summaryrefslogtreecommitdiff
path: root/src/usr.bin/openssl/openssl.1
diff options
context:
space:
mode:
Diffstat (limited to 'src/usr.bin/openssl/openssl.1')
-rw-r--r--src/usr.bin/openssl/openssl.16827
1 files changed, 0 insertions, 6827 deletions
diff --git a/src/usr.bin/openssl/openssl.1 b/src/usr.bin/openssl/openssl.1
deleted file mode 100644
index a095c01f0a..0000000000
--- a/src/usr.bin/openssl/openssl.1
+++ /dev/null
@@ -1,6827 +0,0 @@
1.\" $OpenBSD: openssl.1,v 1.163 2025/04/14 08:40:10 tb Exp $
2.\" ====================================================================
3.\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\"
9.\" 1. Redistributions of source code must retain the above copyright
10.\" notice, this list of conditions and the following disclaimer.
11.\"
12.\" 2. Redistributions in binary form must reproduce the above copyright
13.\" notice, this list of conditions and the following disclaimer in
14.\" the documentation and/or other materials provided with the
15.\" distribution.
16.\"
17.\" 3. All advertising materials mentioning features or use of this
18.\" software must display the following acknowledgment:
19.\" "This product includes software developed by the OpenSSL Project
20.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
21.\"
22.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23.\" endorse or promote products derived from this software without
24.\" prior written permission. For written permission, please contact
25.\" openssl-core@openssl.org.
26.\"
27.\" 5. Products derived from this software may not be called "OpenSSL"
28.\" nor may "OpenSSL" appear in their names without prior written
29.\" permission of the OpenSSL Project.
30.\"
31.\" 6. Redistributions of any form whatsoever must retain the following
32.\" acknowledgment:
33.\" "This product includes software developed by the OpenSSL Project
34.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
35.\"
36.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47.\" OF THE POSSIBILITY OF SUCH DAMAGE.
48.\" ====================================================================
49.\"
50.\" This product includes cryptographic software written by Eric Young
51.\" (eay@cryptsoft.com). This product includes software written by Tim
52.\" Hudson (tjh@cryptsoft.com).
53.\"
54.\"
55.\" Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
56.\" All rights reserved.
57.\"
58.\" This package is an SSL implementation written
59.\" by Eric Young (eay@cryptsoft.com).
60.\" The implementation was written so as to conform with Netscapes SSL.
61.\"
62.\" This library is free for commercial and non-commercial use as long as
63.\" the following conditions are aheared to. The following conditions
64.\" apply to all code found in this distribution, be it the RC4, RSA,
65.\" lhash, DES, etc., code; not just the SSL code. The SSL documentation
66.\" included with this distribution is covered by the same copyright terms
67.\" except that the holder is Tim Hudson (tjh@cryptsoft.com).
68.\"
69.\" Copyright remains Eric Young's, and as such any Copyright notices in
70.\" the code are not to be removed.
71.\" If this package is used in a product, Eric Young should be given attribution
72.\" as the author of the parts of the library used.
73.\" This can be in the form of a textual message at program startup or
74.\" in documentation (online or textual) provided with the package.
75.\"
76.\" Redistribution and use in source and binary forms, with or without
77.\" modification, are permitted provided that the following conditions
78.\" are met:
79.\" 1. Redistributions of source code must retain the copyright
80.\" notice, this list of conditions and the following disclaimer.
81.\" 2. Redistributions in binary form must reproduce the above copyright
82.\" notice, this list of conditions and the following disclaimer in the
83.\" documentation and/or other materials provided with the distribution.
84.\" 3. All advertising materials mentioning features or use of this software
85.\" must display the following acknowledgement:
86.\" "This product includes cryptographic software written by
87.\" Eric Young (eay@cryptsoft.com)"
88.\" The word 'cryptographic' can be left out if the rouines from the library
89.\" being used are not cryptographic related :-).
90.\" 4. If you include any Windows specific code (or a derivative thereof) from
91.\" the apps directory (application code) you must include an
92.\" acknowledgement:
93.\" "This product includes software written by Tim Hudson
94.\" (tjh@cryptsoft.com)"
95.\"
96.\" THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
97.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
98.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
99.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
100.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
101.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
102.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
103.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
104.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
105.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
106.\" SUCH DAMAGE.
107.\"
108.\" The licence and distribution terms for any publically available version or
109.\" derivative of this code cannot be changed. i.e. this code cannot simply be
110.\" copied and put under another distribution licence
111.\" [including the GNU Public Licence.]
112.\"
113.Dd $Mdocdate: April 14 2025 $
114.Dt OPENSSL 1
115.Os
116.Sh NAME
117.Nm openssl
118.Nd OpenSSL command line tool
119.Sh SYNOPSIS
120.Nm
121.Ar command
122.Op Ar command_opt ...
123.Op Ar command_arg ...
124.Pp
125.Nm
126.Cm list-standard-commands |
127.Cm list-message-digest-commands |
128.Cm list-cipher-commands |
129.Cm list-cipher-algorithms |
130.Cm list-message-digest-algorithms |
131.Cm list-public-key-algorithms
132.Pp
133.Nm
134.Cm no- Ns Ar command
135.Sh DESCRIPTION
136.Nm OpenSSL
137is a cryptography toolkit implementing the
138Transport Layer Security
139.Pq TLS
140network protocol,
141as well as related cryptography standards.
142.Pp
143The
144.Nm
145program is a command line tool for using the various
146cryptography functions of
147.Nm openssl Ns 's
148crypto library from the shell.
149.Pp
150The pseudo-commands
151.Cm list-standard-commands , list-message-digest-commands ,
152and
153.Cm list-cipher-commands
154output a list
155.Pq one entry per line
156of the names of all standard commands, message digest commands,
157or cipher commands, respectively, that are available in the present
158.Nm
159utility.
160.Pp
161The pseudo-commands
162.Cm list-cipher-algorithms
163and
164.Cm list-message-digest-algorithms
165list all cipher and message digest names,
166one entry per line.
167Aliases are listed as:
168.Pp
169.D1 from => to
170.Pp
171The pseudo-command
172.Cm list-public-key-algorithms
173lists all supported public key algorithms.
174.Pp
175The pseudo-command
176.Cm no- Ns Ar command
177tests whether a command of the
178specified name is available.
179If
180.Ar command
181does not exist,
182it returns 0
183and prints
184.Cm no- Ns Ar command ;
185otherwise it returns 1 and prints
186.Ar command .
187In both cases, the output goes to stdout and nothing is printed to stderr.
188Additional command line arguments are always ignored.
189Since for each cipher there is a command of the same name,
190this provides an easy way for shell scripts to test for the
191availability of ciphers in the
192.Nm
193program.
194.Pp
195.Sy Note :
196.Cm no- Ns Ar command
197is not able to detect pseudo-commands such as
198.Cm quit ,
199.Cm list- Ns Ar ... Ns Cm -commands ,
200or
201.Cm no- Ns Ar command
202itself.
203.Tg asn1parse
204.Sh ASN1PARSE
205.Bl -hang -width "openssl asn1parse"
206.It Nm openssl asn1parse
207.Bk -words
208.Op Fl i
209.Op Fl dlimit Ar number
210.Op Fl dump
211.Op Fl genconf Ar file
212.Op Fl genstr Ar str
213.Op Fl in Ar file
214.Op Fl inform Cm der | pem | txt
215.Op Fl length Ar number
216.Op Fl noout
217.Op Fl offset Ar number
218.Op Fl oid Ar file
219.Op Fl out Ar file
220.Op Fl strparse Ar offset
221.Ek
222.El
223.Pp
224The
225.Nm asn1parse
226command is a diagnostic utility that can parse ASN.1 structures.
227It can also be used to extract data from ASN.1 formatted data.
228.Pp
229The options are as follows:
230.Bl -tag -width Ds
231.It Fl dlimit Ar number
232Dump the first
233.Ar number
234bytes of unknown data in hex form.
235.It Fl dump
236Dump unknown data in hex form.
237.It Fl genconf Ar file , Fl genstr Ar str
238Generate encoded data based on string
239.Ar str ,
240file
241.Ar file ,
242or both, using the format described in
243.Xr ASN1_generate_nconf 3 .
244If only
245.Ar file
246is present then the string is obtained from the default section
247using the name
248.Dq asn1 .
249The encoded data is passed through the ASN.1 parser and printed out as
250though it came from a file;
251the contents can thus be examined and written to a file using the
252.Fl out
253option.
254.It Fl i
255Indent the output according to the
256.Qq depth
257of the structures.
258.It Fl in Ar file
259The input file to read from, or standard input if not specified.
260.It Fl inform Cm der | pem | txt
261The input format.
262.It Fl length Ar number
263Number of bytes to parse; the default is until end of file.
264.It Fl noout
265Do not output the parsed version of the input file.
266.It Fl offset Ar number
267Starting offset to begin parsing; the default is start of file.
268.It Fl oid Ar file
269A file containing additional object identifiers
270.Pq OIDs .
271If an OID
272.Pq object identifier
273is not part of
274.Nm openssl Ns 's
275internal table, it will be represented in
276numerical form
277.Pq for example 1.2.3.4 .
278.Pp
279Each line consists of three columns:
280the first column is the OID in numerical format and should be followed by
281whitespace.
282The second column is the
283.Qq short name ,
284which is a single word followed by whitespace.
285The final column is the rest of the line and is the
286.Qq long name .
287.Nm asn1parse
288displays the long name.
289.It Fl out Ar file
290The DER-encoded output file; the default is no encoded output
291(useful when combined with
292.Fl strparse ) .
293.It Fl strparse Ar offset
294Parse the content octets of the ASN.1 object starting at
295.Ar offset .
296This option can be used multiple times to
297.Qq drill down
298into a nested structure.
299.El
300.Tg ca
301.Sh CA
302.Bl -hang -width "openssl ca"
303.It Nm openssl ca
304.Bk -words
305.Op Fl batch
306.Op Fl cert Ar file
307.Op Fl config Ar file
308.Op Fl create_serial
309.Op Fl crl_CA_compromise Ar time
310.Op Fl crl_compromise Ar time
311.Op Fl crl_hold Ar instruction
312.Op Fl crl_reason Ar reason
313.Op Fl crldays Ar days
314.Op Fl crlexts Ar section
315.Op Fl crlhours Ar hours
316.Op Fl crlsec Ar seconds
317.Op Fl days Ar arg
318.Op Fl enddate Ar date
319.Op Fl extensions Ar section
320.Op Fl extfile Ar file
321.Op Fl gencrl
322.Op Fl in Ar file
323.Op Fl infiles
324.Op Fl key Ar password
325.Op Fl keyfile Ar file
326.Op Fl keyform Cm pem | der
327.Op Fl md Ar alg
328.Op Fl multivalue-rdn
329.Op Fl name Ar section
330.Op Fl noemailDN
331.Op Fl notext
332.Op Fl out Ar file
333.Op Fl outdir Ar directory
334.Op Fl passin Ar arg
335.Op Fl policy Ar arg
336.Op Fl preserveDN
337.Op Fl revoke Ar file
338.Op Fl selfsign
339.Op Fl sigopt Ar nm:v
340.Op Fl ss_cert Ar file
341.Op Fl startdate Ar date
342.Op Fl status Ar serial
343.Op Fl subj Ar arg
344.Op Fl updatedb
345.Op Fl utf8
346.Op Fl verbose
347.Ek
348.El
349.Pp
350The
351.Nm ca
352command is a minimal certificate authority (CA) application.
353It can be used to sign certificate requests in a variety of forms
354and generate certificate revocation lists (CRLs).
355It also maintains a text database of issued certificates and their status.
356.Pp
357The options relevant to CAs are as follows:
358.Bl -tag -width "XXXX"
359.It Fl batch
360Batch mode.
361In this mode no questions will be asked
362and all certificates will be certified automatically.
363.It Fl cert Ar file
364The CA certificate file.
365.It Fl config Ar file
366Specify an alternative configuration file.
367.It Fl create_serial
368If reading the serial from the text file as specified in the
369configuration fails, create a new random serial to be used as the
370next serial number.
371.It Fl days Ar arg
372The number of days to certify the certificate for.
373.It Fl enddate Ar date
374Set the expiry date.
375The format of the date is [YY]YYMMDDHHMMSSZ,
376with all four year digits required for dates from 2050 onwards.
377.It Fl extensions Ar section
378The section of the configuration file containing certificate extensions
379to be added when a certificate is issued (defaults to
380.Cm x509_extensions
381unless the
382.Fl extfile
383option is used).
384If no extension section is present, a V1 certificate is created.
385If the extension section is present
386.Pq even if it is empty ,
387then a V3 certificate is created.
388See the
389.Xr x509v3.cnf 5
390manual page for details of the extension section format.
391.It Fl extfile Ar file
392An additional configuration
393.Ar file
394to read certificate extensions from
395(using the default section unless the
396.Fl extensions
397option is also used).
398.It Fl in Ar file
399An input
400.Ar file
401containing a single certificate request to be signed by the CA.
402.It Fl infiles
403If present, this should be the last option; all subsequent arguments
404are assumed to be the names of files containing certificate requests.
405.It Fl key Ar password
406The
407.Fa password
408used to encrypt the private key.
409Since on some systems the command line arguments are visible,
410this option should be used with caution.
411.It Fl keyfile Ar file
412The private key to sign requests with.
413.It Fl keyform Cm pem | der
414Private key file format.
415The default is
416.Cm pem .
417.It Fl md Ar alg
418The message digest to use.
419Possible values include
420.Ar md5
421and
422.Ar sha1 .
423This option also applies to CRLs.
424.It Fl multivalue-rdn
425This option causes the
426.Fl subj
427argument to be interpreted with full support for multivalued RDNs,
428for example
429.Qq "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" .
430If
431.Fl multivalue-rdn
432is not used, the UID value is set to
433.Qq "123456+CN=John Doe" .
434.It Fl name Ar section
435Specifies the configuration file
436.Ar section
437to use (overrides
438.Cm default_ca
439in the
440.Cm ca
441section).
442.It Fl noemailDN
443The DN of a certificate can contain the EMAIL field if present in the
444request DN, however it is good policy just having the email set into
445the
446.Cm altName
447extension of the certificate.
448When this option is set, the EMAIL field is removed from the certificate's
449subject and set only in the, eventually present, extensions.
450The
451.Ar email_in_dn
452keyword can be used in the configuration file to enable this behaviour.
453.It Fl notext
454Don't output the text form of a certificate to the output file.
455.It Fl out Ar file
456The output file to output certificates to.
457The default is standard output.
458The certificate details will also be printed out to this file in
459PEM format.
460.It Fl outdir Ar directory
461The
462.Ar directory
463to output certificates to.
464The certificate will be written to a file consisting of the
465serial number in hex with
466.Qq .pem
467appended.
468.It Fl passin Ar arg
469The key password source.
470.It Fl policy Ar arg
471Define the CA
472.Qq policy
473to use.
474The policy section in the configuration file
475consists of a set of variables corresponding to certificate DN fields.
476The values may be one of
477.Qq match
478(the value must match the same field in the CA certificate),
479.Qq supplied
480(the value must be present), or
481.Qq optional
482(the value may be present).
483Any fields not mentioned in the policy section
484are silently deleted, unless the
485.Fl preserveDN
486option is set,
487but this can be regarded more of a quirk than intended behaviour.
488.It Fl preserveDN
489Normally, the DN order of a certificate is the same as the order of the
490fields in the relevant policy section.
491When this option is set, the order is the same as the request.
492This is largely for compatibility with the older IE enrollment control
493which would only accept certificates if their DNs matched the order of the
494request.
495This is not needed for Xenroll.
496.It Fl selfsign
497Indicates the issued certificates are to be signed with the key the
498certificate requests were signed with, given with
499.Fl keyfile .
500Certificate requests signed with a different key are ignored.
501If
502.Fl gencrl
503or
504.Fl ss_cert
505are given,
506.Fl selfsign
507is ignored.
508.Pp
509A consequence of using
510.Fl selfsign
511is that the self-signed certificate appears among the entries in
512the certificate database (see the configuration option
513.Cm database )
514and uses the same serial number counter as all other certificates
515signed with the self-signed certificate.
516.It Fl sigopt Ar nm:v
517Pass options to the signature algorithm during sign or certify operations.
518The names and values of these options are algorithm-specific.
519.It Fl ss_cert Ar file
520A single self-signed certificate to be signed by the CA.
521.It Fl startdate Ar date
522Set the start date.
523The format of the date is [YY]YYMMDDHHMMSSZ,
524with all four year digits required for dates from 2050 onwards.
525.It Fl subj Ar arg
526Supersedes the subject name given in the request.
527The
528.Ar arg
529must be formatted as
530.Sm off
531.Pf / Ar type0 Ns = Ar value0 Ns / Ar type 1 Ns = Ar value 1 Ns /
532.Ar type2 Ns = Ar ... ;
533.Sm on
534characters may be escaped by
535.Sq \e
536.Pq backslash ,
537no spaces are skipped.
538.It Fl utf8
539Interpret field values read from a terminal or obtained from a
540configuration file as UTF-8 strings.
541By default, they are interpreted as ASCII.
542.It Fl verbose
543Print extra details about the operations being performed.
544.El
545.Pp
546The options relevant to CRLs are as follows:
547.Bl -tag -width "XXXX"
548.It Fl crl_CA_compromise Ar time
549This is the same as
550.Fl crl_compromise ,
551except the revocation reason is set to CACompromise.
552.It Fl crl_compromise Ar time
553Set the revocation reason to keyCompromise and the compromise time to
554.Ar time .
555.Ar time
556should be in GeneralizedTime format, i.e. YYYYMMDDHHMMSSZ.
557.It Fl crl_hold Ar instruction
558Set the CRL revocation reason code to certificateHold and the hold
559instruction to
560.Ar instruction
561which must be an OID.
562Although any OID can be used, only holdInstructionNone
563(the use of which is discouraged by RFC 2459), holdInstructionCallIssuer or
564holdInstructionReject will normally be used.
565.It Fl crl_reason Ar reason
566Revocation reason, where
567.Ar reason
568is one of:
569unspecified, keyCompromise, CACompromise, affiliationChanged, superseded,
570cessationOfOperation, certificateHold or removeFromCRL.
571The matching of
572.Ar reason
573is case insensitive.
574Setting any revocation reason will make the CRL v2.
575In practice, removeFromCRL is not particularly useful because it is only used
576in delta CRLs which are not currently implemented.
577.It Fl crldays Ar days
578The number of days before the next CRL is due.
579This is the days from now to place in the CRL
580.Cm nextUpdate
581field.
582.It Fl crlexts Ar section
583The
584.Ar section
585of the configuration file containing CRL extensions to include.
586If no CRL extension section is present then a V1 CRL is created;
587if the CRL extension section is present
588(even if it is empty)
589then a V2 CRL is created.
590The CRL extensions specified are CRL extensions and not CRL entry extensions.
591It should be noted that some software can't handle V2 CRLs.
592See the
593.Xr x509v3.cnf 5
594manual page for details of the extension section format.
595.It Fl crlhours Ar hours
596The number of hours before the next CRL is due.
597.It Fl crlsec Ar seconds
598The number of seconds before the next CRL is due.
599.It Fl gencrl
600Generate a CRL based on information in the index file.
601.It Fl revoke Ar file
602A
603.Ar file
604containing a certificate to revoke.
605.It Fl status Ar serial
606Show the status of the certificate with serial number
607.Ar serial .
608.It Fl updatedb
609Update the database index to purge expired certificates.
610.El
611.Pp
612Many of the options can be set in the
613.Cm ca
614section of the configuration file
615(or in the default section of the configuration file),
616specified using
617.Cm default_ca
618or
619.Fl name .
620The
621.Cm preserve
622option is read directly from the
623.Cm ca
624section.
625.Pp
626Many of the configuration file options are identical to command line
627options.
628Where the option is present in the configuration file and the command line,
629the command line value is used.
630Where an option is described as mandatory, then it must be present in
631the configuration file or the command line equivalent
632.Pq if any
633used.
634.Bl -tag -width "XXXX"
635.It Cm certificate
636The same as
637.Fl cert .
638It gives the file containing the CA certificate.
639Mandatory.
640.It Cm copy_extensions
641Determines how extensions in certificate requests should be handled.
642If set to
643.Cm none
644or this option is not present, then extensions are
645ignored and not copied to the certificate.
646If set to
647.Cm copy ,
648then any extensions present in the request that are not already present
649are copied to the certificate.
650If set to
651.Cm copyall ,
652then all extensions in the request are copied to the certificate:
653if the extension is already present in the certificate it is deleted first.
654.Pp
655The
656.Cm copy_extensions
657option should be used with caution.
658If care is not taken, it can be a security risk.
659For example, if a certificate request contains a
660.Cm basicConstraints
661extension with CA:TRUE and the
662.Cm copy_extensions
663value is set to
664.Cm copyall
665and the user does not spot
666this when the certificate is displayed, then this will hand the requester
667a valid CA certificate.
668.Pp
669This situation can be avoided by setting
670.Cm copy_extensions
671to
672.Cm copy
673and including
674.Cm basicConstraints
675with CA:FALSE in the configuration file.
676Then if the request contains a
677.Cm basicConstraints
678extension, it will be ignored.
679.Pp
680The main use of this option is to allow a certificate request to supply
681values for certain extensions such as
682.Cm subjectAltName .
683.It Cm crl_extensions
684The same as
685.Fl crlexts .
686.It Cm crlnumber
687A text file containing the next CRL number to use in hex.
688The CRL number will be inserted in the CRLs only if this file exists.
689If this file is present, it must contain a valid CRL number.
690.It Cm database
691The text database file to use.
692Mandatory.
693This file must be present, though initially it will be empty.
694.It Cm default_crl_hours , default_crl_days
695The same as the
696.Fl crlhours
697and
698.Fl crldays
699options.
700These will only be used if neither command line option is present.
701At least one of these must be present to generate a CRL.
702.It Cm default_days
703The same as the
704.Fl days
705option.
706The number of days to certify a certificate for.
707.It Cm default_enddate
708The same as the
709.Fl enddate
710option.
711Either this option or
712.Cm default_days
713.Pq or the command line equivalents
714must be present.
715.It Cm default_md
716The same as the
717.Fl md
718option.
719The message digest to use.
720Mandatory.
721.It Cm default_startdate
722The same as the
723.Fl startdate
724option.
725The start date to certify a certificate for.
726If not set, the current time is used.
727.It Cm email_in_dn
728The same as
729.Fl noemailDN .
730If the EMAIL field is to be removed from the DN of the certificate,
731simply set this to
732.Qq no .
733If not present, the default is to allow for the EMAIL field in the
734certificate's DN.
735.It Cm name_opt , cert_opt
736These options allow the format used to display the certificate details
737when asking the user to confirm signing.
738All the options supported by the
739.Nm x509
740utilities'
741.Fl nameopt
742and
743.Fl certopt
744switches can be used here, except that
745.Cm no_signame
746and
747.Cm no_sigdump
748are permanently set and cannot be disabled
749(this is because the certificate signature cannot be displayed because
750the certificate has not been signed at this point).
751.Pp
752For convenience, the value
753.Cm ca_default
754is accepted by both to produce a reasonable output.
755.Pp
756If neither option is present, the format used in earlier versions of
757.Nm openssl
758is used.
759Use of the old format is strongly discouraged
760because it only displays fields mentioned in the
761.Cm policy
762section,
763mishandles multicharacter string types and does not display extensions.
764.It Cm new_certs_dir
765The same as the
766.Fl outdir
767command line option.
768It specifies the directory where new certificates will be placed.
769Mandatory.
770.It Cm oid_file
771This specifies a file containing additional object identifiers.
772Each line of the file should consist of the numerical form of the
773object identifier followed by whitespace, then the short name followed
774by whitespace and finally the long name.
775.It Cm oid_section
776This specifies a section in the configuration file containing extra
777object identifiers.
778Each line should consist of the short name of the object identifier
779followed by
780.Sq =
781and the numerical form.
782The short and long names are the same when this option is used.
783.It Cm policy
784The same as
785.Fl policy .
786Mandatory.
787.It Cm preserve
788The same as
789.Fl preserveDN .
790.It Cm private_key
791Same as the
792.Fl keyfile
793option.
794The file containing the CA private key.
795Mandatory.
796.It Cm serial
797A text file containing the next serial number to use in hex.
798Mandatory.
799This file must be present and contain a valid serial number.
800.It Cm unique_subject
801If the value
802.Cm yes
803is given, the valid certificate entries in the
804database must have unique subjects.
805If the value
806.Cm no
807is given,
808several valid certificate entries may have the exact same subject.
809The default value is
810.Cm yes .
811.Pp
812Note that it is valid in some circumstances for certificates to be created
813without any subject.
814In cases where there are multiple certificates without
815subjects this does not count as a duplicate.
816.It Cm x509_extensions
817The same as
818.Fl extensions .
819.El
820.Tg certhash
821.Sh CERTHASH
822.Bl -hang -width "openssl certhash"
823.It Nm openssl certhash
824.Bk -words
825.Op Fl nv
826.Ar dir ...
827.Ek
828.El
829.Pp
830The
831.Nm certhash
832command calculates a hash value of
833.Qq .pem
834file in the specified directory list and creates symbolic links for each file,
835where the name of the link is the hash value.
836See the
837.Xr SSL_CTX_load_verify_locations 3
838manual page for how hash links are used.
839.Pp
840The links created are of the form
841.Qq HHHHHHHH.D ,
842where each
843.Sq H
844is a hexadecimal character and
845.Sq D
846is a single decimal digit.
847The hashes for CRLs look similar, except the letter
848.Sq r
849appears after the period, like this:
850.Qq HHHHHHHH.rD .
851When processing a directory,
852.Nm certhash
853will first remove all links that have a name in that syntax and invalid
854reference.
855.Pp
856Multiple objects may have the same hash; they will be indicated by
857incrementing the
858.Sq D
859value.
860Duplicates are found by comparing the full SHA256 fingerprint.
861A warning will be displayed if a duplicate is found.
862.Pp
863A warning will also be displayed if there are files that cannot be parsed as
864either a certificate or a CRL.
865.Pp
866The options are as follows:
867.Bl -tag -width Ds
868.It Fl n
869Perform a dry-run, and do not make any changes.
870.It Fl v
871Print extra details about the processing.
872.It Ar dir ...
873Specify the directories to process.
874.El
875.Tg ciphers
876.Sh CIPHERS
877.Nm openssl ciphers
878.Op Fl hsVv
879.Op Fl tls1_2
880.Op Fl tls1_3
881.Op Ar control
882.Pp
883The
884.Nm ciphers
885command converts the
886.Ar control
887string from the format documented in
888.Xr SSL_CTX_set_cipher_list 3
889into an ordered SSL cipher suite preference list.
890If no
891.Ar control
892string is specified, the
893.Cm DEFAULT
894list is printed.
895.Pp
896The options are as follows:
897.Bl -tag -width Ds
898.It Fl h , \&?
899Print a brief usage message.
900.It Fl s
901Only list ciphers that are supported by the TLS method.
902.It Fl tls1_2 | tls1_3
903In combination with the
904.Fl s
905option, list the ciphers which could be used
906if the specified protocol version were negotiated.
907.It Fl V
908Verbose.
909List ciphers with cipher suite code in hex format,
910cipher name, and a complete description of protocol version,
911key exchange, authentication, encryption, and mac algorithms.
912.It Fl v
913Like
914.Fl V ,
915but without cipher suite codes.
916.El
917.Tg cms
918.Sh CMS
919.Bl -hang -width "openssl cms"
920.It Nm openssl cms
921.Bk -words
922.Oo
923.Fl aes128 | aes192 | aes256 | camellia128 |
924.Fl camellia192 | camellia256 | des | des3 |
925.Fl rc2-40 | rc2-64 | rc2-128
926.Oc
927.Op Fl CAfile Ar file
928.Op Fl CApath Ar directory
929.Op Fl CRLfile Ar file
930.Op Fl binary
931.Op Fl certfile Ar file
932.Op Fl certsout Ar file
933.Op Fl cmsout
934.Op Fl compress
935.Op Fl content Ar file
936.Op Fl crlfeol
937.Op Fl data_create
938.Op Fl data_out
939.Op Fl debug_decrypt
940.Op Fl decrypt
941.Op Fl digest_create
942.Op Fl digest_verify
943.Op Fl econtent_type Ar type
944.Op Fl encrypt
945.Op Fl EncryptedData_decrypt
946.Op Fl EncryptedData_encrypt
947.Op Fl from Ar addr
948.Op Fl in Ar file
949.Op Fl inform Cm der | pem | smime
950.Op Fl inkey Ar file
951.Op Fl keyform Cm der | pem
952.Op Fl keyid
953.Op Fl keyopt Ar nm:v
954.Op Fl md Ar digest
955.Op Fl no_attr_verify
956.Op Fl no_content_verify
957.Op Fl no_signer_cert_verify
958.Op Fl noattr
959.Op Fl nocerts
960.Op Fl nodetach
961.Op Fl nointern
962.Op Fl nooldmime
963.Op Fl noout
964.Op Fl nosigs
965.Op Fl nosmimecap
966.Op Fl noverify
967.Op Fl out Ar file
968.Op Fl outform Cm der | pem | smime
969.Op Fl passin Ar src
970.Op Fl print
971.Op Fl pwri_password Ar arg
972.Op Fl rctform Cm der | pem | smime
973.Op Fl receipt_request_all | receipt_request_first
974.Op Fl receipt_request_from Ar addr
975.Op Fl receipt_request_print
976.Op Fl receipt_request_to Ar addr
977.Op Fl recip Ar file
978.Op Fl resign
979.Op Fl secretkey Ar key
980.Op Fl secretkeyid Ar id
981.Op Fl sign
982.Op Fl sign_receipt
983.Op Fl signer Ar file
984.Op Fl stream | indef | noindef
985.Op Fl subject Ar s
986.Op Fl text
987.Op Fl to Ar addr
988.Op Fl uncompress
989.Op Fl verify
990.Op Fl verify_receipt Ar file
991.Op Fl verify_retcode
992.Op Ar cert.pem ...
993.Ek
994.El
995.Pp
996The
997.Nm cms
998command handles S/MIME v3.1 mail.
999It can encrypt, decrypt, sign and verify, compress and uncompress S/MIME
1000messages.
1001.Pp
1002The MIME message must be sent without any blank lines between the headers and
1003the output.
1004Some mail programs will automatically add a blank line.
1005Piping the mail directly to sendmail is one way to achieve the correct format.
1006.Pp
1007The supplied message to be signed or encrypted must include the necessary MIME
1008headers or many S/MIME clients won't display it properly (if at all).
1009You can use the
1010.Fl text
1011option to automatically add plain text headers.
1012.Pp
1013A "signed and encrypted" message is one where a signed message is then
1014encrypted.
1015This can be produced by encrypting an already signed message.
1016.Pp
1017There are various operation options that set the type of operation to be
1018performed.
1019The meaning of the other options varies according to the operation type.
1020.Bl -tag -width "XXXX"
1021.It Fl encrypt
1022Encrypt mail for the given recipient certificates.
1023Input file is the message to be encrypted.
1024The output file is the encrypted mail in MIME format.
1025The actual CMS type is EnvelopedData.
1026Note that no revocation check is done for the recipient cert, so if that
1027key has been compromised, others may be able to decrypt the text.
1028.It Fl decrypt
1029Decrypt mail using the supplied certificate and private key.
1030Expects an encrypted mail message in MIME format for the input file.
1031The decrypted mail is written to the output file.
1032.It Fl sign
1033Sign mail using the supplied certificate and private key.
1034Input file is the message to be signed.
1035The signed message in MIME format is written to the output file.
1036.It Fl verify
1037Verify signed mail.
1038Expects a signed mail message on input and outputs the signed data.
1039Both clear text and opaque signing are supported.
1040.It Fl cmsout
1041Take an input message and write out a PEM encoded CMS structure.
1042.It Fl resign
1043Resign a message.
1044Take an existing message and one or more new signers.
1045This operation uses an existing message digest when adding a new signer.
1046This means that attributes must be present in at least one existing
1047signer using the same message digest or this operation will fail.
1048.It Fl data_create
1049Create a CMS Data type.
1050.It Fl data_out
1051Output a content from the input CMS Data type.
1052.It Fl digest_create
1053Create a CMS DigestedData type.
1054.It Fl digest_verify
1055Verify a CMS DigestedData type and output the content.
1056.It Fl compress
1057Create a CMS CompressedData type.
1058Must be compiled with zlib support for this option to work.
1059.It Fl uncompress
1060Uncompress a CMS CompressedData type and output the content.
1061Must be compiled with zlib support for this option to work.
1062.It Fl EncryptedData_encrypt
1063Encrypt a content using supplied symmetric key and algorithm using a
1064CMS EncryptedData type.
1065.It Fl EncryptedData_decrypt
1066Decrypt a CMS EncryptedData type using supplied symmetric key.
1067.It Fl sign_receipt
1068Generate and output a signed receipt for the supplied message.
1069The input message must contain a signed receipt request.
1070Functionality is otherwise similar to the
1071.Fl sign
1072operation.
1073.It Xo
1074.Fl verify_receipt Ar file
1075.Xc
1076Verify a signed receipt in file.
1077The input message must contain the original receipt request.
1078Functionality is otherwise similar to the
1079.Fl verify
1080operation.
1081.El
1082.Pp
1083The remaining options are as follows:
1084.Bl -tag -width "XXXX"
1085.It Xo
1086.Fl aes128 | aes192 | aes256 | camellia128 |
1087.Fl camellia192 | camellia256 | des | des3 |
1088.Fl rc2-40 | rc2-64 | rc2-128
1089.Xc
1090The encryption algorithm to use.
1091128-, 192-, or 256-bit AES, 128-, 192-, or 256-bit CAMELLIA,
1092DES (56 bits), triple DES (168 bits),
1093or 40-, 64-, or 128-bit RC2, respectively;
1094if not specified, triple DES is
1095used.
1096Only used with
1097.Fl encrypt
1098and
1099.Fl EncryptedData_encrypt
1100commands.
1101.It Fl binary
1102Normally the input message is converted to "canonical" format which is
1103effectively using CR/LF as end of line, as required by the S/MIME specification.
1104When this option is present, no translation occurs.
1105This is useful when handling binary data which may not be in MIME format.
1106.It Fl CAfile Ar file
1107A file containing trusted CA certificates, used with
1108.Fl verify
1109and
1110.Fl verify_receipt .
1111.It Fl CApath Ar directory
1112A directory containing trusted CA certificates, used with
1113.Fl verify
1114and
1115.Fl verify_receipt .
1116This directory must be a standard certificate directory: that is a hash
1117of each subject name (using
1118.Nm x509 Fl hash )
1119should be linked to each certificate.
1120.It Fl CRLfile Ar file
1121Allows additional certificate revocation lists to be specified for verification.
1122The CRLs should be in PEM format.
1123.It Ar cert.pem ...
1124One or more certificates of message recipients: used when encrypting a message.
1125.It Fl certfile Ar file
1126Allows additional certificates to be specified.
1127When signing, these will be included with the message.
1128When verifying, these will be searched for the signer's certificates.
1129The certificates should be in PEM format.
1130.It Fl certsout Ar file
1131A file that any certificates contained in the message are written to.
1132.It Xo
1133.Fl check_ss_sig ,
1134.Fl crl_check ,
1135.Fl crl_check_all ,
1136.Fl extended_crl ,
1137.Fl ignore_critical ,
1138.Fl issuer_checks ,
1139.Fl policy ,
1140.Fl policy_check ,
1141.Fl purpose ,
1142.Fl x509_strict
1143.Xc
1144Set various certificate chain validation options.
1145See the
1146.Nm verify
1147command for details.
1148.It Fl content Ar file
1149A file containing the detached content.
1150This is only useful with the
1151.Fl verify
1152command.
1153This is only usable if the CMS structure is using the detached signature
1154form where the content is not included.
1155This option will override any content if the input format is S/MIME and
1156it uses the multipart/signed MIME content type.
1157.It Fl crlfeol
1158Output a S/MIME message with CR/LF end of line.
1159.It Fl debug_decrypt
1160Set the CMS_DEBUG_DECRYPT flag when decrypting.
1161This option should be used with caution, since this can be used to disable
1162the MMA attack protection and return an error if no recipient can be found.
1163See the
1164.Xr CMS_decrypt 3
1165manual page for details of the flag.
1166.It Xo
1167.Fl from Ar addr ,
1168.Fl subject Ar s ,
1169.Fl to Ar addr
1170.Xc
1171The relevant mail headers.
1172These are included outside the signed portion of a message so they may
1173be included manually.
1174If signing then many S/MIME mail clients check the signer's certificate's
1175email address matches that specified in the From: address.
1176.It Fl econtent_type Ar type
1177Set the encapsulated content type, used with
1178.Fl sign .
1179If not supplied, the Data type is used.
1180The type argument can be any valid OID name in either text or numerical format.
1181.It Fl in Ar file
1182The input message to be encrypted or signed or the message to be decrypted or
1183verified.
1184.It Fl inform Cm der | pem | smime
1185The input format for the CMS structure.
1186The default is
1187.Cm smime ,
1188which reads an S/MIME format message.
1189.Cm pem
1190and
1191.Cm der
1192format change this to expect PEM and DER format CMS structures instead.
1193This currently only affects the input format of the CMS structure; if no
1194CMS structure is being input (for example with
1195.Fl encrypt
1196or
1197.Fl sign )
1198this option has no effect.
1199.It Fl inkey Ar file
1200The private key to use when signing or decrypting.
1201This must match the corresponding certificate.
1202If this option is not specified then the private key must be included in
1203the certificate file specified with the
1204.Fl recip
1205or
1206.Fl signer
1207file.
1208When signing, this option can be used multiple times to specify successive keys.
1209.It Fl keyform Cm der | pem
1210Input private key format.
1211The default is
1212.Cm pem .
1213.It Fl keyid
1214Use subject key identifier to identify certificates instead of issuer
1215name and serial number.
1216The supplied certificate must include a subject key identifier extension.
1217Supported by
1218.Fl sign
1219and
1220.Fl encrypt
1221operations.
1222.It Fl keyopt Ar nm:v
1223Set customised parameters for the preceding key or certificate
1224for encryption and signing.
1225It can currently be used to set RSA-PSS for signing, RSA-OAEP for
1226encryption or to modify default parameters for ECDH.
1227This option can be used multiple times.
1228.It Fl md Ar digest
1229The digest algorithm to use when signing or resigning.
1230If not present then the default digest algorithm for the signing key
1231will be used (usually SHA1).
1232.It Fl no_attr_verify
1233Do not verify the signer's attribute of a signature.
1234.It Fl no_content_verify
1235Do not verify the content of a signed message.
1236.It Fl no_signer_cert_verify
1237Do not verify the signer's certificate of a signed message.
1238.It Fl noattr
1239Do not include attributes.
1240Normally when a message is signed a set of attributes are included which
1241include the signing time and supported symmetric algorithms.
1242With this option they are not included.
1243.It Fl nocerts
1244Do not include the signer's certificate.
1245This will reduce the size of the signed message but the verifier must
1246have a copy of the signer's certificate available locally (passed using
1247the
1248.Fl certfile
1249option for example).
1250.It Fl nodetach
1251When signing a message, use opaque signing.
1252This form is more resistant to translation by mail relays but it cannot be
1253read by mail agents that do not support S/MIME.
1254Without this option cleartext signing with the MIME type multipart/signed is
1255used.
1256.It Fl nointern
1257Only the certificates specified in the
1258.Fl certfile
1259option are used.
1260When verifying a message, normally certificates (if any) included in the
1261message are searched for the signing certificate.
1262The supplied certificates can still be used as untrusted CAs however.
1263.It Fl nooldmime
1264Output an old S/MIME content type like "application/x-pkcs7-".
1265.It Fl noout
1266Do not output the parsed CMS structure for the
1267.Fl cmsout
1268operation.
1269This is useful when combined with the
1270.Fl print
1271option or if the syntax of the CMS structure is being checked.
1272.It Fl nosigs
1273Do not try to verify the signatures on the message.
1274.It Fl nosmimecap
1275Exclude the list of supported algorithms from signed attributes; other
1276options such as signing time and content type are still included.
1277.It Fl noverify
1278Do not verify the signer's certificate of a signed message.
1279.It Fl out Ar file
1280The message text that has been decrypted or verified or the output MIME
1281format message that has been signed or verified.
1282.It Fl outform Cm der | pem | smime
1283This specifies the output format for the CMS structure.
1284The default is
1285.Cm smime ,
1286which writes an S/MIME format message.
1287.Cm pem
1288and
1289.Cm der
1290format change this to write PEM and DER format CMS structures instead.
1291This currently only affects the output format of the CMS structure; if
1292no CMS structure is being output (for example with
1293.Fl verify
1294or
1295.Fl decrypt )
1296this option has no effect.
1297.It Fl passin Ar src
1298The private key password source.
1299.It Fl print
1300Print out all fields of the CMS structure for the
1301.Fl cmsout
1302operation.
1303This is mainly useful for testing purposes.
1304.It Fl pwri_password Ar arg
1305Specify PasswordRecipientInfo (PWRI) password to use.
1306Supported by the
1307.Fl encrypt
1308and
1309.Fl decrypt
1310operations.
1311.It Fl rctform Cm der | pem | smime
1312Specify the format for a signed receipt for use with the
1313.Fl receipt_verify
1314operation.
1315The default is
1316.Cm smime .
1317.It Fl receipt_request_all | receipt_request_first
1318Indicate requests should be provided by all recipient or first tier
1319recipients (those mailed directly and not from a mailing list), for the
1320.Fl sign
1321operation to include a signed receipt request.
1322Ignored if
1323.Fl receipt_request_from
1324is included.
1325.It Fl receipt_request_from Ar addr
1326Add an explicit email address where receipts should be supplied.
1327.It Fl receipt_request_print
1328Print out the contents of any signed receipt requests for the
1329.Fl verify
1330operation.
1331.It Fl receipt_request_to Ar addr
1332Add an explicit email address where signed receipts should be sent to.
1333This option must be supplied if a signed receipt is requested.
1334.It Fl recip Ar file
1335When decrypting a message, this specifies the recipient's certificate.
1336The certificate must match one of the recipients of the message or an
1337error occurs.
1338When encrypting a message, this option may be used multiple times to
1339specify each recipient.
1340This form must be used if customised parameters are required (for example to
1341specify RSA-OAEP).
1342Only certificates carrying RSA, Diffie-Hellman or EC keys are supported
1343by this option.
1344.It Fl secretkey Ar key
1345Specify symmetric key to use.
1346The key must be supplied in hex format and be consistent with the
1347algorithm used.
1348Supported by the
1349.Fl EncryptedData_encrypt ,
1350.Fl EncryptedData_decrypt ,
1351.Fl encrypt
1352and
1353.Fl decrypt
1354operations.
1355When used with
1356.Fl encrypt
1357or
1358.Fl decrypt ,
1359the supplied key is used to wrap or unwrap the content encryption key
1360using an AES key in the KEKRecipientInfo type.
1361.It Fl secretkeyid Ar id
1362The key identifier for the supplied symmetric key for KEKRecipientInfo type.
1363This option must be present if the
1364.Fl secretkey
1365option is used with
1366.Fl encrypt .
1367With
1368.Fl decrypt
1369operations the id is used to locate the relevant key; if it is not supplied
1370then an attempt is used to decrypt any KEKRecipientInfo structures.
1371.It Fl signer Ar file
1372A signing certificate when signing or resigning a message; this option
1373can be used multiple times if more than one signer is required.
1374If a message is being verified then the signers certificates will be
1375written to this file if the verification was successful.
1376.It Xo
1377.Fl stream |
1378.Fl indef |
1379.Fl noindef
1380.Xc
1381The
1382.Fl stream
1383and
1384.Fl indef
1385options are equivalent and enable streaming I/O for encoding operations.
1386This permits single pass processing of data without the need to hold the
1387entire contents in memory, potentially supporting very large files.
1388Streaming is automatically set for S/MIME signing with detached data if
1389the output format is
1390.Cm smime ;
1391it is currently off by default for all other operations.
1392.Fl noindef
1393disable streaming I/O where it would produce an indefinite length
1394constructed encoding.
1395This option currently has no effect.
1396.It Fl text
1397Add plain text (text/plain) MIME headers to the supplied message if
1398encrypting or signing.
1399If decrypting or verifying, it strips off text headers: if the decrypted
1400or verified message is not of MIME type text/plain then an error occurs.
1401.It Fl verify_retcode
1402Set verification error code to exit code to indicate what verification error
1403has occurred.
1404Supported by
1405.Fl verify
1406operation only.
1407Exit code value minus 32 shows verification error code.
1408See
1409.Nm verify
1410command for the list of verification error code.
1411.El
1412.Pp
1413The exit codes for
1414.Nm cms
1415are as follows:
1416.Pp
1417.Bl -tag -width "XXXX" -offset 3n -compact
1418.It 0
1419The operation was completely successful.
1420.It 1
1421An error occurred parsing the command options.
1422.It 2
1423One of the input files could not be read.
1424.It 3
1425An error occurred creating the CMS file or when reading the MIME message.
1426.It 4
1427An error occurred decrypting or verifying the message.
1428.It 5
1429The message was verified correctly but an error occurred writing out the
1430signer's certificates.
1431.It 6
1432An error occurred writing the output file.
1433.It 32+
1434A verify error occurred while
1435.Fl verify_retcode
1436is specified.
1437.El
1438.Tg crl
1439.Sh CRL
1440.Bl -hang -width "openssl crl"
1441.It Nm openssl crl
1442.Bk -words
1443.Op Fl CAfile Ar file
1444.Op Fl CApath Ar dir
1445.Op Fl crlnumber
1446.Op Fl fingerprint
1447.Op Fl hash
1448.Op Fl hash_old
1449.Op Fl in Ar file
1450.Op Fl inform Cm der | pem
1451.Op Fl issuer
1452.Op Fl lastupdate
1453.Op Fl nameopt Ar option
1454.Op Fl nextupdate
1455.Op Fl noout
1456.Op Fl out Ar file
1457.Op Fl outform Cm der | pem
1458.Op Fl text
1459.Op Fl verify
1460.Ek
1461.El
1462.Pp
1463The
1464.Nm crl
1465command processes CRL files in DER or PEM format.
1466.Pp
1467The options are as follows:
1468.Bl -tag -width Ds
1469.It Fl CAfile Ar file
1470Verify the signature on a CRL by looking up the issuing certificate in
1471.Ar file .
1472.It Fl CApath Ar directory
1473Verify the signature on a CRL by looking up the issuing certificate in
1474.Ar dir .
1475This directory must be a standard certificate directory,
1476i.e. a hash of each subject name (using
1477.Cm x509 Fl hash )
1478should be linked to each certificate.
1479.It Fl crlnumber
1480Print the CRL number.
1481.It Fl fingerprint
1482Print the CRL fingerprint.
1483.It Fl hash
1484Output a hash of the issuer name.
1485This can be used to look up CRLs in a directory by issuer name.
1486.It Fl hash_old
1487Output an old-style (MD5) hash of the issuer name.
1488.It Fl in Ar file
1489The input file to read from, or standard input if not specified.
1490.It Fl inform Cm der | pem
1491The input format.
1492.It Fl issuer
1493Output the issuer name.
1494.It Fl lastupdate
1495Output the
1496.Cm thisUpdate
1497field.
1498This option is misnamed for historical reasons.
1499.It Fl nameopt Ar option
1500Specify certificate name options.
1501.It Fl nextupdate
1502Output the
1503.Cm nextUpdate
1504field.
1505.It Fl noout
1506Do not output the encoded version of the CRL.
1507.It Fl out Ar file
1508The output file to write to, or standard output if not specified.
1509.It Fl outform Cm der | pem
1510The output format.
1511.It Fl text
1512Print the CRL in plain text.
1513.It Fl verify
1514Verify the signature on the CRL.
1515.El
1516.Tg crl2pkcs7
1517.Sh CRL2PKCS7
1518.Bl -hang -width "openssl crl2pkcs7"
1519.It Nm openssl crl2pkcs7
1520.Bk -words
1521.Op Fl certfile Ar file
1522.Op Fl in Ar file
1523.Op Fl inform Cm der | pem
1524.Op Fl nocrl
1525.Op Fl out Ar file
1526.Op Fl outform Cm der | pem
1527.Ek
1528.El
1529.Pp
1530The
1531.Nm crl2pkcs7
1532command takes an optional CRL and one or more
1533certificates and converts them into a PKCS#7 degenerate
1534.Qq certificates only
1535structure.
1536.Pp
1537The options are as follows:
1538.Bl -tag -width Ds
1539.It Fl certfile Ar file
1540Add the certificates in PEM
1541.Ar file
1542to the PKCS#7 structure.
1543This option can be used more than once
1544to read certificates from multiple files.
1545.It Fl in Ar file
1546Read the CRL from
1547.Ar file ,
1548or standard input if not specified.
1549.It Fl inform Cm der | pem
1550The input format.
1551.It Fl nocrl
1552Normally, a CRL is included in the output file.
1553With this option, no CRL is
1554included in the output file and a CRL is not read from the input file.
1555.It Fl out Ar file
1556Write the PKCS#7 structure to
1557.Ar file ,
1558or standard output if not specified.
1559.It Fl outform Cm der | pem
1560The output format.
1561.El
1562.Tg dgst
1563.Sh DGST
1564.Bl -hang -width "openssl dgst"
1565.It Nm openssl dgst
1566.Bk -words
1567.Op Fl cdr
1568.Op Fl binary
1569.Op Fl Ar digest
1570.Op Fl hex
1571.Op Fl hmac Ar key
1572.Op Fl keyform Cm pem
1573.Op Fl mac Ar algorithm
1574.Op Fl macopt Ar nm : Ns Ar v
1575.Op Fl out Ar file
1576.Op Fl passin Ar arg
1577.Op Fl prverify Ar file
1578.Op Fl sign Ar file
1579.Op Fl signature Ar file
1580.Op Fl sigopt Ar nm : Ns Ar v
1581.Op Fl verify Ar file
1582.Op Ar
1583.Ek
1584.El
1585.Pp
1586The digest functions output the message digest of a supplied
1587.Ar file
1588or
1589.Ar files
1590in hexadecimal form.
1591They can also be used for digital signing and verification.
1592.Pp
1593The options are as follows:
1594.Bl -tag -width Ds
1595.It Fl binary
1596Output the digest or signature in binary form.
1597.It Fl c
1598Print the digest in two-digit groups separated by colons.
1599.It Fl d
1600Print BIO debugging information.
1601.It Fl Ar digest
1602Use the specified message
1603.Ar digest .
1604The default is SHA256.
1605The available digests can be displayed using
1606.Nm openssl
1607.Cm list-message-digest-commands .
1608The following are equivalent:
1609.Nm openssl dgst
1610.Fl sha256
1611and
1612.Nm openssl
1613.Cm sha256 .
1614.It Fl hex
1615Digest is to be output as a hex dump.
1616This is the default case for a
1617.Qq normal
1618digest as opposed to a digital signature.
1619.It Fl hmac Ar key
1620Create a hashed MAC using
1621.Ar key .
1622.It Fl keyform Cm pem
1623Specifies the key format to sign the digest with.
1624.It Fl mac Ar algorithm
1625Create a keyed Message Authentication Code (MAC).
1626The most popular MAC algorithm is HMAC (hash-based MAC),
1627but there are other MAC algorithms which are not based on hash.
1628MAC keys and other options should be set via the
1629.Fl macopt
1630parameter.
1631.It Fl macopt Ar nm : Ns Ar v
1632Passes options to the MAC algorithm, specified by
1633.Fl mac .
1634The following options are supported by HMAC:
1635.Bl -tag -width Ds
1636.It Cm key : Ns Ar string
1637Specifies the MAC key as an alphanumeric string
1638(use if the key contain printable characters only).
1639String length must conform to any restrictions of the MAC algorithm.
1640.It Cm hexkey : Ns Ar string
1641Specifies the MAC key in hexadecimal form (two hex digits per byte).
1642Key length must conform to any restrictions of the MAC algorithm.
1643.El
1644.It Fl out Ar file
1645The output file to write to,
1646or standard output if not specified.
1647.It Fl passin Ar arg
1648The key password source.
1649.It Fl prverify Ar file
1650Verify the signature using the private key in
1651.Ar file .
1652The output is either
1653.Qq Verification OK
1654or
1655.Qq Verification Failure .
1656.It Fl r
1657Print the digest in coreutils format.
1658.It Fl sign Ar file
1659Digitally sign the digest using the private key in
1660.Ar file .
1661.It Fl signature Ar file
1662The actual signature to verify.
1663.It Fl sigopt Ar nm : Ns Ar v
1664Pass options to the signature algorithm during sign or verify operations.
1665The names and values of these options are algorithm-specific.
1666.It Fl verify Ar file
1667Verify the signature using the public key in
1668.Ar file .
1669The output is either
1670.Qq Verification OK
1671or
1672.Qq Verification Failure .
1673.It Ar
1674File or files to digest.
1675If no files are specified then standard input is used.
1676.El
1677.Tg dhparam
1678.Sh DHPARAM
1679.Bl -hang -width "openssl dhparam"
1680.It Nm openssl dhparam
1681.Bk -words
1682.Op Fl 2 | 5
1683.Op Fl check
1684.Op Fl dsaparam
1685.Op Fl in Ar file
1686.Op Fl inform Cm der | pem
1687.Op Fl noout
1688.Op Fl out Ar file
1689.Op Fl outform Cm der | pem
1690.Op Fl text
1691.Op Ar numbits
1692.Ek
1693.El
1694.Pp
1695The
1696.Nm dhparam
1697command is used to manipulate DH parameter files.
1698Only the older PKCS#3 DH is supported,
1699not the newer X9.42 DH.
1700.Pp
1701The options are as follows:
1702.Bl -tag -width Ds
1703.It Fl 2 , 5
1704The generator to use;
17052 is the default.
1706If present, the input file is ignored and parameters are generated instead.
1707.It Fl check
1708Check the DH parameters.
1709.It Fl dsaparam
1710Read or create DSA parameters,
1711converted to DH format on output.
1712Otherwise,
1713.Qq strong
1714primes
1715.Pq such that (p-1)/2 is also prime
1716will be used for DH parameter generation.
1717.Pp
1718DH parameter generation with the
1719.Fl dsaparam
1720option is much faster,
1721and the recommended exponent length is shorter,
1722which makes DH key exchange more efficient.
1723Beware that with such DSA-style DH parameters,
1724a fresh DH key should be created for each use to
1725avoid small-subgroup attacks that may be possible otherwise.
1726.It Fl in Ar file
1727The input file to read from,
1728or standard input if not specified.
1729.It Fl inform Cm der | pem
1730The input format.
1731.It Fl noout
1732Do not output the encoded version of the parameters.
1733.It Fl out Ar file
1734The output file to write to,
1735or standard output if not specified.
1736.It Fl outform Cm der | pem
1737The output format.
1738.It Fl text
1739Print the DH parameters in plain text.
1740.It Ar numbits
1741Generate a parameter set of size
1742.Ar numbits .
1743It must be the last option.
1744If not present, a value of 2048 is used.
1745If this value is present, the input file is ignored and
1746parameters are generated instead.
1747.El
1748.Tg dsa
1749.Sh DSA
1750.Bl -hang -width "openssl dsa"
1751.It Nm openssl dsa
1752.Bk -words
1753.Oo
1754.Fl aes128 | aes192 | aes256 |
1755.Fl des | des3
1756.Oc
1757.Op Fl in Ar file
1758.Op Fl inform Cm der | pem | pvk
1759.Op Fl modulus
1760.Op Fl noout
1761.Op Fl out Ar file
1762.Op Fl outform Cm der | pem | pvk
1763.Op Fl passin Ar arg
1764.Op Fl passout Ar arg
1765.Op Fl pubin
1766.Op Fl pubout
1767.Op Fl pvk-none | pvk-strong | pvk-weak
1768.Op Fl text
1769.Ek
1770.El
1771.Pp
1772The
1773.Nm dsa
1774command processes DSA keys.
1775They can be converted between various forms and their components printed out.
1776.Pp
1777.Sy Note :
1778This command uses the traditional
1779.Nm SSLeay
1780compatible format for private key encryption:
1781newer applications should use the more secure PKCS#8 format using the
1782.Nm pkcs8
1783command.
1784.Pp
1785The options are as follows:
1786.Bl -tag -width Ds
1787.It Xo
1788.Fl aes128 | aes192 | aes256 |
1789.Fl des | des3
1790.Xc
1791Encrypt the private key with the AES, DES, or the triple DES
1792ciphers, respectively, before outputting it.
1793A pass phrase is prompted for.
1794If none of these options are specified, the key is written in plain text.
1795This means that using the
1796.Nm dsa
1797utility to read an encrypted key with no encryption option can be used to
1798remove the pass phrase from a key,
1799or by setting the encryption options it can be used to add or change
1800the pass phrase.
1801These options can only be used with PEM format output files.
1802.It Fl in Ar file
1803The input file to read from,
1804or standard input if not specified.
1805If the key is encrypted, a pass phrase will be prompted for.
1806.It Fl inform Cm der | pem | pvk
1807The input format.
1808.It Fl modulus
1809Print the value of the public key component of the key.
1810.It Fl noout
1811Do not output the encoded version of the key.
1812.It Fl out Ar file
1813The output file to write to,
1814or standard output if not specified.
1815If any encryption options are set then a pass phrase will be
1816prompted for.
1817.It Fl outform Cm der | pem | pvk
1818The output format.
1819.It Fl passin Ar arg
1820The key password source.
1821.It Fl passout Ar arg
1822The output file password source.
1823.It Fl pubin
1824Read in a public key, not a private key.
1825.It Fl pubout
1826Output a public key, not a private key.
1827Automatically set if the input is a public key.
1828.It Xo
1829.Fl pvk-none | pvk-strong | pvk-weak
1830.Xc
1831Enable or disable PVK encoding.
1832The default is
1833.Fl pvk-strong .
1834.It Fl text
1835Print the public/private key in plain text.
1836.El
1837.Tg dsaparam
1838.Sh DSAPARAM
1839.Bl -hang -width "openssl dsaparam"
1840.It Nm openssl dsaparam
1841.Bk -words
1842.Op Fl genkey
1843.Op Fl in Ar file
1844.Op Fl inform Cm der | pem
1845.Op Fl noout
1846.Op Fl out Ar file
1847.Op Fl outform Cm der | pem
1848.Op Fl text
1849.Op Ar numbits
1850.Ek
1851.El
1852.Pp
1853The
1854.Nm dsaparam
1855command is used to manipulate or generate DSA parameter files.
1856.Pp
1857The options are as follows:
1858.Bl -tag -width Ds
1859.It Fl genkey
1860Generate a DSA key either using the specified or generated
1861parameters.
1862.It Fl in Ar file
1863The input file to read from,
1864or standard input if not specified.
1865If the
1866.Ar numbits
1867parameter is included, then this option is ignored.
1868.It Fl inform Cm der | pem
1869The input format.
1870.It Fl noout
1871Do not output the encoded version of the parameters.
1872.It Fl out Ar file
1873The output file to write to,
1874or standard output if not specified.
1875.It Fl outform Cm der | pem
1876The output format.
1877.It Fl text
1878Print the DSA parameters in plain text.
1879.It Ar numbits
1880Generate a parameter set of size
1881.Ar numbits .
1882If this option is included, the input file is ignored.
1883.El
1884.Tg ec
1885.Sh EC
1886.Bl -hang -width "openssl ec"
1887.It Nm openssl ec
1888.Bk -words
1889.Op Fl conv_form Ar arg
1890.Op Fl des
1891.Op Fl des3
1892.Op Fl in Ar file
1893.Op Fl inform Cm der | pem
1894.Op Fl noout
1895.Op Fl out Ar file
1896.Op Fl outform Cm der | pem
1897.Op Fl param_enc Ar arg
1898.Op Fl param_out
1899.Op Fl passin Ar arg
1900.Op Fl passout Ar arg
1901.Op Fl pubin
1902.Op Fl pubout
1903.Op Fl text
1904.Ek
1905.El
1906.Pp
1907The
1908.Nm ec
1909command processes EC keys.
1910They can be converted between various
1911forms and their components printed out.
1912.Nm openssl
1913uses the private key format specified in
1914.Dq SEC 1: Elliptic Curve Cryptography
1915.Pq Lk https://www.secg.org/ .
1916To convert an
1917EC private key into the PKCS#8 private key format use the
1918.Nm pkcs8
1919command.
1920.Pp
1921The options are as follows:
1922.Bl -tag -width Ds
1923.It Fl conv_form Ar arg
1924Specify how the points on the elliptic curve are converted
1925into octet strings.
1926Possible values are:
1927.Cm compressed ,
1928.Cm uncompressed
1929(the default),
1930and
1931.Cm hybrid .
1932For more information regarding
1933the point conversion forms see the X9.62 standard.
1934Note:
1935Due to patent issues the
1936.Cm compressed
1937option is disabled by default for binary curves
1938and can be enabled by defining the preprocessor macro
1939.Dv OPENSSL_EC_BIN_PT_COMP
1940at compile time.
1941.It Fl des | des3
1942Encrypt the private key with DES, triple DES, or
1943any other cipher supported by
1944.Nm openssl .
1945A pass phrase is prompted for.
1946If none of these options are specified, the key is written in plain text.
1947This means that using the
1948.Nm ec
1949utility to read in an encrypted key with no
1950encryption option can be used to remove the pass phrase from a key,
1951or by setting the encryption options
1952it can be used to add or change the pass phrase.
1953These options can only be used with PEM format output files.
1954.It Fl in Ar file
1955The input file to read a key from,
1956or standard input if not specified.
1957If the key is encrypted, a pass phrase will be prompted for.
1958.It Fl inform Cm der | pem
1959The input format.
1960.It Fl noout
1961Do not output the encoded version of the key.
1962.It Fl out Ar file
1963The output filename to write to,
1964or standard output if not specified.
1965If any encryption options are set then a pass phrase will be prompted for.
1966.It Fl outform Cm der | pem
1967The output format.
1968.It Fl param_enc Ar arg
1969Specify how the elliptic curve parameters are encoded.
1970Possible value are:
1971.Cm named_curve ,
1972i.e. the EC parameters are specified by an OID; or
1973.Cm explicit ,
1974where the EC parameters are explicitly given
1975(see RFC 3279 for the definition of the EC parameter structures).
1976The default value is
1977.Cm named_curve .
1978Note: the
1979.Cm implicitlyCA
1980alternative,
1981as specified in RFC 3279,
1982is currently not implemented.
1983.It Fl param_out
1984Print the elliptic curve parameters.
1985.It Fl passin Ar arg
1986The key password source.
1987.It Fl passout Ar arg
1988The output file password source.
1989.It Fl pubin
1990Read in a public key, not a private key.
1991.It Fl pubout
1992Output a public key, not a private key.
1993Automatically set if the input is a public key.
1994.It Fl text
1995Print the public/private key in plain text.
1996.El
1997.Tg ecparam
1998.Sh ECPARAM
1999.Bl -hang -width "openssl ecparam"
2000.It Nm openssl ecparam
2001.Bk -words
2002.Op Fl check
2003.Op Fl conv_form Ar arg
2004.Op Fl genkey
2005.Op Fl in Ar file
2006.Op Fl inform Cm der | pem
2007.Op Fl list_curves
2008.Op Fl name Ar arg
2009.Op Fl no_seed
2010.Op Fl noout
2011.Op Fl out Ar file
2012.Op Fl outform Cm der | pem
2013.Op Fl param_enc Ar arg
2014.Op Fl text
2015.Ek
2016.El
2017.Pp
2018The
2019.Nm ecparam
2020command is used to manipulate or generate EC parameter files.
2021.Nm openssl
2022is not able to generate new groups so
2023.Nm ecparam
2024can only create EC parameters from known (named) curves.
2025.Pp
2026The options are as follows:
2027.Bl -tag -width Ds
2028.It Fl check
2029Validate the elliptic curve parameters.
2030.It Fl conv_form Ar arg
2031Specify how the points on the elliptic curve are converted
2032into octet strings.
2033Possible values are:
2034.Cm compressed ,
2035.Cm uncompressed
2036(the default),
2037and
2038.Cm hybrid .
2039For more information regarding
2040the point conversion forms see the X9.62 standard.
2041Note:
2042Due to patent issues the
2043.Cm compressed
2044option is disabled by default for binary curves
2045and can be enabled by defining the preprocessor macro
2046.Dv OPENSSL_EC_BIN_PT_COMP
2047at compile time.
2048.It Fl genkey
2049Generate an EC private key using the specified parameters.
2050.It Fl in Ar file
2051The input file to read from,
2052or standard input if not specified.
2053.It Fl inform Cm der | pem
2054The input format.
2055.It Fl list_curves
2056Print a list of all
2057currently implemented EC parameter names and exit.
2058.It Fl name Ar arg
2059Use the EC parameters with the specified "short" name.
2060.It Fl no_seed
2061Do not include the seed for the parameter generation
2062in the ECParameters structure (see RFC 3279).
2063.It Fl noout
2064Do not output the encoded version of the parameters.
2065.It Fl out Ar file
2066The output file to write to,
2067or standard output if not specified.
2068.It Fl outform Cm der | pem
2069The output format.
2070.It Fl param_enc Ar arg
2071Specify how the elliptic curve parameters are encoded.
2072Possible value are:
2073.Cm named_curve ,
2074i.e. the EC parameters are specified by an OID, or
2075.Cm explicit ,
2076where the EC parameters are explicitly given
2077(see RFC 3279 for the definition of the EC parameter structures).
2078The default value is
2079.Cm named_curve .
2080Note: the
2081.Cm implicitlyCA
2082alternative, as specified in RFC 3279,
2083is currently not implemented.
2084.It Fl text
2085Print the EC parameters in plain text.
2086.El
2087.Tg enc
2088.Sh ENC
2089.Bl -hang -width "openssl enc"
2090.It Nm openssl enc
2091.Bk -words
2092.Fl ciphername
2093.Op Fl AadePpv
2094.Op Fl base64
2095.Op Fl bufsize Ar number
2096.Op Fl debug
2097.Op Fl in Ar file
2098.Op Fl iter Ar iterations
2099.Op Fl iv Ar IV
2100.Op Fl K Ar key
2101.Op Fl k Ar password
2102.Op Fl kfile Ar file
2103.Op Fl md Ar digest
2104.Op Fl none
2105.Op Fl nopad
2106.Op Fl nosalt
2107.Op Fl out Ar file
2108.Op Fl pass Ar arg
2109.Op Fl pbkdf2
2110.Op Fl S Ar salt
2111.Op Fl salt
2112.Ek
2113.El
2114.Pp
2115The symmetric cipher commands allow data to be encrypted or decrypted
2116using various block and stream ciphers using keys based on passwords
2117or explicitly provided.
2118Base64 encoding or decoding can also be performed either by itself
2119or in addition to the encryption or decryption.
2120The program can be called either as
2121.Nm openssl Ar ciphername
2122or
2123.Nm openssl enc - Ns Ar ciphername .
2124.Pp
2125Some of the ciphers do not have large keys and others have security
2126implications if not used correctly.
2127All the block ciphers normally use PKCS#5 padding,
2128also known as standard block padding.
2129If padding is disabled, the input data must be a multiple of the cipher
2130block length.
2131.Pp
2132The options are as follows:
2133.Bl -tag -width Ds
2134.It Fl A
2135If the
2136.Fl a
2137option is set, then base64 process the data on one line.
2138.It Fl a , base64
2139Base64 process the data.
2140This means that if encryption is taking place, the data is base64-encoded
2141after encryption.
2142If decryption is set, the input data is base64-decoded before
2143being decrypted.
2144.It Fl bufsize Ar number
2145Set the buffer size for I/O.
2146.It Fl d
2147Decrypt the input data.
2148.It Fl debug
2149Debug the BIOs used for I/O.
2150.It Fl e
2151Encrypt the input data.
2152This is the default.
2153.It Fl in Ar file
2154The input file to read from,
2155or standard input if not specified.
2156.It Fl iter Ar iterations
2157Use the pbkdf2 key derivation function, with
2158.Ar iterations
2159as the number of iterations.
2160.It Fl iv Ar IV
2161The actual
2162.Ar IV
2163.Pq initialisation vector
2164to use:
2165this must be represented as a string comprised only of hex digits.
2166When only the
2167.Ar key
2168is specified using the
2169.Fl K
2170option,
2171the IV must explicitly be defined.
2172When a password is being specified using one of the other options,
2173the IV is generated from this password.
2174.It Fl K Ar key
2175The actual
2176.Ar key
2177to use:
2178this must be represented as a string comprised only of hex digits.
2179If only the key is specified,
2180the IV must also be specified using the
2181.Fl iv
2182option.
2183When both a
2184.Ar key
2185and a
2186.Ar password
2187are specified, the
2188.Ar key
2189given with the
2190.Fl K
2191option will be used and the IV generated from the password will be taken.
2192It probably does not make much sense to specify both
2193.Ar key
2194and
2195.Ar password .
2196.It Fl k Ar password
2197The
2198.Ar password
2199to derive the key from.
2200Superseded by the
2201.Fl pass
2202option.
2203.It Fl kfile Ar file
2204Read the password to derive the key from the first line of
2205.Ar file .
2206Superseded by the
2207.Fl pass
2208option.
2209.It Fl md Ar digest
2210Use
2211.Ar digest
2212to create a key from a pass phrase.
2213Currently, the default value is
2214.Cm sha256 .
2215.It Fl none
2216Use NULL cipher (no encryption or decryption of input).
2217.It Fl nopad
2218Disable standard block padding.
2219.It Fl nosalt
2220Don't use a salt in the key derivation routines.
2221This option should never be used
2222since it makes it possible to perform efficient dictionary
2223attacks on the password and to attack stream cipher encrypted data.
2224.It Fl out Ar file
2225The output file to write to,
2226or standard output if not specified.
2227.It Fl P
2228Print out the salt, key, and IV used, then immediately exit;
2229don't do any encryption or decryption.
2230.It Fl p
2231Print out the salt, key, and IV used.
2232.It Fl pass Ar arg
2233The password source.
2234.It Fl pbkdf2
2235Use the pbkdf2 key derivation function, with
2236the default of 10000 iterations.
2237.It Fl S Ar salt
2238The actual
2239.Ar salt
2240to use:
2241this must be represented as a string comprised only of hex digits.
2242.It Fl salt
2243Use a salt in the key derivation routines (the default).
2244When the salt is being used,
2245the first eight bytes of the encrypted data are reserved for the salt:
2246it is randomly generated when encrypting a file and read from the
2247encrypted file when it is decrypted.
2248.It Fl v
2249Print extra details about the processing.
2250.El
2251.Tg errstr
2252.Sh ERRSTR
2253.Nm openssl errstr
2254.Ar errno ...
2255.Pp
2256The
2257.Nm errstr
2258command performs error number to error string conversion,
2259generating a human-readable string representing the error code
2260.Ar errno .
2261The string is obtained through the
2262.Xr ERR_error_string_n 3
2263function and has the following format:
2264.Pp
2265.Dl error:[error code]:[library name]:[function name]:[reason string]
2266.Pp
2267.Bq error code
2268is an 8-digit hexadecimal number.
2269The remaining fields
2270.Bq library name ,
2271.Bq function name ,
2272and
2273.Bq reason string
2274are all ASCII text.
2275.Tg gendsa
2276.Sh GENDSA
2277.Bl -hang -width "openssl gendsa"
2278.It Nm openssl gendsa
2279.Bk -words
2280.Oo
2281.Fl aes128 | aes192 | aes256 | camellia128 |
2282.Fl camellia192 | camellia256 | des | des3 | idea
2283.Oc
2284.Op Fl out Ar file
2285.Op Fl passout Ar arg
2286.Ar paramfile
2287.Ek
2288.El
2289.Pp
2290The
2291.Nm gendsa
2292command generates a DSA private key from a DSA parameter file
2293(typically generated by the
2294.Nm openssl dsaparam
2295command).
2296DSA key generation is little more than random number generation so it is
2297much quicker than,
2298for example,
2299RSA key generation.
2300.Pp
2301The options are as follows:
2302.Bl -tag -width Ds
2303.It Xo
2304.Fl aes128 | aes192 | aes256 |
2305.Fl camellia128 | camellia192 | camellia256 |
2306.Fl des | des3 |
2307.Fl idea
2308.Xc
2309Encrypt the private key with the AES, CAMELLIA, DES, triple DES
2310or the IDEA ciphers, respectively, before outputting it.
2311A pass phrase is prompted for.
2312If none of these options are specified, no encryption is used.
2313.It Fl out Ar file
2314The output file to write to,
2315or standard output if not specified.
2316.It Fl passout Ar arg
2317The output file password source.
2318.It Ar paramfile
2319Specify the DSA parameter file to use.
2320The parameters in this file determine the size of the private key.
2321.El
2322.Tg genpkey
2323.Sh GENPKEY
2324.Bl -hang -width "openssl genpkey"
2325.It Nm openssl genpkey
2326.Bk -words
2327.Op Fl algorithm Ar alg
2328.Op Ar cipher
2329.Op Fl genparam
2330.Op Fl out Ar file
2331.Op Fl outform Cm der | pem
2332.Op Fl paramfile Ar file
2333.Op Fl pass Ar arg
2334.Op Fl pkeyopt Ar opt : Ns Ar value
2335.Op Fl text
2336.Ek
2337.El
2338.Pp
2339The
2340.Nm genpkey
2341command generates private keys.
2342The use of this
2343program is encouraged over the algorithm specific utilities
2344because additional algorithm options can be used.
2345.Pp
2346The options are as follows:
2347.Bl -tag -width Ds
2348.It Fl algorithm Ar alg
2349The public key algorithm to use,
2350such as RSA, DSA, or DH.
2351This option must precede any
2352.Fl pkeyopt
2353options.
2354The options
2355.Fl paramfile
2356and
2357.Fl algorithm
2358are mutually exclusive.
2359.It Ar cipher
2360Encrypt the private key with the supplied cipher.
2361Any algorithm name accepted by
2362.Xr EVP_get_cipherbyname 3
2363is acceptable.
2364.It Fl genparam
2365Generate a set of parameters instead of a private key.
2366This option must precede any
2367.Fl algorithm ,
2368.Fl paramfile ,
2369or
2370.Fl pkeyopt
2371options.
2372.It Fl out Ar file
2373The output file to write to,
2374or standard output if not specified.
2375.It Fl outform Cm der | pem
2376The output format.
2377.It Fl paramfile Ar file
2378Some public key algorithms generate a private key based on a set of parameters,
2379which can be supplied using this option.
2380If this option is used, the public key
2381algorithm used is determined by the parameters.
2382This option must precede any
2383.Fl pkeyopt
2384options.
2385The options
2386.Fl paramfile
2387and
2388.Fl algorithm
2389are mutually exclusive.
2390.It Fl pass Ar arg
2391The output file password source.
2392.It Fl pkeyopt Ar opt : Ns Ar value
2393Set the public key algorithm option
2394.Ar opt
2395to
2396.Ar value ,
2397as follows:
2398.Bl -tag -width Ds -offset indent
2399.It rsa_keygen_bits : Ns Ar numbits
2400(RSA)
2401The number of bits in the generated key.
2402The default is 2048.
2403.It rsa_keygen_pubexp : Ns Ar value
2404(RSA)
2405The RSA public exponent value.
2406This can be a large decimal or hexadecimal value if preceded by 0x.
2407The default is 65537.
2408.It dsa_paramgen_bits : Ns Ar numbits
2409(DSA)
2410The number of bits in the generated parameters.
2411The default is 1024.
2412.It dh_paramgen_prime_len : Ns Ar numbits
2413(DH)
2414The number of bits in the prime parameter
2415.Ar p .
2416.It dh_paramgen_generator : Ns Ar value
2417(DH)
2418The value to use for the generator
2419.Ar g .
2420.It ec_paramgen_curve : Ns Ar curve
2421(EC)
2422The elliptic curve to use.
2423.El
2424.It Fl text
2425Print the private/public key in plain text.
2426.El
2427.Tg genrsa
2428.Sh GENRSA
2429.Bl -hang -width "openssl genrsa"
2430.It Nm openssl genrsa
2431.Bk -words
2432.Op Fl 3 | f4
2433.Oo
2434.Fl aes128 | aes192 | aes256 | camellia128 |
2435.Fl camellia192 | camellia256 | des | des3 | idea
2436.Oc
2437.Op Fl out Ar file
2438.Op Fl passout Ar arg
2439.Op Ar numbits
2440.Ek
2441.El
2442.Pp
2443The
2444.Nm genrsa
2445command generates an RSA private key,
2446which essentially involves the generation of two prime numbers.
2447When generating the key,
2448various symbols will be output to indicate the progress of the generation.
2449A
2450.Sq \&.
2451represents each number which has passed an initial sieve test;
2452.Sq +
2453means a number has passed a single round of the Miller-Rabin primality test;
2454.Sq *
2455means the number has failed primality testing
2456and needs to be generated afresh.
2457A newline means that the number has passed all the prime tests
2458(the actual number depends on the key size).
2459.Pp
2460The options are as follows:
2461.Bl -tag -width Ds
2462.It Fl 3 | f4
2463The public exponent to use, either 3 or 65537.
2464The default is 65537.
2465.It Xo
2466.Fl aes128 | aes192 | aes256 |
2467.Fl camellia128 | camellia192 | camellia256 |
2468.Fl des | des3 |
2469.Fl idea
2470.Xc
2471Encrypt the private key with the AES, CAMELLIA, DES, triple DES
2472or the IDEA ciphers, respectively, before outputting it.
2473If none of these options are specified, no encryption is used.
2474If encryption is used, a pass phrase is prompted for,
2475if it is not supplied via the
2476.Fl passout
2477option.
2478.It Fl out Ar file
2479The output file to write to,
2480or standard output if not specified.
2481.It Fl passout Ar arg
2482The output file password source.
2483.It Ar numbits
2484The size of the private key to generate in bits.
2485This must be the last option specified.
2486The default is 2048.
2487.El
2488.Tg ocsp
2489.Sh OCSP
2490.Bl -hang -width "openssl ocsp"
2491.It Nm openssl ocsp
2492.Bk -words
2493.Op Fl CA Ar file
2494.Op Fl CAfile Ar file
2495.Op Fl CApath Ar directory
2496.Op Fl cert Ar file
2497.Op Fl dgst Ar alg
2498.Op Fl header Ar name value
2499.Op Fl host Ar hostname : Ns Ar port
2500.Op Fl ignore_err
2501.Op Fl index Ar indexfile
2502.Op Fl issuer Ar file
2503.Op Fl ndays Ar days
2504.Op Fl nmin Ar minutes
2505.Op Fl no_cert_checks
2506.Op Fl no_cert_verify
2507.Op Fl no_certs
2508.Op Fl no_chain
2509.Op Fl no_explicit
2510.Op Fl no_intern
2511.Op Fl no_nonce
2512.Op Fl no_signature_verify
2513.Op Fl nonce
2514.Op Fl noverify
2515.Op Fl nrequest Ar number
2516.Op Fl out Ar file
2517.Op Fl path Ar path
2518.Op Fl port Ar portnum
2519.Op Fl req_text
2520.Op Fl reqin Ar file
2521.Op Fl reqout Ar file
2522.Op Fl resp_key_id
2523.Op Fl resp_no_certs
2524.Op Fl resp_text
2525.Op Fl respin Ar file
2526.Op Fl respout Ar file
2527.Op Fl rkey Ar file
2528.Op Fl rother Ar file
2529.Op Fl rsigner Ar file
2530.Op Fl serial Ar num
2531.Op Fl sign_other Ar file
2532.Op Fl signer Ar file
2533.Op Fl signkey Ar file
2534.Op Fl status_age Ar age
2535.Op Fl text
2536.Op Fl timeout Ar seconds
2537.Op Fl trust_other
2538.Op Fl url Ar responder_url
2539.Op Fl VAfile Ar file
2540.Op Fl validity_period Ar nsec
2541.Op Fl verify_other Ar file
2542.Ek
2543.El
2544.Pp
2545The Online Certificate Status Protocol (OCSP)
2546enables applications to determine the (revocation) state
2547of an identified certificate (RFC 2560).
2548.Pp
2549The
2550.Nm ocsp
2551command performs many common OCSP tasks.
2552It can be used to print out requests and responses,
2553create requests and send queries to an OCSP responder,
2554and behave like a mini OCSP server itself.
2555.Pp
2556The options are as follows:
2557.Bl -tag -width Ds
2558.It Fl CAfile Ar file , Fl CApath Ar directory
2559A file or path containing trusted CA certificates,
2560used to verify the signature on the OCSP response.
2561.It Fl cert Ar file
2562Add the certificate
2563.Ar file
2564to the request.
2565The issuer certificate is taken from the previous
2566.Fl issuer
2567option, or an error occurs if no issuer certificate is specified.
2568.It Fl dgst Ar alg
2569Use the digest algorithm
2570.Ar alg
2571for certificate identification in the OCSP request.
2572By default SHA1 is used.
2573.It Xo
2574.Fl host Ar hostname : Ns Ar port ,
2575.Fl path Ar path
2576.Xc
2577Send
2578the OCSP request to
2579.Ar hostname
2580on
2581.Ar port .
2582.Fl path
2583specifies the HTTP path name to use, or
2584.Pa /
2585by default.
2586.It Fl header Ar name value
2587Add the header name with the specified value to the OCSP request that is sent
2588to the responder.
2589This may be repeated.
2590.It Fl issuer Ar file
2591The current issuer certificate, in PEM format.
2592Can be used multiple times and must come before any
2593.Fl cert
2594options.
2595.It Fl no_cert_checks
2596Don't perform any additional checks on the OCSP response signer's certificate.
2597That is, do not make any checks to see if the signer's certificate is
2598authorised to provide the necessary status information:
2599as a result this option should only be used for testing purposes.
2600.It Fl no_cert_verify
2601Don't verify the OCSP response signer's certificate at all.
2602Since this option allows the OCSP response to be signed by any certificate,
2603it should only be used for testing purposes.
2604.It Fl no_certs
2605Don't include any certificates in the signed request.
2606.It Fl no_chain
2607Do not use certificates in the response as additional untrusted CA
2608certificates.
2609.It Fl no_explicit
2610Don't check the explicit trust for OCSP signing in the root CA certificate.
2611.It Fl no_intern
2612Ignore certificates contained in the OCSP response
2613when searching for the signer's certificate.
2614The signer's certificate must be specified with either the
2615.Fl verify_other
2616or
2617.Fl VAfile
2618options.
2619.It Fl no_signature_verify
2620Don't check the signature on the OCSP response.
2621Since this option tolerates invalid signatures on OCSP responses,
2622it will normally only be used for testing purposes.
2623.It Fl nonce , no_nonce
2624Add an OCSP nonce extension to a request,
2625or disable an OCSP nonce addition.
2626Normally, if an OCSP request is input using the
2627.Fl respin
2628option no nonce is added:
2629using the
2630.Fl nonce
2631option will force the addition of a nonce.
2632If an OCSP request is being created (using the
2633.Fl cert
2634and
2635.Fl serial
2636options),
2637a nonce is automatically added; specifying
2638.Fl no_nonce
2639overrides this.
2640.It Fl noverify
2641Don't attempt to verify the OCSP response signature or the nonce values.
2642This is normally only be used for debugging
2643since it disables all verification of the responder's certificate.
2644.It Fl out Ar file
2645Specify the output file to write to,
2646or standard output if not specified.
2647.It Fl req_text , resp_text , text
2648Print out the text form of the OCSP request, response, or both, respectively.
2649.It Fl reqin Ar file , Fl respin Ar file
2650Read an OCSP request or response file from
2651.Ar file .
2652These options are ignored
2653if an OCSP request or response creation is implied by other options
2654(for example with the
2655.Fl serial , cert ,
2656and
2657.Fl host
2658options).
2659.It Fl reqout Ar file , Fl respout Ar file
2660Write out the DER-encoded certificate request or response to
2661.Ar file .
2662.It Fl serial Ar num
2663Same as the
2664.Fl cert
2665option except the certificate with serial number
2666.Ar num
2667is added to the request.
2668The serial number is interpreted as a decimal integer unless preceded by
2669.Sq 0x .
2670Negative integers can also be specified
2671by preceding the value with a minus sign.
2672.It Fl sign_other Ar file
2673Additional certificates to include in the signed request.
2674.It Fl signer Ar file , Fl signkey Ar file
2675Sign the OCSP request using the certificate specified in the
2676.Fl signer
2677option and the private key specified by the
2678.Fl signkey
2679option.
2680If the
2681.Fl signkey
2682option is not present, then the private key is read from the same file
2683as the certificate.
2684If neither option is specified, the OCSP request is not signed.
2685.It Fl timeout Ar seconds
2686Connection timeout to the OCSP responder in seconds.
2687.It Fl trust_other
2688The certificates specified by the
2689.Fl verify_other
2690option should be explicitly trusted and no additional checks will be
2691performed on them.
2692This is useful when the complete responder certificate chain is not available
2693or trusting a root CA is not appropriate.
2694.It Fl url Ar responder_url
2695Specify the responder URL.
2696Both HTTP and HTTPS
2697.Pq SSL/TLS
2698URLs can be specified.
2699.It Fl VAfile Ar file
2700A file containing explicitly trusted responder certificates.
2701Equivalent to the
2702.Fl verify_other
2703and
2704.Fl trust_other
2705options.
2706.It Fl validity_period Ar nsec , Fl status_age Ar age
2707The range of times, in seconds, which will be tolerated in an OCSP response.
2708Each certificate status response includes a notBefore time
2709and an optional notAfter time.
2710The current time should fall between these two values,
2711but the interval between the two times may be only a few seconds.
2712In practice the OCSP responder and clients' clocks may not be precisely
2713synchronised and so such a check may fail.
2714To avoid this the
2715.Fl validity_period
2716option can be used to specify an acceptable error range in seconds,
2717the default value being 5 minutes.
2718.Pp
2719If the notAfter time is omitted from a response,
2720it means that new status information is immediately available.
2721In this case the age of the notBefore field is checked
2722to see it is not older than
2723.Ar age
2724seconds old.
2725By default, this additional check is not performed.
2726.It Fl verify_other Ar file
2727A file containing additional certificates to search
2728when attempting to locate the OCSP response signing certificate.
2729Some responders omit the actual signer's certificate from the response,
2730so this can be used to supply the necessary certificate.
2731.El
2732.Pp
2733The options for the OCSP server are as follows:
2734.Bl -tag -width "XXXX"
2735.It Fl CA Ar file
2736CA certificate corresponding to the revocation information in
2737.Ar indexfile .
2738.It Fl ignore_err
2739Ignore the invalid response.
2740.It Fl index Ar indexfile
2741.Ar indexfile
2742is a text index file in ca format
2743containing certificate revocation information.
2744.Pp
2745If this option is specified,
2746.Nm ocsp
2747is in responder mode, otherwise it is in client mode.
2748The requests the responder processes can be either specified on
2749the command line (using the
2750.Fl issuer
2751and
2752.Fl serial
2753options), supplied in a file (using the
2754.Fl respin
2755option), or via external OCSP clients (if
2756.Ar port
2757or
2758.Ar url
2759is specified).
2760.Pp
2761If this option is present, then the
2762.Fl CA
2763and
2764.Fl rsigner
2765options must also be present.
2766.It Fl nmin Ar minutes , Fl ndays Ar days
2767Number of
2768.Ar minutes
2769or
2770.Ar days
2771when fresh revocation information is available:
2772used in the nextUpdate field.
2773If neither option is present,
2774the nextUpdate field is omitted,
2775meaning fresh revocation information is immediately available.
2776.It Fl nrequest Ar number
2777Exit after receiving
2778.Ar number
2779requests (the default is unlimited).
2780.It Fl port Ar portnum
2781Port to listen for OCSP requests on.
2782May also be specified using the
2783.Fl url
2784option.
2785.It Fl resp_key_id
2786Identify the signer certificate using the key ID;
2787the default is to use the subject name.
2788.It Fl resp_no_certs
2789Don't include any certificates in the OCSP response.
2790.It Fl rkey Ar file
2791The private key to sign OCSP responses with;
2792if not present, the file specified in the
2793.Fl rsigner
2794option is used.
2795.It Fl rother Ar file
2796Additional certificates to include in the OCSP response.
2797.It Fl rsigner Ar file
2798The certificate to sign OCSP responses with.
2799.El
2800.Pp
2801Initially the OCSP responder certificate is located and the signature on
2802the OCSP request checked using the responder certificate's public key.
2803Then a normal certificate verify is performed on the OCSP responder certificate
2804building up a certificate chain in the process.
2805The locations of the trusted certificates used to build the chain can be
2806specified by the
2807.Fl CAfile
2808and
2809.Fl CApath
2810options or they will be looked for in the standard
2811.Nm openssl
2812certificates directory.
2813.Pp
2814If the initial verify fails, the OCSP verify process halts with an error.
2815Otherwise the issuing CA certificate in the request is compared to the OCSP
2816responder certificate: if there is a match then the OCSP verify succeeds.
2817.Pp
2818Otherwise the OCSP responder certificate's CA is checked against the issuing
2819CA certificate in the request.
2820If there is a match and the OCSPSigning extended key usage is present
2821in the OCSP responder certificate, then the OCSP verify succeeds.
2822.Pp
2823Otherwise the root CA of the OCSP responder's CA is checked to see if it
2824is trusted for OCSP signing.
2825If it is, the OCSP verify succeeds.
2826.Pp
2827If none of these checks is successful, the OCSP verify fails.
2828What this effectively means is that if the OCSP responder certificate is
2829authorised directly by the CA it is issuing revocation information about
2830(and it is correctly configured),
2831then verification will succeed.
2832.Pp
2833If the OCSP responder is a global responder,
2834which can give details about multiple CAs
2835and has its own separate certificate chain,
2836then its root CA can be trusted for OCSP signing.
2837Alternatively, the responder certificate itself can be explicitly trusted
2838with the
2839.Fl VAfile
2840option.
2841.Tg passwd
2842.Sh PASSWD
2843.Bl -hang -width "openssl passwd"
2844.It Nm openssl passwd
2845.Bk -words
2846.Op Fl 1 | apr1 | crypt
2847.Op Fl in Ar file
2848.Op Fl noverify
2849.Op Fl quiet
2850.Op Fl reverse
2851.Op Fl salt Ar string
2852.Op Fl stdin
2853.Op Fl table
2854.Op Ar password
2855.Ek
2856.El
2857.Pp
2858The
2859.Nm passwd
2860command computes the hash of a password.
2861.Pp
2862The options are as follows:
2863.Bl -tag -width Ds
2864.It Fl 1
2865Use the MD5 based
2866.Bx
2867password algorithm
2868.Qq 1 .
2869.It Fl apr1
2870Use the
2871.Qq apr1
2872algorithm
2873.Po
2874Apache variant of the
2875.Bx
2876algorithm
2877.Pc .
2878.It Fl crypt
2879Use the
2880.Qq crypt
2881algorithm (the default).
2882.It Fl in Ar file
2883Read passwords from
2884.Ar file .
2885.It Fl noverify
2886Don't verify when reading a password from the terminal.
2887.It Fl quiet
2888Don't output warnings when passwords given on the command line are truncated.
2889.It Fl reverse
2890Switch table columns.
2891This only makes sense in conjunction with the
2892.Fl table
2893option.
2894.It Fl salt Ar string
2895Use the salt specified by
2896.Ar string .
2897When reading a password from the terminal, this implies
2898.Fl noverify .
2899.It Fl stdin
2900Read passwords from standard input.
2901.It Fl table
2902In the output list, prepend the cleartext password and a TAB character
2903to each password hash.
2904.El
2905.Tg pkcs7
2906.Sh PKCS7
2907.Bl -hang -width "openssl pkcs7"
2908.It Nm openssl pkcs7
2909.Bk -words
2910.Op Fl in Ar file
2911.Op Fl inform Cm der | pem
2912.Op Fl noout
2913.Op Fl out Ar file
2914.Op Fl outform Cm der | pem
2915.Op Fl print
2916.Op Fl print_certs
2917.Op Fl text
2918.Ek
2919.El
2920.Pp
2921The
2922.Nm pkcs7
2923command processes PKCS#7 files in DER or PEM format.
2924The PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC 2315.
2925.Pp
2926The options are as follows:
2927.Bl -tag -width Ds
2928.It Fl in Ar file
2929The input file to read from,
2930or standard input if not specified.
2931.It Fl inform Cm der | pem
2932The input format.
2933.It Fl noout
2934Don't output the encoded version of the PKCS#7 structure
2935(or certificates if
2936.Fl print_certs
2937is set).
2938.It Fl out Ar file
2939The output to write to,
2940or standard output if not specified.
2941.It Fl outform Cm der | pem
2942The output format.
2943.It Fl print
2944Print the ASN.1 representation of PKCS#7 structure.
2945.It Fl print_certs
2946Print any certificates or CRLs contained in the file,
2947preceded by their subject and issuer names in a one-line format.
2948.It Fl text
2949Print certificate details in full rather than just subject and issuer names.
2950.El
2951.Tg pkcs8
2952.Sh PKCS8
2953.Bl -hang -width "openssl pkcs8"
2954.It Nm openssl pkcs8
2955.Bk -words
2956.Op Fl in Ar file
2957.Op Fl inform Cm der | pem
2958.Op Fl nocrypt
2959.Op Fl noiter
2960.Op Fl out Ar file
2961.Op Fl outform Cm der | pem
2962.Op Fl passin Ar arg
2963.Op Fl passout Ar arg
2964.Op Fl topk8
2965.Op Fl v1 Ar alg
2966.Op Fl v2 Ar alg
2967.Ek
2968.El
2969.Pp
2970The
2971.Nm pkcs8
2972command processes private keys
2973(both encrypted and unencrypted)
2974in PKCS#8 format
2975with a variety of PKCS#5 (v1.5 and v2.0) and PKCS#12 algorithms.
2976The default encryption is only 56 bits;
2977keys encrypted using PKCS#5 v2.0 algorithms and high iteration counts
2978are more secure.
2979.Pp
2980The options are as follows:
2981.Bl -tag -width Ds
2982.It Fl in Ar file
2983The input file to read from,
2984or standard input if not specified.
2985If the key is encrypted, a pass phrase will be prompted for.
2986.It Fl inform Cm der | pem
2987The input format.
2988.It Fl nocrypt
2989Generate an unencrypted PrivateKeyInfo structure.
2990This option does not encrypt private keys at all
2991and should only be used when absolutely necessary.
2992.It Fl noiter
2993Use an iteration count of 1.
2994See the
2995.Sx PKCS12
2996section below for a detailed explanation of this option.
2997.It Fl out Ar file
2998The output file to write to,
2999or standard output if none is specified.
3000If any encryption options are set, a pass phrase will be prompted for.
3001.It Fl outform Cm der | pem
3002The output format.
3003.It Fl passin Ar arg
3004The key password source.
3005.It Fl passout Ar arg
3006The output file password source.
3007.It Fl topk8
3008Read a traditional format private key and write a PKCS#8 format key.
3009.It Fl v1 Ar alg
3010Specify a PKCS#5 v1.5 or PKCS#12 algorithm to use.
3011.Pp
3012.Bl -tag -width "XXXX" -compact
3013.It PBE-MD5-DES
301456-bit DES.
3015.It PBE-SHA1-RC2-64 | PBE-MD5-RC2-64 | PBE-SHA1-DES
301664-bit RC2 or 56-bit DES.
3017.It PBE-SHA1-RC4-128 | PBE-SHA1-RC4-40 | PBE-SHA1-3DES
3018.It PBE-SHA1-2DES | PBE-SHA1-RC2-128 | PBE-SHA1-RC2-40
3019PKCS#12 password-based encryption algorithm,
3020which allow strong encryption algorithms like triple DES or 128-bit RC2.
3021.El
3022.It Fl v2 Ar alg
3023Use PKCS#5 v2.0 algorithms.
3024Supports algorithms such as 168-bit triple DES or 128-bit RC2,
3025however not many implementations support PKCS#5 v2.0 yet
3026(if using private keys with
3027.Nm openssl
3028this doesn't matter).
3029.Pp
3030.Ar alg
3031is the encryption algorithm to use;
3032valid values include des, des3, and rc2.
3033It is recommended that des3 is used.
3034.El
3035.Tg pkcs12
3036.Sh PKCS12
3037.Bl -hang -width "openssl pkcs12"
3038.It Nm openssl pkcs12
3039.Bk -words
3040.Oo
3041.Fl aes128 | aes192 | aes256 | camellia128 |
3042.Fl camellia192 | camellia256 | des | des3 | idea
3043.Oc
3044.Op Fl cacerts
3045.Op Fl CAfile Ar file
3046.Op Fl caname Ar name
3047.Op Fl CApath Ar directory
3048.Op Fl certfile Ar file
3049.Op Fl certpbe Ar alg
3050.Op Fl chain
3051.Op Fl clcerts
3052.Op Fl descert
3053.Op Fl export
3054.Op Fl in Ar file
3055.Op Fl info
3056.Op Fl inkey Ar file
3057.Op Fl keyex
3058.Op Fl keypbe Ar alg
3059.Op Fl keysig
3060.Op Fl macalg Ar alg
3061.Op Fl maciter
3062.Op Fl name Ar name
3063.Op Fl nocerts
3064.Op Fl nodes
3065.Op Fl noiter
3066.Op Fl nokeys
3067.Op Fl nomac
3068.Op Fl nomaciter
3069.Op Fl nomacver
3070.Op Fl noout
3071.Op Fl out Ar file
3072.Op Fl passin Ar arg
3073.Op Fl passout Ar arg
3074.Op Fl password Ar arg
3075.Op Fl twopass
3076.Ek
3077.El
3078.Pp
3079The
3080.Nm pkcs12
3081command allows PKCS#12 files
3082.Pq sometimes referred to as PFX files
3083to be created and parsed.
3084By default, a PKCS#12 file is parsed;
3085a PKCS#12 file can be created by using the
3086.Fl export
3087option.
3088.Pp
3089The options for parsing a PKCS12 file are as follows:
3090.Bl -tag -width "XXXX"
3091.It Xo
3092.Fl aes128 | aes192 | aes256 |
3093.Fl camellia128 | camellia192 | camellia256 |
3094.Fl des | des3 |
3095.Fl idea
3096.Xc
3097Encrypt private keys using AES, CAMELLIA, DES, triple DES
3098or the IDEA ciphers, respectively.
3099The default is triple DES.
3100.It Fl cacerts
3101Only output CA certificates
3102.Pq not client certificates .
3103.It Fl clcerts
3104Only output client certificates
3105.Pq not CA certificates .
3106.It Fl in Ar file
3107The input file to read from,
3108or standard input if not specified.
3109.It Fl info
3110Output additional information about the PKCS#12 file structure,
3111algorithms used, and iteration counts.
3112.It Fl nocerts
3113Do not output certificates.
3114.It Fl nodes
3115Do not encrypt private keys.
3116.It Fl nokeys
3117Do not output private keys.
3118.It Fl nomacver
3119Do not attempt to verify the integrity MAC before reading the file.
3120.It Fl noout
3121Do not output the keys and certificates to the output file
3122version of the PKCS#12 file.
3123.It Fl out Ar file
3124The output file to write to,
3125or standard output if not specified.
3126.It Fl passin Ar arg
3127The key password source.
3128.It Fl passout Ar arg
3129The output file password source.
3130.It Fl twopass
3131Prompt for separate integrity and encryption passwords: most software
3132always assumes these are the same so this option will render such
3133PKCS#12 files unreadable.
3134.El
3135.Pp
3136The options for PKCS12 file creation are as follows:
3137.Bl -tag -width "XXXX"
3138.It Fl CAfile Ar file
3139CA storage as a file.
3140.It Fl CApath Ar directory
3141CA storage as a directory.
3142The directory must be a standard certificate directory:
3143that is, a hash of each subject name (using
3144.Nm x509 Fl hash )
3145should be linked to each certificate.
3146.It Fl caname Ar name
3147Specify the
3148.Qq friendly name
3149for other certificates.
3150May be used multiple times to specify names for all certificates
3151in the order they appear.
3152.It Fl certfile Ar file
3153A file to read additional certificates from.
3154.It Fl certpbe Ar alg , Fl keypbe Ar alg
3155Specify the algorithm used to encrypt the private key and
3156certificates to be selected.
3157Any PKCS#5 v1.5 or PKCS#12 PBE algorithm name can be used.
3158If a cipher name
3159(as output by the
3160.Cm list-cipher-algorithms
3161command) is specified then it
3162is used with PKCS#5 v2.0.
3163For interoperability reasons it is advisable to only use PKCS#12 algorithms.
3164.It Fl chain
3165Include the entire certificate chain of the user certificate.
3166The standard CA store is used for this search.
3167If the search fails, it is considered a fatal error.
3168.It Fl descert
3169Encrypt the certificate using triple DES; this may render the PKCS#12
3170file unreadable by some
3171.Qq export grade
3172software.
3173By default, the private key is encrypted using triple DES and the
3174certificate using 40-bit RC2.
3175.It Fl export
3176Create a PKCS#12 file (rather than parsing one).
3177.It Fl in Ar file
3178The input file to read from,
3179or standard input if not specified.
3180The order doesn't matter but one private key and its corresponding
3181certificate should be present.
3182If additional certificates are present, they will also be included
3183in the PKCS#12 file.
3184.It Fl inkey Ar file
3185File to read a private key from.
3186If not present, a private key must be present in the input file.
3187.It Fl keyex | keysig
3188Specify whether the private key is to be used for key exchange or just signing.
3189Normally,
3190.Qq export grade
3191software will only allow 512-bit RSA keys to be
3192used for encryption purposes, but arbitrary length keys for signing.
3193The
3194.Fl keysig
3195option marks the key for signing only.
3196Signing only keys can be used for S/MIME signing, authenticode
3197(ActiveX control signing)
3198and SSL client authentication.
3199.It Fl macalg Ar alg
3200Specify the MAC digest algorithm.
3201The default is SHA1.
3202.It Fl maciter
3203Included for compatibility only:
3204it used to be needed to use MAC iterations counts
3205but they are now used by default.
3206.It Fl name Ar name
3207Specify the
3208.Qq friendly name
3209for the certificate and private key.
3210This name is typically displayed in list boxes by software importing the file.
3211.It Fl nomac
3212Don't attempt to provide the MAC integrity.
3213.It Fl nomaciter , noiter
3214Affect the iteration counts on the MAC and key algorithms.
3215.Pp
3216To discourage attacks by using large dictionaries of common passwords,
3217the algorithm that derives keys from passwords can have an iteration count
3218applied to it: this causes a certain part of the algorithm to be repeated
3219and slows it down.
3220The MAC is used to check the file integrity but since it will normally
3221have the same password as the keys and certificates it could also be attacked.
3222By default, both MAC and encryption iteration counts are set to 2048;
3223using these options the MAC and encryption iteration counts can be set to 1.
3224Since this reduces the file security, you should not use these options
3225unless you really have to.
3226Most software supports both MAC and key iteration counts.
3227.It Fl out Ar file
3228The output file to write to,
3229or standard output if not specified.
3230.It Fl passin Ar arg
3231The key password source.
3232.It Fl passout Ar arg
3233The output file password source.
3234.It Fl password Ar arg
3235With
3236.Fl export ,
3237.Fl password
3238is equivalent to
3239.Fl passout .
3240Otherwise,
3241.Fl password
3242is equivalent to
3243.Fl passin .
3244.El
3245.Tg pkey
3246.Sh PKEY
3247.Bl -hang -width "openssl pkey"
3248.It Nm openssl pkey
3249.Bk -words
3250.Op Ar cipher
3251.Op Fl in Ar file
3252.Op Fl inform Cm der | pem
3253.Op Fl noout
3254.Op Fl out Ar file
3255.Op Fl outform Cm der | pem
3256.Op Fl passin Ar arg
3257.Op Fl passout Ar arg
3258.Op Fl pubin
3259.Op Fl pubout
3260.Op Fl text
3261.Op Fl text_pub
3262.Ek
3263.El
3264.Pp
3265The
3266.Nm pkey
3267command processes public or private keys.
3268They can be converted between various forms
3269and their components printed out.
3270.Pp
3271The options are as follows:
3272.Bl -tag -width Ds
3273.It Ar cipher
3274Encrypt the private key with the specified cipher.
3275Any algorithm name accepted by
3276.Xr EVP_get_cipherbyname 3
3277is acceptable, such as
3278.Cm des3 .
3279.It Fl in Ar file
3280The input file to read from,
3281or standard input if not specified.
3282If the key is encrypted, a pass phrase will be prompted for.
3283.It Fl inform Cm der | pem
3284The input format.
3285.It Fl noout
3286Do not output the encoded version of the key.
3287.It Fl out Ar file
3288The output file to write to,
3289or standard output if not specified.
3290If any encryption options are set then a pass phrase
3291will be prompted for.
3292.It Fl outform Cm der | pem
3293The output format.
3294.It Fl passin Ar arg
3295The key password source.
3296.It Fl passout Ar arg
3297The output file password source.
3298.It Fl pubin
3299Read in a public key, not a private key.
3300.It Fl pubout
3301Output a public key, not a private key.
3302Automatically set if the input is a public key.
3303.It Fl text
3304Print the public/private key in plain text.
3305.It Fl text_pub
3306Print out only public key components
3307even if a private key is being processed.
3308.El
3309.Tg pkeyparam
3310.Sh PKEYPARAM
3311.Cm openssl pkeyparam
3312.Op Fl in Ar file
3313.Op Fl noout
3314.Op Fl out Ar file
3315.Op Fl text
3316.Pp
3317The
3318.Nm pkeyparam
3319command processes public or private keys.
3320The key type is determined by the PEM headers.
3321.Pp
3322The options are as follows:
3323.Bl -tag -width Ds
3324.It Fl in Ar file
3325The input file to read from,
3326or standard input if not specified.
3327.It Fl noout
3328Do not output the encoded version of the parameters.
3329.It Fl out Ar file
3330The output file to write to,
3331or standard output if not specified.
3332.It Fl text
3333Print the parameters in plain text.
3334.El
3335.Tg pkeyutl
3336.Sh PKEYUTL
3337.Bl -hang -width "openssl pkeyutl"
3338.It Nm openssl pkeyutl
3339.Bk -words
3340.Op Fl asn1parse
3341.Op Fl certin
3342.Op Fl decrypt
3343.Op Fl derive
3344.Op Fl encrypt
3345.Op Fl hexdump
3346.Op Fl in Ar file
3347.Op Fl inkey Ar file
3348.Op Fl keyform Cm der | pem
3349.Op Fl out Ar file
3350.Op Fl passin Ar arg
3351.Op Fl peerform Cm der | pem
3352.Op Fl peerkey Ar file
3353.Op Fl pkeyopt Ar opt : Ns Ar value
3354.Op Fl pubin
3355.Op Fl rev
3356.Op Fl sigfile Ar file
3357.Op Fl sign
3358.Op Fl verify
3359.Op Fl verifyrecover
3360.Ek
3361.El
3362.Pp
3363The
3364.Nm pkeyutl
3365command can be used to perform public key operations using
3366any supported algorithm.
3367.Pp
3368The options are as follows:
3369.Bl -tag -width Ds
3370.It Fl asn1parse
3371ASN.1 parse the output data.
3372This is useful when combined with the
3373.Fl verifyrecover
3374option when an ASN.1 structure is signed.
3375.It Fl certin
3376The input is a certificate containing a public key.
3377.It Fl decrypt
3378Decrypt the input data using a private key.
3379.It Fl derive
3380Derive a shared secret using the peer key.
3381.It Fl encrypt
3382Encrypt the input data using a public key.
3383.It Fl hexdump
3384Hex dump the output data.
3385.It Fl in Ar file
3386The input file to read from,
3387or standard input if not specified.
3388.It Fl inkey Ar file
3389The input key file.
3390By default it should be a private key.
3391.It Fl keyform Cm der | pem
3392The key format.
3393.It Fl out Ar file
3394The output file to write to,
3395or standard output if not specified.
3396.It Fl passin Ar arg
3397The key password source.
3398.It Fl peerform Cm der | pem
3399The peer key format.
3400.It Fl peerkey Ar file
3401The peer key file, used by key derivation (agreement) operations.
3402.It Fl pkeyopt Ar opt : Ns Ar value
3403Set the public key algorithm option
3404.Ar opt
3405to
3406.Ar value .
3407Unless otherwise mentioned, all algorithms support the format
3408.Ar digest : Ns Ar alg ,
3409which specifies the digest to use
3410for sign, verify, and verifyrecover operations.
3411The value
3412.Ar alg
3413should represent a digest name as used in the
3414.Xr EVP_get_digestbyname 3
3415function.
3416.Pp
3417The RSA algorithm supports the
3418encrypt, decrypt, sign, verify, and verifyrecover operations in general.
3419Some padding modes only support some of these
3420operations however.
3421.Bl -tag -width Ds
3422.It rsa_padding_mode : Ns Ar mode
3423This sets the RSA padding mode.
3424Acceptable values for
3425.Ar mode
3426are
3427.Cm pkcs1
3428for PKCS#1 padding;
3429.Cm none
3430for no padding;
3431.Cm oaep
3432for OAEP mode;
3433.Cm x931
3434for X9.31 mode;
3435and
3436.Cm pss
3437for PSS.
3438.Pp
3439In PKCS#1 padding if the message digest is not set then the supplied data is
3440signed or verified directly instead of using a DigestInfo structure.
3441If a digest is set then a DigestInfo
3442structure is used and its length
3443must correspond to the digest type.
3444For oeap mode only encryption and decryption is supported.
3445For x931 if the digest type is set it is used to format the block data;
3446otherwise the first byte is used to specify the X9.31 digest ID.
3447Sign, verify, and verifyrecover can be performed in this mode.
3448For pss mode only sign and verify are supported and the digest type must be
3449specified.
3450.It rsa_pss_saltlen : Ns Ar len
3451For pss
3452mode only this option specifies the salt length.
3453Two special values are supported:
3454-1 sets the salt length to the digest length.
3455When signing, -2 sets the salt length to the maximum permissible value.
3456When verifying, -2 causes the salt length to be automatically determined
3457based on the PSS block structure.
3458.El
3459.Pp
3460The DSA algorithm supports the sign and verify operations.
3461Currently there are no additional options other than
3462.Ar digest .
3463Only the SHA1 digest can be used and this digest is assumed by default.
3464.Pp
3465The DH algorithm supports the derive operation
3466and no additional options.
3467.Pp
3468The EC algorithm supports the sign, verify, and derive operations.
3469The sign and verify operations use ECDSA and derive uses ECDH.
3470Currently there are no additional options other than
3471.Ar digest .
3472Only the SHA1 digest can be used and this digest is assumed by default.
3473.It Fl pubin
3474The input file is a public key.
3475.It Fl rev
3476Reverse the order of the input buffer.
3477.It Fl sigfile Ar file
3478Signature file (verify operation only).
3479.It Fl sign
3480Sign the input data and output the signed result.
3481This requires a private key.
3482.It Fl verify
3483Verify the input data against the signature file and indicate if the
3484verification succeeded or failed.
3485.It Fl verifyrecover
3486Verify the input data and output the recovered data.
3487.El
3488.Tg prime
3489.Sh PRIME
3490.Cm openssl prime
3491.Op Fl bits Ar n
3492.Op Fl checks Ar n
3493.Op Fl generate
3494.Op Fl hex
3495.Op Fl safe
3496.Ar p
3497.Pp
3498The
3499.Nm prime
3500command is used to generate prime numbers,
3501or to check numbers for primality.
3502Results are probabilistic:
3503they have an exceedingly high likelihood of being correct,
3504but are not guaranteed.
3505.Pp
3506The options are as follows:
3507.Bl -tag -width Ds
3508.It Fl bits Ar n
3509Specify the number of bits in the generated prime number.
3510Must be used in conjunction with
3511.Fl generate .
3512.It Fl checks Ar n
3513Perform a Miller-Rabin probabilistic primality test with
3514.Ar n
3515iterations.
3516The default is 20.
3517.It Fl generate
3518Generate a pseudo-random prime number.
3519Must be used in conjunction with
3520.Fl bits .
3521.It Fl hex
3522Output in hex format.
3523.It Fl safe
3524Generate only
3525.Qq safe
3526prime numbers
3527(i.e. a prime p so that (p-1)/2 is also prime).
3528.It Ar p
3529Test if number
3530.Ar p
3531is prime.
3532.El
3533.Tg rand
3534.Sh RAND
3535.Bl -hang -width "openssl rand"
3536.It Nm openssl rand
3537.Bk -words
3538.Op Fl base64
3539.Op Fl hex
3540.Op Fl out Ar file
3541.Ar num
3542.Ek
3543.El
3544.Pp
3545The
3546.Nm rand
3547command outputs
3548.Ar num
3549pseudo-random bytes.
3550.Pp
3551The options are as follows:
3552.Bl -tag -width Ds
3553.It Fl base64
3554Perform base64 encoding on the output.
3555.It Fl hex
3556Specify hexadecimal output.
3557.It Fl out Ar file
3558The output file to write to,
3559or standard output if not specified.
3560.El
3561.Tg req
3562.Sh REQ
3563.Bl -hang -width "openssl req"
3564.It Nm openssl req
3565.Bk -words
3566.Op Fl addext Ar ext
3567.Op Fl batch
3568.Op Fl config Ar file
3569.Op Fl days Ar n
3570.Op Fl extensions Ar section
3571.Op Fl in Ar file
3572.Op Fl inform Cm der | pem
3573.Op Fl key Ar keyfile
3574.Op Fl keyform Cm der | pem
3575.Op Fl keyout Ar file
3576.Op Fl md4 | md5 | sha1
3577.Op Fl modulus
3578.Op Fl multivalue-rdn
3579.Op Fl nameopt Ar option
3580.Op Fl new
3581.Op Fl newhdr
3582.Op Fl newkey Ar arg
3583.Op Fl nodes
3584.Op Fl noout
3585.Op Fl out Ar file
3586.Op Fl outform Cm der | pem
3587.Op Fl passin Ar arg
3588.Op Fl passout Ar arg
3589.Op Fl pkeyopt Ar opt:value
3590.Op Fl pubkey
3591.Op Fl reqexts Ar section
3592.Op Fl reqopt Ar option
3593.Op Fl set_serial Ar n
3594.Op Fl sigopt Ar nm:v
3595.Op Fl subj Ar arg
3596.Op Fl subject
3597.Op Fl text
3598.Op Fl utf8
3599.Op Fl verbose
3600.Op Fl verify
3601.Op Fl x509
3602.Ek
3603.El
3604.Pp
3605The
3606.Nm req
3607command primarily creates and processes certificate requests
3608in PKCS#10 format.
3609It can additionally create self-signed certificates,
3610for use as root CAs, for example.
3611.Pp
3612The options are as follows:
3613.Bl -tag -width Ds
3614.It Fl addext Ar ext
3615Add a specific extension to the certificate (if the
3616.Fl x509
3617option is present) or certificate request.
3618The argument must have the form of a key=value pair as it would appear in a
3619config file.
3620This option can be given multiple times.
3621.It Fl batch
3622Non-interactive mode.
3623.It Fl config Ar file
3624Specify an alternative configuration file.
3625.It Fl days Ar n
3626Specify the number of days to certify the certificate for.
3627The default is 30 days.
3628Used with the
3629.Fl x509
3630option.
3631.It Fl extensions Ar section , Fl reqexts Ar section
3632Specify alternative sections to include certificate
3633extensions (with
3634.Fl x509 )
3635or certificate request extensions,
3636allowing several different sections to be used in the same configuration file.
3637.It Fl in Ar file
3638The input file to read a request from,
3639or standard input if not specified.
3640A request is only read if the creation options
3641.Fl new
3642and
3643.Fl newkey
3644are not specified.
3645.It Fl inform Cm der | pem
3646The input format.
3647.It Fl key Ar keyfile
3648The file to read the private key from.
3649It also accepts PKCS#8 format private keys for PEM format files.
3650.It Fl keyform Cm der | pem
3651The format of the private key file specified in the
3652.Fl key
3653argument.
3654The default is
3655.Cm pem .
3656.It Fl keyout Ar file
3657The file to write the newly created private key to.
3658If this option is not specified,
3659the filename present in the configuration file is used.
3660.It Fl md5 | sha1 | sha256
3661The message digest to sign the request with.
3662This overrides the digest algorithm specified in the configuration file.
3663.Pp
3664Some public key algorithms may override this choice.
3665For instance, DSA signatures always use SHA1.
3666.It Fl modulus
3667Print the value of the modulus of the public key contained in the request.
3668.It Fl multivalue-rdn
3669This option causes the
3670.Fl subj
3671argument to be interpreted with full support for multivalued RDNs,
3672for example
3673.Qq "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" .
3674If
3675.Fl multivalue-rdn
3676is not used, the UID value is set to
3677.Qq "123456+CN=John Doe" .
3678.It Fl nameopt Ar option , Fl reqopt Ar option
3679Determine how the subject or issuer names are displayed.
3680.Ar option
3681can be a single option or multiple options separated by commas.
3682Alternatively, these options may be used more than once to set multiple options.
3683See the
3684.Sx X509
3685section below for details.
3686.It Fl new
3687Generate a new certificate request.
3688The user is prompted for the relevant field values.
3689The actual fields prompted for and their maximum and minimum sizes
3690are specified in the configuration file and any requested extensions.
3691.Pp
3692If the
3693.Fl key
3694option is not used, it will generate a new RSA private
3695key using information specified in the configuration file.
3696.It Fl newhdr
3697Add the word NEW to the PEM file header and footer lines
3698on the outputted request.
3699Some software and CAs need this.
3700.It Fl newkey Ar arg
3701Create a new certificate request and a new private key.
3702The argument takes one of several forms.
3703.Pp
3704.No rsa : Ns Ar nbits
3705generates an RSA key
3706.Ar nbits
3707in size.
3708If
3709.Ar nbits
3710is omitted,
3711the default key size is used.
3712.Pp
3713.No dsa : Ns Ar file
3714generates a DSA key using the parameters in
3715.Ar file .
3716.Pp
3717.No param : Ns Ar file
3718generates a key using the parameters or certificate in
3719.Ar file .
3720.Pp
3721All other algorithms support the form
3722.Ar algorithm : Ns Ar file ,
3723where file may be an algorithm parameter file,
3724created by the
3725.Cm genpkey -genparam
3726command or an X.509 certificate for a key with appropriate algorithm.
3727.Ar file
3728can be omitted,
3729in which case any parameters can be specified via the
3730.Fl pkeyopt
3731option.
3732.It Fl nodes
3733Do not encrypt the private key.
3734.It Fl noout
3735Do not output the encoded version of the request.
3736.It Fl out Ar file
3737The output file to write to,
3738or standard output if not specified.
3739.It Fl outform Cm der | pem
3740The output format.
3741.It Fl passin Ar arg
3742The key password source.
3743.It Fl passout Ar arg
3744The output file password source.
3745.It Fl pkeyopt Ar opt:value
3746Set the public key algorithm option
3747.Ar opt
3748to
3749.Ar value .
3750.It Fl pubkey
3751Output the public key.
3752.It Fl reqopt Ar option
3753Customise the output format used with
3754.Fl text .
3755The
3756.Ar option
3757argument can be a single option or multiple options separated by commas.
3758See also the discussion of
3759.Fl certopt
3760in the
3761.Nm x509
3762command.
3763.It Fl set_serial Ar n
3764Serial number to use when outputting a self-signed certificate.
3765This may be specified as a decimal value or a hex value if preceded by
3766.Sq 0x .
3767It is possible to use negative serial numbers but this is not recommended.
3768.It Fl sigopt Ar nm:v
3769Pass options to the signature algorithm during sign operation.
3770The names and values of these options are algorithm-specific.
3771.It Fl subj Ar arg
3772Replaces the subject field of an input request
3773with the specified data and output the modified request.
3774.Ar arg
3775must be formatted as /type0=value0/type1=value1/type2=...;
3776characters may be escaped by
3777.Sq \e
3778(backslash);
3779no spaces are skipped.
3780.It Fl subject
3781Print the request subject (or certificate subject if
3782.Fl x509
3783is specified).
3784.It Fl text
3785Print the certificate request in plain text.
3786.It Fl utf8
3787Interpret field values as UTF8 strings, not ASCII.
3788.It Fl verbose
3789Print extra details about the operations being performed.
3790.It Fl verify
3791Verify the signature on the request.
3792.It Fl x509
3793Output a self-signed certificate instead of a certificate request.
3794This is typically used to generate a test certificate or a self-signed root CA.
3795The extensions added to the certificate (if any)
3796are specified in the configuration file.
3797Unless specified using the
3798.Fl set_serial
3799option, 0 is used for the serial number.
3800.El
3801.Pp
3802The configuration options are specified in the
3803.Qq req
3804section of the configuration file.
3805The options available are as follows:
3806.Bl -tag -width "XXXX"
3807.It Cm attributes
3808The section containing any request attributes: its format
3809is the same as
3810.Cm distinguished_name .
3811Typically these may contain the challengePassword or unstructuredName types.
3812They are currently ignored by the
3813.Nm openssl
3814request signing utilities, but some CAs might want them.
3815.It Cm default_bits
3816The default key size, in bits.
3817The default is 2048.
3818It is used if the
3819.Fl new
3820option is used and can be overridden by using the
3821.Fl newkey
3822option.
3823.It Cm default_keyfile
3824The default file to write a private key to,
3825or standard output if not specified.
3826It can be overridden by the
3827.Fl keyout
3828option.
3829.It Cm default_md
3830The digest algorithm to use.
3831Possible values include
3832.Cm md5 ,
3833.Cm sha1
3834and
3835.Cm sha256
3836(the default).
3837It can be overridden on the command line.
3838.It Cm distinguished_name
3839The section containing the distinguished name fields to
3840prompt for when generating a certificate or certificate request.
3841The format is described below.
3842.It Cm encrypt_key
3843If set to
3844.Qq no
3845and a private key is generated, it is not encrypted.
3846It is equivalent to the
3847.Fl nodes
3848option.
3849For compatibility,
3850.Cm encrypt_rsa_key
3851is an equivalent option.
3852.It Cm input_password | output_password
3853The passwords for the input private key file (if present)
3854and the output private key file (if one will be created).
3855The command line options
3856.Fl passin
3857and
3858.Fl passout
3859override the configuration file values.
3860.It Cm oid_file
3861A file containing additional OBJECT IDENTIFIERS.
3862Each line of the file should consist of the numerical form of the
3863object identifier, followed by whitespace, then the short name followed
3864by whitespace and finally the long name.
3865.It Cm oid_section
3866Specify a section in the configuration file containing extra
3867object identifiers.
3868Each line should consist of the short name of the
3869object identifier followed by
3870.Sq =
3871and the numerical form.
3872The short and long names are the same when this option is used.
3873.It Cm prompt
3874If set to
3875.Qq no ,
3876it disables prompting of certificate fields
3877and just takes values from the config file directly.
3878It also changes the expected format of the
3879.Cm distinguished_name
3880and
3881.Cm attributes
3882sections.
3883.It Cm req_extensions
3884The configuration file section containing a list of
3885extensions to add to the certificate request.
3886It can be overridden by the
3887.Fl reqexts
3888option.
3889.It Cm string_mask
3890Limit the string types for encoding certain fields.
3891The following values may be used, limiting strings to the indicated types:
3892.Bl -tag -width "MASK:number"
3893.It Cm utf8only
3894UTF8String.
3895This is the default, as recommended by PKIX in RFC 2459.
3896.It Cm default
3897PrintableString, IA5String, T61String, BMPString, UTF8String.
3898.It Cm pkix
3899PrintableString, IA5String, BMPString, UTF8String.
3900Inspired by the PKIX recommendation in RFC 2459 for certificates
3901generated before 2004, but differs by also permitting IA5String.
3902.It Cm nombstr
3903PrintableString, IA5String, T61String, UniversalString.
3904A workaround for some ancient software that had problems
3905with the variable-sized BMPString and UTF8String types.
3906.It Cm MASK : Ns Ar number
3907An explicit bitmask of permitted types, where
3908.Ar number
3909is a C-style hex, decimal, or octal number that's a bit-wise OR of
3910.Dv B_ASN1_*
3911values from
3912.In openssl/asn1.h .
3913.El
3914.It Cm utf8
3915If set to
3916.Qq yes ,
3917field values are interpreted as UTF8 strings.
3918.It Cm x509_extensions
3919The configuration file section containing a list of
3920extensions to add to a certificate generated when the
3921.Fl x509
3922switch is used.
3923It can be overridden by the
3924.Fl extensions
3925command line switch.
3926.El
3927.Pp
3928There are two separate formats for the distinguished name and attribute
3929sections.
3930If the
3931.Fl prompt
3932option is set to
3933.Qq no ,
3934then these sections just consist of field names and values.
3935If the
3936.Fl prompt
3937option is absent or not set to
3938.Qq no ,
3939then the file contains field prompting information of the form:
3940.Bd -unfilled -offset indent
3941fieldName="prompt"
3942fieldName_default="default field value"
3943fieldName_min= 2
3944fieldName_max= 4
3945.Ed
3946.Pp
3947.Qq fieldName
3948is the field name being used, for example
3949.Cm commonName
3950(or CN).
3951The
3952.Qq prompt
3953string is used to ask the user to enter the relevant details.
3954If the user enters nothing, the default value is used;
3955if no default value is present, the field is omitted.
3956A field can still be omitted if a default value is present,
3957if the user just enters the
3958.Sq \&.
3959character.
3960.Pp
3961The number of characters entered must be between the
3962fieldName_min and fieldName_max limits:
3963there may be additional restrictions based on the field being used
3964(for example
3965.Cm countryName
3966can only ever be two characters long and must fit in a
3967.Cm PrintableString ) .
3968.Pp
3969Some fields (such as
3970.Cm organizationName )
3971can be used more than once in a DN.
3972This presents a problem because configuration files will
3973not recognize the same name occurring twice.
3974To avoid this problem, if the
3975.Cm fieldName
3976contains some characters followed by a full stop, they will be ignored.
3977So, for example, a second
3978.Cm organizationName
3979can be input by calling it
3980.Qq 1.organizationName .
3981.Pp
3982The actual permitted field names are any object identifier short or
3983long names.
3984These are compiled into
3985.Nm openssl
3986and include the usual values such as
3987.Cm commonName , countryName , localityName , organizationName ,
3988.Cm organizationalUnitName , stateOrProvinceName .
3989Additionally,
3990.Cm emailAddress
3991is included as well as
3992.Cm name , surname , givenName , initials
3993and
3994.Cm dnQualifier .
3995.Pp
3996Additional object identifiers can be defined with the
3997.Cm oid_file
3998or
3999.Cm oid_section
4000options in the configuration file.
4001Any additional fields will be treated as though they were a
4002.Cm DirectoryString .
4003.Tg rsa
4004.Sh RSA
4005.Bl -hang -width "openssl rsa"
4006.It Nm openssl rsa
4007.Bk -words
4008.Op Fl aes128 | aes192 | aes256 | des | des3
4009.Op Fl check
4010.Op Fl in Ar file
4011.Op Fl inform Cm der | net | pem | pvk
4012.Op Fl modulus
4013.Op Fl noout
4014.Op Fl out Ar file
4015.Op Fl outform Cm der | net | pem | pvk
4016.Op Fl passin Ar arg
4017.Op Fl passout Ar arg
4018.Op Fl pubin
4019.Op Fl pubout
4020.Op Fl pvk-none | pvk-strong | pvk-weak
4021.Op Fl RSAPublicKey_in
4022.Op Fl RSAPublicKey_out
4023.Op Fl text
4024.Ek
4025.El
4026.Pp
4027The
4028.Nm rsa
4029command processes RSA keys.
4030They can be converted between various forms and their components printed out.
4031.Nm rsa
4032uses the traditional
4033.Nm SSLeay
4034compatible format for private key encryption:
4035newer applications should use the more secure PKCS#8 format using the
4036.Nm pkcs8
4037utility.
4038.Pp
4039The options are as follows:
4040.Bl -tag -width Ds
4041.It Fl aes128 | aes192 | aes256 | des | des3
4042Encrypt the private key with the AES, DES,
4043or the triple DES ciphers, respectively, before outputting it.
4044A pass phrase is prompted for.
4045If none of these options are specified, the key is written in plain text.
4046This means that using the
4047.Nm rsa
4048utility to read in an encrypted key with no encryption option can be used
4049to remove the pass phrase from a key, or by setting the encryption options
4050it can be used to add or change the pass phrase.
4051These options can only be used with PEM format output files.
4052.It Fl check
4053Check the consistency of an RSA private key.
4054.It Fl in Ar file
4055The input file to read from,
4056or standard input if not specified.
4057If the key is encrypted, a pass phrase will be prompted for.
4058.It Fl inform Cm der | net | pem | pvk
4059The input format.
4060.It Fl noout
4061Do not output the encoded version of the key.
4062.It Fl modulus
4063Print the value of the modulus of the key.
4064.It Fl out Ar file
4065The output file to write to,
4066or standard output if not specified.
4067.It Fl outform Cm der | net | pem | pvk
4068The output format.
4069.It Fl passin Ar arg
4070The key password source.
4071.It Fl passout Ar arg
4072The output file password source.
4073.It Fl pubin
4074Read in a public key,
4075not a private key.
4076.It Fl pubout
4077Output a public key,
4078not a private key.
4079Automatically set if the input is a public key.
4080.It Xo
4081.Fl pvk-none | pvk-strong | pvk-weak
4082.Xc
4083Enable or disable PVK encoding.
4084The default is
4085.Fl pvk-strong .
4086.It Fl RSAPublicKey_in , RSAPublicKey_out
4087Same as
4088.Fl pubin
4089and
4090.Fl pubout
4091except
4092.Cm RSAPublicKey
4093format is used instead.
4094.It Fl text
4095Print the public/private key components in plain text.
4096.El
4097.Tg rsautl
4098.Sh RSAUTL
4099.Bl -hang -width "openssl rsautl"
4100.It Nm openssl rsautl
4101.Bk -words
4102.Op Fl asn1parse
4103.Op Fl certin
4104.Op Fl decrypt
4105.Op Fl encrypt
4106.Op Fl hexdump
4107.Op Fl in Ar file
4108.Op Fl inkey Ar file
4109.Op Fl keyform Cm der | pem
4110.Op Fl oaep | pkcs | raw | x931
4111.Op Fl out Ar file
4112.Op Fl passin Ar arg
4113.Op Fl pubin
4114.Op Fl rev
4115.Op Fl sign
4116.Op Fl verify
4117.Ek
4118.El
4119.Pp
4120The
4121.Nm rsautl
4122command can be used to sign, verify, encrypt and decrypt
4123data using the RSA algorithm.
4124.Pp
4125The options are as follows:
4126.Bl -tag -width Ds
4127.It Fl asn1parse
4128Asn1parse the output data; this is useful when combined with the
4129.Fl verify
4130option.
4131.It Fl certin
4132The input is a certificate containing an RSA public key.
4133.It Fl decrypt
4134Decrypt the input data using an RSA private key.
4135.It Fl encrypt
4136Encrypt the input data using an RSA public key.
4137.It Fl hexdump
4138Hex dump the output data.
4139.It Fl in Ar file
4140The input to read from,
4141or standard input if not specified.
4142.It Fl inkey Ar file
4143The input key file; by default an RSA private key.
4144.It Fl keyform Cm der | pem
4145The private key format.
4146The default is
4147.Cm pem .
4148.It Fl oaep | pkcs | raw | x931
4149The padding to use:
4150PKCS#1 OAEP, PKCS#1 v1.5 (the default), no padding, or ANSI X9.31,
4151respectively.
4152For signatures, only
4153.Fl pkcs
4154and
4155.Fl raw
4156can be used.
4157.It Fl out Ar file
4158The output file to write to,
4159or standard output if not specified.
4160.It Fl passin Ar arg
4161The key password source.
4162.It Fl pubin
4163The input file is an RSA public key.
4164.It Fl rev
4165Reverse the order of the input buffer.
4166.It Fl sign
4167Sign the input data and output the signed result.
4168This requires an RSA private key.
4169.It Fl verify
4170Verify the input data and output the recovered data.
4171.El
4172.Tg s_client
4173.Sh S_CLIENT
4174.Bl -hang -width "openssl s_client"
4175.It Nm openssl s_client
4176.Bk -words
4177.Op Fl 4 | 6
4178.Op Fl alpn Ar protocols
4179.Op Fl bugs
4180.Op Fl CAfile Ar file
4181.Op Fl CApath Ar directory
4182.Op Fl cert Ar file
4183.Op Fl certform Cm der | pem
4184.Op Fl check_ss_sig
4185.Op Fl cipher Ar cipherlist
4186.Op Fl connect Ar host Ns Op : Ns Ar port
4187.Op Fl crl_check
4188.Op Fl crl_check_all
4189.Op Fl crlf
4190.Op Fl debug
4191.Op Fl dtls
4192.Op Fl dtls1_2
4193.Op Fl extended_crl
4194.Op Fl groups Ar list
4195.Op Fl host Ar host
4196.Op Fl ign_eof
4197.Op Fl ignore_critical
4198.Op Fl issuer_checks
4199.Op Fl key Ar keyfile
4200.Op Fl keyform Cm der | pem
4201.Op Fl keymatexport Ar label
4202.Op Fl keymatexportlen Ar len
4203.Op Fl legacy_server_connect
4204.Op Fl msg
4205.Op Fl mtu Ar mtu
4206.Op Fl nbio
4207.Op Fl nbio_test
4208.Op Fl no_comp
4209.Op Fl no_ign_eof
4210.Op Fl no_legacy_server_connect
4211.Op Fl no_ticket
4212.Op Fl no_tls1_2
4213.Op Fl no_tls1_3
4214.Op Fl pass Ar arg
4215.Op Fl policy_check
4216.Op Fl port Ar port
4217.Op Fl prexit
4218.Op Fl proxy Ar host : Ns Ar port
4219.Op Fl quiet
4220.Op Fl reconnect
4221.Op Fl servername Ar name
4222.Op Fl serverpref
4223.Op Fl sess_in Ar file
4224.Op Fl sess_out Ar file
4225.Op Fl showcerts
4226.Op Fl starttls Ar protocol
4227.Op Fl state
4228.Op Fl status
4229.Op Fl timeout
4230.Op Fl tls1_2
4231.Op Fl tls1_3
4232.Op Fl tlsextdebug
4233.Op Fl use_srtp Ar profiles
4234.Op Fl verify Ar depth
4235.Op Fl verify_return_error
4236.Op Fl x509_strict
4237.Op Fl xmpphost Ar host
4238.Ek
4239.El
4240.Pp
4241The
4242.Nm s_client
4243command implements a generic SSL/TLS client which connects
4244to a remote host using SSL/TLS.
4245.Pp
4246If a connection is established with an SSL server, any data received
4247from the server is displayed and any key presses will be sent to the
4248server.
4249When used interactively (which means neither
4250.Fl quiet
4251nor
4252.Fl ign_eof
4253have been given), the session will be renegotiated if the line begins with an
4254.Cm R ;
4255if the line begins with a
4256.Cm Q
4257or if end of file is reached, the connection will be closed down.
4258.Pp
4259The options are as follows:
4260.Bl -tag -width Ds
4261.It Fl 4
4262Attempt connections using IPv4 only.
4263.It Fl 6
4264Attempt connections using IPv6 only.
4265.It Fl alpn Ar protocols
4266Enable the Application-Layer Protocol Negotiation.
4267.Ar protocols
4268is a comma-separated list of protocol names that the client should advertise
4269support for.
4270.It Fl bugs
4271Enable various workarounds for buggy implementations.
4272.It Fl CAfile Ar file
4273A
4274.Ar file
4275containing trusted certificates to use during server authentication
4276and to use when attempting to build the client certificate chain.
4277.It Fl CApath Ar directory
4278The
4279.Ar directory
4280to use for server certificate verification.
4281This directory must be in
4282.Qq hash format ;
4283see
4284.Fl verify
4285for more information.
4286These are also used when building the client certificate chain.
4287.It Fl cert Ar file
4288The certificate to use, if one is requested by the server.
4289The default is not to use a certificate.
4290.It Fl certform Cm der | pem
4291The certificate format.
4292The default is
4293.Cm pem .
4294.It Xo
4295.Fl check_ss_sig ,
4296.Fl crl_check ,
4297.Fl crl_check_all ,
4298.Fl extended_crl ,
4299.Fl ignore_critical ,
4300.Fl issuer_checks ,
4301.Fl policy_check ,
4302.Fl x509_strict
4303.Xc
4304Set various certificate chain validation options.
4305See the
4306.Nm verify
4307command for details.
4308.It Fl cipher Ar cipherlist
4309Modify the cipher list sent by the client.
4310Although the server determines which cipher suite is used, it should take
4311the first supported cipher in the list sent by the client.
4312See the
4313.Nm ciphers
4314command for more information.
4315.It Fl connect Ar host Ns Op : Ns Ar port
4316The
4317.Ar host
4318and
4319.Ar port
4320to connect to.
4321If not specified, an attempt is made to connect to the local host
4322on port 4433.
4323Alternatively, the host and port pair may be separated using a forward-slash
4324character,
4325which is useful for numeric IPv6 addresses.
4326.It Fl crlf
4327Translate a line feed from the terminal into CR+LF,
4328as required by some servers.
4329.It Fl debug
4330Print extensive debugging information, including a hex dump of all traffic.
4331.It Fl dtls
4332Permit any version of DTLS.
4333.It Fl dtls1_2
4334Permit only DTLS1.2.
4335.It Fl groups Ar list
4336Set the supported elliptic curve groups to the colon separated
4337.Ar list
4338of group NIDs or names as documented in
4339.Xr SSL_CTX_set1_groups_list 3 .
4340.It Fl host Ar host
4341The
4342.Ar host
4343to connect to.
4344The default is localhost.
4345.It Fl ign_eof
4346Inhibit shutting down the connection when end of file is reached in the input.
4347.It Fl key Ar keyfile
4348The private key to use.
4349If not specified, the certificate file will be used.
4350.It Fl keyform Cm der | pem
4351The private key format.
4352The default is
4353.Cm pem .
4354.It Fl keymatexport Ar label
4355Export keying material using label.
4356.It Fl keymatexportlen Ar len
4357Export len bytes of keying material (default 20).
4358.It Fl legacy_server_connect , no_legacy_server_connect
4359Allow or disallow initial connection to servers that don't support RI.
4360.It Fl msg
4361Show all protocol messages with hex dump.
4362.It Fl mtu Ar mtu
4363Set the link layer MTU.
4364.It Fl nbio
4365Turn on non-blocking I/O.
4366.It Fl nbio_test
4367Test non-blocking I/O.
4368.It Fl no_ign_eof
4369Shut down the connection when end of file is reached in the input.
4370Can be used to override the implicit
4371.Fl ign_eof
4372after
4373.Fl quiet .
4374.It Fl no_tls1_2 | no_tls1_3
4375Disable the use of TLS1.2 and 1.3, respectively.
4376.It Fl no_ticket
4377Disable RFC 4507 session ticket support.
4378.It Fl pass Ar arg
4379The private key password source.
4380.It Fl port Ar port
4381The
4382.Ar port
4383to connect to.
4384The default is 4433.
4385.It Fl prexit
4386Print session information when the program exits.
4387This will always attempt
4388to print out information even if the connection fails.
4389Normally, information will only be printed out once if the connection succeeds.
4390This option is useful because the cipher in use may be renegotiated
4391or the connection may fail because a client certificate is required or is
4392requested only after an attempt is made to access a certain URL.
4393Note that the output produced by this option is not always accurate
4394because a connection might never have been established.
4395.It Fl proxy Ar host : Ns Ar port
4396Use the HTTP proxy at
4397.Ar host
4398and
4399.Ar port .
4400The connection to the proxy is done in cleartext and the
4401.Fl connect
4402argument is given to the proxy.
4403If not specified, localhost is used as final destination.
4404After that, switch the connection through the proxy to the destination
4405to TLS.
4406.It Fl quiet
4407Inhibit printing of session and certificate information.
4408This implicitly turns on
4409.Fl ign_eof
4410as well.
4411.It Fl reconnect
4412Reconnect to the same server 5 times using the same session ID; this can
4413be used as a test that session caching is working.
4414.It Fl servername Ar name
4415Include the TLS Server Name Indication (SNI) extension in the ClientHello
4416message, using the specified server
4417.Ar name .
4418.It Fl showcerts
4419Display the whole server certificate chain: normally only the server
4420certificate itself is displayed.
4421.It Fl serverpref
4422Use the server's cipher preferences.
4423.It Fl sess_in Ar file
4424Load TLS session from file.
4425The client will attempt to resume a connection from this session.
4426.It Fl sess_out Ar file
4427Output TLS session to file.
4428.It Fl starttls Ar protocol
4429Send the protocol-specific messages to switch to TLS for communication.
4430.Ar protocol
4431is a keyword for the intended protocol.
4432Currently, the supported keywords are
4433.Qq ftp ,
4434.Qq imap ,
4435.Qq smtp ,
4436.Qq pop3 ,
4437and
4438.Qq xmpp .
4439.It Fl state
4440Print the SSL session states.
4441.It Fl status
4442Send a certificate status request to the server (OCSP stapling).
4443The server response (if any) is printed out.
4444.It Fl timeout
4445Enable send/receive timeout on DTLS connections.
4446.It Fl tls1_2 | tls1_3
4447Permit only TLS1.2 or 1.3 respectively.
4448.It Fl tlsextdebug
4449Print a hex dump of any TLS extensions received from the server.
4450.It Fl use_srtp Ar profiles
4451Offer SRTP key management with a colon-separated profile list.
4452.It Fl verify Ar depth
4453Turn on server certificate verification,
4454with a maximum length of
4455.Ar depth .
4456Currently the verify operation continues after errors so all the problems
4457with a certificate chain can be seen.
4458As a side effect the connection will never fail due to a server
4459certificate verify failure.
4460.It Fl verify_return_error
4461Return verification error.
4462.It Fl xmpphost Ar hostname
4463When used with
4464.Fl starttls Ar xmpp ,
4465specify the host for the "to" attribute of the stream element.
4466If this option is not specified then the host specified with
4467.Fl connect
4468will be used.
4469.El
4470.Tg s_server
4471.Sh S_SERVER
4472.Bl -hang -width "openssl s_server"
4473.It Nm openssl s_server
4474.Bk -words
4475.Op Fl accept Ar port
4476.Op Fl alpn Ar protocols
4477.Op Fl bugs
4478.Op Fl CAfile Ar file
4479.Op Fl CApath Ar directory
4480.Op Fl cert Ar file
4481.Op Fl cert2 Ar file
4482.Op Fl certform Cm der | pem
4483.Op Fl cipher Ar cipherlist
4484.Op Fl context Ar id
4485.Op Fl crl_check
4486.Op Fl crl_check_all
4487.Op Fl crlf
4488.Op Fl dcert Ar file
4489.Op Fl dcertform Cm der | pem
4490.Op Fl debug
4491.Op Fl dhparam Ar file
4492.Op Fl dkey Ar file
4493.Op Fl dkeyform Cm der | pem
4494.Op Fl dpass Ar arg
4495.Op Fl dtls
4496.Op Fl dtls1
4497.Op Fl dtls1_2
4498.Op Fl groups Ar list
4499.Op Fl HTTP
4500.Op Fl id_prefix Ar arg
4501.Op Fl key Ar keyfile
4502.Op Fl key2 Ar keyfile
4503.Op Fl keyform Cm der | pem
4504.Op Fl keymatexport Ar label
4505.Op Fl keymatexportlen Ar len
4506.Op Fl msg
4507.Op Fl mtu Ar mtu
4508.Op Fl naccept Ar num
4509.Op Fl named_curve Ar arg
4510.Op Fl nbio
4511.Op Fl nbio_test
4512.Op Fl no_cache
4513.Op Fl no_dhe
4514.Op Fl no_ecdhe
4515.Op Fl no_ticket
4516.Op Fl no_tls1_2
4517.Op Fl no_tls1_3
4518.Op Fl no_tmp_rsa
4519.Op Fl nocert
4520.Op Fl pass Ar arg
4521.Op Fl quiet
4522.Op Fl servername Ar name
4523.Op Fl servername_fatal
4524.Op Fl serverpref
4525.Op Fl state
4526.Op Fl status
4527.Op Fl status_timeout Ar nsec
4528.Op Fl status_url Ar url
4529.Op Fl status_verbose
4530.Op Fl timeout
4531.Op Fl tls1_2
4532.Op Fl tls1_3
4533.Op Fl tlsextdebug
4534.Op Fl use_srtp Ar profiles
4535.Op Fl Verify Ar depth
4536.Op Fl verify Ar depth
4537.Op Fl verify_return_error
4538.Op Fl WWW
4539.Op Fl www
4540.Ek
4541.El
4542.Pp
4543The
4544.Nm s_server
4545command implements a generic SSL/TLS server which listens
4546for connections on a given port using SSL/TLS.
4547.Pp
4548If a connection request is established with a client and neither the
4549.Fl www
4550nor the
4551.Fl WWW
4552option has been used, then any data received
4553from the client is displayed and any key presses are sent to the client.
4554Certain single letter commands perform special operations:
4555.Pp
4556.Bl -tag -width "XXXX" -compact
4557.It Ic P
4558Send plain text, which should cause the client to disconnect.
4559.It Ic Q
4560End the current SSL connection and exit.
4561.It Ic q
4562End the current SSL connection, but still accept new connections.
4563.It Ic R
4564Renegotiate the SSL session and request a client certificate.
4565.It Ic r
4566Renegotiate the SSL session.
4567.It Ic S
4568Print out some session cache status information.
4569.El
4570.Pp
4571The options are as follows:
4572.Bl -tag -width Ds
4573.It Fl accept Ar port
4574Listen on TCP
4575.Ar port
4576for connections.
4577The default is port 4433.
4578.It Fl alpn Ar protocols
4579Enable the Application-Layer Protocol Negotiation.
4580.Ar protocols
4581is a comma-separated list of supported protocol names.
4582.It Fl bugs
4583Enable various workarounds for buggy implementations.
4584.It Fl CAfile Ar file
4585A
4586.Ar file
4587containing trusted certificates to use during client authentication
4588and to use when attempting to build the server certificate chain.
4589The list is also used in the list of acceptable client CAs passed to the
4590client when a certificate is requested.
4591.It Fl CApath Ar directory
4592The
4593.Ar directory
4594to use for client certificate verification.
4595This directory must be in
4596.Qq hash format ;
4597see
4598.Fl verify
4599for more information.
4600These are also used when building the server certificate chain.
4601.It Fl cert Ar file
4602The certificate to use: most server's cipher suites require the use of a
4603certificate and some require a certificate with a certain public key type.
4604For example, the DSS cipher suites require a certificate containing a DSS
4605(DSA) key.
4606If not specified, the file
4607.Pa server.pem
4608will be used.
4609.It Fl cert2 Ar file
4610The certificate to use for servername.
4611.It Fl certform Cm der | pem
4612The certificate format.
4613The default is
4614.Cm pem .
4615.It Fl cipher Ar cipherlist
4616Modify the cipher list used by the server.
4617This allows the cipher list used by the server to be modified.
4618When the client sends a list of supported ciphers, the first client cipher
4619also included in the server list is used.
4620Because the client specifies the preference order, the order of the server
4621cipherlist is irrelevant.
4622See the
4623.Nm ciphers
4624command for more information.
4625.It Fl context Ar id
4626Set the SSL context ID.
4627It can be given any string value.
4628.It Fl crl_check , crl_check_all
4629Check the peer certificate has not been revoked by its CA.
4630The CRLs are appended to the certificate file.
4631.Fl crl_check_all
4632checks all CRLs of all CAs in the chain.
4633.It Fl crlf
4634Translate a line feed from the terminal into CR+LF.
4635.It Fl dcert Ar file , Fl dkey Ar file
4636Specify an additional certificate and private key; these behave in the
4637same manner as the
4638.Fl cert
4639and
4640.Fl key
4641options except there is no default if they are not specified
4642(no additional certificate or key is used).
4643By using RSA and DSS certificates and keys,
4644a server can support clients which only support RSA or DSS cipher suites
4645by using an appropriate certificate.
4646.It Fl dcertform Cm der | pem , Fl dkeyform Cm der | pem , Fl dpass Ar arg
4647Additional certificate and private key format, and private key password source,
4648respectively.
4649.It Fl debug
4650Print extensive debugging information, including a hex dump of all traffic.
4651.It Fl dhparam Ar file
4652The DH parameter file to use.
4653The ephemeral DH cipher suites generate keys
4654using a set of DH parameters.
4655If not specified, an attempt is made to
4656load the parameters from the server certificate file.
4657If this fails, a static set of parameters hard coded into the
4658.Nm s_server
4659program will be used.
4660.It Fl dtls
4661Permit any version of DTLS.
4662.It Fl dtls1_2
4663Permit only DTLS1.2.
4664.It Fl groups Ar list
4665Set the supported elliptic curve groups to the colon separated
4666.Ar list
4667of group NIDs or names as documented in
4668.Xr SSL_CTX_set1_groups_list 3 .
4669.It Fl HTTP
4670Emulate a simple web server.
4671Pages are resolved relative to the current directory.
4672For example if the URL
4673.Pa https://myhost/page.html
4674is requested, the file
4675.Pa ./page.html
4676will be loaded.
4677The files loaded are assumed to contain a complete and correct HTTP
4678response (lines that are part of the HTTP response line and headers
4679must end with CRLF).
4680.It Fl id_prefix Ar arg
4681Generate SSL/TLS session IDs prefixed by
4682.Ar arg .
4683This is mostly useful for testing any SSL/TLS code
4684that wish to deal with multiple servers,
4685when each of which might be generating a unique range of session IDs.
4686.It Fl key Ar keyfile
4687The private key to use.
4688If not specified, the certificate file will be used.
4689.It Fl key2 Ar keyfile
4690The private key to use for servername.
4691.It Fl keyform Cm der | pem
4692The private key format.
4693The default is
4694.Cm pem .
4695.It Fl keymatexport Ar label
4696Export keying material using label.
4697.It Fl keymatexportlen Ar len
4698Export len bytes of keying material (default 20).
4699.It Fl msg
4700Show all protocol messages with hex dump.
4701.It Fl mtu Ar mtu
4702Set the link layer MTU.
4703.It Fl naccept Ar num
4704Terminate server after
4705.Ar num
4706connections.
4707.It Fl named_curve Ar arg
4708Specify the elliptic curve name to use for ephemeral ECDH keys.
4709This option is deprecated; use
4710.Fl groups
4711instead.
4712.It Fl nbio
4713Turn on non-blocking I/O.
4714.It Fl nbio_test
4715Test non-blocking I/O.
4716.It Fl no_cache
4717Disable session caching.
4718.It Fl no_dhe
4719Disable ephemeral DH cipher suites.
4720.It Fl no_ecdhe
4721Disable ephemeral ECDH cipher suites.
4722.It Fl no_ticket
4723Disable RFC 4507 session ticket support.
4724.It Fl no_tls1_2 | no_tls1_3
4725Disable the use of TLS1.2 and 1.3, respectively.
4726.It Fl no_tmp_rsa
4727Disable temporary RSA key generation.
4728.It Fl nocert
4729Do not use a certificate.
4730This restricts the cipher suites available to the anonymous ones
4731(currently just anonymous DH).
4732.It Fl pass Ar arg
4733The private key password source.
4734.It Fl quiet
4735Inhibit printing of session and certificate information.
4736.It Fl servername Ar name
4737Set the TLS Server Name Indication (SNI) extension with
4738.Ar name .
4739.It Fl servername_fatal
4740Send fatal alert if servername does not match.
4741The default is warning alert.
4742.It Fl serverpref
4743Use server's cipher preferences.
4744.It Fl state
4745Print the SSL session states.
4746.It Fl status
4747Enables certificate status request support (OCSP stapling).
4748.It Fl status_timeout Ar nsec
4749Sets the timeout for OCSP response in seconds.
4750.It Fl status_url Ar url
4751Sets a fallback responder URL to use if no responder URL is present in the
4752server certificate.
4753Without this option, an error is returned if the server certificate does not
4754contain a responder address.
4755.It Fl status_verbose
4756Enables certificate status request support (OCSP stapling) and gives a verbose
4757printout of the OCSP response.
4758.It Fl timeout
4759Enable send/receive timeout on DTLS connections.
4760.It Fl tls1_2 | tls1_3
4761Permit only TLS1.2, or 1.3, respectively.
4762.It Fl tlsextdebug
4763Print a hex dump of any TLS extensions received from the server.
4764.It Fl use_srtp Ar profiles
4765Offer SRTP key management with a colon-separated profile list.
4766.It Fl verify_return_error
4767Return verification error.
4768.It Fl WWW
4769Emulate a simple web server.
4770Pages are resolved relative to the current directory.
4771For example if the URL
4772.Pa https://myhost/page.html
4773is requested, the file
4774.Pa ./page.html
4775will be loaded.
4776.It Fl www
4777Send a status message to the client when it connects,
4778including information about the ciphers used and various session parameters.
4779The output is in HTML format so this option will normally be used with a
4780web browser.
4781.It Fl Verify Ar depth , Fl verify Ar depth
4782Request a certificate chain from the client,
4783with a maximum length of
4784.Ar depth .
4785With
4786.Fl Verify ,
4787the client must supply a certificate or an error occurs;
4788with
4789.Fl verify ,
4790a certificate is requested but the client does not have to send one.
4791.El
4792.Tg s_time
4793.Sh S_TIME
4794.Bl -hang -width "openssl s_time"
4795.It Nm openssl s_time
4796.Bk -words
4797.Op Fl bugs
4798.Op Fl CAfile Ar file
4799.Op Fl CApath Ar directory
4800.Op Fl cert Ar file
4801.Op Fl cipher Ar cipherlist
4802.Op Fl connect Ar host Ns Op : Ns Ar port
4803.Op Fl key Ar keyfile
4804.Op Fl nbio
4805.Op Fl new
4806.Op Fl no_shutdown
4807.Op Fl reuse
4808.Op Fl time Ar seconds
4809.Op Fl verify Ar depth
4810.Op Fl www Ar page
4811.Ek
4812.El
4813.Pp
4814The
4815.Nm s_time
4816command implements a generic SSL/TLS client which connects to a
4817remote host using SSL/TLS.
4818It can request a page from the server and includes
4819the time to transfer the payload data in its timing measurements.
4820It measures the number of connections within a given timeframe,
4821the amount of data transferred
4822.Pq if any ,
4823and calculates the average time spent for one connection.
4824.Pp
4825The options are as follows:
4826.Bl -tag -width Ds
4827.It Fl bugs
4828Enable various workarounds for buggy implementations.
4829.It Fl CAfile Ar file
4830A
4831.Ar file
4832containing trusted certificates to use during server authentication
4833and to use when attempting to build the client certificate chain.
4834.It Fl CApath Ar directory
4835The directory to use for server certificate verification.
4836This directory must be in
4837.Qq hash format ;
4838see
4839.Nm verify
4840for more information.
4841These are also used when building the client certificate chain.
4842.It Fl cert Ar file
4843The certificate to use, if one is requested by the server.
4844The default is not to use a certificate.
4845.It Fl cipher Ar cipherlist
4846Modify the cipher list sent by the client.
4847Although the server determines which cipher suite is used,
4848it should take the first supported cipher in the list sent by the client.
4849See the
4850.Nm ciphers
4851command for more information.
4852.It Fl connect Ar host Ns Op : Ns Ar port
4853The host and port to connect to.
4854.It Fl key Ar keyfile
4855The private key to use.
4856If not specified, the certificate file will be used.
4857.It Fl nbio
4858Turn on non-blocking I/O.
4859.It Fl new
4860Perform the timing test using a new session ID for each connection.
4861If neither
4862.Fl new
4863nor
4864.Fl reuse
4865are specified,
4866they are both on by default and executed in sequence.
4867.It Fl no_shutdown
4868Shut down the connection without sending a
4869.Qq close notify
4870shutdown alert to the server.
4871.It Fl reuse
4872Perform the timing test using the same session ID for each connection.
4873If neither
4874.Fl new
4875nor
4876.Fl reuse
4877are specified,
4878they are both on by default and executed in sequence.
4879.It Fl time Ar seconds
4880Limit
4881.Nm s_time
4882benchmarks to the number of
4883.Ar seconds .
4884The default is 30 seconds.
4885.It Fl verify Ar depth
4886Turn on server certificate verification,
4887with a maximum length of
4888.Ar depth .
4889Currently the verify operation continues after errors, so all the problems
4890with a certificate chain can be seen.
4891As a side effect,
4892the connection will never fail due to a server certificate verify failure.
4893.It Fl www Ar page
4894The page to GET from the server.
4895A value of
4896.Sq /
4897gets the index.htm[l] page.
4898If this parameter is not specified,
4899.Nm s_time
4900will only perform the handshake to establish SSL connections
4901but not transfer any payload data.
4902.El
4903.Tg sess_id
4904.Sh SESS_ID
4905.Bl -hang -width "openssl sess_id"
4906.It Nm openssl sess_id
4907.Bk -words
4908.Op Fl cert
4909.Op Fl context Ar ID
4910.Op Fl in Ar file
4911.Op Fl inform Cm der | pem
4912.Op Fl noout
4913.Op Fl out Ar file
4914.Op Fl outform Cm der | pem
4915.Op Fl text
4916.Ek
4917.El
4918.Pp
4919The
4920.Nm sess_id
4921program processes the encoded version of the SSL session structure and
4922optionally prints out SSL session details
4923(for example the SSL session master key)
4924in human-readable format.
4925.Pp
4926The options are as follows:
4927.Bl -tag -width Ds
4928.It Fl cert
4929If a certificate is present in the session,
4930it will be output using this option;
4931if the
4932.Fl text
4933option is also present, then it will be printed out in text form.
4934.It Fl context Ar ID
4935Set the session
4936.Ar ID .
4937The ID can be any string of characters.
4938.It Fl in Ar file
4939The input file to read from,
4940or standard input if not specified.
4941.It Fl inform Cm der | pem
4942The input format.
4943.Cm der
4944uses an ASN.1 DER-encoded format containing session details.
4945The precise format can vary from one version to the next.
4946.Cm pem
4947is the default format: it consists of the DER
4948format base64-encoded with additional header and footer lines.
4949.It Fl noout
4950Do not output the encoded version of the session.
4951.It Fl out Ar file
4952The output file to write to,
4953or standard output if not specified.
4954.It Fl outform Cm der | pem
4955The output format.
4956.It Fl text
4957Print the various public or private key components in plain text,
4958in addition to the encoded version.
4959.El
4960.Pp
4961The output of
4962.Nm sess_id
4963is composed as follows:
4964.Pp
4965.Bl -tag -width "Verify return code " -offset 3n -compact
4966.It Protocol
4967The protocol in use.
4968.It Cipher
4969The actual raw SSL or TLS cipher code.
4970.It Session-ID
4971The SSL session ID, in hex format.
4972.It Session-ID-ctx
4973The session ID context, in hex format.
4974.It Master-Key
4975The SSL session master key.
4976.It Key-Arg
4977The key argument; this is only used in SSL v2.
4978.It Start Time
4979The session start time.
4980.Ux
4981format.
4982.It Timeout
4983The timeout, in seconds.
4984.It Verify return code
4985The return code when a certificate is verified.
4986.El
4987.Pp
4988Since the SSL session output contains the master key, it is possible to read
4989the contents of an encrypted session using this information.
4990Therefore appropriate security precautions
4991should be taken if the information is being output by a
4992.Qq real
4993application.
4994This is, however, strongly discouraged and should only be used for
4995debugging purposes.
4996.Tg smime
4997.Sh SMIME
4998.Bl -hang -width "openssl smime"
4999.It Nm openssl smime
5000.Bk -words
5001.Oo
5002.Fl aes128 | aes192 | aes256 | des |
5003.Fl des3 | rc2-40 | rc2-64 | rc2-128
5004.Oc
5005.Op Fl binary
5006.Op Fl CAfile Ar file
5007.Op Fl CApath Ar directory
5008.Op Fl certfile Ar file
5009.Op Fl check_ss_sig
5010.Op Fl content Ar file
5011.Op Fl crl_check
5012.Op Fl crl_check_all
5013.Op Fl decrypt
5014.Op Fl encrypt
5015.Op Fl extended_crl
5016.Op Fl from Ar addr
5017.Op Fl ignore_critical
5018.Op Fl in Ar file
5019.Op Fl indef
5020.Op Fl inform Cm der | pem | smime
5021.Op Fl inkey Ar file
5022.Op Fl issuer_checks
5023.Op Fl keyform Cm der | pem
5024.Op Fl md Ar digest
5025.Op Fl noattr
5026.Op Fl nocerts
5027.Op Fl nochain
5028.Op Fl nodetach
5029.Op Fl noindef
5030.Op Fl nointern
5031.Op Fl nosigs
5032.Op Fl nosmimecap
5033.Op Fl noverify
5034.Op Fl out Ar file
5035.Op Fl outform Cm der | pem | smime
5036.Op Fl passin Ar arg
5037.Op Fl pk7out
5038.Op Fl policy_check
5039.Op Fl recip Ar file
5040.Op Fl resign
5041.Op Fl sign
5042.Op Fl signer Ar file
5043.Op Fl stream
5044.Op Fl subject Ar s
5045.Op Fl text
5046.Op Fl to Ar addr
5047.Op Fl verify
5048.Op Fl x509_strict
5049.Op Ar cert.pem ...
5050.Ek
5051.El
5052.Pp
5053The
5054.Nm smime
5055command handles S/MIME mail.
5056It can encrypt, decrypt, sign, and verify S/MIME messages.
5057.Pp
5058The MIME message must be sent without any blank lines between the
5059headers and the output.
5060Some mail programs will automatically add a blank line.
5061Piping the mail directly to an MTA is one way to
5062achieve the correct format.
5063.Pp
5064The supplied message to be signed or encrypted must include the necessary
5065MIME headers or many S/MIME clients won't display it properly (if at all).
5066Use the
5067.Fl text
5068option to automatically add plain text headers.
5069.Pp
5070A
5071.Qq signed and encrypted
5072message is one where a signed message is then encrypted.
5073This can be produced by encrypting an already signed message.
5074.Pp
5075There are a number of operations that can be performed, as follows:
5076.Bl -tag -width "XXXX"
5077.It Fl decrypt
5078Decrypt mail using the supplied certificate and private key.
5079The input file is an encrypted mail message in MIME format.
5080The decrypted mail is written to the output file.
5081.It Fl encrypt
5082Encrypt mail for the given recipient certificates.
5083The input is the message to be encrypted.
5084The output file is the encrypted mail, in MIME format.
5085.It Fl pk7out
5086Take an input message and write out a PEM-encoded PKCS#7 structure.
5087.It Fl resign
5088Resign a message: take an existing message and one or more new signers.
5089.It Fl sign
5090Sign mail using the supplied certificate and private key.
5091The input file is the message to be signed.
5092The signed message, in MIME format, is written to the output file.
5093.It Fl verify
5094Verify signed mail.
5095The input is a signed mail message and the output is the signed data.
5096Both clear text and opaque signing is supported.
5097.El
5098.Pp
5099The remaining options are as follows:
5100.Bl -tag -width "XXXX"
5101.It Xo
5102.Fl aes128 | aes192 | aes256 | des |
5103.Fl des3 | rc2-40 | rc2-64 | rc2-128
5104.Xc
5105The encryption algorithm to use.
5106128-, 192-, or 256-bit AES, DES (56 bits), triple DES (168 bits),
5107or 40-, 64-, or 128-bit RC2, respectively;
5108if not specified, 40-bit RC2 is
5109used.
5110Only used with
5111.Fl encrypt .
5112.It Fl binary
5113Normally, the input message is converted to
5114.Qq canonical
5115format which uses CR/LF as end of line,
5116as required by the S/MIME specification.
5117When this option is present, no translation occurs.
5118This is useful when handling binary data which may not be in MIME format.
5119.It Fl CAfile Ar file
5120A
5121.Ar file
5122containing trusted CA certificates; only used with
5123.Fl verify .
5124.It Fl CApath Ar directory
5125A
5126.Ar directory
5127containing trusted CA certificates; only used with
5128.Fl verify .
5129This directory must be a standard certificate directory:
5130that is, a hash of each subject name (using
5131.Nm x509 -hash )
5132should be linked to each certificate.
5133.It Ar cert.pem ...
5134One or more certificates of message recipients: used when encrypting
5135a message.
5136.It Fl certfile Ar file
5137Allows additional certificates to be specified.
5138When signing, these will be included with the message.
5139When verifying, these will be searched for the signers' certificates.
5140The certificates should be in PEM format.
5141.It Xo
5142.Fl check_ss_sig ,
5143.Fl crl_check ,
5144.Fl crl_check_all ,
5145.Fl extended_crl ,
5146.Fl ignore_critical ,
5147.Fl issuer_checks ,
5148.Fl policy_check ,
5149.Fl x509_strict
5150.Xc
5151Set various certificate chain validation options.
5152See the
5153.Nm verify
5154command for details.
5155.It Fl content Ar file
5156A file containing the detached content.
5157This is only useful with the
5158.Fl verify
5159option,
5160and only usable if the PKCS#7 structure is using the detached
5161signature form where the content is not included.
5162This option will override any content if the input format is S/MIME
5163and it uses the multipart/signed MIME content type.
5164.It Xo
5165.Fl from Ar addr ,
5166.Fl subject Ar s ,
5167.Fl to Ar addr
5168.Xc
5169The relevant mail headers.
5170These are included outside the signed
5171portion of a message so they may be included manually.
5172When signing, many S/MIME
5173mail clients check that the signer's certificate email
5174address matches the From: address.
5175.It Fl in Ar file
5176The input file to read from.
5177.It Fl indef
5178Enable streaming I/O for encoding operations.
5179This permits single pass processing of data without
5180the need to hold the entire contents in memory,
5181potentially supporting very large files.
5182Streaming is automatically set for S/MIME signing with detached
5183data if the output format is SMIME;
5184it is currently off by default for all other operations.
5185.It Fl inform Cm der | pem | smime
5186The input format.
5187.It Fl inkey Ar file
5188The private key to use when signing or decrypting,
5189which must match the corresponding certificate.
5190If this option is not specified, the private key must be included
5191in the certificate file specified with
5192the
5193.Fl recip
5194or
5195.Fl signer
5196file.
5197When signing,
5198this option can be used multiple times to specify successive keys.
5199.It Fl keyform Cm der | pem
5200Input private key format.
5201The default is
5202.Cm pem .
5203.It Fl md Ar digest
5204The digest algorithm to use when signing or resigning.
5205If not present then the default digest algorithm for the signing key is used
5206(usually SHA1).
5207.It Fl noattr
5208Do not include attributes.
5209.It Fl nocerts
5210Do not include the signer's certificate.
5211This will reduce the size of the signed message but the verifier must
5212have a copy of the signer's certificate available locally (passed using the
5213.Fl certfile
5214option, for example).
5215.It Fl nochain
5216Do not do chain verification of signers' certificates: that is,
5217don't use the certificates in the signed message as untrusted CAs.
5218.It Fl nodetach
5219When signing a message, use opaque signing: this form is more resistant
5220to translation by mail relays but it cannot be read by mail agents that
5221do not support S/MIME.
5222Without this option cleartext signing with the MIME type
5223multipart/signed is used.
5224.It Fl noindef
5225Disable streaming I/O where it would produce an encoding of indefinite length
5226(currently has no effect).
5227.It Fl nointern
5228Only use certificates specified in the
5229.Fl certfile .
5230The supplied certificates can still be used as untrusted CAs.
5231.It Fl nosigs
5232Do not try to verify the signatures on the message.
5233.It Fl nosmimecap
5234Exclude the list of supported algorithms from signed attributes,
5235other options such as signing time and content type are still included.
5236.It Fl noverify
5237Do not verify the signer's certificate of a signed message.
5238.It Fl out Ar file
5239The output file to write to.
5240.It Fl outform Cm der | pem | smime
5241The output format.
5242The default is smime, which writes an S/MIME format message.
5243.Cm pem
5244and
5245.Cm der
5246change this to write PEM and DER format PKCS#7 structures instead.
5247This currently only affects the output format of the PKCS#7
5248structure; if no PKCS#7 structure is being output (for example with
5249.Fl verify
5250or
5251.Fl decrypt )
5252this option has no effect.
5253.It Fl passin Ar arg
5254The key password source.
5255.It Fl recip Ar file
5256The recipients certificate when decrypting a message.
5257This certificate
5258must match one of the recipients of the message or an error occurs.
5259.It Fl signer Ar file
5260A signing certificate when signing or resigning a message;
5261this option can be used multiple times if more than one signer is required.
5262If a message is being verified, the signer's certificates will be
5263written to this file if the verification was successful.
5264.It Fl stream
5265The same as
5266.Fl indef .
5267.It Fl text
5268Add plain text (text/plain) MIME
5269headers to the supplied message if encrypting or signing.
5270If decrypting or verifying, it strips off text headers:
5271if the decrypted or verified message is not of MIME type text/plain
5272then an error occurs.
5273.El
5274.Pp
5275The exit codes for
5276.Nm smime
5277are as follows:
5278.Pp
5279.Bl -tag -width "XXXX" -offset 3n -compact
5280.It 0
5281The operation was completely successful.
5282.It 1
5283An error occurred parsing the command options.
5284.It 2
5285One of the input files could not be read.
5286.It 3
5287An error occurred creating the file or when reading the message.
5288.It 4
5289An error occurred decrypting or verifying the message.
5290.It 5
5291An error occurred writing certificates.
5292.El
5293.Tg speed
5294.Sh SPEED
5295.Bl -hang -width "openssl speed"
5296.It Nm openssl speed
5297.Bk -words
5298.Op Ar algorithm
5299.Op Fl decrypt
5300.Op Fl elapsed
5301.Op Fl evp Ar algorithm
5302.Op Fl mr
5303.Op Fl multi Ar number
5304.Op Fl unaligned Ar number
5305.Ek
5306.El
5307.Pp
5308The
5309.Nm speed
5310command is used to test the performance of cryptographic algorithms.
5311.Bl -tag -width "XXXX"
5312.It Ar algorithm
5313Perform the test using
5314.Ar algorithm .
5315The default is to test all algorithms.
5316.It Fl decrypt
5317Time decryption instead of encryption;
5318must be used with
5319.Fl evp .
5320.It Fl elapsed
5321Measure time in real time instead of CPU user time.
5322.It Fl evp Ar algorithm
5323Perform the test using one of the algorithms accepted by
5324.Xr EVP_get_cipherbyname 3 .
5325.It Fl mr
5326Produce machine readable output.
5327.It Fl multi Ar number
5328Run
5329.Ar number
5330benchmarks in parallel.
5331.It Fl unaligned Ar number
5332Use allocated buffers with an offset of
5333.Ar number
5334bytes from the alignment provided by
5335.Xr malloc 3 .
5336.Ar number
5337should be between 0 and 16.
5338.El
5339.Tg ts
5340.Sh TS
5341.Bk -words
5342.Bl -hang -width "openssl ts"
5343.It Nm openssl ts
5344.Fl query
5345.Op Fl md4 | md5 | ripemd160 | sha1
5346.Op Fl cert
5347.Op Fl config Ar configfile
5348.Op Fl data Ar file_to_hash
5349.Op Fl digest Ar digest_bytes
5350.Op Fl in Ar request.tsq
5351.Op Fl no_nonce
5352.Op Fl out Ar request.tsq
5353.Op Fl policy Ar object_id
5354.Op Fl text
5355.It Nm openssl ts
5356.Fl reply
5357.Op Fl chain Ar certs_file.pem
5358.Op Fl config Ar configfile
5359.Op Fl in Ar response.tsr
5360.Op Fl inkey Ar private.pem
5361.Op Fl out Ar response.tsr
5362.Op Fl passin Ar arg
5363.Op Fl policy Ar object_id
5364.Op Fl queryfile Ar request.tsq
5365.Op Fl section Ar tsa_section
5366.Op Fl signer Ar tsa_cert.pem
5367.Op Fl text
5368.Op Fl token_in
5369.Op Fl token_out
5370.It Nm openssl ts
5371.Fl verify
5372.Op Fl CAfile Ar trusted_certs.pem
5373.Op Fl CApath Ar trusted_cert_path
5374.Op Fl data Ar file_to_hash
5375.Op Fl digest Ar digest_bytes
5376.Op Fl in Ar response.tsr
5377.Op Fl queryfile Ar request.tsq
5378.Op Fl token_in
5379.Op Fl untrusted Ar cert_file.pem
5380.El
5381.Ek
5382.Pp
5383The
5384.Nm ts
5385command is a basic Time Stamping Authority (TSA) client and server
5386application as specified in RFC 3161 (Time-Stamp Protocol, TSP).
5387A TSA can be part of a PKI deployment and its role is to provide long
5388term proof of the existence of specific data.
5389Here is a brief description of the protocol:
5390.Bl -enum
5391.It
5392The TSA client computes a one-way hash value for a data file and sends
5393the hash to the TSA.
5394.It
5395The TSA attaches the current date and time to the received hash value,
5396signs them and sends the time stamp token back to the client.
5397By creating this token the TSA certifies the existence of the original
5398data file at the time of response generation.
5399.It
5400The TSA client receives the time stamp token and verifies the
5401signature on it.
5402It also checks if the token contains the same hash
5403value that it had sent to the TSA.
5404.El
5405.Pp
5406There is one DER-encoded protocol data unit defined for transporting a time
5407stamp request to the TSA and one for sending the time stamp response
5408back to the client.
5409The
5410.Nm ts
5411command has three main functions:
5412creating a time stamp request based on a data file;
5413creating a time stamp response based on a request;
5414and verifying if a response corresponds
5415to a particular request or a data file.
5416.Pp
5417There is no support for sending the requests/responses automatically
5418over HTTP or TCP yet as suggested in RFC 3161.
5419Users must send the requests either by FTP or email.
5420.Pp
5421The
5422.Fl query
5423switch can be used for creating and printing a time stamp
5424request with the following options:
5425.Bl -tag -width Ds
5426.It Fl cert
5427Expect the TSA to include its signing certificate in the response.
5428.It Fl config Ar configfile
5429Specify an alternative configuration file.
5430Only the OID section is used.
5431.It Fl data Ar file_to_hash
5432The data file for which the time stamp request needs to be created.
5433The default is standard input.
5434.It Fl digest Ar digest_bytes
5435Specify the message imprint explicitly without the data file.
5436The imprint must be specified in a hexadecimal format,
5437two characters per byte,
5438the bytes optionally separated by colons.
5439The number of bytes must match the message digest algorithm in use.
5440.It Fl in Ar request.tsq
5441A previously created time stamp request in DER
5442format that will be printed into the output file.
5443Useful for examining the content of a request in human-readable format.
5444.It Fl md4 | md5 | ripemd160 | sha | sha1
5445The message digest to apply to the data file.
5446It supports all the message digest algorithms that are supported by the
5447.Nm dgst
5448command.
5449The default is SHA1.
5450.It Fl no_nonce
5451Specify no nonce in the request.
5452The default, to include a 64-bit long pseudo-random nonce,
5453is recommended to protect against replay attacks.
5454.It Fl out Ar request.tsq
5455The output file to write to,
5456or standard output if not specified.
5457.It Fl policy Ar object_id
5458The policy that the client expects the TSA to use for creating the
5459time stamp token.
5460Either dotted OID notation or OID names defined
5461in the config file can be used.
5462If no policy is requested, the TSA uses its own default policy.
5463.It Fl text
5464Output in human-readable text format instead of DER.
5465.El
5466.Pp
5467A time stamp response (TimeStampResp) consists of a response status
5468and the time stamp token itself (ContentInfo),
5469if the token generation was successful.
5470The
5471.Fl reply
5472command is for creating a time stamp
5473response or time stamp token based on a request and printing the
5474response/token in human-readable format.
5475If
5476.Fl token_out
5477is not specified the output is always a time stamp response (TimeStampResp),
5478otherwise it is a time stamp token (ContentInfo).
5479.Bl -tag -width Ds
5480.It Fl chain Ar certs_file.pem
5481The collection of PEM certificates
5482that will be included in the response
5483in addition to the signer certificate if the
5484.Fl cert
5485option was used for the request.
5486This file is supposed to contain the certificate chain
5487for the signer certificate from its issuer upwards.
5488The
5489.Fl reply
5490command does not build a certificate chain automatically.
5491.It Fl config Ar configfile
5492Specify an alternative configuration file.
5493.It Fl in Ar response.tsr
5494Specify a previously created time stamp response (or time stamp token, if
5495.Fl token_in
5496is also specified)
5497in DER format that will be written to the output file.
5498This option does not require a request;
5499it is useful, for example,
5500to examine the content of a response or token
5501or to extract the time stamp token from a response.
5502If the input is a token and the output is a time stamp response, a default
5503.Qq granted
5504status info is added to the token.
5505.It Fl inkey Ar private.pem
5506The signer private key of the TSA in PEM format.
5507Overrides the
5508.Cm signer_key
5509config file option.
5510.It Fl out Ar response.tsr
5511The response is written to this file.
5512The format and content of the file depends on other options (see
5513.Fl text
5514and
5515.Fl token_out ) .
5516The default is stdout.
5517.It Fl passin Ar arg
5518The key password source.
5519.It Fl policy Ar object_id
5520The default policy to use for the response.
5521Either dotted OID notation or OID names defined
5522in the config file can be used.
5523If no policy is requested, the TSA uses its own default policy.
5524.It Fl queryfile Ar request.tsq
5525The file containing a DER-encoded time stamp request.
5526.It Fl section Ar tsa_section
5527The config file section containing the settings for response generation.
5528.It Fl signer Ar tsa_cert.pem
5529The PEM signer certificate of the TSA.
5530The TSA signing certificate must have exactly one extended key usage
5531assigned to it: timeStamping.
5532The extended key usage must also be critical,
5533otherwise the certificate is going to be refused.
5534Overrides the
5535.Cm signer_cert
5536variable of the config file.
5537.It Fl text
5538Output in human-readable text format instead of DER.
5539.It Fl token_in
5540The input is a DER-encoded time stamp token (ContentInfo)
5541instead of a time stamp response (TimeStampResp).
5542.It Fl token_out
5543The output is a time stamp token (ContentInfo)
5544instead of a time stamp response (TimeStampResp).
5545.El
5546.Pp
5547The
5548.Fl verify
5549command is for verifying if a time stamp response or time stamp token
5550is valid and matches a particular time stamp request or data file.
5551The
5552.Fl verify
5553command does not use the configuration file.
5554.Bl -tag -width Ds
5555.It Fl CAfile Ar trusted_certs.pem
5556The file containing a set of trusted self-signed PEM CA certificates.
5557See
5558.Nm verify
5559for additional details.
5560Either this option or
5561.Fl CApath
5562must be specified.
5563.It Fl CApath Ar trusted_cert_path
5564The directory containing the trusted CA certificates of the client.
5565See
5566.Nm verify
5567for additional details.
5568Either this option or
5569.Fl CAfile
5570must be specified.
5571.It Fl data Ar file_to_hash
5572The response or token must be verified against
5573.Ar file_to_hash .
5574The file is hashed with the message digest algorithm specified in the token.
5575The
5576.Fl digest
5577and
5578.Fl queryfile
5579options must not be specified with this one.
5580.It Fl digest Ar digest_bytes
5581The response or token must be verified against the message digest specified
5582with this option.
5583The number of bytes must match the message digest algorithm
5584specified in the token.
5585The
5586.Fl data
5587and
5588.Fl queryfile
5589options must not be specified with this one.
5590.It Fl in Ar response.tsr
5591The time stamp response that needs to be verified, in DER format.
5592This option in mandatory.
5593.It Fl queryfile Ar request.tsq
5594The original time stamp request, in DER format.
5595The
5596.Fl data
5597and
5598.Fl digest
5599options must not be specified with this one.
5600.It Fl token_in
5601The input is a DER-encoded time stamp token (ContentInfo)
5602instead of a time stamp response (TimeStampResp).
5603.It Fl untrusted Ar cert_file.pem
5604Additional untrusted PEM certificates which may be needed
5605when building the certificate chain for the TSA's signing certificate.
5606This file must contain the TSA signing certificate and
5607all intermediate CA certificates unless the response includes them.
5608.El
5609.Pp
5610Options specified on the command line always override
5611the settings in the config file:
5612.Bl -tag -width Ds
5613.It Cm tsa Ar section , Cm default_tsa
5614This is the main section and it specifies the name of another section
5615that contains all the options for the
5616.Fl reply
5617option.
5618This section can be overridden with the
5619.Fl section
5620command line switch.
5621.It Cm oid_file
5622See
5623.Nm ca
5624for a description.
5625.It Cm oid_section
5626See
5627.Nm ca
5628for a description.
5629.It Cm serial
5630The file containing the hexadecimal serial number of the
5631last time stamp response created.
5632This number is incremented by 1 for each response.
5633If the file does not exist at the time of response generation,
5634a new file is created with serial number 1.
5635This parameter is mandatory.
5636.It Cm signer_cert
5637TSA signing certificate, in PEM format.
5638The same as the
5639.Fl signer
5640command line option.
5641.It Cm certs
5642A set of PEM-encoded certificates that need to be
5643included in the response.
5644The same as the
5645.Fl chain
5646command line option.
5647.It Cm signer_key
5648The private key of the TSA, in PEM format.
5649The same as the
5650.Fl inkey
5651command line option.
5652.It Cm default_policy
5653The default policy to use when the request does not mandate any policy.
5654The same as the
5655.Fl policy
5656command line option.
5657.It Cm other_policies
5658Comma separated list of policies that are also acceptable by the TSA
5659and used only if the request explicitly specifies one of them.
5660.It Cm digests
5661The list of message digest algorithms that the TSA accepts.
5662At least one algorithm must be specified.
5663This parameter is mandatory.
5664.It Cm accuracy
5665The accuracy of the time source of the TSA in seconds, milliseconds
5666and microseconds.
5667For example, secs:1, millisecs:500, microsecs:100.
5668If any of the components is missing,
5669zero is assumed for that field.
5670.It Cm clock_precision_digits
5671The maximum number of digits, which represent the fraction of seconds,
5672that need to be included in the time field.
5673The trailing zeroes must be removed from the time,
5674so there might actually be fewer digits
5675or no fraction of seconds at all.
5676The maximum value is 6;
5677the default is 0.
5678.It Cm ordering
5679If this option is yes,
5680the responses generated by this TSA can always be ordered,
5681even if the time difference between two responses is less
5682than the sum of their accuracies.
5683The default is no.
5684.It Cm tsa_name
5685Set this option to yes if the subject name of the TSA must be included in
5686the TSA name field of the response.
5687The default is no.
5688.It Cm ess_cert_id_chain
5689The SignedData objects created by the TSA always contain the
5690certificate identifier of the signing certificate in a signed
5691attribute (see RFC 2634, Enhanced Security Services).
5692If this option is set to yes and either the
5693.Cm certs
5694variable or the
5695.Fl chain
5696option is specified then the certificate identifiers of the chain will also
5697be included in the SigningCertificate signed attribute.
5698If this variable is set to no,
5699only the signing certificate identifier is included.
5700The default is no.
5701.El
5702.Tg verify
5703.Sh VERIFY
5704.Bl -hang -width "openssl verify"
5705.It Nm openssl verify
5706.Bk -words
5707.Op Fl CAfile Ar file
5708.Op Fl CApath Ar directory
5709.Op Fl check_ss_sig
5710.Op Fl CRLfile Ar file
5711.Op Fl crl_check
5712.Op Fl crl_check_all
5713.Op Fl explicit_policy
5714.Op Fl extended_crl
5715.Op Fl help
5716.Op Fl ignore_critical
5717.Op Fl inhibit_any
5718.Op Fl inhibit_map
5719.Op Fl issuer_checks
5720.Op Fl legacy_verify
5721.Op Fl policy_check
5722.Op Fl purpose Ar purpose
5723.Op Fl trusted Ar file
5724.Op Fl untrusted Ar file
5725.Op Fl verbose
5726.Op Fl x509_strict
5727.Op Ar certificates
5728.Ek
5729.El
5730.Pp
5731The
5732.Nm verify
5733command verifies certificate chains.
5734.Pp
5735The options are as follows:
5736.Bl -tag -width Ds
5737.It Fl CAfile Ar file
5738A
5739.Ar file
5740of trusted certificates.
5741The
5742.Ar file
5743should contain multiple certificates in PEM format, concatenated together.
5744.It Fl CApath Ar directory
5745A
5746.Ar directory
5747of trusted certificates.
5748The certificates, or symbolic links to them,
5749should have names of the form
5750.Ar hash Ns .0 ,
5751where
5752.Ar hash
5753is the hashed certificate subject name
5754(see the
5755.Fl hash
5756option of the
5757.Nm x509
5758utility).
5759.It Fl check_ss_sig
5760Verify the signature on the self-signed root CA.
5761This is disabled by default
5762because it doesn't add any security.
5763.It Fl CRLfile Ar file
5764The
5765.Ar file
5766should contain one or more CRLs in PEM format.
5767.It Fl crl_check
5768Check end entity certificate validity by attempting to look up a valid CRL.
5769If a valid CRL cannot be found, an error occurs.
5770.It Fl crl_check_all
5771Check the validity of all certificates in the chain by attempting
5772to look up valid CRLs.
5773.It Fl explicit_policy
5774Set policy variable require-explicit-policy (RFC 3280).
5775.It Fl extended_crl
5776Enable extended CRL features such as indirect CRLs and alternate CRL
5777signing keys.
5778.It Fl help
5779Print a usage message.
5780.It Fl ignore_critical
5781Ignore critical extensions instead of rejecting the certificate.
5782.It Fl inhibit_any
5783Set policy variable inhibit-any-policy (RFC 3280).
5784.It Fl inhibit_map
5785Set policy variable inhibit-policy-mapping (RFC 3280).
5786.It Fl issuer_checks
5787Print diagnostics relating to searches for the issuer certificate
5788of the current certificate
5789showing why each candidate issuer certificate was rejected.
5790The presence of rejection messages
5791does not itself imply that anything is wrong:
5792during the normal verify process several rejections may take place.
5793.It Fl legacy_verify
5794Use the legacy X.509 certificate chain verification code.
5795.It Fl policy_check
5796Enable certificate policy processing.
5797.It Fl purpose Ar purpose
5798The intended use for the certificate.
5799Without this option no chain verification will be done.
5800Currently accepted uses are
5801.Cm sslclient , sslserver ,
5802.Cm nssslserver , smimesign ,
5803.Cm smimeencrypt , crlsign ,
5804.Cm any ,
5805and
5806.Cm ocsphelper .
5807.It Fl trusted Ar file
5808A
5809.Ar file
5810of trusted certificates.
5811The
5812.Ar file
5813should contain multiple certificates.
5814.It Fl untrusted Ar file
5815A
5816.Ar file
5817of untrusted certificates.
5818The
5819.Ar file
5820should contain multiple certificates.
5821.It Fl verbose
5822Print extra information about the operations being performed.
5823.It Fl x509_strict
5824Disable workarounds for broken certificates which have to be disabled
5825for strict X.509 compliance.
5826.It Ar certificates
5827One or more PEM
5828.Ar certificates
5829to verify.
5830If no certificate files are included, an attempt is made to read
5831a certificate from standard input.
5832If the first certificate filename begins with a dash,
5833use a lone dash to mark the last option.
5834.El
5835.Pp
5836The
5837.Nm verify
5838program uses the same functions as the internal SSL and S/MIME verification,
5839with one crucial difference:
5840wherever possible an attempt is made to continue after an error,
5841whereas normally the verify operation would halt on the first error.
5842This allows all the problems with a certificate chain to be determined.
5843.Pp
5844The verify operation consists of a number of separate steps.
5845Firstly a certificate chain is built up starting from the supplied certificate
5846and ending in the root CA.
5847It is an error if the whole chain cannot be built up.
5848The chain is built up by looking up the issuer's certificate of the current
5849certificate.
5850If a certificate is found which is its own issuer, it is assumed
5851to be the root CA.
5852.Pp
5853All certificates whose subject name matches the issuer name
5854of the current certificate are subject to further tests.
5855The relevant authority key identifier components of the current certificate
5856(if present) must match the subject key identifier (if present)
5857and issuer and serial number of the candidate issuer;
5858in addition the
5859.Cm keyUsage
5860extension of the candidate issuer (if present) must permit certificate signing.
5861.Pp
5862The lookup first looks in the list of untrusted certificates and if no match
5863is found the remaining lookups are from the trusted certificates.
5864The root CA is always looked up in the trusted certificate list:
5865if the certificate to verify is a root certificate,
5866then an exact match must be found in the trusted list.
5867.Pp
5868The second operation is to check every untrusted certificate's extensions for
5869consistency with the supplied purpose.
5870If the
5871.Fl purpose
5872option is not included, then no checks are done.
5873The supplied or
5874.Qq leaf
5875certificate must have extensions compatible with the supplied purpose
5876and all other certificates must also be valid CA certificates.
5877The precise extensions required are described in more detail in
5878the
5879.Nm X509
5880section below.
5881.Pp
5882The third operation is to check the trust settings on the root CA.
5883The root CA should be trusted for the supplied purpose.
5884A certificate with no trust settings is considered to be valid for
5885all purposes.
5886.Pp
5887The final operation is to check the validity of the certificate chain.
5888The validity period is checked against the current system time and the
5889.Cm notBefore
5890and
5891.Cm notAfter
5892dates in the certificate.
5893The certificate signatures are also checked at this point.
5894.Pp
5895If all operations complete successfully, the certificate is considered
5896valid.
5897If any operation fails then the certificate is not valid.
5898When a verify operation fails, the output messages can be somewhat cryptic.
5899The general form of the error message is:
5900.Bd -literal
5901server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024-bit)
5902error 24 at 1 depth lookup:invalid CA certificate
5903.Ed
5904.Pp
5905The first line contains the name of the certificate being verified, followed by
5906the subject name of the certificate.
5907The second line contains the error number as defined by the
5908.Dv X509_V_ERR_*
5909constants in
5910.In openssl/x509_vfy.h ,
5911the associated error message documented in
5912.Xr X509_STORE_CTX_get_error 3 ,
5913and the depth.
5914The depth is the number of the certificate being verified when a
5915problem was detected starting with zero for the certificate being verified
5916itself, then 1 for the CA that signed the certificate and so on.
5917.Tg version
5918.Sh VERSION
5919.Nm openssl version
5920.Op Fl abdfpv
5921.Pp
5922The
5923.Nm version
5924command is used to print out version information about
5925.Nm openssl .
5926.Pp
5927The options are as follows:
5928.Bl -tag -width Ds
5929.It Fl a
5930All information: this is the same as setting all the other flags.
5931.It Fl b
5932The date the current version of
5933.Nm openssl
5934was built.
5935.It Fl d
5936.Ev OPENSSLDIR
5937setting.
5938.It Fl f
5939Compilation flags.
5940.It Fl p
5941Platform setting.
5942.It Fl v
5943The current
5944.Nm openssl
5945version.
5946.El
5947.Tg x509
5948.Sh X509
5949.Bl -hang -width "openssl x509"
5950.It Nm openssl x509
5951.Bk -words
5952.Op Fl addreject Ar arg
5953.Op Fl addtrust Ar arg
5954.Op Fl alias
5955.Op Fl CA Ar file
5956.Op Fl CAcreateserial
5957.Op Fl CAform Cm der | pem
5958.Op Fl CAkey Ar file
5959.Op Fl CAkeyform Cm der | pem
5960.Op Fl CAserial Ar file
5961.Op Fl certopt Ar option
5962.Op Fl checkend Ar arg
5963.Op Fl clrext
5964.Op Fl clrreject
5965.Op Fl clrtrust
5966.Op Fl dates
5967.Op Fl days Ar arg
5968.Op Fl email
5969.Op Fl enddate
5970.Op Fl extensions Ar section
5971.Op Fl extfile Ar file
5972.Op Fl fingerprint
5973.Op Fl force_pubkey Ar key
5974.Op Fl hash
5975.Op Fl in Ar file
5976.Op Fl inform Cm der | net | pem
5977.Op Fl issuer
5978.Op Fl issuer_hash
5979.Op Fl issuer_hash_old
5980.Op Fl keyform Cm der | pem
5981.Op Fl md5 | sha1
5982.Op Fl modulus
5983.Op Fl multivalue-rdn
5984.Op Fl nameopt Ar option
5985.Op Fl new
5986.Op Fl next_serial
5987.Op Fl noout
5988.Op Fl ocsp_uri
5989.Op Fl ocspid
5990.Op Fl out Ar file
5991.Op Fl outform Cm der | net | pem
5992.Op Fl passin Ar arg
5993.Op Fl pubkey
5994.Op Fl purpose
5995.Op Fl req
5996.Op Fl serial
5997.Op Fl set_issuer Ar name
5998.Op Fl set_serial Ar n
5999.Op Fl set_subject Ar name
6000.Op Fl setalias Ar arg
6001.Op Fl signkey Ar file
6002.Op Fl sigopt Ar nm:v
6003.Op Fl startdate
6004.Op Fl subject
6005.Op Fl subject_hash
6006.Op Fl subject_hash_old
6007.Op Fl text
6008.Op Fl trustout
6009.Op Fl utf8
6010.Op Fl x509toreq
6011.Ek
6012.El
6013.Pp
6014The
6015.Nm x509
6016command is a multi-purpose certificate utility.
6017It can be used to display certificate information, convert certificates to
6018various forms, sign certificate requests like a
6019.Qq mini CA ,
6020or edit certificate trust settings.
6021.Pp
6022The following are x509 input, output, and general purpose options:
6023.Bl -tag -width "XXXX"
6024.It Fl in Ar file
6025The input file to read from,
6026or standard input if not specified.
6027This option cannot be used with
6028.Fl new .
6029.It Fl inform Cm der | net | pem
6030The input format.
6031Normally, the command will expect an X.509 certificate,
6032but this can change if other options such as
6033.Fl in
6034or
6035.Fl req
6036are present.
6037.It Fl md5 | sha1
6038The digest to use.
6039This affects any signing or display option that uses a message digest,
6040such as the
6041.Fl fingerprint , signkey ,
6042and
6043.Fl CA
6044options.
6045If not specified, MD5 is used.
6046SHA1 is always used with DSA keys.
6047.It Fl out Ar file
6048The output file to write to,
6049or standard output if none is specified.
6050.It Fl outform Cm der | net | pem
6051The output format.
6052.It Fl passin Ar arg
6053The key password source.
6054.El
6055.Pp
6056The following are x509 display options:
6057.Bl -tag -width "XXXX"
6058.It Fl certopt Ar option
6059Customise the output format used with
6060.Fl text ,
6061either using a list of comma-separated options or by specifying
6062.Fl certopt
6063multiple times.
6064The default behaviour is to print all fields.
6065The options are as follows:
6066.Pp
6067.Bl -tag -width "no_extensions" -offset indent -compact
6068.It Cm ca_default
6069Equivalent to
6070.Cm no_issuer , no_pubkey , no_header ,
6071.Cm no_version , no_sigdump ,
6072and
6073.Cm no_signame .
6074.It Cm compatible
6075Equivalent to no output options at all.
6076.It Cm ext_default
6077Print unsupported certificate extensions.
6078.It Cm ext_dump
6079Hex dump unsupported extensions.
6080.It Cm ext_error
6081Print an error message for unsupported certificate extensions.
6082.It Cm ext_parse
6083ASN.1 parse unsupported extensions.
6084.It Cm no_aux
6085Do not print certificate trust information.
6086.It Cm no_extensions
6087Do not print X509V3 extensions.
6088.It Cm no_header
6089Do not print header (Certificate and Data) information.
6090.It Cm no_issuer
6091Do not print the issuer name.
6092.It Cm no_pubkey
6093Do not print the public key.
6094.It Cm no_serial
6095Do not print the serial number.
6096.It Cm no_sigdump
6097Do not give a hexadecimal dump of the certificate signature.
6098.It Cm no_signame
6099Do not print the signature algorithm used.
6100.It Cm no_subject
6101Do not print the subject name.
6102.It Cm no_validity
6103Do not print the
6104.Cm notBefore
6105and
6106.Cm notAfter
6107(validity) fields.
6108.It Cm no_version
6109Do not print the version number.
6110.El
6111.It Fl dates
6112Print the start and expiry date of a certificate.
6113.It Fl email
6114Output the email addresses, if any.
6115.It Fl enddate
6116Print the expiry date of the certificate; that is, the
6117.Cm notAfter
6118date.
6119.It Fl fingerprint
6120Print the digest of the DER-encoded version of the whole certificate.
6121.It Fl hash
6122A synonym for
6123.Fl subject_hash .
6124.It Fl issuer
6125Print the issuer name.
6126.It Fl issuer_hash
6127Print the hash of the certificate issuer name.
6128.It Fl issuer_hash_old
6129Print the hash of the certificate issuer name
6130using the older algorithm as used by
6131.Nm openssl
6132versions before 1.0.0.
6133.It Fl modulus
6134Print the value of the modulus of the public key contained in the certificate.
6135.It Fl multivalue-rdn
6136This option causes the
6137.Fl subj
6138argument to be interpreted with full support for multivalued RDNs,
6139for example
6140.Qq "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" .
6141If
6142.Fl multivalue-rdn
6143is not used, the UID value is set to
6144.Qq "123456+CN=John Doe" .
6145.It Fl nameopt Ar option
6146Customise how the subject or issuer names are displayed,
6147either using a list of comma-separated options or by specifying
6148.Fl nameopt
6149multiple times.
6150The default behaviour is to use the
6151.Cm oneline
6152format.
6153The options,
6154which can be preceded by a dash to turn them off,
6155are as follows:
6156.Bl -tag -width "XXXX"
6157.It Cm align
6158Align field values for a more readable output.
6159Only usable with
6160.Ar sep_multiline .
6161.It Cm compat
6162Use the old format,
6163equivalent to specifying no options at all.
6164.It Cm dn_rev
6165Reverse the fields of the DN, as required by RFC 2253.
6166As a side effect, this also reverses the order of multiple AVAs.
6167.It Cm dump_all
6168Dump all fields.
6169When used with
6170.Ar dump_der ,
6171it allows the DER encoding of the structure to be unambiguously determined.
6172.It Cm dump_der
6173Any fields that need to be hexdumped are
6174dumped using the DER encoding of the field.
6175Otherwise just the content octets will be displayed.
6176Both options use the RFC 2253 #XXXX... format.
6177.It Cm dump_nostr
6178Dump non-character string types
6179(for example OCTET STRING);
6180usually, non-character string types are displayed
6181as though each content octet represents a single character.
6182.It Cm dump_unknown
6183Dump any field whose OID is not recognised by
6184.Nm openssl .
6185.It Cm esc_2253
6186Escape the
6187.Qq special
6188characters required by RFC 2253 in a field that is
6189.Dq \& ,+"<>; .
6190Additionally,
6191.Sq #
6192is escaped at the beginning of a string
6193and a space character at the beginning or end of a string.
6194.It Cm esc_ctrl
6195Escape control characters.
6196That is, those with ASCII values less than 0x20 (space)
6197and the delete (0x7f) character.
6198They are escaped using the RFC 2253 \eXX notation (where XX are two hex
6199digits representing the character value).
6200.It Cm esc_msb
6201Escape characters with the MSB set; that is, with ASCII values larger than
6202127.
6203.It Cm multiline
6204A multiline format.
6205Equivalent to
6206.Cm esc_ctrl , esc_msb , sep_multiline ,
6207.Cm space_eq , lname ,
6208and
6209.Cm align .
6210.It Cm no_type
6211Do not attempt to interpret multibyte characters.
6212That is, content octets are merely dumped as though one octet
6213represents each character.
6214This is useful for diagnostic purposes
6215but results in rather odd looking output.
6216.It Cm nofname , sname , lname , oid
6217Alter how the field name is displayed:
6218.Cm nofname
6219does not display the field at all;
6220.Cm sname
6221uses the short name form (CN for
6222.Cm commonName ,
6223for example);
6224.Cm lname
6225uses the long form.
6226.Cm oid
6227represents the OID in numerical form and is useful for diagnostic purpose.
6228.It Cm oneline
6229A one line format which is more readable than
6230.Cm RFC2253 .
6231Equivalent to
6232.Cm esc_2253 , esc_ctrl , esc_msb , utf8 ,
6233.Cm dump_nostr , dump_der , use_quote , sep_comma_plus_spc ,
6234.Cm space_eq ,
6235and
6236.Cm sname .
6237.It Cm RFC2253
6238Displays names compatible with RFC 2253.
6239Equivalent to
6240.Cm esc_2253 , esc_ctrl ,
6241.Cm esc_msb , utf8 , dump_nostr , dump_unknown ,
6242.Cm dump_der , sep_comma_plus , dn_rev ,
6243and
6244.Cm sname .
6245.It Cm sep_comma_plus , sep_comma_plus_space , sep_semi_plus_space , sep_multiline
6246Determine the field separators:
6247the first character is between RDNs and the second between multiple AVAs
6248(multiple AVAs are very rare and their use is discouraged).
6249The options ending in
6250.Qq space
6251additionally place a space after the separator to make it more readable.
6252.Cm sep_multiline
6253uses a linefeed character for the RDN separator and a spaced
6254.Sq +
6255for the AVA separator,
6256as well as indenting the fields by four characters.
6257If no field separator is specified then
6258.Cm sep_comma_plus_space
6259is used by default.
6260.It Cm show_type
6261Show the type of the ASN.1 character string.
6262The type precedes the field contents.
6263For example
6264.Qq BMPSTRING: Hello World .
6265.It Cm space_eq
6266Place spaces round the
6267.Sq =
6268character which follows the field name.
6269.It Cm use_quote
6270Escape some characters by surrounding the whole string with
6271.Sq \&"
6272characters.
6273Without the option, all escaping is done with the
6274.Sq \e
6275character.
6276.It Cm utf8
6277Convert all strings to UTF8 format first, as required by RFC 2253.
6278On a UTF8 compatible terminal,
6279the use of this option (and not setting
6280.Cm esc_msb )
6281may result in the correct display of multibyte characters.
6282Usually, multibyte characters larger than 0xff
6283are represented using the format \eUXXXX for 16 bits and \eWXXXXXXXX
6284for 32 bits,
6285and any UTF8Strings are converted to their character form first.
6286.El
6287.It Fl next_serial
6288Print the next serial number.
6289.It Fl noout
6290Do not output the encoded version of the request.
6291.It Fl ocsp_uri
6292Print the OCSP responder addresses, if any.
6293.It Fl ocspid
6294Print OCSP hash values for the subject name and public key.
6295.It Fl pubkey
6296Print the public key.
6297.It Fl serial
6298Print the certificate serial number.
6299.It Fl sigopt Ar nm:v
6300Pass options to the signature algorithm during sign or certify operations.
6301The names and values of these options are algorithm-specific.
6302.It Fl startdate
6303Print the start date of the certificate; that is, the
6304.Cm notBefore
6305date.
6306.It Fl subject
6307Print the subject name.
6308.It Fl subject_hash
6309Print the hash of the certificate subject name.
6310This is used in
6311.Nm openssl
6312to form an index to allow certificates in a directory to be looked up
6313by subject name.
6314.It Fl subject_hash_old
6315Print the hash of the certificate subject name
6316using the older algorithm as used by
6317.Nm openssl
6318versions before 1.0.0.
6319.It Fl text
6320Print the full certificate in text form.
6321.El
6322.Pp
6323A trusted certificate is a certificate which has several
6324additional pieces of information attached to it such as the permitted
6325and prohibited uses of the certificate and an alias.
6326When a certificate is being verified, at least one certificate must be trusted.
6327By default, a trusted certificate must be stored locally and be a root CA.
6328The following are x509 trust settings options:
6329.Bl -tag -width "XXXX"
6330.It Fl addreject Ar arg
6331Add a prohibited use.
6332Accepts the same values as the
6333.Fl addtrust
6334option.
6335.It Fl addtrust Ar arg
6336Add a trusted certificate use.
6337Any object name can be used here, but currently only
6338.Cm clientAuth
6339(SSL client use),
6340.Cm serverAuth
6341(SSL server use),
6342and
6343.Cm emailProtection
6344(S/MIME email) are used.
6345.It Fl alias
6346Output the certificate alias.
6347.It Fl clrreject
6348Clear all the prohibited or rejected uses of the certificate.
6349.It Fl clrtrust
6350Clear all the permitted or trusted uses of the certificate.
6351.It Fl purpose
6352Perform tests on the certificate extensions.
6353The same code is used when verifying untrusted certificates in chains,
6354so this section is useful if a chain is rejected by the verify code.
6355.Pp
6356The
6357.Cm basicConstraints
6358extension CA flag is used to determine whether the
6359certificate can be used as a CA.
6360If the CA flag is true, it is a CA;
6361if the CA flag is false, it is not a CA.
6362All CAs should have the CA flag set to true.
6363.Pp
6364If the
6365.Cm basicConstraints
6366extension is absent, then the certificate is
6367considered to be a possible CA;
6368other extensions are checked according to the intended use of the certificate.
6369A warning is given in this case because the certificate should really not
6370be regarded as a CA.
6371However it is allowed to be a CA to work around some broken software.
6372.Pp
6373If the certificate is a V1 certificate
6374(and thus has no extensions) and it is self-signed,
6375it is also assumed to be a CA but a warning is again given.
6376This is to work around the problem of Verisign roots
6377which are V1 self-signed certificates.
6378.Pp
6379If the
6380.Cm keyUsage
6381extension is present, then additional restraints are
6382made on the uses of the certificate.
6383A CA certificate must have the
6384.Cm keyCertSign
6385bit set if the
6386.Cm keyUsage
6387extension is present.
6388.Pp
6389The extended key usage extension places additional restrictions on the
6390certificate uses.
6391If this extension is present, whether critical or not,
6392the key can only be used for the purposes specified.
6393.Pp
6394A complete description of each test is given below.
6395The comments about
6396.Cm basicConstraints
6397and
6398.Cm keyUsage
6399and V1 certificates above apply to all CA certificates.
6400.Bl -tag -width "XXXX"
6401.It SSL Client
6402The extended key usage extension must be absent or include the
6403web client authentication OID.
6404.Cm keyUsage
6405must be absent or it must have the
6406.Cm digitalSignature
6407bit set.
6408The Netscape certificate type must be absent
6409or it must have the SSL client bit set.
6410.It SSL Client CA
6411The extended key usage extension must be absent or include the
6412web client authentication OID.
6413The Netscape certificate type must be absent
6414or it must have the SSL CA bit set:
6415this is used as a workaround if the
6416.Cm basicConstraints
6417extension is absent.
6418.It SSL Server
6419The extended key usage extension must be absent or include the
6420web server authentication and/or one of the SGC OIDs.
6421.Cm keyUsage
6422must be absent or it must have the
6423.Cm digitalSignature
6424set, the
6425.Cm keyEncipherment
6426set, or both bits set.
6427The Netscape certificate type must be absent or have the SSL server bit set.
6428.It SSL Server CA
6429The extended key usage extension must be absent or include the
6430web server authentication and/or one of the SGC OIDs.
6431The Netscape certificate type must be absent or the SSL CA bit must be set:
6432this is used as a workaround if the
6433.Cm basicConstraints
6434extension is absent.
6435.It Netscape SSL Server
6436For Netscape SSL clients to connect to an SSL server; it must have the
6437.Cm keyEncipherment
6438bit set if the
6439.Cm keyUsage
6440extension is present.
6441This isn't always valid because some cipher suites use the key for
6442digital signing.
6443Otherwise it is the same as a normal SSL server.
6444.It Common S/MIME Client Tests
6445The extended key usage extension must be absent or include the
6446email protection OID.
6447The Netscape certificate type must be absent or should have the S/MIME bit set.
6448If the S/MIME bit is not set in Netscape certificate type, then the SSL
6449client bit is tolerated as an alternative but a warning is shown:
6450this is because some Verisign certificates don't set the S/MIME bit.
6451.It S/MIME Signing
6452In addition to the common S/MIME client tests, the
6453.Cm digitalSignature
6454bit must be set if the
6455.Cm keyUsage
6456extension is present.
6457.It S/MIME Encryption
6458In addition to the common S/MIME tests, the
6459.Cm keyEncipherment
6460bit must be set if the
6461.Cm keyUsage
6462extension is present.
6463.It S/MIME CA
6464The extended key usage extension must be absent or include the
6465email protection OID.
6466The Netscape certificate type must be absent
6467or must have the S/MIME CA bit set:
6468this is used as a workaround if the
6469.Cm basicConstraints
6470extension is absent.
6471.It CRL Signing
6472The
6473.Cm keyUsage
6474extension must be absent or it must have the CRL signing bit set.
6475.It CRL Signing CA
6476The normal CA tests apply, except the
6477.Cm basicConstraints
6478extension must be present.
6479.El
6480.It Fl setalias Ar arg
6481Set the alias of the certificate,
6482allowing the certificate to be referred to using a nickname,
6483such as
6484.Qq Steve's Certificate .
6485.It Fl trustout
6486Output a trusted certificate
6487(the default if any trust settings are modified).
6488An ordinary or trusted certificate can be input, but by default an ordinary
6489certificate is output and any trust settings are discarded.
6490.El
6491.Pp
6492The
6493.Nm x509
6494utility can be used to sign certificates and requests:
6495it can thus behave like a mini CA.
6496The following are x509 signing options:
6497.Bl -tag -width "XXXX"
6498.It Fl CA Ar file
6499The CA certificate to be used for signing.
6500When this option is present,
6501.Nm x509
6502behaves like a mini CA.
6503The input file is signed by the CA using this option;
6504that is, its issuer name is set to the subject name of the CA and it is
6505digitally signed using the CA's private key.
6506.Pp
6507This option is normally combined with the
6508.Fl req
6509option.
6510Without the
6511.Fl req
6512option, the input is a certificate which must be self-signed.
6513.It Fl CAcreateserial
6514Create the CA serial number file if it does not exist
6515instead of generating an error.
6516The file will contain the serial number
6517.Sq 02
6518and the certificate being signed will have
6519.Sq 1
6520as its serial number.
6521.It Fl CAform Cm der | pem
6522The format of the CA certificate file.
6523The default is
6524.Cm pem .
6525.It Fl CAkey Ar file
6526Set the CA private key to sign a certificate with.
6527Otherwise it is assumed that the CA private key is present
6528in the CA certificate file.
6529.It Fl CAkeyform Cm der | pem
6530The format of the CA private key.
6531The default is
6532.Cm pem .
6533.It Fl CAserial Ar file
6534Use the serial number in
6535.Ar file
6536to sign a certificate.
6537The file should consist of one line containing an even number of hex digits
6538with the serial number to use.
6539After each use the serial number is incremented and written out
6540to the file again.
6541.Pp
6542The default filename consists of the CA certificate file base name with
6543.Pa .srl
6544appended.
6545For example, if the CA certificate file is called
6546.Pa mycacert.pem ,
6547it expects to find a serial number file called
6548.Pa mycacert.srl .
6549.It Fl checkend Ar arg
6550Check whether the certificate expires in the next
6551.Ar arg
6552seconds.
6553If so, exit with return value 1;
6554otherwise exit with return value 0.
6555.It Fl clrext
6556Delete any extensions from a certificate.
6557This option is used when a certificate is being created from another
6558certificate (for example with the
6559.Fl signkey
6560or the
6561.Fl CA
6562options).
6563Normally, all extensions are retained.
6564.It Fl days Ar arg
6565The number of days to make a certificate valid for.
6566The default is 30 days.
6567.It Fl extensions Ar section
6568The section to add certificate extensions from.
6569If this option is not specified, the extensions should either be
6570contained in the unnamed (default) section
6571or the default section should contain a variable called
6572.Qq extensions
6573which contains the section to use.
6574.It Fl extfile Ar file
6575File containing certificate extensions to use.
6576If not specified, no extensions are added to the certificate.
6577.It Fl force_pubkey Ar key
6578Set the public key of the certificate to the public key contained in
6579.Ar key .
6580.It Fl keyform Cm der | pem
6581The format of the key file used in the
6582.Fl force_pubkey
6583and
6584.Fl signkey
6585options.
6586.It Fl new
6587Generate a new certificate using the subject given by
6588.Fl set_subject
6589and signed by
6590.Fl signkey .
6591If no public key is provided with
6592.Fl force_pubkey ,
6593the resulting certificate is self-signed.
6594This option cannot be used with
6595.Fl in
6596or
6597.Fl req .
6598.It Fl req
6599Expect a certificate request on input instead of a certificate.
6600This option cannot be used with
6601.Fl new .
6602.It Fl set_issuer Ar name
6603The issuer name to use.
6604.Ar name
6605must be formatted as /type0=value0/type1=value1/type2=...;
6606characters may be escaped by
6607.Sq \e
6608(backslash);
6609no spaces are skipped.
6610.It Fl set_serial Ar n
6611The serial number to use.
6612This option can be used with either the
6613.Fl signkey
6614or
6615.Fl CA
6616options.
6617If used in conjunction with the
6618.Fl CA
6619option, the serial number file (as specified by the
6620.Fl CAserial
6621or
6622.Fl CAcreateserial
6623options) is not used.
6624.Pp
6625The serial number can be decimal or hex (if preceded by
6626.Sq 0x ) .
6627Negative serial numbers can also be specified but their use is not recommended.
6628.It Fl set_subject Ar name
6629The subject name to use.
6630.Ar name
6631must be formatted as /type0=value0/type1=value1/type2=...;
6632characters may be escaped by
6633.Sq \e
6634(backslash);
6635no spaces are skipped.
6636.It Fl signkey Ar file
6637Self-sign
6638.Ar file
6639using the supplied private key.
6640.Pp
6641If the input file is a certificate, it sets the issuer name to the
6642subject name (i.e. makes it self-signed),
6643changes the public key to the supplied value,
6644and changes the start and end dates.
6645The start date is set to the current time and the end date is set to
6646a value determined by the
6647.Fl days
6648option.
6649Any certificate extensions are retained unless the
6650.Fl clrext
6651option is supplied.
6652.Pp
6653If the input is a certificate request, a self-signed certificate
6654is created using the supplied private key using the subject name in
6655the request.
6656.It Fl utf8
6657Interpret field values read from a terminal or obtained from a configuration
6658file as UTF-8 strings.
6659By default, they are interpreted as ASCII.
6660.It Fl x509toreq
6661Convert a certificate into a certificate request.
6662The
6663.Fl signkey
6664option is used to pass the required private key.
6665.El
6666.Sh COMMON NOTATION
6667Several commands share a common syntax,
6668as detailed below.
6669.Pp
6670Password arguments, typically specified using
6671.Fl passin
6672and
6673.Fl passout
6674for input and output passwords,
6675allow passwords to be obtained from a variety of sources.
6676Both of these options take a single argument, described below.
6677If no password argument is given and a password is required,
6678then the user is prompted to enter one:
6679this will typically be read from the current terminal with echoing turned off.
6680.Bl -tag -width "pass:password" -offset indent
6681.It Cm pass : Ns Ar password
6682The actual password is
6683.Ar password .
6684Since the password is visible to utilities,
6685this form should only be used where security is not important.
6686.It Cm env : Ns Ar var
6687Obtain the password from the environment variable
6688.Ar var .
6689Since the environment of other processes is visible,
6690this option should be used with caution.
6691.It Cm file : Ns Ar path
6692The first line of
6693.Ar path
6694is the password.
6695If the same
6696.Ar path
6697argument is supplied to
6698.Fl passin
6699and
6700.Fl passout ,
6701then the first line will be used for the input password and the next line
6702for the output password.
6703.Ar path
6704need not refer to a regular file:
6705it could, for example, refer to a device or named pipe.
6706.It Cm fd : Ns Ar number
6707Read the password from the file descriptor
6708.Ar number .
6709This can be used to send the data via a pipe, for example.
6710.It Cm stdin
6711Read the password from standard input.
6712.El
6713.Pp
6714Input/output formats,
6715typically specified using
6716.Fl inform
6717and
6718.Fl outform ,
6719indicate the format being read from or written to.
6720The argument is case insensitive.
6721.Pp
6722.Bl -tag -width Ds -offset indent -compact
6723.It Cm der
6724Distinguished Encoding Rules (DER)
6725is a binary format.
6726.It Cm net
6727Insecure legacy format.
6728.It Cm pem
6729Privacy Enhanced Mail (PEM)
6730is base64-encoded.
6731.It Cm pvk
6732Private Key format.
6733.It Cm smime
6734An SMIME format message.
6735.It Cm txt
6736Plain ASCII text.
6737.El
6738.Sh ENVIRONMENT
6739The following environment variables affect the execution of
6740.Nm openssl :
6741.Bl -tag -width "/etc/ssl/openssl.cnf"
6742.It Ev OPENSSL_CONF
6743The location of the master configuration file.
6744.El
6745.Sh FILES
6746.Bl -tag -width "/etc/ssl/openssl.cnf" -compact
6747.It Pa /etc/ssl/
6748Default config directory for
6749.Nm openssl .
6750.It Pa /etc/ssl/lib/
6751Unused.
6752.It Pa /etc/ssl/private/
6753Default private key directory.
6754.It Pa /etc/ssl/openssl.cnf
6755Default configuration file for
6756.Nm openssl .
6757.It Pa /etc/ssl/x509v3.cnf
6758Default configuration file for
6759.Nm x509
6760certificates.
6761.El
6762.Sh SEE ALSO
6763.Xr acme-client 1 ,
6764.Xr nc 1 ,
6765.Xr openssl.cnf 5 ,
6766.Xr x509v3.cnf 5 ,
6767.Xr ssl 8 ,
6768.Xr starttls 8
6769.Sh STANDARDS
6770.Rs
6771.%A T. Dierks
6772.%A C. Allen
6773.%D January 1999
6774.%R RFC 2246
6775.%T The TLS Protocol Version 1.0
6776.Re
6777.Pp
6778.Rs
6779.%A M. Wahl
6780.%A S. Killie
6781.%A T. Howes
6782.%D December 1997
6783.%R RFC 2253
6784.%T Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names
6785.Re
6786.Pp
6787.Rs
6788.%A B. Kaliski
6789.%D March 1998
6790.%R RFC 2315
6791.%T PKCS #7: Cryptographic Message Syntax Version 1.5
6792.Re
6793.Pp
6794.Rs
6795.%A R. Housley
6796.%A W. Ford
6797.%A W. Polk
6798.%A D. Solo
6799.%D January 1999
6800.%R RFC 2459
6801.%T Internet X.509 Public Key Infrastructure Certificate and CRL Profile
6802.Re
6803.Pp
6804.Rs
6805.%A M. Myers
6806.%A R. Ankney
6807.%A A. Malpani
6808.%A S. Galperin
6809.%A C. Adams
6810.%D June 1999
6811.%R RFC 2560
6812.%T X.509 Internet Public Key Infrastructure Online Certificate Status Protocol \(en OCSP
6813.Re
6814.Pp
6815.Rs
6816.%A R. Housley
6817.%D June 1999
6818.%R RFC 2630
6819.%T Cryptographic Message Syntax
6820.Re
6821.Pp
6822.Rs
6823.%A P. Chown
6824.%D June 2002
6825.%R RFC 3268
6826.%T Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)
6827.Re
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-11 08:07:56 +0000