Import OpenSSL 0.9.8j.
[dragonfly.git] / crypto / openssl / doc / ssl / SSL_CTX_set_client_CA_list.pod
CommitLineData
730b1645
PA
1=pod
2
3=head1 NAME
4
5SSL_CTX_set_client_CA_list, SSL_set_client_CA_list, SSL_CTX_add_client_CA,
6SSL_add_client_CA - set list of CAs sent to the client when requesting a
7client certificate
8
9=head1 SYNOPSIS
10
11 #include <openssl/ssl.h>
12
13 void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list);
14 void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list);
15 int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *cacert);
16 int SSL_add_client_CA(SSL *ssl, X509 *cacert);
17
18=head1 DESCRIPTION
19
20SSL_CTX_set_client_CA_list() sets the B<list> of CAs sent to the client when
21requesting a client certificate for B<ctx>.
22
23SSL_set_client_CA_list() sets the B<list> of CAs sent to the client when
24requesting a client certificate for the chosen B<ssl>, overriding the
25setting valid for B<ssl>'s SSL_CTX object.
26
27SSL_CTX_add_client_CA() adds the CA name extracted from B<cacert> to the
28list of CAs sent to the client when requesting a client certificate for
29B<ctx>.
30
31SSL_add_client_CA() adds the CA name extracted from B<cacert> to the
32list of CAs sent to the client when requesting a client certificate for
33the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object.
34
35=head1 NOTES
36
37When a TLS/SSL server requests a client certificate (see
38B<SSL_CTX_set_verify_options()>), it sends a list of CAs, for which
39it will accept certificates, to the client.
40
41This list must explicitly be set using SSL_CTX_set_client_CA_list() for
42B<ctx> and SSL_set_client_CA_list() for the specific B<ssl>. The list
43specified overrides the previous setting. The CAs listed do not become
44trusted (B<list> only contains the names, not the complete certificates); use
45L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)>
46to additionally load them for verification.
47
48If the list of acceptable CAs is compiled in a file, the
49L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)>
50function can be used to help importing the necessary data.
51
52SSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional
53items the list of client CAs. If no list was specified before using
54SSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client
55CA list for B<ctx> or B<ssl> (as appropriate) is opened.
56
57These functions are only useful for TLS/SSL servers.
58
59=head1 RETURN VALUES
60
61SSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return
62diagnostic information.
63
64SSL_CTX_add_client_CA() and SSL_add_client_CA() have the following return
65values:
66
67=over 4
68
69=item 1
70
71The operation succeeded.
72
73=item 0
74
75A failure while manipulating the STACK_OF(X509_NAME) object occurred or
76the X509_NAME could not be extracted from B<cacert>. Check the error stack
77to find out the reason.
78
79=back
80
81=head1 EXAMPLES
82
83Scan all certificates in B<CAfile> and list them as acceptable CAs:
84
85 SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
86
87=head1 SEE ALSO
88
89L<ssl(3)|ssl(3)>,
90L<SSL_get_client_CA_list(3)|SSL_get_client_CA_list(3)>,
91L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)>,
92L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)>
93
94=cut