diff options
| author | Benjamin Kaduk <bkaduk@akamai.com> | 2018-10-04 20:49:21 +0200 |
|---|---|---|
| committer | Ben Kaduk <kaduk@mit.edu> | 2018-10-08 23:32:47 +0200 |
| commit | 3d362f190306b62a17aa2fd475b2bc8b3faa8142 (patch) | |
| tree | 6017fdeece75ffebed1fa1de05193dc21ceb7814 /doc/man1/storeutl.pod | |
| parent | Cleanup typos and grammar in DES_random_key.pod (diff) | |
| download | openssl-3d362f190306b62a17aa2fd475b2bc8b3faa8142.tar.xz openssl-3d362f190306b62a17aa2fd475b2bc8b3faa8142.zip | |
apps: allow empty attribute values with -subj
Historically (i.e., OpenSSL 1.0.x), the openssl applications would
allow for empty subject attributes to be passed via the -subj argument,
e.g., `opensl req -subj '/CN=joe/O=/OU=local' ...`. Commit
db4c08f0194d58c6192f0d8311bf3f20e251cf4f applied a badly needed rewrite
to the parse_name() helper function that parses these strings, but
in the process dropped a check that would skip attributes with no
associated value. As a result, such strings are now treated as
hard errors and the operation fails.
Restore the check to skip empty attribute values and restore
the historical behavior.
Document the behavior for empty subject attribute values in the
corresponding applications' manual pages.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7349)
Diffstat (limited to '')
| -rw-r--r-- | doc/man1/storeutl.pod | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/doc/man1/storeutl.pod b/doc/man1/storeutl.pod index 3f26ab500b..083f028246 100644 --- a/doc/man1/storeutl.pod +++ b/doc/man1/storeutl.pod @@ -82,8 +82,11 @@ returned. =item B<-subject arg> Search for an object having the subject name B<arg>. -The arg must be formatted as I</type0=value0/type1=value1/type2=...>, -characters may be escaped by \ (backslash), no spaces are skipped. +The arg must be formatted as I</type0=value0/type1=value1/type2=...>. +Keyword characters may be escaped by \ (backslash), and whitespace is retained. +Empty values are permitted but are ignored for the search. That is, +a search with an empty value will have the same effect as not specifying +the type at all. =item B<-issuer arg> |