Loading doc/ssl/SSL_CTX_free.pod +2 −0 Original line number Diff line number Diff line Loading @@ -24,6 +24,8 @@ the certificates and keys. SSL_CTX_free() does not provide diagnostic information. =head1 SEE ALSO L<SSL_CTX_new(3)|SSL_CTX_new(3)>, L<ssl(3)|ssl(3)> =cut doc/ssl/SSL_CTX_load_verify_locations.pod +1 −1 Original line number Diff line number Diff line Loading @@ -58,7 +58,7 @@ failure. In server mode, when requesting a client certificate, the server must send the list of CAs of which it will accept client certificates. This list is not influenced by the contents of B<CAfile> or B<CApath> and must explicitely be set using the explicitly be set using the L<SSL_CTX_set_client_CA_list(3)|SSL_CTX_set_client_CA_list(3)> family of functions. Loading doc/ssl/SSL_CTX_set_info_callback.pod +1 −1 Original line number Diff line number Diff line Loading @@ -43,7 +43,7 @@ is called whenever the state changes, an alert appears, or an error occurs. The callback function is called as B<callback(SSL *ssl, int where, int ret)>. The B<where> argument specifies information about where (in which context) the callback function was called. If B<ret> is 0, an error condition occured. the callback function was called. If B<ret> is 0, an error condition occurred. If an alert is handled, SSL_CB_ALERT is set and B<ret> specifies the alert information. Loading doc/ssl/SSL_CTX_set_options.pod +1 −1 Original line number Diff line number Diff line Loading @@ -133,7 +133,7 @@ This option must be used to prevent small subgroup attacks, when the DH parameters were not generated using "strong" primes (e.g. when using DSA-parameters, see L<dhparam(1)|dhparam(1)>). If "strong" primes were used, it is not strictly necessary to generate a new DH key during each handshake but it is also recommendet. a new DH key during each handshake but it is also recommended. SSL_OP_SINGLE_DH_USE should therefore be enabled whenever temporary/ephemeral DH parameters are used. Loading doc/ssl/SSL_CTX_set_tmp_dh_callback.pod +3 −3 Original line number Diff line number Diff line Loading @@ -29,7 +29,7 @@ The key is inherited by all B<ssl> objects created from B<ctx>. SSL_set_tmp_dh_callback() sets the callback only for B<ssl>. SSL_set_tmp_dh() sets the paramters only for B<ssl>. SSL_set_tmp_dh() sets the parameters only for B<ssl>. These functions apply to SSL/TLS servers only. Loading @@ -54,7 +54,7 @@ In order to perform a DH key exchange the server must use a DH group DH key during the negotiation, when the DH parameters are supplied via callback and/or when the SSL_OP_SINGLE_DH_USE option of L<SSL_CTX_set_options(3)|SSL_CTX_set_options(3)> is set. It will immediatly create a DH key, when DH parameters are supplied via immediately create a DH key, when DH parameters are supplied via SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. In this case, it may happen that a key is generated on initialization without later being needed, while on the other hand the computer time during the Loading @@ -74,7 +74,7 @@ should not generate the parameters on the fly but supply the parameters. DH parameters can be reused, as the actual key is newly generated during the negotiation. The risk in reusing DH parameters is that an attacker may specialize on a very often used DH group. Applications should therefore generate their own DH paramaters during the installation process using the generate their own DH parameters during the installation process using the openssl L<dhparam(1)|dhparam(1)> application. In order to reduce the computer time needed for this generation, it is possible to use DSA parameters instead (see L<dhparam(1)|dhparam(1)>), but in this case SSL_OP_SINGLE_DH_USE Loading Loading
doc/ssl/SSL_CTX_free.pod +2 −0 Original line number Diff line number Diff line Loading @@ -24,6 +24,8 @@ the certificates and keys. SSL_CTX_free() does not provide diagnostic information. =head1 SEE ALSO L<SSL_CTX_new(3)|SSL_CTX_new(3)>, L<ssl(3)|ssl(3)> =cut
doc/ssl/SSL_CTX_load_verify_locations.pod +1 −1 Original line number Diff line number Diff line Loading @@ -58,7 +58,7 @@ failure. In server mode, when requesting a client certificate, the server must send the list of CAs of which it will accept client certificates. This list is not influenced by the contents of B<CAfile> or B<CApath> and must explicitely be set using the explicitly be set using the L<SSL_CTX_set_client_CA_list(3)|SSL_CTX_set_client_CA_list(3)> family of functions. Loading
doc/ssl/SSL_CTX_set_info_callback.pod +1 −1 Original line number Diff line number Diff line Loading @@ -43,7 +43,7 @@ is called whenever the state changes, an alert appears, or an error occurs. The callback function is called as B<callback(SSL *ssl, int where, int ret)>. The B<where> argument specifies information about where (in which context) the callback function was called. If B<ret> is 0, an error condition occured. the callback function was called. If B<ret> is 0, an error condition occurred. If an alert is handled, SSL_CB_ALERT is set and B<ret> specifies the alert information. Loading
doc/ssl/SSL_CTX_set_options.pod +1 −1 Original line number Diff line number Diff line Loading @@ -133,7 +133,7 @@ This option must be used to prevent small subgroup attacks, when the DH parameters were not generated using "strong" primes (e.g. when using DSA-parameters, see L<dhparam(1)|dhparam(1)>). If "strong" primes were used, it is not strictly necessary to generate a new DH key during each handshake but it is also recommendet. a new DH key during each handshake but it is also recommended. SSL_OP_SINGLE_DH_USE should therefore be enabled whenever temporary/ephemeral DH parameters are used. Loading
doc/ssl/SSL_CTX_set_tmp_dh_callback.pod +3 −3 Original line number Diff line number Diff line Loading @@ -29,7 +29,7 @@ The key is inherited by all B<ssl> objects created from B<ctx>. SSL_set_tmp_dh_callback() sets the callback only for B<ssl>. SSL_set_tmp_dh() sets the paramters only for B<ssl>. SSL_set_tmp_dh() sets the parameters only for B<ssl>. These functions apply to SSL/TLS servers only. Loading @@ -54,7 +54,7 @@ In order to perform a DH key exchange the server must use a DH group DH key during the negotiation, when the DH parameters are supplied via callback and/or when the SSL_OP_SINGLE_DH_USE option of L<SSL_CTX_set_options(3)|SSL_CTX_set_options(3)> is set. It will immediatly create a DH key, when DH parameters are supplied via immediately create a DH key, when DH parameters are supplied via SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. In this case, it may happen that a key is generated on initialization without later being needed, while on the other hand the computer time during the Loading @@ -74,7 +74,7 @@ should not generate the parameters on the fly but supply the parameters. DH parameters can be reused, as the actual key is newly generated during the negotiation. The risk in reusing DH parameters is that an attacker may specialize on a very often used DH group. Applications should therefore generate their own DH paramaters during the installation process using the generate their own DH parameters during the installation process using the openssl L<dhparam(1)|dhparam(1)> application. In order to reduce the computer time needed for this generation, it is possible to use DSA parameters instead (see L<dhparam(1)|dhparam(1)>), but in this case SSL_OP_SINGLE_DH_USE Loading
