Latest update.

2019-09-21 00:43:47 +09:00
parent 2e57f602ae
commit 62515c7d8d
1131 changed files with 47556 additions and 24957 deletions
@@ -40,7 +40,8 @@ It is strongly recommended to use absolute paths with the B<.include>
 directive. Relative paths are evaluated based on the application current
 working directory so unless the configuration file containing the
 B<.include> directive is application specific the inclusion will not
-work as expected.
+work as expected. The environment variable B<OPENSSL_CONF_INCLUDE> can also be
+used to specify the path to prepend to all .include paths.

 There can be optional B<=> character and whitespace characters between
 B<.include> directive and the path which can be useful in cases the
@@ -487,6 +488,10 @@ Ignored in set-user-ID and set-group-ID programs.
 The path to the directory with OpenSSL modules, such as providers.
 Ignored in set-user-ID and set-group-ID programs.

+=item B<OPENSSL_CONF_INCLUDE>
+
+The optional path to prepend to all .include paths.
+
 =back

 =head1 BUGS
@@ -504,7 +509,7 @@ file.

 =head1 SEE ALSO

-L<x509(1)>, L<req(1)>, L<ca(1)>
+L<x509(1)>, L<req(1)>, L<ca(1)>, L<fips_config(5)>

 =head1 COPYRIGHT

@@ -0,0 +1,71 @@
+=pod
+
+=head1 NAME
+
+OPENSSL FIPS CONFIGURATION
+
+=head1 DESCRIPTION
+
+A separate configuration file containing data related to FIPS 'self tests' is
+written to during installation time.
+This data is used for 2 purposes when the fips module is loaded:
+
+=over 4
+
+=item - Verify the module's checksum each time the fips module loads.
+
+=item - Run the startup FIPS self test KATS (known answer tests).
+This only needs to be run once during installation.
+
+=back
+
+The supported options are:
+
+=over 4
+
+=item B<module-checksum>
+
+The calculated MAC of the module file
+
+=item B<install-version>
+
+A version number for the fips install process. Should be 1.
+
+=item B<install-status>
+
+The install status indicator description that will be verified.
+If this field is not present the FIPS self tests will run when the fips module
+loads.
+This value should only be written to after the FIPS module has
+successfully passed its self tests during installation.
+
+=item B<install-checksum>
+
+The calculated MAC of the install status indicator.
+It is initially empty and is written to at the same time as the install_status.
+
+=back
+
+For example:
+
+ [fips_install]
+
+ install-version = 1
+ module-checksum = 41:D0:FA:C2:5D:41:75:CD:7D:C3:90:55:6F:A4:DC
+ install-checksum = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C
+ install-status = INSTALL_SELF_TEST_KATS_RUN
+
+=head1 SEE ALSO
+
+L<config(5)>
+
+=head1 COPYRIGHT
+
+Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
@@ -56,7 +56,7 @@ must be used, see the L<ARBITRARY EXTENSIONS|/"ARBITRARY EXTENSIONS"> section fo

 The following sections describe each supported extension in detail.

-=head2 Basic Constraints.
+=head2 Basic Constraints

 This is a multi valued extension which indicates whether a certificate is
 a CA certificate. The first (mandatory) name is B<CA> followed by B<TRUE> or
@@ -81,7 +81,7 @@ below this one in a chain. So if you have a CA with a pathlen of zero it can
 only be used to sign end user certificates and not further CAs.


-=head2 Key Usage.
+=head2 Key Usage

 Key usage is a multi valued extension consisting of a list of names of the
 permitted key usages.
@@ -97,7 +97,7 @@ Examples:
 keyUsage=critical, keyCertSign


-=head2 Extended Key Usage.
+=head2 Extended Key Usage

 This extensions consists of a list of usages indicating purposes for which
 the certificate public key can be used for,
@@ -126,7 +126,7 @@ Examples:
 extendedKeyUsage=serverAuth,clientAuth


-=head2 Subject Key Identifier.
+=head2 Subject Key Identifier

 This is really a string extension and can take two possible values. Either
 the word B<hash> which will automatically follow the guidelines in RFC3280
@@ -138,7 +138,7 @@ Example:
 subjectKeyIdentifier=hash


-=head2 Authority Key Identifier.
+=head2 Authority Key Identifier

 The authority key identifier extension permits two options. keyid and issuer:
 both can take the optional value "always".
@@ -156,7 +156,7 @@ Example:
 authorityKeyIdentifier=keyid,issuer


-=head2 Subject Alternative Name.
+=head2 Subject Alternative Name

 The subject alternative name extension allows various literal values to be
 included in the configuration file. These include B<email> (an email address)
@@ -195,7 +195,7 @@ Examples:
 CN=My Name


-=head2 Issuer Alternative Name.
+=head2 Issuer Alternative Name

 The issuer alternative name option supports all the literal options of
 subject alternative name. It does B<not> support the email:copy option because
@@ -208,7 +208,7 @@ Example:
 issuerAltName = issuer:copy


-=head2 Authority Info Access.
+=head2 Authority Info Access

 The authority information access extension gives details about how to access
 certain information relating to the CA. Its syntax is accessOID;location
@@ -300,7 +300,7 @@ Example:
 CN=Some Name


-=head2 Certificate Policies.
+=head2 Certificate Policies

 This is a I<raw> extension. All the fields of this extension can be set by
 using the appropriate syntax.
@@ -424,7 +424,7 @@ Example:
 The following extensions are non standard, Netscape specific and largely
 obsolete. Their use in new applications is discouraged.

-=head2 Netscape String extensions.
+=head2 Netscape String extensions

 Netscape Comment (B<nsComment>) is a string extension containing a comment
 which will be displayed when the certificate is viewed in some browsers.
@@ -483,7 +483,7 @@ For example:

 basicConstraints=critical,DER:00:01:02:03

-=head1 WARNING
+=head1 WARNINGS

 There is no guarantee that a specific implementation will process a given
 extension. It may therefore be sometimes possible to use certificates for
@@ -493,7 +493,6 @@ not recognize or honour the values of the relevant extensions.
 The DER and ASN1 options should be used with caution. It is possible to create
 totally invalid extensions if they are not used carefully.

-
 =head1 NOTES

 If an extension is multi-value and a field value must contain a comma the long