[openssl/openssl] 3e7bd7: doc: add detailed documentation for SSL_CERT_FLAG_...
"'Kit Dallege' via openssl-commits" <[email protected]>
| Newsgroups | gmane.comp.encryption.openssl.cvs |
|---|---|
| Message-ID | <openssl/openssl/push/refs/heads/master/[email protected]> |
Branch: refs/heads/master
Home: https://github.com/openssl/openssl
Commit: 3e7bd74a115e7ac569bd7e5a770d67e695eee874
https://github.com/openssl/openssl/commit/3e7bd74a115e7ac569bd7e5a770d67e695eee874
Author: kovan <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M doc/man3/SSL_CONF_cmd.pod
Log Message:
-----------
doc: add detailed documentation for SSL_CERT_FLAG_TLS_STRICT
The -strict option and StrictCertCheck configuration option were
documented only as "Enables strict mode protocol handling" without
explaining what strict mode actually does.
Add detailed documentation explaining that strict mode enforces:
- All chain certificates must use configured signature algorithms
(no SHA1 fallback)
- CA certificate parameters are validated against supported list
- Client certificate type must match server's CertificateRequest
- Client certificate issuer must be in server's CA list
Also note that Suite B modes always imply strict mode.
Fixes #16140
Co-Authored-By: Claude Opus 4.5 <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Tue Aug 18 15:50:34 2026
(Merged from https://github.com/openssl/openssl/pull/29841)
To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications
--
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/4be37d-3e7bd7%40github.com.