mirror of
https://github.com/openssl/openssl.git
synced 2024-12-21 06:09:35 +08:00
33328581b8
Various functions cause the results of processing extensions to be cached. The processing itself requires a libctx, and so this implicit caching means that the default ctx is used which can lead to failures. By explicitly caching the extensions we can specify the libctx to be used. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11409)
48 lines
1.2 KiB
Plaintext
48 lines
1.2 KiB
Plaintext
=pod
|
|
|
|
=head1 NAME
|
|
|
|
X509_check_ca - check if given certificate is CA certificate
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
#include <openssl/x509v3.h>
|
|
|
|
int X509_check_ca(X509 *cert);
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
This function checks if given certificate is CA certificate (can be used
|
|
to sign other certificates).
|
|
|
|
=head1 RETURN VALUES
|
|
|
|
Function return 0, if it is not CA certificate, 1 if it is proper X509v3
|
|
CA certificate with B<basicConstraints> extension CA:TRUE,
|
|
3, if it is self-signed X509 v1 certificate, 4, if it is certificate with
|
|
B<keyUsage> extension with bit B<keyCertSign> set, but without
|
|
B<basicConstraints>, and 5 if it has outdated Netscape Certificate Type
|
|
extension telling that it is CA certificate.
|
|
|
|
This function will also return 0 on error.
|
|
|
|
Actually, any nonzero value means that this certificate could have been
|
|
used to sign other certificates.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<X509_verify_cert(3)>,
|
|
L<X509_check_issued(3)>,
|
|
L<X509_check_purpose(3)>
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
|
|
|
|
Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file LICENSE in the source distribution or at
|
|
L<https://www.openssl.org/source/license.html>.
|
|
|
|
=cut
|