diff -up openssl-1.0.1e/doc/apps/cms.pod.manfix openssl-1.0.1e/doc/apps/cms.pod

--- openssl-1.0.1e/doc/apps/cms.pod.manfix	2013-02-11 16:26:04.000000000 +0100

+++ openssl-1.0.1e/doc/apps/cms.pod	2013-09-12 11:17:42.147092310 +0200

@@ -450,28 +450,28 @@ remains DER.

 =over 4

-=item 0

+=item C<0>

 the operation was completely successfully.

-=item 1 

+=item C<1>

 an error occurred parsing the command options.

-=item 2

+=item C<2>

 one of the input files could not be read.

-=item 3

+=item C<3>

 an error occurred creating the CMS file or when reading the MIME

 message.

-=item 4

+=item C<4>

 an error occurred decrypting or verifying the message.

-=item 5

+=item C<5>

 the message was verified correctly but an error occurred writing out

 the signers certificates.

diff -up openssl-1.0.1e/doc/apps/ec.pod.manfix openssl-1.0.1e/doc/apps/ec.pod

--- openssl-1.0.1e/doc/apps/ec.pod.manfix	2013-02-11 16:26:04.000000000 +0100

+++ openssl-1.0.1e/doc/apps/ec.pod	2013-09-12 11:17:42.147092310 +0200

@@ -93,10 +93,6 @@ prints out the public, private key compo

 this option prevents output of the encoded version of the key.

-=item B<-modulus>

-

-this option prints out the value of the public key component of the key.

-

 =item B<-pubin>

 by default a private key is read from the input file: with this option a

diff -up openssl-1.0.1e/doc/apps/openssl.pod.manfix openssl-1.0.1e/doc/apps/openssl.pod

--- openssl-1.0.1e/doc/apps/openssl.pod.manfix	2013-02-11 16:26:04.000000000 +0100

+++ openssl-1.0.1e/doc/apps/openssl.pod	2013-09-12 11:17:42.148092331 +0200

@@ -163,7 +163,7 @@ Create or examine a netscape certificate

 Online Certificate Status Protocol utility.

-=item L<B<passwd>|passwd(1)>

+=item L<B<passwd>|sslpasswd(1)>

 Generation of hashed passwords.

@@ -187,7 +187,7 @@ Public key algorithm parameter managemen

 Public key algorithm cryptographic operation utility.

-=item L<B<rand>|rand(1)>

+=item L<B<rand>|sslrand(1)>

 Generate pseudo-random bytes.

@@ -401,9 +401,9 @@ L<crl(1)|crl(1)>, L

 L<dhparam(1)|dhparam(1)>, L<dsa(1)|dsa(1)>, L<dsaparam(1)|dsaparam(1)>,

 L<enc(1)|enc(1)>, L<gendsa(1)|gendsa(1)>, L<genpkey(1)|genpkey(1)>,

 L<genrsa(1)|genrsa(1)>, L<nseq(1)|nseq(1)>, L<openssl(1)|openssl(1)>,

-L<passwd(1)|passwd(1)>,

+L<sslpasswd(1)|sslpasswd(1)>,

 L<pkcs12(1)|pkcs12(1)>, L<pkcs7(1)|pkcs7(1)>, L<pkcs8(1)|pkcs8(1)>,

-L<rand(1)|rand(1)>, L<req(1)|req(1)>, L<rsa(1)|rsa(1)>,

+L<sslrand(1)|sslrand(1)>, L<req(1)|req(1)>, L<rsa(1)|rsa(1)>,

 L<rsautl(1)|rsautl(1)>, L<s_client(1)|s_client(1)>,

 L<s_server(1)|s_server(1)>, L<s_time(1)|s_time(1)>,

 L<smime(1)|smime(1)>, L<spkac(1)|spkac(1)>,

diff -up openssl-1.0.1e/doc/apps/s_client.pod.manfix openssl-1.0.1e/doc/apps/s_client.pod

--- openssl-1.0.1e/doc/apps/s_client.pod.manfix	2013-09-12 11:17:41.517078502 +0200

+++ openssl-1.0.1e/doc/apps/s_client.pod	2013-09-12 11:17:42.149092353 +0200

@@ -32,9 +32,14 @@ B<openssl> B<s_client>

 [B<-ssl2>]

 [B<-ssl3>]

 [B<-tls1>]

+[B<-tls1_1>]

+[B<-tls1_2>]

+[B<-dtls1>]

 [B<-no_ssl2>]

 [B<-no_ssl3>]

 [B<-no_tls1>]

+[B<-no_tls1_1>]

+[B<-no_tls1_2>]

 [B<-bugs>]

 [B<-cipher cipherlist>]

 [B<-starttls protocol>]

@@ -44,6 +49,7 @@ B<openssl> B<s_client>

 [B<-sess_out filename>]

 [B<-sess_in filename>]

 [B<-rand file(s)>]

+[B<-nextprotoneg protocols>]

 =head1 DESCRIPTION

@@ -182,7 +188,7 @@ Use the PSK key B<key> when using a PSK

 given as a hexadecimal number without leading 0x, for example -psk

 1a2b3c4d.

-=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>

+=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-dtls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>

 these options disable the use of certain SSL or TLS protocols. By default

 the initial handshake uses a method which should be compatible with all

@@ -243,6 +249,17 @@ Multiple files can be specified separate

 The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for

 all others.

+=item B<-nextprotoneg protocols>

+

+enable Next Protocol Negotiation TLS extension and provide a list of

+comma-separated protocol names that the client should advertise

+support for. The list should contain most wanted protocols first.

+Protocol names are printable ASCII strings, for example "http/1.1" or

+"spdy/3".

+Empty list of protocols is treated specially and will cause the client to

+advertise support for the TLS extension but disconnect just after

+reciving ServerHello with a list of server supported protocols.

+

 =back

 =head1 CONNECTED COMMANDS

diff -up openssl-1.0.1e/doc/apps/smime.pod.manfix openssl-1.0.1e/doc/apps/smime.pod

--- openssl-1.0.1e/doc/apps/smime.pod.manfix	2013-02-11 16:26:04.000000000 +0100

+++ openssl-1.0.1e/doc/apps/smime.pod	2013-09-12 11:17:42.150092375 +0200

@@ -308,28 +308,28 @@ remains DER.

 =over 4

-=item 0

+=item C<0>

 the operation was completely successfully.

-=item 1 

+=item C<1>

 an error occurred parsing the command options.

-=item 2

+=item C<2>

 one of the input files could not be read.

-=item 3

+=item C<3>

 an error occurred creating the PKCS#7 file or when reading the MIME

 message.

-=item 4

+=item C<4>

 an error occurred decrypting or verifying the message.

-=item 5

+=item C<5>

 the message was verified correctly but an error occurred writing out

 the signers certificates.

diff -up openssl-1.0.1e/doc/apps/s_server.pod.manfix openssl-1.0.1e/doc/apps/s_server.pod

--- openssl-1.0.1e/doc/apps/s_server.pod.manfix	2013-02-11 16:26:04.000000000 +0100

+++ openssl-1.0.1e/doc/apps/s_server.pod	2013-09-12 11:17:42.150092375 +0200

@@ -40,10 +40,16 @@ B<openssl> B<s_server>

 [B<-ssl2>]

 [B<-ssl3>]

 [B<-tls1>]

+[B<-tls1_1>]

+[B<-tls1_2>]

+[B<-dtls1>]

 [B<-no_ssl2>]

 [B<-no_ssl3>]

 [B<-no_tls1>]

+[B<-no_tls1_1>]

+[B<-no_tls1_2>]

 [B<-no_dhe>]

+[B<-no_ecdhe>]

 [B<-bugs>]

 [B<-hack>]

 [B<-www>]

@@ -54,6 +60,7 @@ B<openssl> B<s_server>

 [B<-no_ticket>]

 [B<-id_prefix arg>]

 [B<-rand file(s)>]

+[B<-nextprotoneg protocols>]

 =head1 DESCRIPTION

@@ -131,6 +138,10 @@ a static set of parameters hard coded in

 if this option is set then no DH parameters will be loaded effectively

 disabling the ephemeral DH cipher suites.

+=item B<-no_ecdhe>

+

+if this option is set then ephemeral ECDH cipher suites will be disabled.

+

 =item B<-no_tmp_rsa>

 certain export cipher suites sometimes use a temporary RSA key, this option

@@ -201,7 +212,7 @@ Use the PSK key B<key> when using a PSK

 given as a hexadecimal number without leading 0x, for example -psk

 1a2b3c4d.

-=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>

+=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-dtls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>

 these options disable the use of certain SSL or TLS protocols. By default

 the initial handshake uses a method which should be compatible with all

@@ -276,6 +287,14 @@ Multiple files can be specified separate

 The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for

 all others.

+=item B<-nextprotoneg protocols>

+

+enable Next Protocol Negotiation TLS extension and provide a

+comma-separated list of supported protocol names.

+The list should contain most wanted protocols first.

+Protocol names are printable ASCII strings, for example "http/1.1" or

+"spdy/3".

+

 =back

 =head1 CONNECTED COMMANDS

diff -up openssl-1.0.1e/doc/apps/verify.pod.manfix openssl-1.0.1e/doc/apps/verify.pod

--- openssl-1.0.1e/doc/apps/verify.pod.manfix	2013-02-11 16:26:04.000000000 +0100

+++ openssl-1.0.1e/doc/apps/verify.pod	2013-09-12 11:25:13.994994992 +0200

@@ -25,6 +25,7 @@ B<openssl> B<verify>

 [B<-untrusted file>]

 [B<-help>]

 [B<-issuer_checks>]

+[B<-attime timestamp>]

 [B<-verbose>]

 [B<->]

 [certificates]

@@ -80,6 +81,12 @@ rejected. The presence of rejection mess

 anything is wrong; during the normal verification process, several

 rejections may take place.

+=item B<-attime timestamp>

+

+Perform validation checks using the time specified by B<timestamp> and not

+the current system time. B<timestamp> is the number of seconds since

+01.01.1970 (UNIX time).

+

 =item B<-policy arg>

 Enable policy processing and add B<arg> to the user-initial-policy-set (see

diff -up openssl-1.0.1e/doc/ssl/SSL_accept.pod.manfix openssl-1.0.1e/doc/ssl/SSL_accept.pod

--- openssl-1.0.1e/doc/ssl/SSL_accept.pod.manfix	2013-09-12 11:17:42.129091915 +0200

+++ openssl-1.0.1e/doc/ssl/SSL_accept.pod	2013-09-12 11:17:42.156092507 +0200

@@ -44,13 +44,13 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The TLS/SSL handshake was not successful but was shut down controlled and

 by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the

 return value B<ret> to find out the reason.

-=item 1

+=item C<1>

 The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been

 established.

diff -up openssl-1.0.1e/doc/ssl/SSL_clear.pod.manfix openssl-1.0.1e/doc/ssl/SSL_clear.pod

--- openssl-1.0.1e/doc/ssl/SSL_clear.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_clear.pod	2013-09-12 11:17:42.158092551 +0200

@@ -56,12 +56,12 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The SSL_clear() operation could not be performed. Check the error stack to

 find out the reason.

-=item 1

+=item C<1>

 The SSL_clear() operation was successful.

diff -up openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod.manfix openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod

--- openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod.manfix	2013-09-12 11:17:42.049090162 +0200

+++ openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod	2013-09-12 11:17:42.159092573 +0200

@@ -60,11 +60,11 @@ SSL_COMP_add_compression_method() may re

 =over 4

-=item 0

+=item C<0>

 The operation succeeded.

-=item 1

+=item C<1>

 The operation failed. Check the error queue to find out the reason.

diff -up openssl-1.0.1e/doc/ssl/SSL_connect.pod.manfix openssl-1.0.1e/doc/ssl/SSL_connect.pod

--- openssl-1.0.1e/doc/ssl/SSL_connect.pod.manfix	2013-09-12 11:17:42.130091937 +0200

+++ openssl-1.0.1e/doc/ssl/SSL_connect.pod	2013-09-12 11:17:42.161092616 +0200

@@ -41,13 +41,13 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The TLS/SSL handshake was not successful but was shut down controlled and

 by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the

 return value B<ret> to find out the reason.

-=item 1

+=item C<1>

 The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been

 established.

diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_add_session.pod.manfix openssl-1.0.1e/doc/ssl/SSL_CTX_add_session.pod

--- openssl-1.0.1e/doc/ssl/SSL_CTX_add_session.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_CTX_add_session.pod	2013-09-12 11:17:42.162092638 +0200

@@ -52,13 +52,13 @@ The following values are returned by all

 =over 4

-=item 0

+=item C<0>

  The operation failed. In case of the add operation, it was tried to add

  the same (identical) session twice. In case of the remove operation, the

  session was not found in the cache.

-=item 1

+=item C<1>

  The operation succeeded.

diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_load_verify_locations.pod.manfix openssl-1.0.1e/doc/ssl/SSL_CTX_load_verify_locations.pod

--- openssl-1.0.1e/doc/ssl/SSL_CTX_load_verify_locations.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_CTX_load_verify_locations.pod	2013-09-12 11:17:42.163092660 +0200

@@ -100,13 +100,13 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The operation failed because B<CAfile> and B<CApath> are NULL or the

 processing at one of the locations specified failed. Check the error

 stack to find out the reason.

-=item 1

+=item C<1>

 The operation succeeded.

diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_set_client_CA_list.pod.manfix openssl-1.0.1e/doc/ssl/SSL_CTX_set_client_CA_list.pod

--- openssl-1.0.1e/doc/ssl/SSL_CTX_set_client_CA_list.pod.manfix	2013-09-12 11:17:42.132091981 +0200

+++ openssl-1.0.1e/doc/ssl/SSL_CTX_set_client_CA_list.pod	2013-09-12 11:17:42.164092682 +0200

@@ -66,13 +66,13 @@ values:

 =over 4

-=item 0

+=item C<0>

 A failure while manipulating the STACK_OF(X509_NAME) object occurred or

 the X509_NAME could not be extracted from B<cacert>. Check the error stack

 to find out the reason.

-=item 1

+=item C<1>

 The operation succeeded.

diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_set_session_id_context.pod.manfix openssl-1.0.1e/doc/ssl/SSL_CTX_set_session_id_context.pod

--- openssl-1.0.1e/doc/ssl/SSL_CTX_set_session_id_context.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_CTX_set_session_id_context.pod	2013-09-12 11:17:42.166092726 +0200

@@ -64,13 +64,13 @@ return the following values:

 =over 4

-=item 0

+=item C<0>

 The length B<sid_ctx_len> of the session id context B<sid_ctx> exceeded

 the maximum allowed length of B<SSL_MAX_SSL_SESSION_ID_LENGTH>. The error

 is logged to the error stack.

-=item 1

+=item C<1>

 The operation succeeded.

diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_set_ssl_version.pod.manfix openssl-1.0.1e/doc/ssl/SSL_CTX_set_ssl_version.pod

--- openssl-1.0.1e/doc/ssl/SSL_CTX_set_ssl_version.pod.manfix	2013-02-11 16:26:04.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_CTX_set_ssl_version.pod	2013-09-12 11:17:42.167092748 +0200

@@ -42,11 +42,11 @@ and SSL_set_ssl_method():

 =over 4

-=item 0

+=item C<0>

 The new choice failed, check the error stack to find out the reason.

-=item 1

+=item C<1>

 The operation succeeded.

diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_use_psk_identity_hint.pod.manfix openssl-1.0.1e/doc/ssl/SSL_CTX_use_psk_identity_hint.pod

--- openssl-1.0.1e/doc/ssl/SSL_CTX_use_psk_identity_hint.pod.manfix	2013-09-12 11:17:42.133092003 +0200

+++ openssl-1.0.1e/doc/ssl/SSL_CTX_use_psk_identity_hint.pod	2013-09-12 11:17:42.168092770 +0200

@@ -96,7 +96,7 @@ data to B<psk> and return the length of

 connection will fail with decryption_error before it will be finished

 completely.

-=item 0

+=item C<0>

 PSK identity was not found. An "unknown_psk_identity" alert message

 will be sent and the connection setup fails.

diff -up openssl-1.0.1e/doc/ssl/SSL_do_handshake.pod.manfix openssl-1.0.1e/doc/ssl/SSL_do_handshake.pod

--- openssl-1.0.1e/doc/ssl/SSL_do_handshake.pod.manfix	2013-09-12 11:17:42.135092047 +0200

+++ openssl-1.0.1e/doc/ssl/SSL_do_handshake.pod	2013-09-12 11:17:42.170092814 +0200

@@ -45,13 +45,13 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The TLS/SSL handshake was not successful but was shut down controlled and

 by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the

 return value B<ret> to find out the reason.

-=item 1

+=item C<1>

 The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been

 established.

diff -up openssl-1.0.1e/doc/ssl/SSL_read.pod.manfix openssl-1.0.1e/doc/ssl/SSL_read.pod

--- openssl-1.0.1e/doc/ssl/SSL_read.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_read.pod	2013-09-12 11:17:42.171092836 +0200

@@ -86,7 +86,7 @@ The following return values can occur:

 The read operation was successful; the return value is the number of

 bytes actually read from the TLS/SSL connection.

-=item 0

+=item C<0>

 The read operation was not successful. The reason may either be a clean

 shutdown due to a "close notify" alert sent by the peer (in which case

diff -up openssl-1.0.1e/doc/ssl/SSL_session_reused.pod.manfix openssl-1.0.1e/doc/ssl/SSL_session_reused.pod

--- openssl-1.0.1e/doc/ssl/SSL_session_reused.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_session_reused.pod	2013-09-12 11:17:42.172092857 +0200

@@ -27,11 +27,11 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 A new session was negotiated.

-=item 1

+=item C<1>

 A session was reused.

diff -up openssl-1.0.1e/doc/ssl/SSL_set_fd.pod.manfix openssl-1.0.1e/doc/ssl/SSL_set_fd.pod

--- openssl-1.0.1e/doc/ssl/SSL_set_fd.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_set_fd.pod	2013-09-12 11:17:42.174092901 +0200

@@ -35,11 +35,11 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The operation failed. Check the error stack to find out why.

-=item 1

+=item C<1>

 The operation succeeded.

diff -up openssl-1.0.1e/doc/ssl/SSL_set_session.pod.manfix openssl-1.0.1e/doc/ssl/SSL_set_session.pod

--- openssl-1.0.1e/doc/ssl/SSL_set_session.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_set_session.pod	2013-09-12 11:17:42.175092923 +0200

@@ -37,11 +37,11 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The operation failed; check the error stack to find out the reason.

-=item 1

+=item C<1>

 The operation succeeded.

diff -up openssl-1.0.1e/doc/ssl/SSL_shutdown.pod.manfix openssl-1.0.1e/doc/ssl/SSL_shutdown.pod

--- openssl-1.0.1e/doc/ssl/SSL_shutdown.pod.manfix	2013-09-12 11:17:42.137092090 +0200

+++ openssl-1.0.1e/doc/ssl/SSL_shutdown.pod	2013-09-12 11:17:42.177092967 +0200

@@ -92,14 +92,14 @@ The following return values can occur:

 =over 4

-=item 0

+=item C<0>

 The shutdown is not yet finished. Call SSL_shutdown() for a second time,

 if a bidirectional shutdown shall be performed.

 The output of L<SSL_get_error(3)|SSL_get_error(3)> may be misleading, as an

 erroneous SSL_ERROR_SYSCALL may be flagged even though no error occurred.

-=item 1

+=item C<1>

 The shutdown was successfully completed. The "close notify" alert was sent

 and the peer's "close notify" alert was received.

diff -up openssl-1.0.1e/doc/ssl/SSL_write.pod.manfix openssl-1.0.1e/doc/ssl/SSL_write.pod

--- openssl-1.0.1e/doc/ssl/SSL_write.pod.manfix	2013-02-11 16:02:48.000000000 +0100

+++ openssl-1.0.1e/doc/ssl/SSL_write.pod	2013-09-12 11:17:42.177092967 +0200

@@ -79,7 +79,7 @@ The following return values can occur:

 The write operation was successful, the return value is the number of

 bytes actually written to the TLS/SSL connection.

-=item 0

+=item C<0>

 The write operation was not successful. Probably the underlying connection

 was closed. Call SSL_get_error() with the return value B<ret> to find out,