You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
94 lines
3.0 KiB
94 lines
3.0 KiB
=pod |
|
|
|
=head1 NAME |
|
|
|
SSL_CTX_set_client_CA_list, SSL_set_client_CA_list, SSL_CTX_add_client_CA, |
|
SSL_add_client_CA - set list of CAs sent to the client when requesting a |
|
client certificate |
|
|
|
=head1 SYNOPSIS |
|
|
|
#include <openssl/ssl.h> |
|
|
|
void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list); |
|
void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list); |
|
int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *cacert); |
|
int SSL_add_client_CA(SSL *ssl, X509 *cacert); |
|
|
|
=head1 DESCRIPTION |
|
|
|
SSL_CTX_set_client_CA_list() sets the B<list> of CAs sent to the client when |
|
requesting a client certificate for B<ctx>. |
|
|
|
SSL_set_client_CA_list() sets the B<list> of CAs sent to the client when |
|
requesting a client certificate for the chosen B<ssl>, overriding the |
|
setting valid for B<ssl>'s SSL_CTX object. |
|
|
|
SSL_CTX_add_client_CA() adds the CA name extracted from B<cacert> to the |
|
list of CAs sent to the client when requesting a client certificate for |
|
B<ctx>. |
|
|
|
SSL_add_client_CA() adds the CA name extracted from B<cacert> to the |
|
list of CAs sent to the client when requesting a client certificate for |
|
the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object. |
|
|
|
=head1 NOTES |
|
|
|
When a TLS/SSL server requests a client certificate (see |
|
B<SSL_CTX_set_verify(3)>), it sends a list of CAs, for which |
|
it will accept certificates, to the client. |
|
|
|
This list must explicitly be set using SSL_CTX_set_client_CA_list() for |
|
B<ctx> and SSL_set_client_CA_list() for the specific B<ssl>. The list |
|
specified overrides the previous setting. The CAs listed do not become |
|
trusted (B<list> only contains the names, not the complete certificates); use |
|
L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> |
|
to additionally load them for verification. |
|
|
|
If the list of acceptable CAs is compiled in a file, the |
|
L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)> |
|
function can be used to help importing the necessary data. |
|
|
|
SSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional |
|
items the list of client CAs. If no list was specified before using |
|
SSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client |
|
CA list for B<ctx> or B<ssl> (as appropriate) is opened. |
|
|
|
These functions are only useful for TLS/SSL servers. |
|
|
|
=head1 RETURN VALUES |
|
|
|
SSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return |
|
diagnostic information. |
|
|
|
SSL_CTX_add_client_CA() and SSL_add_client_CA() have the following return |
|
values: |
|
|
|
=over 4 |
|
|
|
=item Z<>0 |
|
|
|
A failure while manipulating the STACK_OF(X509_NAME) object occurred or |
|
the X509_NAME could not be extracted from B<cacert>. Check the error stack |
|
to find out the reason. |
|
|
|
=item Z<>1 |
|
|
|
The operation succeeded. |
|
|
|
=back |
|
|
|
=head1 EXAMPLES |
|
|
|
Scan all certificates in B<CAfile> and list them as acceptable CAs: |
|
|
|
SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile)); |
|
|
|
=head1 SEE ALSO |
|
|
|
L<ssl(3)|ssl(3)>, |
|
L<SSL_get_client_CA_list(3)|SSL_get_client_CA_list(3)>, |
|
L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)>, |
|
L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> |
|
|
|
=cut
|
|
|