]>
Commit | Line | Data |
---|---|---|
6c17629f DSH |
1 | =pod |
2 | ||
3 | =head1 NAME | |
4 | ||
a47bc283 RS |
5 | X509_VERIFY_PARAM_set_flags, X509_VERIFY_PARAM_clear_flags, |
6 | X509_VERIFY_PARAM_get_flags, X509_VERIFY_PARAM_set_purpose, | |
7 | X509_VERIFY_PARAM_get_inh_flags, X509_VERIFY_PARAM_set_inh_flags, | |
8 | X509_VERIFY_PARAM_set_trust, X509_VERIFY_PARAM_set_depth, | |
9 | X509_VERIFY_PARAM_get_depth, X509_VERIFY_PARAM_set_auth_level, | |
10 | X509_VERIFY_PARAM_get_auth_level, X509_VERIFY_PARAM_set_time, | |
329f2f4a | 11 | X509_VERIFY_PARAM_get_time, |
a47bc283 RS |
12 | X509_VERIFY_PARAM_add0_policy, X509_VERIFY_PARAM_set1_policies, |
13 | X509_VERIFY_PARAM_set1_host, X509_VERIFY_PARAM_add1_host, | |
5b748dea MC |
14 | X509_VERIFY_PARAM_set_hostflags, |
15 | X509_VERIFY_PARAM_get_hostflags, | |
16 | X509_VERIFY_PARAM_get0_peername, | |
a47bc283 RS |
17 | X509_VERIFY_PARAM_set1_email, X509_VERIFY_PARAM_set1_ip, |
18 | X509_VERIFY_PARAM_set1_ip_asc | |
19 | - X509 verification parameters | |
6c17629f DSH |
20 | |
21 | =head1 SYNOPSIS | |
22 | ||
23 | #include <openssl/x509_vfy.h> | |
24 | ||
fbb82a60 | 25 | int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, |
a47bc283 | 26 | unsigned long flags); |
6c17629f | 27 | int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, |
a47bc283 | 28 | unsigned long flags); |
25d7cd1d | 29 | unsigned long X509_VERIFY_PARAM_get_flags(const X509_VERIFY_PARAM *param); |
6c17629f | 30 | |
a47bc283 RS |
31 | int X509_VERIFY_PARAM_set_inh_flags(X509_VERIFY_PARAM *param, |
32 | uint32_t flags); | |
33 | uint32_t X509_VERIFY_PARAM_get_inh_flags(const X509_VERIFY_PARAM *param); | |
34 | ||
6c17629f DSH |
35 | int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose); |
36 | int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust); | |
37 | ||
38 | void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t); | |
329f2f4a | 39 | time_t X509_VERIFY_PARAM_get_time(const X509_VERIFY_PARAM *param); |
6c17629f DSH |
40 | |
41 | int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, | |
e9b77246 | 42 | ASN1_OBJECT *policy); |
1bc74519 | 43 | int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, |
e9b77246 | 44 | STACK_OF(ASN1_OBJECT) *policies); |
6c17629f DSH |
45 | |
46 | void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth); | |
47 | int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param); | |
48 | ||
fbb82a60 | 49 | void X509_VERIFY_PARAM_set_auth_level(X509_VERIFY_PARAM *param, |
e9b77246 | 50 | int auth_level); |
fbb82a60 VD |
51 | int X509_VERIFY_PARAM_get_auth_level(const X509_VERIFY_PARAM *param); |
52 | ||
397a8e74 | 53 | int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, |
1bc74519 | 54 | const char *name, size_t namelen); |
8abffa4a | 55 | int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param, |
297c67fc | 56 | const char *name, size_t namelen); |
397a8e74 | 57 | void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param, |
1bc74519 | 58 | unsigned int flags); |
4db296d9 | 59 | unsigned int X509_VERIFY_PARAM_get_hostflags(const X509_VERIFY_PARAM *param); |
4588cb44 | 60 | char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param); |
397a8e74 | 61 | int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param, |
e9b77246 | 62 | const char *email, size_t emaillen); |
397a8e74 | 63 | int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param, |
1bc74519 | 64 | const unsigned char *ip, size_t iplen); |
297c67fc | 65 | int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc); |
397a8e74 | 66 | |
6c17629f DSH |
67 | =head1 DESCRIPTION |
68 | ||
69 | These functions manipulate the B<X509_VERIFY_PARAM> structure associated with | |
1bc74519 | 70 | a certificate verification operation. |
6c17629f DSH |
71 | |
72 | The X509_VERIFY_PARAM_set_flags() function sets the flags in B<param> by oring | |
73 | it with B<flags>. See the B<VERIFICATION FLAGS> section for a complete | |
74 | description of values the B<flags> parameter can take. | |
75 | ||
76 | X509_VERIFY_PARAM_get_flags() returns the flags in B<param>. | |
77 | ||
a47bc283 RS |
78 | X509_VERIFY_PARAM_get_inh_flags() returns the inheritance flags in B<param> |
79 | which specifies how verification flags are copied from one structure to | |
80 | another. X509_VERIFY_PARAM_set_inh_flags() sets the inheritance flags. | |
81 | See the B<INHERITANCE FLAGS> section for a description of these bits. | |
82 | ||
6c17629f DSH |
83 | X509_VERIFY_PARAM_clear_flags() clears the flags B<flags> in B<param>. |
84 | ||
85 | X509_VERIFY_PARAM_set_purpose() sets the verification purpose in B<param> | |
86 | to B<purpose>. This determines the acceptable purpose of the certificate | |
87 | chain, for example SSL client or SSL server. | |
88 | ||
1bc74519 | 89 | X509_VERIFY_PARAM_set_trust() sets the trust setting in B<param> to |
6c17629f DSH |
90 | B<trust>. |
91 | ||
92 | X509_VERIFY_PARAM_set_time() sets the verification time in B<param> to | |
93 | B<t>. Normally the current time is used. | |
94 | ||
95 | X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled | |
96 | by default) and adds B<policy> to the acceptable policy set. | |
97 | ||
98 | X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled | |
99 | by default) and sets the acceptable policy set to B<policies>. Any existing | |
100 | policy set is cleared. The B<policies> parameter can be B<NULL> to clear | |
101 | an existing policy set. | |
102 | ||
103 | X509_VERIFY_PARAM_set_depth() sets the maximum verification depth to B<depth>. | |
fbb82a60 | 104 | That is the maximum number of intermediate CA certificates that can appear in a |
6c17629f | 105 | chain. |
fbb82a60 | 106 | A maximal depth chain contains 2 more certificates than the limit, since |
0ad69cd6 | 107 | neither the end-entity certificate nor the trust-anchor count against this |
fbb82a60 VD |
108 | limit. |
109 | Thus a B<depth> limit of 0 only allows the end-entity certificate to be signed | |
110 | directly by the trust-anchor, while with a B<depth> limit of 1 there can be one | |
111 | intermediate CA certificate between the trust-anchor and the end-entity | |
112 | certificate. | |
113 | ||
114 | X509_VERIFY_PARAM_set_auth_level() sets the authentication security level to | |
115 | B<auth_level>. | |
116 | The authentication security level determines the acceptable signature and public | |
117 | key strength when verifying certificate chains. | |
118 | For a certificate chain to validate, the public keys of all the certificates | |
119 | must meet the specified security level. | |
120 | The signature algorithm security level is not enforced for the chain's I<trust | |
121 | anchor> certificate, which is either directly trusted or validated by means other | |
122 | than its signature. | |
123 | See L<SSL_CTX_set_security_level(3)> for the definitions of the available | |
124 | levels. | |
125 | The default security level is -1, or "not set". | |
126 | At security level 0 or lower all algorithms are acceptable. | |
127 | Security level 1 requires at least 80-bit-equivalent security and is broadly | |
128 | interoperable, though it will, for example, reject MD5 signatures or RSA keys | |
129 | shorter than 1024 bits. | |
6c17629f | 130 | |
8abffa4a | 131 | X509_VERIFY_PARAM_set1_host() sets the expected DNS hostname to |
9c0586d5 | 132 | B<name> clearing any previously specified hostname. If |
8abffa4a VD |
133 | B<name> is NULL, or empty the list of hostnames is cleared, and |
134 | name checks are not performed on the peer certificate. If B<name> | |
135 | is NUL-terminated, B<namelen> may be zero, otherwise B<namelen> | |
55a6250f VD |
136 | must be set to the length of B<name>. |
137 | ||
138 | When a hostname is specified, | |
8abffa4a VD |
139 | certificate verification automatically invokes L<X509_check_host(3)> |
140 | with flags equal to the B<flags> argument given to | |
35cb565a | 141 | X509_VERIFY_PARAM_set_hostflags() (default zero). Applications |
8abffa4a | 142 | are strongly advised to use this interface in preference to explicitly |
55a6250f | 143 | calling L<X509_check_host(3)>, hostname checks may be out of scope |
8abffa4a | 144 | with the DANE-EE(3) certificate usage, and the internal check will |
55a6250f VD |
145 | be suppressed as appropriate when DANE verification is enabled. |
146 | ||
147 | When the subject CommonName will not be ignored, whether as a result of the | |
148 | B<X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT> host flag, or because no DNS subject | |
149 | alternative names are present in the certificate, any DNS name constraints in | |
150 | issuer certificates apply to the subject CommonName as well as the subject | |
151 | alternative name extension. | |
152 | ||
153 | When the subject CommonName will be ignored, whether as a result of the | |
154 | B<X509_CHECK_FLAG_NEVER_CHECK_SUBJECT> host flag, or because some DNS subject | |
155 | alternative names are present in the certificate, DNS name constraints in | |
156 | issuer certificates will not be applied to the subject DN. | |
157 | As described in X509_check_host(3) the B<X509_CHECK_FLAG_NEVER_CHECK_SUBJECT> | |
6e501c47 | 158 | flag takes precedence over the B<X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT> flag. |
8abffa4a | 159 | |
5b748dea MC |
160 | X509_VERIFY_PARAM_get_hostflags() returns any host flags previously set via a |
161 | call to X509_VERIFY_PARAM_set_hostflags(). | |
162 | ||
8abffa4a | 163 | X509_VERIFY_PARAM_add1_host() adds B<name> as an additional reference |
186bb907 | 164 | identifier that can match the peer's certificate. Any previous names |
8abffa4a VD |
165 | set via X509_VERIFY_PARAM_set1_host() or X509_VERIFY_PARAM_add1_host() |
166 | are retained, no change is made if B<name> is NULL or empty. When | |
167 | multiple names are configured, the peer is considered verified when | |
168 | any name matches. | |
397a8e74 | 169 | |
6e661d45 VD |
170 | X509_VERIFY_PARAM_get0_peername() returns the DNS hostname or subject |
171 | CommonName from the peer certificate that matched one of the reference | |
172 | identifiers. When wildcard matching is not disabled, or when a | |
173 | reference identifier specifies a parent domain (starts with ".") | |
174 | rather than a hostname, the peer name may be a wildcard name or a | |
175 | sub-domain of the reference identifier respectively. The return | |
176 | string is allocated by the library and is no longer valid once the | |
177 | associated B<param> argument is freed. Applications must not free | |
178 | the return value. | |
179 | ||
397a8e74 | 180 | X509_VERIFY_PARAM_set1_email() sets the expected RFC822 email address to |
df24f29a | 181 | B<email>. If B<email> is NUL-terminated, B<emaillen> may be zero, otherwise |
397a8e74 VD |
182 | B<emaillen> must be set to the length of B<email>. When an email address |
183 | is specified, certificate verification automatically invokes | |
184 | L<X509_check_email(3)>. | |
185 | ||
186 | X509_VERIFY_PARAM_set1_ip() sets the expected IP address to B<ip>. | |
187 | The B<ip> argument is in binary format, in network byte-order and | |
188 | B<iplen> must be set to 4 for IPv4 and 16 for IPv6. When an IP | |
189 | address is specified, certificate verification automatically invokes | |
190 | L<X509_check_ip(3)>. | |
191 | ||
192 | X509_VERIFY_PARAM_set1_ip_asc() sets the expected IP address to | |
193 | B<ipasc>. The B<ipasc> argument is a NUL-terminal ASCII string: | |
194 | dotted decimal quad for IPv4 and colon-separated hexadecimal for | |
195 | IPv6. The condensed "::" notation is supported for IPv6 addresses. | |
196 | ||
6c17629f DSH |
197 | =head1 RETURN VALUES |
198 | ||
397a8e74 | 199 | X509_VERIFY_PARAM_set_flags(), X509_VERIFY_PARAM_clear_flags(), |
a47bc283 | 200 | X509_VERIFY_PARAM_set_inh_flags(), |
6c17629f | 201 | X509_VERIFY_PARAM_set_purpose(), X509_VERIFY_PARAM_set_trust(), |
397a8e74 | 202 | X509_VERIFY_PARAM_add0_policy() X509_VERIFY_PARAM_set1_policies(), |
919ba009 | 203 | X509_VERIFY_PARAM_set1_host(), X509_VERIFY_PARAM_add1_host(), |
397a8e74 VD |
204 | X509_VERIFY_PARAM_set1_email(), X509_VERIFY_PARAM_set1_ip() and |
205 | X509_VERIFY_PARAM_set1_ip_asc() return 1 for success and 0 for | |
206 | failure. | |
6c17629f DSH |
207 | |
208 | X509_VERIFY_PARAM_get_flags() returns the current verification flags. | |
209 | ||
5b748dea MC |
210 | X509_VERIFY_PARAM_get_hostflags() returns any current host flags. |
211 | ||
a47bc283 RS |
212 | X509_VERIFY_PARAM_get_inh_flags() returns the current inheritance flags. |
213 | ||
6c17629f DSH |
214 | X509_VERIFY_PARAM_set_time() and X509_VERIFY_PARAM_set_depth() do not return |
215 | values. | |
216 | ||
217 | X509_VERIFY_PARAM_get_depth() returns the current verification depth. | |
218 | ||
fbb82a60 VD |
219 | X509_VERIFY_PARAM_get_auth_level() returns the current authentication security |
220 | level. | |
221 | ||
6c17629f DSH |
222 | =head1 VERIFICATION FLAGS |
223 | ||
224 | The verification flags consists of zero or more of the following flags | |
225 | ored together. | |
226 | ||
227 | B<X509_V_FLAG_CRL_CHECK> enables CRL checking for the certificate chain leaf | |
1bc74519 | 228 | certificate. An error occurs if a suitable CRL cannot be found. |
6c17629f DSH |
229 | |
230 | B<X509_V_FLAG_CRL_CHECK_ALL> enables CRL checking for the entire certificate | |
231 | chain. | |
232 | ||
233 | B<X509_V_FLAG_IGNORE_CRITICAL> disabled critical extension checking. By default | |
234 | any unhandled critical extensions in certificates or (if checked) CRLs results | |
235 | in a fatal error. If this flag is set unhandled critical extensions are | |
236 | ignored. B<WARNING> setting this option for anything other than debugging | |
237 | purposes can be a security risk. Finer control over which extensions are | |
238 | supported can be performed in the verification callback. | |
239 | ||
186bb907 | 240 | The B<X509_V_FLAG_X509_STRICT> flag disables workarounds for some broken |
6c17629f DSH |
241 | certificates and makes the verification strictly apply B<X509> rules. |
242 | ||
243 | B<X509_V_FLAG_ALLOW_PROXY_CERTS> enables proxy certificate verification. | |
244 | ||
245 | B<X509_V_FLAG_POLICY_CHECK> enables certificate policy checking, by default | |
186bb907 | 246 | no policy checking is performed. Additional information is sent to the |
6c17629f DSH |
247 | verification callback relating to policy checking. |
248 | ||
249 | B<X509_V_FLAG_EXPLICIT_POLICY>, B<X509_V_FLAG_INHIBIT_ANY> and | |
250 | B<X509_V_FLAG_INHIBIT_MAP> set the B<require explicit policy>, B<inhibit any | |
251 | policy> and B<inhibit policy mapping> flags respectively as defined in | |
252 | B<RFC3280>. Policy checking is automatically enabled if any of these flags | |
253 | are set. | |
254 | ||
255 | If B<X509_V_FLAG_NOTIFY_POLICY> is set and the policy checking is successful | |
256 | a special status code is set to the verification callback. This permits it | |
257 | to examine the valid policy tree and perform additional checks or simply | |
258 | log it for debugging purposes. | |
259 | ||
2b4ffc65 | 260 | By default some additional features such as indirect CRLs and CRLs signed by |
6c17629f DSH |
261 | different keys are disabled. If B<X509_V_FLAG_EXTENDED_CRL_SUPPORT> is set |
262 | they are enabled. | |
263 | ||
186bb907 | 264 | If B<X509_V_FLAG_USE_DELTAS> is set delta CRLs (if present) are used to |
6c17629f DSH |
265 | determine certificate status. If not set deltas are ignored. |
266 | ||
267 | B<X509_V_FLAG_CHECK_SS_SIGNATURE> enables checking of the root CA self signed | |
186bb907 | 268 | certificate signature. By default this check is disabled because it doesn't |
6c17629f DSH |
269 | add any additional security but in some cases applications might want to |
270 | check the signature anyway. A side effect of not checking the root CA | |
271 | signature is that disabled or unsupported message digests on the root CA | |
272 | are not treated as fatal errors. | |
273 | ||
f517911d VD |
274 | When B<X509_V_FLAG_TRUSTED_FIRST> is set, construction of the certificate chain |
275 | in L<X509_verify_cert(3)> will search the trust store for issuer certificates | |
276 | before searching the provided untrusted certificates. | |
277 | Local issuer certificates are often more likely to satisfy local security | |
278 | requirements and lead to a locally trusted root. | |
279 | This is especially important when some certificates in the trust store have | |
1903a9b7 | 280 | explicit trust settings (see "TRUST SETTINGS" in L<openssl-x509(1)>). |
f517911d | 281 | As of OpenSSL 1.1.0 this option is on by default. |
0daccd4d | 282 | |
fa7b0111 | 283 | The B<X509_V_FLAG_NO_ALT_CHAINS> flag suppresses checking for alternative |
0daccd4d VD |
284 | chains. |
285 | By default, unless B<X509_V_FLAG_TRUSTED_FIRST> is set, when building a | |
286 | certificate chain, if the first certificate chain found is not trusted, then | |
287 | OpenSSL will attempt to replace untrusted certificates supplied by the peer | |
288 | with certificates from the trust store to see if an alternative chain can be | |
289 | found that is trusted. | |
290 | As of OpenSSL 1.1.0, with B<X509_V_FLAG_TRUSTED_FIRST> always set, this option | |
291 | has no effect. | |
fa7b0111 | 292 | |
f517911d VD |
293 | The B<X509_V_FLAG_PARTIAL_CHAIN> flag causes intermediate certificates in the |
294 | trust store to be treated as trust-anchors, in the same way as the self-signed | |
295 | root CA certificates. | |
296 | This makes it possible to trust certificates issued by an intermediate CA | |
297 | without having to trust its ancestor root CA. | |
298 | With OpenSSL 1.1.0 and later and <X509_V_FLAG_PARTIAL_CHAIN> set, chain | |
299 | construction stops as soon as the first certificate from the trust store is | |
300 | added to the chain, whether that certificate is a self-signed "root" | |
301 | certificate or a not self-signed intermediate certificate. | |
302 | Thus, when an intermediate certificate is found in the trust store, the | |
303 | verified chain passed to callbacks may be shorter than it otherwise would | |
304 | be without the B<X509_V_FLAG_PARTIAL_CHAIN> flag. | |
305 | ||
d35ff2c0 DW |
306 | The B<X509_V_FLAG_NO_CHECK_TIME> flag suppresses checking the validity period |
307 | of certificates and CRLs against the current time. If X509_VERIFY_PARAM_set_time() | |
308 | is used to specify a verification time, the check is not suppressed. | |
309 | ||
a47bc283 RS |
310 | =head1 INHERITANCE FLAGS |
311 | ||
69687aa8 | 312 | These flags specify how parameters are "inherited" from one structure to |
a47bc283 RS |
313 | another. |
314 | ||
315 | If B<X509_VP_FLAG_ONCE> is set then the current setting is zeroed | |
316 | after the next call. | |
317 | ||
318 | If B<X509_VP_FLAG_LOCKED> is set then no values are copied. This overrides | |
319 | all of the following flags. | |
320 | ||
321 | If B<X509_VP_FLAG_DEFAULT> is set then anything set in the source is copied | |
322 | to the destination. Effectively the values in "to" become default values | |
323 | which will be used only if nothing new is set in "from". This is the | |
324 | default. | |
325 | ||
326 | If B<X509_VP_FLAG_OVERWRITE> is set then all value are copied across whether | |
327 | they are set or not. Flags is still Ored though. | |
328 | ||
329 | If B<X509_VP_FLAG_RESET_FLAGS> is set then the flags value is copied instead | |
330 | of ORed. | |
331 | ||
6c17629f DSH |
332 | =head1 NOTES |
333 | ||
334 | The above functions should be used to manipulate verification parameters | |
a95d7574 RS |
335 | instead of functions which work in specific structures such as |
336 | X509_STORE_CTX_set_flags() which are likely to be deprecated in a future | |
337 | release. | |
6c17629f DSH |
338 | |
339 | =head1 BUGS | |
340 | ||
341 | Delta CRL checking is currently primitive. Only a single delta can be used and | |
1bc74519 | 342 | (partly due to limitations of B<X509_STORE>) constructed CRLs are not |
6c17629f DSH |
343 | maintained. |
344 | ||
345 | If CRLs checking is enable CRLs are expected to be available in the | |
346 | corresponding B<X509_STORE> structure. No attempt is made to download | |
347 | CRLs from the CRL distribution points extension. | |
348 | ||
cda77422 | 349 | =head1 EXAMPLES |
6c17629f | 350 | |
1bc74519 | 351 | Enable CRL checking when performing certificate verification during SSL |
9074df86 | 352 | connections associated with an B<SSL_CTX> structure B<ctx>: |
6c17629f | 353 | |
2947af32 | 354 | X509_VERIFY_PARAM *param; |
e9b77246 | 355 | |
2947af32 BB |
356 | param = X509_VERIFY_PARAM_new(); |
357 | X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK); | |
358 | SSL_CTX_set1_param(ctx, param); | |
359 | X509_VERIFY_PARAM_free(param); | |
6c17629f DSH |
360 | |
361 | =head1 SEE ALSO | |
362 | ||
9b86974e RS |
363 | L<X509_verify_cert(3)>, |
364 | L<X509_check_host(3)>, | |
365 | L<X509_check_email(3)>, | |
cc94da4e | 366 | L<X509_check_ip(3)>, |
1903a9b7 | 367 | L<openssl-x509(1)> |
6c17629f DSH |
368 | |
369 | =head1 HISTORY | |
370 | ||
fc5ecadd DMSP |
371 | The B<X509_V_FLAG_NO_ALT_CHAINS> flag was added in OpenSSL 1.1.0. |
372 | The flag B<X509_V_FLAG_CB_ISSUER_CHECK> was deprecated in OpenSSL 1.1.0 | |
373 | and has no effect. | |
6c17629f | 374 | |
fc5ecadd | 375 | The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. |
5b748dea | 376 | |
e2f92610 RS |
377 | =head1 COPYRIGHT |
378 | ||
48e5119a | 379 | Copyright 2009-2018 The OpenSSL Project Authors. All Rights Reserved. |
e2f92610 | 380 | |
4746f25a | 381 | Licensed under the Apache License 2.0 (the "License"). You may not use |
e2f92610 RS |
382 | this file except in compliance with the License. You can obtain a copy |
383 | in the file LICENSE in the source distribution or at | |
384 | L<https://www.openssl.org/source/license.html>. | |
385 | ||
386 | =cut |