Commit 3e7bd74a11 for openssl.org

commit 3e7bd74a115e7ac569bd7e5a770d67e695eee874
Author: kovan <xaum.io@gmail.com>
Date:   Thu Jan 29 12:33:37 2026 +0100

    doc: add detailed documentation for SSL_CERT_FLAG_TLS_STRICT

    The -strict option and StrictCertCheck configuration option were
    documented only as "Enables strict mode protocol handling" without
    explaining what strict mode actually does.

    Add detailed documentation explaining that strict mode enforces:
    - All chain certificates must use configured signature algorithms
      (no SHA1 fallback)
    - CA certificate parameters are validated against supported list
    - Client certificate type must match server's CertificateRequest
    - Client certificate issuer must be in server's CA list

    Also note that Suite B modes always imply strict mode.

    Fixes #16140

    Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Tue Aug 18 15:50:34 2026
    (Merged from https://github.com/openssl/openssl/pull/29841)

diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod
index 15f969eb61..18a476a5c2 100644
--- a/doc/man3/SSL_CONF_cmd.pod
+++ b/doc/man3/SSL_CONF_cmd.pod
@@ -107,9 +107,42 @@ Equivalent to B<SSL_OP_PREFER_NO_DHE_KEX>. Only used by servers.

 =item B<-strict>

-Enables strict mode protocol handling. Equivalent to setting
+Enables strict certificate chain checking. Equivalent to setting
 B<SSL_CERT_FLAG_TLS_STRICT>.

+When enabled, this enforces additional TLS certificate chain requirements that
+many implementations ignore:
+
+=over 4
+
+=item *
+
+All certificates in the chain must use signature algorithms that are in the
+configured or negotiated list. Without strict mode, SHA1-based signatures are
+permitted as a fallback even if not explicitly configured.
+
+=item *
+
+The parameters (such as EC curves) of CA certificates in the chain are
+validated against the supported list, not just the end-entity certificate.
+
+=item *
+
+For client authentication in TLS 1.2 and earlier, the certificate type must
+match one of the types requested by the server in the CertificateRequest
+message.
+
+=item *
+
+For client authentication, the certificate chain must contain a certificate
+issued by one of the CAs in the server's CertificateRequest CA list (if
+provided).
+
+=back
+
+Suite B modes (enabled via B<SSL_CERT_FLAG_SUITEB_128_LOS> or
+B<SSL_CERT_FLAG_SUITEB_192_LOS>) always imply strict mode.
+
 =item B<-sigalgs> I<algs>

 This sets the supported signature algorithms for TLSv1.2 and TLSv1.3.
@@ -636,8 +669,13 @@ B<KTLS>: Enables kernel TLS if support has been compiled in, and it is supported
 by the negotiated ciphersuites and extensions. Equivalent to
 B<SSL_OP_ENABLE_KTLS>.

-B<StrictCertCheck>: Enable strict certificate checking. Equivalent to
-setting B<SSL_CERT_FLAG_TLS_STRICT> with SSL_CTX_set_cert_flags().
+B<StrictCertCheck>: Enable strict certificate chain checking. This enforces
+that all certificates in the chain use configured signature algorithms (no
+SHA1 fallback), validates CA certificate parameters against the supported
+list, and for client authentication requires matching certificate types and
+issuer names. Equivalent to setting B<SSL_CERT_FLAG_TLS_STRICT> with
+SSL_CTX_set_cert_flags(). See the B<-strict> command line option for full
+details.

 B<TxCertificateCompression>: support sending compressed certificates, enabled by
 default. Inverse of B<SSL_OP_NO_TX_CERTIFICATE_COMPRESSION>: that is,