summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/usr.sbin/openssl/openssl.1714
1 files changed, 359 insertions, 355 deletions
diff --git a/src/usr.sbin/openssl/openssl.1 b/src/usr.sbin/openssl/openssl.1
index 625f98385d..6284c5bc49 100644
--- a/src/usr.sbin/openssl/openssl.1
+++ b/src/usr.sbin/openssl/openssl.1
@@ -1,4 +1,4 @@
1.\" $OpenBSD: openssl.1,v 1.29 2004/01/23 14:31:11 jmc Exp $ 1.\" $OpenBSD: openssl.1,v 1.30 2004/01/23 21:43:09 jmc Exp $
2.\" ==================================================================== 2.\" ====================================================================
3.\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. 3.\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
4.\" 4.\"
@@ -409,19 +409,19 @@ Since the environment of other processes is visible on certain platforms
409under certain 409under certain
410.Ux 410.Ux
411OSes) this option should be used with caution. 411OSes) this option should be used with caution.
412.It Ar file : Ns Ar pathname 412.It Ar file : Ns Ar path
413The first line of 413The first line of
414.Ar pathname 414.Ar path
415is the password. 415is the password.
416If the same 416If the same
417.Ar pathname 417.Ar path
418argument is supplied to 418argument is supplied to
419.Fl passin 419.Fl passin
420and 420and
421.Fl passout , 421.Fl passout ,
422then the first line will be used for the input password and the next line 422then the first line will be used for the input password and the next line
423for the output password. 423for the output password.
424.Ar pathname 424.Ar path
425need not refer to a regular file: 425need not refer to a regular file:
426it could, for example, refer to a device or named pipe. 426it could, for example, refer to a device or named pipe.
427.It Ar fd : Ns Ar number 427.It Ar fd : Ns Ar number
@@ -441,12 +441,12 @@ Read the password from standard input.
441.Op Fl i 441.Op Fl i
442.Op Fl noout 442.Op Fl noout
443.Op Fl dlimit Ar number 443.Op Fl dlimit Ar number
444.Op Fl in Ar filename 444.Op Fl in Ar file
445.Op Fl inform Ar DER | PEM | TXT 445.Op Fl inform Ar DER | PEM | TXT
446.Op Fl length Ar number 446.Op Fl length Ar number
447.Op Fl offset Ar number 447.Op Fl offset Ar number
448.Op Fl oid Ar filename 448.Op Fl oid Ar file
449.Op Fl out Ar filename 449.Op Fl out Ar file
450.Op Fl strparse Ar offset 450.Op Fl strparse Ar offset
451.Ek 451.Ek
452.Pp 452.Pp
@@ -467,7 +467,7 @@ Dump unknown data in hex form.
467Indents the output according to the 467Indents the output according to the
468.Qq depth 468.Qq depth
469of the structures. 469of the structures.
470.It Fl in Ar filename 470.It Fl in Ar file
471The input file; default is standard input. 471The input file; default is standard input.
472.It Fl inform Ar DER | PEM | TXT 472.It Fl inform Ar DER | PEM | TXT
473The input format. 473The input format.
@@ -485,13 +485,13 @@ Number of bytes to parse; default is until end of file.
485Don't output the parsed version of the input file. 485Don't output the parsed version of the input file.
486.It Fl offset Ar number 486.It Fl offset Ar number
487Starting offset to begin parsing; default is start of file. 487Starting offset to begin parsing; default is start of file.
488.It Fl oid Ar filename 488.It Fl oid Ar file
489A file containing additional object identifiers 489A file containing additional object identifiers
490.Pq OIDs . 490.Pq OIDs .
491The format of this file is described in the 491The format of this file is described in the
492.Sx ASN1PARSE NOTES 492.Sx ASN1PARSE NOTES
493section below. 493section below.
494.It Fl out Ar filename 494.It Fl out Ar file
495Output file to place the 495Output file to place the
496.Em DER 496.Em DER
497encoded data into. 497encoded data into.
@@ -602,7 +602,7 @@ The output of some ASN.1 types is not well handled
602.Op Fl updatedb 602.Op Fl updatedb
603.Op Fl verbose 603.Op Fl verbose
604.Op Fl cert Ar file 604.Op Fl cert Ar file
605.Op Fl config Ar filename 605.Op Fl config Ar file
606.Op Fl crl_CA_compromise Ar time 606.Op Fl crl_CA_compromise Ar time
607.Op Fl crl_compromise Ar time 607.Op Fl crl_compromise Ar time
608.Op Fl crl_hold Ar instruction 608.Op Fl crl_hold Ar instruction
@@ -649,7 +649,7 @@ In this mode no questions will be asked
649and all certificates will be certified automatically. 649and all certificates will be certified automatically.
650.It Fl cert Ar file 650.It Fl cert Ar file
651The CA certificate file. 651The CA certificate file.
652.It Fl config Ar filename 652.It Fl config Ar file
653Specifies the configuration file to use. 653Specifies the configuration file to use.
654.It Fl days Ar arg 654.It Fl days Ar arg
655The number of days to certify the certificate for. 655The number of days to certify the certificate for.
@@ -683,9 +683,9 @@ to read certificate extensions from
683(using the default section unless the 683(using the default section unless the
684.Fl extensions 684.Fl extensions
685option is also used). 685option is also used).
686.It Fl in Ar filename 686.It Fl in Ar file
687An input 687An input
688.Ar filename 688.Ar file
689containing a single certificate request to be signed by the CA. 689containing a single certificate request to be signed by the CA.
690.It Fl infiles 690.It Fl infiles
691If present, this should be the last option; all subsequent arguments 691If present, this should be the last option; all subsequent arguments
@@ -698,7 +698,7 @@ Since on some systems the command line arguments are visible
698with the 698with the
699.Xr ps 1 699.Xr ps 1
700utility) this option should be used with caution. 700utility) this option should be used with caution.
701.It Fl keyfile Ar filename 701.It Fl keyfile Ar file
702The private key to sign requests with. 702The private key to sign requests with.
703.It Fl keyform Ar PEM | ENGINE 703.It Fl keyform Ar PEM | ENGINE
704Private key file format. 704Private key file format.
@@ -741,7 +741,7 @@ The
741keyword can be used in the configuration file to enable this behaviour. 741keyword can be used in the configuration file to enable this behaviour.
742.It Fl notext 742.It Fl notext
743Don't output the text form of a certificate to the output file. 743Don't output the text form of a certificate to the output file.
744.It Fl out Ar filename 744.It Fl out Ar file
745The output file to output certificates to. 745The output file to output certificates to.
746The default is standard output. 746The default is standard output.
747The certificate details will also be printed out to this file. 747The certificate details will also be printed out to this file.
@@ -749,7 +749,7 @@ The certificate details will also be printed out to this file.
749The 749The
750.Ar directory 750.Ar directory
751to output certificates to. 751to output certificates to.
752The certificate will be written to a filename consisting of the 752The certificate will be written to a file consisting of the
753serial number in hex with 753serial number in hex with
754.Qq .pem 754.Qq .pem
755appended. 755appended.
@@ -777,13 +777,13 @@ This is largely for compatibility with the older IE enrollment control
777which would only accept certificates if their DNs matched the order of the 777which would only accept certificates if their DNs matched the order of the
778request. 778request.
779This is not needed for Xenroll. 779This is not needed for Xenroll.
780.It Fl spkac Ar filename 780.It Fl spkac Ar file
781A file containing a single Netscape signed public key and challenge, 781A file containing a single Netscape signed public key and challenge,
782and additional field values to be signed by the CA. 782and additional field values to be signed by the CA.
783See the 783See the
784.Sx SPKAC FORMAT 784.Sx SPKAC FORMAT
785section for information on the required format. 785section for information on the required format.
786.It Fl ss_cert Ar filename 786.It Fl ss_cert Ar file
787A single self-signed certificate to be signed by the CA. 787A single self-signed certificate to be signed by the CA.
788.It Fl startdate Ar date 788.It Fl startdate Ar date
789This allows the start date to be explicitly set. 789This allows the start date to be explicitly set.
@@ -851,9 +851,9 @@ can't handle V2 CRLs.
851The number of hours before the next CRL is due. 851The number of hours before the next CRL is due.
852.It Fl gencrl 852.It Fl gencrl
853This option generates a CRL based on information in the index file. 853This option generates a CRL based on information in the index file.
854.It Fl revoke Ar filename 854.It Fl revoke Ar file
855A 855A
856.Ar filename 856.Ar file
857containing a certificate to revoke. 857containing a certificate to revoke.
858.It Fl subj Ar arg 858.It Fl subj Ar arg
859Supersedes the subject name given in the request. 859Supersedes the subject name given in the request.
@@ -1688,9 +1688,9 @@ selection options were added in version 0.9.7.
1688.Op Fl text 1688.Op Fl text
1689.Op Cm CAfile Ar file 1689.Op Cm CAfile Ar file
1690.Op Cm CApath Ar dir 1690.Op Cm CApath Ar dir
1691.Op Fl in Ar filename 1691.Op Fl in Ar file
1692.Op Fl inform Ar DER | PEM 1692.Op Fl inform Ar DER | PEM
1693.Op Fl out Ar filename 1693.Op Fl out Ar file
1694.Op Fl outform Ar DER | PEM 1694.Op Fl outform Ar DER | PEM
1695.Ek 1695.Ek
1696.Pp 1696.Pp
@@ -1719,8 +1719,8 @@ Print the CRL fingerprint.
1719.It Fl hash 1719.It Fl hash
1720Output a hash of the issuer name. 1720Output a hash of the issuer name.
1721This can be used to look up CRLs in a directory by issuer name. 1721This can be used to look up CRLs in a directory by issuer name.
1722.It Fl in Ar filename 1722.It Fl in Ar file
1723This specifies the input filename to read from, or standard input if this 1723This specifies the input file to read from, or standard input if this
1724option is not specified. 1724option is not specified.
1725.It Fl inform Ar DER | PEM 1725.It Fl inform Ar DER | PEM
1726This specifies the input format. 1726This specifies the input format.
@@ -1741,8 +1741,8 @@ Output the
1741field. 1741field.
1742.It Fl noout 1742.It Fl noout
1743Don't output the encoded version of the CRL. 1743Don't output the encoded version of the CRL.
1744.It Fl out Ar filename 1744.It Fl out Ar file
1745Specifies the output filename to write to, or standard output by 1745Specifies the output file to write to, or standard output by
1746default. 1746default.
1747.It Fl outform Ar DER | PEM 1747.It Fl outform Ar DER | PEM
1748This specifies the output format; the options have the same meaning as the 1748This specifies the output format; the options have the same meaning as the
@@ -1780,10 +1780,10 @@ and files too.
1780.Nm openssl crl2pkcs7 1780.Nm openssl crl2pkcs7
1781.Bk -words 1781.Bk -words
1782.Op Fl nocrl 1782.Op Fl nocrl
1783.Op Fl certfile Ar filename 1783.Op Fl certfile Ar file
1784.Op Fl in Ar filename 1784.Op Fl in Ar file
1785.Op Fl inform Ar DER | PEM 1785.Op Fl inform Ar DER | PEM
1786.Op Fl out Ar filename 1786.Op Fl out Ar file
1787.Op Fl outform Ar DER | PEM 1787.Op Fl outform Ar DER | PEM
1788.Ek 1788.Ek
1789.Pp 1789.Pp
@@ -1796,18 +1796,18 @@ structure.
1796.Pp 1796.Pp
1797The options are as follows: 1797The options are as follows:
1798.Bl -tag -width "XXXX" 1798.Bl -tag -width "XXXX"
1799.It Fl certfile Ar filename 1799.It Fl certfile Ar file
1800Specifies a 1800Specifies a
1801.Ar filename 1801.Ar file
1802containing one or more certificates in 1802containing one or more certificates in
1803.Ar PEM 1803.Ar PEM
1804format. 1804format.
1805All certificates in the file will be added to the PKCS#7 structure. 1805All certificates in the file will be added to the PKCS#7 structure.
1806This option can be used more than once to read certificates from multiple 1806This option can be used more than once to read certificates from multiple
1807files. 1807files.
1808.It Fl in Ar filename 1808.It Fl in Ar file
1809This specifies the input 1809This specifies the input
1810.Ar filename 1810.Ar file
1811to read a CRL from or standard input if this option is not specified. 1811to read a CRL from or standard input if this option is not specified.
1812.It Fl inform Ar DER | PEM 1812.It Fl inform Ar DER | PEM
1813This specifies the CRL input format. 1813This specifies the CRL input format.
@@ -1820,9 +1820,9 @@ is a base64 encoded version of the DER form with header and footer lines.
1820Normally, a CRL is included in the output file. 1820Normally, a CRL is included in the output file.
1821With this option, no CRL is 1821With this option, no CRL is
1822included in the output file and a CRL is not read from the input file. 1822included in the output file and a CRL is not read from the input file.
1823.It Fl out Ar filename 1823.It Fl out Ar file
1824Specifies the output 1824Specifies the output
1825.Ar filename 1825.Ar file
1826to write the PKCS#7 structure to or standard output by default. 1826to write the PKCS#7 structure to or standard output by default.
1827.It Fl outform Ar DER | PEM 1827.It Fl outform Ar DER | PEM
1828This specifies the PKCS#7 structure output format. 1828This specifies the PKCS#7 structure output format.
@@ -1875,12 +1875,12 @@ install user certificates and CAs in MSIE using the Xenroll control.
1875.Op Fl hex 1875.Op Fl hex
1876.Op Fl engine Ar id 1876.Op Fl engine Ar id
1877.Op Fl keyform Ar PEM | ENGINE 1877.Op Fl keyform Ar PEM | ENGINE
1878.Op Fl out Ar filename 1878.Op Fl out Ar file
1879.Op Fl prverify Ar filename 1879.Op Fl prverify Ar file
1880.Op Fl rand Ar file ... 1880.Op Fl rand Ar file ...
1881.Op Fl sign Ar filename 1881.Op Fl sign Ar file
1882.Op Fl signature Ar filename 1882.Op Fl signature Ar file
1883.Op Fl verify Ar filename 1883.Op Fl verify Ar file
1884.Op Ar file ... 1884.Op Ar file ...
1885.Ek 1885.Ek
1886.Pp 1886.Pp
@@ -1925,11 +1925,11 @@ This is the default case for a
1925digest as opposed to a digital signature. 1925digest as opposed to a digital signature.
1926.It Fl keyform Ar PEM | ENGINE 1926.It Fl keyform Ar PEM | ENGINE
1927Key file format. 1927Key file format.
1928.It Fl out Ar filename 1928.It Fl out Ar file
1929Filename to output to, or standard output by default. 1929file to output to, or standard output by default.
1930.It Fl prverify Ar filename 1930.It Fl prverify Ar file
1931Verify the signature using the private key in 1931Verify the signature using the private key in
1932.Ar filename . 1932.Ar file .
1933The output is either 1933The output is either
1934.Qq Verification OK 1934.Qq Verification OK
1935or 1935or
@@ -1940,14 +1940,14 @@ generator, or an EGD socket (see
1940.Xr RAND_egd 3 ) . 1940.Xr RAND_egd 3 ) .
1941Multiple files can be specified separated by a 1941Multiple files can be specified separated by a
1942.Sq \&: . 1942.Sq \&: .
1943.It Fl sign Ar filename 1943.It Fl sign Ar file
1944Digitally sign the digest using the private key in 1944Digitally sign the digest using the private key in
1945.Ar filename . 1945.Ar file .
1946.It Fl signature Ar filename 1946.It Fl signature Ar file
1947The actual signature to verify. 1947The actual signature to verify.
1948.It Fl verify Ar filename 1948.It Fl verify Ar file
1949Verify the signature using the public key in 1949Verify the signature using the public key in
1950.Ar filename . 1950.Ar file .
1951The output is either 1951The output is either
1952.Qq Verification OK 1952.Qq Verification OK
1953or 1953or
@@ -1993,9 +1993,9 @@ below.
1993.Op Fl noout 1993.Op Fl noout
1994.Op Fl text 1994.Op Fl text
1995.Op Fl engine Ar id 1995.Op Fl engine Ar id
1996.Op Fl in Ar filename 1996.Op Fl in Ar file
1997.Op Fl inform Ar DER | PEM 1997.Op Fl inform Ar DER | PEM
1998.Op Fl out Ar filename 1998.Op Fl out Ar file
1999.Op Fl outform Ar DER | PEM 1999.Op Fl outform Ar DER | PEM
2000.Op Fl rand Ar file ... 2000.Op Fl rand Ar file ...
2001.Op Ar numbits 2001.Op Ar numbits
@@ -2043,9 +2043,9 @@ string) will cause
2043to attempt to obtain a functional reference to the specified engine, 2043to attempt to obtain a functional reference to the specified engine,
2044thus initialising it if needed. 2044thus initialising it if needed.
2045The engine will then be set as the default for all available algorithms. 2045The engine will then be set as the default for all available algorithms.
2046.It Fl in Ar filename 2046.It Fl in Ar file
2047This specifies the input 2047This specifies the input
2048.Ar filename 2048.Ar file
2049to read parameters from or standard input if this option is not specified. 2049to read parameters from or standard input if this option is not specified.
2050.It Fl inform Ar DER | PEM 2050.It Fl inform Ar DER | PEM
2051This specifies the input format. 2051This specifies the input format.
@@ -2067,9 +2067,9 @@ It must be the last option.
2067If not present, then a value of 512 is used. 2067If not present, then a value of 512 is used.
2068If this value is present, then the input file is ignored and 2068If this value is present, then the input file is ignored and
2069parameters are generated instead. 2069parameters are generated instead.
2070.It Fl out Ar filename 2070.It Fl out Ar file
2071This specifies the output 2071This specifies the output
2072.Ar filename 2072.Ar file
2073to write parameters to. 2073to write parameters to.
2074Standard output is used if this option is not present. 2074Standard output is used if this option is not present.
2075The output filename should 2075The output filename should
@@ -2148,9 +2148,9 @@ option was added in
2148.Op Fl pubout 2148.Op Fl pubout
2149.Op Fl text 2149.Op Fl text
2150.Op Fl engine Ar id 2150.Op Fl engine Ar id
2151.Op Fl in Ar filename 2151.Op Fl in Ar file
2152.Op Fl inform Ar DER | PEM 2152.Op Fl inform Ar DER | PEM
2153.Op Fl out Ar filename 2153.Op Fl out Ar file
2154.Op Fl outform Ar DER | PEM 2154.Op Fl outform Ar DER | PEM
2155.Op Fl passin Ar arg 2155.Op Fl passin Ar arg
2156.Op Fl passout Ar arg 2156.Op Fl passout Ar arg
@@ -2196,9 +2196,9 @@ string) will cause
2196to attempt to obtain a functional reference to the specified engine, 2196to attempt to obtain a functional reference to the specified engine,
2197thus initialising it if needed. 2197thus initialising it if needed.
2198The engine will then be set as the default for all available algorithms. 2198The engine will then be set as the default for all available algorithms.
2199.It Fl in Ar filename 2199.It Fl in Ar file
2200This specifies the input 2200This specifies the input
2201.Ar filename 2201.Ar file
2202to read a key from or standard input if this option is not specified. 2202to read a key from or standard input if this option is not specified.
2203If the key is encrypted, a pass phrase will be prompted for. 2203If the key is encrypted, a pass phrase will be prompted for.
2204.It Fl inform Ar DER | PEM 2204.It Fl inform Ar DER | PEM
@@ -2224,9 +2224,9 @@ In the case of a private key, PKCS#8 format is also accepted.
2224This option prints out the value of the public key component of the key. 2224This option prints out the value of the public key component of the key.
2225.It Fl noout 2225.It Fl noout
2226This option prevents output of the encoded version of the key. 2226This option prevents output of the encoded version of the key.
2227.It Fl out Ar filename 2227.It Fl out Ar file
2228This specifies the output 2228This specifies the output
2229.Ar filename 2229.Ar file
2230to write a key to, or standard output if not specified. 2230to write a key to, or standard output if not specified.
2231If any encryption options are set then a pass phrase will be 2231If any encryption options are set then a pass phrase will be
2232prompted for. 2232prompted for.
@@ -2308,9 +2308,9 @@ To just output the public part of a private key:
2308.Op Fl noout 2308.Op Fl noout
2309.Op Fl text 2309.Op Fl text
2310.Op Fl engine Ar id 2310.Op Fl engine Ar id
2311.Op Fl in Ar filename 2311.Op Fl in Ar file
2312.Op Fl inform Ar DER | PEM 2312.Op Fl inform Ar DER | PEM
2313.Op Fl out Ar filename 2313.Op Fl out Ar file
2314.Op Fl outform Ar DER | PEM 2314.Op Fl outform Ar DER | PEM
2315.Op Fl rand Ar file ... 2315.Op Fl rand Ar file ...
2316.Op Ar numbits 2316.Op Ar numbits
@@ -2338,9 +2338,9 @@ The engine will then be set as the default for all available algorithms.
2338.It Fl genkey 2338.It Fl genkey
2339This option will generate a DSA either using the specified or generated 2339This option will generate a DSA either using the specified or generated
2340parameters. 2340parameters.
2341.It Fl in Ar filename 2341.It Fl in Ar file
2342This specifies the input 2342This specifies the input
2343.Ar filename 2343.Ar file
2344to read parameters from, or standard input if this option is not specified. 2344to read parameters from, or standard input if this option is not specified.
2345If the 2345If the
2346.Ar numbits 2346.Ar numbits
@@ -2366,9 +2366,9 @@ It must be the last option.
2366If this option is included, then the input file 2366If this option is included, then the input file
2367.Pq if any 2367.Pq if any
2368is ignored. 2368is ignored.
2369.It Fl out Ar filename 2369.It Fl out Ar file
2370This specifies the output 2370This specifies the output
2371.Ar filename 2371.Ar file
2372to write parameters to. 2372to write parameters to.
2373Standard output is used if this option is not present. 2373Standard output is used if this option is not present.
2374The output filename should 2374The output filename should
@@ -2411,12 +2411,12 @@ DSA parameters is often used to generate several distinct keys.
2411.Op Fl nosalt 2411.Op Fl nosalt
2412.Op Fl salt 2412.Op Fl salt
2413.Op Fl bufsize Ar number 2413.Op Fl bufsize Ar number
2414.Op Fl in Ar filename 2414.Op Fl in Ar file
2415.Op Fl iv Ar IV 2415.Op Fl iv Ar IV
2416.Op Fl K Ar key 2416.Op Fl K Ar key
2417.Op Fl k Ar password 2417.Op Fl k Ar password
2418.Op Fl kfile Ar filename 2418.Op Fl kfile Ar file
2419.Op Fl out Ar filename 2419.Op Fl out Ar file
2420.Op Fl pass Ar arg 2420.Op Fl pass Ar arg
2421.Op Fl S Ar salt 2421.Op Fl S Ar salt
2422.Ek 2422.Ek
@@ -2455,9 +2455,9 @@ string) will cause
2455to attempt to obtain a functional reference to the specified engine, 2455to attempt to obtain a functional reference to the specified engine,
2456thus initialising it if needed. 2456thus initialising it if needed.
2457The engine will then be set as the default for all available algorithms. 2457The engine will then be set as the default for all available algorithms.
2458.It Fl in Ar filename 2458.It Fl in Ar file
2459The input 2459The input
2460.Ar filename ; 2460.Ar file ;
2461standard input by default. 2461standard input by default.
2462.It Fl iv Ar IV 2462.It Fl iv Ar IV
2463The actual 2463The actual
@@ -2510,9 +2510,9 @@ This is for compatibility with previous versions of
2510Superseded by the 2510Superseded by the
2511.Fl pass 2511.Fl pass
2512option. 2512option.
2513.It Fl kfile Ar filename 2513.It Fl kfile Ar file
2514Read the password to derive the key from the first line of 2514Read the password to derive the key from the first line of
2515.Ar filename . 2515.Ar file .
2516This is for compatibility with previous versions of 2516This is for compatibility with previous versions of
2517.Nm OpenSSL . 2517.Nm OpenSSL .
2518Superseded by the 2518Superseded by the
@@ -2528,9 +2528,9 @@ This is the default for compatibility with previous versions of
2528.Nm OpenSSL 2528.Nm OpenSSL
2529and 2529and
2530.Nm SSLeay . 2530.Nm SSLeay .
2531.It Fl out Ar filename 2531.It Fl out Ar file
2532The output 2532The output
2533.Ar filename , 2533.Ar file ,
2534standard output by default. 2534standard output by default.
2535.It Fl P 2535.It Fl P
2536Print out the 2536Print out the
@@ -2788,7 +2788,7 @@ above.
2788.Fl des | des3 2788.Fl des | des3
2789.Oc 2789.Oc
2790.Op Fl engine Ar id 2790.Op Fl engine Ar id
2791.Op Fl out Ar filename 2791.Op Fl out Ar file
2792.Op Fl rand Ar file ... 2792.Op Fl rand Ar file ...
2793.Op Ar paramfile 2793.Op Ar paramfile
2794.Ek 2794.Ek
@@ -2818,9 +2818,9 @@ string) will cause
2818to attempt to obtain a functional reference to the specified engine, 2818to attempt to obtain a functional reference to the specified engine,
2819thus initialising it if needed. 2819thus initialising it if needed.
2820The engine will then be set as the default for all available algorithms. 2820The engine will then be set as the default for all available algorithms.
2821.It Fl out Ar filename 2821.It Fl out Ar file
2822The output 2822The output
2823.Ar filename . 2823.Ar file .
2824If this argument is not specified, standard output is used. 2824If this argument is not specified, standard output is used.
2825.It Ar paramfile 2825.It Ar paramfile
2826This option specifies the DSA parameter file to use. 2826This option specifies the DSA parameter file to use.
@@ -2850,7 +2850,7 @@ much quicker than RSA key generation, for example.
2850.Oc 2850.Oc
2851.Op Fl engine Ar id 2851.Op Fl engine Ar id
2852.Op Fl 3 | f4 2852.Op Fl 3 | f4
2853.Op Fl out Ar filename 2853.Op Fl out Ar file
2854.Op Fl passout Ar arg 2854.Op Fl passout Ar arg
2855.Op Fl rand Ar file ... 2855.Op Fl rand Ar file ...
2856.Op Ar numbits 2856.Op Ar numbits
@@ -2888,9 +2888,9 @@ The default is 65537.
2888The size of the private key to generate in bits. 2888The size of the private key to generate in bits.
2889This must be the last option specified. 2889This must be the last option specified.
2890The default is 512. 2890The default is 512.
2891.It Fl out Ar filename 2891.It Fl out Ar file
2892The output 2892The output
2893.Ar filename . 2893.Ar file .
2894If this argument is not specified, standard output is used. 2894If this argument is not specified, standard output is used.
2895.It Fl passout Ar arg 2895.It Fl passout Ar arg
2896The output file password source. 2896The output file password source.
@@ -2935,8 +2935,8 @@ they will be much larger
2935.Sh NSEQ 2935.Sh NSEQ
2936.Nm openssl nseq 2936.Nm openssl nseq
2937.Op Fl toseq 2937.Op Fl toseq
2938.Op Fl in Ar filename 2938.Op Fl in Ar file
2939.Op Fl out Ar filename 2939.Op Fl out Ar file
2940.Pp 2940.Pp
2941The 2941The
2942.Nm nseq 2942.Nm nseq
@@ -2947,13 +2947,13 @@ sequence.
2947.Pp 2947.Pp
2948The options are as follows: 2948The options are as follows:
2949.Bl -tag -width "-toseq" 2949.Bl -tag -width "-toseq"
2950.It Fl in Ar filename 2950.It Fl in Ar file
2951This specifies the input 2951This specifies the input
2952.Ar filename 2952.Ar file
2953to read or standard input if this option is not specified. 2953to read or standard input if this option is not specified.
2954.It Fl out Ar filename 2954.It Fl out Ar file
2955Specifies the output 2955Specifies the output
2956.Ar filename 2956.Ar file
2957or standard output by default. 2957or standard output by default.
2958.It Fl toseq 2958.It Fl toseq
2959Normally, a Netscape certificate sequence will be input and the output 2959Normally, a Netscape certificate sequence will be input and the output
@@ -3000,53 +3000,53 @@ input and output files and allowing multiple certificate files to be used.
3000.Sh OCSP 3000.Sh OCSP
3001.Nm openssl ocsp 3001.Nm openssl ocsp
3002.Bk -words 3002.Bk -words
3003.Op Fl out Ar file 3003.Op Fl no_cert_checks
3004.Op Fl issuer Ar file 3004.Op Fl no_cert_verify
3005.Op Fl cert Ar file
3006.Op Fl serial Ar n
3007.Op Fl signer Ar file
3008.Op Fl signkey Ar file
3009.Op Fl sign_other Ar file
3010.Op Fl no_certs 3005.Op Fl no_certs
3006.Op Fl no_chain
3007.Op Fl no_intern
3008.Op Fl no_nonce
3009.Op Fl no_signature_verify
3010.Op Fl nonce
3011.Op Fl noverify
3011.Op Fl req_text 3012.Op Fl req_text
3013.Op Fl resp_key_id
3014.Op Fl resp_no_certs
3012.Op Fl resp_text 3015.Op Fl resp_text
3013.Op Fl text 3016.Op Fl text
3014.Op Fl reqout Ar file 3017.Op Fl trust_other
3015.Op Fl respout Ar file 3018.Op Fl CA Ar file
3016.Op Fl reqin Ar file 3019.Op Fl CAfile Ar file
3017.Op Fl respin Ar file 3020.Op Fl CApath Ar path
3018.Op Fl nonce 3021.Op Fl cert Ar file
3019.Op Fl no_nonce
3020.Op Fl url Ar URL
3021.Oo 3022.Oo
3022.Fl host 3023.Fl host
3023.Ar hostname : Ns Ar port 3024.Ar hostname : Ns Ar port
3024.Oc 3025.Oc
3025.Op Fl path 3026.Op Fl index Ar indexfile
3026.Op Fl CApath Ar dir 3027.Op Fl issuer Ar file
3027.Op Fl CAfile Ar file 3028.Op Fl ndays Ar days
3028.Op Fl VAfile Ar file 3029.Op Fl nmin Ar minutes
3029.Op Fl validity_period Ar n 3030.Op Fl nrequest Ar number
3030.Op Fl status_age Ar n 3031.Op Fl out Ar file
3031.Op Fl noverify 3032.Op Fl path Ar path
3032.Op Fl verify_other Ar file 3033.Op Fl port Ar portnum
3033.Op Fl trust_other 3034.Op Fl reqin Ar file
3034.Op Fl no_intern 3035.Op Fl reqout Ar file
3035.Op Fl no_signature_verify 3036.Op Fl respin Ar file
3036.Op Fl no_cert_verify 3037.Op Fl respout Ar file
3037.Op Fl no_chain
3038.Op Fl no_cert_checks
3039.Op Fl port Ar num
3040.Op Fl index Ar file
3041.Op Fl CA Ar file
3042.Op Fl rsigner Ar file
3043.Op Fl rkey Ar file 3038.Op Fl rkey Ar file
3044.Op Fl rother Ar file 3039.Op Fl rother Ar file
3045.Op Fl resp_no_certs 3040.Op Fl rsigner Ar file
3046.Op Fl nmin Ar n 3041.Op Fl serial Ar number
3047.Op Fl ndays Ar n 3042.Op Fl sign_other Ar file
3048.Op Fl resp_key_id 3043.Op Fl signer Ar file
3049.Op Fl nrequest Ar n 3044.Op Fl signkey Ar file
3045.Op Fl status_age Ar age
3046.Op Fl url Ar responder_url
3047.Op Fl VAfile Ar file
3048.Op Fl validity_period Ar nsec
3049.Op Fl verify_other Ar file
3050.Ek 3050.Ek
3051.Pp 3051.Pp
3052The Online Certificate Status Protocol 3052The Online Certificate Status Protocol
@@ -3065,49 +3065,67 @@ and behave like a mini OCSP server itself.
3065.Pp 3065.Pp
3066The options are as follows: 3066The options are as follows:
3067.Bl -tag -width "XXXX" 3067.Bl -tag -width "XXXX"
3068.It Fl out Ar filename 3068.It Fl CAfile Ar file , Fl CApath Ar path
3069Specify output 3069.Ar file
3070.Ar filename , 3070or
3071default is standard output. 3071.Ar path
3072.It Fl issuer Ar filename 3072containing trusted CA certificates.
3073This specifies the current issuer certificate. 3073These are used to verify the signature on the OCSP response.
3074This option can be used multiple times. 3074.It Fl cert Ar file
3075The certificate specified in
3076.Ar filename
3077must be in
3078.Ar PEM
3079format.
3080.It Fl cert Ar filename
3081Add the certificate 3075Add the certificate
3082.Ar filename 3076.Ar file
3083to the request. 3077to the request.
3084The issuer certificate is taken from the previous 3078The issuer certificate is taken from the previous
3085.Fl issuer 3079.Fl issuer
3086option, or an error occurs if no issuer certificate is specified. 3080option, or an error occurs if no issuer certificate is specified.
3087.It Fl serial Ar num 3081.It Xo
3088Same as the 3082.Fl host Ar hostname : Ns Ar port ,
3089.Fl cert 3083.Fl path Ar path
3090option except the certificate with serial number 3084.Xc
3091.Ar num
3092is added to the request.
3093The serial number is interpreted as a decimal integer unless preceded by
3094.Sq 0x .
3095Negative integers can also be specified by preceding the value with a
3096.Sq -
3097sign.
3098.It Fl signer Ar filename , Fl signkey Ar filename
3099Sign the OCSP request using the certificate specified in the
3100.Fl signer
3101option and the private key specified by the
3102.Fl signkey
3103option.
3104If the 3085If the
3105.Fl signkey 3086.Fl host
3106option is not present, then the private key is read from the same file 3087option is present, then the OCSP request is sent to the host
3107as the certificate. 3088.Ar hostname
3108If neither option is specified, then the OCSP request is not signed. 3089on port
3109.It Fl sign_other Ar filename 3090.Ar port .
3110Additional certificates to include in the signed request. 3091.Fl path
3092specifies the HTTP path name to use, or
3093.Sq /
3094by default.
3095.It Fl issuer Ar file
3096This specifies the current issuer certificate.
3097This option can be used multiple times.
3098The certificate specified in
3099.Ar file
3100must be in
3101.Ar PEM
3102format.
3103.It Fl no_cert_checks
3104Don't perform any additional checks on the OCSP response signer's certificate.
3105That is, do not make any checks to see if the signer's certificate is
3106authorised to provide the necessary status information:
3107as a result this option should only be used for testing purposes.
3108.It Fl no_cert_verify
3109Don't verify the OCSP response signer's certificate at all.
3110Since this option allows the OCSP response to be signed by any certificate,
3111it should only be used for testing purposes.
3112.It Fl no_certs
3113Don't include any certificates in signed request.
3114.It Fl no_chain
3115Do not use certificates in the response as additional untrusted CA
3116certificates.
3117.It Fl no_intern
3118Ignore certificates contained in the OCSP response
3119when searching for the signer's certificate.
3120With this option, the signer's certificate must be specified with either the
3121.Fl verify_certs
3122or
3123.Fl VAfile
3124options.
3125.It Fl no_signature_verify
3126Don't check the signature on the OCSP response.
3127Since this option tolerates invalid signatures on OCSP responses,
3128it will normally only be used for testing purposes.
3111.It Fl nonce , no_nonce 3129.It Fl nonce , no_nonce
3112Add an OCSP 3130Add an OCSP
3113.Em nonce 3131.Em nonce
@@ -3133,52 +3151,57 @@ a
3133is automatically added; specifying 3151is automatically added; specifying
3134.Fl no_nonce 3152.Fl no_nonce
3135overrides this. 3153overrides this.
3154.It Fl noverify
3155Don't attempt to verify the OCSP response signature or the
3156.Em nonce
3157values.
3158This option will normally only be used for debugging
3159since it disables all verification of the responder's certificate.
3160.It Fl out Ar file
3161Specify output
3162.Ar file ;
3163default is standard output.
3136.It Fl req_text , resp_text , text 3164.It Fl req_text , resp_text , text
3137Print out the text form of the OCSP request, response, or both, respectively. 3165Print out the text form of the OCSP request, response, or both, respectively.
3138.It Fl reqout Ar file , Fl respout Ar file
3139Write out the DER encoded certificate request or response to
3140.Ar file .
3141.It Fl reqin Ar file , Fl respin Ar file 3166.It Fl reqin Ar file , Fl respin Ar file
3142Read an OCSP request or response file from 3167Read an OCSP request or response file from
3143.Ar file . 3168.Ar file .
3144These option are ignored 3169These option are ignored
3145if an OCSP request or response creation is implied by other options 3170if an OCSP request or response creation is implied by other options
3146(for example with the 3171(for example with the
3147.Fl serial , cert 3172.Fl serial , cert ,
3148and 3173and
3149.Fl host 3174.Fl host
3150options). 3175options).
3151.It Fl url Ar responder_url 3176.It Fl reqout Ar file , Fl respout Ar file
3152Specify the responder URL. 3177Write out the
3153Both HTTP and HTTPS 3178.Ar DER
3154.Pq SSL/TLS 3179encoded certificate request or response to
3155URLs can be specified. 3180.Ar file .
3156.It Xo 3181.It Fl serial Ar num
3157.Fl host Ar hostname : Ns Ar port , 3182Same as the
3158.Fl path Ar pathname 3183.Fl cert
3159.Xc 3184option except the certificate with serial number
3185.Ar num
3186is added to the request.
3187The serial number is interpreted as a decimal integer unless preceded by
3188.Sq 0x .
3189Negative integers can also be specified by preceding the value with a
3190.Sq -
3191sign.
3192.It Fl sign_other Ar file
3193Additional certificates to include in the signed request.
3194.It Fl signer Ar file , Fl signkey Ar file
3195Sign the OCSP request using the certificate specified in the
3196.Fl signer
3197option and the private key specified by the
3198.Fl signkey
3199option.
3160If the 3200If the
3161.Fl host 3201.Fl signkey
3162option is present, then the OCSP request is sent to the host 3202option is not present, then the private key is read from the same file
3163.Ar hostname 3203as the certificate.
3164on port 3204If neither option is specified, then the OCSP request is not signed.
3165.Ar port .
3166.Fl path
3167specifies the HTTP path name to use, or
3168.Sq /
3169by default.
3170.It Fl CAfile Ar file , Fl CApath Ar pathname
3171.Ar file
3172or
3173.Ar pathname
3174containing trusted CA certificates.
3175These are used to verify the signature on the OCSP response.
3176.It Fl verify_other Ar file
3177.Ar file
3178containing additional certificates to search when attempting to locate
3179the OCSP response signing certificate.
3180Some responders omit the actual signer's certificate from the response:
3181this option can be used to supply the necessary certificate in such cases.
3182.It Fl trust_other 3205.It Fl trust_other
3183The certificates specified by the 3206The certificates specified by the
3184.Fl verify_certs 3207.Fl verify_certs
@@ -3186,6 +3209,11 @@ option should be explicitly trusted and no additional checks will be
3186performed on them. 3209performed on them.
3187This is useful when the complete responder certificate chain is not available 3210This is useful when the complete responder certificate chain is not available
3188or trusting a root CA is not appropriate. 3211or trusting a root CA is not appropriate.
3212.It Fl url Ar responder_url
3213Specify the responder URL.
3214Both HTTP and HTTPS
3215.Pq SSL/TLS
3216URLs can be specified.
3189.It Fl VAfile Ar file 3217.It Fl VAfile Ar file
3190.Ar file 3218.Ar file
3191containing explicitly trusted responder certificates. 3219containing explicitly trusted responder certificates.
@@ -3194,36 +3222,6 @@ Equivalent to the
3194and 3222and
3195.Fl trust_other 3223.Fl trust_other
3196options. 3224options.
3197.It Fl noverify
3198Don't attempt to verify the OCSP response signature or the
3199.Em nonce
3200values.
3201This option will normally only be used for debugging
3202since it disables all verification of the responders certificate.
3203.It Fl no_intern
3204Ignore certificates contained in the OCSP response
3205when searching for the signer's certificate.
3206With this option the signer's certificate must be specified with either the
3207.Fl verify_certs
3208or
3209.Fl VAfile
3210options.
3211.It Fl no_signature_verify
3212Don't check the signature on the OCSP response.
3213Since this option tolerates invalid signatures on OCSP responses,
3214it will normally only be used for testing purposes.
3215.It Fl no_cert_verify
3216Don't verify the OCSP response signer's certificate at all.
3217Since this option allows the OCSP response to be signed by any certificate,
3218it should only be used for testing purposes.
3219.It Fl no_chain
3220Do not use certificates in the response as additional untrusted CA
3221certificates.
3222.It Fl no_cert_checks
3223Don't perform any additional checks on the OCSP response signer's certificate.
3224That is, do not make any checks to see if the signer's certificate is
3225authorised to provide the necessary status information:
3226as a result this option should only be used for testing purposes.
3227.It Fl validity_period Ar nsec , Fl status_age Ar age 3225.It Fl validity_period Ar nsec , Fl status_age Ar age
3228These options specify the range of times, in seconds, which will be tolerated 3226These options specify the range of times, in seconds, which will be tolerated
3229in an OCSP response. 3227in an OCSP response.
@@ -3251,9 +3249,18 @@ field is checked to see it is not older than
3251.Ar age 3249.Ar age
3252seconds old. 3250seconds old.
3253By default, this additional check is not performed. 3251By default, this additional check is not performed.
3252.It Fl verify_other Ar file
3253.Ar file
3254containing additional certificates to search when attempting to locate
3255the OCSP response signing certificate.
3256Some responders omit the actual signer's certificate from the response;
3257this option can be used to supply the necessary certificate in such cases.
3254.El 3258.El
3255.Sh OCSP SERVER OPTIONS 3259.Sh OCSP SERVER OPTIONS
3256.Bl -tag -width "XXXX" 3260.Bl -tag -width "XXXX"
3261.It Fl CA Ar file
3262CA certificate corresponding to the revocation information in
3263.Ar indexfile .
3257.It Fl index Ar indexfile 3264.It Fl index Ar indexfile
3258.Ar indexfile 3265.Ar indexfile
3259is a text index file in 3266is a text index file in
@@ -3289,32 +3296,6 @@ option is present, then the
3289and 3296and
3290.Fl rsigner 3297.Fl rsigner
3291options must also be present. 3298options must also be present.
3292.It Fl CA Ar file
3293CA certificate corresponding to the revocation information in
3294.Ar indexfile .
3295.It Fl rsigner Ar file
3296The certificate to sign OCSP responses with.
3297.It Fl rother Ar file
3298Additional certificates to include in the OCSP response.
3299.It Fl resp_no_certs
3300Don't include any certificates in the OCSP response.
3301.It Fl resp_key_id
3302Identify the signer certificate using the key ID,
3303default is to use the subject name.
3304.It Fl rkey Ar file
3305The private key to sign OCSP responses with;
3306if not present, the file specified in the
3307.Fl rsigner
3308option is used.
3309.It Fl port Ar portnum
3310Port to listen for OCSP requests on.
3311The port may also be specified using the
3312.Fl url
3313option.
3314.It Fl nrequest Ar number
3315The OCSP server will exit after receiving
3316.Ar number
3317requests, default unlimited.
3318.It Fl nmin Ar minutes , Fl ndays Ar days 3299.It Fl nmin Ar minutes , Fl ndays Ar days
3319Number of 3300Number of
3320.Ar minutes 3301.Ar minutes
@@ -3326,6 +3307,29 @@ field.
3326If neither option is present, then the 3307If neither option is present, then the
3327.Em nextUpdate 3308.Em nextUpdate
3328field is omitted, meaning fresh revocation information is immediately available. 3309field is omitted, meaning fresh revocation information is immediately available.
3310.It Fl nrequest Ar number
3311The OCSP server will exit after receiving
3312.Ar number
3313requests, default unlimited.
3314.It Fl port Ar portnum
3315Port to listen for OCSP requests on.
3316The port may also be specified using the
3317.Fl url
3318option.
3319.It Fl resp_key_id
3320Identify the signer certificate using the key ID;
3321default is to use the subject name.
3322.It Fl resp_no_certs
3323Don't include any certificates in the OCSP response.
3324.It Fl rkey Ar file
3325The private key to sign OCSP responses with;
3326if not present, the file specified in the
3327.Fl rsigner
3328option is used.
3329.It Fl rother Ar file
3330Additional certificates to include in the OCSP response.
3331.It Fl rsigner Ar file
3332The certificate to sign OCSP responses with.
3329.El 3333.El
3330.Sh OCSP RESPONSE VERIFICATION 3334.Sh OCSP RESPONSE VERIFICATION
3331OCSP Response follows the rules specified in RFC 2560. 3335OCSP Response follows the rules specified in RFC 2560.
@@ -3423,7 +3427,7 @@ $ openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \e
3423 -url http://ocsp.myhost.com/ -resp_text -respout resp.der 3427 -url http://ocsp.myhost.com/ -resp_text -respout resp.der
3424.Ed 3428.Ed
3425.Pp 3429.Pp
3426Read in an OCSP response and print out text form: 3430Read in an OCSP response and print out in text form:
3427.Pp 3431.Pp
3428.Dl $ openssl ocsp -respin resp.der -text 3432.Dl $ openssl ocsp -respin resp.der -text
3429.Pp 3433.Pp
@@ -3448,8 +3452,8 @@ $ openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA \e
3448 demoCA/cacert.pem -issuer demoCA/cacert.pem -serial 1 3452 demoCA/cacert.pem -issuer demoCA/cacert.pem -serial 1
3449.Ed 3453.Ed
3450.Pp 3454.Pp
3451Query status information using request read from a file, write response to a 3455Query status information using request read from a file and write
3452second file: 3456the response to a second file:
3453.Bd -literal -offset indent 3457.Bd -literal -offset indent
3454$ openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA \e 3458$ openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA \e
3455 demoCA/cacert.pem -reqin req.der -respout resp.der 3459 demoCA/cacert.pem -reqin req.der -respout resp.der
@@ -3554,8 +3558,8 @@ prints
3554.Bk -words 3558.Bk -words
3555.Op Fl inform Ar DER | PEM 3559.Op Fl inform Ar DER | PEM
3556.Op Fl outform Ar DER | PEM 3560.Op Fl outform Ar DER | PEM
3557.Op Fl in Ar filename 3561.Op Fl in Ar file
3558.Op Fl out Ar filename 3562.Op Fl out Ar file
3559.Op Fl print_certs 3563.Op Fl print_certs
3560.Op Fl text 3564.Op Fl text
3561.Op Fl noout 3565.Op Fl noout
@@ -3583,13 +3587,13 @@ is a base64 encoded version of the DER form with header and footer lines.
3583This specifies the output format; the options have the same meaning as the 3587This specifies the output format; the options have the same meaning as the
3584.Fl inform 3588.Fl inform
3585option. 3589option.
3586.It Fl in Ar filename 3590.It Fl in Ar file
3587This specifies the input 3591This specifies the input
3588.Ar filename 3592.Ar file
3589to read from or standard input if this option is not specified. 3593to read from or standard input if this option is not specified.
3590.It Fl out Ar filename 3594.It Fl out Ar file
3591Specifies the output 3595Specifies the output
3592.Ar filename 3596.Ar file
3593to write to or standard output by default. 3597to write to or standard output by default.
3594.It Fl print_certs 3598.It Fl print_certs
3595Prints out any certificates or CRLs contained in the file. 3599Prints out any certificates or CRLs contained in the file.
@@ -3650,9 +3654,9 @@ They cannot currently parse, for example, the new CMS as described in RFC 2630.
3650.Op Fl topk8 3654.Op Fl topk8
3651.Op Fl inform Ar DER | PEM 3655.Op Fl inform Ar DER | PEM
3652.Op Fl outform Ar DER | PEM 3656.Op Fl outform Ar DER | PEM
3653.Op Fl in Ar filename 3657.Op Fl in Ar file
3654.Op Fl passin Ar arg 3658.Op Fl passin Ar arg
3655.Op Fl out Ar filename 3659.Op Fl out Ar file
3656.Op Fl passout Ar arg 3660.Op Fl passout Ar arg
3657.Op Fl noiter 3661.Op Fl noiter
3658.Op Fl nocrypt 3662.Op Fl nocrypt
@@ -3698,9 +3702,9 @@ format of the traditional format private key is used.
3698This specifies the output format; the options have the same meaning as the 3702This specifies the output format; the options have the same meaning as the
3699.Fl inform 3703.Fl inform
3700option. 3704option.
3701.It Fl in Ar filename 3705.It Fl in Ar file
3702This specifies the input 3706This specifies the input
3703.Ar filename 3707.Ar file
3704to read a key from or standard input if this option is not specified. 3708to read a key from or standard input if this option is not specified.
3705If the key is encrypted, a pass phrase will be prompted for. 3709If the key is encrypted, a pass phrase will be prompted for.
3706.It Fl passin Ar arg 3710.It Fl passin Ar arg
@@ -3710,9 +3714,9 @@ For more information about the format of
3710see the 3714see the
3711.Sx PASS PHRASE ARGUMENTS 3715.Sx PASS PHRASE ARGUMENTS
3712section above. 3716section above.
3713.It Fl out Ar filename 3717.It Fl out Ar file
3714This specifies the output 3718This specifies the output
3715.Ar filename 3719.Ar file
3716to write a key to or standard output by default. 3720to write a key to or standard output by default.
3717If any encryption options are set then a pass phrase will be prompted for. 3721If any encryption options are set then a pass phrase will be prompted for.
3718The output filename should 3722The output filename should
@@ -3907,14 +3911,14 @@ compatibility, several of the utilities use the old format at present.
3907.Bk -words 3911.Bk -words
3908.Op Fl export 3912.Op Fl export
3909.Op Fl chain 3913.Op Fl chain
3910.Op Fl inkey Ar filename 3914.Op Fl inkey Ar file
3911.Op Fl certfile Ar filename 3915.Op Fl certfile Ar file
3912.Op Fl CApath Ar directory 3916.Op Fl CApath Ar directory
3913.Op Fl CAfile Ar filename 3917.Op Fl CAfile Ar file
3914.Op Fl name Ar name 3918.Op Fl name Ar name
3915.Op Fl caname Ar name 3919.Op Fl caname Ar name
3916.Op Fl in Ar filename 3920.Op Fl in Ar file
3917.Op Fl out Ar filename 3921.Op Fl out Ar file
3918.Op Fl noout 3922.Op Fl noout
3919.Op Fl nomacver 3923.Op Fl nomacver
3920.Op Fl nocerts 3924.Op Fl nocerts
@@ -3959,14 +3963,14 @@ option
3959.Pq see below . 3963.Pq see below .
3960.Sh PKCS12 PARSING OPTIONS 3964.Sh PKCS12 PARSING OPTIONS
3961.Bl -tag -width "XXXX" 3965.Bl -tag -width "XXXX"
3962.It Fl in Ar filename 3966.It Fl in Ar file
3963This specifies the 3967This specifies the
3964.Ar filename 3968.Ar file
3965of the PKCS#12 file to be parsed. 3969of the PKCS#12 file to be parsed.
3966Standard input is used by default. 3970Standard input is used by default.
3967.It Fl out Ar filename 3971.It Fl out Ar file
3968The 3972The
3969.Ar filename 3973.Ar file
3970to write certificates and private keys to, standard output by default. 3974to write certificates and private keys to, standard output by default.
3971They are all written in 3975They are all written in
3972.Em PEM 3976.Em PEM
@@ -4024,14 +4028,14 @@ PKCS#12 files unreadable.
4024.It Fl export 4028.It Fl export
4025This option specifies that a PKCS#12 file will be created rather than 4029This option specifies that a PKCS#12 file will be created rather than
4026parsed. 4030parsed.
4027.It Fl out Ar filename 4031.It Fl out Ar file
4028This specifies 4032This specifies
4029.Ar filename 4033.Ar file
4030to write the PKCS#12 file to. 4034to write the PKCS#12 file to.
4031Standard output is used by default. 4035Standard output is used by default.
4032.It Fl in Ar filename 4036.It Fl in Ar file
4033The 4037The
4034.Ar filename 4038.Ar file
4035to read certificates and private keys from, standard input by default. 4039to read certificates and private keys from, standard input by default.
4036They must all be in 4040They must all be in
4037.Em PEM 4041.Em PEM
@@ -4040,7 +4044,7 @@ The order doesn't matter but one private key and its corresponding
4040certificate should be present. 4044certificate should be present.
4041If additional certificates are present, they will also be included 4045If additional certificates are present, they will also be included
4042in the PKCS#12 file. 4046in the PKCS#12 file.
4043.It Fl inkey Ar filename 4047.It Fl inkey Ar file
4044File to read private key from. 4048File to read private key from.
4045If not present then a private key must be present in the input file. 4049If not present then a private key must be present in the input file.
4046.It Fl name Ar friendlyname 4050.It Fl name Ar friendlyname
@@ -4048,12 +4052,12 @@ This specifies the
4048.Qq friendly name 4052.Qq friendly name
4049for the certificate and private key. 4053for the certificate and private key.
4050This name is typically displayed in list boxes by software importing the file. 4054This name is typically displayed in list boxes by software importing the file.
4051.It Fl certfile Ar filename 4055.It Fl certfile Ar file
4052A filename to read additional certificates from. 4056A file to read additional certificates from.
4053.It Fl CApath Ar directory 4057.It Fl CApath Ar directory
4054Directory of CAs 4058Directory of CAs
4055.Pq PEM format . 4059.Pq PEM format .
4056.It Fl CAfile Ar filename 4060.It Fl CAfile Ar file
4057File of CAs 4061File of CAs
4058.Pq PEM format . 4062.Pq PEM format .
4059.It Fl caname Ar friendlyname 4063.It Fl caname Ar friendlyname
@@ -4334,9 +4338,9 @@ The engine will then be set as the default for all available algorithms.
4334.Bk -words 4338.Bk -words
4335.Op Fl inform Ar DER | PEM 4339.Op Fl inform Ar DER | PEM
4336.Op Fl outform Ar DER | PEM 4340.Op Fl outform Ar DER | PEM
4337.Op Fl in Ar filename 4341.Op Fl in Ar file
4338.Op Fl passin Ar arg 4342.Op Fl passin Ar arg
4339.Op Fl out Ar filename 4343.Op Fl out Ar file
4340.Op Fl passout Ar arg 4344.Op Fl passout Ar arg
4341.Op Fl text 4345.Op Fl text
4342.Op Fl pubkey 4346.Op Fl pubkey
@@ -4357,11 +4361,11 @@ The engine will then be set as the default for all available algorithms.
4357.Oc 4361.Oc
4358.Op Fl nodes 4362.Op Fl nodes
4359.Op Fl subject 4363.Op Fl subject
4360.Op Fl key Ar filename 4364.Op Fl key Ar file
4361.Op Fl keyform Ar DER | PEM 4365.Op Fl keyform Ar DER | PEM
4362.Op Fl keyout Ar filename 4366.Op Fl keyout Ar file
4363.Op Fl md5 | sha1 | md2 | md4 4367.Op Fl md5 | sha1 | md2 | md4
4364.Op Fl config Ar filename 4368.Op Fl config Ar file
4365.Op Fl subj Ar arg 4369.Op Fl subj Ar arg
4366.Op Fl x509 4370.Op Fl x509
4367.Op Fl days Ar n 4371.Op Fl days Ar n
@@ -4401,9 +4405,9 @@ footer lines.
4401This specifies the output format; the options have the same meaning as the 4405This specifies the output format; the options have the same meaning as the
4402.Fl inform 4406.Fl inform
4403option. 4407option.
4404.It Fl in Ar filename 4408.It Fl in Ar file
4405This specifies the input 4409This specifies the input
4406.Ar filename 4410.Ar file
4407to read a request from, or standard input 4411to read a request from, or standard input
4408if this option is not specified. 4412if this option is not specified.
4409A request is only read if the creation options 4413A request is only read if the creation options
@@ -4418,9 +4422,9 @@ For more information about the format of
4418see the 4422see the
4419.Sx PASS PHRASE ARGUMENTS 4423.Sx PASS PHRASE ARGUMENTS
4420section above. 4424section above.
4421.It Fl out Ar filename 4425.It Fl out Ar file
4422This specifies the output 4426This specifies the output
4423.Ar filename 4427.Ar file
4424to write to, or standard output by default. 4428to write to, or standard output by default.
4425.It Fl passout Ar arg 4429.It Fl passout Ar arg
4426The output file password source. 4430The output file password source.
@@ -4465,10 +4469,10 @@ where
4465is the number of bits, generates an RSA key 4469is the number of bits, generates an RSA key
4466.Ar nbits 4470.Ar nbits
4467in size. 4471in size.
4468.Ar dsa : Ns Ar filename 4472.Ar dsa : Ns Ar file
4469generates a DSA key using the parameters in the file 4473generates a DSA key using the parameters in the file
4470.Ar filename . 4474.Ar file .
4471.It Fl key Ar filename 4475.It Fl key Ar file
4472This specifies the file to read the private key from. 4476This specifies the file to read the private key from.
4473It also accepts PKCS#8 format private keys for 4477It also accepts PKCS#8 format private keys for
4474.Em PEM 4478.Em PEM
@@ -4479,9 +4483,9 @@ The format of the private key file specified in the
4479argument. 4483argument.
4480.Ar PEM 4484.Ar PEM
4481is the default. 4485is the default.
4482.It Fl keyout Ar filename 4486.It Fl keyout Ar file
4483This gives the 4487This gives the
4484.Ar filename 4488.Ar file
4485to write the newly created private key to. 4489to write the newly created private key to.
4486If this option is not specified, then the filename present in the 4490If this option is not specified, then the filename present in the
4487configuration file is used. 4491configuration file is used.
@@ -4494,7 +4498,7 @@ Output the request's subject.
4494This specifies the message digest to sign the request with. 4498This specifies the message digest to sign the request with.
4495This overrides the digest algorithm specified in the configuration file. 4499This overrides the digest algorithm specified in the configuration file.
4496This option is ignored for DSA requests: they always use SHA1. 4500This option is ignored for DSA requests: they always use SHA1.
4497.It Fl config Ar filename 4501.It Fl config Ar file
4498This allows an alternative configuration file to be specified; 4502This allows an alternative configuration file to be specified;
4499this overrides the compile time filename or any specified in 4503this overrides the compile time filename or any specified in
4500the 4504the
@@ -4628,7 +4632,7 @@ It can be overridden by using the
4628.Fl newkey 4632.Fl newkey
4629option. 4633option.
4630.It Ar default_keyfile 4634.It Ar default_keyfile
4631This is the default filename to write a private key to. 4635This is the default file to write a private key to.
4632If not specified, the key is written to standard output. 4636If not specified, the key is written to standard output.
4633This can be overridden by the 4637This can be overridden by the
4634.Fl keyout 4638.Fl keyout
@@ -4647,7 +4651,7 @@ object identifier followed by
4647and the numerical form. 4651and the numerical form.
4648The short and long names are the same when this option is used. 4652The short and long names are the same when this option is used.
4649.It Ar RANDFILE 4653.It Ar RANDFILE
4650This specifies a filename in which random number seed information is 4654This specifies a file in which random number seed information is
4651placed and read from, or an EGD socket (see 4655placed and read from, or an EGD socket (see
4652.Xr RAND_egd 3 ) . 4656.Xr RAND_egd 3 ) .
4653It is used for private key generation. 4657It is used for private key generation.
@@ -5062,9 +5066,9 @@ should be input by the user.
5062.Bk -words 5066.Bk -words
5063.Op Fl inform Ar DER | NET | PEM 5067.Op Fl inform Ar DER | NET | PEM
5064.Op Fl outform Ar DER | NET | PEM 5068.Op Fl outform Ar DER | NET | PEM
5065.Op Fl in Ar filename 5069.Op Fl in Ar file
5066.Op Fl passin Ar arg 5070.Op Fl passin Ar arg
5067.Op Fl out Ar filename 5071.Op Fl out Ar file
5068.Op Fl passout Ar arg 5072.Op Fl passout Ar arg
5069.Op Fl sgckey 5073.Op Fl sgckey
5070.Oo 5074.Oo
@@ -5116,9 +5120,9 @@ section.
5116This specifies the output format; the options have the same meaning as the 5120This specifies the output format; the options have the same meaning as the
5117.Fl inform 5121.Fl inform
5118option. 5122option.
5119.It Fl in Ar filename 5123.It Fl in Ar file
5120This specifies the input 5124This specifies the input
5121.Ar filename 5125.Ar file
5122to read a key from or standard input if this 5126to read a key from or standard input if this
5123option is not specified. 5127option is not specified.
5124If the key is encrypted, a pass phrase will be prompted for. 5128If the key is encrypted, a pass phrase will be prompted for.
@@ -5129,9 +5133,9 @@ For more information about the format of
5129see the 5133see the
5130.Sx PASS PHRASE ARGUMENTS 5134.Sx PASS PHRASE ARGUMENTS
5131section above. 5135section above.
5132.It Fl out Ar filename 5136.It Fl out Ar file
5133This specifies the output 5137This specifies the output
5134.Ar filename 5138.Ar file
5135to write a key to, or standard output if this option is not specified. 5139to write a key to, or standard output if this option is not specified.
5136If any encryption options are set then, a pass phrase will be prompted for. 5140If any encryption options are set then, a pass phrase will be prompted for.
5137The output filename should 5141The output filename should
@@ -5289,14 +5293,14 @@ data using the RSA algorithm.
5289.Pp 5293.Pp
5290The options are as follows: 5294The options are as follows:
5291.Bl -tag -width "XXXX" 5295.Bl -tag -width "XXXX"
5292.It Fl in Ar filename 5296.It Fl in Ar file
5293This specifies the input 5297This specifies the input
5294.Ar filename 5298.Ar file
5295to read data from or standard input 5299to read data from or standard input
5296if this option is not specified. 5300if this option is not specified.
5297.It Fl out Ar filename 5301.It Fl out Ar file
5298Specifies the output 5302Specifies the output
5299.Ar filename 5303.Ar file
5300to write to or standard output by 5304to write to or standard output by
5301default. 5305default.
5302.It Fl inkey Ar file 5306.It Fl inkey Ar file
@@ -5451,10 +5455,10 @@ which it can be seen agrees with the recovered value above.
5451.Fl connect Ar host : Ns Ar port 5455.Fl connect Ar host : Ns Ar port
5452.Oc 5456.Oc
5453.Op Fl verify Ar depth 5457.Op Fl verify Ar depth
5454.Op Fl cert Ar filename 5458.Op Fl cert Ar file
5455.Op Fl key Ar filename 5459.Op Fl key Ar file
5456.Op Fl CApath Ar directory 5460.Op Fl CApath Ar directory
5457.Op Fl CAfile Ar filename 5461.Op Fl CAfile Ar file
5458.Op Fl reconnect 5462.Op Fl reconnect
5459.Op Fl pause 5463.Op Fl pause
5460.Op Fl showcerts 5464.Op Fl showcerts
@@ -5713,11 +5717,11 @@ We should really report information whenever a session is renegotiated.
5713.Op Fl context Ar id 5717.Op Fl context Ar id
5714.Op Fl verify Ar depth 5718.Op Fl verify Ar depth
5715.Op Fl Verify Ar depth 5719.Op Fl Verify Ar depth
5716.Op Fl cert Ar filename 5720.Op Fl cert Ar file
5717.Op Fl key Ar keyfile 5721.Op Fl key Ar keyfile
5718.Op Fl dcert Ar filename 5722.Op Fl dcert Ar file
5719.Op Fl dkey Ar keyfile 5723.Op Fl dkey Ar keyfile
5720.Op Fl dhparam Ar filename 5724.Op Fl dhparam Ar file
5721.Op Fl nbio 5725.Op Fl nbio
5722.Op Fl nbio_test 5726.Op Fl nbio_test
5723.Op Fl crlf 5727.Op Fl crlf
@@ -5725,7 +5729,7 @@ We should really report information whenever a session is renegotiated.
5725.Op Fl msg 5729.Op Fl msg
5726.Op Fl state 5730.Op Fl state
5727.Op Fl CApath Ar directory 5731.Op Fl CApath Ar directory
5728.Op Fl CAfile Ar filename 5732.Op Fl CAfile Ar file
5729.Op Fl nocert 5733.Op Fl nocert
5730.Op Fl cipher Ar cipherlist 5734.Op Fl cipher Ar cipherlist
5731.Op Fl serverpref 5735.Op Fl serverpref
@@ -5770,13 +5774,13 @@ certificate and some require a certificate with a certain public key type:
5770for example the DSS cipher suites require a certificate containing a DSS 5774for example the DSS cipher suites require a certificate containing a DSS
5771.Pq DSA 5775.Pq DSA
5772key. 5776key.
5773If not specified, then the filename 5777If not specified, then the file
5774.Pa server.pem 5778.Pa server.pem
5775will be used. 5779will be used.
5776.It Fl key Ar keyfile 5780.It Fl key Ar keyfile
5777The private key to use. 5781The private key to use.
5778If not specified, then the certificate file will be used. 5782If not specified, then the certificate file will be used.
5779.It Fl dcert Ar filename , Fl dkey Ar keyname 5783.It Fl dcert Ar file , Fl dkey Ar keyname
5780Specify an additional certificate and private key; these behave in the 5784Specify an additional certificate and private key; these behave in the
5781same manner as the 5785same manner as the
5782.Fl cert 5786.Fl cert
@@ -5797,7 +5801,7 @@ by using an appropriate certificate.
5797If this option is set, then no certificate is used. 5801If this option is set, then no certificate is used.
5798This restricts the cipher suites available to the anonymous ones 5802This restricts the cipher suites available to the anonymous ones
5799.Pq currently just anonymous DH . 5803.Pq currently just anonymous DH .
5800.It Fl dhparam Ar filename 5804.It Fl dhparam Ar file
5801The DH parameter file to use. 5805The DH parameter file to use.
5802The ephemeral DH cipher suites generate keys 5806The ephemeral DH cipher suites generate keys
5803using a set of DH parameters. 5807using a set of DH parameters.
@@ -6005,8 +6009,8 @@ utility is currently undocumented.
6005.Bk -words 6009.Bk -words
6006.Op Fl inform Ar DER | PEM 6010.Op Fl inform Ar DER | PEM
6007.Op Fl outform Ar DER | PEM 6011.Op Fl outform Ar DER | PEM
6008.Op Fl in Ar filename 6012.Op Fl in Ar file
6009.Op Fl out Ar filename 6013.Op Fl out Ar file
6010.Op Fl text 6014.Op Fl text
6011.Op Fl cert 6015.Op Fl cert
6012.Op Fl noout 6016.Op Fl noout
@@ -6039,13 +6043,13 @@ format base64 encoded with additional header and footer lines.
6039This specifies the output format; the options have the same meaning as the 6043This specifies the output format; the options have the same meaning as the
6040.Fl inform 6044.Fl inform
6041option. 6045option.
6042.It Fl in Ar filename 6046.It Fl in Ar file
6043This specifies the input 6047This specifies the input
6044.Ar filename 6048.Ar file
6045to read session information from, or standard input by default. 6049to read session information from, or standard input by default.
6046.It Fl out Ar filename 6050.It Fl out Ar file
6047This specifies the output 6051This specifies the output
6048.Ar filename 6052.Ar file
6049to write session information to, or standard 6053to write session information to, or standard
6050output if this option is not specified. 6054output if this option is not specified.
6051.It Fl text 6055.It Fl text
@@ -6214,7 +6218,7 @@ Both clear text and opaque signing is supported.
6214Takes an input message and writes out a 6218Takes an input message and writes out a
6215.Em PEM 6219.Em PEM
6216encoded PKCS#7 structure. 6220encoded PKCS#7 structure.
6217.It Fl in Ar filename 6221.It Fl in Ar file
6218The input message to be encrypted or signed or the 6222The input message to be encrypted or signed or the
6219.Em MIME 6223.Em MIME
6220message to 6224message to
@@ -6237,7 +6241,7 @@ structure; if no PKCS#7 structure is being input (for example with
6237or 6241or
6238.Fl sign ) , 6242.Fl sign ) ,
6239this option has no effect. 6243this option has no effect.
6240.It Fl out Ar filename 6244.It Fl out Ar file
6241The message text that has been decrypted or verified, or the output 6245The message text that has been decrypted or verified, or the output
6242.Em MIME 6246.Em MIME
6243format message that has been signed or verified. 6247format message that has been signed or verified.
@@ -6259,7 +6263,7 @@ structure; if no PKCS#7 structure is being output (for example with
6259or 6263or
6260.Fl decrypt ) 6264.Fl decrypt )
6261this option has no effect. 6265this option has no effect.
6262.It Fl content Ar filename 6266.It Fl content Ar file
6263This specifies a file containing the detached content. 6267This specifies a file containing the detached content.
6264This is only useful with the 6268This is only useful with the
6265.Fl verify 6269.Fl verify
@@ -6673,8 +6677,8 @@ for all available algorithms.
6673.\" 6677.\"
6674.Sh SPKAC 6678.Sh SPKAC
6675.Nm openssl spkac 6679.Nm openssl spkac
6676.Op Fl in Ar filename 6680.Op Fl in Ar file
6677.Op Fl out Ar filename 6681.Op Fl out Ar file
6678.Op Fl key Ar keyfile 6682.Op Fl key Ar keyfile
6679.Op Fl passin Ar arg 6683.Op Fl passin Ar arg
6680.Op Fl challenge Ar string 6684.Op Fl challenge Ar string
@@ -6695,16 +6699,16 @@ produce its own SPKACs from a supplied private key.
6695.Pp 6699.Pp
6696The options are as follows: 6700The options are as follows:
6697.Bl -tag -width "XXXX" 6701.Bl -tag -width "XXXX"
6698.It Fl in Ar filename 6702.It Fl in Ar file
6699This specifies the input 6703This specifies the input
6700.Ar filename 6704.Ar file
6701to read from or standard input if this option is not specified. 6705to read from or standard input if this option is not specified.
6702Ignored if the 6706Ignored if the
6703.Fl key 6707.Fl key
6704option is used. 6708option is used.
6705.It Fl out Ar filename 6709.It Fl out Ar file
6706Specifies the output 6710Specifies the output
6707.Ar filename 6711.Ar file
6708to write to or standard output by default. 6712to write to or standard output by default.
6709.It Fl key Ar keyfile 6713.It Fl key Ar keyfile
6710Create an SPKAC file using the private key in 6714Create an SPKAC file using the private key in
@@ -6889,7 +6893,7 @@ This is useful if the first certificate filename begins with a
6889One or more 6893One or more
6890.Ar certificates 6894.Ar certificates
6891to verify. 6895to verify.
6892If no certificate filenames are included, then an attempt is made to read 6896If no certificate files are included, then an attempt is made to read
6893a certificate from standard input. 6897a certificate from standard input.
6894They should all be in 6898They should all be in
6895.Em PEM 6899.Em PEM
@@ -7196,8 +7200,8 @@ option was added in
7196.Op Fl keyform Ar DER | PEM 7200.Op Fl keyform Ar DER | PEM
7197.Op Fl CAform Ar DER | PEM 7201.Op Fl CAform Ar DER | PEM
7198.Op Fl CAkeyform Ar DER | PEM 7202.Op Fl CAkeyform Ar DER | PEM
7199.Op Fl in Ar filename 7203.Op Fl in Ar file
7200.Op Fl out Ar filename 7204.Op Fl out Ar file
7201.Op Fl passin Ar arg 7205.Op Fl passin Ar arg
7202.Op Fl serial 7206.Op Fl serial
7203.Op Fl hash 7207.Op Fl hash
@@ -7224,18 +7228,18 @@ option was added in
7224.Op Fl days Ar arg 7228.Op Fl days Ar arg
7225.Op Fl checkend Ar arg 7229.Op Fl checkend Ar arg
7226.Op Fl set_serial Ar n 7230.Op Fl set_serial Ar n
7227.Op Fl signkey Ar filename 7231.Op Fl signkey Ar file
7228.Op Fl x509toreq 7232.Op Fl x509toreq
7229.Op Fl req 7233.Op Fl req
7230.Op Fl CA Ar filename 7234.Op Fl CA Ar file
7231.Op Fl CAkey Ar filename 7235.Op Fl CAkey Ar file
7232.Op Fl CAcreateserial 7236.Op Fl CAcreateserial
7233.Op Fl CAserial Ar filename 7237.Op Fl CAserial Ar file
7234.Op Fl text 7238.Op Fl text
7235.Op Fl C 7239.Op Fl C
7236.Op Fl md2 | md5 | sha1 7240.Op Fl md2 | md5 | sha1
7237.Op Fl clrext 7241.Op Fl clrext
7238.Op Fl extfile Ar filename 7242.Op Fl extfile Ar file
7239.Op Fl extensions Ar section 7243.Op Fl extensions Ar section
7240.Op Fl engine Ar id 7244.Op Fl engine Ar id
7241.Ek 7245.Ek
@@ -7271,13 +7275,13 @@ obsolete.
7271This specifies the output format; the options have the same meaning as the 7275This specifies the output format; the options have the same meaning as the
7272.Fl inform 7276.Fl inform
7273option. 7277option.
7274.It Fl in Ar filename 7278.It Fl in Ar file
7275This specifies the input 7279This specifies the input
7276.Ar filename 7280.Ar file
7277to read a certificate from or standard input if this option is not specified. 7281to read a certificate from or standard input if this option is not specified.
7278.It Fl out Ar filename 7282.It Fl out Ar file
7279This specifies the output 7283This specifies the output
7280.Ar filename 7284.Ar file
7281to write to or standard output by default. 7285to write to or standard output by default.
7282.It Fl passin Ar arg 7286.It Fl passin Ar arg
7283The key password source. 7287The key password source.
@@ -7472,7 +7476,7 @@ utility can be used to sign certificates and requests: it
7472can thus behave like a 7476can thus behave like a
7473.Qq mini CA . 7477.Qq mini CA .
7474.Bl -tag -width "XXXX" 7478.Bl -tag -width "XXXX"
7475.It Fl signkey Ar filename 7479.It Fl signkey Ar file
7476This option causes the input file to be self-signed using the supplied 7480This option causes the input file to be self-signed using the supplied
7477private key. 7481private key.
7478.Pp 7482.Pp
@@ -7542,7 +7546,7 @@ options) is not used.
7542The serial number can be decimal or hex (if preceded by 7546The serial number can be decimal or hex (if preceded by
7543.Sq 0x ) . 7547.Sq 0x ) .
7544Negative serial numbers can also be specified but their use is not recommended. 7548Negative serial numbers can also be specified but their use is not recommended.
7545.It Fl CA Ar filename 7549.It Fl CA Ar file
7546Specifies the CA certificate to be used for signing. 7550Specifies the CA certificate to be used for signing.
7547When this option is present, 7551When this option is present,
7548.Nm x509 7552.Nm x509
@@ -7558,11 +7562,11 @@ option.
7558Without the 7562Without the
7559.Fl req 7563.Fl req
7560option, the input is a certificate which must be self-signed. 7564option, the input is a certificate which must be self-signed.
7561.It Fl CAkey Ar filename 7565.It Fl CAkey Ar file
7562Sets the CA private key to sign a certificate with. 7566Sets the CA private key to sign a certificate with.
7563If this option is not specified, then it is assumed that the CA private key 7567If this option is not specified, then it is assumed that the CA private key
7564is present in the CA certificate file. 7568is present in the CA certificate file.
7565.It Fl CAserial Ar filename 7569.It Fl CAserial Ar file
7566Sets the CA serial number file to use. 7570Sets the CA serial number file to use.
7567.Pp 7571.Pp
7568When the 7572When the
@@ -7591,7 +7595,7 @@ as its serial number.
7591Normally, if the 7595Normally, if the
7592.Fl CA 7596.Fl CA
7593option is specified and the serial number file does not exist, it is an error. 7597option is specified and the serial number file does not exist, it is an error.
7594.It Fl extfile Ar filename 7598.It Fl extfile Ar file
7595File containing certificate extensions to use. 7599File containing certificate extensions to use.
7596If not specified, then no extensions are added to the certificate. 7600If not specified, then no extensions are added to the certificate.
7597.It Fl extensions Ar section 7601.It Fl extensions Ar section
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-24 22:00:10 +0000