the proxy certificate. The value is
[all …]
|
| /freebsd-9-stable/crypto/openssl/doc/ssl/ |
| D | SSL_CTX_set_client_cert_cb.pod | 5 SSL_CTX_set_client_cert_cb, SSL_CTX_get_client_cert_cb - handle client certificate callback function
18 called when a client certificate is requested by a server and no certificate
27 set a certificate, a certificate/private key combination must be set
29 certificate will be installed into B<ssl>, see the NOTES and BUGS sections.
30 If no certificate should be set, "0" has to be returned and no certificate
40 During a handshake (or renegotiation) a server may request a certificate
41 from the client. A client certificate must only be sent, when the server
44 When a certificate was set using the
47 certificate is sent, if it matches the list of acceptable CAs sent by the
50 selection routine or to allow a user interaction to choose the certificate to
[all …]
|
| D | SSL_CTX_use_certificate.pod | 5 …SAPrivateKey_file, SSL_CTX_check_private_key, SSL_check_private_key - load certificate and key data
51 SSL_CTX_use_certificate() loads the certificate B<x> into B<ctx>,
53 certificates needed to form the complete certificate chain can be
58 SSL_CTX_use_certificate_ASN1() loads the ASN1 encoded certificate from
60 SSL_use_certificate_ASN1() loads the ASN1 encoded certificate into B<ssl>.
62 SSL_CTX_use_certificate_file() loads the first certificate stored in B<file>
63 into B<ctx>. The formatting B<type> of the certificate must be specified
65 SSL_use_certificate_file() loads the certificate from B<file> into B<ssl>.
69 SSL_CTX_use_certificate_chain_file() loads a certificate chain from
71 be sorted starting with the subject's certificate (actual client or server
[all …]
|
| D | SSL_get_peer_certificate.pod | 5 SSL_get_peer_certificate - get the X509 certificate of the peer
15 SSL_get_peer_certificate() returns a pointer to the X509 certificate the
16 peer presented. If the peer did not present a certificate, NULL is returned.
21 certificate, if present. A client will only send a certificate when
26 That a certificate is returned does not indicate information about the
31 will not be destroyed when the session containing the peer certificate is
42 No certificate was presented by the peer or no connection was established.
44 =item Pointer to an X509 certificate
46 The return value points to the certificate presented by the peer.
|
| D | SSL_get_peer_cert_chain.pod | 5 SSL_get_peer_cert_chain - get the X509 certificate chain of the peer
16 forming the certificate chain of the peer. If called on the client side,
17 the stack also contains the peer's certificate; if called on the server
18 side, the peer's certificate must be obtained separately using
20 If the peer did not present a certificate, NULL is returned.
24 The peer certificate chain is not necessarily available after reusing
39 No certificate was presented by the peer or no connection was established
40 or the certificate chain is no longer available when a session is reused.
44 The return value points to the certificate chain presented by the peer.
|
| D | SSL_CTX_set_verify.pod | 5 …_set_verify, SSL_CTX_set_verify_depth, SSL_set_verify_depth - set peer certificate verification pa…
34 SSL_CTX_set_verify_depth() sets the maximum B<depth> for the certificate chain
37 SSL_set_verify_depth() sets the maximum B<depth> for the certificate chain
49 B<Server mode:> the server will not send a client certificate request to the
50 client, so the client will not send a certificate.
53 server will send a certificate which will be checked. The result of the
54 certificate verification process can be checked after the TLS/SSL handshake
60 B<Server mode:> the server sends a client certificate request to the client.
61 The certificate returned (if any) is checked. If the verification process
68 B<Client mode:> the server certificate is verified. If the verification process
[all …]
|
| D | SSL_CTX_load_verify_locations.pod | 27 ... (CA certificate in base64 encoding) ...
37 in PEM format. The files each contain one CA certificate. The files are
39 If more than one CA certificate with the same name hash value exist, the
46 building the certificate chain or when actually performing the verification
47 of a peer certificate.
52 serial number as taken from the certificate to be verified. If these data
53 do not match, the next certificate will be tried. If a first certificate
58 In server mode, when requesting a client certificate, the server must send
65 When building its own certificate chain, an OpenSSL client/server will
67 certificate chain was not explicitly specified (see
[all …]
|
| D | SSL_CTX_set_max_cert_list.pod | 5 …SSL_set_max_cert_list, SSL_get_max_cert_list, - manipulate allowed for the peer's certificate chain
20 certificate chain for all SSL objects created from B<ctx> to be <size> bytes.
27 certificate chain for B<ssl> to be <size> bytes. This setting stays valid
34 During the handshake process, the peer may send a certificate chain.
35 The TLS/SSL standard does not give any maximum size of the certificate chain.
38 received from a faulty or malicious peer, a maximum size for the certificate
41 The default value for the maximum certificate chain size is 100kB (30kB
42 on the 16bit DOS platform). This should be sufficient for usual certificate
47 For special applications it can be necessary to extend the maximum certificate
57 If the maximum certificate chain size allowed is exceeded, the handshake will
|
| D | SSL_alert_type_string.pod | 40 non-fatal errors are certificate errors ("certificate expired",
41 "unsupported certificate"), for which a warning alert may be sent.
99 =item "NC"/"no certificate"
101 A client, that was asked to send a certificate, does not send a certificate
104 =item "BC"/"bad certificate"
106 A certificate was corrupt, contained signatures that did not
109 =item "UC"/"unsupported certificate"
111 A certificate was of an unsupported type.
113 =item "CR"/"certificate revoked"
115 A certificate was revoked by its signer.
[all …]
|
| /freebsd-9-stable/crypto/openssl/doc/crypto/ |
| D | x509.pod | 5 x509 - X.509 certificate handling
13 A X.509 certificate is a structured grouping of information about
15 (certificate revocation list) is a tool to help determine if a
16 certificate is still valid. The exact definition of those can be
18 In OpenSSL, the type X509 is used to express such a certificate, and
21 A related structure is a certificate request, defined in PKCS#10 from
23 X509_REQ is used to express such a certificate request.
25 To handle some complex parts of a certificate, there are the types
26 X509_NAME (to express a certificate name), X509_ATTRIBUTE (to express
27 a certificate attributes), X509_EXTENSION (to express a certificate
[all …]
|
| /freebsd-9-stable/crypto/heimdal/doc/ |
| D | hx509.texi | 212 * Creating a CA certificate::
215 @c * Issuing a proxy certificate::
216 @c * Creating a user certificate::
217 @c * Validating a certificate::
218 @c * Validating a certificate path::
233 certificate processing tasks, path construction, path validation, OCSP
235 secret encrypted), CMS SignedData (certificate signed), and CMS
236 EnvelopedData (certificate encrypted).
246 X.509 v3 certificate standard, as specified in RFC 3280.
252 stored within a so called certificate. From the beginning X.509 was a
[all …]
|
| /freebsd-9-stable/crypto/heimdal/lib/hx509/data/ |
| D | nist-data2 | 3 # 4.1.2 Invalid CA Signature Test2 - Reject - Invalid signature on intermediate certificate
5 # 4.1.3 Invalid EE Signature Test3 - Reject - Invalid signature on end entity certificate
9 # 4.2.1 Invalid CA notBefore Date Test1 - Reject - notBefore date in intermediate certificate is af…
11 # 4.2.2 Invalid EE notBefore Date Test2 - Reject - notBefore date in end entity certificate is afte…
17 # 4.2.5 Invalid CA notAfter Date Test5 - Reject - notAfter date in intermediate certificate is befo…
19 # 4.2.6 Invalid EE notAfter Date Test6 - Reject - notAfter date in end entity certificate is before…
21 …2000 UTC EE notAfter Date Test7 - Reject - notAfter date in end entity certificate is before the c…
39 # 4.4.1 Missing CRL Test1 - Reject or Warn - status of end entity certificate can not be determined
41 # 4.4.2 Invalid Revoked CA Test2 - Reject - an intermediate certificate has been revoked.
43 # 4.4.3 Invalid Revoked EE Test3 - Reject - the end entity certificate has been revoked
[all …]
|
| /freebsd-9-stable/crypto/heimdal/tests/kdc/ |
| D | check-pkinit.in | 123 ${hxtool} issue-certificate \
128 --certificate="FILE:ca.crt" || exit 1
131 ${hxtool} issue-certificate \
132 --ca-certificate=FILE:$objdir/ca.crt,${keyfile} \
136 --certificate="FILE:kdc.crt" || exit 1
139 ${hxtool} issue-certificate \
140 --ca-certificate=FILE:$objdir/ca.crt,${keyfile} \
144 --certificate="FILE:pkinit.crt" || exit 1
147 ${hxtool} issue-certificate \
148 --ca-certificate=FILE:$objdir/ca.crt,${keyfile} \
[all …]
|