• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• DIAGNOSTICS
• BUGS
• SEE ALSO
• HISTORY
• COPYRIGHT

NAME

openssl-verify - certificate verification command

SYNOPSIS

openssl verify [-help] [-CRLfile file] [-crl_download] [-show_chain] [-verbose] [-trusted file] [-untrusted file] [-vfyopt nm:v] [-nameopt option] [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath] [-CAstore uri] [-no-CAstore] [-engine id] [-allow_proxy_certs] [-attime timestamp] [-no_check_time] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-issuer_checks]

[-provider name] [-provider_path path] [--] [certificate ...]

DESCRIPTION

This command verifies certificate chains.

OPTIONS

-help

Print out a usage message.

-CRLfile file

The file should contain one or more CRLs in PEM format. This option can be specified more than once to include CRLs from multiple files.

-crl_download

Attempt to download CRL information for certificates via their CDP entries.

-show_chain

Display information about the certificate chain that has been built (if successful). Certificates in the chain that came from the untrusted list will be flagged as "untrusted".

-verbose

Print extra information about the operations being performed.

-trusted file

A file of trusted certificates in PEM format. This option can be specified more than once to load certificates from multiple files.

-untrusted file

A file of untrusted certificates in PEM format to use for chain building. This option can be specified more than once to load certificates from multiple files.

-vfyopt nm:v

Pass options to the signature algorithm during verify operations. Names and values of these options are algorithm-specific.

-nameopt option

This specifies how the subject or issuer names are displayed. See -engine id

See -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore

See -allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict -issuer_checks

Set various options of certificate chain verification. See -provider name

-provider_path path

See --

Indicates the last option. All arguments following this are assumed to be certificate files. This is useful if the first certificate filename begins with a -.

certificate ...

One or more certificates to verify. If no certificates are given, this command will attempt to read a certificate from standard input. Certificates must be in PEM format. If a certificate chain has multiple problems, this program tries to display all of them.

 server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
 error 24 at 1 depth lookup:invalid CA certificate

A list of the error codes and messages can be found in BUGS

Although the issuer checks are a considerable improvement over the old technique they still suffer from limitations in the underlying X509_LOOKUP API. One consequence of this is that trusted certificates with matching subject name must either appear in a file (as specified by the -CAfile option), a directory (as specified by -CApath), or a store (as specified by -CAstore). If they occur in more than one location then only the certificates in the file will be recognised.

openssl-x509(1), HISTORY

The -show_chain option was added in OpenSSL 1.1.0.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.