| SSL_CTX_set_client_CA_list.pod (76866) | SSL_CTX_set_client_CA_list.pod (79998) |
|---|---|
| 1=pod 2 3=head1 NAME 4 5SSL_CTX_set_client_CA_list, SSL_set_client_CA_list, SSL_CTX_add_client_CA, 6SSL_add_client_CA - set list of CAs sent to the client when requesting a 7client certificate 8 --- 22 unchanged lines hidden (view full) --- 31SSL_add_client_CA() adds the CA name extracted from B<cacert> to the 32list of CAs sent to the client when requesting a client certificate for 33the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object. 34 35=head1 NOTES 36 37When a TLS/SSL server requests a client certificate (see 38B<SSL_CTX_set_verify_options()>), it sends a list of CAs, for which | 1=pod 2 3=head1 NAME 4 5SSL_CTX_set_client_CA_list, SSL_set_client_CA_list, SSL_CTX_add_client_CA, 6SSL_add_client_CA - set list of CAs sent to the client when requesting a 7client certificate 8 --- 22 unchanged lines hidden (view full) --- 31SSL_add_client_CA() adds the CA name extracted from B<cacert> to the 32list of CAs sent to the client when requesting a client certificate for 33the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object. 34 35=head1 NOTES 36 37When a TLS/SSL server requests a client certificate (see 38B<SSL_CTX_set_verify_options()>), it sends a list of CAs, for which |
| 39it will accept certificates, to the client. If no special list is provided, 40the CAs available using the B<CAfile> option in 41L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> 42are sent. | 39it will accept certificates, to the client. |
| 43 | 40 |
| 44This list can be explicitly set using the SSL_CTX_set_client_CA_list() for | 41This list must explicitly be set using SSL_CTX_set_client_CA_list() for |
| 45B<ctx> and SSL_set_client_CA_list() for the specific B<ssl>. The list 46specified overrides the previous setting. The CAs listed do not become 47trusted (B<list> only contains the names, not the complete certificates); use 48L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> 49to additionally load them for verification. 50 | 42B<ctx> and SSL_set_client_CA_list() for the specific B<ssl>. The list 43specified overrides the previous setting. The CAs listed do not become 44trusted (B<list> only contains the names, not the complete certificates); use 45L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> 46to additionally load them for verification. 47 |
| 48If the list of acceptable CAs is compiled in a file, the 49L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)> 50function can be used to help importing the necessary data. 51 |
|
| 51SSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional 52items the list of client CAs. If no list was specified before using 53SSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client | 52SSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional 53items the list of client CAs. If no list was specified before using 54SSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client |
| 54CA list for B<ctx> or B<ssl> (as appropriate) is opened. The CAs implicitly 55specified using 56L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> 57are no longer used automatically. | 55CA list for B |
| 58 59These functions are only useful for TLS/SSL servers. 60 61=head1 RETURN VALUES 62 63SSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return 64diagnostic information. 65 --- 9 unchanged lines hidden (view full) --- 75=item 0 76 77A failure while manipulating the STACK_OF(X509_NAME) object occurred or 78the X509_NAME could not be extracted from B<cacert>. Check the error stack 79to find out the reason. 80 81=back 82 | 56 57These functions are only useful for TLS/SSL servers. 58 59=head1 RETURN VALUES 60 61SSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return 62diagnostic information. 63 --- 9 unchanged lines hidden (view full) --- 73=item 0 74 75A failure while manipulating the STACK_OF(X509_NAME) object occurred or 76the X509_NAME could not be extracted from B<cacert>. Check the error stack 77to find out the reason. 78 79=back 80 |
| 81=head1 EXAMPLES 82 83Scan all certificates in B<CAfile> and list them as acceptable CAs: 84 85 SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile)); 86 |
|
| 83=head1 SEE ALSO 84 85L<ssl(3)|ssl(3)>, 86L<SSL_get_client_CA_list(3)|SSL_get_client_CA_list(3)>, | 87=head1 SEE ALSO 88 89L<ssl(3)|ssl(3)>, 90L<SSL_get_client_CA_list(3)|SSL_get_client_CA_list(3)>, |
| 87L | 91L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)>, |
| 88L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> 89 90=cut | 92L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> 93 94=cut |