wolfSSL manual: accuracy review and fixes for 5.9.4 by LinuxJedi · Pull Request #296 · wolfSSL/documentation

LinuxJedi · 2026-11-06T10:19:38Z

A full accuracy pass over the English wolfSSL manual (wolfSSL/src), checked against current wolfssl master (post v5.9.4). The Japanese manual and the Doxygen-generated API reference content are not touched; the build changes below do affect how the API reference pages are linked and listed.

What changed

Each commit covers one area:

Build pipeline (wolfSSL/Makefile, mkdocs.yml, Doxyfile)
- The perl regex that converts Doxybook2 function anchors was greedy, so on any line with several function links every link after the first became #function_xxx and broke. It now stops at the closing paren, and also handles typedef- and variable- anchors.
- Links to the top of a header page (#file-types.h) matched no heading id; they now point at the page (HTML) or its heading id (PDF).
- pdf-prep now strips group__*.md / *_8h.md link prefixes in the appendices too, so appendix links into the API reference work in the PDF.
- Seven API groups and ten header pages that were generated but missing from the nav and the PDF are added (Argon2, Falcon, FrodoKEM, HPKE, STM32, TSP, wolfEntropy, ...). They only exist in the English Doxygen input, so they are filtered out of the Japanese PDF build.
- Removed ten Doxyfile tags that current doxygen reports as obsolete; updated the copyright year.
- Result (together with the link fixes in the content commits): LaTeX undefined references in the PDF build went from 508 to 0, and broken internal links in the generated HTML from 311 to 0.
Chapter 2 (Building wolfSSL)
- New CMake, vcpkg and Debian/RPM package sections; Visual Studio, STM32CubeIDE, Yocto (IMAGE_INSTALL:append), Xcode and vendor IDE steps brought up to date.
- configure options: removed or renamed options that no longer exist and make ./configure fail (--enable-singlethread, --enable-fast-rsa, --with-user-crypto, --enable-fallback-scsv, --enable-apache-httpd); headings switched to the form a user needs when the default changed (--disable-ecc, --disable-tls13, --enable-des3, --enable-md5, ...); added entries for every option in configure.ac that was undocumented (ML-KEM, ML-DSA, LMS, XMSS, DTLS 1.3, ECH, QUIC, Ed448/X448, AES-XTS/EAX/SIV, ...). All option names in the section are accepted by configure.
- Macro reference: "Removing Features" now holds only removal macros, with the enable/tune macros regrouped into subsections; defaults corrected throughout; removed macros and platforms deleted (CryptoCell, Mynewt, picoTCP, Galileo, nRF51 AES, ...); math section rewritten for SP math as the default; new entries for ML-KEM/ML-DSA/LMS/XMSS macros, ports (Zephyr, nRF5x, FreeBSD kernel module, Xilinx, OP-TEE, NetX, ...) and missing removal macros.
Chapters 3 and 4: Getting Started examples now compile on a default build (TLS 1.0 method calls replaced), sample output regenerated from 5.9.4, static memory examples fixed and compile-tested, cipher suite and feature lists updated (TLS 1.3 suites, ML-KEM, removed Blake2b suites and SWIG), fixed ABI list regenerated from WOLFSSL_ABI markers.
Chapters 5 to 9: callback prototypes checked against the headers (nonexistent RSA-PSS sign-check typedefs removed, missing callback families added), RSA keygen example moved to 2048 bits (RSA_MIN_SIZE), CSR example fixed to PEM-encode the signed request, options.h include order documented, appendix references updated to the current letters.
Chapters 1, 10 to 16: wolfCrypt usage examples fixed (init/free calls, wc_RsaSetRNG() with blinding, WC_* type names) and new sections for ECC/ECDH, X25519, Ed25519, ML-KEM, ML-DSA, SHA-3/SHAKE, ChaCha20-Poly1305, AES-GCM streaming and WC_RNG; every example compiles and runs; tutorial and OpenSSL compatibility chapters updated; licensing and support details refreshed.
Appendices D to K: error code tables regenerated from the headers (names, values, ~150 missing codes); cipher suite defaults and required options corrected and confirmed with client -e; hardware options and macros checked against configure and the source; porting guide and wolfSM steps updated; RFC list updated.
Appendix I (post-quantum): states what is on by default (ML-KEM and the hybrid groups); the TLS examples now use a default-enabled hybrid and the in-tree certs/mldsa / certs/slhdsa certificates (tested over TLS 1.3 and DTLS 1.3); LMS/HSS and XMSS/XMSS^MT rewritten for the native implementations with a compile-tested example; all size, memory and benchmark figures re-measured on current master (platform and configure lines stated); liboqs-era data removed.
Links and characters: fixed internal links (mixed-case API anchors, renamed headings, a stray parenthesis, links to anchors that did not exist) and replaced non-ASCII punctuation, several instances of which were inside commands and code (an ideographic space in a CAAM export, en dashes in --enable-* flags, smart quotes in C).
codespell: sme (Arm Scalable Matrix Extension, used by --enable-frodokem-sme) added to the ignore list.

How it was checked

Claims were checked against the wolfssl master source; configure options with real ./configure runs; C examples compiled and run against builds of master with the needed options; example client/server commands run.
The manual was built with the repo Dockerfile (HTML and PDF), and internal links were checked against the generated HTML ids and the xelatex undefined-reference log.
The Japanese HTML build still works with the Makefile changes. The Japanese PDF cannot be built in the Dockerfile image on master either (xeCJK.sty is not installed), so that was checked only up to the pandoc step: pdf-prep, including the filtered API page lists, runs cleanly.
codespell (with the CI ignore list) is clean; markdownlint warnings went from 520 to 483 (lint is not enforced in CI).

Found along the way (upstream wolfssl, not changed here)

examples/client and examples/server --help print (null) at the end (Usage() reads past the last message entry).
doc/dox_comments: wolfDTLSv1_2_server_method has no \ingroup; wolfDTLSv1_3_client_method_ex / _server_method_ex and the ECH functions have no dox comments; the QUIC functions use \ingroup QUIC and nine functions in ssl.h (e.g. wolfSSL_CTX_set_ephemeral_key) use \ingroup SSL, but neither group is defined, so they have no group page; ssl.h line 17380 contains an ideographic space (U+3000) that renders as a missing glyph in the PDF; the wolfSSL_StaticBufferSz_ex example passes a NULL buffer.
configure help text disagrees with configure.ac for --enable-aesecb and --enable-error-queue-per-thread; --enable-opensslextra=noinstall on its own does not define OPENSSL_EXTRA.
Encrypt-then-MAC callbacks receive the MacEncrypt/DecryptVerify contexts rather than the EncryptMac/VerifyDecrypt ones, and the verify/decrypt callback is called without a NULL check.
INSTALL item 15 uses SecP521r1MLKEM1024, which only exists with --enable-experimental --enable-extra-pqc-hybrids, so its example fails on a normal build; examples/benchmark/tls_bench prints the first group as "N/A"; the wolfSSL_CTX_set1_groups_list dox comment says names are case-sensitive but the code compares them case-insensitively.
The unreleased ChangeLog still describes a CryptoCell-310 port, but settings.h rejects WOLFSSL_CRYPTOCELL.
Some build-option comment blocks at the top of src/internal.c, src/tls.c and wolfcrypt/src/aes.c carry the wrong descriptions that had been copied into chapter 2.
sslhandshake.png in this repo still shows the client Certificate after ClientKeyExchange; the text now gives the correct order, but the image needs redrawing.

- html-prep/pdf-prep: the regex that converts Doxybook2 function anchors was greedy, so every function link after the first on a line was rewritten to "#function_xxx" and broke. Match up to the closing paren only, and apply the same dash to underscore fix to typedef and variable anchors. - Links to the top of a header page ("#file-types.h") matched no heading id. Drop the anchor in the HTML build and point it at the header page's heading id in the PDF build. - pdf-prep: also strip group__*.md and *_8h.md link prefixes in the appendices (links from appendix pages into the API reference were left as dead file links in the PDF), and strip any *_8h.md prefix rather than a fixed list of five header pages. - Add the generated API pages that were missing from the mkdocs nav and the PDF: Argon2, Falcon, FrodoKEM, HPKE, STM32, TSP and wolfEntropy groups plus ten header pages. These only exist in the English Doxygen input, so they are filtered out of the Japanese PDF build. - Doxyfile: remove ten tags current doxygen reports as obsolete. - Update the copyright year.

- Keep only removal macros under "Removing Features"; move the enabling, tuning and relaxing macros into new subsections (symmetric/hash/KDF, RSA, hardware and async, PKCS, certificate and ASN.1, OCSP, post-quantum, TLS, debugging) - Add NO_DES3_TLS_SUITES, NO_PKCS8, NO_PKCS12, NO_CODING, WOLFSSL_NO_PEM and WOLFSSL_DTLS_NO_HVR_ON_RESUME - Drop NO_WOLFSSL_SHA256 and WOLFSSL_ASN_KEY_SIZE_ENUM (no longer used) and the duplicate WOLFSSL_HAVE_SP_RSA / WOLFSSL_SP_ASM entries - Rename the Dilithium entries to WOLFSSL_MLDSA_NO_ASN1 and WOLFSSL_MLDSA_FIPS204_DRAFT - Correct stale or wrong descriptions (NO_DES3, NO_RC4, NO_PSK, NO_TLS, session cache sizes, WOLFSSL_RSA_VERIFY_INLINE, WOLFSSL_NO_CLIENT_AUTH, WOLFSSL_ALLOW_NO_CN_IN_SAN, ALLOW_SELFSIGNED_INVALID_CERTSIGN, SLH-DSA parameter sets, ASN template and one-time-auth defaults, etc.)

- Add a note that some entries are on by default and state the default and opt-out for each such entry (SNI, AES-GCM, ChaCha/Poly, ECC, SHA, TLS 1.3, RSA blinding/PSS, AES sizes/CBC/decrypt, PRF, async I/O, etc.) - Correct descriptions that did not match the source (DTLS future records, keep SNI, TCA, DH extra, X25519 blinding, GCM tables, session export nopeer, webserver, write dup, cert setup cb, AEAD limits, etc.) - Add WOLFSSL_HAVE_MLKEM, WOLFSSL_HAVE_MLDSA, WOLFSSL_HAVE_LMS, WOLFSSL_HAVE_XMSS, WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK, HAVE_ED448, WOLFSSL_SHA224, HAVE_BLAKE2B/S and the HAVE_FFDHE_<size> macros - Rename WOLFSSL_APPLE_NATIVE_CERT_VALIDATION; mark obsolete or internal macros; drop GCM_GMULT_LEN, WOLFSSL_MEM_GUARD, WOLFSSL_PSK_ID_PROTECTION, WOLFSSL_CLIENT_SESSION_DEFINED and WOLFSSL_USE_POPEN_HOST - Fix typos, list formatting and an unbalanced code span

- Document git checkout with autogen.sh, wolfssl/options.h, CMake (build, options, install, find_package, Windows, presets), vcpkg and make deb / make rpm - Replace stale VS 2008/2010/2013, TrueSTUDIO, Cygwin and Keil text with the current Visual Studio, STM32Cube and MDK5 CMSIS pack flow - Fix the vendor IDE exclude list, Yocto, IAR, Xcode, apple-universal and GCC-ARM details - Correct fastmath/SP math option descriptions and the --enable-sp macro lists, and add the missing --enable-sp values - Fix cross compile examples and update the IDE port list - NXP CAAM: fix broken shell commands, API names and code snippets, move CodeAurora URLs to GitHub, add SECO API and QNX/Linux docs - Remove general macro entries misplaced at the end of the CAAM section

- Rewrite the math options section for the current code: SP math all is the default, fast math is legacy, heap math still ships; add USE_INTEGER_HEAP_MATH and NO_BIG_INT entries - Correct SP math entries (SP_MATH_ALL, NONBLOCK, HAVE_SP_RSA/DH/ECC, SP_DIV_32/64, SP_ASM, SP_INT_BITS), drop WOLFSSL_SP, add RISCV64 asm and the missing SP source files - Fix RNG, time, I/O, AES-NI, GCM, SHA, ECC and async entries that no longer match the source; fix the CUSTOM_RAND_GENERATE_BLOCK example - Remove entries for removed platforms and macros (CryptoCell, picoTCP, INTEL_GALILEO, GAME_BUILD, LSR, QL, EROAD, NRF51_AES, Mynewt, COMVERGE, SO_REUSEPORT) - Add Zephyr, nRF5x, FreeBSD kernel module, Xilinx, Telit, OP-TEE, NetX, Arduino and Raspberry Pi Pico port entries; move FUSION_RTOS to the platform section and TLS/certificate defines out of it - Merge the STM32F2 entry into the STM32 family entry and fix typos

- Mention DTLS 1.0/1.2/1.3 and that SSL 3.0, TLS 1.0 and TLS 1.1 are off by default - Use record protocol terminology, cite RFC 8446 for TLS 1.3, fix RFC 5246 link - Note the real TLS 1.2 client message order, add a TLS 1.3 handshake and DTLS section - Fix TLS name, bad_record_mac, Klima typos; note static RSA/DH removal in TLS 1.3 - RFC list: SSL 3.0 RFC 6101, DTLS versions, RFC 9846, current NIST specs (FIPS 180-4, 202, 186-5, SP 800-38A-D), RFC 5280, 8018, 5958, 7292 - Add TLS extension, cipher suite, post-quantum and other RFCs/specs used by wolfSSL

- Regenerate wolfSSL, I/O callback and wolfCrypt code tables from ssl.h, error-ssl.h and error-crypt.h so names and values match the source - Fix SSL_ERROR_WANT_X509_LOOKUP/SSL_ERROR_SSL values, add SSL_ERROR_NONE - Fix renamed codes (DUPLICATE_MSG_E, ASYNC_INIT_E, BAD_STATE_E, BAD_COND_E, DH_CHECK_PRIV_E) and shifted SRP/ASN codes, fix garbled descriptions - Add all missing codes, describe the error code ranges instead of MIN_CODE_E - Point to error-crypt.h, clarify how WANT_READ reaches the application

- DHE-RSA suites are enabled by default; static RSA, static ECDH and pure PSK suites need WOLFSSL_STATIC_RSA/DH/PSK (no --enable-staticecdh) - 3DES suites need --enable-des3-tls-suites, MD5 suites --enable-md5 - Add the _OLD_POLY1305 ChaCha suites, SCSV, WDM multicast suite, secp160r1/r2 and old ML-KEM hybrid IDs; add a note on --enable-harden-tls - Fix curve options (P-224 default, --with-eccminsz, ecccustcurves=all), Kyber option (--enable-mlkem=yes,original) and SHA-1 signature rows - Update the option to macro table (WOLFSSL_HAVE_MLKEM/MLDSA, NO_PSK, etc.) - Drop the dot after section numbers, use ASCII in the section D heading

- Intel and SP assembly need --enable-intelasm / --enable-sp --enable-sp-asm, document --enable-all-asm; fix RISC-V and PowerPC options - Fix the SP key size example (WOLFSSL_HAVE_SP_*, SP_NO_* macros) - Fix macros and options for STM32MP13, ESP32, Renesas, ATECC/TA100, Xilinx, QAT, Cavium, /dev/crypto and KCAPI; remove the CryptoCell row - Add missing assembly (ML-KEM, ML-DSA, FrodoKEM, SM3, Falcon, Hexagon) and ports (NXP ELE/ELS/LPC55S69/Kinetis/QorIQ, Altera, PolarFire, Nuvoton, TI, Pico, nRF51, CUDA, MagicCrypto, PKCS#11, AUTOSAR, SRAM PUF)

- Porting guide: SP math is the default math library, src/wolfio.c, static I/O buffer sizes, gencertbuf.pl arrays, current Micrium block - Document WOLFSSL_USER_FILESYSTEM, WOLFSSL_USER_MUTEX, CUSTOM_RAND_*, TIME_OVERRIDES, XMALLOC_OVERRIDE, wolfSSL_SetAllocators, static memory - Update PK and atomic record callback lists, add a crypto callback section - wolfSM: fix directory steps, add cd ../wolfssl, RISC-V 64, typo fixes

- ch05: STRING_USER macro list, XMEMCPY hook, USER_MATH_LIB, filesystem layer in wc_port.h, current IO setter names and callback return codes, OS/chipmaker lists, C# wrapper build and snippet - ch06: WOLFSSL_CALLBACKS requirement, WOLFSSL_TIMEVAL, HandShakeInfo ssl member, Encrypt-Then-MAC callbacks, fixed RSA/RSA-PSS sign check docs, split ECC/RSA sections with ECC keygen, word32 prototypes, protocol callbacks, crypto callback registration errors and CB_ONLY list, table of other callbacks - ch07: extension tables, custom OID and unknown extension callbacks, loading prototypes, encrypted keys, system CAs, PEM to DER, RSA keygen at 2048 bits with WC_RNG, ECC/Ed25519 keygen, Cert/CertName layouts, signature and PEM type lists, fixed cert and CSR examples, CSR use, ECC DER export - ch08: --enable-debug, log output controls, error string buffer size, native WANT_READ/WRITE names, Error Codes appendix link - ch09: options.h/user_settings include order, wolfSSL_Init behaviour, write_dup, CTX sharing, static buffer sizes

- Remove options configure no longer accepts (fast-rsa, user-crypto, apache-httpd, fallback-scsv); rename singlethread, blake2, xts - Use the disable form for options that are now on by default (ecc, eccshamir, sha512, supportedcurves, extended-master, tls13, sys-ca-certs) and the enable form for oldtls, des3 and md5 - Correct defaults and values for aesgcm, sha3, sha224, sni, keygen, curve25519, eccencrypt, devcrypto, cryptocb, armasm, mldsa, slhdsa, falcon and frodokem; fix sniffer, leantls, session cache, tinytls13 and renegotiation-indication descriptions - Document the missing configure options: DTLS 1.3, TLS 1.3 extras, extensions, PQC, ASN.1, AES modes, hashes, KDFs, curves, hardening, RNG, debug and memory logging, asm, kernel, hardware and application integration options

The wolfSSL manual now documents the --enable-frodokem-sme configure option, which codespell flags as a misspelling.

- Use current wc_* type and digest-size names; add Init/Free calls (HMAC, GMAC, AES, hashes, RSA, DH, DSA, RNG) - Note build options for algorithms that are off by default - Fix RSA (key init, RNG for blinding, signed return), DH (in/out sizes, dh2048), DES IV size, ChaCha example, HMAC hash list - Add SHA-3/SHAKE, AES-GCM (one-shot and streaming), ChaCha20-Poly1305, RNG, ECC (ECDSA/ECDH), X25519, Ed25519, ML-KEM and ML-DSA sections - Update AES mode list, CCM tag sizes, CTR key direction, EDH APIs

- Mark SSL 3.0/TLS 1.0/TLS 1.1/DTLS 1.0 as build options; list version-flexible methods and fix DTLS method names and links - Regenerate testsuite output from a 5.9.4 default build - Tutorial: WOLFSSL_SUCCESS/WOLFSSL_FILETYPE_PEM, string spacing, read buffer bound, implicit handshake on write, signal handler declarations; point to Appendix D for the protocol diagrams - OpenSSL compat: TLS_client_method(), C socket code, safe SSL_read, shipped cert file names, free order, OSP test projects - Best practices: typos, signature algorithms beyond RSA, wolfBoot

- Licensing: add wolfSSH to the GPLv3 list, note the GPLv2 exception list in LICENSING, retitle to FIPS 140-3 - Support: fix heading typo, add GitHub issues, build settings in the bug checklist, and a security vulnerability reporting section - Updates: X (formerly Twitter), GitHub releases and ChangeLog.md

- Add entries that existing links pointed at but that did not exist: NO_SIG_WRAPPER, HAVE_ECC_SECPR2, HAVE_ECC_SECPR3, HAVE_ECC_BRAINPOOL, HAVE_ECC_KOBLITZ and WOLFSSL_DEVCRYPTO. - Move NO_CERTS and NO_CLIENT_CACHE under Removing Features, and the certificate store/copy macros under Certificate and ASN.1 Options. - Re-add WOLFSSL_HAVE_ERROR_QUEUE, WOLFSSL_HAVE_CERT_SERVICE, WOLFSSL_HEAP_TEST, WOLFSSL_NO_REALLOC, WOLFSSL_NO_OPENSSL_RAND_CB and WOLFSSL_DEBUG_DTLS in the right sections (they were misplaced under the IMXRT1170 CAAM heading) with corrected descriptions. - Link configure options mentioned in macro entries to their entries.

- Regenerate testsuite, client/server --help and benchmark output from a default 5.9.4 build and explain what make test runs - Use www.google.com with SNI for the external client example, fix the -v defaults, error message format, test CA and -345 client cert text - Describe SP math as the default, mark fastmath notes as legacy, fix BENCH_EMBEDDED, keygen and bulk transfer buffer notes - Use cipher suites that exist in a default build - Client/server porting steps: include options.h, use the version-flexible methods, WOLFSSL_MAX_ERROR_SZ, wolfSSL_shutdown()

- Replace the SWIG text with the current language wrappers - Protocol support: build defaults, DTLS 1.3 and version-flexible methods, downgrade range and wolfSSL_CTX_SetMinVersion() - Add missing TLS extensions and short sections on resumption and tickets, secure renegotiation, early data, post-handshake auth, DTLS 1.3/Connection ID, raw public keys, ECH and QUIC - Cipher suites: add TLS 1.3, ARIA, SM, integrity-only and other missing suites, fix headings, drop removed Blake2b suites - Update cipher, hash and public key defaults, ML-KEM/ML-DSA, Falcon and FrodoKEM build options, ECC default and ECC example CA - Hardware acceleration: ARMv8, SP asm, crypto callbacks, other ports, current STM32, NITROX V, Espressif and Silicon Labs details - Sniffer cipher and ephemeral key support, missing stats field - Fix the static memory examples (heap hint pointer, return codes, _ex method pointer, WOLFMEM_IO_POOL_FIXED, StaticBufferSz_ex usage) and describe build-dependent bucket defaults - PSK defaults, suites, identity hint and length limits; zlib option and compression warning; SNI default; SP math timing resistance - Regenerate the fixed ABI list from the WOLFSSL_ABI markers

- Fix links broken by renamed headings (--disable-ecc, --disable-eccshamir, --disable-sys-ca-certs, --enable-blake2b, "Features Defined as C Pre-processor Macros") and other broken links: a stray parenthesis in the chapter 6 Atomic Record Layer link, mixed-case API anchors (ids are lowercase), a .html link that breaks in the PDF and the chapter 11 "Getting the Source Code" link. - Link configure option mentions in the wolfCrypt usage and tutorial chapters to their chapter 2 entries. - Replace curly quotes, en/em dashes, ellipsis and micro signs with ASCII. Several were inside commands and code (for example "-<en dash>enable- cryptocb"), which broke copy and paste.

- Fix the getting-started example: in-tree ML-DSA and SLH-DSA certs and the default SecP384r1MLKEM1024 group; add build defaults, DTLS 1.3 notes and the correct hybrid group table with code points - Rewrite LMS/HSS and XMSS/XMSS^MT for the native implementations: configure sub-options, parameter sets, key state callbacks, a tested sign/verify/reload example, and fresh benchmark tables - Replace stale statistics, liboqs heap/stack data and 5.6.3 benchmarks with new measurements, naming the platform and configure line - Point to FIPS 203/204/205 and SP 800-208; fix typos and wording

- Appendix G B-7: the standalone ML-KEM group names are ML_KEM_512, ML_KEM_768 and ML_KEM_1024 (aliases MLKEM512/768/1024), not ML-KEM-512. - Appendix I: link configure options to their chapter 2 entries and replace the remaining curly apostrophes.

…orts - Add entries for the 66 configure options that were still undocumented (HMAC and DRBG switches, RC2, Base16, S/MIME, web client, AUTOSAR, wolfSentry, PSA paths, hardware ports, internal/test-only options, and the no-op or removed --enable-tls13-draft18 and --with-wnr), each checked with a configure run. - Add 14 platform defines from the settings.h list that had no entry (Microchip TCP/IP, ESP32, Nucleus, Renesas TSIP/SCE, uTasker, Freescale KSDK/MQX, MAXQ10xx, Solaris, and others).

- wolfSSL_CTX_set_ephemeral_key() is on the ssl.h page; its dox comment uses an undefined SSL group, so there is no group__SSL page. - Drop the in-page AES-GCM link in chapter 10. A level 6 AES-GCM heading in chapter 2 takes the aes-gcm id in the PDF, so the link could not resolve there, and the example is directly below the sentence.

Copilot

🟡 Changes recommended

The CSR example leaves the version at 2 instead of PKCS#10’s required 0, producing a nonconforming request; the certificate-logging and error-code documentation also contains inaccuracies.

3 open issues

What changed in this PR

Updates the English wolfSSL manual for 5.9.4 and current master, aligning developer guidance with supported APIs, build options, and defaults while improving generated reference navigation.

Changes:

Corrects examples and expands configuration, callback, certificate, debugging, and porting guidance.
Refreshes protocol, hardware, error-code, licensing, and support references.
Fixes HTML/PDF link processing, adds missing API pages, and removes obsolete Doxygen settings.

File	Description
`wolfSSL/src/chapter16.md`	Updates release information and project links.
`wolfSSL/src/chapter15.md`	Adds bug-report requirements and private vulnerability reporting guidance.
`wolfSSL/src/chapter14.md`	Clarifies licensing options and FIPS references.
`wolfSSL/src/chapter13.md`	Refreshes OpenSSL compatibility guidance and examples.
`wolfSSL/src/chapter12.md`	Expands firmware-signing algorithm guidance.
`wolfSSL/src/chapter11.md`	Updates TLS tutorial examples, defaults, and sample output.
`wolfSSL/src/chapter09.md`	Clarifies configuration headers, lifecycle, threading, and buffers.
`wolfSSL/src/chapter08.md`	Expands logging controls and corrects error-buffer guidance.
`wolfSSL/src/chapter07.md`	Updates certificate handling, key generation, and CSR examples.
`wolfSSL/src/chapter06.md`	Corrects callback interfaces and documents additional callback families.
`wolfSSL/src/chapter05.md`	Refreshes portability abstractions, platform support, and C# instructions.
`wolfSSL/src/chapter01.md`	Updates protocol and default post-quantum feature descriptions.
`wolfSSL/src/appendix11.md`	Corrects wolfSM build steps and optimization references.
`wolfSSL/src/appendix10.md`	Modernizes platform-porting instructions and configuration hooks.
`wolfSSL/src/appendix08.md`	Updates hardware acceleration options and supported algorithms.
`wolfSSL/src/appendix06.md`	Expands and corrects error-code tables and handling guidance.
`wolfSSL/src/appendix05.md`	Refreshes standards links and adds modern cryptography references.
`wolfSSL/src/appendix04.md`	Clarifies protocol defaults and TLS/DTLS handshake descriptions.
`wolfSSL/mkdocs.yml`	Adds missing API navigation entries and updates copyright.
`wolfSSL/Makefile`	Fixes link rewriting and expands PDF API coverage with language filtering.
`wolfSSL/Doxyfile`	Removes obsolete Doxygen configuration tags.
`.github/workflows/code-spell.yml`	Adds the Arm SME term to spelling exceptions.

_{Review effort: Balanced}

- Chapter 7 CSR example: set req.version to 0 after wc_InitCert(), which defaults to 2 (X.509 v3). PKCS wolfSSL#10 requests are version 0 and wc_MakeCertReq() encodes the field as set. - Appendix F: wolfSSL_get_error() also maps MATCH_SUITE_ERROR and SOCKET_PEER_CLOSED_E to SSL_ERROR_SYSCALL in OPENSSL_EXTRA builds, and MP_WOULDBLOCK to WC_PENDING_E with WOLFSSL_ASYNC_CRYPT. - Chapter 8 and the WOLFSSL_DEBUG_CERTS entry: without DEBUG_WOLFSSL the certificate messages are off at run time until wolfSSL_CertDebugging_ON() is called (or WOLFSSL_CERT_LOG_ENABLED_DEFAULT is defined to 1).

LinuxJedi added 24 commits November 6, 2026 09:01

codespell: ignore "sme" (Arm Scalable Matrix Extension)

a651fd7

The wolfSSL manual now documents the --enable-frodokem-sme configure option, which codespell flags as a misspelling.

Copilot AI balanced review requested due to automatic review settings November 6, 2026 10:19

Copilot started reviewing on behalf of LinuxJedi November 6, 2026 10:20

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread wolfSSL/src/chapter07.md Resolved

Comment thread wolfSSL/src/appendix06.md Resolved

Comment thread wolfSSL/src/chapter08.md Resolved

LinuxJedi assigned wolfSSL-Bot Nov 6, 2026

LinuxJedi mentioned this pull request Nov 6, 2026

Fix issues found reviewing the wolfSSL manual wolfSSL/wolfssl#12038

Open

2 of 4 tasks

Navigation Menu

Repository navigation

wolfSSL manual: accuracy review and fixes for 5.9.4 - #296

wolfSSL manual: accuracy review and fixes for 5.9.4#296
LinuxJedi wants to merge 25 commits into
wolfSSL:masterfrom
LinuxJedi:wolfssl-manual-review-fixes

LinuxJedi commented Nov 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

LinuxJedi commented Nov 6, 2026

What changed

How it was checked

Found along the way (upstream wolfssl, not changed here)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants