849 lines
33 KiB
Groff
Executable File
849 lines
33 KiB
Groff
Executable File
.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
|
|
.\"
|
|
.\" Standard preamble:
|
|
.\" ========================================================================
|
|
.de Sp \" Vertical space (when we can't use .PP)
|
|
.if t .sp .5v
|
|
.if n .sp
|
|
..
|
|
.de Vb \" Begin verbatim text
|
|
.ft CW
|
|
.nf
|
|
.ne \\$1
|
|
..
|
|
.de Ve \" End verbatim text
|
|
.ft R
|
|
.fi
|
|
..
|
|
.\" Set up some character translations and predefined strings. \*(-- will
|
|
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
|
|
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
|
|
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
|
|
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
|
|
.\" nothing in troff, for use with C<>.
|
|
.tr \(*W-
|
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
|
.ie n \{\
|
|
. ds -- \(*W-
|
|
. ds PI pi
|
|
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
|
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
|
. ds L" ""
|
|
. ds R" ""
|
|
. ds C` ""
|
|
. ds C' ""
|
|
'br\}
|
|
.el\{\
|
|
. ds -- \|\(em\|
|
|
. ds PI \(*p
|
|
. ds L" ``
|
|
. ds R" ''
|
|
'br\}
|
|
.\"
|
|
.\" Escape single quotes in literal strings from groff's Unicode transform.
|
|
.ie \n(.g .ds Aq \(aq
|
|
.el .ds Aq '
|
|
.\"
|
|
.\" If the F register is turned on, we'll generate index entries on stderr for
|
|
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
|
|
.\" entries marked with X<> in POD. Of course, you'll have to process the
|
|
.\" output yourself in some meaningful fashion.
|
|
.ie \nF \{\
|
|
. de IX
|
|
. tm Index:\\$1\t\\n%\t"\\$2"
|
|
..
|
|
. nr % 0
|
|
. rr F
|
|
.\}
|
|
.el \{\
|
|
. de IX
|
|
..
|
|
.\}
|
|
.\"
|
|
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
|
|
.\" Fear. Run. Save yourself. No user-serviceable parts.
|
|
. \" fudge factors for nroff and troff
|
|
.if n \{\
|
|
. ds #H 0
|
|
. ds #V .8m
|
|
. ds #F .3m
|
|
. ds #[ \f1
|
|
. ds #] \fP
|
|
.\}
|
|
.if t \{\
|
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
|
. ds #V .6m
|
|
. ds #F 0
|
|
. ds #[ \&
|
|
. ds #] \&
|
|
.\}
|
|
. \" simple accents for nroff and troff
|
|
.if n \{\
|
|
. ds ' \&
|
|
. ds ` \&
|
|
. ds ^ \&
|
|
. ds , \&
|
|
. ds ~ ~
|
|
. ds /
|
|
.\}
|
|
.if t \{\
|
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
|
.\}
|
|
. \" troff and (daisy-wheel) nroff accents
|
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
|
. \" corrections for vroff
|
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
|
. \" for low resolution devices (crt and lpr)
|
|
.if \n(.H>23 .if \n(.V>19 \
|
|
\{\
|
|
. ds : e
|
|
. ds 8 ss
|
|
. ds o a
|
|
. ds d- d\h'-1'\(ga
|
|
. ds D- D\h'-1'\(hy
|
|
. ds th \o'bp'
|
|
. ds Th \o'LP'
|
|
. ds ae ae
|
|
. ds Ae AE
|
|
.\}
|
|
.rm #[ #] #H #V #F C
|
|
.\" ========================================================================
|
|
.\"
|
|
.IX Title "OPENSSL-X509 1"
|
|
.TH OPENSSL-X509 1 "2020-03-02" "3.0.0-dev" "OpenSSL"
|
|
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
|
|
.\" way too many mistakes in technical documents.
|
|
.if n .ad l
|
|
.nh
|
|
.SH "NAME"
|
|
openssl\-x509 \- Certificate display and signing utility
|
|
.SH "SYNOPSIS"
|
|
.IX Header "SYNOPSIS"
|
|
\&\fBopenssl\fR \fBx509\fR
|
|
[\fB\-help\fR]
|
|
[\fB\-inform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR]
|
|
[\fB\-outform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR]
|
|
[\fB\-keyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fB\s-1ENGINE\s0\fR]
|
|
[\fB\-CAform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR]
|
|
[\fB\-CAkeyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fB\s-1ENGINE\s0\fR]
|
|
[\fB\-in\fR \fIfilename\fR]
|
|
[\fB\-out\fR \fIfilename\fR]
|
|
[\fB\-serial\fR]
|
|
[\fB\-hash\fR]
|
|
[\fB\-subject_hash\fR]
|
|
[\fB\-subject_hash_old\fR]
|
|
[\fB\-issuer_hash\fR]
|
|
[\fB\-issuer_hash_old\fR]
|
|
[\fB\-ocspid\fR]
|
|
[\fB\-subject\fR]
|
|
[\fB\-issuer\fR]
|
|
[\fB\-email\fR]
|
|
[\fB\-ocsp_uri\fR]
|
|
[\fB\-startdate\fR]
|
|
[\fB\-enddate\fR]
|
|
[\fB\-purpose\fR]
|
|
[\fB\-dates\fR]
|
|
[\fB\-checkend\fR \fInum\fR]
|
|
[\fB\-modulus\fR]
|
|
[\fB\-pubkey\fR]
|
|
[\fB\-fingerprint\fR]
|
|
[\fB\-alias\fR]
|
|
[\fB\-noout\fR]
|
|
[\fB\-trustout\fR]
|
|
[\fB\-clrtrust\fR]
|
|
[\fB\-clrreject\fR]
|
|
[\fB\-addtrust\fR \fIarg\fR]
|
|
[\fB\-addreject\fR \fIarg\fR]
|
|
[\fB\-setalias\fR \fIarg\fR]
|
|
[\fB\-days\fR \fIarg\fR]
|
|
[\fB\-set_serial\fR \fIn\fR]
|
|
[\fB\-signkey\fR \fIarg\fR]
|
|
[\fB\-badsig\fR]
|
|
[\fB\-passin\fR \fIarg\fR]
|
|
[\fB\-x509toreq\fR]
|
|
[\fB\-req\fR]
|
|
[\fB\-CA\fR \fIfilename\fR]
|
|
[\fB\-CAkey\fR \fIfilename\fR]
|
|
[\fB\-CAcreateserial\fR]
|
|
[\fB\-CAserial\fR \fIfilename\fR]
|
|
[\fB\-new\fR]
|
|
[\fB\-next_serial\fR]
|
|
[\fB\-nocert\fR]
|
|
[\fB\-force_pubkey\fR \fIfilename\fR]
|
|
[\fB\-subj\fR \fIarg\fR]
|
|
[\fB\-text\fR]
|
|
[\fB\-ext\fR \fIextensions\fR]
|
|
[\fB\-certopt\fR \fIoption\fR]
|
|
[\fB\-checkhost\fR \fIhost\fR]
|
|
[\fB\-checkemail\fR \fIhost\fR]
|
|
[\fB\-checkip\fR \fIipaddr\fR]
|
|
[\fB\-C\fR]
|
|
[\fB\-\f(BIdigest\fB\fR]
|
|
[\fB\-clrext\fR]
|
|
[\fB\-extfile\fR \fIfilename\fR]
|
|
[\fB\-extensions\fR \fIsection\fR]
|
|
[\fB\-sigopt\fR \fInm\fR:\fIv\fR]
|
|
[\fB\-preserve_dates\fR]
|
|
[\fB\-nameopt\fR \fIoption\fR]
|
|
[\fB\-rand\fR \fIfiles\fR]
|
|
[\fB\-writerand\fR \fIfile\fR]
|
|
[\fB\-engine\fR \fIid\fR]
|
|
.SH "DESCRIPTION"
|
|
.IX Header "DESCRIPTION"
|
|
This command is a multi purpose certificate utility. It can
|
|
be used to display certificate information, convert certificates to
|
|
various forms, sign certificate requests like a \*(L"mini \s-1CA\s0\*(R" or edit
|
|
certificate trust settings.
|
|
.PP
|
|
Since there are a large number of options they will split up into
|
|
various sections.
|
|
.SH "OPTIONS"
|
|
.IX Header "OPTIONS"
|
|
.SS "Input, Output, and General Purpose Options"
|
|
.IX Subsection "Input, Output, and General Purpose Options"
|
|
.IP "\fB\-help\fR" 4
|
|
.IX Item "-help"
|
|
Print out a usage message.
|
|
.IP "\fB\-inform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR, \fB\-outform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR" 4
|
|
.IX Item "-inform DER|PEM, -outform DER|PEM"
|
|
The input and formats; the default is \fB\s-1PEM\s0\fR.
|
|
See \*(L"Format Options\*(R" in \fIopenssl\fR\|(1) for details.
|
|
.Sp
|
|
The input is normally an X.509 certificate, but this can change if other
|
|
options such as \fB\-req\fR are used.
|
|
.IP "\fB\-in\fR \fIfilename\fR" 4
|
|
.IX Item "-in filename"
|
|
This specifies the input filename to read a certificate from or standard input
|
|
if this option is not specified.
|
|
.IP "\fB\-out\fR \fIfilename\fR" 4
|
|
.IX Item "-out filename"
|
|
This specifies the output filename to write to or standard output by
|
|
default.
|
|
.IP "\fB\-\f(BIdigest\fB\fR" 4
|
|
.IX Item "-digest"
|
|
The digest to use.
|
|
This affects any signing or display option that uses a message
|
|
digest, such as the \fB\-fingerprint\fR, \fB\-signkey\fR and \fB\-CA\fR options.
|
|
Any digest supported by the \fIopenssl\-dgst\fR\|(1) command can be used.
|
|
If not specified then \s-1SHA1\s0 is used with \fB\-fingerprint\fR or
|
|
the default digest for the signing algorithm is used, typically \s-1SHA256\s0.
|
|
.IP "\fB\-preserve_dates\fR" 4
|
|
.IX Item "-preserve_dates"
|
|
When signing a certificate, preserve the \*(L"notBefore\*(R" and \*(L"notAfter\*(R" dates
|
|
instead of adjusting them to current time and duration.
|
|
Cannot be used with the \fB\-days\fR option.
|
|
.Sp
|
|
[\fB\-rand\fR \fIfiles\fR]
|
|
[\fB\-writerand\fR \fIfile\fR]
|
|
.IP "\fB\-engine\fR \fIid\fR" 4
|
|
.IX Item "-engine id"
|
|
See \*(L"Engine Options\*(R" in \fIopenssl\fR\|(1).
|
|
.SS "Display Options"
|
|
.IX Subsection "Display Options"
|
|
Note: the \fB\-alias\fR and \fB\-purpose\fR options are also display options
|
|
but are described in the \*(L"Trust Settings\*(R" section.
|
|
.IP "\fB\-text\fR" 4
|
|
.IX Item "-text"
|
|
Prints out the certificate in text form. Full details are output including the
|
|
public key, signature algorithms, issuer and subject names, serial number
|
|
any extensions present and any trust settings.
|
|
.IP "\fB\-ext\fR \fIextensions\fR" 4
|
|
.IX Item "-ext extensions"
|
|
Prints out the certificate extensions in text form. Extensions are specified
|
|
with a comma separated string, e.g., \*(L"subjectAltName,subjectKeyIdentifier\*(R".
|
|
See the \fIx509v3_config\fR\|(5) manual page for the extension names.
|
|
.IP "\fB\-certopt\fR \fIoption\fR" 4
|
|
.IX Item "-certopt option"
|
|
Customise the output format used with \fB\-text\fR. The \fIoption\fR argument
|
|
can be a single option or multiple options separated by commas. The
|
|
\&\fB\-certopt\fR switch may be also be used more than once to set multiple
|
|
options. See the \*(L"Text Options\*(R" section for more information.
|
|
.IP "\fB\-checkhost\fR \fIhost\fR" 4
|
|
.IX Item "-checkhost host"
|
|
Check that the certificate matches the specified host.
|
|
.IP "\fB\-checkemail\fR \fIemail\fR" 4
|
|
.IX Item "-checkemail email"
|
|
Check that the certificate matches the specified email address.
|
|
.IP "\fB\-checkip\fR \fIipaddr\fR" 4
|
|
.IX Item "-checkip ipaddr"
|
|
Check that the certificate matches the specified \s-1IP\s0 address.
|
|
.IP "\fB\-noout\fR" 4
|
|
.IX Item "-noout"
|
|
This option prevents output of the encoded version of the certificate.
|
|
.IP "\fB\-pubkey\fR" 4
|
|
.IX Item "-pubkey"
|
|
Outputs the certificate's SubjectPublicKeyInfo block in \s-1PEM\s0 format.
|
|
.IP "\fB\-modulus\fR" 4
|
|
.IX Item "-modulus"
|
|
This option prints out the value of the modulus of the public key
|
|
contained in the certificate.
|
|
.IP "\fB\-serial\fR" 4
|
|
.IX Item "-serial"
|
|
Outputs the certificate serial number.
|
|
.IP "\fB\-subject_hash\fR" 4
|
|
.IX Item "-subject_hash"
|
|
Outputs the \*(L"hash\*(R" of the certificate subject name. This is used in OpenSSL to
|
|
form an index to allow certificates in a directory to be looked up by subject
|
|
name.
|
|
.IP "\fB\-issuer_hash\fR" 4
|
|
.IX Item "-issuer_hash"
|
|
Outputs the \*(L"hash\*(R" of the certificate issuer name.
|
|
.IP "\fB\-ocspid\fR" 4
|
|
.IX Item "-ocspid"
|
|
Outputs the \s-1OCSP\s0 hash values for the subject name and public key.
|
|
.IP "\fB\-hash\fR" 4
|
|
.IX Item "-hash"
|
|
Synonym for \*(L"\-subject_hash\*(R" for backward compatibility reasons.
|
|
.IP "\fB\-subject_hash_old\fR" 4
|
|
.IX Item "-subject_hash_old"
|
|
Outputs the \*(L"hash\*(R" of the certificate subject name using the older algorithm
|
|
as used by OpenSSL before version 1.0.0.
|
|
.IP "\fB\-issuer_hash_old\fR" 4
|
|
.IX Item "-issuer_hash_old"
|
|
Outputs the \*(L"hash\*(R" of the certificate issuer name using the older algorithm
|
|
as used by OpenSSL before version 1.0.0.
|
|
.IP "\fB\-subject\fR" 4
|
|
.IX Item "-subject"
|
|
Outputs the subject name.
|
|
.IP "\fB\-issuer\fR" 4
|
|
.IX Item "-issuer"
|
|
Outputs the issuer name.
|
|
.IP "\fB\-nameopt\fR \fIoption\fR" 4
|
|
.IX Item "-nameopt option"
|
|
This specifies how the subject or issuer names are displayed.
|
|
See \*(L"Name Format Options\*(R" in \fIopenssl\fR\|(1) for details.
|
|
.IP "\fB\-email\fR" 4
|
|
.IX Item "-email"
|
|
Outputs the email address(es) if any.
|
|
.IP "\fB\-ocsp_uri\fR" 4
|
|
.IX Item "-ocsp_uri"
|
|
Outputs the \s-1OCSP\s0 responder address(es) if any.
|
|
.IP "\fB\-startdate\fR" 4
|
|
.IX Item "-startdate"
|
|
Prints out the start date of the certificate, that is the notBefore date.
|
|
.IP "\fB\-enddate\fR" 4
|
|
.IX Item "-enddate"
|
|
Prints out the expiry date of the certificate, that is the notAfter date.
|
|
.IP "\fB\-dates\fR" 4
|
|
.IX Item "-dates"
|
|
Prints out the start and expiry dates of a certificate.
|
|
.IP "\fB\-checkend\fR \fIarg\fR" 4
|
|
.IX Item "-checkend arg"
|
|
Checks if the certificate expires within the next \fIarg\fR seconds and exits
|
|
nonzero if yes it will expire or zero if not.
|
|
.IP "\fB\-fingerprint\fR" 4
|
|
.IX Item "-fingerprint"
|
|
Calculates and outputs the digest of the \s-1DER\s0 encoded version of the entire
|
|
certificate (see digest options).
|
|
This is commonly called a \*(L"fingerprint\*(R". Because of the nature of message
|
|
digests, the fingerprint of a certificate is unique to that certificate and
|
|
two certificates with the same fingerprint can be considered to be the same.
|
|
.IP "\fB\-C\fR" 4
|
|
.IX Item "-C"
|
|
This outputs the certificate in the form of a C source file.
|
|
.SS "Trust Settings"
|
|
.IX Subsection "Trust Settings"
|
|
A \fBtrusted certificate\fR is an ordinary certificate which has several
|
|
additional pieces of information attached to it such as the permitted
|
|
and prohibited uses of the certificate and an \*(L"alias\*(R".
|
|
.PP
|
|
Normally when a certificate is being verified at least one certificate
|
|
must be \*(L"trusted\*(R". By default a trusted certificate must be stored
|
|
locally and must be a root \s-1CA:\s0 any certificate chain ending in this \s-1CA\s0
|
|
is then usable for any purpose.
|
|
.PP
|
|
Trust settings currently are only used with a root \s-1CA\s0. They allow a finer
|
|
control over the purposes the root \s-1CA\s0 can be used for. For example a \s-1CA\s0
|
|
may be trusted for \s-1SSL\s0 client but not \s-1SSL\s0 server use.
|
|
.PP
|
|
See the description in \fIopenssl\-verify\fR\|(1) for more information
|
|
on the meaning of trust settings.
|
|
.PP
|
|
Future versions of OpenSSL will recognize trust settings on any
|
|
certificate: not just root CAs.
|
|
.IP "\fB\-trustout\fR" 4
|
|
.IX Item "-trustout"
|
|
Output a \fBtrusted\fR certificate rather than an ordinary. An ordinary
|
|
or trusted certificate can be input but by default an ordinary
|
|
certificate is output and any trust settings are discarded. With the
|
|
\&\fB\-trustout\fR option a trusted certificate is output. A trusted
|
|
certificate is automatically output if any trust settings are modified.
|
|
.IP "\fB\-setalias\fR \fIarg\fR" 4
|
|
.IX Item "-setalias arg"
|
|
Sets the alias of the certificate. This will allow the certificate
|
|
to be referred to using a nickname for example \*(L"Steve's Certificate\*(R".
|
|
.IP "\fB\-alias\fR" 4
|
|
.IX Item "-alias"
|
|
Outputs the certificate alias, if any.
|
|
.IP "\fB\-clrtrust\fR" 4
|
|
.IX Item "-clrtrust"
|
|
Clears all the permitted or trusted uses of the certificate.
|
|
.IP "\fB\-clrreject\fR" 4
|
|
.IX Item "-clrreject"
|
|
Clears all the prohibited or rejected uses of the certificate.
|
|
.IP "\fB\-addtrust\fR \fIarg\fR" 4
|
|
.IX Item "-addtrust arg"
|
|
Adds a trusted certificate use.
|
|
Any object name can be used here but currently only \fBclientAuth\fR (\s-1SSL\s0 client
|
|
use), \fBserverAuth\fR (\s-1SSL\s0 server use), \fBemailProtection\fR (S/MIME email) and
|
|
\&\fBanyExtendedKeyUsage\fR are used.
|
|
As of OpenSSL 1.1.0, the last of these blocks all purposes when rejected or
|
|
enables all purposes when trusted.
|
|
Other OpenSSL applications may define additional uses.
|
|
.IP "\fB\-addreject\fR \fIarg\fR" 4
|
|
.IX Item "-addreject arg"
|
|
Adds a prohibited use. It accepts the same values as the \fB\-addtrust\fR
|
|
option.
|
|
.IP "\fB\-purpose\fR" 4
|
|
.IX Item "-purpose"
|
|
This option performs tests on the certificate extensions and outputs
|
|
the results. For a more complete description see the
|
|
\&\*(L"\s-1CERTIFICATE\s0 \s-1EXTENSIONS\s0\*(R" section.
|
|
.SS "Signing Options"
|
|
.IX Subsection "Signing Options"
|
|
This command can be used to sign certificates and requests: it
|
|
can thus behave like a \*(L"mini \s-1CA\s0\*(R".
|
|
.IP "\fB\-signkey\fR \fIarg\fR" 4
|
|
.IX Item "-signkey arg"
|
|
This option causes the input file to be self signed using the supplied
|
|
private key or engine. The private key's format is specified with the
|
|
\&\fB\-keyform\fR option.
|
|
.Sp
|
|
It sets the issuer name to the subject name (i.e., makes it self-issued)
|
|
and changes the public key to the supplied value (unless overridden by
|
|
\&\fB\-force_pubkey\fR). It sets the validity start date to the current time
|
|
and the end date to a value determined by the \fB\-days\fR option.
|
|
It retains any certificate extensions unless the \fB\-clrext\fR option is supplied;
|
|
this includes, for example, any existing key identifier extensions.
|
|
.IP "\fB\-badsig\fR" 4
|
|
.IX Item "-badsig"
|
|
Corrupt the signature before writing it; this can be useful
|
|
for testing.
|
|
.IP "\fB\-sigopt\fR \fInm\fR:\fIv\fR" 4
|
|
.IX Item "-sigopt nm:v"
|
|
Pass options to the signature algorithm during sign or verify operations.
|
|
Names and values of these options are algorithm-specific.
|
|
.IP "\fB\-passin\fR \fIarg\fR" 4
|
|
.IX Item "-passin arg"
|
|
The key password source. For more information about the format of \fIarg\fR
|
|
see \*(L"Pass Phrase Options\*(R" in \fIopenssl\fR\|(1).
|
|
.IP "\fB\-clrext\fR" 4
|
|
.IX Item "-clrext"
|
|
Delete any extensions from a certificate. This option is used when a
|
|
certificate is being created from another certificate (for example with
|
|
the \fB\-signkey\fR or the \fB\-CA\fR options). Normally all extensions are
|
|
retained.
|
|
.IP "\fB\-keyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fB\s-1ENGINE\s0\fR" 4
|
|
.IX Item "-keyform DER|PEM|ENGINE"
|
|
The key format; the default is \fB\s-1PEM\s0\fR.
|
|
See \*(L"Format Options\*(R" in \fIopenssl\fR\|(1) for details.
|
|
.IP "\fB\-CAform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR, \fB\-CAkeyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fB\s-1ENGINE\s0\fR" 4
|
|
.IX Item "-CAform DER|PEM, -CAkeyform DER|PEM|ENGINE"
|
|
The format for the \s-1CA\s0 certificate and key; the default is \fB\s-1PEM\s0\fR.
|
|
See \*(L"Format Options\*(R" in \fIopenssl\fR\|(1) for details.
|
|
.IP "\fB\-days\fR \fIarg\fR" 4
|
|
.IX Item "-days arg"
|
|
Specifies the number of days to make a certificate valid for. The default
|
|
is 30 days. Cannot be used with the \fB\-preserve_dates\fR option.
|
|
.IP "\fB\-x509toreq\fR" 4
|
|
.IX Item "-x509toreq"
|
|
Converts a certificate into a certificate request. The \fB\-signkey\fR option
|
|
is used to pass the required private key.
|
|
.IP "\fB\-req\fR" 4
|
|
.IX Item "-req"
|
|
By default a certificate is expected on input. With this option a
|
|
certificate request is expected instead.
|
|
.IP "\fB\-set_serial\fR \fIn\fR" 4
|
|
.IX Item "-set_serial n"
|
|
Specifies the serial number to use. This option can be used with either
|
|
the \fB\-signkey\fR or \fB\-CA\fR options. If used in conjunction with the \fB\-CA\fR
|
|
option the serial number file (as specified by the \fB\-CAserial\fR or
|
|
\&\fB\-CAcreateserial\fR options) is not used.
|
|
.Sp
|
|
The serial number can be decimal or hex (if preceded by \f(CW\*(C`0x\*(C'\fR).
|
|
.IP "\fB\-CA\fR \fIfilename\fR" 4
|
|
.IX Item "-CA filename"
|
|
Specifies the \s-1CA\s0 certificate to be used for signing. When this option is
|
|
present, this command behaves like a \*(L"mini \s-1CA\s0\*(R". The input file is signed by
|
|
this \s-1CA\s0 using this option: that is its issuer name is set to the subject name
|
|
of the \s-1CA\s0 and it is digitally signed using the CAs private key.
|
|
.Sp
|
|
This option is normally combined with the \fB\-req\fR option. Without the
|
|
\&\fB\-req\fR option the input is a certificate which must be self signed.
|
|
.IP "\fB\-CAkey\fR \fIfilename\fR" 4
|
|
.IX Item "-CAkey filename"
|
|
Sets the \s-1CA\s0 private key to sign a certificate with. If this option is
|
|
not specified then it is assumed that the \s-1CA\s0 private key is present in
|
|
the \s-1CA\s0 certificate file.
|
|
.IP "\fB\-CAserial\fR \fIfilename\fR" 4
|
|
.IX Item "-CAserial filename"
|
|
Sets the \s-1CA\s0 serial number file to use.
|
|
.Sp
|
|
When the \fB\-CA\fR option is used to sign a certificate it uses a serial
|
|
number specified in a file. This file consists of one line containing
|
|
an even number of hex digits with the serial number to use. After each
|
|
use the serial number is incremented and written out to the file again.
|
|
.Sp
|
|
The default filename consists of the \s-1CA\s0 certificate file base name with
|
|
\&\fI.srl\fR appended. For example if the \s-1CA\s0 certificate file is called
|
|
\&\fImycacert.pem\fR it expects to find a serial number file called
|
|
\&\fImycacert.srl\fR.
|
|
.IP "\fB\-CAcreateserial\fR" 4
|
|
.IX Item "-CAcreateserial"
|
|
With this option the \s-1CA\s0 serial number file is created if it does not exist:
|
|
it will contain the serial number \*(L"02\*(R" and the certificate being signed will
|
|
have the 1 as its serial number. If the \fB\-CA\fR option is specified
|
|
and the serial number file does not exist a random number is generated;
|
|
this is the recommended practice.
|
|
.IP "\fB\-extfile\fR \fIfilename\fR" 4
|
|
.IX Item "-extfile filename"
|
|
File containing certificate extensions to use. If not specified then
|
|
no extensions are added to the certificate.
|
|
.IP "\fB\-extensions\fR \fIsection\fR" 4
|
|
.IX Item "-extensions section"
|
|
The section to add certificate extensions from. If this option is not
|
|
specified then the extensions should either be contained in the unnamed
|
|
(default) section or the default section should contain a variable called
|
|
\&\*(L"extensions\*(R" which contains the section to use. See the
|
|
\&\fIx509v3_config\fR\|(5) manual page for details of the
|
|
extension section format.
|
|
.IP "\fB\-new\fR" 4
|
|
.IX Item "-new"
|
|
Generate a certificate from scratch, not using an input certificate
|
|
or certificate request. So the \fB\-in\fR option must not be used in this case.
|
|
Instead, the \fB\-subj\fR and <\-force_pubkey> options need to be given.
|
|
.IP "\fB\-next_serial\fR" 4
|
|
.IX Item "-next_serial"
|
|
Set the serial to be one more than the number in the certificate.
|
|
.IP "\fB\-nocert\fR" 4
|
|
.IX Item "-nocert"
|
|
Do not generate or output a certificate.
|
|
.IP "\fB\-force_pubkey\fR \fIfilename\fR" 4
|
|
.IX Item "-force_pubkey filename"
|
|
When a certificate is created set its public key to the key in \fIfilename\fR
|
|
instead of the key contained in the input or given with the \fB\-signkey\fR option.
|
|
.Sp
|
|
This option is useful for creating self-issued certificates that are not
|
|
self-signed, for instance when the key cannot be used for signing, such as \s-1DH\s0.
|
|
It can also be used in conjunction with b<\-new> and \fB\-subj\fR to directly
|
|
generate a certificate containing any desired public key.
|
|
.Sp
|
|
The format of the key file can be specified using the \fB\-keyform\fR option.
|
|
.IP "\fB\-subj\fR \fIarg\fR" 4
|
|
.IX Item "-subj arg"
|
|
When a certificate is created set its subject name to the given value.
|
|
The arg must be formatted as \f(CW\*(C`/type0=value0/type1=value1/type2=...\*(C'\fR.
|
|
Keyword characters may be escaped by \e (backslash), and whitespace is retained.
|
|
Empty values are permitted, but the corresponding type will not be included
|
|
in the certificate. Giving a single \f(CW\*(C`/\*(C'\fR will lead to an empty sequence of RDNs
|
|
(a \s-1NULL\s0 subject \s-1DN\s0).
|
|
.Sp
|
|
Unless the \fB\-CA\fR option is given the issuer is set to the same value.
|
|
.Sp
|
|
This option can be used in conjunction with the \fB\-force_pubkey\fR option
|
|
to create a certificate even without providing an input certificate
|
|
or certificate request.
|
|
.SS "Text Options"
|
|
.IX Subsection "Text Options"
|
|
As well as customising the name output format, it is also possible to
|
|
customise the actual fields printed using the \fBcertopt\fR options when
|
|
the \fBtext\fR option is present. The default behaviour is to print all fields.
|
|
.IP "\fBcompatible\fR" 4
|
|
.IX Item "compatible"
|
|
Use the old format. This is equivalent to specifying no output options at all.
|
|
.IP "\fBno_header\fR" 4
|
|
.IX Item "no_header"
|
|
Don't print header information: that is the lines saying \*(L"Certificate\*(R"
|
|
and \*(L"Data\*(R".
|
|
.IP "\fBno_version\fR" 4
|
|
.IX Item "no_version"
|
|
Don't print out the version number.
|
|
.IP "\fBno_serial\fR" 4
|
|
.IX Item "no_serial"
|
|
Don't print out the serial number.
|
|
.IP "\fBno_signame\fR" 4
|
|
.IX Item "no_signame"
|
|
Don't print out the signature algorithm used.
|
|
.IP "\fBno_validity\fR" 4
|
|
.IX Item "no_validity"
|
|
Don't print the validity, that is the \fBnotBefore\fR and \fBnotAfter\fR fields.
|
|
.IP "\fBno_subject\fR" 4
|
|
.IX Item "no_subject"
|
|
Don't print out the subject name.
|
|
.IP "\fBno_issuer\fR" 4
|
|
.IX Item "no_issuer"
|
|
Don't print out the issuer name.
|
|
.IP "\fBno_pubkey\fR" 4
|
|
.IX Item "no_pubkey"
|
|
Don't print out the public key.
|
|
.IP "\fBno_sigdump\fR" 4
|
|
.IX Item "no_sigdump"
|
|
Don't give a hexadecimal dump of the certificate signature.
|
|
.IP "\fBno_aux\fR" 4
|
|
.IX Item "no_aux"
|
|
Don't print out certificate trust information.
|
|
.IP "\fBno_extensions\fR" 4
|
|
.IX Item "no_extensions"
|
|
Don't print out any X509V3 extensions.
|
|
.IP "\fBext_default\fR" 4
|
|
.IX Item "ext_default"
|
|
Retain default extension behaviour: attempt to print out unsupported
|
|
certificate extensions.
|
|
.IP "\fBext_error\fR" 4
|
|
.IX Item "ext_error"
|
|
Print an error message for unsupported certificate extensions.
|
|
.IP "\fBext_parse\fR" 4
|
|
.IX Item "ext_parse"
|
|
\&\s-1ASN1\s0 parse unsupported extensions.
|
|
.IP "\fBext_dump\fR" 4
|
|
.IX Item "ext_dump"
|
|
Hex dump unsupported extensions.
|
|
.IP "\fBca_default\fR" 4
|
|
.IX Item "ca_default"
|
|
The value used by \fIopenssl\-ca\fR\|(1), equivalent to \fBno_issuer\fR, \fBno_pubkey\fR,
|
|
\&\fBno_header\fR, and \fBno_version\fR.
|
|
.SH "EXAMPLES"
|
|
.IX Header "EXAMPLES"
|
|
Note: in these examples the '\e' means the example should be all on one
|
|
line.
|
|
.PP
|
|
Display the contents of a certificate:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-noout \-text
|
|
.Ve
|
|
.PP
|
|
Display the \*(L"Subject Alternative Name\*(R" extension of a certificate:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-noout \-ext subjectAltName
|
|
.Ve
|
|
.PP
|
|
Display more extensions of a certificate:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-noout \-ext subjectAltName,nsCertType
|
|
.Ve
|
|
.PP
|
|
Display the certificate serial number:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-noout \-serial
|
|
.Ve
|
|
.PP
|
|
Display the certificate subject name:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-noout \-subject
|
|
.Ve
|
|
.PP
|
|
Display the certificate subject name in \s-1RFC2253\s0 form:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-noout \-subject \-nameopt RFC2253
|
|
.Ve
|
|
.PP
|
|
Display the certificate subject name in oneline form on a terminal
|
|
supporting \s-1UTF8:\s0
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-noout \-subject \-nameopt oneline,\-esc_msb
|
|
.Ve
|
|
.PP
|
|
Display the certificate \s-1SHA1\s0 fingerprint:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-sha1 \-in cert.pem \-noout \-fingerprint
|
|
.Ve
|
|
.PP
|
|
Convert a certificate from \s-1PEM\s0 to \s-1DER\s0 format:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-in cert.pem \-inform PEM \-out cert.der \-outform DER
|
|
.Ve
|
|
.PP
|
|
Convert a certificate to a certificate request:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl x509 \-x509toreq \-in cert.pem \-out req.pem \-signkey key.pem
|
|
.Ve
|
|
.PP
|
|
Convert a certificate request into a self signed certificate using
|
|
extensions for a \s-1CA:\s0
|
|
.PP
|
|
.Vb 2
|
|
\& openssl x509 \-req \-in careq.pem \-extfile openssl.cnf \-extensions v3_ca \e
|
|
\& \-signkey key.pem \-out cacert.pem
|
|
.Ve
|
|
.PP
|
|
Sign a certificate request using the \s-1CA\s0 certificate above and add user
|
|
certificate extensions:
|
|
.PP
|
|
.Vb 2
|
|
\& openssl x509 \-req \-in req.pem \-extfile openssl.cnf \-extensions v3_usr \e
|
|
\& \-CA cacert.pem \-CAkey key.pem \-CAcreateserial
|
|
.Ve
|
|
.PP
|
|
Set a certificate to be trusted for \s-1SSL\s0 client use and change set its alias to
|
|
\&\*(L"Steve's Class 1 \s-1CA\s0\*(R"
|
|
.PP
|
|
.Vb 2
|
|
\& openssl x509 \-in cert.pem \-addtrust clientAuth \e
|
|
\& \-setalias "Steve\*(Aqs Class 1 CA" \-out trust.pem
|
|
.Ve
|
|
.SH "NOTES"
|
|
.IX Header "NOTES"
|
|
The conversion to \s-1UTF8\s0 format used with the name options assumes that
|
|
T61Strings use the \s-1ISO8859\-1\s0 character set. This is wrong but Netscape
|
|
and \s-1MSIE\s0 do this as do many certificates. So although this is incorrect
|
|
it is more likely to display the majority of certificates correctly.
|
|
.PP
|
|
The \fB\-email\fR option searches the subject name and the subject alternative
|
|
name extension. Only unique email addresses will be printed out: it will
|
|
not print the same address more than once.
|
|
.SH "CERTIFICATE EXTENSIONS"
|
|
.IX Header "CERTIFICATE EXTENSIONS"
|
|
The \fB\-purpose\fR option checks the certificate extensions and determines
|
|
what the certificate can be used for. The actual checks done are rather
|
|
complex and include various hacks and workarounds to handle broken
|
|
certificates and software.
|
|
.PP
|
|
The same code is used when verifying untrusted certificates in chains
|
|
so this section is useful if a chain is rejected by the verify code.
|
|
.PP
|
|
The basicConstraints extension \s-1CA\s0 flag is used to determine whether the
|
|
certificate can be used as a \s-1CA\s0. If the \s-1CA\s0 flag is true then it is a \s-1CA\s0,
|
|
if the \s-1CA\s0 flag is false then it is not a \s-1CA\s0. \fBAll\fR CAs should have the
|
|
\&\s-1CA\s0 flag set to true.
|
|
.PP
|
|
If the basicConstraints extension is absent then the certificate is
|
|
considered to be a \*(L"possible \s-1CA\s0\*(R" other extensions are checked according
|
|
to the intended use of the certificate. A warning is given in this case
|
|
because the certificate should really not be regarded as a \s-1CA:\s0 however
|
|
it is allowed to be a \s-1CA\s0 to work around some broken software.
|
|
.PP
|
|
If the certificate is a V1 certificate (and thus has no extensions) and
|
|
it is self signed it is also assumed to be a \s-1CA\s0 but a warning is again
|
|
given: this is to work around the problem of Verisign roots which are V1
|
|
self signed certificates.
|
|
.PP
|
|
If the keyUsage extension is present then additional restraints are
|
|
made on the uses of the certificate. A \s-1CA\s0 certificate \fBmust\fR have the
|
|
keyCertSign bit set if the keyUsage extension is present.
|
|
.PP
|
|
The extended key usage extension places additional restrictions on the
|
|
certificate uses. If this extension is present (whether critical or not)
|
|
the key can only be used for the purposes specified.
|
|
.PP
|
|
A complete description of each test is given below. The comments about
|
|
basicConstraints and keyUsage and V1 certificates above apply to \fBall\fR
|
|
\&\s-1CA\s0 certificates.
|
|
.IP "\fB\s-1SSL\s0 Client\fR" 4
|
|
.IX Item "SSL Client"
|
|
The extended key usage extension must be absent or include the \*(L"web client
|
|
authentication\*(R" \s-1OID\s0. keyUsage must be absent or it must have the
|
|
digitalSignature bit set. Netscape certificate type must be absent or it must
|
|
have the \s-1SSL\s0 client bit set.
|
|
.IP "\fB\s-1SSL\s0 Client \s-1CA\s0\fR" 4
|
|
.IX Item "SSL Client CA"
|
|
The extended key usage extension must be absent or include the \*(L"web client
|
|
authentication\*(R" \s-1OID\s0. Netscape certificate type must be absent or it must have
|
|
the \s-1SSL\s0 \s-1CA\s0 bit set: this is used as a work around if the basicConstraints
|
|
extension is absent.
|
|
.IP "\fB\s-1SSL\s0 Server\fR" 4
|
|
.IX Item "SSL Server"
|
|
The extended key usage extension must be absent or include the \*(L"web server
|
|
authentication\*(R" and/or one of the \s-1SGC\s0 OIDs. keyUsage must be absent or it
|
|
must have the digitalSignature, the keyEncipherment set or both bits set.
|
|
Netscape certificate type must be absent or have the \s-1SSL\s0 server bit set.
|
|
.IP "\fB\s-1SSL\s0 Server \s-1CA\s0\fR" 4
|
|
.IX Item "SSL Server CA"
|
|
The extended key usage extension must be absent or include the \*(L"web server
|
|
authentication\*(R" and/or one of the \s-1SGC\s0 OIDs. Netscape certificate type must
|
|
be absent or the \s-1SSL\s0 \s-1CA\s0 bit must be set: this is used as a work around if the
|
|
basicConstraints extension is absent.
|
|
.IP "\fBNetscape \s-1SSL\s0 Server\fR" 4
|
|
.IX Item "Netscape SSL Server"
|
|
For Netscape \s-1SSL\s0 clients to connect to an \s-1SSL\s0 server it must have the
|
|
keyEncipherment bit set if the keyUsage extension is present. This isn't
|
|
always valid because some cipher suites use the key for digital signing.
|
|
Otherwise it is the same as a normal \s-1SSL\s0 server.
|
|
.IP "\fBCommon S/MIME Client Tests\fR" 4
|
|
.IX Item "Common S/MIME Client Tests"
|
|
The extended key usage extension must be absent or include the \*(L"email
|
|
protection\*(R" \s-1OID\s0. Netscape certificate type must be absent or should have the
|
|
S/MIME bit set. If the S/MIME bit is not set in Netscape certificate type
|
|
then the \s-1SSL\s0 client bit is tolerated as an alternative but a warning is shown:
|
|
this is because some Verisign certificates don't set the S/MIME bit.
|
|
.IP "\fBS/MIME Signing\fR" 4
|
|
.IX Item "S/MIME Signing"
|
|
In addition to the common S/MIME client tests the digitalSignature bit or
|
|
the nonRepudiation bit must be set if the keyUsage extension is present.
|
|
.IP "\fBS/MIME Encryption\fR" 4
|
|
.IX Item "S/MIME Encryption"
|
|
In addition to the common S/MIME tests the keyEncipherment bit must be set
|
|
if the keyUsage extension is present.
|
|
.IP "\fBS/MIME \s-1CA\s0\fR" 4
|
|
.IX Item "S/MIME CA"
|
|
The extended key usage extension must be absent or include the \*(L"email
|
|
protection\*(R" \s-1OID\s0. Netscape certificate type must be absent or must have the
|
|
S/MIME \s-1CA\s0 bit set: this is used as a work around if the basicConstraints
|
|
extension is absent.
|
|
.IP "\fB\s-1CRL\s0 Signing\fR" 4
|
|
.IX Item "CRL Signing"
|
|
The keyUsage extension must be absent or it must have the \s-1CRL\s0 signing bit
|
|
set.
|
|
.IP "\fB\s-1CRL\s0 Signing \s-1CA\s0\fR" 4
|
|
.IX Item "CRL Signing CA"
|
|
The normal \s-1CA\s0 tests apply. Except in this case the basicConstraints extension
|
|
must be present.
|
|
.SH "BUGS"
|
|
.IX Header "BUGS"
|
|
Extensions in certificates are not transferred to certificate requests and
|
|
vice versa.
|
|
.PP
|
|
It is possible to produce invalid certificates or requests by specifying the
|
|
wrong private key or using inconsistent options in some cases: these should
|
|
be checked.
|
|
.PP
|
|
There should be options to explicitly set such things as start and end
|
|
dates rather than an offset from the current time.
|
|
.SH "SEE ALSO"
|
|
.IX Header "SEE ALSO"
|
|
\&\fIopenssl\fR\|(1),
|
|
\&\fIopenssl\-req\fR\|(1),
|
|
\&\fIopenssl\-ca\fR\|(1),
|
|
\&\fIopenssl\-genrsa\fR\|(1),
|
|
\&\fIopenssl\-gendsa\fR\|(1),
|
|
\&\fIopenssl\-verify\fR\|(1),
|
|
\&\fIx509v3_config\fR\|(5)
|
|
.SH "HISTORY"
|
|
.IX Header "HISTORY"
|
|
The hash algorithm used in the \fB\-subject_hash\fR and \fB\-issuer_hash\fR options
|
|
before OpenSSL 1.0.0 was based on the deprecated \s-1MD5\s0 algorithm and the encoding
|
|
of the distinguished name. In OpenSSL 1.0.0 and later it is based on a canonical
|
|
version of the \s-1DN\s0 using \s-1SHA1\s0. This means that any directories using the old
|
|
form must have their links rebuilt using \fIopenssl\-rehash\fR\|(1) or similar.
|
|
.SH "COPYRIGHT"
|
|
.IX Header "COPYRIGHT"
|
|
Copyright 2000\-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
.PP
|
|
Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file \s-1LICENSE\s0 in the source distribution or at
|
|
<https://www.openssl.org/source/license.html>.
|