# info > openssl-verification-options

---
type: CommandReference
command: openssl-verification-options
mode: man
section: 1SSL
source: man-pages
---

## Quick Reference

- `-CAfile file` — load trusted certificates from file
- `-CApath dir` — use directory as trust store (hash-named files)
- `-CAstore uri` — use URI as CA store (file: or store URI)
- `-untrusted file` — load intermediate CA certificates (untrusted)
- `-trusted file` — load certificates with explicit trust attributes
- `-verify_depth num` — limit chain to num intermediate CA certs
- `-purpose purpose` — set intended use (sslclient, sslserver, etc.)
- `-crl_check` — check end entity via CRL lookup

## Name

generic X.509 certificate verification options

## Synopsis

openssl command [ options ... ] [ parameters ... ]
## Options

### Trusted Certificate Options

- `-CAfile file` — load file containing trusted certificates (PEM or PKCS#12). PEM-encoded certificates may have trust attributes.
- `-no-CAfile` — do not load default trusted certificate file
- `-CApath dir` — use directory as trust store; files named by hash of X.509 SubjectName
- `-no-CApath` — do not use default trusted certificate directory
- `-CAstore uri` — use URI as CA store (file: scheme acts like -CAfile or -CApath)
- `-no-CAstore` — do not use default store of trusted CA certificates

### Verification Options

- `-verbose` — print extra information about operations
- `-attime timestamp` — use timestamp (Unix epoch seconds) instead of current time
- `-no_check_time` — suppress checking validity period of certificates/CRLs (unless -attime given)
- `-x509_strict` — enforce RFC 5280 compliance; throw errors on non-compliant certificates (e.g., CA basicConstraints critical, keyUsage required, pathlenConstraint rules, non-empty issuer/subject, etc.)
- `-ignore_critical` — ignore unhandled critical extensions (otherwise reject per RFC 5280)
- `-issuer_checks` — ignored (obsolete)
- `-crl_check` — check end entity certificate validity by looking up valid CRL
- `-crl_check_all` — check validity of all certificates in chain via CRLs
- `-use_deltas` — enable support for delta CRLs
- `-extended_crl` — enable extended CRL features (indirect CRLs, alternate signing keys)
- `-suiteB_128_only`, `-suiteB_128`, `-suiteB_192` — enable Suite B mode (ECDSA + SHA256/SHA384, curves P-256/P-384)
- `-auth_level level` — set authentication security level (default -1: any; level 1: 80-bit equivalent, rejects MD5, RSA<1024)
- `-partial_chain` — allow verification with incomplete chain ending in a trusted certificate (not self-signed)
- `-check_ss_sig` — verify signature of last self-signed certificate in chain (disabled by default, no security benefit)
- `-allow_proxy_certs` — allow verification of proxy certificates
- `-trusted_first` — always use trusted certificates before untrusted (on by default since 1.1.0)
- `-no_alt_chains` — no effect (since -trusted_first always on)
- `-trusted file` — load certificates with explicit trust attributes; implies -no-CAfile, -no-CApath, -no-CAstore; may be used multiple times
- `-untrusted file` — load untrusted intermediate CA certificates for chain building; may be used multiple times
- `-policy arg` — enable policy processing; add arg (OID or name) to user-initial-policy-set
- `-explicit_policy` — set require-explicit-policy (RFC 5280)
- `-policy_check` — enable certificate policy processing
- `-policy_print` — print diagnostics related to policy processing
- `-inhibit_any` — set inhibit-any-policy (RFC 5280)
- `-inhibit_map` — set inhibit-policy-mapping (RFC 5280)
- `-purpose purpose` — intended use: sslclient, sslserver, nssslserver, smimesign, smimeencrypt, crlsign, ocsphelper, timestampsign, any. Default for TLS is sslclient/sslserver.
- `-verify_depth num` — limit chain to num intermediate CA certificates (max chain length num+2)
- `-verify_email email` — verify email matches Subject Alternative Name or subject DN email
- `-verify_hostname hostname` — verify hostname matches DNS SAN or Common Name
- `-verify_ip ip` — verify IP matches IP SAN
- `-verify_name name` — use default verification policies (trust model, required policies) by name: default, pkcs7, smime_sign, ssl_client, ssl_server. Equivalent to corresponding -purpose settings.

### Extended Verification Options

- `-xkey infile`, `-xcert infile`, `-xchain` — specify extra certificate, private key, and chain for alternative chain generation
- `-xchain_build` — build certificate chain for extra certificates (-xkey, -xcert, -xchain)
- `-xcertform DER|PEM|P12` — input format for extra certificate (retained for backward compatibility, no effect)
- `-xkeyform DER|PEM|P12` — input format for extra key (no effect, backward compatibility)

### Certificate Extensions

Verification checks extensions based on purpose:

- **Basic Constraints**: CA flag determines if certificate is a CA. If absent (including X.509v1), considered "possible CA". -x509_strict enforces CA flag critical, keyUsage keyCertSign for CA, etc.
- **Key Usage**: If present, restricts certificate use. CA must have keyCertSign. DigitalSignature, keyEncipherment, etc. checked per purpose.
- **Extended Key Usage (EKU)**: If present, restricts use to specified OIDs. Common purposes: SSL Client (web client auth), SSL Server (web server auth, SGC), S/MIME (email protection), CRL signing, etc. For each purpose, EKU, keyUsage, and Netscape certificate type are checked.

## See Also

- [X509_verify_cert(3)](http://localhost/phpMan.php/man/X509verifycert/3/markdown)
- [openssl-verify(1)](http://localhost/phpMan.php/man/openssl-verify/1/markdown)
- [openssl-ocsp(1)](http://localhost/phpMan.php/man/openssl-ocsp/1/markdown)
- [openssl-ts(1)](http://localhost/phpMan.php/man/openssl-ts/1/markdown)
- [openssl-s_client(1)](http://localhost/phpMan.php/man/openssl-sclient/1/markdown)
- [openssl-s_server(1)](http://localhost/phpMan.php/man/openssl-sserver/1/markdown)
- [openssl-smime(1)](http://localhost/phpMan.php/man/openssl-smime/1/markdown)
- [openssl-cmp(1)](http://localhost/phpMan.php/man/openssl-cmp/1/markdown)
- [openssl-cms(1)](http://localhost/phpMan.php/man/openssl-cms/1/markdown)