diff options
Diffstat (limited to 'secure/usr.bin/openssl/man/req.1')
-rw-r--r-- | secure/usr.bin/openssl/man/req.1 | 69 |
1 files changed, 39 insertions, 30 deletions
diff --git a/secure/usr.bin/openssl/man/req.1 b/secure/usr.bin/openssl/man/req.1 index 5b48dd1..2e27d89 100644 --- a/secure/usr.bin/openssl/man/req.1 +++ b/secure/usr.bin/openssl/man/req.1 @@ -1,4 +1,4 @@ -.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) +.\" Automatically generated by Pod::Man 2.27 (Pod::Simple 3.28) .\" .\" Standard preamble: .\" ======================================================================== @@ -38,6 +38,8 @@ . ds PI \(*p . ds L" `` . ds R" '' +. ds C` +. ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. @@ -48,17 +50,24 @@ .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. -.ie \nF \{\ -. de IX -. tm Index:\\$1\t\\n%\t"\\$2" +.\" +.\" Avoid warning from groff about undefined register 'F'. +.de IX .. -. nr % 0 -. rr F -.\} -.el \{\ -. de IX +.nr rF 0 +.if \n(.g .if rF .nr rF 1 +.if (\n(rF:(\n(.g==0)) \{ +. if \nF \{ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" .. +. if !\nF==2 \{ +. nr % 0 +. nr F 2 +. \} +. \} .\} +.rr rF .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. @@ -124,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "REQ 1" -.TH REQ 1 "2014-10-15" "1.0.1j" "OpenSSL" +.TH REQ 1 "2015-01-08" "1.0.1k" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -183,7 +192,7 @@ for use as root CAs for example. .IX Header "COMMAND OPTIONS" .IP "\fB\-inform DER|PEM\fR" 4 .IX Item "-inform DER|PEM" -This specifies the input format. The \fB\s-1DER\s0\fR option uses an \s-1ASN1\s0 \s-1DER\s0 encoded +This specifies the input format. The \fB\s-1DER\s0\fR option uses an \s-1ASN1 DER\s0 encoded form compatible with the PKCS#10. The \fB\s-1PEM\s0\fR form is the default format: it consists of the \fB\s-1DER\s0\fR format base64 encoded with additional header and footer lines. @@ -199,7 +208,7 @@ options (\fB\-new\fR and \fB\-newkey\fR) are not specified. .IP "\fB\-passin arg\fR" 4 .IX Item "-passin arg" the input file password source. For more information about the format of \fBarg\fR -see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). +see the \fB\s-1PASS PHRASE ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). .IP "\fB\-out filename\fR" 4 .IX Item "-out filename" This specifies the output filename to write to or standard output by @@ -207,7 +216,7 @@ default. .IP "\fB\-passout arg\fR" 4 .IX Item "-passout arg" the output file password source. For more information about the format of \fBarg\fR -see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). +see the \fB\s-1PASS PHRASE ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). .IP "\fB\-text\fR" 4 .IX Item "-text" prints out the certificate request in text form. @@ -270,15 +279,15 @@ if neccessary should be specified via \fB\-pkeyopt\fR parameter. .Sp \&\fBdsa:filename\fR generates a \s-1DSA\s0 key using the parameters in the file \fBfilename\fR. \fBec:filename\fR generates \s-1EC\s0 key (usable both with -\&\s-1ECDSA\s0 or \s-1ECDH\s0 algorithms), \fBgost2001:filename\fR generates \s-1GOST\s0 R -34.10\-2001 key (requires \fBccgost\fR engine configured in the configuration +\&\s-1ECDSA\s0 or \s-1ECDH\s0 algorithms), \fBgost2001:filename\fR generates \s-1GOST R +34.10\-2001\s0 key (requires \fBccgost\fR engine configured in the configuration file). If just \fBgost2001\fR is specified a parameter set should be specified by \fB\-pkeyopt paramset:X\fR .IP "\fB\-pkeyopt opt:value\fR" 4 .IX Item "-pkeyopt opt:value" set the public key algorithm option \fBopt\fR to \fBvalue\fR. The precise set of options supported depends on the public key algorithm used and its -implementation. See \fB\s-1KEY\s0 \s-1GENERATION\s0 \s-1OPTIONS\s0\fR in the \fBgenpkey\fR manual page +implementation. See \fB\s-1KEY GENERATION OPTIONS\s0\fR in the \fBgenpkey\fR manual page for more details. .IP "\fB\-key filename\fR" 4 .IX Item "-key filename" @@ -304,8 +313,8 @@ this specifies the message digest to sign the request with (such as the configuration file. .Sp Some public key algorithms may override this choice. For instance, \s-1DSA\s0 -signatures always use \s-1SHA1\s0, \s-1GOST\s0 R 34.10 signatures always use -\&\s-1GOST\s0 R 34.11\-94 (\fB\-md_gost94\fR). +signatures always use \s-1SHA1, GOST R 34.10\s0 signatures always use +\&\s-1GOST R 34.11\-94 \s0(\fB\-md_gost94\fR). .IP "\fB\-config filename\fR" 4 .IX Item "-config filename" this allows an alternative configuration file to be specified, @@ -329,7 +338,7 @@ If \-multi\-rdn is not used then the \s-1UID\s0 value is \fI123456+CN=John Doe\f .IX Item "-x509" this option outputs a self signed certificate instead of a certificate request. This is typically used to generate a test certificate or -a self signed root \s-1CA\s0. The extensions added to the certificate +a self signed root \s-1CA.\s0 The extensions added to the certificate (if any) are specified in the configuration file. Unless specified using the \fBset_serial\fR option \fB0\fR will be used for the serial number. @@ -356,7 +365,7 @@ a variety of purposes. .IP "\fB\-utf8\fR" 4 .IX Item "-utf8" this option causes field values to be interpreted as \s-1UTF8\s0 strings, by -default they are interpreted as \s-1ASCII\s0. This means that the field +default they are interpreted as \s-1ASCII.\s0 This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid \s-1UTF8\s0 strings. .IP "\fB\-nameopt option\fR" 4 @@ -380,10 +389,10 @@ accept requests containing no attributes in an invalid form: this option produces this invalid format. .Sp More precisely the \fBAttributes\fR in a PKCS#10 certificate request -are defined as a \fB\s-1SET\s0 \s-1OF\s0 Attribute\fR. They are \fBnot \s-1OPTIONAL\s0\fR so +are defined as a \fB\s-1SET OF\s0 Attribute\fR. They are \fBnot \s-1OPTIONAL\s0\fR so if no attributes are present then they should be encoded as an -empty \fB\s-1SET\s0 \s-1OF\s0\fR. The invalid form does not include the empty -\&\fB\s-1SET\s0 \s-1OF\s0\fR whereas the correct form does. +empty \fB\s-1SET OF\s0\fR. The invalid form does not include the empty +\&\fB\s-1SET OF\s0\fR whereas the correct form does. .Sp It should be noted that very few CAs still require the use of this option. .IP "\fB\-no\-asn1\-kludge\fR" 4 @@ -435,7 +444,7 @@ specified the key is written to standard output. This can be overridden by the \fB\-keyout\fR option. .IP "\fBoid_file\fR" 4 .IX Item "oid_file" -This specifies a file containing additional \fB\s-1OBJECT\s0 \s-1IDENTIFIERS\s0\fR. +This specifies a file containing additional \fB\s-1OBJECT IDENTIFIERS\s0\fR. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed by white space and finally the long name. @@ -468,7 +477,7 @@ fields. Most users will not need to change this option. It can be set to several values \fBdefault\fR which is also the default option uses PrintableStrings, T61Strings and BMPStrings if the \&\fBpkix\fR value is used then only PrintableStrings and BMPStrings will -be used. This follows the \s-1PKIX\s0 recommendation in \s-1RFC2459\s0. If the +be used. This follows the \s-1PKIX\s0 recommendation in \s-1RFC2459.\s0 If the \&\fButf8only\fR option is used then only UTF8Strings will be used: this is the \s-1PKIX\s0 recommendation in \s-1RFC2459\s0 after 2003. Finally the \fBnombstr\fR option just uses PrintableStrings and T61Strings: certain software has @@ -493,7 +502,7 @@ expected format of the \fBdistinguished_name\fR and \fBattributes\fR sections. .IP "\fButf8\fR" 4 .IX Item "utf8" if set to the value \fByes\fR then field values to be interpreted as \s-1UTF8\s0 -strings, by default they are interpreted as \s-1ASCII\s0. This means that +strings, by default they are interpreted as \s-1ASCII.\s0 This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid \s-1UTF8\s0 strings. .IP "\fBattributes\fR" 4 @@ -546,7 +555,7 @@ on the field being used (for example countryName can only ever be two characters long and must fit in a PrintableString). .PP Some fields (such as organizationName) can be used more than once -in a \s-1DN\s0. This presents a problem because configuration files will +in a \s-1DN.\s0 This presents a problem because configuration files will not recognize the same name occurring twice. To avoid this problem if the fieldName contains some characters followed by a full stop they will be ignored. So for example a second organizationName can @@ -721,14 +730,14 @@ Another puzzling message is this: .Ve .PP this is displayed when no attributes are present and the request includes -the correct empty \fB\s-1SET\s0 \s-1OF\s0\fR structure (the \s-1DER\s0 encoding of which is 0xa0 +the correct empty \fB\s-1SET OF\s0\fR structure (the \s-1DER\s0 encoding of which is 0xa0 0x00). If you just see: .PP .Vb 1 \& Attributes: .Ve .PP -then the \fB\s-1SET\s0 \s-1OF\s0\fR is missing and the encoding is technically invalid (but +then the \fB\s-1SET OF\s0\fR is missing and the encoding is technically invalid (but it is tolerated). See the description of the command line option \fB\-asn1\-kludge\fR for more information. .SH "ENVIRONMENT VARIABLES" @@ -740,7 +749,7 @@ environment variable serves the same purpose but its use is discouraged. .SH "BUGS" .IX Header "BUGS" OpenSSL's handling of T61Strings (aka TeletexStrings) is broken: it effectively -treats them as \s-1ISO\-8859\-1\s0 (Latin 1), Netscape and \s-1MSIE\s0 have similar behaviour. +treats them as \s-1ISO\-8859\-1 \s0(Latin 1), Netscape and \s-1MSIE\s0 have similar behaviour. This can cause problems if you need characters that aren't available in PrintableStrings and you don't want to or can't use BMPStrings. .PP |