diff options
Diffstat (limited to 'deps/openssl/openssl/doc/apps/verify.pod')
| -rw-r--r-- | deps/openssl/openssl/doc/apps/verify.pod | 60 |
1 files changed, 30 insertions, 30 deletions
diff --git a/deps/openssl/openssl/doc/apps/verify.pod b/deps/openssl/openssl/doc/apps/verify.pod index da683004bd..336098f1e3 100644 --- a/deps/openssl/openssl/doc/apps/verify.pod +++ b/deps/openssl/openssl/doc/apps/verify.pod @@ -54,37 +54,35 @@ in PEM format concatenated together. =item B<-untrusted file> A file of untrusted certificates. The file should contain multiple certificates -in PEM format concatenated together. =item B<-purpose purpose> -The intended use for the certificate. If this option is not specified, -B<verify> will not consider certificate purpose during chain verification. -Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>, -B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more -information. +the intended use for the certificate. Without this option no chain verification +will be done. Currently accepted uses are B<sslclient>, B<sslserver>, +B<nssslserver>, B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> +section for more information. =item B<-help> -Print out a usage message. +prints out a usage message. =item B<-verbose> -Print extra information about the operations being performed. +print extra information about the operations being performed. =item B<-issuer_checks> -Print out diagnostics relating to searches for the issuer certificate of the -current certificate. This shows why each candidate issuer certificate was -rejected. The presence of rejection messages does not itself imply that -anything is wrong; during the normal verification process, several -rejections may take place. +print out diagnostics relating to searches for the issuer certificate +of the current certificate. This shows why each candidate issuer +certificate was rejected. However the presence of rejection messages +does not itself imply that anything is wrong: during the normal +verify process several rejections may take place. =item B<-policy arg> -Enable policy processing and add B<arg> to the user-initial-policy-set (see -RFC5280). The policy B<arg> can be an object name an OID in numeric form. -This argument can appear more than once. +Enable policy processing and add B<arg> to the user-initial-policy-set +(see RFC3280 et al). The policy B<arg> can be an object name an OID in numeric +form. This argument can appear more than once. =item B<-policy_check> @@ -92,40 +90,41 @@ Enables certificate policy processing. =item B<-explicit_policy> -Set policy variable require-explicit-policy (see RFC5280). +Set policy variable require-explicit-policy (see RFC3280 et al). =item B<-inhibit_any> -Set policy variable inhibit-any-policy (see RFC5280). +Set policy variable inhibit-any-policy (see RFC3280 et al). =item B<-inhibit_map> -Set policy variable inhibit-policy-mapping (see RFC5280). +Set policy variable inhibit-policy-mapping (see RFC3280 et al). =item B<-policy_print> -Print out diagnostics related to policy processing. +Print out diagnostics, related to policy checking =item B<-crl_check> -Checks end entity certificate validity by attempting to look up a valid CRL. +Checks end entity certificate validity by attempting to lookup a valid CRL. If a valid CRL cannot be found an error occurs. =item B<-crl_check_all> Checks the validity of B<all> certificates in the chain by attempting -to look up valid CRLs. +to lookup valid CRLs. =item B<-ignore_critical> Normally if an unhandled critical extension is present which is not -supported by OpenSSL the certificate is rejected (as required by RFC5280). -If this option is set critical extensions are ignored. +supported by OpenSSL the certificate is rejected (as required by +RFC3280 et al). If this option is set critical extensions are +ignored. =item B<-x509_strict> -For strict X.509 compliance, disable non-compliant workarounds for broken -certificates. +Disable workarounds for broken certificates which have to be disabled +for strict X.509 compliance. =item B<-extended_crl> @@ -143,15 +142,16 @@ because it doesn't add any security. =item B<-> -Indicates the last option. All arguments following this are assumed to be +marks the last option. All arguments following this are assumed to be certificate files. This is useful if the first certificate filename begins with a B<->. =item B<certificates> -One or more certificates to verify. If no certificates are given, B<verify> -will attempt to read a certificate from standard input. Certificates must be -in PEM format. +one or more certificates to verify. If no certificate filenames are included +then an attempt is made to read a certificate from standard input. They should +all be in PEM format. + =back |