1 .\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
4 .\" ========================================================================
5 .de Sp \" Vertical space (when we can't use .PP)
9 .de Vb \" Begin verbatim text
14 .de Ve \" End verbatim text
18 .\" Set up some character translations and predefined strings. \*(-- will
19 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
20 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
21 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
22 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
23 .\" nothing in troff, for use with C<>.
25 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
29 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
30 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
45 .\" Escape single quotes in literal strings from groff's Unicode transform.
49 .\" If the F register is >0, we'll generate index entries on stderr for
50 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
51 .\" entries marked with X<> in POD. Of course, you'll have to process the
52 .\" output yourself in some meaningful fashion.
54 .\" Avoid warning from groff about undefined register 'F'.
58 .if \n(.g .if rF .nr rF 1
59 .if (\n(rF:(\n(.g==0)) \{\
62 . tm Index:\\$1\t\\n%\t"\\$2"
72 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
73 .\" Fear. Run. Save yourself. No user-serviceable parts.
74 . \" fudge factors for nroff and troff
83 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
89 . \" simple accents for nroff and troff
99 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
100 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
101 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
102 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
103 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
104 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
106 . \" troff and (daisy-wheel) nroff accents
107 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
108 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
109 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
110 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
111 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
112 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
113 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
114 .ds ae a\h'-(\w'a'u*4/10)'e
115 .ds Ae A\h'-(\w'A'u*4/10)'E
116 . \" corrections for vroff
117 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
118 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
119 . \" for low resolution devices (crt and lpr)
120 .if \n(.H>23 .if \n(.V>19 \
133 .\" ========================================================================
136 .TH VERIFY 1 "2021-02-16" "1.1.1j" "OpenSSL"
137 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
138 .\" way too many mistakes in technical documents.
142 openssl\-verify, verify \- Utility to verify certificates
144 .IX Header "SYNOPSIS"
145 \&\fBopenssl\fR \fBverify\fR
147 [\fB\-CAfile file\fR]
148 [\fB\-CApath directory\fR]
151 [\fB\-allow_proxy_certs\fR]
152 [\fB\-attime timestamp\fR]
153 [\fB\-check_ss_sig\fR]
154 [\fB\-CRLfile file\fR]
155 [\fB\-crl_download\fR]
157 [\fB\-crl_check_all\fR]
159 [\fB\-explicit_policy\fR]
160 [\fB\-extended_crl\fR]
161 [\fB\-ignore_critical\fR]
162 [\fB\-inhibit_any\fR]
163 [\fB\-inhibit_map\fR]
164 [\fB\-nameopt option\fR]
165 [\fB\-no_check_time\fR]
166 [\fB\-partial_chain\fR]
168 [\fB\-policy_check\fR]
169 [\fB\-policy_print\fR]
170 [\fB\-purpose purpose\fR]
172 [\fB\-suiteB_128_only\fR]
174 [\fB\-trusted_first\fR]
175 [\fB\-no_alt_chains\fR]
176 [\fB\-untrusted file\fR]
177 [\fB\-trusted file\fR]
180 [\fB\-auth_level level\fR]
181 [\fB\-verify_depth num\fR]
182 [\fB\-verify_email email\fR]
183 [\fB\-verify_hostname hostname\fR]
184 [\fB\-verify_ip ip\fR]
185 [\fB\-verify_name name\fR]
186 [\fB\-x509_strict\fR]
191 .IX Header "DESCRIPTION"
192 The \fBverify\fR command verifies certificate chains.
197 Print out a usage message.
198 .IP "\fB\-CAfile file\fR" 4
199 .IX Item "-CAfile file"
200 A \fBfile\fR of trusted certificates.
201 The file should contain one or more certificates in \s-1PEM\s0 format.
202 .IP "\fB\-CApath directory\fR" 4
203 .IX Item "-CApath directory"
204 A directory of trusted certificates. The certificates should have names
205 of the form: hash.0 or have symbolic links to them of this
206 form (\*(L"hash\*(R" is the hashed certificate subject name: see the \fB\-hash\fR option
207 of the \fBx509\fR utility). Under Unix the \fBc_rehash\fR script will automatically
208 create symbolic links to a directory of certificates.
209 .IP "\fB\-no\-CAfile\fR" 4
210 .IX Item "-no-CAfile"
211 Do not load the trusted \s-1CA\s0 certificates from the default file location.
212 .IP "\fB\-no\-CApath\fR" 4
213 .IX Item "-no-CApath"
214 Do not load the trusted \s-1CA\s0 certificates from the default directory location.
215 .IP "\fB\-allow_proxy_certs\fR" 4
216 .IX Item "-allow_proxy_certs"
217 Allow the verification of proxy certificates.
218 .IP "\fB\-attime timestamp\fR" 4
219 .IX Item "-attime timestamp"
220 Perform validation checks using time specified by \fBtimestamp\fR and not
221 current system time. \fBtimestamp\fR is the number of seconds since
222 01.01.1970 (\s-1UNIX\s0 time).
223 .IP "\fB\-check_ss_sig\fR" 4
224 .IX Item "-check_ss_sig"
225 Verify the signature of
226 the last certificate in a chain if the certificate is supposedly self-signed.
227 This is prohibited and will result in an error if it is a non-conforming \s-1CA\s0
228 certificate with key usage restrictions not including the keyCertSign bit.
229 This verification is disabled by default because it doesn't add any security.
230 .IP "\fB\-CRLfile file\fR" 4
231 .IX Item "-CRLfile file"
232 The \fBfile\fR should contain one or more CRLs in \s-1PEM\s0 format.
233 This option can be specified more than once to include CRLs from multiple
235 .IP "\fB\-crl_download\fR" 4
236 .IX Item "-crl_download"
237 Attempt to download \s-1CRL\s0 information for this certificate.
238 .IP "\fB\-crl_check\fR" 4
239 .IX Item "-crl_check"
240 Checks end entity certificate validity by attempting to look up a valid \s-1CRL.\s0
241 If a valid \s-1CRL\s0 cannot be found an error occurs.
242 .IP "\fB\-crl_check_all\fR" 4
243 .IX Item "-crl_check_all"
244 Checks the validity of \fBall\fR certificates in the chain by attempting
245 to look up valid CRLs.
246 .IP "\fB\-engine id\fR" 4
247 .IX Item "-engine id"
248 Specifying an engine \fBid\fR will cause \fBverify\fR\|(1) to attempt to load the
250 The engine will then be set as the default for all its supported algorithms.
251 If you want to load certificates or CRLs that require engine support via any of
252 the \fB\-trusted\fR, \fB\-untrusted\fR or \fB\-CRLfile\fR options, the \fB\-engine\fR option
253 must be specified before those options.
254 .IP "\fB\-explicit_policy\fR" 4
255 .IX Item "-explicit_policy"
256 Set policy variable require-explicit-policy (see \s-1RFC5280\s0).
257 .IP "\fB\-extended_crl\fR" 4
258 .IX Item "-extended_crl"
259 Enable extended \s-1CRL\s0 features such as indirect CRLs and alternate \s-1CRL\s0
261 .IP "\fB\-ignore_critical\fR" 4
262 .IX Item "-ignore_critical"
263 Normally if an unhandled critical extension is present which is not
264 supported by OpenSSL the certificate is rejected (as required by \s-1RFC5280\s0).
265 If this option is set critical extensions are ignored.
266 .IP "\fB\-inhibit_any\fR" 4
267 .IX Item "-inhibit_any"
268 Set policy variable inhibit-any-policy (see \s-1RFC5280\s0).
269 .IP "\fB\-inhibit_map\fR" 4
270 .IX Item "-inhibit_map"
271 Set policy variable inhibit-policy-mapping (see \s-1RFC5280\s0).
272 .IP "\fB\-nameopt option\fR" 4
273 .IX Item "-nameopt option"
274 Option which determines how the subject or issuer names are displayed. The
275 \&\fBoption\fR argument can be a single option or multiple options separated by
276 commas. Alternatively the \fB\-nameopt\fR switch may be used more than once to
277 set multiple options. See the \fBx509\fR\|(1) manual page for details.
278 .IP "\fB\-no_check_time\fR" 4
279 .IX Item "-no_check_time"
280 This option suppresses checking the validity period of certificates and CRLs
281 against the current time. If option \fB\-attime timestamp\fR is used to specify
282 a verification time, the check is not suppressed.
283 .IP "\fB\-partial_chain\fR" 4
284 .IX Item "-partial_chain"
285 Allow verification to succeed even if a \fIcomplete\fR chain cannot be built to a
286 self-signed trust-anchor, provided it is possible to construct a chain to a
287 trusted certificate that might not be self-signed.
288 .IP "\fB\-policy arg\fR" 4
289 .IX Item "-policy arg"
290 Enable policy processing and add \fBarg\fR to the user-initial-policy-set (see
291 \&\s-1RFC5280\s0). The policy \fBarg\fR can be an object name an \s-1OID\s0 in numeric form.
292 This argument can appear more than once.
293 .IP "\fB\-policy_check\fR" 4
294 .IX Item "-policy_check"
295 Enables certificate policy processing.
296 .IP "\fB\-policy_print\fR" 4
297 .IX Item "-policy_print"
298 Print out diagnostics related to policy processing.
299 .IP "\fB\-purpose purpose\fR" 4
300 .IX Item "-purpose purpose"
301 The intended use for the certificate. If this option is not specified,
302 \&\fBverify\fR will not consider certificate purpose during chain verification.
303 Currently accepted uses are \fBsslclient\fR, \fBsslserver\fR, \fBnssslserver\fR,
304 \&\fBsmimesign\fR, \fBsmimeencrypt\fR. See the \fB\s-1VERIFY OPERATION\s0\fR section for more
306 .IP "\fB\-suiteB_128_only\fR, \fB\-suiteB_128\fR, \fB\-suiteB_192\fR" 4
307 .IX Item "-suiteB_128_only, -suiteB_128, -suiteB_192"
308 Enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
309 192 bit, or only 192 bit Level of Security respectively.
310 See \s-1RFC6460\s0 for details. In particular the supported signature algorithms are
311 reduced to support only \s-1ECDSA\s0 and \s-1SHA256\s0 or \s-1SHA384\s0 and only the elliptic curves
313 .IP "\fB\-trusted_first\fR" 4
314 .IX Item "-trusted_first"
315 When constructing the certificate chain, use the trusted certificates specified
316 via \fB\-CAfile\fR, \fB\-CApath\fR or \fB\-trusted\fR before any certificates specified via
318 This can be useful in environments with Bridge or Cross-Certified CAs.
319 As of OpenSSL 1.1.0 this option is on by default and cannot be disabled.
320 .IP "\fB\-no_alt_chains\fR" 4
321 .IX Item "-no_alt_chains"
322 By default, unless \fB\-trusted_first\fR is specified, when building a certificate
323 chain, if the first certificate chain found is not trusted, then OpenSSL will
324 attempt to replace untrusted issuer certificates with certificates from the
325 trust store to see if an alternative chain can be found that is trusted.
326 As of OpenSSL 1.1.0, with \fB\-trusted_first\fR always on, this option has no
328 .IP "\fB\-untrusted file\fR" 4
329 .IX Item "-untrusted file"
330 A \fBfile\fR of additional untrusted certificates (intermediate issuer CAs) used
331 to construct a certificate chain from the subject certificate to a trust-anchor.
332 The \fBfile\fR should contain one or more certificates in \s-1PEM\s0 format.
333 This option can be specified more than once to include untrusted certificates
334 from multiple \fBfiles\fR.
335 .IP "\fB\-trusted file\fR" 4
336 .IX Item "-trusted file"
337 A \fBfile\fR of trusted certificates, which must be self-signed, unless the
338 \&\fB\-partial_chain\fR option is specified.
339 The \fBfile\fR contains one or more certificates in \s-1PEM\s0 format.
340 With this option, no additional (e.g., default) certificate lists are
342 That is, the only trust-anchors are those listed in \fBfile\fR.
343 This option can be specified more than once to include trusted certificates
344 from multiple \fBfiles\fR.
345 This option implies the \fB\-no\-CAfile\fR and \fB\-no\-CApath\fR options.
346 This option cannot be used in combination with either of the \fB\-CAfile\fR or
347 \&\fB\-CApath\fR options.
348 .IP "\fB\-use_deltas\fR" 4
349 .IX Item "-use_deltas"
350 Enable support for delta CRLs.
351 .IP "\fB\-verbose\fR" 4
353 Print extra information about the operations being performed.
354 .IP "\fB\-auth_level level\fR" 4
355 .IX Item "-auth_level level"
356 Set the certificate chain authentication security level to \fBlevel\fR.
357 The authentication security level determines the acceptable signature and
358 public key strength when verifying certificate chains.
359 For a certificate chain to validate, the public keys of all the certificates
360 must meet the specified security \fBlevel\fR.
361 The signature algorithm security level is enforced for all the certificates in
362 the chain except for the chain's \fItrust anchor\fR, which is either directly
363 trusted or validated by means other than its signature.
364 See \fBSSL_CTX_set_security_level\fR\|(3) for the definitions of the available
366 The default security level is \-1, or \*(L"not set\*(R".
367 At security level 0 or lower all algorithms are acceptable.
368 Security level 1 requires at least 80\-bit\-equivalent security and is broadly
369 interoperable, though it will, for example, reject \s-1MD5\s0 signatures or \s-1RSA\s0 keys
370 shorter than 1024 bits.
371 .IP "\fB\-verify_depth num\fR" 4
372 .IX Item "-verify_depth num"
373 Limit the certificate chain to \fBnum\fR intermediate \s-1CA\s0 certificates.
374 A maximal depth chain can have up to \fBnum+2\fR certificates, since neither the
375 end-entity certificate nor the trust-anchor certificate count against the
376 \&\fB\-verify_depth\fR limit.
377 .IP "\fB\-verify_email email\fR" 4
378 .IX Item "-verify_email email"
379 Verify if the \fBemail\fR matches the email address in Subject Alternative Name or
380 the email in the subject Distinguished Name.
381 .IP "\fB\-verify_hostname hostname\fR" 4
382 .IX Item "-verify_hostname hostname"
383 Verify if the \fBhostname\fR matches \s-1DNS\s0 name in Subject Alternative Name or
384 Common Name in the subject certificate.
385 .IP "\fB\-verify_ip ip\fR" 4
386 .IX Item "-verify_ip ip"
387 Verify if the \fBip\fR matches the \s-1IP\s0 address in Subject Alternative Name of
388 the subject certificate.
389 .IP "\fB\-verify_name name\fR" 4
390 .IX Item "-verify_name name"
391 Use default verification policies like trust model and required certificate
392 policies identified by \fBname\fR.
393 The trust model determines which auxiliary trust or reject OIDs are applicable
394 to verifying the given certificate chain.
395 See the \fB\-addtrust\fR and \fB\-addreject\fR options of the \fBx509\fR\|(1) command-line
397 Supported policy names include: \fBdefault\fR, \fBpkcs7\fR, \fBsmime_sign\fR,
398 \&\fBssl_client\fR, \fBssl_server\fR.
399 These mimics the combinations of purpose and trust settings used in \s-1SSL, CMS\s0
401 As of OpenSSL 1.1.0, the trust model is inferred from the purpose when not
402 specified, so the \fB\-verify_name\fR options are functionally equivalent to the
403 corresponding \fB\-purpose\fR settings.
404 .IP "\fB\-x509_strict\fR" 4
405 .IX Item "-x509_strict"
406 For strict X.509 compliance, disable non-compliant workarounds for broken
408 .IP "\fB\-show_chain\fR" 4
409 .IX Item "-show_chain"
410 Display information about the certificate chain that has been built (if
411 successful). Certificates in the chain that came from the untrusted list will be
412 flagged as \*(L"untrusted\*(R".
415 Indicates the last option. All arguments following this are assumed to be
416 certificate files. This is useful if the first certificate filename begins
418 .IP "\fBcertificates\fR" 4
419 .IX Item "certificates"
420 One or more certificates to verify. If no certificates are given, \fBverify\fR
421 will attempt to read a certificate from standard input. Certificates must be
422 in \s-1PEM\s0 format.
423 .SH "VERIFY OPERATION"
424 .IX Header "VERIFY OPERATION"
425 The \fBverify\fR program uses the same functions as the internal \s-1SSL\s0 and S/MIME
426 verification, therefore, this description applies to these verify operations
429 There is one crucial difference between the verify operations performed
430 by the \fBverify\fR program: wherever possible an attempt is made to continue
431 after an error whereas normally the verify operation would halt on the
432 first error. This allows all the problems with a certificate chain to be
435 The verify operation consists of a number of separate steps.
437 Firstly a certificate chain is built up starting from the supplied certificate
438 and ending in the root \s-1CA.\s0
439 It is an error if the whole chain cannot be built up.
440 The chain is built up by looking up the issuers certificate of the current
442 If a certificate is found which is its own issuer it is assumed to be the root
445 The process of 'looking up the issuers certificate' itself involves a number of
447 After all certificates whose subject name matches the issuer name of the current
448 certificate are subject to further tests.
449 The relevant authority key identifier components of the current certificate (if
450 present) must match the subject key identifier (if present) and issuer and
451 serial number of the candidate issuer, in addition the keyUsage extension of
452 the candidate issuer (if present) must permit certificate signing.
454 The lookup first looks in the list of untrusted certificates and if no match
455 is found the remaining lookups are from the trusted certificates. The root \s-1CA\s0
456 is always looked up in the trusted certificate list: if the certificate to
457 verify is a root certificate then an exact match must be found in the trusted
460 The second operation is to check every untrusted certificate's extensions for
461 consistency with the supplied purpose. If the \fB\-purpose\fR option is not included
462 then no checks are done. The supplied or \*(L"leaf\*(R" certificate must have extensions
463 compatible with the supplied purpose and all other certificates must also be valid
464 \&\s-1CA\s0 certificates. The precise extensions required are described in more detail in
465 the \fB\s-1CERTIFICATE EXTENSIONS\s0\fR section of the \fBx509\fR utility.
467 The third operation is to check the trust settings on the root \s-1CA.\s0 The root \s-1CA\s0
468 should be trusted for the supplied purpose.
469 For compatibility with previous versions of OpenSSL, a certificate with no
470 trust settings is considered to be valid for all purposes.
472 The final operation is to check the validity of the certificate chain.
473 For each element in the chain, including the root \s-1CA\s0 certificate,
474 the validity period as specified by the \f(CW\*(C`notBefore\*(C'\fR and \f(CW\*(C`notAfter\*(C'\fR fields
475 is checked against the current system time.
476 The \fB\-attime\fR flag may be used to use a reference time other than \*(L"now.\*(R"
477 The certificate signature is checked as well
478 (except for the signature of the typically self-signed root \s-1CA\s0 certificate,
479 which is verified only if the \fB\-check_ss_sig\fR option is given).
481 If all operations complete successfully then certificate is considered valid. If
482 any operation fails then the certificate is not valid.
484 .IX Header "DIAGNOSTICS"
485 When a verify operation fails the output messages can be somewhat cryptic. The
486 general form of the error message is:
489 \& server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
490 \& error 24 at 1 depth lookup:invalid CA certificate
493 The first line contains the name of the certificate being verified followed by
494 the subject name of the certificate. The second line contains the error number
495 and the depth. The depth is number of the certificate being verified when a
496 problem was detected starting with zero for the certificate being verified itself
497 then 1 for the \s-1CA\s0 that signed the certificate and so on. Finally a text version
498 of the error number is presented.
500 A partial list of the error codes and messages is shown below, this also
501 includes the name of the error code as defined in the header file x509_vfy.h
502 Some of the error codes are defined but never returned: these are described
504 .IP "\fBX509_V_OK\fR" 4
506 The operation was successful.
507 .IP "\fBX509_V_ERR_UNSPECIFIED\fR" 4
508 .IX Item "X509_V_ERR_UNSPECIFIED"
509 Unspecified error; should not happen.
510 .IP "\fBX509_V_ERR_UNABLE_TO_GET_ISSUER_CERT\fR" 4
511 .IX Item "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT"
512 The issuer certificate of a looked up certificate could not be found. This
513 normally means the list of trusted certificates is not complete.
514 .IP "\fBX509_V_ERR_UNABLE_TO_GET_CRL\fR" 4
515 .IX Item "X509_V_ERR_UNABLE_TO_GET_CRL"
516 The \s-1CRL\s0 of a certificate could not be found.
517 .IP "\fBX509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE\fR" 4
518 .IX Item "X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE"
519 The certificate signature could not be decrypted. This means that the
520 actual signature value could not be determined rather than it not matching
521 the expected value, this is only meaningful for \s-1RSA\s0 keys.
522 .IP "\fBX509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE\fR" 4
523 .IX Item "X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE"
524 The \s-1CRL\s0 signature could not be decrypted: this means that the actual
525 signature value could not be determined rather than it not matching the
526 expected value. Unused.
527 .IP "\fBX509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY\fR" 4
528 .IX Item "X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY"
529 The public key in the certificate SubjectPublicKeyInfo could not be read.
530 .IP "\fBX509_V_ERR_CERT_SIGNATURE_FAILURE\fR" 4
531 .IX Item "X509_V_ERR_CERT_SIGNATURE_FAILURE"
532 The signature of the certificate is invalid.
533 .IP "\fBX509_V_ERR_CRL_SIGNATURE_FAILURE\fR" 4
534 .IX Item "X509_V_ERR_CRL_SIGNATURE_FAILURE"
535 The signature of the certificate is invalid.
536 .IP "\fBX509_V_ERR_CERT_NOT_YET_VALID\fR" 4
537 .IX Item "X509_V_ERR_CERT_NOT_YET_VALID"
538 The certificate is not yet valid: the notBefore date is after the
540 .IP "\fBX509_V_ERR_CERT_HAS_EXPIRED\fR" 4
541 .IX Item "X509_V_ERR_CERT_HAS_EXPIRED"
542 The certificate has expired: that is the notAfter date is before the
544 .IP "\fBX509_V_ERR_CRL_NOT_YET_VALID\fR" 4
545 .IX Item "X509_V_ERR_CRL_NOT_YET_VALID"
546 The \s-1CRL\s0 is not yet valid.
547 .IP "\fBX509_V_ERR_CRL_HAS_EXPIRED\fR" 4
548 .IX Item "X509_V_ERR_CRL_HAS_EXPIRED"
549 The \s-1CRL\s0 has expired.
550 .IP "\fBX509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD\fR" 4
551 .IX Item "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD"
552 The certificate notBefore field contains an invalid time.
553 .IP "\fBX509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD\fR" 4
554 .IX Item "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD"
555 The certificate notAfter field contains an invalid time.
556 .IP "\fBX509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD\fR" 4
557 .IX Item "X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD"
558 The \s-1CRL\s0 lastUpdate field contains an invalid time.
559 .IP "\fBX509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD\fR" 4
560 .IX Item "X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD"
561 The \s-1CRL\s0 nextUpdate field contains an invalid time.
562 .IP "\fBX509_V_ERR_OUT_OF_MEM\fR" 4
563 .IX Item "X509_V_ERR_OUT_OF_MEM"
564 An error occurred trying to allocate memory. This should never happen.
565 .IP "\fBX509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT\fR" 4
566 .IX Item "X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT"
567 The passed certificate is self-signed and the same certificate cannot
568 be found in the list of trusted certificates.
569 .IP "\fBX509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN\fR" 4
570 .IX Item "X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN"
571 The certificate chain could be built up using the untrusted certificates
572 but the root could not be found locally.
573 .IP "\fBX509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY\fR" 4
574 .IX Item "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
575 The issuer certificate could not be found: this occurs if the issuer
576 certificate of an untrusted certificate cannot be found.
577 .IP "\fBX509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE\fR" 4
578 .IX Item "X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE"
579 No signatures could be verified because the chain contains only one
580 certificate and it is not self signed.
581 .IP "\fBX509_V_ERR_CERT_CHAIN_TOO_LONG\fR" 4
582 .IX Item "X509_V_ERR_CERT_CHAIN_TOO_LONG"
583 The certificate chain length is greater than the supplied maximum
585 .IP "\fBX509_V_ERR_CERT_REVOKED\fR" 4
586 .IX Item "X509_V_ERR_CERT_REVOKED"
587 The certificate has been revoked.
588 .IP "\fBX509_V_ERR_INVALID_CA\fR" 4
589 .IX Item "X509_V_ERR_INVALID_CA"
590 A \s-1CA\s0 certificate is invalid. Either it is not a \s-1CA\s0 or its extensions
591 are not consistent with the supplied purpose.
592 .IP "\fBX509_V_ERR_PATH_LENGTH_EXCEEDED\fR" 4
593 .IX Item "X509_V_ERR_PATH_LENGTH_EXCEEDED"
594 The basicConstraints pathlength parameter has been exceeded.
595 .IP "\fBX509_V_ERR_INVALID_PURPOSE\fR" 4
596 .IX Item "X509_V_ERR_INVALID_PURPOSE"
597 The supplied certificate cannot be used for the specified purpose.
598 .IP "\fBX509_V_ERR_CERT_UNTRUSTED\fR" 4
599 .IX Item "X509_V_ERR_CERT_UNTRUSTED"
600 The root \s-1CA\s0 is not marked as trusted for the specified purpose.
601 .IP "\fBX509_V_ERR_CERT_REJECTED\fR" 4
602 .IX Item "X509_V_ERR_CERT_REJECTED"
603 The root \s-1CA\s0 is marked to reject the specified purpose.
604 .IP "\fBX509_V_ERR_SUBJECT_ISSUER_MISMATCH\fR" 4
605 .IX Item "X509_V_ERR_SUBJECT_ISSUER_MISMATCH"
606 Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
607 \&\fB\-issuer_checks\fR option.
608 .IP "\fBX509_V_ERR_AKID_SKID_MISMATCH\fR" 4
609 .IX Item "X509_V_ERR_AKID_SKID_MISMATCH"
610 Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
611 \&\fB\-issuer_checks\fR option.
612 .IP "\fBX509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH\fR" 4
613 .IX Item "X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH"
614 Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
615 \&\fB\-issuer_checks\fR option.
616 .IP "\fBX509_V_ERR_KEYUSAGE_NO_CERTSIGN\fR" 4
617 .IX Item "X509_V_ERR_KEYUSAGE_NO_CERTSIGN"
618 Not used as of OpenSSL 1.1.0 as a result of the deprecation of the
619 \&\fB\-issuer_checks\fR option.
620 .IP "\fBX509_V_ERR_UNABLE_TO_GET_CRL_ISSUER\fR" 4
621 .IX Item "X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER"
622 Unable to get \s-1CRL\s0 issuer certificate.
623 .IP "\fBX509_V_ERR_UNHANDLED_CRITICAL_EXTENSION\fR" 4
624 .IX Item "X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION"
625 Unhandled critical extension.
626 .IP "\fBX509_V_ERR_KEYUSAGE_NO_CRL_SIGN\fR" 4
627 .IX Item "X509_V_ERR_KEYUSAGE_NO_CRL_SIGN"
628 Key usage does not include \s-1CRL\s0 signing.
629 .IP "\fBX509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION\fR" 4
630 .IX Item "X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION"
631 Unhandled critical \s-1CRL\s0 extension.
632 .IP "\fBX509_V_ERR_INVALID_NON_CA\fR" 4
633 .IX Item "X509_V_ERR_INVALID_NON_CA"
634 Invalid non-CA certificate has \s-1CA\s0 markings.
635 .IP "\fBX509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED\fR" 4
636 .IX Item "X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED"
637 Proxy path length constraint exceeded.
638 .IP "\fBX509_V_ERR_PROXY_SUBJECT_INVALID\fR" 4
639 .IX Item "X509_V_ERR_PROXY_SUBJECT_INVALID"
640 Proxy certificate subject is invalid. It \s-1MUST\s0 be the same as the issuer
641 with a single \s-1CN\s0 component added.
642 .IP "\fBX509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE\fR" 4
643 .IX Item "X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE"
644 Key usage does not include digital signature.
645 .IP "\fBX509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED\fR" 4
646 .IX Item "X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED"
647 Proxy certificates not allowed, please use \fB\-allow_proxy_certs\fR.
648 .IP "\fBX509_V_ERR_INVALID_EXTENSION\fR" 4
649 .IX Item "X509_V_ERR_INVALID_EXTENSION"
650 Invalid or inconsistent certificate extension.
651 .IP "\fBX509_V_ERR_INVALID_POLICY_EXTENSION\fR" 4
652 .IX Item "X509_V_ERR_INVALID_POLICY_EXTENSION"
653 Invalid or inconsistent certificate policy extension.
654 .IP "\fBX509_V_ERR_NO_EXPLICIT_POLICY\fR" 4
655 .IX Item "X509_V_ERR_NO_EXPLICIT_POLICY"
657 .IP "\fBX509_V_ERR_DIFFERENT_CRL_SCOPE\fR" 4
658 .IX Item "X509_V_ERR_DIFFERENT_CRL_SCOPE"
659 Different \s-1CRL\s0 scope.
660 .IP "\fBX509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE\fR" 4
661 .IX Item "X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE"
662 Unsupported extension feature.
663 .IP "\fBX509_V_ERR_UNNESTED_RESOURCE\fR" 4
664 .IX Item "X509_V_ERR_UNNESTED_RESOURCE"
665 \&\s-1RFC 3779\s0 resource not subset of parent's resources.
666 .IP "\fBX509_V_ERR_PERMITTED_VIOLATION\fR" 4
667 .IX Item "X509_V_ERR_PERMITTED_VIOLATION"
668 Permitted subtree violation.
669 .IP "\fBX509_V_ERR_EXCLUDED_VIOLATION\fR" 4
670 .IX Item "X509_V_ERR_EXCLUDED_VIOLATION"
671 Excluded subtree violation.
672 .IP "\fBX509_V_ERR_SUBTREE_MINMAX\fR" 4
673 .IX Item "X509_V_ERR_SUBTREE_MINMAX"
674 Name constraints minimum and maximum not supported.
675 .IP "\fBX509_V_ERR_APPLICATION_VERIFICATION\fR" 4
676 .IX Item "X509_V_ERR_APPLICATION_VERIFICATION"
677 Application verification failure. Unused.
678 .IP "\fBX509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE\fR" 4
679 .IX Item "X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE"
680 Unsupported name constraint type.
681 .IP "\fBX509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX\fR" 4
682 .IX Item "X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX"
683 Unsupported or invalid name constraint syntax.
684 .IP "\fBX509_V_ERR_UNSUPPORTED_NAME_SYNTAX\fR" 4
685 .IX Item "X509_V_ERR_UNSUPPORTED_NAME_SYNTAX"
686 Unsupported or invalid name syntax.
687 .IP "\fBX509_V_ERR_CRL_PATH_VALIDATION_ERROR\fR" 4
688 .IX Item "X509_V_ERR_CRL_PATH_VALIDATION_ERROR"
689 \&\s-1CRL\s0 path validation error.
690 .IP "\fBX509_V_ERR_PATH_LOOP\fR" 4
691 .IX Item "X509_V_ERR_PATH_LOOP"
693 .IP "\fBX509_V_ERR_SUITE_B_INVALID_VERSION\fR" 4
694 .IX Item "X509_V_ERR_SUITE_B_INVALID_VERSION"
695 Suite B: certificate version invalid.
696 .IP "\fBX509_V_ERR_SUITE_B_INVALID_ALGORITHM\fR" 4
697 .IX Item "X509_V_ERR_SUITE_B_INVALID_ALGORITHM"
698 Suite B: invalid public key algorithm.
699 .IP "\fBX509_V_ERR_SUITE_B_INVALID_CURVE\fR" 4
700 .IX Item "X509_V_ERR_SUITE_B_INVALID_CURVE"
701 Suite B: invalid \s-1ECC\s0 curve.
702 .IP "\fBX509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM\fR" 4
703 .IX Item "X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM"
704 Suite B: invalid signature algorithm.
705 .IP "\fBX509_V_ERR_SUITE_B_LOS_NOT_ALLOWED\fR" 4
706 .IX Item "X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED"
707 Suite B: curve not allowed for this \s-1LOS.\s0
708 .IP "\fBX509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256\fR" 4
709 .IX Item "X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256"
710 Suite B: cannot sign P\-384 with P\-256.
711 .IP "\fBX509_V_ERR_HOSTNAME_MISMATCH\fR" 4
712 .IX Item "X509_V_ERR_HOSTNAME_MISMATCH"
714 .IP "\fBX509_V_ERR_EMAIL_MISMATCH\fR" 4
715 .IX Item "X509_V_ERR_EMAIL_MISMATCH"
716 Email address mismatch.
717 .IP "\fBX509_V_ERR_IP_ADDRESS_MISMATCH\fR" 4
718 .IX Item "X509_V_ERR_IP_ADDRESS_MISMATCH"
719 \&\s-1IP\s0 address mismatch.
720 .IP "\fBX509_V_ERR_DANE_NO_MATCH\fR" 4
721 .IX Item "X509_V_ERR_DANE_NO_MATCH"
722 \&\s-1DANE TLSA\s0 authentication is enabled, but no \s-1TLSA\s0 records matched the
724 This error is only possible in \fBs_client\fR\|(1).
725 .IP "\fBX509_V_ERR_EE_KEY_TOO_SMALL\fR" 4
726 .IX Item "X509_V_ERR_EE_KEY_TOO_SMALL"
727 \&\s-1EE\s0 certificate key too weak.
728 .IP "\fBX509_ERR_CA_KEY_TOO_SMALL\fR" 4
729 .IX Item "X509_ERR_CA_KEY_TOO_SMALL"
730 \&\s-1CA\s0 certificate key too weak.
731 .IP "\fBX509_ERR_CA_MD_TOO_WEAK\fR" 4
732 .IX Item "X509_ERR_CA_MD_TOO_WEAK"
733 \&\s-1CA\s0 signature digest algorithm too weak.
734 .IP "\fBX509_V_ERR_INVALID_CALL\fR" 4
735 .IX Item "X509_V_ERR_INVALID_CALL"
736 nvalid certificate verification context.
737 .IP "\fBX509_V_ERR_STORE_LOOKUP\fR" 4
738 .IX Item "X509_V_ERR_STORE_LOOKUP"
739 Issuer certificate lookup error.
740 .IP "\fBX509_V_ERR_NO_VALID_SCTS\fR" 4
741 .IX Item "X509_V_ERR_NO_VALID_SCTS"
742 Certificate Transparency required, but no valid SCTs found.
743 .IP "\fBX509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION\fR" 4
744 .IX Item "X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION"
745 Proxy subject name violation.
746 .IP "\fBX509_V_ERR_OCSP_VERIFY_NEEDED\fR" 4
747 .IX Item "X509_V_ERR_OCSP_VERIFY_NEEDED"
748 Returned by the verify callback to indicate an \s-1OCSP\s0 verification is needed.
749 .IP "\fBX509_V_ERR_OCSP_VERIFY_FAILED\fR" 4
750 .IX Item "X509_V_ERR_OCSP_VERIFY_FAILED"
751 Returned by the verify callback to indicate \s-1OCSP\s0 verification failed.
752 .IP "\fBX509_V_ERR_OCSP_CERT_UNKNOWN\fR" 4
753 .IX Item "X509_V_ERR_OCSP_CERT_UNKNOWN"
754 Returned by the verify callback to indicate that the certificate is not recognized
755 by the \s-1OCSP\s0 responder.
758 Although the issuer checks are a considerable improvement over the old
759 technique they still suffer from limitations in the underlying X509_LOOKUP
760 \&\s-1API.\s0 One consequence of this is that trusted certificates with matching
761 subject name must either appear in a file (as specified by the \fB\-CAfile\fR
762 option) or a directory (as specified by \fB\-CApath\fR). If they occur in
763 both then only the certificates in the file will be recognised.
765 Previous versions of OpenSSL assume certificates with matching subject
766 name are identical and mishandled them.
768 Previous versions of this documentation swapped the meaning of the
769 \&\fBX509_V_ERR_UNABLE_TO_GET_ISSUER_CERT\fR and
770 \&\fBX509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY\fR error codes.
772 .IX Header "SEE ALSO"
776 The \fB\-show_chain\fR option was added in OpenSSL 1.1.0.
778 The \fB\-issuer_checks\fR option is deprecated as of OpenSSL 1.1.0 and
781 .IX Header "COPYRIGHT"
782 Copyright 2000\-2020 The OpenSSL Project Authors. All Rights Reserved.
784 Licensed under the OpenSSL license (the \*(L"License\*(R"). You may not use
785 this file except in compliance with the License. You can obtain a copy
786 in the file \s-1LICENSE\s0 in the source distribution or at
787 <https://www.openssl.org/source/license.html>.
projects / FreeBSD / FreeBSD.git / blob