=head1 DESCRIPTION
This function checks if given certificate is CA certificate (can be used
-to sign other certificates).
+to sign other certificates). The certificate must be a complete certificate
+otherwise an error is returned.
=head1 RETURN VALUES
I<subject>, as far as present, with the respective B<subjectKeyIdentifier>,
serial number, and issuer fields of I<issuer>, as far as present. It also checks
if the B<keyUsage> field (if present) of I<issuer> allows certificate signing.
-It does not actually check the certificate signature.
+It does not actually check the certificate signature. An error is returned
+if the I<issuer> or the I<subject> are incomplete certificates.
=head1 RETURN VALUES
This function checks if certificate I<x> was created with the purpose
represented by I<id>. If I<ca> is nonzero, then certificate I<x> is
checked to determine if it's a possible CA with various levels of certainty
-possibly returned.
+possibly returned. The certificate I<x> must be a complete certificate
+otherwise the function returns an error.
Below are the potential ID's that can be checked:
I<pkey>. Only the signature is checked: no other checks (such as certificate
chain validity) are performed.
-X509_self_signed() checks whether a certificate is self-signed.
+X509_self_signed() checks whether certificate I<cert> is self-signed.
For success the issuer and subject names must match, the components of the
authority key identifier (if present) must match the subject key identifier etc.
The signature itself is actually verified only if B<verify_signature> is 1, as
X509_verify(),
X509_REQ_verify_ex(), X509_REQ_verify() and X509_CRL_verify()
return 1 if the signature is valid and 0 if the signature check fails.
-If the signature could not be checked at all because it was ill-formed
-or some other error occurred then -1 is returned.
+If the signature could not be checked at all because it was ill-formed,
+the certificate or the request was not complete or some other error occurred
+then -1 is returned.
X509_self_signed() returns the same values but also returns 1
if all respective fields match and B<verify_signature> is 0.