mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Can't use -trusted with -CA{path,file}

Browse Source 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
This commit is contained in:
Rich Salz 2015-07-09 14:54:13 -04:00 committed by Rich Salz
parent e5c0bc6cc4
commit 5b89036c41
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
apps/verify.c
View File

@ -88,7 +88,7 @@ OPTIONS verify_options[] = {
{"CApath", OPT_CAPATH, '/', "A directory of trusted certificates"},
{"CAfile", OPT_CAFILE, '<', "A file of trusted certificates"},
{"untrusted", OPT_UNTRUSTED, '<', "A file of untrusted certificates"},
{"trusted", OPT_TRUSTED, '<', "A file of additional trusted certificates"},
{"trusted", OPT_TRUSTED, '<', "A file of trusted certificates"},
{"CRLfile", OPT_CRLFILE, '<',
"File containing one or more CRL's (in PEM format) to load"},
{"crl_download", OPT_CRL_DOWNLOAD, '-',
@ -180,6 +180,12 @@ int verify_main(int argc, char **argv)
}
argc = opt_num_rest();
argv = opt_rest();
if (trustfile && (CAfile || CApath)) {
BIO_printf(bio_err,
"%s: Cannot use -trusted with -CAfile or -CApath\n",
prog);
goto end;
}
if (!app_load_modules(NULL))
goto end;

12
doc/apps/verify.pod
View File

@ -182,13 +182,17 @@ behaviour to match that of OpenSSL versions prior to 1.1.0.
=item B<-untrusted file>
A file of untrusted certificates. The file should contain multiple certificates
in PEM format concatenated together.
A file of untrusted certificates. The file should contain one or more
certificates in PEM format.
=item B<-trusted file>
A file of additional trusted certificates. The file should contain multiple
certificates in PEM format concatenated together.
A file of trusted certificates. The file contain one or more
certificates in PEM format.
With this option, no additional (e.g., default) certificate lists
are consulted. That is, the only trusted issuers are those listed
in B<file>.
This option cannot be used with the B<-CAfile> or B<-CApath> options.
=item B<-use_deltas>