Rearrange and test authz extension.

RFC 5878 support.

Support for fixed DH ciphersuites.

The cipher definitions of these ciphersuites have been around since SSLeay
but were always disabled. Now OpenSSL supports DH certificates they can be

Support for fixed DH ciphersuites.

The cipher definitions of these ciphersuites have been around since SSLeay
but were always disabled. Now OpenSSL supports DH certificates they can be
finally enabled.

Various additional changes were needed to make them work properly: many
unused fixed DH sections of code were untested.

show more ...

PR: 1411
Submitted by: steve@openssl.org

Allow use of trusted certificates in SSL_CTX_use_chain_file()

Reword comment to be much shorter to stop other people from complaining
about "overcommenting".

Clear error queue when starting SSL_CTX_use_certificate_chain_file
PR: 1417, 1513
Submitted by: Erik de Castro Lopo <mle+openssl@mega-nerd.com>

add support for DER encoded private keys to SSL_CTX_use_PrivateKey_file()
and SSL_use_PrivateKey_file()

PR: 1035
Submitted by: Walter Goulet
Reviewed by: Nils Larsch

get rid of very buggy and very imcomplete DH cert support

Reviewed by: Bodo Moeller

really clear the error queue here

PR: 860

Constify d2i, s2i, c2i and r2i functions and other associated
functions and macros.

This change has associated tags: LEVITTE_before_const and
LEVITTE_after_const. Those will be remo

Constify d2i, s2i, c2i and r2i functions and other associated
functions and macros.

This change has associated tags: LEVITTE_before_const and
LEVITTE_after_const. Those will be removed when this change has been
properly reviewed.

show more ...

make sure no error is left in the queue that is intentionally ignored

Reorder inclusion of header files:

des_old.h redefines crypt:
#define crypt(b,s)\
DES_crypt((b),(s))

This scheme leads to failure, if header files with the OS's true

Reorder inclusion of header files:

des_old.h redefines crypt:
#define crypt(b,s)\
DES_crypt((b),(s))

This scheme leads to failure, if header files with the OS's true definition
of crypt() are processed _after_ des_old.h was processed. This is e.g. the
case on HP-UX with unistd.h.
As evp.h now again includes des.h (which includes des_old.h), this problem
only came up after this modification.
Solution: move header files (indirectly) including e_os.h before the header
files (indirectly) including evp.h.
Submitted by:
Reviewed by:
PR:

show more ...

use ERR_peek_last_error() instead of ERR_peek_error()

Rename recently introduced functions for improved code clarity:
[DR]SA_up => [DR]SA_up_ref

Changes crypto/evp/ and ssl/ code from directly incrementing reference
counts in DH, DSA, and RSA structures. Instead they use the new "***_up()"
functions that handle this.

Use new-style system-id macros everywhere possible. I hope I haven't
missed any.

This compiles and runs on Linux, and external applications have no
problems with it. The definite t

Use new-style system-id macros everywhere possible. I hope I haven't
missed any.

This compiles and runs on Linux, and external applications have no
problems with it. The definite test will be to build this on VMS.

show more ...

The consequence of constification is that to pass the address to a
pointer to a const double pointe parameter, the pointer must point to
const data as well.

typo while I poke around...

Additional user data argument to pem_password_cb function type
and to lots of PEM_... functions.
Submitted by: Damien Miller <dmiller@ilogic.com.au>

Create a duplicate of the SSL_CTX's CERT in SSL_new instead of copying
pointers. The cert_st handling is changed by this in various ways.
Submitted by:
Reviewed by:
PR:

Use "const char *" instead of "char *" for filenames passed to functions.

Submitted by:
Reviewed by:
PR:

New function SSL_CTX_use_certificate_chain_file.

Submitted by:
Reviewed by:
PR:

Remove NOPROTO definitions and error code comments.

Change #include filenames from <foo.h> to <openssl.h>.

Submitted by:
Reviewed by:
PR:

Change functions to ANSI C.