1*4724848cSchristos=pod 2*4724848cSchristos 3*4724848cSchristos=head1 NAME 4*4724848cSchristos 5*4724848cSchristosX509_sign, X509_sign_ctx, X509_verify, X509_REQ_sign, X509_REQ_sign_ctx, 6*4724848cSchristosX509_REQ_verify, X509_CRL_sign, X509_CRL_sign_ctx, X509_CRL_verify - 7*4724848cSchristossign or verify certificate, certificate request or CRL signature 8*4724848cSchristos 9*4724848cSchristos=head1 SYNOPSIS 10*4724848cSchristos 11*4724848cSchristos #include <openssl/x509.h> 12*4724848cSchristos 13*4724848cSchristos int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md); 14*4724848cSchristos int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx); 15*4724848cSchristos int X509_verify(X509 *a, EVP_PKEY *r); 16*4724848cSchristos 17*4724848cSchristos int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md); 18*4724848cSchristos int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx); 19*4724848cSchristos int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r); 20*4724848cSchristos 21*4724848cSchristos int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md); 22*4724848cSchristos int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx); 23*4724848cSchristos int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r); 24*4724848cSchristos 25*4724848cSchristos=head1 DESCRIPTION 26*4724848cSchristos 27*4724848cSchristosX509_sign() signs certificate B<x> using private key B<pkey> and message 28*4724848cSchristosdigest B<md> and sets the signature in B<x>. X509_sign_ctx() also signs 29*4724848cSchristoscertificate B<x> but uses the parameters contained in digest context B<ctx>. 30*4724848cSchristos 31*4724848cSchristosX509_verify() verifies the signature of certificate B<x> using public key 32*4724848cSchristosB<pkey>. Only the signature is checked: no other checks (such as certificate 33*4724848cSchristoschain validity) are performed. 34*4724848cSchristos 35*4724848cSchristosX509_REQ_sign(), X509_REQ_sign_ctx(), X509_REQ_verify(), 36*4724848cSchristosX509_CRL_sign(), X509_CRL_sign_ctx() and X509_CRL_verify() sign and verify 37*4724848cSchristoscertificate requests and CRLs respectively. 38*4724848cSchristos 39*4724848cSchristos=head1 NOTES 40*4724848cSchristos 41*4724848cSchristosX509_sign_ctx() is used where the default parameters for the corresponding 42*4724848cSchristospublic key and digest are not suitable. It can be used to sign keys using 43*4724848cSchristosRSA-PSS for example. 44*4724848cSchristos 45*4724848cSchristosFor efficiency reasons and to work around ASN.1 encoding issues the encoding 46*4724848cSchristosof the signed portion of a certificate, certificate request and CRL is cached 47*4724848cSchristosinternally. If the signed portion of the structure is modified the encoding 48*4724848cSchristosis not always updated meaning a stale version is sometimes used. This is not 49*4724848cSchristosnormally a problem because modifying the signed portion will invalidate the 50*4724848cSchristossignature and signing will always update the encoding. 51*4724848cSchristos 52*4724848cSchristos=head1 RETURN VALUES 53*4724848cSchristos 54*4724848cSchristosX509_sign(), X509_sign_ctx(), X509_REQ_sign(), X509_REQ_sign_ctx(), 55*4724848cSchristosX509_CRL_sign() and X509_CRL_sign_ctx() return the size of the signature 56*4724848cSchristosin bytes for success and zero for failure. 57*4724848cSchristos 58*4724848cSchristosX509_verify(), X509_REQ_verify() and X509_CRL_verify() return 1 if the 59*4724848cSchristossignature is valid and 0 if the signature check fails. If the signature 60*4724848cSchristoscould not be checked at all because it was invalid or some other error 61*4724848cSchristosoccurred then -1 is returned. 62*4724848cSchristos 63*4724848cSchristos=head1 SEE ALSO 64*4724848cSchristos 65*4724848cSchristosL<d2i_X509(3)>, 66*4724848cSchristosL<ERR_get_error(3)>, 67*4724848cSchristosL<X509_CRL_get0_by_serial(3)>, 68*4724848cSchristosL<X509_get0_signature(3)>, 69*4724848cSchristosL<X509_get_ext_d2i(3)>, 70*4724848cSchristosL<X509_get_extension_flags(3)>, 71*4724848cSchristosL<X509_get_pubkey(3)>, 72*4724848cSchristosL<X509_get_subject_name(3)>, 73*4724848cSchristosL<X509_get_version(3)>, 74*4724848cSchristosL<X509_NAME_add_entry_by_txt(3)>, 75*4724848cSchristosL<X509_NAME_ENTRY_get_object(3)>, 76*4724848cSchristosL<X509_NAME_get_index_by_NID(3)>, 77*4724848cSchristosL<X509_NAME_print_ex(3)>, 78*4724848cSchristosL<X509_new(3)>, 79*4724848cSchristosL<X509V3_get_d2i(3)>, 80*4724848cSchristosL<X509_verify_cert(3)> 81*4724848cSchristos 82*4724848cSchristos=head1 HISTORY 83*4724848cSchristos 84*4724848cSchristosThe X509_sign(), X509_REQ_sign() and X509_CRL_sign() functions are 85*4724848cSchristosavailable in all versions of OpenSSL. 86*4724848cSchristos 87*4724848cSchristosThe X509_sign_ctx(), X509_REQ_sign_ctx() 88*4724848cSchristosand X509_CRL_sign_ctx() functions were added OpenSSL 1.0.1. 89*4724848cSchristos 90*4724848cSchristos=head1 COPYRIGHT 91*4724848cSchristos 92*4724848cSchristosCopyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. 93*4724848cSchristos 94*4724848cSchristosLicensed under the OpenSSL license (the "License"). You may not use 95*4724848cSchristosthis file except in compliance with the License. You can obtain a copy 96*4724848cSchristosin the file LICENSE in the source distribution or at 97*4724848cSchristosL<https://www.openssl.org/source/license.html>. 98*4724848cSchristos 99*4724848cSchristos=cut 100