|PROXY_POLICY_NEW(3)||Library Functions Manual||PROXY_POLICY_NEW(3)|
X.509 proxy certificate extension
If a given non-CA certificate grants any privileges, using that certificate to issue a proxy certificate and handing that proxy certificate over to another person, organization, or service allows the bearer of the proxy certificate to exercise some or all of the privileges on behalf of the subject of the original certificate.
allocates and initializes an empty PROXY_POLICY
object, representing an ASN.1 ProxyPolicy structure
defined in RFC 3820 section 3.8. It defines which privileges are to be
allocates and initializes an empty
PROXY_CERT_INFO_EXTENSION object, representing an
ASN.1 ProxyCertInfo structure defined in RFC 3820
section 3.8. It can contain a PROXY_POLICY object, and
it can additionally restrict the maximum depth of the path of proxy
certificates that can be signed by this proxy certificate.
If a non-CA certificate contains a PROXY_CERT_INFO_EXTENSION, it is a proxy certificate; otherwise, it is an end entity certificate.
PROXY_CERT_INFO_EXTENSION_new() return the new
PROXY_CERT_INFO_EXTENSION object, respectively, or
NULL if an error occurs.
RFC 3820: Internet X.509 Public Key Infrastructure (PKI) Proxy Certificate Profile
These functions first appeared in OpenSSL 0.9.7g and have been available since OpenBSD 3.8.
|October 27, 2021||OpenBSD-current|