From 6b4fac968d93516ad0c7b78d1beae41f3452cfe2 Mon Sep 17 00:00:00 2001 From: Jon Shallow Date: Mon, 20 Nov 2023 11:07:55 +0000 Subject: [PATCH] PKI: Document intermediate CAs Correct some typos --- examples/coap-server.c | 6 +++--- include/coap3/coap_dtls.h | 3 ++- man/coap-server.txt.in | 6 +++--- man/coap_encryption.txt.in | 3 ++- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/examples/coap-server.c b/examples/coap-server.c index de50ab4f..b1c07be0 100644 --- a/examples/coap-server.c +++ b/examples/coap-server.c @@ -2260,12 +2260,12 @@ usage(const char *program, const char *version) { "\t-C cafile\tPEM file or PKCS11 URI that contains a list of one or\n" "\t \t\tmore CAs that are to be passed to the client for the\n" "\t \t\tclient to determine what client certificate to use.\n" - "\t \t\tNormally, this list of CAs would be the root CA and and\n" + "\t \t\tNormally, this list of CAs would be the root CA and\n" "\t \t\tany intermediate CAs. Ideally the server certificate\n" "\t \t\tshould be signed by the same CA so that mutual\n" "\t \t\tauthentication can take place. The contents of cafile\n" "\t \t\tare added to the trusted store of root CAs.\n" - "\t \t\tUsing the -C or -R options will will trigger the\n" + "\t \t\tUsing the -C or -R options will trigger the\n" "\t \t\tvalidation of the client certificate unless overridden\n" "\t \t\tby the -n option\n" "\t-J pkcs11_pin\tThe user pin to unlock access to the PKCS11 token\n" @@ -2281,7 +2281,7 @@ usage(const char *program, const char *version) { "\t \t\tUsing '-R trust_casfile' disables common CA mutual\n" "\t \t\tauthentication which can only be done by using\n" "\t \t\t'-C cafile'.\n" - "\t \t\tUsing the -C or -R options will will trigger the\n" + "\t \t\tUsing the -C or -R options will trigger the\n" "\t \t\tvalidation of the client certificate unless overridden\n" "\t \t\tby the -n option\n" "\t-S match_pki_sni_file\n" diff --git a/include/coap3/coap_dtls.h b/include/coap3/coap_dtls.h index 4cff26b3..a8517061 100644 --- a/include/coap3/coap_dtls.h +++ b/include/coap3/coap_dtls.h @@ -196,7 +196,8 @@ typedef enum coap_pki_key_t { * The structure that holds the PKI PEM definitions. */ typedef struct coap_pki_key_pem_t { - const char *ca_file; /**< File location of Common CA in PEM format */ + const char *ca_file; /**< File location of Common CA (and any + intermediates) in PEM format */ const char *public_cert; /**< File location of Public Cert */ const char *private_key; /**< File location of Private Key in PEM format */ } coap_pki_key_pem_t; diff --git a/man/coap-server.txt.in b/man/coap-server.txt.in index 5bed5135..24e08e6f 100644 --- a/man/coap-server.txt.in +++ b/man/coap-server.txt.in @@ -209,11 +209,11 @@ definitions have to be in DER, not PEM, format. Otherwise all of *-C* cafile:: PEM file or PKCS11 URI that contains a list of one or more CAs that are to be passed to the client for the client to determine what client certificate - to use. Normally, this list of CAs would be the root CA and and any + to use. Normally, this list of CAs would be the root CA and any intermediate CAs. Ideally the server certificate should be signed by the same CA so that mutual authentication can take place. The contents of *cafile* are added to the trusted store of root CAs. Using the *-C* or *-R* - options will will trigger the validation of the client certificate unless + options will trigger the validation of the client certificate unless overridden by the *-n* option. *-J* pkcs11_pin:: @@ -230,7 +230,7 @@ definitions have to be in DER, not PEM, format. Otherwise all of directory containing a set of CA PEM files. The *-C cafile* CA does not have to be in this list and is trusted for the validation. Using *-R trust_casfile* disables common CA mutual authentication which can only - be done by using *-C cafile*. Using the *-C* or *-R* options will will + be done by using *-C cafile*. Using the *-C* or *-R* options will trigger the validation of the server certificate unless overridden by the *-n* option. diff --git a/man/coap_encryption.txt.in b/man/coap_encryption.txt.in index 14fac78f..282810f5 100644 --- a/man/coap_encryption.txt.in +++ b/man/coap_encryption.txt.in @@ -687,7 +687,8 @@ COAP_PKI_KEY_PKCS11. [source, c] ---- typedef struct coap_pki_key_pem_t { - const char *ca_file; /* File location of Common CA in PEM format */ + const char *ca_file; /* File location of Common CA (and any + intermediates) in PEM format */ const char *public_cert; /* File location of Public Cert */ const char *private_key; /* File location of Private Key in PEM format */ } coap_pki_key_pem_t;