openssl/doc/man5, branch dependabot/github_actions/actions/setup-python-7

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes

Polish AKID/SKID handling and related docs

2026-03-02T17:04:10Z

- Drop empty requestExtensions CSR attributes While `attributes` is a required CSR field, its `requestExtensions` attribute is optional, and should be avoided if empty. - Detail documentation of req extension section selection - Fixed req CI test case naming nits - Refer to config(5) for meaning of "variable" - In code comments, note possibility of fewer extensions after adding an ignored empty extension while deleting a previous value. - Mention new "nonss" AKID qualifier in CHANGES - I x509_config(5) Clarify AKID issuer as fallback (unless ":always") - In stock config file, comment proxy cert issuer SKID expectation. - Clarify comment on empty SKID/AKID vs. prior value - Use B not C for unnamed section - Polish (mostly CSR) extension handling * In update_req_extensions() drop extraneous duplicate X509at_delete_attr() call. * Consolidate empty SKID/AKID detection in new ossl_ignored_x509_extension(). * Handle empty SKID/AKID also in X509V3_add1_i2d(). * In test_drop_empty_csr_keyids() exercise the full NCONF extension management stack, using X509_REQ_get_attr_count() to check that after "subjectKeyIdentifier = none" not an even an empty extension set remains as a CSR attribute (X509_REQ_get_extensions() always returns at least an empty stack because NULL signals an error). Reviewed-by: David von Oheimb Reviewed-by: Tim Hudson Reviewed-by: Neil Horman MergeDate: Mon Mar 2 17:04:22 2026 (Merged from https://github.com/openssl/openssl/pull/30217)

Replace built-in AKID/SKID with configs

2026-02-28T15:22:41Z

Add tests for suppression of skid/akid via explicit "none" values and per-keyword "nonss" qualifiers and update docs. Signing of X509 certs and X509_REQ CSRs rejects empty AKID/SKID extensions, document and test this behaviour. Reviewed-by: Matt Caswell Reviewed-by: Neil Horman MergeDate: Sat Feb 28 15:22:53 2026 (Merged from https://github.com/openssl/openssl/pull/29057)

Add support for deferred FIPS self-tests

2026-02-13T09:53:50Z

Add a new -defer_tests option to openssl fipsinstall and a corresponding defer-tests configuration parameter for the FIPS provider. This allows the execution of self-tests to be postponed until the first time an algorithm is used, instead of running all tests during module initialization. This reduces startup time. Update the self-test framework to handle the new SELF_TEST_STATE_DEFER state, ensuring deferred tests are skipped at load and run on demand. Signed-off-by: Simo Sorce Reviewed-by: Shane Lontis Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/29222)

Docs: Clean up ENGINE mentions

2025-12-04T12:32:18Z

Engines are removed and the documentation should reflect that, even with deprecated and legacy API. Resolves: https://github.com/openssl/project/issues/1366 Signed-off-by: Norbert Pocs Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Saša Nedvědický Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/29305)

Expand and clarify SSL_CTX_config(3) docs.

2025-11-21T14:13:09Z

- Document significant limitations in CONF_module_load_file() in OpenSSL 3.x - Given the limitations, deëmphasise the use of CONF_module_load_file() in SSL_CTX_config(3) documentation, showing an example with the default config file instead. Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28650)

Copyright year updates

2025-09-02T13:05:45Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Release: yes

x509: Accept 'contentCommitment' as alias

2025-08-11T10:00:38Z

ITU-T X.509 (10/2019) section 9.2.2.3 [1] defines 'contentCommitment' as the current name for what had previously been called 'nonRepudiation', and deprecates the old name: > It is not incorrect to refer to this keyUsage bit using the identifier > nonRepudiation. However, the use of this identifier has been > deprecated. Allow 'contentCommitment' as an alias wherever 'nonRepudiation' has been accepted before, so that passing -addext keyUsage=critical,contentCommitment works as expected. Add a test that checks that contentCommitment sets the same keyUsage bit as nonRepudiation. Adjust the docs to mention the available alias name. [1]: https://www.itu.int/rec/T-REC-X.509-201910-I/en Signed-off-by: Clemens Lang Reviewed-by: David von Oheimb Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/28161)

Update FIPS provider doc to match the current code.

2025-07-01T18:47:08Z

Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27902)

Copyright year updates

2025-03-12T13:35:59Z

Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Release: yes