From e1132c8c38cf6df68831155c3bd64e1317cf3162 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Fri, 4 Oct 2024 17:06:38 +0200 Subject: [PATCH] Documenting CRL download usage and restrictions Fixes #25603 Reviewed-by: Matt Caswell Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25608) (cherry picked from commit e647220c00bb1da0518f8a31ed07b2a0977a3c9e) --- doc/man1/openssl-s_client.pod.in | 4 +++- doc/man3/X509_load_http.pod | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/doc/man1/openssl-s_client.pod.in b/doc/man1/openssl-s_client.pod.in index 31729d6bdd252..d722bea9e3563 100644 --- a/doc/man1/openssl-s_client.pod.in +++ b/doc/man1/openssl-s_client.pod.in @@ -263,7 +263,9 @@ See L for details. =item B<-crl_download> -Download CRL from distribution points in the certificate. +Download CRL from distribution points in the certificate. Note that this option +is ignored if B<-crl_check> option is not provided. Note that the maximum size +of CRL is limited by L function. =item B<-key> I|I diff --git a/doc/man3/X509_load_http.pod b/doc/man3/X509_load_http.pod index a147c43caa3fd..e17330b05587f 100644 --- a/doc/man3/X509_load_http.pod +++ b/doc/man3/X509_load_http.pod @@ -27,6 +27,9 @@ see L: X509_load_http() and X509_CRL_load_http() loads a certificate or a CRL, respectively, in ASN.1 format using HTTP from the given B. +Maximum size of the HTTP response is 100 kB for certificates and 32 MB for CRLs +and hard coded in the functions. + If B is given and B is NULL then this BIO is used instead of an internal one for connecting, writing the request, and reading the response. If both B and B are given (which may be memory BIOs, for instance)