diff options
Diffstat (limited to 'crypto/openssl/doc/apps')
| -rw-r--r-- | crypto/openssl/doc/apps/CA.pl.pod | 5 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/ca.pod | 168 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/ciphers.pod | 50 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/enc.pod | 16 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/ocsp.pod | 348 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/openssl.pod | 4 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/passwd.pod | 10 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/pkcs12.pod | 2 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/pkcs7.pod | 2 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/rand.pod | 2 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/req.pod | 67 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/rsa.pod | 2 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/s_client.pod | 17 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/s_server.pod | 22 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/smime.pod | 4 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/speed.pod | 14 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/version.pod | 8 | ||||
| -rw-r--r-- | crypto/openssl/doc/apps/x509.pod | 147 |
18 files changed, 820 insertions, 68 deletions
diff --git a/crypto/openssl/doc/apps/CA.pl.pod b/crypto/openssl/doc/apps/CA.pl.pod index 63cd132..58e0f52 100644 --- a/crypto/openssl/doc/apps/CA.pl.pod +++ b/crypto/openssl/doc/apps/CA.pl.pod @@ -13,6 +13,7 @@ B<CA.pl> [B<-help>] [B<-newcert>] [B<-newreq>] +[B<-newreq-nodes>] [B<-newca>] [B<-xsign>] [B<-sign>] @@ -46,6 +47,10 @@ written to the file "newreq.pem". creates a new certificate request. The private key and request are written to the file "newreq.pem". +=item B<-newreq-nowdes> + +is like B<-newreq> except that the private key will not be encrypted. + =item B<-newca> creates a new CA hierarchy for use with the B<ca> program (or the B<-signcert> diff --git a/crypto/openssl/doc/apps/ca.pod b/crypto/openssl/doc/apps/ca.pod index cea9002..183cd47 100644 --- a/crypto/openssl/doc/apps/ca.pod +++ b/crypto/openssl/doc/apps/ca.pod @@ -13,6 +13,11 @@ B<openssl> B<ca> [B<-name section>] [B<-gencrl>] [B<-revoke file>] +[B<-crl_reason reason>] +[B<-crl_hold instruction>] +[B<-crl_compromise time>] +[B<-crl_CA_compromise time>] +[B<-subj arg>] [B<-crldays days>] [B<-crlhours hours>] [B<-crlexts section>] @@ -33,9 +38,11 @@ B<openssl> B<ca> [B<-spkac file>] [B<-ss_cert file>] [B<-preserveDN>] +[B<-noemailDN>] [B<-batch>] [B<-msie_hack>] [B<-extensions section>] +[B<-extfile section>] =head1 DESCRIPTION @@ -71,7 +78,7 @@ a single self signed certificate to be signed by the CA. =item B<-spkac filename> a file containing a single Netscape signed public key and challenge -and additional field values to be signed by the CA. See the B<NOTES> +and additional field values to be signed by the CA. See the B<SPKAC FORMAT> section for information on the required format. =item B<-infiles> @@ -109,6 +116,7 @@ the 'ps' utility) this option should be used with caution. the key password source. For more information about the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>. + =item B<-verbose> this prints extra details about the operations being performed. @@ -159,6 +167,15 @@ is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll. +=item B<-noemailDN> + +The DN of a certificate can contain the EMAIL field if present in the +request DN, however it is good policy just having the e-mail set into +the altName extension of the certificate. When this option is set the +EMAIL field is removed from the certificate' subject and set only in +the, eventually present, extensions. The B<email_in_dn> keyword can be +used in the configuration file to enable this behaviour. + =item B<-batch> this sets the batch mode. In this mode no questions will be asked @@ -167,9 +184,16 @@ and all certificates will be certified automatically. =item B<-extensions section> the section of the configuration file containing certificate extensions -to be added when a certificate is issued. If no extension section is -present then a V1 certificate is created. If the extension section -is present (even if it is empty) then a V3 certificate is created. +to be added when a certificate is issued (defaults to B<x509_extensions> +unless the B<-extfile> option is used). If no extension section is +present then, a V1 certificate is created. If the extension section +is present (even if it is empty), then a V3 certificate is created. + +=item B<-extfile file> + +an additional configuration file to read certificate extensions from +(using the default section unless the B<-extensions> option is also +used). =back @@ -194,6 +218,39 @@ the number of hours before the next CRL is due. a filename containing a certificate to revoke. +=item B<-crl_reason reason> + +revocation reason, where B<reason> is one of: B<unspecified>, B<keyCompromise>, +B<CACompromise>, B<affiliationChanged>, B<superseded>, B<cessationOfOperation>, +B<certificateHold> or B<removeFromCRL>. The matching of B<reason> is case +insensitive. Setting any revocation reason will make the CRL v2. + +In practive B<removeFromCRL> is not particularly useful because it is only used +in delta CRLs which are not currently implemented. + +=item B<-crl_hold instruction> + +This sets the CRL revocation reason code to B<certificateHold> and the hold +instruction to B<instruction> which must be an OID. Although any OID can be +used only B<holdInstructionNone> (the use of which is discouraged by RFC2459) +B<holdInstructionCallIssuer> or B<holdInstructionReject> will normally be used. + +=item B<-crl_compromise time> + +This sets the revocation reason to B<keyCompromise> and the compromise time to +B<time>. B<time> should be in GeneralizedTime format that is B<YYYYMMDDHHMMSSZ>. + +=item B<-crl_CA_compromise time> + +This is the same as B<crl_compromise> except the revocation reason is set to +B<CACompromise>. + +=item B<-subj arg> + +supersedes subject name given in the request. +The arg must be formatted as I</type0=value0/type1=value1/type2=...>, +characters may be escaped by \ (backslash), no spaces are skipped. + =item B<-crlexts section> the section of the configuration file containing CRL extensions to @@ -311,6 +368,12 @@ the same as B<-crlexts>. the same as B<-preserveDN> +=item B<email_in_dn> + +the same as B<-noemailDN>. If you want the EMAIL field to be removed +from the DN of the certificate simply set this to 'no'. If not present +the default is to allow for the EMAIL filed in the certificate's DN. + =item B<msie_hack> the same as B<-msie_hack> @@ -320,6 +383,37 @@ the same as B<-msie_hack> the same as B<-policy>. Mandatory. See the B<POLICY FORMAT> section for more information. +=item B<nameopt>, B<certopt> + +these options allow the format used to display the certificate details +when asking the user to confirm signing. All the options supported by +the B<x509> utilities B<-nameopt> and B<-certopt> switches can be used +here, except the B<no_signame> and B<no_sigdump> are permanently set +and cannot be disabled (this is because the certificate signature cannot +be displayed because the certificate has not been signed at this point). + +For convenience the values B<default_ca> are accepted by both to produce +a reasonable output. + +If neither option is present the format used in earlier versions of +OpenSSL is used. Use of the old format is B<strongly> discouraged because +it only displays fields mentioned in the B<policy> section, mishandles +multicharacter string types and does not display extensions. + +=item B<copy_extensions> + +determines how extensions in certificate requests should be handled. +If set to B<none> or this option is not present then extensions are +ignored and not copied to the certificate. If set to B<copy> then any +extensions present in the request that are not already present are copied +to the certificate. If set to B<copyall> then all extensions in the +request are copied to the certificate: if the extension is already present +in the certificate it is deleted first. See the B<WARNINGS> section before +using this option. + +The main use of this option is to allow a certificate request to supply +values for certain extensions such as subjectAltName. + =back =head1 POLICY FORMAT @@ -409,6 +503,11 @@ A sample configuration file with the relevant sections for B<ca>: default_md = md5 # md to use policy = policy_any # default policy + email_in_dn = no # Don't add the email into cert DN + + nameopt = default_ca # Subject name display option + certopt = default_ca # Certificate display option + copy_extensions = none # Don't copy extensions from request [ policy_any ] countryName = supplied @@ -418,18 +517,6 @@ A sample configuration file with the relevant sections for B<ca>: commonName = supplied emailAddress = optional -=head1 WARNINGS - -The B<ca> command is quirky and at times downright unfriendly. - -The B<ca> utility was originally meant as an example of how to do things -in a CA. It was not supposed be be used as a full blown CA itself: -nevertheless some people are using it for this purpose. - -The B<ca> command is effectively a single user command: no locking is -done on the various files and attempts to run more than one B<ca> command -on the same database can have unpredictable results. - =head1 FILES Note: the location of all files can change either by compile time options, @@ -459,9 +546,6 @@ if corrupted it can be difficult to fix. It is theoretically possible to rebuild the index file from all the issued certificates and a current CRL: however there is no option to do this. -CRL entry extensions cannot currently be created: only CRL extensions -can be added. - V2 CRL features like delta CRL support and CRL numbers are not currently supported. @@ -474,10 +558,6 @@ The use of an in memory text database can cause problems when large numbers of certificates are present because, as the name implies the database has to be kept in memory. -Certificate request extensions are ignored: some kind of "policy" should -be included to use certain static extensions and certain extensions -from the request. - It is not possible to certify two certificates with the same DN: this is a side effect of how the text database is indexed and it cannot easily be fixed without introducing other problems. Some S/MIME clients can use @@ -490,13 +570,49 @@ exposed at either a command or interface level so a more friendly utility B<CA.pl> help a little but not very much. Any fields in a request that are not present in a policy are silently -deleted. This does not happen if the B<-preserveDN> option is used but -the extra fields are not displayed when the user is asked to certify -a request. The behaviour should be more friendly and configurable. +deleted. This does not happen if the B<-preserveDN> option is used. To +enforce the absence of the EMAIL field within the DN, as suggested by +RFCs, regardless the contents of the request' subject the B<-noemailDN> +option can be used. The behaviour should be more friendly and +configurable. Cancelling some commands by refusing to certify a certificate can create an empty file. +=head1 WARNINGS + +The B<ca> command is quirky and at times downright unfriendly. + +The B<ca> utility was originally meant as an example of how to do things +in a CA. It was not supposed to be used as a full blown CA itself: +nevertheless some people are using it for this purpose. + +The B<ca> command is effectively a single user command: no locking is +done on the various files and attempts to run more than one B<ca> command +on the same database can have unpredictable results. + +The B<copy_extensions> option should be used with caution. If care is +not taken then it can be a security risk. For example if a certificate +request contains a basicConstraints extension with CA:TRUE and the +B<copy_extensions> value is set to B<copyall> and the user does not spot +this when the certificate is displayed then this will hand the requestor +a valid CA certificate. + +This situation can be avoided by setting B<copy_extensions> to B<copy> +and including basicConstraints with CA:FALSE in the configuration file. +Then if the request contains a basicConstraints extension it will be +ignored. + +It is advisable to also include values for other extensions such +as B<keyUsage> to prevent a request supplying its own values. + +Additional restrictions can be placed on the CA certificate itself. +For example if the CA certificate has: + + basicConstraints = CA:TRUE, pathlen:0 + +then even if a certificate is issued with CA:TRUE it will not be valid. + =head1 SEE ALSO L<req(1)|req(1)>, L<spkac(1)|spkac(1)>, L<x509(1)|x509(1)>, L<CA.pl(1)|CA.pl(1)>, diff --git a/crypto/openssl/doc/apps/ciphers.pod b/crypto/openssl/doc/apps/ciphers.pod index 2107761..81a2c43 100644 --- a/crypto/openssl/doc/apps/ciphers.pod +++ b/crypto/openssl/doc/apps/ciphers.pod @@ -108,10 +108,20 @@ the default cipher list. This is determined at compile time and is normally B<ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH>. This must be the first cipher string specified. +=item B<COMPLEMENTOFDEFAULT> + +the ciphers included in B<ALL>, but not enabled by default. Currently +this is B<ADH>. Note that this rule does not cover B<eNULL>, which is +not included by B<ALL> (use B<COMPLEMENTOFALL> if necessary). + =item B<ALL> all ciphers suites except the B<eNULL> ciphers which must be explicitly enabled. +=item B<COMPLEMENTOFALL> + +the cipher suites not enabled by B<ALL>, currently being B<eNULL>. + =item B<HIGH> "high" encryption cipher suites. This currently means those with key lengths larger @@ -193,6 +203,10 @@ cipher suites using DH, including anonymous DH. anonymous DH cipher suites. +=item B<AES> + +cipher suites using AES. + =item B<3DES> cipher suites using triple DES. @@ -226,7 +240,9 @@ cipher suites using SHA1. =head1 CIPHER SUITE NAMES The following lists give the SSL or TLS cipher suites names from the -relevant specification and their OpenSSL equivalents. +relevant specification and their OpenSSL equivalents. It should be noted, +that several cipher suite names do not include the authentication used, +e.g. DES-CBC3-SHA. In these cases, RSA authentication is used. =head2 SSL v3.0 cipher suites. @@ -296,6 +312,24 @@ relevant specification and their OpenSSL equivalents. TLS_DH_anon_WITH_DES_CBC_SHA ADH-DES-CBC-SHA TLS_DH_anon_WITH_3DES_EDE_CBC_SHA ADH-DES-CBC3-SHA +=head2 AES ciphersuites from RFC3268, extending TLS v1.0 + + TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA + TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA + + TLS_DH_DSS_WITH_AES_128_CBC_SHA DH-DSS-AES128-SHA + TLS_DH_DSS_WITH_AES_256_CBC_SHA DH-DSS-AES256-SHA + TLS_DH_RSA_WITH_AES_128_CBC_SHA DH-RSA-AES128-SHA + TLS_DH_RSA_WITH_AES_256_CBC_SHA DH-RSA-AES256-SHA + + TLS_DHE_DSS_WITH_AES_128_CBC_SHA DHE-DSS-AES128-SHA + TLS_DHE_DSS_WITH_AES_256_CBC_SHA DHE-DSS-AES256-SHA + TLS_DHE_RSA_WITH_AES_128_CBC_SHA DHE-RSA-AES128-SHA + TLS_DHE_RSA_WITH_AES_256_CBC_SHA DHE-RSA-AES256-SHA + + TLS_DH_anon_WITH_AES_128_CBC_SHA ADH-AES128-SHA + TLS_DH_anon_WITH_AES_256_CBC_SHA ADH-AES256-SHA + =head2 Additional Export 1024 and other cipher suites Note: these ciphers can also be used in SSL v3. @@ -339,8 +373,22 @@ Include only 3DES ciphers and then place RSA ciphers last: openssl ciphers -v '3DES:+RSA' +Include all RC4 ciphers but leave out those without authentication: + + openssl ciphers -v 'RC4:!COMPLEMENTOFDEFAULT' + +Include all chiphers with RSA authentication but leave out ciphers without +encryption. + + openssl ciphers -v 'RSA:!COMPLEMENTOFALL' + =head1 SEE ALSO L<s_client(1)|s_client(1)>, L<s_server(1)|s_server(1)>, L<ssl(3)|ssl(3)> +=head1 HISTORY + +The B<COMPLENTOFALL> and B<COMPLEMENTOFDEFAULT> selection options were +added in version 0.9.7. + =cut diff --git a/crypto/openssl/doc/apps/enc.pod b/crypto/openssl/doc/apps/enc.pod index a68ddca..ddf0816 100644 --- a/crypto/openssl/doc/apps/enc.pod +++ b/crypto/openssl/doc/apps/enc.pod @@ -21,6 +21,7 @@ B<openssl enc -ciphername> [B<-p>] [B<-P>] [B<-bufsize number>] +[B<-nopad>] [B<-debug>] =head1 DESCRIPTION @@ -122,6 +123,10 @@ or decryption. set the buffer size for I/O +=item B<-nopad> + +disable standard block padding + =item B<-debug> debug the BIOs used for I/O. @@ -150,11 +155,14 @@ Some of the ciphers do not have large keys and others have security implications if not used correctly. A beginner is advised to just use a strong block cipher in CBC mode such as bf or des3. -All the block ciphers use PKCS#5 padding also known as standard block +All the block ciphers normally use PKCS#5 padding also known as standard block padding: this allows a rudimentary integrity or password check to be performed. However since the chance of random data passing the test is better than 1 in 256 it isn't a very good test. +If padding is disabled then the input data must be a multiple of the cipher +block length. + All RC2 ciphers have the same key and effective key length. Blowfish and RC5 algorithms use a 128 bit key. @@ -256,8 +264,8 @@ The B<-A> option when used with large files doesn't work properly. There should be an option to allow an iteration count to be included. -Like the EVP library the B<enc> program only supports a fixed number of -algorithms with certain parameters. So if, for example, you want to use RC2 -with a 76 bit key or RC4 with an 84 bit key you can't use this program. +The B<enc> program only supports a fixed number of algorithms with +certain parameters. So if, for example, you want to use RC2 with a +76 bit key or RC4 with an 84 bit key you can't use this program. =cut diff --git a/crypto/openssl/doc/apps/ocsp.pod b/crypto/openssl/doc/apps/ocsp.pod new file mode 100644 index 0000000..da201b9 --- /dev/null +++ b/crypto/openssl/doc/apps/ocsp.pod @@ -0,0 +1,348 @@ +=pod + +=head1 NAME + +ocsp - Online Certificate Status Protocol utility + +=head1 SYNOPSIS + +B<openssl> B<ocsp> +[B<-out file>] +[B<-issuer file>] +[B<-cert file>] +[B<-serial n>] +[B<-req_text>] +[B<-resp_text>] +[B<-text>] +[B<-reqout file>] +[B<-respout file>] +[B<-reqin file>] +[B<-respin file>] +[B<-nonce>] +[B<-no_nonce>] +[B<-url responder_url>] +[B<-host host:n>] +[B<-path>] +[B<-CApath file>] +[B<-CAfile file>] +[B<-VAfile file>] +[B<-verify_certs file>] +[B<-noverify>] +[B<-trust_other>] +[B<-no_intern>] +[B<-no_sig_verify>] +[B<-no_cert_verify>] +[B<-no_chain>] +[B<-no_cert_checks>] +[B<-validity_period nsec>] +[B<-status_age nsec>] + +=head1 DESCRIPTION + +B<WARNING: this documentation is preliminary and subject to change.> + +The Online Certificate Status Protocol (OCSP) enables applications to +determine the (revocation) state of an identified certificate (RFC 2560). + +The B<ocsp> command performs many common OCSP tasks. It can be used +to print out requests and responses, create requests and send queries +to an OCSP responder and behave like a mini OCSP server itself. + +=head1 OCSP CLIENT OPTIONS + +=over 4 + +=item B<-out filename> + +specify output filename, default is standard output. + +=item B<-issuer filename> + +This specifies the current issuer certificate. This option can be used +multiple times. The certificate specified in B<filename> must be in +PEM format. + +=item B<-cert filename> + +Add the certificate B<filename> to the request. The issuer certificate +is taken from the previous B<issuer> option, or an error occurs if no +issuer certificate is specified. + +=item B<-serial num> + +Same as the B<cert> option except the certificate with serial number +B<num> is added to the request. The serial number is interpreted as a +decimal integer unless preceded by B<0x>. Negative integers can also +be specified by preceding the value by a B<-> sign. + +=item B<-signer filename>, B<-signkey filename> + +Sign the OCSP request using the certificate specified in the B<signer> +option and the private key specified by the B<signkey> option. If +the B<signkey> option is not present then the private key is read +from the same file as the certificate. If neither option is specified then +the OCSP request is not signed. + +=item B<-nonce>, B<-no_nonce> + +Add an OCSP nonce extension to a request or disable OCSP nonce addition. +Normally if an OCSP request is input using the B<respin> option no +nonce is added: using the B<nonce> option will force addition of a nonce. +If an OCSP request is being created (using B<cert> and B<serial> options) +a nonce is automatically added specifying B<no_nonce> overrides this. + +=item B<-req_text>, B<-resp_text>, B<-text> + +print out the text form of the OCSP request, response or both respectively. + +=item B<-reqout file>, B<-respout file> + +write out the DER encoded certificate request or response to B<file>. + +=item B<-reqin file>, B<-respin file> + +read OCSP request or response file from B<file>. These option are ignored +if OCSP request or response creation is implied by other options (for example +with B<serial>, B<cert> and B<host> options). + +=item B<-url responder_url> + +specify the responder URL. Both HTTP and HTTPS (SSL/TLS) URLs can be specified. + +=item B<-host hostname:port>, B<-path pathname> + +if the B<host> option is present then the OCSP request is sent to the host +B<hostname> on port B<port>. B<path> specifies the HTTP path name to use +or "/" by default. + +=item B<-CAfile file>, B<-CApath pathname> + +file or pathname containing trusted CA certificates. These are used to verify +the signature on the OCSP response. + +=item B<-verify_certs file> + +file containing additional certificates to search when attempting to locate +the OCSP response signing certificate. Some responders omit the actual signer's +certificate from the response: this option can be used to supply the necessary +certificate in such cases. + +=item B<-trust_other> + +the certificates specified by the B<-verify_certs> option should be explicitly +trusted and no additional checks will be performed on them. This is useful +when the complete responder certificate chain is not available or trusting a +root CA is not appropriate. + +=item B<-VAfile file> + +file containing explicitly trusted responder certificates. Equivalent to the +B<-verify_certs> and B<-trust_other> options. + +=item B<-noverify> + +don't attempt to verify the OCSP response signature or the nonce values. This +option will normally only be used for debugging since it disables all verification +of the responders certificate. + +=item B<-no_intern> + +ignore certificates contained in the OCSP response when searching for the +signers certificate. With this option the signers certificate must be specified +with either the B<-verify_certs> or B<-VAfile> options. + +=item B<-no_sig_verify> + +don't check the signature on the OCSP response. Since this option tolerates invalid +signatures on OCSP responses it will normally only be used for testing purposes. + +=item B<-no_cert_verify> + +don't verify the OCSP response signers certificate at all. Since this option allows +the OCSP response to be signed by any certificate it should only be used for +testing purposes. + +=item B<-no_chain> + +do not use certificates in the response as additional untrusted CA +certificates. + +=item B<-no_cert_checks> + +don't perform any additional checks on the OCSP response signers certificate. +That is do not make any checks to see if the signers certificate is authorised +to provide the necessary status information: as a result this option should +only be used for testing purposes. + +=item B<-validity_period nsec>, B<-status_age age> + +these options specify the range of times, in seconds, which will be tolerated +in an OCSP response. Each certificate status response includes a B<notBefore> time and +an optional B<notAfter> time. The current time should fall between these two values, but +the interval between the two times may be only a few seconds. In practice the OCSP +responder and clients clocks may not be precisely synchronised and so such a check +may fail. To avoid this the B<-validity_period> option can be used to specify an +acceptable error range in seconds, the default value is 5 minutes. + +If the B<notAfter> time is omitted from a response then this means that new status +information is immediately available. In this case the age of the B<notBefore> field +is checked to see it is not older than B<age> seconds old. By default this additional +check is not performed. + +=back + +=head1 OCSP SERVER OPTIONS + +=over 4 + +=item B<-index indexfile> + +B<indexfile> is a text index file in B<ca> format containing certificate revocation +information. + +If the B<index> option is specified the B<ocsp> utility is in responder mode, otherwise +it is in client mode. The request(s) the responder processes can be either specified on +the command line (using B<issuer> and B<serial> options), supplied in a file (using the +B<respin> option) or via external OCSP clients (if B<port> or B<url> is specified). + +If the B<index> option is present then the B<CA> and B<rsigner> options must also be +present. + +=item B<-CA file> + +CA certificate corresponding to the revocation information in B<indexfile>. + +=item B<-rsigner file> + +The certificate to sign OCSP responses with. + +=item B<-rother file> + +Additional certificates to include in the OCSP response. + +=item B<-resp_no_certs> + +Don't include any certificates in the OCSP response. + +=item B<-resp_key_id> + +Identify the signer certificate using the key ID, default is to use the subject name. + +=item B<-rkey file> + +The private key to sign OCSP responses with: if not present the file specified in the +B<rsigner> option is used. + +=item B<-port portnum> + +Port to listen for OCSP requests on. The port may also be specified using the B<url> +option. + +=item B<-nrequest number> + +The OCSP server will exit after receiving B<number> requests, default unlimited. + +=item B<-nmin minutes>, B<-ndays days> + +Number of minutes or days when fresh revocation information is available: used in the +B<nextUpdate> field. If neither option is present then the B<nextUpdate> field is +omitted meaning fresh revocation information is immediately available. + +=back + +=head1 OCSP Response verification. + +OCSP Response follows the rules specified in RFC2560. + +Initially the OCSP responder certificate is located and the signature on +the OCSP request checked using the responder certificate's public key. + +Then a normal certificate verify is performed on the OCSP responder certificate +building up a certificate chain in the process. The locations of the trusted +certificates used to build the chain can be specified by the B<CAfile> +and B<CApath> options or they will be looked for in the standard OpenSSL +certificates directory. + +If the initial verify fails then the OCSP verify process halts with an +error. + +Otherwise the issuing CA certificate in the request is compared to the OCSP +responder certificate: if there is a match then the OCSP verify succeeds. + +Otherwise the OCSP responder certificate's CA is checked against the issuing +CA certificate in the request. If there is a match and the OCSPSigning +extended key usage is present in the OCSP responder certificate then the +OCSP verify succeeds. + +Otherwise the root CA of the OCSP responders CA is checked to see if it +is trusted for OCSP signing. If it is the OCSP verify succeeds. + +If none of these checks is successful then the OCSP verify fails. + +What this effectively means if that if the OCSP responder certificate is +authorised directly by the CA it is issuing revocation information about +(and it is correctly configured) then verification will succeed. + +If the OCSP responder is a "global responder" which can give details about +multiple CAs and has its own separate certificate chain then its root +CA can be trusted for OCSP signing. For example: + + openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem + +Alternatively the responder certificate itself can be explicitly trusted +with the B<-VAfile> option. + +=head1 NOTES + +As noted, most of the verify options are for testing or debugging purposes. +Normally only the B<-CApath>, B<-CAfile> and (if the responder is a 'global +VA') B<-VAfile> options need to be used. + +The OCSP server is only useful for test and demonstration purposes: it is +not really usable as a full OCSP responder. It contains only a very +simple HTTP request handling and can only handle the POST form of OCSP +queries. It also handles requests serially meaning it cannot respond to +new requests until it has processed the current one. The text index file +format of revocation is also inefficient for large quantities of revocation +data. + +It is possible to run the B<ocsp> application in responder mode via a CGI +script using the B<respin> and B<respout> options. + +=head1 EXAMPLES + +Create an OCSP request and write it to a file: + + openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem -reqout req.der + +Send a query to an OCSP responder with URL http://ocsp.myhost.com/ save the +response to a file and print it out in text form + + openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \ + -url http://ocsp.myhost.com/ -resp_text -respout resp.der + +Read in an OCSP response and print out text form: + + openssl ocsp -respin resp.der -text + +OCSP server on port 8888 using a standard B<ca> configuration, and a separate +responder certificate. All requests and responses are printed to a file. + + openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem + -text -out log.txt + +As above but exit after processing one request: + + openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem + -nrequest 1 + +Query status information using internally generated request: + + openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem + -issuer demoCA/cacert.pem -serial 1 + +Query status information using request read from a file, write response to a +second file. + + openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem + -reqin req.der -respout resp.der diff --git a/crypto/openssl/doc/apps/openssl.pod b/crypto/openssl/doc/apps/openssl.pod index e3c79a4..07dd80e 100644 --- a/crypto/openssl/doc/apps/openssl.pod +++ b/crypto/openssl/doc/apps/openssl.pod @@ -121,6 +121,10 @@ Generation of DSA Parameters. Generation of RSA Parameters. +=item L<B<ocsp>|ocsp(1)> + +Online Certificate Status Protocol utility. + =item L<B<passwd>|passwd(1)> Generation of hashed passwords. diff --git a/crypto/openssl/doc/apps/passwd.pod b/crypto/openssl/doc/apps/passwd.pod index 6e09894..f449825 100644 --- a/crypto/openssl/doc/apps/passwd.pod +++ b/crypto/openssl/doc/apps/passwd.pod @@ -13,6 +13,7 @@ B<openssl passwd> [B<-salt> I<string>] [B<-in> I<file>] [B<-stdin>] +[B<-noverify>] [B<-quiet>] [B<-table>] {I<password>} @@ -22,7 +23,7 @@ B<openssl passwd> The B<passwd> command computes the hash of a password typed at run-time or the hash of each password in a list. The password list is taken from the named file for option B<-in file>, from stdin for -option B<-stdin>, and from the command line otherwise. +option B<-stdin>, or from the command line, or from the terminal otherwise. The Unix standard algorithm B<crypt> and the MD5-based BSD password algorithm B<1> and its Apache variant B<apr1> are available. @@ -45,6 +46,7 @@ Use the B<apr1> algorithm (Apache variant of the BSD algorithm). =item B<-salt> I<string> Use the specified salt. +When reading a password from the terminal, this implies B<-noverify>. =item B<-in> I<file> @@ -54,6 +56,10 @@ Read passwords from I<file>. Read passwords from B<stdin>. +=item B<-noverify> + +Don't verify when reading a password from the terminal. + =item B<-quiet> Don't output warnings when passwords given at the command line are truncated. @@ -69,7 +75,7 @@ to each password hash. B<openssl passwd -crypt -salt xx password> prints B<xxj31ZMTZzkVA>. -B<openssl passwd -1 -salt xxxxxxxx password> prints B<$1$xxxxxxxx$8XJIcl6ZXqBMCK0qFevqT1>. +B<openssl passwd -1 -salt xxxxxxxx password> prints B<$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.>. B<openssl passwd -apr1 -salt xxxxxxxx password> prints B<$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0>. diff --git a/crypto/openssl/doc/apps/pkcs12.pod b/crypto/openssl/doc/apps/pkcs12.pod index 7e0307d..7d84146 100644 --- a/crypto/openssl/doc/apps/pkcs12.pod +++ b/crypto/openssl/doc/apps/pkcs12.pod @@ -262,7 +262,7 @@ the one corresponding to the private key. Certain software which requires a private key and certificate and assumes the first certificate in the file is the one corresponding to the private key: this may not always be the case. Using the B<-clcerts> option will solve this problem by only -outputing the certificate corresponding to the private key. If the CA +outputting the certificate corresponding to the private key. If the CA certificates are required then they can be output to a separate file using the B<-nokeys -cacerts> options to just output CA certificates. diff --git a/crypto/openssl/doc/apps/pkcs7.pod b/crypto/openssl/doc/apps/pkcs7.pod index 4e9bd6e..9871c0e 100644 --- a/crypto/openssl/doc/apps/pkcs7.pod +++ b/crypto/openssl/doc/apps/pkcs7.pod @@ -78,7 +78,7 @@ The PEM PKCS#7 format uses the header and footer lines: -----BEGIN PKCS7----- -----END PKCS7----- -For compatability with some CAs it will also accept: +For compatibility with some CAs it will also accept: -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- diff --git a/crypto/openssl/doc/apps/rand.pod b/crypto/openssl/doc/apps/rand.pod index cbf8768..75745ca 100644 --- a/crypto/openssl/doc/apps/rand.pod +++ b/crypto/openssl/doc/apps/rand.pod @@ -15,7 +15,7 @@ I<num> =head1 DESCRIPTION The B<rand> command outputs I<num> pseudo-random bytes after seeding -the random number generater once. As in other B<openssl> command +the random number generator once. As in other B<openssl> command line tools, PRNG seeding uses the file I<$HOME/>B<.rnd> or B<.rnd> in addition to the files given in the B<-rand> option. A new I<$HOME>/B<.rnd> or B<.rnd> file will be written back if enough diff --git a/crypto/openssl/doc/apps/req.pod b/crypto/openssl/doc/apps/req.pod index a3f54f4..7a3b6bb 100644 --- a/crypto/openssl/doc/apps/req.pod +++ b/crypto/openssl/doc/apps/req.pod @@ -3,7 +3,7 @@ =head1 NAME -req - PKCS#10 certificate and certificate generating utility. +req - PKCS#10 certificate request and certificate generating utility. =head1 SYNOPSIS @@ -15,6 +15,7 @@ B<openssl> B<req> [B<-out filename>] [B<-passout arg>] [B<-text>] +[B<-pubkey>] [B<-noout>] [B<-verify>] [B<-modulus>] @@ -28,12 +29,18 @@ B<openssl> B<req> [B<-keyout filename>] [B<-[md5|sha1|md2|mdc2]>] [B<-config filename>] +[B<-subj arg>] [B<-x509>] [B<-days n>] +[B<-set_serial n>] [B<-asn1-kludge>] [B<-newhdr>] [B<-extensions section>] [B<-reqexts section>] +[B<-utf8>] +[B<-nameopt>] +[B<-batch>] +[B<-verbose>] =head1 DESCRIPTION @@ -82,6 +89,10 @@ see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>. prints out the certificate request in text form. +=item B<-pubkey> + +outputs the public key. + =item B<-noout> this option prevents output of the encoded version of the request. @@ -154,18 +165,33 @@ this allows an alternative configuration file to be specified, this overrides the compile time filename or any specified in the B<OPENSSL_CONF> environment variable. +=item B<-subj arg> + +sets subject name for new request or supersedes the subject name +when processing a request. +The arg must be formatted as I</type0=value0/type1=value1/type2=...>, +characters may be escaped by \ (backslash), no spaces are skipped. + =item B<-x509> this option outputs a self signed certificate instead of a certificate request. This is typically used to generate a test certificate or a self signed root CA. The extensions added to the certificate -(if any) are specified in the configuration file. +(if any) are specified in the configuration file. Unless specified +using the B<set_serial> option B<0> will be used for the serial +number. =item B<-days n> when the B<-x509> option is being used this specifies the number of days to certify the certificate for. The default is 30 days. +=item B<-set_serial n> + +serial number to use when outputting a self signed certificate. This +may be specified as a decimal value or a hex value if preceded by B<0x>. +It is possible to use negative serial numbers but this is not recommended. + =item B<-extensions section> =item B<-reqexts section> @@ -176,6 +202,20 @@ request extensions. This allows several different sections to be used in the same configuration file to specify requests for a variety of purposes. +=item B<-utf8> + +this option causes field values to be interpreted as UTF8 strings, by +default they are interpreted as ASCII. This means that the field +values, whether prompted from a terminal or obtained from a +configuration file, must be valid UTF8 strings. + +=item B<-nameopt option> + +option which determines how the subject or issuer names are displayed. The +B<option> argument can be a single option or multiple options separated by +commas. Alternatively the B<-nameopt> switch may be used more than once to +set multiple options. See the L<x509(1)|x509(1)> manual page for details. + =item B<-asn1-kludge> by default the B<req> command outputs certificate requests containing @@ -196,6 +236,14 @@ It should be noted that very few CAs still require the use of this option. Adds the word B<NEW> to the PEM file header and footer lines on the outputed request. Some software (Netscape certificate server) and some CAs need this. +=item B<-batch> + +non-interactive mode. + +=item B<-verbose> + +print extra details about the operations being performed. + =back =head1 CONFIGURATION FILE FORMAT @@ -292,6 +340,13 @@ if set to the value B<no> this disables prompting of certificate fields and just takes values from the config file directly. It also changes the expected format of the B<distinguished_name> and B<attributes> sections. +=item B<utf8> + +if set to the value B<yes> then field values to be interpreted as UTF8 +strings, by default they are interpreted as ASCII. This means that +the field values, whether prompted from a terminal or obtained from a +configuration file, must be valid UTF8 strings. + =item B<attributes> this specifies the section containing any request attributes: its format @@ -457,13 +512,13 @@ Sample configuration containing all field values: The header and footer lines in the B<PEM> format are normally: - -----BEGIN CERTIFICATE REQUEST---- - -----END CERTIFICATE REQUEST---- + -----BEGIN CERTIFICATE REQUEST----- + -----END CERTIFICATE REQUEST----- some software (some versions of Netscape certificate server) instead needs: - -----BEGIN NEW CERTIFICATE REQUEST---- - -----END NEW CERTIFICATE REQUEST---- + -----BEGIN NEW CERTIFICATE REQUEST----- + -----END NEW CERTIFICATE REQUEST----- which is produced with the B<-newhdr> option but is otherwise compatible. Either form is accepted transparently on input. diff --git a/crypto/openssl/doc/apps/rsa.pod b/crypto/openssl/doc/apps/rsa.pod index f0e613e..ef74f1a 100644 --- a/crypto/openssl/doc/apps/rsa.pod +++ b/crypto/openssl/doc/apps/rsa.pod @@ -136,7 +136,7 @@ and Microsoft IIS .key files, this uses unsalted RC4 for its encryption. It is not very secure and so should only be used when necessary. Some newer version of IIS have additional data in the exported .key -files. To use thse with the utility view the file with a binary editor +files. To use these with the utility, view the file with a binary editor and look for the string "private-key", then trace back to the byte sequence 0x30, 0x82 (this is an ASN1 SEQUENCE). Copy all the data from this point onwards to another file and use that as the input diff --git a/crypto/openssl/doc/apps/s_client.pod b/crypto/openssl/doc/apps/s_client.pod index f596ec7..7fca9cb 100644 --- a/crypto/openssl/doc/apps/s_client.pod +++ b/crypto/openssl/doc/apps/s_client.pod @@ -18,6 +18,7 @@ B<openssl> B<s_client> [B<-pause>] [B<-showcerts>] [B<-debug>] +[B<-msg>] [B<-nbio_test>] [B<-state>] [B<-nbio>] @@ -32,6 +33,7 @@ B<openssl> B<s_client> [B<-no_tls1>] [B<-bugs>] [B<-cipher cipherlist>] +[B<-engine id>] [B<-rand file(s)>] =head1 DESCRIPTION @@ -111,6 +113,10 @@ prints out the SSL session states. print extensive debugging information including a hex dump of all traffic. +=item B<-msg> + +show all protocol messages with hex dump. + =item B<-nbio_test> tests non-blocking I/O @@ -131,7 +137,7 @@ input. =item B<-quiet> -inhibit printing of session and certificate information. This implicitely +inhibit printing of session and certificate information. This implicitly turns on B<-ign_eof> as well. =item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1> @@ -157,6 +163,13 @@ the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See the B<ciphers> command for more information. +=item B<-engine id> + +specifying an engine (by it's unique B<id> string) will cause B<s_client> +to attempt to obtain a functional reference to the specified engine, +thus initialising it if needed. The engine will then be set as the default +for all available algorithms. + =item B<-rand file(s)> a file or files containing random data used to seed the random number @@ -172,7 +185,7 @@ all others. If a connection is established with an SSL server then any data received from the server is displayed and any key presses will be sent to the server. When used interactively (which means neither B<-quiet> nor B<-ign_eof> -have been given), the session will be renegociated if the line begins with an +have been given), the session will be renegotiated if the line begins with an B<R>, and if the line begins with a B<Q> or if end of file is reached, the connection will be closed down. diff --git a/crypto/openssl/doc/apps/s_server.pod b/crypto/openssl/doc/apps/s_server.pod index 23a073a..4b1e426 100644 --- a/crypto/openssl/doc/apps/s_server.pod +++ b/crypto/openssl/doc/apps/s_server.pod @@ -21,6 +21,7 @@ B<openssl> B<s_server> [B<-nbio_test>] [B<-crlf>] [B<-debug>] +[B<-msg>] [B<-state>] [B<-CApath directory>] [B<-CAfile filename>] @@ -39,6 +40,8 @@ B<openssl> B<s_server> [B<-hack>] [B<-www>] [B<-WWW>] +[B<-HTTP>] +[B<-engine id>] [B<-rand file(s)>] =head1 DESCRIPTION @@ -134,6 +137,10 @@ prints out the SSL session states. print extensive debugging information including a hex dump of all traffic. +=item B<-msg> + +show all protocol messages with hex dump. + =item B<-nbio_test> tests non blocking I/O @@ -187,6 +194,21 @@ emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be loaded. +=item B<-HTTP> + +emulates a simple web server. Pages will be resolved relative to the +current directory, for example if the URL https://myhost/page.html is +requested the file ./page.html will be loaded. The files loaded are +assumed to contain a complete and correct HTTP response (lines that +are part of the HTTP response line and headers must end with CRLF). + +=item B<-engine id> + +specifying an engine (by it's unique B<id> string) will cause B<s_server> +to attempt to obtain a functional reference to the specified engine, +thus initialising it if needed. The engine will then be set as the default +for all available algorithms. + =item B<-rand file(s)> a file or files containing random data used to seed the random number diff --git a/crypto/openssl/doc/apps/smime.pod b/crypto/openssl/doc/apps/smime.pod index fa5d23e..2453dd2 100644 --- a/crypto/openssl/doc/apps/smime.pod +++ b/crypto/openssl/doc/apps/smime.pod @@ -340,8 +340,8 @@ detached signature format. You can use this program to verify the signature by line wrapping the base64 encoded structure and surrounding it with: - -----BEGIN PKCS7---- - -----END PKCS7---- + -----BEGIN PKCS7----- + -----END PKCS7----- and using the command, diff --git a/crypto/openssl/doc/apps/speed.pod b/crypto/openssl/doc/apps/speed.pod index 77560f1..0dcdba8 100644 --- a/crypto/openssl/doc/apps/speed.pod +++ b/crypto/openssl/doc/apps/speed.pod @@ -7,6 +7,7 @@ speed - test library performance =head1 SYNOPSIS B<openssl speed> +[B<-engine id>] [B<md2>] [B<mdc2>] [B<md5>] @@ -39,7 +40,20 @@ This command is used to test the performance of cryptographic algorithms. =head1 OPTIONS +=over 4 + +=item B<-engine id> + +specifying an engine (by it's unique B<id> string) will cause B<speed> +to attempt to obtain a functional reference to the specified engine, +thus initialising it if needed. The engine will then be set as the default +for all available algorithms. + +=item B<[zero or more test algorithms]> + If any options are given, B<speed> tests those algorithms, otherwise all of the above are tested. +=back + =cut diff --git a/crypto/openssl/doc/apps/version.pod b/crypto/openssl/doc/apps/version.pod index 5d261a6..e00324c 100644 --- a/crypto/openssl/doc/apps/version.pod +++ b/crypto/openssl/doc/apps/version.pod @@ -46,6 +46,10 @@ compilation flags. platform setting. +=item B<-d> + +OPENSSLDIR setting. + =back =head1 NOTES @@ -53,4 +57,8 @@ platform setting. The output of B<openssl version -a> would typically be used when sending in a bug report. +=head1 HISTORY + +The B<-d> option was added in OpenSSL 0.9.7. + =cut diff --git a/crypto/openssl/doc/apps/x509.pod b/crypto/openssl/doc/apps/x509.pod index 84f76cb..674bfd1 100644 --- a/crypto/openssl/doc/apps/x509.pod +++ b/crypto/openssl/doc/apps/x509.pod @@ -36,6 +36,7 @@ B<openssl> B<x509> [B<-addreject arg>] [B<-setalias arg>] [B<-days arg>] +[B<-set_serial n>] [B<-signkey filename>] [B<-x509toreq>] [B<-req>] @@ -60,8 +61,9 @@ certificate trust settings. Since there are a large number of options they will split up into various sections. +=head1 OPTIONS -=head1 INPUT, OUTPUT AND GENERAL PURPOSE OPTIONS +=head2 INPUT, OUTPUT AND GENERAL PURPOSE OPTIONS =over 4 @@ -99,10 +101,10 @@ this option has no effect: SHA1 is always used with DSA keys. =back -=head1 DISPLAY OPTIONS +=head2 DISPLAY OPTIONS Note: the B<-alias> and B<-purpose> options are also display options -but are described in the B<TRUST OPTIONS> section. +but are described in the B<TRUST SETTINGS> section. =over 4 @@ -112,6 +114,13 @@ prints out the certificate in text form. Full details are output including the public key, signature algorithms, issuer and subject names, serial number any extensions present and any trust settings. +=item B<-certopt option> + +customise the output format used with B<-text>. The B<option> argument can be +a single option or multiple options separated by commas. The B<-certopt> switch +may be also be used more than once to set multiple options. See the B<TEXT OPTIONS> +section for more information. + =item B<-noout> this option prevents output of the encoded version of the request. @@ -141,9 +150,10 @@ outputs the issuer name. =item B<-nameopt option> -option which determine how the subject or issuer names are displayed. This -option may be used more than once to set multiple options. See the B<NAME -OPTIONS> section for more information. +option which determines how the subject or issuer names are displayed. The +B<option> argument can be a single option or multiple options separated by +commas. Alternatively the B<-nameopt> switch may be used more than once to +set multiple options. See the B<NAME OPTIONS> section for more information. =item B<-email> @@ -163,7 +173,8 @@ prints out the start and expiry dates of a certificate. =item B<-fingerprint> -prints out the digest of the DER encoded version of the whole certificate. +prints out the digest of the DER encoded version of the whole certificate +(see digest options). =item B<-C> @@ -171,7 +182,7 @@ this outputs the certificate in the form of a C source file. =back -=head1 TRUST SETTINGS +=head2 TRUST SETTINGS Please note these options are currently experimental and may well change. @@ -242,7 +253,7 @@ EXTENSIONS> section. =back -=head1 SIGNING OPTIONS +=head2 SIGNING OPTIONS The B<x509> utility can be used to sign certificates and requests: it can thus behave like a "mini CA". @@ -292,6 +303,16 @@ is used to pass the required private key. by default a certificate is expected on input. With this option a certificate request is expected instead. +=item B<-set_serial n> + +specifies the serial number to use. This option can be used with either +the B<-signkey> or B<-CA> options. If used in conjunction with the B<-CA> +option the serial number file (as specified by the B<-CAserial> or +B<-CAcreateserial> options) is not used. + +The serial number can be decimal or hex (if preceded by B<0x>). Negative +serial numbers can also be specified but their use is not recommended. + =item B<-CA filename> specifies the CA certificate to be used for signing. When this option is @@ -321,7 +342,7 @@ The default filename consists of the CA certificate file base name with ".srl" appended. For example if the CA certificate file is called "mycacert.pem" it expects to find a serial number file called "mycacert.srl". -=item B<-CAcreateserial filename> +=item B<-CAcreateserial> with this option the CA serial number file is created if it does not exist: it will contain the serial number "02" and the certificate being signed will @@ -342,7 +363,7 @@ specified then the extensions should either be contained in the unnamed =back -=head1 NAME OPTIONS +=head2 NAME OPTIONS The B<nameopt> command line switch determines how the subject and issuer names are displayed. If no B<nameopt> switch is present the default "oneline" @@ -372,12 +393,12 @@ options. =item B<multiline> a multiline format. It is equivalent B<esc_ctrl>, B<esc_msb>, B<sep_multiline>, -B<spc_eq> and B<lname>. +B<spc_eq>, B<lname> and B<align>. =item B<esc_2253> escape the "special" characters required by RFC2253 in a field That is -B<,+"E<lt>E<gt>;>. Additionally B<#> is escaped at the beginnging of a string +B<,+"E<lt>E<gt>;>. Additionally B<#> is escaped at the beginning of a string and a space character at the beginning or end of a string. =item B<esc_ctrl> @@ -431,7 +452,7 @@ B<#XXXX...> format. dump non character string types (for example OCTET STRING) if this option is not set then non character string types will be displayed -as though each content octet repesents a single character. +as though each content octet represents a single character. =item B<dump_all> @@ -467,6 +488,11 @@ not display the field at all. B<sname> uses the "short name" form B<oid> represents the OID in numerical form and is useful for diagnostic purpose. +=item B<align> + +align field values for a more readable output. Only usable with +B<sep_multiline>. + =item B<spc_eq> places spaces round the B<=> character which follows the field @@ -474,6 +500,85 @@ name. =back +=head2 TEXT OPTIONS + +As well as customising the name output format, it is also possible to +customise the actual fields printed using the B<certopt> options when +the B<text> option is present. The default behaviour is to print all fields. + +=over 4 + +=item B<compatible> + +use the old format. This is equivalent to specifying no output options at all. + +=item B<no_header> + +don't print header information: that is the lines saying "Certificate" and "Data". + +=item B<no_version> + +don't print out the version number. + +=item B<no_serial> + +don't print out the serial number. + +=item B<no_signame> + +don't print out the signature algorithm used. + +=item B<no_validity> + +don't print the validity, that is the B<notBefore> and B<notAfter> fields. + +=item B<no_subject> + +don't print out the subject name. + +=item B<no_issuer> + +don't print out the issuer name. + +=item B<no_pubkey> + +don't print out the public key. + +=item B<no_sigdump> + +don't give a hexadecimal dump of the certificate signature. + +=item B<no_aux> + +don't print out certificate trust information. + +=item B<no_extensions> + +don't print out any X509V3 extensions. + +=item B<ext_default> + +retain default extension behaviour: attempt to print out unsupported certificate extensions. + +=item B<ext_error> + +print an error message for unsupported certificate extensions. + +=item B<ext_parse> + +ASN1 parse unsupported extensions. + +=item B<ext_dump> + +hex dump unsupported extensions. + +=item B<ca_default> + +the value used by the B<ca> utility, equivalent to B<no_issuer>, B<no_pubkey>, B<no_header>, +B<no_version>, B<no_sigdump> and B<no_signame>. + +=back + =head1 EXAMPLES Note: in these examples the '\' means the example should be all on one @@ -498,7 +603,7 @@ Display the certificate subject name in RFC2253 form: Display the certificate subject name in oneline form on a terminal supporting UTF8: - openssl x509 -in cert.pem -noout -subject -nameopt oneline -nameopt -escmsb + openssl x509 -in cert.pem -noout -subject -nameopt oneline,-escmsb Display the certificate MD5 fingerprint: @@ -539,18 +644,18 @@ Set a certificate to be trusted for SSL client use and change set its alias to The PEM format uses the header and footer lines: - -----BEGIN CERTIFICATE---- - -----END CERTIFICATE---- + -----BEGIN CERTIFICATE----- + -----END CERTIFICATE----- it will also handle files containing: - -----BEGIN X509 CERTIFICATE---- - -----END X509 CERTIFICATE---- + -----BEGIN X509 CERTIFICATE----- + -----END X509 CERTIFICATE----- Trusted certificates have the lines - -----BEGIN TRUSTED CERTIFICATE---- - -----END TRUSTED CERTIFICATE---- + -----BEGIN TRUSTED CERTIFICATE----- + -----END TRUSTED CERTIFICATE----- The conversion to UTF8 format used with the name options assumes that T61Strings use the ISO8859-1 character set. This is wrong but Netscape |
