diff options
Diffstat (limited to 'secure/usr.bin/openssl/man/x509.1')
| -rw-r--r-- | secure/usr.bin/openssl/man/x509.1 | 101 |
1 files changed, 55 insertions, 46 deletions
diff --git a/secure/usr.bin/openssl/man/x509.1 b/secure/usr.bin/openssl/man/x509.1 index 66530e5..b3a0b9a 100644 --- a/secure/usr.bin/openssl/man/x509.1 +++ b/secure/usr.bin/openssl/man/x509.1 @@ -1,4 +1,4 @@ -.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) +.\" Automatically generated by Pod::Man 2.27 (Pod::Simple 3.28) .\" .\" Standard preamble: .\" ======================================================================== @@ -38,6 +38,8 @@ . ds PI \(*p . ds L" `` . ds R" '' +. ds C` +. ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. @@ -48,17 +50,24 @@ .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. -.ie \nF \{\ -. de IX -. tm Index:\\$1\t\\n%\t"\\$2" +.\" +.\" Avoid warning from groff about undefined register 'F'. +.de IX .. -. nr % 0 -. rr F -.\} -.el \{\ -. de IX +.nr rF 0 +.if \n(.g .if rF .nr rF 1 +.if (\n(rF:(\n(.g==0)) \{ +. if \nF \{ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" .. +. if !\nF==2 \{ +. nr % 0 +. nr F 2 +. \} +. \} .\} +.rr rF .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. @@ -124,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "X509 1" -.TH X509 1 "2014-10-15" "1.0.1j" "OpenSSL" +.TH X509 1 "2015-01-08" "1.0.1k" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -189,14 +198,14 @@ x509 \- Certificate display and signing utility .IX Header "DESCRIPTION" The \fBx509\fR command is a multi purpose certificate utility. It can be used to display certificate information, convert certificates to -various forms, sign certificate requests like a \*(L"mini \s-1CA\s0\*(R" or edit +various forms, sign certificate requests like a \*(L"mini \s-1CA\*(R"\s0 or edit certificate trust settings. .PP Since there are a large number of options they will split up into various sections. .SH "OPTIONS" .IX Header "OPTIONS" -.SS "\s-1INPUT\s0, \s-1OUTPUT\s0 \s-1AND\s0 \s-1GENERAL\s0 \s-1PURPOSE\s0 \s-1OPTIONS\s0" +.SS "\s-1INPUT, OUTPUT AND GENERAL PURPOSE OPTIONS\s0" .IX Subsection "INPUT, OUTPUT AND GENERAL PURPOSE OPTIONS" .IP "\fB\-inform DER|PEM|NET\fR" 4 .IX Item "-inform DER|PEM|NET" @@ -230,10 +239,10 @@ specifying an engine (by its unique \fBid\fR string) will cause \fBx509\fR to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. -.SS "\s-1DISPLAY\s0 \s-1OPTIONS\s0" +.SS "\s-1DISPLAY OPTIONS\s0" .IX Subsection "DISPLAY OPTIONS" Note: the \fB\-alias\fR and \fB\-purpose\fR options are also display options -but are described in the \fB\s-1TRUST\s0 \s-1SETTINGS\s0\fR section. +but are described in the \fB\s-1TRUST SETTINGS\s0\fR section. .IP "\fB\-text\fR" 4 .IX Item "-text" prints out the certificate in text form. Full details are output including the @@ -243,7 +252,7 @@ any extensions present and any trust settings. .IX Item "-certopt option" customise the output format used with \fB\-text\fR. The \fBoption\fR argument can be a single option or multiple options separated by commas. The \fB\-certopt\fR switch -may be also be used more than once to set multiple options. See the \fB\s-1TEXT\s0 \s-1OPTIONS\s0\fR +may be also be used more than once to set multiple options. See the \fB\s-1TEXT OPTIONS\s0\fR section for more information. .IP "\fB\-noout\fR" 4 .IX Item "-noout" @@ -291,7 +300,7 @@ outputs the issuer name. option which determines how the subject or issuer names are displayed. The \&\fBoption\fR argument can be a single option or multiple options separated by commas. Alternatively the \fB\-nameopt\fR switch may be used more than once to -set multiple options. See the \fB\s-1NAME\s0 \s-1OPTIONS\s0\fR section for more information. +set multiple options. See the \fB\s-1NAME OPTIONS\s0\fR section for more information. .IP "\fB\-email\fR" 4 .IX Item "-email" outputs the email address(es) if any. @@ -318,7 +327,7 @@ prints out the digest of the \s-1DER\s0 encoded version of the whole certificate .IP "\fB\-C\fR" 4 .IX Item "-C" this outputs the certificate in the form of a C source file. -.SS "\s-1TRUST\s0 \s-1SETTINGS\s0" +.SS "\s-1TRUST SETTINGS\s0" .IX Subsection "TRUST SETTINGS" Please note these options are currently experimental and may well change. .PP @@ -331,7 +340,7 @@ must be \*(L"trusted\*(R". By default a trusted certificate must be stored locally and must be a root \s-1CA:\s0 any certificate chain ending in this \s-1CA\s0 is then usable for any purpose. .PP -Trust settings currently are only used with a root \s-1CA\s0. They allow a finer +Trust settings currently are only used with a root \s-1CA.\s0 They allow a finer control over the purposes the root \s-1CA\s0 can be used for. For example a \s-1CA\s0 may be trusted for \s-1SSL\s0 client but not \s-1SSL\s0 server use. .PP @@ -373,12 +382,12 @@ option. .IP "\fB\-purpose\fR" 4 .IX Item "-purpose" this option performs tests on the certificate extensions and outputs -the results. For a more complete description see the \fB\s-1CERTIFICATE\s0 -\&\s-1EXTENSIONS\s0\fR section. -.SS "\s-1SIGNING\s0 \s-1OPTIONS\s0" +the results. For a more complete description see the \fB\s-1CERTIFICATE +EXTENSIONS\s0\fR section. +.SS "\s-1SIGNING OPTIONS\s0" .IX Subsection "SIGNING OPTIONS" The \fBx509\fR utility can be used to sign certificates and requests: it -can thus behave like a \*(L"mini \s-1CA\s0\*(R". +can thus behave like a \*(L"mini \s-1CA\*(R".\s0 .IP "\fB\-signkey filename\fR" 4 .IX Item "-signkey filename" this option causes the input file to be self signed using the supplied @@ -397,7 +406,7 @@ the request. .IP "\fB\-passin arg\fR" 4 .IX Item "-passin arg" the key password source. For more information about the format of \fBarg\fR -see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). +see the \fB\s-1PASS PHRASE ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). .IP "\fB\-clrext\fR" 4 .IX Item "-clrext" delete any extensions from a certificate. This option is used when a @@ -432,7 +441,7 @@ serial numbers can also be specified but their use is not recommended. .IP "\fB\-CA filename\fR" 4 .IX Item "-CA filename" specifies the \s-1CA\s0 certificate to be used for signing. When this option is -present \fBx509\fR behaves like a \*(L"mini \s-1CA\s0\*(R". The input file is signed by this +present \fBx509\fR behaves like a \*(L"mini \s-1CA\*(R".\s0 The input file is signed by this \&\s-1CA\s0 using this option: that is its issuer name is set to the subject name of the \s-1CA\s0 and it is digitally signed using the CAs private key. .Sp @@ -473,7 +482,7 @@ specified then the extensions should either be contained in the unnamed \&\*(L"extensions\*(R" which contains the section to use. See the \&\fIx509v3_config\fR\|(5) manual page for details of the extension section format. -.SS "\s-1NAME\s0 \s-1OPTIONS\s0" +.SS "\s-1NAME OPTIONS\s0" .IX Subsection "NAME OPTIONS" The \fBnameopt\fR command line switch determines how the subject and issuer names are displayed. If no \fBnameopt\fR switch is present the default \*(L"oneline\*(R" @@ -490,7 +499,7 @@ displays names compatible with \s-1RFC2253\s0 equivalent to \fBesc_2253\fR, \fBe \&\fBsep_comma_plus\fR, \fBdn_rev\fR and \fBsname\fR. .IP "\fBoneline\fR" 4 .IX Item "oneline" -a oneline format which is more readable than \s-1RFC2253\s0. It is equivalent to +a oneline format which is more readable than \s-1RFC2253.\s0 It is equivalent to specifying the \fBesc_2253\fR, \fBesc_ctrl\fR, \fBesc_msb\fR, \fButf8\fR, \fBdump_nostr\fR, \&\fBdump_der\fR, \fBuse_quote\fR, \fBsep_comma_plus_space\fR, \fBspace_eq\fR and \fBsname\fR options. @@ -519,7 +528,7 @@ escapes some characters by surrounding the whole string with \fB"\fR characters, without the option all escaping is done with the \fB\e\fR character. .IP "\fButf8\fR" 4 .IX Item "utf8" -convert all strings to \s-1UTF8\s0 format first. This is required by \s-1RFC2253\s0. If +convert all strings to \s-1UTF8\s0 format first. This is required by \s-1RFC2253.\s0 If you are lucky enough to have a \s-1UTF8\s0 compatible terminal then the use of this option (and \fBnot\fR setting \fBesc_msb\fR) may result in the correct display of multibyte (international) characters. Is this option is not @@ -541,11 +550,11 @@ field contents. For example \*(L"\s-1BMPSTRING:\s0 Hello World\*(R". .IX Item "dump_der" when this option is set any fields that need to be hexdumped will be dumped using the \s-1DER\s0 encoding of the field. Otherwise just the -content octets will be displayed. Both options use the \s-1RFC2253\s0 -\&\fB#XXXX...\fR format. +content octets will be displayed. Both options use the \s-1RFC2253 +\&\s0\fB#XXXX...\fR format. .IP "\fBdump_nostr\fR" 4 .IX Item "dump_nostr" -dump non character string types (for example \s-1OCTET\s0 \s-1STRING\s0) if this +dump non character string types (for example \s-1OCTET STRING\s0) if this option is not set then non character string types will be displayed as though each content octet represents a single character. .IP "\fBdump_all\fR" 4 @@ -566,7 +575,7 @@ the \s-1RDN\s0 separator and a spaced \fB+\fR for the \s-1AVA\s0 separator. It a indents the fields by four characters. .IP "\fBdn_rev\fR" 4 .IX Item "dn_rev" -reverse the fields of the \s-1DN\s0. This is required by \s-1RFC2253\s0. As a side +reverse the fields of the \s-1DN.\s0 This is required by \s-1RFC2253.\s0 As a side effect this also reverses the order of multiple AVAs but this is permissible. .IP "\fBnofname\fR, \fBsname\fR, \fBlname\fR, \fBoid\fR" 4 @@ -584,7 +593,7 @@ align field values for a more readable output. Only usable with .IX Item "space_eq" places spaces round the \fB=\fR character which follows the field name. -.SS "\s-1TEXT\s0 \s-1OPTIONS\s0" +.SS "\s-1TEXT OPTIONS\s0" .IX Subsection "TEXT OPTIONS" As well as customising the name output format, it is also possible to customise the actual fields printed using the \fBcertopt\fR options when @@ -718,7 +727,7 @@ certificate extensions: .Ve .PP Set a certificate to be trusted for \s-1SSL\s0 client use and change set its alias to -\&\*(L"Steve's Class 1 \s-1CA\s0\*(R" +\&\*(L"Steve's Class 1 \s-1CA\*(R"\s0 .PP .Vb 2 \& openssl x509 \-in cert.pem \-addtrust clientAuth \e @@ -757,7 +766,7 @@ This is commonly called a \*(L"fingerprint\*(R". Because of the nature of messag digests the fingerprint of a certificate is unique to that certificate and two certificates with the same fingerprint can be considered to be the same. .PP -The Netscape fingerprint uses \s-1MD5\s0 whereas \s-1MSIE\s0 uses \s-1SHA1\s0. +The Netscape fingerprint uses \s-1MD5\s0 whereas \s-1MSIE\s0 uses \s-1SHA1.\s0 .PP The \fB\-email\fR option searches the subject name and the subject alternative name extension. Only unique email addresses will be printed out: it will @@ -773,12 +782,12 @@ The same code is used when verifying untrusted certificates in chains so this section is useful if a chain is rejected by the verify code. .PP The basicConstraints extension \s-1CA\s0 flag is used to determine whether the -certificate can be used as a \s-1CA\s0. If the \s-1CA\s0 flag is true then it is a \s-1CA\s0, -if the \s-1CA\s0 flag is false then it is not a \s-1CA\s0. \fBAll\fR CAs should have the +certificate can be used as a \s-1CA.\s0 If the \s-1CA\s0 flag is true then it is a \s-1CA,\s0 +if the \s-1CA\s0 flag is false then it is not a \s-1CA. \s0\fBAll\fR CAs should have the \&\s-1CA\s0 flag set to true. .PP If the basicConstraints extension is absent then the certificate is -considered to be a \*(L"possible \s-1CA\s0\*(R" other extensions are checked according +considered to be a \*(L"possible \s-1CA\*(R"\s0 other extensions are checked according to the intended use of the certificate. A warning is given in this case because the certificate should really not be regarded as a \s-1CA:\s0 however it is allowed to be a \s-1CA\s0 to work around some broken software. @@ -802,14 +811,14 @@ basicConstraints and keyUsage and V1 certificates above apply to \fBall\fR .IP "\fB\s-1SSL\s0 Client\fR" 4 .IX Item "SSL Client" The extended key usage extension must be absent or include the \*(L"web client -authentication\*(R" \s-1OID\s0. keyUsage must be absent or it must have the +authentication\*(R" \s-1OID. \s0 keyUsage must be absent or it must have the digitalSignature bit set. Netscape certificate type must be absent or it must have the \s-1SSL\s0 client bit set. .IP "\fB\s-1SSL\s0 Client \s-1CA\s0\fR" 4 .IX Item "SSL Client CA" The extended key usage extension must be absent or include the \*(L"web client -authentication\*(R" \s-1OID\s0. Netscape certificate type must be absent or it must have -the \s-1SSL\s0 \s-1CA\s0 bit set: this is used as a work around if the basicConstraints +authentication\*(R" \s-1OID.\s0 Netscape certificate type must be absent or it must have +the \s-1SSL CA\s0 bit set: this is used as a work around if the basicConstraints extension is absent. .IP "\fB\s-1SSL\s0 Server\fR" 4 .IX Item "SSL Server" @@ -821,7 +830,7 @@ Netscape certificate type must be absent or have the \s-1SSL\s0 server bit set. .IX Item "SSL Server CA" The extended key usage extension must be absent or include the \*(L"web server authentication\*(R" and/or one of the \s-1SGC\s0 OIDs. Netscape certificate type must -be absent or the \s-1SSL\s0 \s-1CA\s0 bit must be set: this is used as a work around if the +be absent or the \s-1SSL CA\s0 bit must be set: this is used as a work around if the basicConstraints extension is absent. .IP "\fBNetscape \s-1SSL\s0 Server\fR" 4 .IX Item "Netscape SSL Server" @@ -832,7 +841,7 @@ Otherwise it is the same as a normal \s-1SSL\s0 server. .IP "\fBCommon S/MIME Client Tests\fR" 4 .IX Item "Common S/MIME Client Tests" The extended key usage extension must be absent or include the \*(L"email -protection\*(R" \s-1OID\s0. Netscape certificate type must be absent or should have the +protection\*(R" \s-1OID.\s0 Netscape certificate type must be absent or should have the S/MIME bit set. If the S/MIME bit is not set in netscape certificate type then the \s-1SSL\s0 client bit is tolerated as an alternative but a warning is shown: this is because some Verisign certificates don't set the S/MIME bit. @@ -847,7 +856,7 @@ if the keyUsage extension is present. .IP "\fBS/MIME \s-1CA\s0\fR" 4 .IX Item "S/MIME CA" The extended key usage extension must be absent or include the \*(L"email -protection\*(R" \s-1OID\s0. Netscape certificate type must be absent or must have the +protection\*(R" \s-1OID.\s0 Netscape certificate type must be absent or must have the S/MIME \s-1CA\s0 bit set: this is used as a work around if the basicConstraints extension is absent. .IP "\fB\s-1CRL\s0 Signing\fR" 4 @@ -870,7 +879,7 @@ be checked. There should be options to explicitly set such things as start and end dates rather than an offset from the current time. .PP -The code to implement the verify behaviour described in the \fB\s-1TRUST\s0 \s-1SETTINGS\s0\fR +The code to implement the verify behaviour described in the \fB\s-1TRUST SETTINGS\s0\fR is currently being developed. It thus describes the intended behaviour rather than the current behaviour. It is hoped that it will represent reality in OpenSSL 0.9.5 and later. @@ -881,10 +890,10 @@ OpenSSL 0.9.5 and later. \&\fIx509v3_config\fR\|(5) .SH "HISTORY" .IX Header "HISTORY" -Before OpenSSL 0.9.8, the default digest for \s-1RSA\s0 keys was \s-1MD5\s0. +Before OpenSSL 0.9.8, the default digest for \s-1RSA\s0 keys was \s-1MD5.\s0 .PP The hash algorithm used in the \fB\-subject_hash\fR and \fB\-issuer_hash\fR options before OpenSSL 1.0.0 was based on the deprecated \s-1MD5\s0 algorithm and the encoding of the distinguished name. In OpenSSL 1.0.0 and later it is based on a -canonical version of the \s-1DN\s0 using \s-1SHA1\s0. This means that any directories using +canonical version of the \s-1DN\s0 using \s-1SHA1.\s0 This means that any directories using the old form must have their links rebuilt using \fBc_rehash\fR or similar. |
