Add CRL extraction logic

manpages/wolfssl-verify.1

@@ -4,19 +4,17 @@
 .SH NAME
 wolfssl-verify, verify \- verify an X.509 certificate chain
 .SH SYNOPSIS
-wolfssl verify -CAfile <ca file> [-untrusted <intermediate file>] [-crl_check] [-partial_chain] <cert to verify>
+wolfssl verify -CAfile <ca file> [-untrusted <intermediate file>] [-crl_check] [-partial_chain] [-legacy_ca] [-inform pem|der] <cert to verify>
 .SH DESCRIPTION
 Verifies an X.509 certificate against a trusted CA certificate, optionally
 building the chain with an intermediate certificate and checking
 revocation.
 .SH OPTIONS
 -CAfile file          trusted CA certificate to verify against (PEM only).
 .br
-                      Must be a self-signed root CA unless \-partial_chain
+                      May be a bundle; must contain a self-signed root CA
 .br
-                      is given; an intermediate CA causes "CA file is not
-.br
-                      root CA".
+                      unless \-partial_chain is given. See NOTES.
 .br
 .LP
 -untrusted file       intermediate certificate file. Only one intermediate
@@ -31,7 +29,19 @@ revocation.
 .LP
 -partial_chain        allow verification to succeed with a partial chain.
 .br
-                      Also permits using a non-root CA in -CAfile.
+                      Also permits using a non-root CA in -CAfile, and
+.br
+                      implies \-legacy_ca.
+.LP
+-legacy_ca            trust a self-signed CA bundle cert with no
+.br
+                      basicConstraints extension as a root (pre-RFC 5280
+.br
+                      certs). Without this, such certs are skipped.
+.LP
+-inform pem|der       accepted for compatibility and ignored; input format
+.br
+                      is always auto-detected (PEM, falling back to DER).
 .SH EXAMPLES
 Verify a certificate against a trusted root CA:
 .RS
@@ -52,11 +62,18 @@ wolfssl verify -CAfile ca-and-crl.pem -crl_check server-cert.pem
 .BR wolfssl-x509(1) ", " wolfssl-crl(1)
 .SH NOTES
 The certificate to verify is given as the final argument. -CAfile must be
-a PEM file. Unless -partial_chain is given, -CAfile must be a self-signed
-root CA; supplying an intermediate CA without -partial_chain fails with
-"CA file is not root CA". With -crl_check, revocation data must already be
-present in -CAfile (for example by concatenating the CRL PEM after the CA
-certificate). Available only when wolfSSL is built with filesystem support.
+a PEM file, and may contain a bundle of multiple certificates and/or CRLs;
+the bundle is scanned in any order for a self-signed root CA. Every
+candidate CA certificate, including the self-signed root, must assert
+basicConstraints CA:TRUE; certificates without it (including legacy,
+pre-RFC 5280 CA certs) are skipped when searching for a root unless
+-legacy_ca or -partial_chain is given. Unless -partial_chain is given, the bundle
+must contain a self-signed root CA; if none is found, verification fails
+with "CA file does not contain a self-signed root CA (use -partial_chain
+to trust an intermediate)". With -crl_check, revocation data must already
+be present in -CAfile (for example by concatenating the CRL PEM after the
+CA certificate). Available only when wolfSSL is built with filesystem
+support.
 .SH BUGS
 No known bugs at this time.
 .SH AUTHOR