deploy openssl/openssl@6b93db7 to master

Author: openssl-machine

master/man1/openssl-verification-options/index.html

@@ -44,7 +44,9 @@
 basicConstraints = CA:FALSE
 
 basicConstraints = critical, CA:TRUE, pathlen:1
-</code></pre></div><p>A CA certificate <em>must</em> include the <strong>basicConstraints</strong> name with the <strong>CA</strong> parameter set to <strong>TRUE</strong>. An end-user certificate must either have <strong>CA:FALSE</strong> or omit the extension entirely. The <strong>pathlen</strong> parameter specifies the maximum number of CAs that can appear below this one in a chain. A <strong>pathlen</strong> of zero means the CA cannot sign any sub-CA&#39;s, and can only sign end-entity certificates.</p><h3 id=key-usage>Key Usage<a class=headerlink href=#key-usage title="Permanent link">&para;</a></h3><p>Key usage is a multi-valued extension consisting of a list of names of the permitted key usages. The defined values are: <code>digitalSignature</code>, <code>nonRepudiation</code>, <code>keyEncipherment</code>, <code>dataEncipherment</code>, <code>keyAgreement</code>, <code>keyCertSign</code>, <code>cRLSign</code>, <code>encipherOnly</code>, and <code>decipherOnly</code>.</p><p>Examples:</p><div class=highlight><pre><span></span><code>keyUsage = digitalSignature, nonRepudiation
+</code></pre></div><p>A CA certificate <em>must</em> include the <strong>basicConstraints</strong> name with the <strong>CA</strong> parameter set to <strong>TRUE</strong>. An end-user certificate must either have <strong>CA:FALSE</strong> or omit the extension entirely. The <strong>pathlen</strong> parameter specifies the maximum number of CAs that can appear below this one in a chain. A <strong>pathlen</strong> of zero means the CA cannot sign any sub-CA&#39;s, and can only sign end-entity certificates.</p><h3 id=key-usage>Key Usage<a class=headerlink href=#key-usage title="Permanent link">&para;</a></h3><p>Key usage is a multi-valued extension consisting of a list of names of the permitted key usages. The defined values are: <code>digitalSignature</code>, <code>nonRepudiation</code> (with an alternative name <code>contentCommitment</code>), <code>keyEncipherment</code>, <code>dataEncipherment</code>, <code>keyAgreement</code>, <code>keyCertSign</code>, <code>cRLSign</code>, <code>encipherOnly</code>, and <code>decipherOnly</code>.</p><p>Examples:</p><div class=highlight><pre><span></span><code>keyUsage = digitalSignature, nonRepudiation
+
+keyUsage = digitalSignature, contentCommitment
 
 keyUsage = critical, keyCertSign
 </code></pre></div><h3 id=extended-key-usage>Extended Key Usage<a class=headerlink href=#extended-key-usage title="Permanent link">&para;</a></h3><p>This extension consists of a list of values indicating purposes for which the certificate public key can be used. Each value can be either a short text name or an OID. The following text names, and their intended meaning, are known:</p><div class=highlight><pre><span></span><code>Value                  Meaning according to RFC 5280 etc.