]>
Commit | Line | Data |
---|---|---|
aba3e65f DSH |
1 | =pod |
2 | ||
3 | =head1 NAME | |
4 | ||
19d2bb57 | 5 | config - OpenSSL CONF library configuration files |
aba3e65f DSH |
6 | |
7 | =head1 DESCRIPTION | |
8 | ||
19d2bb57 | 9 | The OpenSSL CONF library can be used to read configuration files. |
aba3e65f DSH |
10 | It is used for the OpenSSL master configuration file B<openssl.cnf> |
11 | and in a few other places like B<SPKAC> files and certificate extension | |
a30af36c DSH |
12 | files for the B<x509> utility. OpenSSL applications can also use the |
13 | CONF library for their own purposes. | |
aba3e65f DSH |
14 | |
15 | A configuration file is divided into a number of sections. Each section | |
e8769719 | 16 | starts with a line C<[section_name]> and ends when a new section is |
aba3e65f | 17 | started or end of file is reached. A section name can consist of |
e8769719 | 18 | alphanumeric characters and underscores. The brackets are required. |
aba3e65f DSH |
19 | |
20 | The first section of a configuration file is special and is referred | |
0652e8a7 | 21 | to as the B<default> section. This section is usually unnamed and spans from the |
aba3e65f DSH |
22 | start of file until the first named section. When a name is being looked up |
23 | it is first looked up in a named section (if any) and then the | |
24 | default section. | |
25 | ||
26 | The environment is mapped onto a section called B<ENV>. | |
27 | ||
28 | Comments can be included by preceding them with the B<#> character | |
29 | ||
b524b808 TM |
30 | Other files can be included using the B<.include> directive followed |
31 | by a path. If the path points to a directory all files with | |
32 | names ending with B<.cnf> or B<.conf> are included from the directory. | |
33 | Recursive inclusion of directories from files in such directory is not | |
34 | supported. That means the files in the included directory can also contain | |
35 | B<.include> directives but only inclusion of regular files is supported | |
36 | there. The inclusion of directories is not supported on systems without | |
37 | POSIX IO support. | |
38 | ||
39 | It is strongly recommended to use absolute paths with the B<.include> | |
40 | directive. Relative paths are evaluated based on the application current | |
41 | working directory so unless the configuration file containing the | |
42 | B<.include> directive is application specific the inclusion will not | |
7bb82f92 SL |
43 | work as expected. The environment variable B<OPENSSL_CONF_INCLUDE> can also be |
44 | used to specify the path to prepend to all .include paths. | |
b524b808 | 45 | |
9d556033 TM |
46 | There can be optional B<=> character and whitespace characters between |
47 | B<.include> directive and the path which can be useful in cases the | |
48 | configuration file needs to be loaded by old OpenSSL versions which do | |
49 | not support the B<.include> syntax. They would bail out with error | |
50 | if the B<=> character is not present but with it they just ignore | |
51 | the include. | |
52 | ||
0255c174 RL |
53 | Pragmas can be specified with the B<.pragma> directive. |
54 | See L</PRAGMAS> for mor information. | |
55 | ||
aba3e65f DSH |
56 | Each section in a configuration file consists of a number of name and |
57 | value pairs of the form B<name=value> | |
58 | ||
59 | The B<name> string can contain any alphanumeric characters as well as | |
60 | a few punctuation symbols such as B<.> B<,> B<;> and B<_>. | |
61 | ||
62 | The B<value> string consists of the string following the B<=> character | |
63 | until end of line with any leading and trailing white space removed. | |
64 | ||
65 | The value string undergoes variable expansion. This can be done by | |
66 | including the form B<$var> or B<${var}>: this will substitute the value | |
67 | of the named variable in the current section. It is also possible to | |
68 | substitute a value from another section using the syntax B<$section::name> | |
19d2bb57 | 69 | or B<${section::name}>. By using the form B<$ENV::name> environment |
aba3e65f DSH |
70 | variables can be substituted. It is also possible to assign values to |
71 | environment variables by using the name B<ENV::name>, this will work | |
72 | if the program looks up environment variables using the B<CONF> library | |
8a585601 MC |
73 | instead of calling getenv() directly. The value string must not exceed 64k in |
74 | length after variable expansion. Otherwise an error will occur. | |
aba3e65f DSH |
75 | |
76 | It is possible to escape certain characters by using any kind of quote | |
77 | or the B<\> character. By making the last character of a line a B<\> | |
78 | a B<value> string can be spread across multiple lines. In addition | |
657e60fa | 79 | the sequences B<\n>, B<\r>, B<\b> and B<\t> are recognized. |
aba3e65f | 80 | |
b524b808 TM |
81 | All expansion and escape rules as described above that apply to B<value> |
82 | also apply to the path of the B<.include> directive. | |
83 | ||
0255c174 RL |
84 | =head1 PRAGMAS |
85 | ||
86 | Pragmas can be used to change the behavior of the configuration file | |
87 | parser, among others. Currently supported pragmas are: | |
88 | ||
89 | =over 4 | |
90 | ||
91 | =item B<.pragma> B<dollarid>:I<value> | |
92 | ||
93 | I<value> can be one of: | |
94 | ||
95 | =over 4 | |
96 | ||
97 | =item B<"on"> or B<"true"> | |
98 | ||
99 | this signifies that dollar signs are considered an identity character | |
100 | from this point on and that variable expansion requires the use of | |
101 | braces or parentheses. In other words, C<foo$bar> will be considered | |
102 | a name instead of C<foo> followed by the expansion of the variable | |
103 | C<bar>. | |
104 | This is suitable for platforms where the dollar sign is commonly used | |
105 | as part of names. | |
106 | ||
107 | =item B<"off"> or B<"false"> | |
108 | ||
109 | Turns this pragma off, i.e. C<foo$bar> will be interpreted as C<foo> | |
110 | followed by the expansion of the variable C<bar>. | |
111 | ||
112 | =back | |
113 | ||
114 | By default, this pragma is turned off. | |
115 | ||
116 | =back | |
117 | ||
a30af36c DSH |
118 | =head1 OPENSSL LIBRARY CONFIGURATION |
119 | ||
a528d4f0 | 120 | Applications can automatically configure certain |
a30af36c DSH |
121 | aspects of OpenSSL using the master OpenSSL configuration file, or optionally |
122 | an alternative configuration file. The B<openssl> utility includes this | |
123 | functionality: any sub command uses the master OpenSSL configuration file | |
124 | unless an option is used in the sub command to use an alternative configuration | |
125 | file. | |
126 | ||
1bc74519 | 127 | To enable library configuration the default section needs to contain an |
a30af36c DSH |
128 | appropriate line which points to the main configuration section. The default |
129 | name is B<openssl_conf> which is used by the B<openssl> utility. Other | |
a8c5ed81 | 130 | applications may use an alternative name such as B<myapplication_conf>. |
131 | All library configuration lines appear in the default section at the start | |
132 | of the configuration file. | |
a30af36c DSH |
133 | |
134 | The configuration section should consist of a set of name value pairs which | |
135 | contain specific module configuration information. The B<name> represents | |
cb1b2caf | 136 | the name of the I<configuration module>. The meaning of the B<value> is |
a30af36c | 137 | module specific: it may, for example, represent a further configuration |
cb1b2caf | 138 | section containing configuration module specific information. E.g.: |
a30af36c | 139 | |
a8c5ed81 | 140 | # This must be in the default section |
a30af36c DSH |
141 | openssl_conf = openssl_init |
142 | ||
143 | [openssl_init] | |
144 | ||
145 | oid_section = new_oids | |
146 | engines = engine_section | |
b6670f69 | 147 | providers = provider_section |
a30af36c DSH |
148 | |
149 | [new_oids] | |
150 | ||
151 | ... new oids here ... | |
152 | ||
153 | [engine_section] | |
154 | ||
155 | ... engine stuff here ... | |
156 | ||
b6670f69 RL |
157 | [provider_section] |
158 | ||
159 | ... provider stuff here ... | |
160 | ||
3d764db7 | 161 | The features of each configuration module are described below. |
a30af36c | 162 | |
05ea606a | 163 | =head2 ASN1 Object Configuration Module |
a30af36c DSH |
164 | |
165 | This module has the name B<oid_section>. The value of this variable points | |
166 | to a section containing name value pairs of OIDs: the name is the OID short | |
167 | and long name, the value is the numerical form of the OID. Although some of | |
168 | the B<openssl> utility sub commands already have their own ASN1 OBJECT section | |
169 | functionality not all do. By using the ASN1 OBJECT configuration module | |
170 | B<all> the B<openssl> utility sub commands can see the new objects as well | |
171 | as any compliant applications. For example: | |
172 | ||
173 | [new_oids] | |
1bc74519 | 174 | |
a30af36c DSH |
175 | some_new_oid = 1.2.3.4 |
176 | some_other_oid = 1.2.3.5 | |
177 | ||
a528d4f0 | 178 | It is also possible to set the value to the long name followed |
6446e0c3 DSH |
179 | by a comma and the numerical OID form. For example: |
180 | ||
181 | shortName = some object long name, 1.2.3.4 | |
182 | ||
05ea606a | 183 | =head2 Engine Configuration Module |
a30af36c | 184 | |
f2c18125 DSH |
185 | This ENGINE configuration module has the name B<engines>. The value of this |
186 | variable points to a section containing further ENGINE configuration | |
187 | information. | |
188 | ||
189 | The section pointed to by B<engines> is a table of engine names (though see | |
2b4ffc65 | 190 | B<engine_id> below) and further sections containing configuration information |
f2c18125 DSH |
191 | specific to each ENGINE. |
192 | ||
193 | Each ENGINE specific section is used to set default algorithms, load | |
194 | dynamic, perform initialization and send ctrls. The actual operation performed | |
195 | depends on the I<command> name which is the name of the name value pair. The | |
196 | currently supported commands are listed below. | |
197 | ||
198 | For example: | |
199 | ||
200 | [engine_section] | |
201 | ||
202 | # Configure ENGINE named "foo" | |
203 | foo = foo_section | |
204 | # Configure ENGINE named "bar" | |
205 | bar = bar_section | |
206 | ||
207 | [foo_section] | |
208 | ... foo ENGINE specific commands ... | |
209 | ||
210 | [bar_section] | |
211 | ... "bar" ENGINE specific commands ... | |
212 | ||
1bc74519 | 213 | The command B<engine_id> is used to give the ENGINE name. If used this |
f2c18125 DSH |
214 | command must be first. For example: |
215 | ||
216 | [engine_section] | |
217 | # This would normally handle an ENGINE named "foo" | |
218 | foo = foo_section | |
219 | ||
220 | [foo_section] | |
221 | # Override default name and use "myfoo" instead. | |
222 | engine_id = myfoo | |
223 | ||
224 | The command B<dynamic_path> loads and adds an ENGINE from the given path. It | |
225 | is equivalent to sending the ctrls B<SO_PATH> with the path argument followed | |
226 | by B<LIST_ADD> with value 2 and B<LOAD> to the dynamic ENGINE. If this is | |
227 | not the required behaviour then alternative ctrls can be sent directly | |
228 | to the dynamic ENGINE using ctrl commands. | |
229 | ||
230 | The command B<init> determines whether to initialize the ENGINE. If the value | |
231 | is B<0> the ENGINE will not be initialized, if B<1> and attempt it made to | |
232 | initialized the ENGINE immediately. If the B<init> command is not present | |
233 | then an attempt will be made to initialize the ENGINE after all commands in | |
234 | its section have been processed. | |
235 | ||
236 | The command B<default_algorithms> sets the default algorithms an ENGINE will | |
35cb565a | 237 | supply using the functions ENGINE_set_default_string(). |
f2c18125 DSH |
238 | |
239 | If the name matches none of the above command names it is assumed to be a | |
1bc74519 | 240 | ctrl command which is sent to the ENGINE. The value of the command is the |
f2c18125 DSH |
241 | argument to the ctrl command. If the value is the string B<EMPTY> then no |
242 | value is sent to the command. | |
243 | ||
244 | For example: | |
245 | ||
246 | ||
247 | [engine_section] | |
248 | ||
249 | # Configure ENGINE named "foo" | |
250 | foo = foo_section | |
251 | ||
252 | [foo_section] | |
253 | # Load engine from DSO | |
254 | dynamic_path = /some/path/fooengine.so | |
255 | # A foo specific ctrl. | |
256 | some_ctrl = some_value | |
257 | # Another ctrl that doesn't take a value. | |
258 | other_ctrl = EMPTY | |
259 | # Supply all default algorithms | |
260 | default_algorithms = ALL | |
a30af36c | 261 | |
b6670f69 RL |
262 | =head2 Provider Configuration Module |
263 | ||
264 | This provider configuration module has the name B<providers>. The | |
265 | value of this variable points to a section containing further provider | |
266 | configuration information. | |
267 | ||
268 | The section pointed to by B<providers> is a table of provider names | |
269 | (though see B<identity> below) and further sections containing | |
270 | configuration information specific to each provider module. | |
271 | ||
272 | Each provider specific section is used to load its module, perform | |
273 | activation and set parameters to pass to the provider on demand. The | |
274 | actual operation performed depends on the name of the name value pair. | |
275 | The currently supported commands are listed below. | |
276 | ||
277 | For example: | |
278 | ||
279 | [provider_section] | |
280 | ||
281 | # Configure provider named "foo" | |
282 | foo = foo_section | |
283 | # Configure provider named "bar" | |
284 | bar = bar_section | |
285 | ||
286 | [foo_section] | |
287 | ... "foo" provider specific parameters ... | |
288 | ||
289 | [bar_section] | |
290 | ... "bar" provider specific parameters ... | |
291 | ||
292 | The command B<identity> is used to give the provider name. For example: | |
293 | ||
294 | [provider_section] | |
295 | # This would normally handle a provider named "foo" | |
296 | foo = foo_section | |
297 | ||
298 | [foo_section] | |
299 | # Override default name and use "myfoo" instead. | |
300 | identity = myfoo | |
301 | ||
302 | The parameter B<module> loads and adds a provider module from the | |
9c0586d5 | 303 | given module path. That path may be a simple filename, a relative |
b6670f69 RL |
304 | path or an absolute path. |
305 | ||
306 | The parameter B<activate> determines whether to activate the | |
307 | provider. The value has no importance, the presence of the parameter | |
308 | is enough for activation to take place. | |
309 | ||
310 | All parameters in the section as well as sub-sections are made | |
311 | available to the provider. | |
312 | ||
05ea606a | 313 | =head2 EVP Configuration Module |
3d764db7 | 314 | |
de3955f6 | 315 | This module has the name B<alg_section> which points to a section containing |
3d764db7 DSH |
316 | algorithm commands. |
317 | ||
de3955f6 RL |
318 | The supported algorithm commands are: |
319 | ||
320 | =over 4 | |
321 | ||
322 | =item B<default_properties> | |
323 | ||
324 | The value may be anything that is acceptable as a property query | |
325 | string for EVP_set_default_properties(). | |
326 | ||
327 | =item B<fips_mode> (deprecated) | |
328 | ||
329 | The value is a boolean that can be B<yes> or B<no>. If the value is | |
330 | B<yes>, this is exactly equivalent to: | |
331 | ||
332 | default_properties = fips=yes | |
333 | ||
334 | If the value is B<no>, nothing happens. | |
335 | ||
336 | =back | |
337 | ||
338 | These two commands should not be used together, as there is no control | |
339 | over how they affect each other. | |
340 | The use of B<fips_mode> is strongly discouraged and is only present | |
341 | for backward compatibility with earlier OpenSSL FIPS modules. | |
3d764db7 | 342 | |
05ea606a | 343 | =head2 SSL Configuration Module |
913592d2 DSH |
344 | |
345 | This module has the name B<ssl_conf> which points to a section containing | |
346 | SSL configurations. | |
347 | ||
348 | Each line in the SSL configuration section contains the name of the | |
349 | configuration and the section containing it. | |
350 | ||
351 | Each configuration section consists of command value pairs for B<SSL_CONF>. | |
352 | Each pair will be passed to a B<SSL_CTX> or B<SSL> structure if it calls | |
353 | SSL_CTX_config() or SSL_config() with the appropriate configuration name. | |
354 | ||
355 | Note: any characters before an initial dot in the configuration section are | |
356 | ignored so the same command can be used multiple times. | |
357 | ||
358 | For example: | |
359 | ||
360 | ssl_conf = ssl_sect | |
361 | ||
362 | [ssl_sect] | |
363 | ||
364 | server = server_section | |
365 | ||
366 | [server_section] | |
367 | ||
368 | RSA.Certificate = server-rsa.pem | |
369 | ECDSA.Certificate = server-ecdsa.pem | |
370 | Ciphers = ALL:!RC4 | |
3d764db7 | 371 | |
8a5ed9dc TM |
372 | The system default configuration with name B<system_default> if present will |
373 | be applied during any creation of the B<SSL_CTX> structure. | |
374 | ||
375 | Example of a configuration with the system default: | |
376 | ||
377 | ssl_conf = ssl_sect | |
378 | ||
379 | [ssl_sect] | |
380 | ||
381 | system_default = system_default_sect | |
382 | ||
383 | [system_default_sect] | |
384 | ||
385 | MinProtocol = TLSv1.2 | |
386 | ||
387 | ||
aba3e65f DSH |
388 | =head1 NOTES |
389 | ||
19d2bb57 | 390 | If a configuration file attempts to expand a variable that doesn't exist |
aba3e65f DSH |
391 | then an error is flagged and the file will not load. This can happen |
392 | if an attempt is made to expand an environment variable that doesn't | |
a30af36c DSH |
393 | exist. For example in a previous version of OpenSSL the default OpenSSL |
394 | master configuration file used the value of B<HOME> which may not be | |
395 | defined on non Unix systems and would cause an error. | |
aba3e65f DSH |
396 | |
397 | This can be worked around by including a B<default> section to provide | |
398 | a default value: then if the environment lookup fails the default value | |
399 | will be used instead. For this to work properly the default value must | |
400 | be defined earlier in the configuration file than the expansion. See | |
401 | the B<EXAMPLES> section for an example of how to do this. | |
402 | ||
403 | If the same variable exists in the same section then all but the last | |
404 | value will be silently ignored. In certain circumstances such as with | |
405 | DNs the same field may occur multiple times. This is usually worked | |
406 | around by ignoring any characters before an initial B<.> e.g. | |
407 | ||
408 | 1.OU="My first OU" | |
409 | 2.OU="My Second OU" | |
410 | ||
411 | =head1 EXAMPLES | |
412 | ||
413 | Here is a sample configuration file using some of the features | |
414 | mentioned above. | |
415 | ||
416 | # This is the default section. | |
1bc74519 | 417 | |
aba3e65f | 418 | HOME=/temp |
aba3e65f DSH |
419 | configdir=$ENV::HOME/config |
420 | ||
421 | [ section_one ] | |
422 | ||
423 | # We are now in section one. | |
424 | ||
425 | # Quotes permit leading and trailing whitespace | |
426 | any = " any variable name " | |
427 | ||
428 | other = A string that can \ | |
429 | cover several lines \ | |
430 | by including \\ characters | |
431 | ||
432 | message = Hello World\n | |
433 | ||
434 | [ section_two ] | |
435 | ||
436 | greeting = $section_one::message | |
437 | ||
438 | This next example shows how to expand environment variables safely. | |
439 | ||
440 | Suppose you want a variable called B<tmpfile> to refer to a | |
441 | temporary filename. The directory it is placed in can determined by | |
35ed393e | 442 | the B<TEMP> or B<TMP> environment variables but they may not be |
aba3e65f DSH |
443 | set to any value at all. If you just include the environment variable |
444 | names and the variable doesn't exist then this will cause an error when | |
445 | an attempt is made to load the configuration file. By making use of the | |
1bc74519 | 446 | default section both values can be looked up with B<TEMP> taking |
aba3e65f DSH |
447 | priority and B</tmp> used if neither is defined: |
448 | ||
449 | TMP=/tmp | |
450 | # The above value is used if TMP isn't in the environment | |
451 | TEMP=$ENV::TMP | |
452 | # The above value is used if TEMP isn't in the environment | |
453 | tmpfile=${ENV::TEMP}/tmp.filename | |
454 | ||
7b68c30d DSH |
455 | Simple OpenSSL library configuration example to enter FIPS mode: |
456 | ||
457 | # Default appname: should match "appname" parameter (if any) | |
458 | # supplied to CONF_modules_load_file et al. | |
459 | openssl_conf = openssl_conf_section | |
460 | ||
461 | [openssl_conf_section] | |
462 | # Configuration module list | |
463 | alg_section = evp_sect | |
464 | ||
465 | [evp_sect] | |
466 | # Set to "yes" to enter FIPS mode if supported | |
467 | fips_mode = yes | |
468 | ||
469 | Note: in the above example you will get an error in non FIPS capable versions | |
470 | of OpenSSL. | |
471 | ||
472 | More complex OpenSSL library configuration. Add OID and don't enter FIPS mode: | |
473 | ||
474 | # Default appname: should match "appname" parameter (if any) | |
475 | # supplied to CONF_modules_load_file et al. | |
476 | openssl_conf = openssl_conf_section | |
477 | ||
478 | [openssl_conf_section] | |
479 | # Configuration module list | |
480 | alg_section = evp_sect | |
481 | oid_section = new_oids | |
482 | ||
483 | [evp_sect] | |
484 | # This will have no effect as FIPS mode is off by default. | |
485 | # Set to "yes" to enter FIPS mode, if supported | |
486 | fips_mode = no | |
487 | ||
488 | [new_oids] | |
489 | # New OID, just short name | |
490 | newoid1 = 1.2.3.4.1 | |
491 | # New OID shortname and long name | |
492 | newoid2 = New OID 2 long name, 1.2.3.4.2 | |
493 | ||
35ed393e | 494 | The above examples can be used with any application supporting library |
7b68c30d DSH |
495 | configuration if "openssl_conf" is modified to match the appropriate "appname". |
496 | ||
497 | For example if the second sample file above is saved to "example.cnf" then | |
498 | the command line: | |
499 | ||
500 | OPENSSL_CONF=example.cnf openssl asn1parse -genstr OID:1.2.3.4.1 | |
501 | ||
502 | will output: | |
503 | ||
504 | 0:d=0 hl=2 l= 4 prim: OBJECT :newoid1 | |
505 | ||
506 | showing that the OID "newoid1" has been added as "1.2.3.4.1". | |
507 | ||
284f4f6b BE |
508 | =head1 ENVIRONMENT |
509 | ||
510 | =over 4 | |
511 | ||
512 | =item B<OPENSSL_CONF> | |
513 | ||
514 | The path to the config file. | |
515 | Ignored in set-user-ID and set-group-ID programs. | |
516 | ||
517 | =item B<OPENSSL_ENGINES> | |
518 | ||
519 | The path to the engines directory. | |
520 | Ignored in set-user-ID and set-group-ID programs. | |
521 | ||
b6670f69 RL |
522 | =item B<OPENSSL_MODULES> |
523 | ||
524 | The path to the directory with OpenSSL modules, such as providers. | |
525 | Ignored in set-user-ID and set-group-ID programs. | |
526 | ||
7bb82f92 SL |
527 | =item B<OPENSSL_CONF_INCLUDE> |
528 | ||
529 | The optional path to prepend to all .include paths. | |
530 | ||
284f4f6b BE |
531 | =back |
532 | ||
aba3e65f DSH |
533 | =head1 BUGS |
534 | ||
535 | Currently there is no way to include characters using the octal B<\nnn> | |
536 | form. Strings are all null terminated so nulls cannot form part of | |
537 | the value. | |
538 | ||
539 | The escaping isn't quite right: if you want to use sequences like B<\n> | |
540 | you can't use any quote escaping on the same line. | |
541 | ||
542 | Files are loaded in a single pass. This means that an variable expansion | |
543 | will only work if the variables referenced are defined earlier in the | |
544 | file. | |
545 | ||
7cfc0a55 RS |
546 | =head1 HISTORY |
547 | ||
548 | An undocumented API, NCONF_WIN32(), used a slightly different set | |
549 | of parsing rules there were intended to be tailored to | |
550 | the Microsoft Windows platform. | |
551 | Specifically, the backslash character was not an escape character and | |
552 | could be used in pathnames, only the double-quote character was recognized, | |
553 | and comments began with a semi-colon. | |
554 | This function was deprecated in OpenSSL 3.0; applications with | |
555 | configuration files using that syntax will have to be modified. | |
556 | ||
aba3e65f DSH |
557 | =head1 SEE ALSO |
558 | ||
1903a9b7 | 559 | L<openssl-x509(1)>, L<openssl-req(1)>, L<openssl-ca(1)>, L<fips_config(5)> |
aba3e65f | 560 | |
e2f92610 RS |
561 | =head1 COPYRIGHT |
562 | ||
b0edda11 | 563 | Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. |
e2f92610 | 564 | |
b1e979ae | 565 | Licensed under the Apache License 2.0 (the "License"). You may not use |
e2f92610 RS |
566 | this file except in compliance with the License. You can obtain a copy |
567 | in the file LICENSE in the source distribution or at | |
568 | L<https://www.openssl.org/source/license.html>. | |
569 | ||
570 | =cut |