1266 lines
51 KiB
Groff
Executable File
1266 lines
51 KiB
Groff
Executable File
.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
|
|
.\"
|
|
.\" Standard preamble:
|
|
.\" ========================================================================
|
|
.de Sp \" Vertical space (when we can't use .PP)
|
|
.if t .sp .5v
|
|
.if n .sp
|
|
..
|
|
.de Vb \" Begin verbatim text
|
|
.ft CW
|
|
.nf
|
|
.ne \\$1
|
|
..
|
|
.de Ve \" End verbatim text
|
|
.ft R
|
|
.fi
|
|
..
|
|
.\" Set up some character translations and predefined strings. \*(-- will
|
|
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
|
|
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
|
|
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
|
|
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
|
|
.\" nothing in troff, for use with C<>.
|
|
.tr \(*W-
|
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
|
.ie n \{\
|
|
. ds -- \(*W-
|
|
. ds PI pi
|
|
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
|
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
|
. ds L" ""
|
|
. ds R" ""
|
|
. ds C` ""
|
|
. ds C' ""
|
|
'br\}
|
|
.el\{\
|
|
. ds -- \|\(em\|
|
|
. ds PI \(*p
|
|
. ds L" ``
|
|
. ds R" ''
|
|
'br\}
|
|
.\"
|
|
.\" Escape single quotes in literal strings from groff's Unicode transform.
|
|
.ie \n(.g .ds Aq \(aq
|
|
.el .ds Aq '
|
|
.\"
|
|
.\" If the F register is turned on, we'll generate index entries on stderr for
|
|
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
|
|
.\" entries marked with X<> in POD. Of course, you'll have to process the
|
|
.\" output yourself in some meaningful fashion.
|
|
.ie \nF \{\
|
|
. de IX
|
|
. tm Index:\\$1\t\\n%\t"\\$2"
|
|
..
|
|
. nr % 0
|
|
. rr F
|
|
.\}
|
|
.el \{\
|
|
. de IX
|
|
..
|
|
.\}
|
|
.\"
|
|
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
|
|
.\" Fear. Run. Save yourself. No user-serviceable parts.
|
|
. \" fudge factors for nroff and troff
|
|
.if n \{\
|
|
. ds #H 0
|
|
. ds #V .8m
|
|
. ds #F .3m
|
|
. ds #[ \f1
|
|
. ds #] \fP
|
|
.\}
|
|
.if t \{\
|
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
|
. ds #V .6m
|
|
. ds #F 0
|
|
. ds #[ \&
|
|
. ds #] \&
|
|
.\}
|
|
. \" simple accents for nroff and troff
|
|
.if n \{\
|
|
. ds ' \&
|
|
. ds ` \&
|
|
. ds ^ \&
|
|
. ds , \&
|
|
. ds ~ ~
|
|
. ds /
|
|
.\}
|
|
.if t \{\
|
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
|
.\}
|
|
. \" troff and (daisy-wheel) nroff accents
|
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
|
. \" corrections for vroff
|
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
|
. \" for low resolution devices (crt and lpr)
|
|
.if \n(.H>23 .if \n(.V>19 \
|
|
\{\
|
|
. ds : e
|
|
. ds 8 ss
|
|
. ds o a
|
|
. ds d- d\h'-1'\(ga
|
|
. ds D- D\h'-1'\(hy
|
|
. ds th \o'bp'
|
|
. ds Th \o'LP'
|
|
. ds ae ae
|
|
. ds Ae AE
|
|
.\}
|
|
.rm #[ #] #H #V #F C
|
|
.\" ========================================================================
|
|
.\"
|
|
.IX Title "OPENSSL 1"
|
|
.TH OPENSSL 1 "2020-03-02" "3.0.0-dev" "OpenSSL"
|
|
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
|
|
.\" way too many mistakes in technical documents.
|
|
.if n .ad l
|
|
.nh
|
|
.SH "NAME"
|
|
openssl \- OpenSSL command line tool
|
|
.SH "SYNOPSIS"
|
|
.IX Header "SYNOPSIS"
|
|
\&\fBopenssl\fR
|
|
\&\fIcommand\fR
|
|
[ \fIoptions\fR ... ]
|
|
[ \fIparameters\fR ... ]
|
|
.PP
|
|
\&\fBopenssl\fR
|
|
\&\fBlist\fR
|
|
\&\fB\-standard\-commands\fR |
|
|
\&\fB\-digest\-commands\fR |
|
|
\&\fB\-cipher\-commands\fR |
|
|
\&\fB\-cipher\-algorithms\fR |
|
|
\&\fB\-digest\-algorithms\fR |
|
|
\&\fB\-mac\-algorithms\fR |
|
|
\&\fB\-public\-key\-algorithms\fR
|
|
.PP
|
|
\&\fBopenssl\fR \fBno\-\fR\fI\s-1XXX\s0\fR [ \fIoptions\fR ]
|
|
.SH "DESCRIPTION"
|
|
.IX Header "DESCRIPTION"
|
|
OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (\s-1SSL\s0
|
|
v2/v3) and Transport Layer Security (\s-1TLS\s0 v1) network protocols and related
|
|
cryptography standards required by them.
|
|
.PP
|
|
The \fBopenssl\fR program is a command line tool for using the various
|
|
cryptography functions of OpenSSL's \fBcrypto\fR library from the shell.
|
|
It can be used for
|
|
.PP
|
|
.Vb 8
|
|
\& o Creation and management of private keys, public keys and parameters
|
|
\& o Public key cryptographic operations
|
|
\& o Creation of X.509 certificates, CSRs and CRLs
|
|
\& o Calculation of Message Digests and Message Authentication Codes
|
|
\& o Encryption and Decryption with Ciphers
|
|
\& o SSL/TLS Client and Server Tests
|
|
\& o Handling of S/MIME signed or encrypted mail
|
|
\& o Timestamp requests, generation and verification
|
|
.Ve
|
|
.SH "COMMAND SUMMARY"
|
|
.IX Header "COMMAND SUMMARY"
|
|
The \fBopenssl\fR program provides a rich variety of commands (\fIcommand\fR in
|
|
the \*(L"\s-1SYNOPSIS\s0\*(R" above).
|
|
Each command can have many options and argument parameters, shown above as
|
|
\&\fIoptions\fR and \fIparameters\fR.
|
|
.PP
|
|
Detailed documentation and use cases for most standard subcommands are available
|
|
(e.g., \fIopenssl\-x509\fR\|(1)).
|
|
.PP
|
|
Many commands use an external configuration file for some or all of their
|
|
arguments and have a \fB\-config\fR option to specify that file.
|
|
The default name of the file is \fIopenssl.cnf\fR in the default certificate
|
|
storage area, which can be determined from the \fIopenssl\-version\fR\|(1)
|
|
command.
|
|
The environment variable \fB\s-1OPENSSL_CONF\s0\fR can be used to specify
|
|
a different location of the file.
|
|
See \fIopenssl\-env\fR\|(7).
|
|
.PP
|
|
The list options \fB\-standard\-commands\fR, \fB\-digest\-commands\fR,
|
|
and \fB\-cipher\-commands\fR output a list (one entry per line) of the names
|
|
of all standard commands, message digest commands, or cipher commands,
|
|
respectively, that are available.
|
|
.PP
|
|
The list parameters \fB\-cipher\-algorithms\fR, \fB\-digest\-algorithms\fR,
|
|
and \fB\-mac\-algorithms\fR list all cipher, message digest, and message
|
|
authentication code names, one entry per line. Aliases are listed as:
|
|
.PP
|
|
.Vb 1
|
|
\& from => to
|
|
.Ve
|
|
.PP
|
|
The list parameter \fB\-public\-key\-algorithms\fR lists all supported public
|
|
key algorithms.
|
|
.PP
|
|
The command \fBno\-\fR\fI\s-1XXX\s0\fR tests whether a command of the
|
|
specified name is available. If no command named \fI\s-1XXX\s0\fR exists, it
|
|
returns 0 (success) and prints \fBno\-\fR\fI\s-1XXX\s0\fR; otherwise it returns 1
|
|
and prints \fI\s-1XXX\s0\fR. In both cases, the output goes to \fBstdout\fR and
|
|
nothing is printed to \fBstderr\fR. Additional command line arguments
|
|
are always ignored. Since for each cipher there is a command of the
|
|
same name, this provides an easy way for shell scripts to test for the
|
|
availability of ciphers in the \fBopenssl\fR program. (\fBno\-\fR\fI\s-1XXX\s0\fR is
|
|
not able to detect pseudo-commands such as \fBquit\fR,
|
|
\&\fBlist\fR, or \fBno\-\fR\fI\s-1XXX\s0\fR itself.)
|
|
.SS "Standard Commands"
|
|
.IX Subsection "Standard Commands"
|
|
.IP "\fBasn1parse\fR" 4
|
|
.IX Item "asn1parse"
|
|
Parse an \s-1ASN\s0.1 sequence.
|
|
.IP "\fBca\fR" 4
|
|
.IX Item "ca"
|
|
Certificate Authority (\s-1CA\s0) Management.
|
|
.IP "\fBciphers\fR" 4
|
|
.IX Item "ciphers"
|
|
Cipher Suite Description Determination.
|
|
.IP "\fBcms\fR" 4
|
|
.IX Item "cms"
|
|
\&\s-1CMS\s0 (Cryptographic Message Syntax) utility.
|
|
.IP "\fBcrl\fR" 4
|
|
.IX Item "crl"
|
|
Certificate Revocation List (\s-1CRL\s0) Management.
|
|
.IP "\fBcrl2pkcs7\fR" 4
|
|
.IX Item "crl2pkcs7"
|
|
\&\s-1CRL\s0 to PKCS#7 Conversion.
|
|
.IP "\fBdgst\fR" 4
|
|
.IX Item "dgst"
|
|
Message Digest calculation. \s-1MAC\s0 calculations are superseded by
|
|
\&\fIopenssl\-mac\fR\|(1).
|
|
.IP "\fBdhparam\fR" 4
|
|
.IX Item "dhparam"
|
|
Generation and Management of Diffie-Hellman Parameters. Superseded by
|
|
\&\fIopenssl\-genpkey\fR\|(1) and \fIopenssl\-pkeyparam\fR\|(1).
|
|
.IP "\fBdsa\fR" 4
|
|
.IX Item "dsa"
|
|
\&\s-1DSA\s0 Data Management.
|
|
.IP "\fBdsaparam\fR" 4
|
|
.IX Item "dsaparam"
|
|
\&\s-1DSA\s0 Parameter Generation and Management. Superseded by
|
|
\&\fIopenssl\-genpkey\fR\|(1) and \fIopenssl\-pkeyparam\fR\|(1).
|
|
.IP "\fBec\fR" 4
|
|
.IX Item "ec"
|
|
\&\s-1EC\s0 (Elliptic curve) key processing.
|
|
.IP "\fBecparam\fR" 4
|
|
.IX Item "ecparam"
|
|
\&\s-1EC\s0 parameter manipulation and generation.
|
|
.IP "\fBenc\fR" 4
|
|
.IX Item "enc"
|
|
Encryption, decryption, and encoding.
|
|
.IP "\fBengine\fR" 4
|
|
.IX Item "engine"
|
|
Engine (loadable module) information and manipulation.
|
|
.IP "\fBerrstr\fR" 4
|
|
.IX Item "errstr"
|
|
Error Number to Error String Conversion.
|
|
.IP "\fBfipsinstall\fR" 4
|
|
.IX Item "fipsinstall"
|
|
\&\s-1FIPS\s0 configuration installation.
|
|
.IP "\fBgendsa\fR" 4
|
|
.IX Item "gendsa"
|
|
Generation of \s-1DSA\s0 Private Key from Parameters. Superseded by
|
|
\&\fIopenssl\-genpkey\fR\|(1) and \fIopenssl\-pkey\fR\|(1).
|
|
.IP "\fBgenpkey\fR" 4
|
|
.IX Item "genpkey"
|
|
Generation of Private Key or Parameters.
|
|
.IP "\fBgenrsa\fR" 4
|
|
.IX Item "genrsa"
|
|
Generation of \s-1RSA\s0 Private Key. Superseded by \fIopenssl\-genpkey\fR\|(1).
|
|
.IP "\fBhelp\fR" 4
|
|
.IX Item "help"
|
|
Display information about a command's options.
|
|
.IP "\fBinfo\fR" 4
|
|
.IX Item "info"
|
|
Display diverse information built into the OpenSSL libraries.
|
|
.IP "\fBkdf\fR" 4
|
|
.IX Item "kdf"
|
|
Key Derivation Functions.
|
|
.IP "\fBlist\fR" 4
|
|
.IX Item "list"
|
|
List algorithms and features.
|
|
.IP "\fBmac\fR" 4
|
|
.IX Item "mac"
|
|
Message Authentication Code Calculation.
|
|
.IP "\fBnseq\fR" 4
|
|
.IX Item "nseq"
|
|
Create or examine a Netscape certificate sequence.
|
|
.IP "\fBocsp\fR" 4
|
|
.IX Item "ocsp"
|
|
Online Certificate Status Protocol utility.
|
|
.IP "\fBpasswd\fR" 4
|
|
.IX Item "passwd"
|
|
Generation of hashed passwords.
|
|
.IP "\fBpkcs12\fR" 4
|
|
.IX Item "pkcs12"
|
|
PKCS#12 Data Management.
|
|
.IP "\fBpkcs7\fR" 4
|
|
.IX Item "pkcs7"
|
|
PKCS#7 Data Management.
|
|
.IP "\fBpkcs8\fR" 4
|
|
.IX Item "pkcs8"
|
|
PKCS#8 format private key conversion tool.
|
|
.IP "\fBpkey\fR" 4
|
|
.IX Item "pkey"
|
|
Public and private key management.
|
|
.IP "\fBpkeyparam\fR" 4
|
|
.IX Item "pkeyparam"
|
|
Public key algorithm parameter management.
|
|
.IP "\fBpkeyutl\fR" 4
|
|
.IX Item "pkeyutl"
|
|
Public key algorithm cryptographic operation utility.
|
|
.IP "\fBprime\fR" 4
|
|
.IX Item "prime"
|
|
Compute prime numbers.
|
|
.IP "\fBprovider\fR" 4
|
|
.IX Item "provider"
|
|
Load and query providers.
|
|
.IP "\fBrand\fR" 4
|
|
.IX Item "rand"
|
|
Generate pseudo-random bytes.
|
|
.IP "\fBrehash\fR" 4
|
|
.IX Item "rehash"
|
|
Create symbolic links to certificate and \s-1CRL\s0 files named by the hash values.
|
|
.IP "\fBreq\fR" 4
|
|
.IX Item "req"
|
|
PKCS#10 X.509 Certificate Signing Request (\s-1CSR\s0) Management.
|
|
.IP "\fBrsa\fR" 4
|
|
.IX Item "rsa"
|
|
\&\s-1RSA\s0 key management.
|
|
.IP "\fBrsautl\fR" 4
|
|
.IX Item "rsautl"
|
|
\&\s-1RSA\s0 utility for signing, verification, encryption, and decryption. Superseded
|
|
by \fIopenssl\-pkeyutl\fR\|(1).
|
|
.IP "\fBs_client\fR" 4
|
|
.IX Item "s_client"
|
|
This implements a generic \s-1SSL/TLS\s0 client which can establish a transparent
|
|
connection to a remote server speaking \s-1SSL/TLS\s0. It's intended for testing
|
|
purposes only and provides only rudimentary interface functionality but
|
|
internally uses mostly all functionality of the OpenSSL \fBssl\fR library.
|
|
.IP "\fBs_server\fR" 4
|
|
.IX Item "s_server"
|
|
This implements a generic \s-1SSL/TLS\s0 server which accepts connections from remote
|
|
clients speaking \s-1SSL/TLS\s0. It's intended for testing purposes only and provides
|
|
only rudimentary interface functionality but internally uses mostly all
|
|
functionality of the OpenSSL \fBssl\fR library. It provides both an own command
|
|
line oriented protocol for testing \s-1SSL\s0 functions and a simple \s-1HTTP\s0 response
|
|
facility to emulate an SSL/TLS\-aware webserver.
|
|
.IP "\fBs_time\fR" 4
|
|
.IX Item "s_time"
|
|
\&\s-1SSL\s0 Connection Timer.
|
|
.IP "\fBsess_id\fR" 4
|
|
.IX Item "sess_id"
|
|
\&\s-1SSL\s0 Session Data Management.
|
|
.IP "\fBsmime\fR" 4
|
|
.IX Item "smime"
|
|
S/MIME mail processing.
|
|
.IP "\fBspeed\fR" 4
|
|
.IX Item "speed"
|
|
Algorithm Speed Measurement.
|
|
.IP "\fBspkac\fR" 4
|
|
.IX Item "spkac"
|
|
\&\s-1SPKAC\s0 printing and generating utility.
|
|
.IP "\fBsrp\fR" 4
|
|
.IX Item "srp"
|
|
Maintain \s-1SRP\s0 password file.
|
|
.IP "\fBstoreutl\fR" 4
|
|
.IX Item "storeutl"
|
|
Utility to list and display certificates, keys, CRLs, etc.
|
|
.IP "\fBts\fR" 4
|
|
.IX Item "ts"
|
|
Time Stamping Authority tool (client/server).
|
|
.IP "\fBverify\fR" 4
|
|
.IX Item "verify"
|
|
X.509 Certificate Verification.
|
|
.IP "\fBversion\fR" 4
|
|
.IX Item "version"
|
|
OpenSSL Version Information.
|
|
.IP "\fBx509\fR" 4
|
|
.IX Item "x509"
|
|
X.509 Certificate Data Management.
|
|
.SS "Message Digest Commands"
|
|
.IX Subsection "Message Digest Commands"
|
|
.IP "\fBblake2b512\fR" 4
|
|
.IX Item "blake2b512"
|
|
BLAKE2b\-512 Digest
|
|
.IP "\fBblake2s256\fR" 4
|
|
.IX Item "blake2s256"
|
|
BLAKE2s\-256 Digest
|
|
.IP "\fBmd2\fR" 4
|
|
.IX Item "md2"
|
|
\&\s-1MD2\s0 Digest
|
|
.IP "\fBmd4\fR" 4
|
|
.IX Item "md4"
|
|
\&\s-1MD4\s0 Digest
|
|
.IP "\fBmd5\fR" 4
|
|
.IX Item "md5"
|
|
\&\s-1MD5\s0 Digest
|
|
.IP "\fBmdc2\fR" 4
|
|
.IX Item "mdc2"
|
|
\&\s-1MDC2\s0 Digest
|
|
.IP "\fBrmd160\fR" 4
|
|
.IX Item "rmd160"
|
|
\&\s-1RMD\-160\s0 Digest
|
|
.IP "\fBsha1\fR" 4
|
|
.IX Item "sha1"
|
|
\&\s-1SHA\-1\s0 Digest
|
|
.IP "\fBsha224\fR" 4
|
|
.IX Item "sha224"
|
|
\&\s-1SHA\-2\s0 224 Digest
|
|
.IP "\fBsha256\fR" 4
|
|
.IX Item "sha256"
|
|
\&\s-1SHA\-2\s0 256 Digest
|
|
.IP "\fBsha384\fR" 4
|
|
.IX Item "sha384"
|
|
\&\s-1SHA\-2\s0 384 Digest
|
|
.IP "\fBsha512\fR" 4
|
|
.IX Item "sha512"
|
|
\&\s-1SHA\-2\s0 512 Digest
|
|
.IP "\fBsha3\-224\fR" 4
|
|
.IX Item "sha3-224"
|
|
\&\s-1SHA\-3\s0 224 Digest
|
|
.IP "\fBsha3\-256\fR" 4
|
|
.IX Item "sha3-256"
|
|
\&\s-1SHA\-3\s0 256 Digest
|
|
.IP "\fBsha3\-384\fR" 4
|
|
.IX Item "sha3-384"
|
|
\&\s-1SHA\-3\s0 384 Digest
|
|
.IP "\fBsha3\-512\fR" 4
|
|
.IX Item "sha3-512"
|
|
\&\s-1SHA\-3\s0 512 Digest
|
|
.IP "\fBshake128\fR" 4
|
|
.IX Item "shake128"
|
|
\&\s-1SHA\-3\s0 \s-1SHAKE128\s0 Digest
|
|
.IP "\fBshake256\fR" 4
|
|
.IX Item "shake256"
|
|
\&\s-1SHA\-3\s0 \s-1SHAKE256\s0 Digest
|
|
.IP "\fBsm3\fR" 4
|
|
.IX Item "sm3"
|
|
\&\s-1SM3\s0 Digest
|
|
.SS "Encryption, Decryption, and Encoding Commands"
|
|
.IX Subsection "Encryption, Decryption, and Encoding Commands"
|
|
The following aliases provide convenient access to the most used encodings
|
|
and ciphers.
|
|
.PP
|
|
Depending on how OpenSSL was configured and built, not all ciphers listed
|
|
here may be present. See \fIopenssl\-enc\fR\|(1) for more information.
|
|
.IP "\fBaes128\fR, \fBaes\-128\-cbc\fR, \fBaes\-128\-cfb\fR, \fBaes\-128\-ctr\fR, \fBaes\-128\-ecb\fR, \fBaes\-128\-ofb\fR" 4
|
|
.IX Item "aes128, aes-128-cbc, aes-128-cfb, aes-128-ctr, aes-128-ecb, aes-128-ofb"
|
|
\&\s-1AES\-128\s0 Cipher
|
|
.IP "\fBaes192\fR, \fBaes\-192\-cbc\fR, \fBaes\-192\-cfb\fR, \fBaes\-192\-ctr\fR, \fBaes\-192\-ecb\fR, \fBaes\-192\-ofb\fR" 4
|
|
.IX Item "aes192, aes-192-cbc, aes-192-cfb, aes-192-ctr, aes-192-ecb, aes-192-ofb"
|
|
\&\s-1AES\-192\s0 Cipher
|
|
.IP "\fBaes256\fR, \fBaes\-256\-cbc\fR, \fBaes\-256\-cfb\fR, \fBaes\-256\-ctr\fR, \fBaes\-256\-ecb\fR, \fBaes\-256\-ofb\fR" 4
|
|
.IX Item "aes256, aes-256-cbc, aes-256-cfb, aes-256-ctr, aes-256-ecb, aes-256-ofb"
|
|
\&\s-1AES\-256\s0 Cipher
|
|
.IP "\fBaria128\fR, \fBaria\-128\-cbc\fR, \fBaria\-128\-cfb\fR, \fBaria\-128\-ctr\fR, \fBaria\-128\-ecb\fR, \fBaria\-128\-ofb\fR" 4
|
|
.IX Item "aria128, aria-128-cbc, aria-128-cfb, aria-128-ctr, aria-128-ecb, aria-128-ofb"
|
|
Aria\-128 Cipher
|
|
.IP "\fBaria192\fR, \fBaria\-192\-cbc\fR, \fBaria\-192\-cfb\fR, \fBaria\-192\-ctr\fR, \fBaria\-192\-ecb\fR, \fBaria\-192\-ofb\fR" 4
|
|
.IX Item "aria192, aria-192-cbc, aria-192-cfb, aria-192-ctr, aria-192-ecb, aria-192-ofb"
|
|
Aria\-192 Cipher
|
|
.IP "\fBaria256\fR, \fBaria\-256\-cbc\fR, \fBaria\-256\-cfb\fR, \fBaria\-256\-ctr\fR, \fBaria\-256\-ecb\fR, \fBaria\-256\-ofb\fR" 4
|
|
.IX Item "aria256, aria-256-cbc, aria-256-cfb, aria-256-ctr, aria-256-ecb, aria-256-ofb"
|
|
Aria\-256 Cipher
|
|
.IP "\fBbase64\fR" 4
|
|
.IX Item "base64"
|
|
Base64 Encoding
|
|
.IP "\fBbf\fR, \fBbf-cbc\fR, \fBbf-cfb\fR, \fBbf-ecb\fR, \fBbf-ofb\fR" 4
|
|
.IX Item "bf, bf-cbc, bf-cfb, bf-ecb, bf-ofb"
|
|
Blowfish Cipher
|
|
.IP "\fBcamellia128\fR, \fBcamellia\-128\-cbc\fR, \fBcamellia\-128\-cfb\fR, \fBcamellia\-128\-ctr\fR, \fBcamellia\-128\-ecb\fR, \fBcamellia\-128\-ofb\fR" 4
|
|
.IX Item "camellia128, camellia-128-cbc, camellia-128-cfb, camellia-128-ctr, camellia-128-ecb, camellia-128-ofb"
|
|
Camellia\-128 Cipher
|
|
.IP "\fBcamellia192\fR, \fBcamellia\-192\-cbc\fR, \fBcamellia\-192\-cfb\fR, \fBcamellia\-192\-ctr\fR, \fBcamellia\-192\-ecb\fR, \fBcamellia\-192\-ofb\fR" 4
|
|
.IX Item "camellia192, camellia-192-cbc, camellia-192-cfb, camellia-192-ctr, camellia-192-ecb, camellia-192-ofb"
|
|
Camellia\-192 Cipher
|
|
.IP "\fBcamellia256\fR, \fBcamellia\-256\-cbc\fR, \fBcamellia\-256\-cfb\fR, \fBcamellia\-256\-ctr\fR, \fBcamellia\-256\-ecb\fR, \fBcamellia\-256\-ofb\fR" 4
|
|
.IX Item "camellia256, camellia-256-cbc, camellia-256-cfb, camellia-256-ctr, camellia-256-ecb, camellia-256-ofb"
|
|
Camellia\-256 Cipher
|
|
.IP "\fBcast\fR, \fBcast-cbc\fR" 4
|
|
.IX Item "cast, cast-cbc"
|
|
\&\s-1CAST\s0 Cipher
|
|
.IP "\fBcast5\-cbc\fR, \fBcast5\-cfb\fR, \fBcast5\-ecb\fR, \fBcast5\-ofb\fR" 4
|
|
.IX Item "cast5-cbc, cast5-cfb, cast5-ecb, cast5-ofb"
|
|
\&\s-1CAST5\s0 Cipher
|
|
.IP "\fBchacha20\fR" 4
|
|
.IX Item "chacha20"
|
|
Chacha20 Cipher
|
|
.IP "\fBdes\fR, \fBdes-cbc\fR, \fBdes-cfb\fR, \fBdes-ecb\fR, \fBdes-ede\fR, \fBdes-ede-cbc\fR, \fBdes-ede-cfb\fR, \fBdes-ede-ofb\fR, \fBdes-ofb\fR" 4
|
|
.IX Item "des, des-cbc, des-cfb, des-ecb, des-ede, des-ede-cbc, des-ede-cfb, des-ede-ofb, des-ofb"
|
|
\&\s-1DES\s0 Cipher
|
|
.IP "\fBdes3\fR, \fBdesx\fR, \fBdes\-ede3\fR, \fBdes\-ede3\-cbc\fR, \fBdes\-ede3\-cfb\fR, \fBdes\-ede3\-ofb\fR" 4
|
|
.IX Item "des3, desx, des-ede3, des-ede3-cbc, des-ede3-cfb, des-ede3-ofb"
|
|
Triple-DES Cipher
|
|
.IP "\fBidea\fR, \fBidea-cbc\fR, \fBidea-cfb\fR, \fBidea-ecb\fR, \fBidea-ofb\fR" 4
|
|
.IX Item "idea, idea-cbc, idea-cfb, idea-ecb, idea-ofb"
|
|
\&\s-1IDEA\s0 Cipher
|
|
.IP "\fBrc2\fR, \fBrc2\-cbc\fR, \fBrc2\-cfb\fR, \fBrc2\-ecb\fR, \fBrc2\-ofb\fR" 4
|
|
.IX Item "rc2, rc2-cbc, rc2-cfb, rc2-ecb, rc2-ofb"
|
|
\&\s-1RC2\s0 Cipher
|
|
.IP "\fBrc4\fR" 4
|
|
.IX Item "rc4"
|
|
\&\s-1RC4\s0 Cipher
|
|
.IP "\fBrc5\fR, \fBrc5\-cbc\fR, \fBrc5\-cfb\fR, \fBrc5\-ecb\fR, \fBrc5\-ofb\fR" 4
|
|
.IX Item "rc5, rc5-cbc, rc5-cfb, rc5-ecb, rc5-ofb"
|
|
\&\s-1RC5\s0 Cipher
|
|
.IP "\fBseed\fR, \fBseed-cbc\fR, \fBseed-cfb\fR, \fBseed-ecb\fR, \fBseed-ofb\fR" 4
|
|
.IX Item "seed, seed-cbc, seed-cfb, seed-ecb, seed-ofb"
|
|
\&\s-1SEED\s0 Cipher
|
|
.IP "\fBsm4\fR, \fBsm4\-cbc\fR, \fBsm4\-cfb\fR, \fBsm4\-ctr\fR, \fBsm4\-ecb\fR, \fBsm4\-ofb\fR" 4
|
|
.IX Item "sm4, sm4-cbc, sm4-cfb, sm4-ctr, sm4-ecb, sm4-ofb"
|
|
\&\s-1SM4\s0 Cipher
|
|
.SH "OPTIONS"
|
|
.IX Header "OPTIONS"
|
|
Details of which options are available depend on the specific command.
|
|
This section describes some common options with common behavior.
|
|
.SS "Common Options"
|
|
.IX Subsection "Common Options"
|
|
.IP "\fB\-help\fR" 4
|
|
.IX Item "-help"
|
|
Provides a terse summary of all options.
|
|
If an option takes an argument, the \*(L"type\*(R" of argument is also given.
|
|
.IP "\fB\-\-\fR" 4
|
|
.IX Item "--"
|
|
This terminates the list of options. It is mostly useful if any filename
|
|
parameters start with a minus sign:
|
|
.Sp
|
|
.Vb 1
|
|
\& openssl verify [flags...] \-\- \-cert1.pem...
|
|
.Ve
|
|
.SS "Format Options"
|
|
.IX Subsection "Format Options"
|
|
Several OpenSSL commands can take input or generate output in a variety
|
|
of formats. The list of acceptable formats, and the default, is
|
|
described in each command documentation. The list of formats is
|
|
described below. Both uppercase and lowercase are accepted.
|
|
.IP "\fB\s-1DER\s0\fR" 4
|
|
.IX Item "DER"
|
|
A binary format, encoded or parsed according to Distinguished Encoding Rules
|
|
(\s-1DER\s0) of the \s-1ASN\s0.1 data language.
|
|
.IP "\fB\s-1ENGINE\s0\fR" 4
|
|
.IX Item "ENGINE"
|
|
Used to specify that the cryptographic material is in an OpenSSL \fBengine\fR.
|
|
An engine must be configured or specified using the \fB\-engine\fR option.
|
|
In addition, the \fB\-input\fR flag can be used to name a specific object in
|
|
the engine.
|
|
A password, such as the \fB\-passin\fR flag often must be specified as well.
|
|
.IP "\fBP12\fR" 4
|
|
.IX Item "P12"
|
|
A DER-encoded file containing a PKCS#12 object.
|
|
It might be necessary to provide a decryption password to retrieve
|
|
the private key.
|
|
.IP "\fB\s-1PEM\s0\fR" 4
|
|
.IX Item "PEM"
|
|
A text format defined in \s-1IETF\s0 \s-1RFC\s0 1421 and \s-1IETF\s0 \s-1RFC\s0 7468. Briefly, this is
|
|
a block of base\-64 encoding (defined in \s-1IETF\s0 \s-1RFC\s0 4648), with specific
|
|
lines used to mark the start and end:
|
|
.Sp
|
|
.Vb 7
|
|
\& Text before the BEGIN line is ignored.
|
|
\& \-\-\-\-\- BEGIN object\-type \-\-\-\-\-
|
|
\& OT43gQKBgQC/2OHZoko6iRlNOAQ/tMVFNq7fL81GivoQ9F1U0Qr+DH3ZfaH8eIkX
|
|
\& xT0ToMPJUzWAn8pZv0snA0um6SIgvkCuxO84OkANCVbttzXImIsL7pFzfcwV/ERK
|
|
\& UM6j0ZuSMFOCr/lGPAoOQU0fskidGEHi1/kW+suSr28TqsyYZpwBDQ==
|
|
\& \-\-\-\-\- END object\-type \-\-\-\-\-
|
|
\& Text after the END line is also ignored
|
|
.Ve
|
|
.Sp
|
|
The \fIobject-type\fR must match the type of object that is expected.
|
|
For example a \f(CW\*(C`BEGIN X509 CERTIFICATE\*(C'\fR will not match if the command
|
|
is trying to read a private key. The types supported include:
|
|
.Sp
|
|
.Vb 10
|
|
\& ANY PRIVATE KEY
|
|
\& CERTIFICATE
|
|
\& CERTIFICATE REQUEST
|
|
\& CMS
|
|
\& DH PARAMETERS
|
|
\& DSA PARAMETERS
|
|
\& DSA PUBLIC KEY
|
|
\& EC PARAMETERS
|
|
\& EC PRIVATE KEY
|
|
\& ECDSA PUBLIC KEY
|
|
\& ENCRYPTED PRIVATE KEY
|
|
\& PARAMETERS
|
|
\& PKCS #7 SIGNED DATA
|
|
\& PKCS7
|
|
\& PRIVATE KEY
|
|
\& PUBLIC KEY
|
|
\& RSA PRIVATE KEY
|
|
\& SSL SESSION PARAMETERS
|
|
\& TRUSTED CERTIFICATE
|
|
\& X509 CRL
|
|
\& X9.42 DH PARAMETERS
|
|
.Ve
|
|
.Sp
|
|
The following legacy \fIobject-type\fR's are also supported for compatibility
|
|
with earlier releases:
|
|
.Sp
|
|
.Vb 4
|
|
\& DSA PRIVATE KEY
|
|
\& NEW CERTIFICATE REQUEST
|
|
\& RSA PUBLIC KEY
|
|
\& X509 CERTIFICATE
|
|
.Ve
|
|
.IP "\fB\s-1SMIME\s0\fR" 4
|
|
.IX Item "SMIME"
|
|
An S/MIME object as described in \s-1IETF\s0 \s-1RFC\s0 8551.
|
|
Earlier versions were known as \s-1CMS\s0 and are compatible.
|
|
Note that the parsing is simple and might fail to parse some legal data.
|
|
.PP
|
|
The options to specify the format are as follows. Refer to the individual
|
|
manpage to see which options are accepted.
|
|
.IP "\fB\-inform\fR \fIformat\fR, \fB\-outform\fR \fIformat\fR" 4
|
|
.IX Item "-inform format, -outform format"
|
|
The format of the input or output streams.
|
|
.IP "\fB\-keyform\fR \fIformat\fR" 4
|
|
.IX Item "-keyform format"
|
|
Format of a private key input source.
|
|
.IP "\fB\-CRLform\fR \fIformat\fR" 4
|
|
.IX Item "-CRLform format"
|
|
Format of a \s-1CRL\s0 input source.
|
|
.SS "Pass Phrase Options"
|
|
.IX Subsection "Pass Phrase Options"
|
|
Several commands accept password arguments, typically using \fB\-passin\fR
|
|
and \fB\-passout\fR for input and output passwords respectively. These allow
|
|
the password to be obtained from a variety of sources. Both of these
|
|
options take a single argument whose format is described below. If no
|
|
password argument is given and a password is required then the user is
|
|
prompted to enter one: this will typically be read from the current
|
|
terminal with echoing turned off.
|
|
.PP
|
|
Note that character encoding may be relevant, please see
|
|
\&\fIpassphrase\-encoding\fR\|(7).
|
|
.IP "\fBpass:\fR\fIpassword\fR" 4
|
|
.IX Item "pass:password"
|
|
The actual password is \fIpassword\fR. Since the password is visible
|
|
to utilities (like 'ps' under Unix) this form should only be used
|
|
where security is not important.
|
|
.IP "\fBenv:\fR\fIvar\fR" 4
|
|
.IX Item "env:var"
|
|
Obtain the password from the environment variable \fIvar\fR. Since
|
|
the environment of other processes is visible on certain platforms
|
|
(e.g. ps under certain Unix OSes) this option should be used with caution.
|
|
.IP "\fBfile:\fR\fIpathname\fR" 4
|
|
.IX Item "file:pathname"
|
|
The first line of \fIpathname\fR is the password. If the same \fIpathname\fR
|
|
argument is supplied to \fB\-passin\fR and \fB\-passout\fR arguments then the first
|
|
line will be used for the input password and the next line for the output
|
|
password. \fIpathname\fR need not refer to a regular file: it could for example
|
|
refer to a device or named pipe.
|
|
.IP "\fBfd:\fR\fInumber\fR" 4
|
|
.IX Item "fd:number"
|
|
Read the password from the file descriptor \fInumber\fR. This can be used to
|
|
send the data via a pipe for example.
|
|
.IP "\fBstdin\fR" 4
|
|
.IX Item "stdin"
|
|
Read the password from standard input.
|
|
.SS "Trusted Certificate Options"
|
|
.IX Subsection "Trusted Certificate Options"
|
|
Part of validating a certificate includes verifying that the chain of \s-1CA\s0's
|
|
can be traced up to an existing trusted root. The following options specify
|
|
how to list the trusted roots, also known as trust anchors. A collection
|
|
of trusted roots is called a \fItrust store\fR.
|
|
.PP
|
|
Note that OpenSSL does not provide a default set of trust anchors. Many
|
|
Linux distributions include a system default and configure OpenSSL to point
|
|
to that. Mozilla maintains an influential trust store that can be found at
|
|
https://www.mozilla.org/en\-US/about/governance/policies/security\-group/certs/ <https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/>.
|
|
.IP "\fB\-CAfile\fR \fIfile\fR" 4
|
|
.IX Item "-CAfile file"
|
|
Load the specified file which contains one or more PEM-format certificates
|
|
of \s-1CA\s0's that are trusted.
|
|
.IP "\fB\-no\-CAfile\fR" 4
|
|
.IX Item "-no-CAfile"
|
|
Do not load the default file of trusted certificates.
|
|
.IP "\fB\-CApath\fR \fIdir\fR" 4
|
|
.IX Item "-CApath dir"
|
|
Use the specified directory as a list of trust certificates. That is,
|
|
files should be named with the hash of the X.509 SubjectName of each
|
|
certificate. This is so that the library can extract the IssuerName,
|
|
hash it, and directly lookup the file to get the issuer certificate.
|
|
See \fIopenssl\-rehash\fR\|(1) for information on creating this type of directory.
|
|
.IP "\fB\-no\-CApath\fR" 4
|
|
.IX Item "-no-CApath"
|
|
Do not use the default directory of trusted certificates.
|
|
.IP "\fB\-CAstore\fR \fIuri\fR" 4
|
|
.IX Item "-CAstore uri"
|
|
Use \fIuri\fR as a store of trusted \s-1CA\s0 certificates. The \s-1URI\s0 may
|
|
indicate a single certificate, as well as a collection of them.
|
|
With URIs in the \f(CW\*(C`file:\*(C'\fR scheme, this acts as \fB\-CAfile\fR or
|
|
\&\fB\-CApath\fR, depending on if the \s-1URI\s0 indicates a single file or
|
|
directory.
|
|
See \fIossl_store\-file\fR\|(7) for more information on the \f(CW\*(C`file:\*(C'\fR scheme.
|
|
.Sp
|
|
These certificates are also used when building the server certificate
|
|
chain (for example with \fIopenssl\-s_server\fR\|(1)) or client certificate
|
|
chain (for example with \fIopenssl\-s_time\fR\|(1)).
|
|
.IP "\fB\-no\-CAstore\fR" 4
|
|
.IX Item "-no-CAstore"
|
|
Do not use the default store.
|
|
.SS "Random State Options"
|
|
.IX Subsection "Random State Options"
|
|
Prior to OpenSSL 3.0, it was common for applications to store information
|
|
about the state of the random-number generator in a file that was loaded
|
|
at startup and rewritten upon exit. On modern operating systems, this is
|
|
generally no longer necessary as OpenSSL will seed itself from the
|
|
appropriate \s-1CPU\s0 flags, device files, and so on. These flags are still
|
|
supported for special platforms or circumstances that might require them.
|
|
.PP
|
|
It is generally an error to use the same seed file more than once and
|
|
every use of \fB\-rand\fR should be paired with \fB\-writerand\fR.
|
|
.IP "\fB\-rand\fR \fIfiles\fR" 4
|
|
.IX Item "-rand files"
|
|
A file or files containing random data used to seed the random number
|
|
generator.
|
|
Multiple files can be specified separated by an OS-dependent character.
|
|
The separator is \f(CW\*(C`;\*(C'\fR for MS-Windows, \f(CW\*(C`,\*(C'\fR for OpenVMS, and \f(CW\*(C`:\*(C'\fR for
|
|
all others. Another way to specify multiple files is to repeat this flag
|
|
with different filenames.
|
|
.IP "\fB\-writerand\fR \fIfile\fR" 4
|
|
.IX Item "-writerand file"
|
|
Writes the seed data to the specified \fIfile\fR upon exit.
|
|
This file can be used in a subsequent command invocation.
|
|
.SS "Extended Verification Options"
|
|
.IX Subsection "Extended Verification Options"
|
|
Sometimes there may be more than one certificate chain leading to an
|
|
end-entity certificate.
|
|
This usually happens when a root or intermediate \s-1CA\s0 signs a certificate
|
|
for another a \s-1CA\s0 in other organization.
|
|
Another reason is when a \s-1CA\s0 might have intermediates that use two different
|
|
signature formats, such as a \s-1SHA\-1\s0 and a \s-1SHA\-256\s0 digest.
|
|
.PP
|
|
The following options can be used to provide data that will allow the
|
|
OpenSSL command to generate an alternative chain.
|
|
.IP "\fB\-xchain_build\fR" 4
|
|
.IX Item "-xchain_build"
|
|
Specify whether the application should build the certificate chain to be
|
|
provided to the server for the extra certificates via the \fB\-xkey\fR,
|
|
\&\fB\-xcert\fR, and \fB\-xchain\fR options.
|
|
.IP "\fB\-xkey\fR \fIinfile\fR, \fB\-xcert\fR \fIinfile\fR, \fB\-xchain\fR" 4
|
|
.IX Item "-xkey infile, -xcert infile, -xchain"
|
|
Specify an extra certificate, private key and certificate chain. These behave
|
|
in the same manner as the \fB\-cert\fR, \fB\-key\fR and \fB\-cert_chain\fR options. When
|
|
specified, the callback returning the first valid chain will be in use by the
|
|
client.
|
|
.IP "\fB\-xcertform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR, \fB\-xkeyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR" 4
|
|
.IX Item "-xcertform DER|PEM, -xkeyform DER|PEM"
|
|
The input format for the extra certificate and key, respectively.
|
|
See \*(L"Format Options\*(R" in \fIopenssl\fR\|(1) for details.
|
|
.IP "\fB\-xchain_build\fR" 4
|
|
.IX Item "-xchain_build"
|
|
Specify whether the application should build the certificate chain to be
|
|
provided to the server for the extra certificates via the \fB\-xkey\fR,
|
|
\&\fB\-xcert\fR, and \fB\-xchain\fR options.
|
|
.IP "\fB\-xcertform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR, \fB\-xkeyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR" 4
|
|
.IX Item "-xcertform DER|PEM, -xkeyform DER|PEM"
|
|
The input format for the extra certificate and key, respectively.
|
|
See \*(L"Format Options\*(R" in \fIopenssl\fR\|(1) for details.
|
|
.SS "Verification Options"
|
|
.IX Subsection "Verification Options"
|
|
Many OpenSSL commands verify certificates. The details of how each
|
|
command handles errors are documented on the specific command page.
|
|
.PP
|
|
Verification is a complicated process, consisting of a number of separate
|
|
steps that are detailed in the following paragraphs.
|
|
.PP
|
|
First, a certificate chain is built up starting from the supplied certificate
|
|
and ending in a root \s-1CA\s0. It is an error if the whole chain cannot be
|
|
built up. The chain is built up by looking up the certificate that
|
|
signed (or issued) the certificate. It then repeats the process, until
|
|
it gets to a certificate that is self-issued.
|
|
.PP
|
|
The process of looking up the issuer's certificate itself involves a number
|
|
of steps. After all certificates whose subject name matches the issuer
|
|
name of the current certificate are subject to further tests. The relevant
|
|
authority key identifier components of the current certificate (if present)
|
|
must match the subject key identifier (if present) and issuer and serial
|
|
number of the candidate issuer, in addition the keyUsage extension of the
|
|
candidate issuer (if present) must permit certificate signing.
|
|
.PP
|
|
The lookup first looks in the list of untrusted certificates and if no match
|
|
is found the remaining lookups are from the trusted certificates. The root \s-1CA\s0
|
|
is always looked up in the trusted certificate list: if the certificate to
|
|
verify is a root certificate then an exact match must be found in the trusted
|
|
list.
|
|
.PP
|
|
The second step is to check every untrusted certificate's extensions
|
|
for consistency with the supplied purpose. If the \fB\-purpose\fR option is
|
|
not included then no checks are done. The supplied or \*(L"leaf\*(R" certificate
|
|
must have extensions compatible with the supplied purpose and all other
|
|
certificates must also be valid \s-1CA\s0 certificates. The precise extensions
|
|
required are described in more detail in
|
|
\&\*(L"\s-1CERTIFICATE\s0 \s-1EXTENSIONS\s0\*(R" in \fIopenssl\-x509\fR\|(1).
|
|
.PP
|
|
The third step is to check the trust settings on the root \s-1CA\s0. The root
|
|
\&\s-1CA\s0 should be trusted for the supplied purpose. For compatibility with
|
|
previous versions of OpenSSL, a certificate with no trust settings is
|
|
considered to be valid for all purposes.
|
|
.PP
|
|
The fourth, and final, step is to check the validity of the certificate
|
|
chain. The validity period is checked against the system time
|
|
and the \f(CW\*(C`notBefore\*(C'\fR and \f(CW\*(C`notAfter\*(C'\fR dates in the certificate. The certificate
|
|
signatures are also checked at this point. The \fB\-attime\fR flag may be
|
|
used to specify a time other than \*(L"now.\*(R"
|
|
.PP
|
|
If all operations complete successfully then certificate is considered
|
|
valid. If any operation fails then the certificate is not valid.
|
|
.PP
|
|
The details of the processing steps can be fine-tuned with the
|
|
following flags.
|
|
.IP "\fB\-verbose\fR" 4
|
|
.IX Item "-verbose"
|
|
Print extra information about the operations being performed.
|
|
.IP "\fB\-attime\fR \fItimestamp\fR" 4
|
|
.IX Item "-attime timestamp"
|
|
Perform validation checks using time specified by \fItimestamp\fR and not
|
|
current system time. \fItimestamp\fR is the number of seconds since
|
|
January 1, 1970 (i.e., the Unix Epoch).
|
|
.IP "\fB\-no_check_time\fR" 4
|
|
.IX Item "-no_check_time"
|
|
This option suppresses checking the validity period of certificates and CRLs
|
|
against the current time. If option \fB\-attime\fR is used to specify
|
|
a verification time, the check is not suppressed.
|
|
.IP "\fB\-x509_strict\fR" 4
|
|
.IX Item "-x509_strict"
|
|
This disables non-compliant workarounds for broken certificates.
|
|
.IP "\fB\-ignore_critical\fR" 4
|
|
.IX Item "-ignore_critical"
|
|
Normally if an unhandled critical extension is present which is not
|
|
supported by OpenSSL the certificate is rejected (as required by \s-1RFC5280\s0).
|
|
If this option is set critical extensions are ignored.
|
|
.IP "\fB\-issuer_checks\fR" 4
|
|
.IX Item "-issuer_checks"
|
|
Ignored.
|
|
.IP "\fB\-crl_check\fR" 4
|
|
.IX Item "-crl_check"
|
|
Checks end entity certificate validity by attempting to look up a valid \s-1CRL\s0.
|
|
If a valid \s-1CRL\s0 cannot be found an error occurs.
|
|
.IP "\fB\-crl_check_all\fR" 4
|
|
.IX Item "-crl_check_all"
|
|
Checks the validity of \fBall\fR certificates in the chain by attempting
|
|
to look up valid CRLs.
|
|
.IP "\fB\-use_deltas\fR" 4
|
|
.IX Item "-use_deltas"
|
|
Enable support for delta CRLs.
|
|
.IP "\fB\-extended_crl\fR" 4
|
|
.IX Item "-extended_crl"
|
|
Enable extended \s-1CRL\s0 features such as indirect CRLs and alternate \s-1CRL\s0
|
|
signing keys.
|
|
.IP "\fB\-suiteB_128_only\fR, \fB\-suiteB_128\fR, \fB\-suiteB_192\fR" 4
|
|
.IX Item "-suiteB_128_only, -suiteB_128, -suiteB_192"
|
|
Enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
|
|
192 bit, or only 192 bit Level of Security respectively.
|
|
See \s-1RFC6460\s0 for details. In particular the supported signature algorithms are
|
|
reduced to support only \s-1ECDSA\s0 and \s-1SHA256\s0 or \s-1SHA384\s0 and only the elliptic curves
|
|
P\-256 and P\-384.
|
|
.IP "\fB\-auth_level\fR \fIlevel\fR" 4
|
|
.IX Item "-auth_level level"
|
|
Set the certificate chain authentication security level to \fIlevel\fR.
|
|
The authentication security level determines the acceptable signature and
|
|
public key strength when verifying certificate chains. For a certificate
|
|
chain to validate, the public keys of all the certificates must meet the
|
|
specified security \fIlevel\fR. The signature algorithm security level is
|
|
enforced for all the certificates in the chain except for the chain's
|
|
\&\fItrust anchor\fR, which is either directly trusted or validated by means
|
|
other than its signature. See \fISSL_CTX_set_security_level\fR\|(3) for the
|
|
definitions of the available levels. The default security level is \-1,
|
|
or \*(L"not set\*(R". At security level 0 or lower all algorithms are acceptable.
|
|
Security level 1 requires at least 80\-bit\-equivalent security and is broadly
|
|
interoperable, though it will, for example, reject \s-1MD5\s0 signatures or \s-1RSA\s0
|
|
keys shorter than 1024 bits.
|
|
.IP "\fB\-partial_chain\fR" 4
|
|
.IX Item "-partial_chain"
|
|
Allow verification to succeed even if a \fIcomplete\fR chain cannot be built to a
|
|
self-signed trust-anchor, provided it is possible to construct a chain to a
|
|
trusted certificate that might not be self-signed.
|
|
.IP "\fB\-check_ss_sig\fR" 4
|
|
.IX Item "-check_ss_sig"
|
|
Verify the signature on the self-signed root \s-1CA\s0. This is disabled by default
|
|
because it doesn't add any security.
|
|
.IP "\fB\-allow_proxy_certs\fR" 4
|
|
.IX Item "-allow_proxy_certs"
|
|
Allow the verification of proxy certificates.
|
|
.IP "\fB\-trusted_first\fR" 4
|
|
.IX Item "-trusted_first"
|
|
As of OpenSSL 1.1.0 this option is on by default and cannot be disabled.
|
|
.IP "\fB\-no_alt_chains\fR" 4
|
|
.IX Item "-no_alt_chains"
|
|
As of OpenSSL 1.1.0, since \fB\-trusted_first\fR always on, this option has no
|
|
effect.
|
|
.IP "\fB\-trusted\fR \fIfile\fR" 4
|
|
.IX Item "-trusted file"
|
|
Parse \fIfile\fR as a set of one or more certificates in \s-1PEM\s0 format.
|
|
All certificates must be self-signed, unless the
|
|
\&\fB\-partial_chain\fR option is specified.
|
|
This option implies the \fB\-no\-CAfile\fR and \fB\-no\-CApath\fR options and it
|
|
cannot be used with either the \fB\-CAfile\fR or \fB\-CApath\fR options, so
|
|
only certificates in the file are trust anchors.
|
|
This option may be used multiple times.
|
|
.IP "\fB\-untrusted\fR \fIfile\fR" 4
|
|
.IX Item "-untrusted file"
|
|
Parse \fIfile\fR as a set of one or more certificates in \s-1PEM\s0 format.
|
|
All certificates are untrusted certificates that may be used to
|
|
construct a certificate chain from the subject certificate to a trust anchor.
|
|
This option may be used multiple times.
|
|
.IP "\fB\-policy\fR \fIarg\fR" 4
|
|
.IX Item "-policy arg"
|
|
Enable policy processing and add \fIarg\fR to the user-initial-policy-set (see
|
|
\&\s-1RFC5280\s0). The policy \fIarg\fR can be an object name an \s-1OID\s0 in numeric form.
|
|
This argument can appear more than once.
|
|
.IP "\fB\-explicit_policy\fR" 4
|
|
.IX Item "-explicit_policy"
|
|
Set policy variable require-explicit-policy (see \s-1RFC5280\s0).
|
|
.IP "\fB\-policy_check\fR" 4
|
|
.IX Item "-policy_check"
|
|
Enables certificate policy processing.
|
|
.IP "\fB\-policy_print\fR" 4
|
|
.IX Item "-policy_print"
|
|
Print out diagnostics related to policy processing.
|
|
.IP "\fB\-inhibit_any\fR" 4
|
|
.IX Item "-inhibit_any"
|
|
Set policy variable inhibit-any-policy (see \s-1RFC5280\s0).
|
|
.IP "\fB\-inhibit_map\fR" 4
|
|
.IX Item "-inhibit_map"
|
|
Set policy variable inhibit-policy-mapping (see \s-1RFC5280\s0).
|
|
.IP "\fB\-purpose\fR \fIpurpose\fR" 4
|
|
.IX Item "-purpose purpose"
|
|
The intended use for the certificate. If this option is not specified, this
|
|
command will not consider certificate purpose during chain verification.
|
|
Currently accepted uses are \fBsslclient\fR, \fBsslserver\fR, \fBnssslserver\fR,
|
|
\&\fBsmimesign\fR, \fBsmimeencrypt\fR.
|
|
.IP "\fB\-verify_depth\fR \fInum\fR" 4
|
|
.IX Item "-verify_depth num"
|
|
Limit the certificate chain to \fInum\fR intermediate \s-1CA\s0 certificates.
|
|
A maximal depth chain can have up to \fInum\fR+2 certificates, since neither the
|
|
end-entity certificate nor the trust-anchor certificate count against the
|
|
\&\fB\-verify_depth\fR limit.
|
|
.IP "\fB\-verify_email\fR \fIemail\fR" 4
|
|
.IX Item "-verify_email email"
|
|
Verify if \fIemail\fR matches the email address in Subject Alternative Name or
|
|
the email in the subject Distinguished Name.
|
|
.IP "\fB\-verify_hostname\fR \fIhostname\fR" 4
|
|
.IX Item "-verify_hostname hostname"
|
|
Verify if \fIhostname\fR matches \s-1DNS\s0 name in Subject Alternative Name or
|
|
Common Name in the subject certificate.
|
|
.IP "\fB\-verify_ip\fR \fIip\fR" 4
|
|
.IX Item "-verify_ip ip"
|
|
Verify if \fIip\fR matches the \s-1IP\s0 address in Subject Alternative Name of
|
|
the subject certificate.
|
|
.IP "\fB\-verify_name\fR \fIname\fR" 4
|
|
.IX Item "-verify_name name"
|
|
Use default verification policies like trust model and required certificate
|
|
policies identified by \fIname\fR.
|
|
The trust model determines which auxiliary trust or reject OIDs are applicable
|
|
to verifying the given certificate chain.
|
|
See the \fB\-addtrust\fR and \fB\-addreject\fR options for \fIopenssl\-x509\fR\|(1).
|
|
Supported policy names include: \fBdefault\fR, \fBpkcs7\fR, \fBsmime_sign\fR,
|
|
\&\fBssl_client\fR, \fBssl_server\fR.
|
|
These mimics the combinations of purpose and trust settings used in \s-1SSL\s0, \s-1CMS\s0
|
|
and S/MIME.
|
|
As of OpenSSL 1.1.0, the trust model is inferred from the purpose when not
|
|
specified, so the \fB\-verify_name\fR options are functionally equivalent to the
|
|
corresponding \fB\-purpose\fR settings.
|
|
.SS "Name Format Options"
|
|
.IX Subsection "Name Format Options"
|
|
OpenSSL provides fine-grain control over how the subject and issuer \s-1DN\s0's are
|
|
displayed.
|
|
This is specified by using the \fB\-nameopt\fR option, which takes a
|
|
comma-separated list of options from the following set.
|
|
An option may be preceded by a minus sign, \f(CW\*(C`\-\*(C'\fR, to turn it off.
|
|
The default value is \f(CW\*(C`oneline\*(C'\fR.
|
|
The first four are the most commonly used.
|
|
.IP "\fBcompat\fR" 4
|
|
.IX Item "compat"
|
|
Display the name using an old format from previous OpenSSL versions.
|
|
.IP "\fB\s-1RFC2253\s0\fR" 4
|
|
.IX Item "RFC2253"
|
|
Display the name using the format defined in \s-1RFC\s0 2253.
|
|
It is equivalent to \fBesc_2253\fR, \fBesc_ctrl\fR, \fBesc_msb\fR, \fButf8\fR,
|
|
\&\fBdump_nostr\fR, \fBdump_unknown\fR, \fBdump_der\fR, \fBsep_comma_plus\fR, \fBdn_rev\fR
|
|
and \fBsname\fR.
|
|
.IP "\fBoneline\fR" 4
|
|
.IX Item "oneline"
|
|
Display the name in one line, using a format that is more readable
|
|
\&\s-1RFC\s0 2253.
|
|
It is equivalent to \fBesc_2253\fR, \fBesc_ctrl\fR, \fBesc_msb\fR, \fButf8\fR,
|
|
\&\fBdump_nostr\fR, \fBdump_der\fR, \fBuse_quote\fR, \fBsep_comma_plus_space\fR,
|
|
\&\fBspace_eq\fR and \fBsname\fR options.
|
|
.IP "\fBmultiline\fR" 4
|
|
.IX Item "multiline"
|
|
Display the name using multiple lines.
|
|
It is equivalent to \fBesc_ctrl\fR, \fBesc_msb\fR, \fBsep_multiline\fR, \fBspace_eq\fR,
|
|
\&\fBlname\fR and \fBalign\fR.
|
|
.IP "\fBesc_2253\fR" 4
|
|
.IX Item "esc_2253"
|
|
Escape the \*(L"special\*(R" characters in a field, as required by \s-1RFC\s0 2253.
|
|
That is, any of the characters \f(CW\*(C`,+"<>;\*(C'\fR, \f(CW\*(C`#\*(C'\fR at the beginning of
|
|
a string and leading or trailing spaces.
|
|
.IP "\fBesc_2254\fR" 4
|
|
.IX Item "esc_2254"
|
|
Escape the \*(L"special\*(R" characters in a field as required by \s-1RFC\s0 2254 in a field.
|
|
That is, the \fB\s-1NUL\s0\fR character and and of \f(CW\*(C`()*\*(C'\fR.
|
|
.IP "\fBesc_ctrl\fR" 4
|
|
.IX Item "esc_ctrl"
|
|
Escape non-printable \s-1ASCII\s0 characters, codes less than 0x20 (space)
|
|
or greater than 0x7F (\s-1DELETE\s0). They are displayed using \s-1RFC\s0 2253 \f(CW\*(C`\eXX\*(C'\fR
|
|
notation where \fB\s-1XX\s0\fR are the two hex digits representing the character value.
|
|
.IP "\fBesc_msb\fR" 4
|
|
.IX Item "esc_msb"
|
|
Escape any characters with the most significant bit set, that is with
|
|
values larger than 127, as described in \fBesc_ctrl\fR.
|
|
.IP "\fBuse_quote\fR" 4
|
|
.IX Item "use_quote"
|
|
Escapes some characters by surrounding the entire string with quotation
|
|
marks, \f(CW\*(C`"\*(C'\fR.
|
|
Without this option, individual special characters are preceeded with
|
|
a backslash character, \f(CW\*(C`\e\*(C'\fR.
|
|
.IP "\fButf8\fR" 4
|
|
.IX Item "utf8"
|
|
Convert all strings to \s-1UTF\-8\s0 format first as required by \s-1RFC\s0 2253.
|
|
If the output device is \s-1UTF\-8\s0 compatible, then using this option (and
|
|
not setting \fBesc_msb\fR) may give the correct display of multibyte
|
|
characters.
|
|
If this option is not set, then multibyte characters larger than 0xFF
|
|
will be output as \f(CW\*(C`\eUXXXX\*(C'\fR for 16 bits or \f(CW\*(C`\eWXXXXXXXX\*(C'\fR for 32 bits.
|
|
In addition, any UTF8Strings will be converted to their character form first.
|
|
.IP "\fBignore_type\fR" 4
|
|
.IX Item "ignore_type"
|
|
This option does not attempt to interpret multibyte characters in any
|
|
way. That is, the content octets are merely dumped as though one octet
|
|
represents each character. This is useful for diagnostic purposes but
|
|
will result in rather odd looking output.
|
|
.IP "\fBshow_type\fR" 4
|
|
.IX Item "show_type"
|
|
Display the type of the \s-1ASN1\s0 character string before the value,
|
|
such as \f(CW\*(C`BMPSTRING: Hello World\*(C'\fR.
|
|
.IP "\fBdump_der\fR" 4
|
|
.IX Item "dump_der"
|
|
Any fields that would be output in hex format are displayed using
|
|
the \s-1DER\s0 encoding of the field.
|
|
If not set, just the content octets are displayed.
|
|
Either way, the \fB#XXXX...\fR format of \s-1RFC\s0 2253 is used.
|
|
.IP "\fBdump_nostr\fR" 4
|
|
.IX Item "dump_nostr"
|
|
Dump non-character strings, such as \s-1ASN\s0.1 \fB\s-1OCTET\s0 \s-1STRING\s0\fR.
|
|
If this option is not set, then non character string types will be displayed
|
|
as though each content octet represents a single character.
|
|
.IP "\fBdump_all\fR" 4
|
|
.IX Item "dump_all"
|
|
Dump all fields. When this used with \fBdump_der\fR, this allows the
|
|
\&\s-1DER\s0 encoding of the structure to be unambiguously determined.
|
|
.IP "\fBdump_unknown\fR" 4
|
|
.IX Item "dump_unknown"
|
|
Dump any field whose \s-1OID\s0 is not recognised by OpenSSL.
|
|
.IP "\fBsep_comma_plus\fR, \fBsep_comma_plus_space\fR, \fBsep_semi_plus_space\fR, \fBsep_multiline\fR" 4
|
|
.IX Item "sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline"
|
|
Specify the field separators. The first word is used between the
|
|
Relative Distinguished Names (RDNs) and the second is between
|
|
multiple Attribute Value Assertions (AVAs). Multiple AVAs are
|
|
very rare and their use is discouraged.
|
|
The options ending in \*(L"space\*(R" additionally place a space after the separator to make it more readable.
|
|
The \fBsep_multiline\fR starts each field on its own line, and uses \*(L"plus space\*(R"
|
|
for the \s-1AVA\s0 separator.
|
|
It also indents the fields by four characters.
|
|
The default value is \fBsep_comma_plus_space\fR.
|
|
.IP "\fBdn_rev\fR" 4
|
|
.IX Item "dn_rev"
|
|
Reverse the fields of the \s-1DN\s0 as required by \s-1RFC\s0 2253.
|
|
This also reverses the order of multiple AVAs in a field, but this is
|
|
permissible as there is no ordering on values.
|
|
.IP "\fBnofname\fR, \fBsname\fR, \fBlname\fR, \fBoid\fR" 4
|
|
.IX Item "nofname, sname, lname, oid"
|
|
Specify how the field name is displayed.
|
|
\&\fBnofname\fR does not display the field at all.
|
|
\&\fBsname\fR uses the \*(L"short name\*(R" form (\s-1CN\s0 for commonName for example).
|
|
\&\fBlname\fR uses the long form.
|
|
\&\fBoid\fR represents the \s-1OID\s0 in numerical form and is useful for
|
|
diagnostic purpose.
|
|
.IP "\fBalign\fR" 4
|
|
.IX Item "align"
|
|
Align field values for a more readable output. Only usable with
|
|
\&\fBsep_multiline\fR.
|
|
.IP "\fBspace_eq\fR" 4
|
|
.IX Item "space_eq"
|
|
Places spaces round the equal sign, \f(CW\*(C`=\*(C'\fR, character which follows the field
|
|
name.
|
|
.SS "\s-1TLS\s0 Version Options"
|
|
.IX Subsection "TLS Version Options"
|
|
Several commands use \s-1SSL\s0, \s-1TLS\s0, or \s-1DTLS\s0. By default, the commands use \s-1TLS\s0 and
|
|
clients will offer the lowest and highest protocol version they support,
|
|
and servers will pick the highest version that the client offers that is also
|
|
supported by the server.
|
|
.PP
|
|
The options below can be used to limit which protocol versions are used,
|
|
and whether \s-1TCP\s0 (\s-1SSL\s0 and \s-1TLS\s0) or \s-1UDP\s0 (\s-1DTLS\s0) is used.
|
|
Note that not all protocols and flags may be available, depending on how
|
|
OpenSSL was built.
|
|
.IP "\fB\-ssl3\fR, \fB\-tls1\fR, \fB\-tls1_1\fR, \fB\-tls1_2\fR, \fB\-tls1_3\fR, \fB\-no_ssl3\fR, \fB\-no_tls1\fR, \fB\-no_tls1_1\fR, \fB\-no_tls1_2\fR, \fB\-no_tls1_3\fR" 4
|
|
.IX Item "-ssl3, -tls1, -tls1_1, -tls1_2, -tls1_3, -no_ssl3, -no_tls1, -no_tls1_1, -no_tls1_2, -no_tls1_3"
|
|
These options require or disable the use of the specified \s-1SSL\s0 or \s-1TLS\s0 protocols.
|
|
When a specific \s-1TLS\s0 version is required, only that version will be offered or
|
|
accepted.
|
|
Only one specific protocol can be given and it cannot be combined with any of
|
|
the \fBno_\fR options.
|
|
.IP "\fB\-dtls\fR, \fB\-dtls1\fR, \fB\-dtls1_2\fR" 4
|
|
.IX Item "-dtls, -dtls1, -dtls1_2"
|
|
These options specify to use \s-1DTLS\s0 instead of \s-1DLTS\s0.
|
|
With \fB\-dtls\fR, clients will negotiate any supported \s-1DTLS\s0 protocol version.
|
|
Use the \fB\-dtls1\fR or \fB\-dtls1_2\fR options to support only \s-1DTLS1\s0.0 or \s-1DTLS1\s0.2,
|
|
respectively.
|
|
.SS "Engine Options"
|
|
.IX Subsection "Engine Options"
|
|
.IP "\fB\-engine\fR \fIid\fR" 4
|
|
.IX Item "-engine id"
|
|
Use the engine identified by \fIid\fR and use all the methods it
|
|
implements (algorithms, key storage, etc.), unless specified otherwise in
|
|
the command-specific documentation or it is configured to do so, as described
|
|
in \*(L"Engine Configuration Module\*(R" in \fIconfig\fR\|(5).
|
|
.SH "ENVIRONMENT"
|
|
.IX Header "ENVIRONMENT"
|
|
The OpenSSL library can be take some configuration parameters from the
|
|
environment. Some of these variables are listed below. For information
|
|
about specific commands, see \fIopenssl\-engine\fR\|(1), \fIopenssl\-provider\fR\|(1),
|
|
\&\fIopenssl\-rehash\fR\|(1), and \fItsget\fR\|(1).
|
|
.PP
|
|
For information about the use of environment variables in configuration,
|
|
see \*(L"\s-1ENVIRONMENT\s0\*(R" in \fIconfig\fR\|(5).
|
|
.PP
|
|
For information about querying or specifying \s-1CPU\s0 architecture flags, see
|
|
\&\fIOPENSSL_ia32cap\fR\|(3), and \fIOPENSSL_s390xcap\fR\|(3).
|
|
.PP
|
|
For information about all environment variables used by the OpenSSL libraries,
|
|
see \fIopenssl\-env\fR\|(7).
|
|
.IP "\fBOPENSSL_TRACE=\fR\fIname\fR[,...]" 4
|
|
.IX Item "OPENSSL_TRACE=name[,...]"
|
|
Enable tracing output of OpenSSL library, by name.
|
|
This output will only make sense if you know OpenSSL internals well.
|
|
Also, it might not give you any output at all, depending on how
|
|
OpenSSL was built.
|
|
.Sp
|
|
The value is a comma separated list of names, with the following
|
|
available:
|
|
.RS 4
|
|
.IP "\fB\s-1TRACE\s0\fR" 4
|
|
.IX Item "TRACE"
|
|
The tracing functionality.
|
|
.IP "\fB\s-1TLS\s0\fR" 4
|
|
.IX Item "TLS"
|
|
General \s-1SSL/TLS\s0.
|
|
.IP "\fB\s-1TLS_CIPHER\s0\fR" 4
|
|
.IX Item "TLS_CIPHER"
|
|
\&\s-1SSL/TLS\s0 cipher.
|
|
.IP "\fB\s-1ENGINE_CONF\s0\fR" 4
|
|
.IX Item "ENGINE_CONF"
|
|
\&\s-1ENGINE\s0 configuration.
|
|
.IP "\fB\s-1ENGINE_TABLE\s0\fR" 4
|
|
.IX Item "ENGINE_TABLE"
|
|
The function that is used by \s-1RSA\s0, \s-1DSA\s0 (etc) code to select registered
|
|
ENGINEs, cache defaults and functional references (etc), will generate
|
|
debugging summaries.
|
|
.IP "\fB\s-1ENGINE_REF_COUNT\s0\fR" 4
|
|
.IX Item "ENGINE_REF_COUNT"
|
|
Reference counts in the \s-1ENGINE\s0 structure will be monitored with a line
|
|
of generated for each change.
|
|
.IP "\fB\s-1PKCS5V2\s0\fR" 4
|
|
.IX Item "PKCS5V2"
|
|
PKCS#5 v2 keygen.
|
|
.IP "\fB\s-1PKCS12_KEYGEN\s0\fR" 4
|
|
.IX Item "PKCS12_KEYGEN"
|
|
PKCS#12 key generation.
|
|
.IP "\fB\s-1PKCS12_DECRYPT\s0\fR" 4
|
|
.IX Item "PKCS12_DECRYPT"
|
|
PKCS#12 decryption.
|
|
.IP "\fBX509V3_POLICY\fR" 4
|
|
.IX Item "X509V3_POLICY"
|
|
Generates the complete policy tree at various point during X.509 v3
|
|
policy evaluation.
|
|
.IP "\fB\s-1BN_CTX\s0\fR" 4
|
|
.IX Item "BN_CTX"
|
|
\&\s-1BIGNUM\s0 context.
|
|
.RE
|
|
.RS 4
|
|
.RE
|
|
.SH "SEE ALSO"
|
|
.IX Header "SEE ALSO"
|
|
\&\fIopenssl\-asn1parse\fR\|(1),
|
|
\&\fIopenssl\-ca\fR\|(1),
|
|
\&\fIopenssl\-ciphers\fR\|(1),
|
|
\&\fIopenssl\-cms\fR\|(1),
|
|
\&\fIopenssl\-crl\fR\|(1),
|
|
\&\fIopenssl\-crl2pkcs7\fR\|(1),
|
|
\&\fIopenssl\-dgst\fR\|(1),
|
|
\&\fIopenssl\-dhparam\fR\|(1),
|
|
\&\fIopenssl\-dsa\fR\|(1),
|
|
\&\fIopenssl\-dsaparam\fR\|(1),
|
|
\&\fIopenssl\-ec\fR\|(1),
|
|
\&\fIopenssl\-ecparam\fR\|(1),
|
|
\&\fIopenssl\-enc\fR\|(1),
|
|
\&\fIopenssl\-engine\fR\|(1),
|
|
\&\fIopenssl\-errstr\fR\|(1),
|
|
\&\fIopenssl\-gendsa\fR\|(1),
|
|
\&\fIopenssl\-genpkey\fR\|(1),
|
|
\&\fIopenssl\-genrsa\fR\|(1),
|
|
\&\fIopenssl\-kdf\fR\|(1),
|
|
\&\fIopenssl\-mac\fR\|(1),
|
|
\&\fIopenssl\-nseq\fR\|(1),
|
|
\&\fIopenssl\-ocsp\fR\|(1),
|
|
\&\fIopenssl\-passwd\fR\|(1),
|
|
\&\fIopenssl\-pkcs12\fR\|(1),
|
|
\&\fIopenssl\-pkcs7\fR\|(1),
|
|
\&\fIopenssl\-pkcs8\fR\|(1),
|
|
\&\fIopenssl\-pkey\fR\|(1),
|
|
\&\fIopenssl\-pkeyparam\fR\|(1),
|
|
\&\fIopenssl\-pkeyutl\fR\|(1),
|
|
\&\fIopenssl\-prime\fR\|(1),
|
|
\&\fIopenssl\-rand\fR\|(1),
|
|
\&\fIopenssl\-rehash\fR\|(1),
|
|
\&\fIopenssl\-req\fR\|(1),
|
|
\&\fIopenssl\-rsa\fR\|(1),
|
|
\&\fIopenssl\-rsautl\fR\|(1),
|
|
\&\fIopenssl\-s_client\fR\|(1),
|
|
\&\fIopenssl\-s_server\fR\|(1),
|
|
\&\fIopenssl\-s_time\fR\|(1),
|
|
\&\fIopenssl\-sess_id\fR\|(1),
|
|
\&\fIopenssl\-smime\fR\|(1),
|
|
\&\fIopenssl\-speed\fR\|(1),
|
|
\&\fIopenssl\-spkac\fR\|(1),
|
|
\&\fIopenssl\-srp\fR\|(1),
|
|
\&\fIopenssl\-storeutl\fR\|(1),
|
|
\&\fIopenssl\-ts\fR\|(1),
|
|
\&\fIopenssl\-verify\fR\|(1),
|
|
\&\fIopenssl\-version\fR\|(1),
|
|
\&\fIopenssl\-x509\fR\|(1),
|
|
\&\fIconfig\fR\|(5),
|
|
\&\fIcrypto\fR\|(7),
|
|
\&\fIopenssl\-env\fR\|(7).
|
|
\&\fIssl\fR\|(7),
|
|
\&\fIx509v3_config\fR\|(5)
|
|
.SH "HISTORY"
|
|
.IX Header "HISTORY"
|
|
The \fBlist\fR \-\fI\s-1XXX\s0\fR\fB\-algorithms\fR options were added in OpenSSL 1.0.0;
|
|
For notes on the availability of other commands, see their individual
|
|
manual pages.
|
|
.PP
|
|
The \fB\-issuer_checks\fR option is deprecated as of OpenSSL 1.1.0 and
|
|
is silently ignored.
|
|
.SH "COPYRIGHT"
|
|
.IX Header "COPYRIGHT"
|
|
Copyright 2000\-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
.PP
|
|
Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file \s-1LICENSE\s0 in the source distribution or at
|
|
<https://www.openssl.org/source/license.html>.
|