Automatically generated by Pod::Man 2.28 (Pod::Simple 3.28)

Standard preamble:
========================================================================
..

..

.. Set up some character translations and predefined strings. \*(-- will
give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
double quote, and \*(R" will give a right double quote. \*(C+ will
give a nicer C++. Capital omega is used to do unbreakable dashes and
therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
nothing in troff, for use with C<>.
.tr \(*W- . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\}
Escape single quotes in literal strings from groff's Unicode transform.

If the F register is turned on, we'll generate index entries on stderr for
titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
entries marked with X<> in POD. Of course, you'll have to process the
output yourself in some meaningful fashion.

Avoid warning from groff about undefined register 'F'.
.. .nr rF 0 . if \nF \{ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{ . nr % 0 . nr F 2 . \} . \} .\} .rr rF
Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
Fear. Run. Save yourself. No user-serviceable parts.
. \" fudge factors for nroff and troff . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] .\} . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents . \" corrections for vroff . \" for low resolution devices (crt and lpr) \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} ========================================================================

Title "SSL_CTX_set_client_CA_list 3" For nroff, turn off justification. Always turn off hyphenation; it makes
way too many mistakes in technical documents.
SSL_CTX_set_client_CA_list, SSL_set_client_CA_list, SSL_CTX_add_client_CA, SSL_add_client_CA - set list of CAs sent to the client when requesting a client certificate Header "SYNOPSIS" .Vb 1 #include <openssl/ssl.h> void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list); void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list); int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *cacert); int SSL_add_client_CA(SSL *ssl, X509 *cacert); .Ve Header "DESCRIPTION" \fISSL_CTX_set_client_CA_list() sets the list of CAs sent to the client when requesting a client certificate for ctx.

\fISSL_set_client_CA_list() sets the list of CAs sent to the client when requesting a client certificate for the chosen ssl, overriding the setting valid for ssl's \s-1SSL_CTX\s0 object.

\fISSL_CTX_add_client_CA() adds the \s-1CA\s0 name extracted from cacert to the list of CAs sent to the client when requesting a client certificate for \fBctx.

\fISSL_add_client_CA() adds the \s-1CA\s0 name extracted from cacert to the list of CAs sent to the client when requesting a client certificate for the chosen ssl, overriding the setting valid for ssl's \s-1SSL_CTX\s0 object.

Header "NOTES" When a \s-1TLS/SSL\s0 server requests a client certificate (see \fB\f(BISSL_CTX_set_verify\|(3)), it sends a list of CAs, for which it will accept certificates, to the client.

This list must explicitly be set using SSL_CTX_set_client_CA_list() for \fBctx and SSL_set_client_CA_list() for the specific ssl. The list specified overrides the previous setting. The CAs listed do not become trusted (list only contains the names, not the complete certificates); use \fISSL_CTX_load_verify_locations\|(3) to additionally load them for verification.

If the list of acceptable CAs is compiled in a file, the \fISSL_load_client_CA_file\|(3) function can be used to help importing the necessary data.

\fISSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional items the list of client CAs. If no list was specified before using \fISSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client \s-1CA\s0 list for ctx or ssl (as appropriate) is opened.

These functions are only useful for \s-1TLS/SSL\s0 servers.

Header "RETURN VALUES" \fISSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return diagnostic information.

\fISSL_CTX_add_client_CA() and SSL_add_client_CA() have the following return values:

A failure while manipulating the \s-1STACK_OF\s0(X509_NAME) object occurred or the X509_NAME could not be extracted from cacert. Check the error stack to find out the reason. Item "1" The operation succeeded. Header "EXAMPLES" Scan all certificates in CAfile and list them as acceptable CAs:

.Vb 1 SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile)); .Ve

Header "SEE ALSO" \fIssl\|(3), \fISSL_get_client_CA_list\|(3), \fISSL_load_client_CA_file\|(3), \fISSL_CTX_load_verify_locations\|(3)