diff options
Diffstat (limited to 'doc/man3/OSSL_CMP_exec_certreq.pod')
| -rw-r--r-- | doc/man3/OSSL_CMP_exec_certreq.pod | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/doc/man3/OSSL_CMP_exec_certreq.pod b/doc/man3/OSSL_CMP_exec_certreq.pod index 71d21154fc..fbf118c2b1 100644 --- a/doc/man3/OSSL_CMP_exec_certreq.pod +++ b/doc/man3/OSSL_CMP_exec_certreq.pod @@ -139,6 +139,18 @@ CMP is defined in RFC 4210 (and CRMF in RFC 4211). The CMP client implementation is limited to one request per CMP message (and consequently to at most one response component per CMP message). +When a client obtains from a CMP server CA certificates that it is going to +trust, for instance via the caPubs field of a certificate response +or using functions like OSSL_CMP_get1_caCerts(), +authentication of the CMP server is particularly critical. +So special care must be taken setting up server authentication in I<ctx> +using functions such as +L<OSSL_CMP_CTX_set0_trusted(3)> (for certificate-based authentication) or +L<OSSL_CMP_CTX_set1_secretValue(3)> (for MAC-based protection). +If authentication is certificate-based, L<OSSL_CMP_CTX_get0_validatedSrvCert(3)> +should be used to obtain the server validated certificate +and perform an authorization check based on it. + =head1 RETURN VALUES OSSL_CMP_exec_certreq(), OSSL_CMP_exec_IR_ses(), OSSL_CMP_exec_CR_ses(), |