gitweb.dragonflybsd.org Git - dragonfly.git/blame_incremental - crypto/openssl/doc/ssl/SSL_CTX_set_client_CA

... / ...

Commit	Line	Data
	1	=pod
	2
	3	=head1 NAME
	4
	5	SSL_CTX_set_client_CA_list, SSL_set_client_CA_list, SSL_CTX_add_client_CA,
	6	SSL_add_client_CA - set list of CAs sent to the client when requesting a
	7	client certificate
	8
	9	=head1 SYNOPSIS
	10
	11	#include <openssl/ssl.h>
	12
	13	void SSL_CTX_set_client_CA_list(SSL_CTX ctx, STACK_OF(X509_NAME) list);
	14	void SSL_set_client_CA_list(SSL s, STACK_OF(X509_NAME) list);
	15	int SSL_CTX_add_client_CA(SSL_CTX ctx, X509 cacert);
	16	int SSL_add_client_CA(SSL ssl, X509 cacert);
	17
	18	=head1 DESCRIPTION
	19
	20	SSL_CTX_set_client_CA_list() sets the B<list> of CAs sent to the client when
	21	requesting a client certificate for B<ctx>.
	22
	23	SSL_set_client_CA_list() sets the B<list> of CAs sent to the client when
	24	requesting a client certificate for the chosen B<ssl>, overriding the
	25	setting valid for B<ssl>'s SSL_CTX object.
	26
	27	SSL_CTX_add_client_CA() adds the CA name extracted from B<cacert> to the
	28	list of CAs sent to the client when requesting a client certificate for
	29	B<ctx>.
	30
	31	SSL_add_client_CA() adds the CA name extracted from B<cacert> to the
	32	list of CAs sent to the client when requesting a client certificate for
	33	the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object.
	34
	35	=head1 NOTES
	36
	37	When a TLS/SSL server requests a client certificate (see
	38	B<SSL_CTX_set_verify_options()>), it sends a list of CAs, for which
	39	it will accept certificates, to the client.
	40
	41	This list must explicitly be set using SSL_CTX_set_client_CA_list() for
	42	B<ctx> and SSL_set_client_CA_list() for the specific B<ssl>. The list
	43	specified overrides the previous setting. The CAs listed do not become
	44	trusted (B<list> only contains the names, not the complete certificates); use
	45	L<SSL_CTX_load_verify_locations(3)\|SSL_CTX_load_verify_locations(3)>
	46	to additionally load them for verification.
	47
	48	If the list of acceptable CAs is compiled in a file, the
	49	L<SSL_load_client_CA_file(3)\|SSL_load_client_CA_file(3)>
	50	function can be used to help importing the necessary data.
	51
	52	SSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional
	53	items the list of client CAs. If no list was specified before using
	54	SSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client
	55	CA list for B<ctx> or B<ssl> (as appropriate) is opened.
	56
	57	These functions are only useful for TLS/SSL servers.
	58
	59	=head1 RETURN VALUES
	60
	61	SSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return
	62	diagnostic information.
	63
	64	SSL_CTX_add_client_CA() and SSL_add_client_CA() have the following return
	65	values:
	66
	67	=over 4
	68
	69	=item 1
	70
	71	The operation succeeded.
	72
	73	=item 0
	74
	75	A failure while manipulating the STACK_OF(X509_NAME) object occurred or
	76	the X509_NAME could not be extracted from B<cacert>. Check the error stack
	77	to find out the reason.
	78
	79	=back
	80
	81	=head1 EXAMPLES
	82
	83	Scan all certificates in B<CAfile> and list them as acceptable CAs:
	84
	85	SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
	86
	87	=head1 SEE ALSO
	88
	89	L<ssl(3)\|ssl(3)>,
	90	L<SSL_get_client_CA_list(3)\|SSL_get_client_CA_list(3)>,
	91	L<SSL_load_client_CA_file(3)\|SSL_load_client_CA_file(3)>,
	92	L<SSL_CTX_load_verify_locations(3)\|SSL_CTX_load_verify_locations(3)>
	93
	94	=cut