openssl/doc, branch OpenSSL_1_1_0f

Document that PKCS#12 functions assume UTF-8 for passwords

2017-05-24T20:17:27Z

Part of issue #3531 Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/3535) (cherry picked from commit cff85f39e438830cb5bc8bf7cb2ed6458670c5be)

Clarify what character encoding is used in the returned UI strings

2017-05-24T20:14:55Z

Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3532) (cherry picked from commit 789d6dddecbc231f5c858d203aab318cf81676fd)

Fix typo in doc/man3/EVP_EncrypInit.pod

2017-05-23T08:31:59Z

In the example section. CLA: trivial Signed-off-by: Paul Yang Reviewed-by: Rich Salz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/3520) (cherry picked from commit 719b289d62d32fe45226e8bc5b4fb0d76f6a1b5d)

-inkey can be an identifier, not just a file

2017-05-21T22:24:49Z

update pkcs12, smime, ts apps. Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/3507) (cherry picked from commit 48b5352212d8c68f7fd071ca9f38822b7e954c5a)

Fix regression in openssl req -x509 behaviour.

2017-05-11T15:22:38Z

Allow conversion of existing requests to certificates again. Fixes the issue #3396 Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/3437) (cherry picked from commit 888adbe064556ff5ab2f1d16a223b0548696614c)

Fixed typo in X509_STORE_CTX_new description

2017-04-22T22:27:23Z

'X509_XTORE_CTX_cleanup' -> 'X509_STORE_CTX_cleanup' Reviewed-by: Kurt Roeckx Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3271) (cherry picked from commit 7643a1723ef8eb4e542e57dfadeeb8eff788ec05)

Document Next Protocol Negotiation APIs

2017-04-19T16:48:38Z

Add callback function prototypes, fix description Reviewed-by: Kurt Roeckx Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3084) (cherry picked from commit 87b81496fec2f969371b3167dea3b6aaed9f9f9d)

update docs because depth refers only to intermediate certs

2017-04-18T15:08:40Z

Reviewed-by: Viktor Dukhovni Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3132) (cherry picked from commit 800b5dac006344896a3aa947ab13cd9f63e3fc4c)

Allow an ALPN callback to pretend to not exist

2017-04-11T12:46:13Z

RFC 7301 mandates that the server SHALL respond with a fatal "no_application_protocol" alert when there is no overlap between the client's supplied list and the server's list of supported protocols. In commit 062178678f5374b09f00d70796f6e692e8775aca we changed from ignoring non-success returns from the supplied alpn_select_cb() to treating such non-success returns as indicative of non-overlap and sending the fatal alert. In effect, this is using the presence of an alpn_select_cb() as a proxy to attempt to determine whether the application has configured a list of supported protocols. However, there may be cases in which an application's architecture leads it to supply an alpn_select_cb() but have that callback be configured to take no action on connections that do not have ALPN configured; returning SSL_TLSEXT_ERR_NOACK from the callback would be the natural way to do so. Unfortunately, the aforementioned behavior change also treated SSL_TLSEXT_ERR_NOACK as indicative of no overlap and terminated the connection; this change supplies special handling for SSL_TLSEXT_ERR_NOACK returns from the callback. In effect, it provides a way for a callback to obtain the behavior that would have occurred if no callback was registered at all, which was not possible prior to this change. Reviewed-by: Matt Caswell Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3158) (cherry picked from commit 8313a787d770ac1d7ddafcbc41b13e7fb5841eae)

Standardize on =over 4 and check for it.

2017-04-07T18:51:18Z

(cherry picked from commit dfc63ccebd8262648640fc6e35fffa132102b967) Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/3117)