=head1 DESCRIPTION
The B<CA.pl> script is a perl script that supplies the relevant command line
-arguments to the B<openssl> command for some common certificate operations.
+arguments to the L<openssl(1)> command for some common certificate operations.
It is intended to simplify the process of certificate creation and management
by the use of some simple options.
Creates a new self signed certificate. The private key is written to the file
"newkey.pem" and the request written to the file "newreq.pem".
-This argument invokes B<openssl req> command.
+This argument invokes L<openssl-req(1)> command.
=item B<-newreq>
Creates a new certificate request. The private key is written to the file
"newkey.pem" and the request written to the file "newreq.pem".
-Executes B<openssl req> command below the hood.
+Executes L<openssl-req(1)> command below the hood.
=item B<-newreq-nodes>
Is like B<-newreq> except that the private key will not be encrypted.
-Uses B<openssl req> command.
+Uses L<openssl-req(1)> command.
=item B<-newca>
certificates (which should also contain the private key) or by hitting ENTER
details of the CA will be prompted for. The relevant files and directories
are created in a directory called "demoCA" in the current directory.
-B<openssl req> and B<openssl ca> commands are get invoked.
+L<openssl-req(1)> and L<openssl-ca(1)> commands are get invoked.
=item B<-pkcs12>
If there is an additional argument on the command line it will be used as the
"friendly name" for the certificate (which is typically displayed in the browser
list box), otherwise the name "My Certificate" is used.
-Delegates work to B<openssl pkcs12> command.
+Delegates work to L<openssl-pkcs12(1)> command.
=item B<-sign>, B<-signcert>, B<-xsign>
-Calls the B<ca> program to sign a certificate request. It expects the request
-to be in the file "newreq.pem". The new certificate is written to the file
-"newcert.pem" except in the case of the B<-xsign> option when it is written
-to standard output. Leverages B<openssl ca> command.
+Calls the L<openssl-ca(1)> command to sign a certificate request. It expects the
+request to be in the file "newreq.pem". The new certificate is written to the
+file "newcert.pem" except in the case of the B<-xsign> option when it is
+written to standard output. Leverages L<openssl-ca(1)> command.
=item B<-signCA>
This option is the same as the B<-signreq> option except it uses the
configuration file section B<v3_ca> and so makes the signed request a
valid CA certificate. This is useful when creating intermediate CA from
-a root CA. Extra params are passed on to B<openssl ca> command.
+a root CA. Extra params are passed on to L<openssl-ca(1)> command.
=item B<-signcert>
This option is the same as B<-sign> except it expects a self signed certificate
to be present in the file "newreq.pem".
-Extra params are passed on to B<openssl x509> and B<openssl ca> commands.
+Extra params are passed on to L<openssl-x509(1)> and L<openssl-ca(1)> commands.
=item B<-crl>
-Generate a CRL. Executes B<openssl ca> command.
+Generate a CRL. Executes L<openssl-ca(1)> command.
=item B<-revoke> I<certfile> [I<reason>]
reason may be specified, and must be one of: B<unspecified>,
B<keyCompromise>, B<CACompromise>, B<affiliationChanged>, B<superseded>,
B<cessationOfOperation>, B<certificateHold>, or B<removeFromCRL>.
-Leverages B<openssl ca> command.
+Leverages L<openssl-ca(1)> command.
=item B<-verify>
Verifies certificates against the CA certificate for "demoCA". If no
certificates are specified on the command line it tries to verify the file
-"newcert.pem". Invokes B<openssl verify> command.
+"newcert.pem". Invokes L<openssl-verify(1)> command.
=item B<-extra-req> | B<-extra-ca> | B<-extra-pkcs12> | B<-extra-x509> | B<-extra-verify> I<extra-params>
The purpose of these parameters is to allow optional parameters to be supplied
-to B<openssl> that this command executes. The B<-extra-cmd> are specific to the
-option being used and the B<openssl> command getting invoked. For example
-when this command invokes B<openssl req> extra parameters can be passed on
+to L<openssl(1)> that this command executes. The B<-extra-cmd> are specific to
+the option being used and the L<openssl(1)> command getting invoked. For example
+when this command invokes L<openssl-req(1)> extra parameters can be passed on
with the B<-extra-req> parameter. The
-B<openssl> commands being invoked per option are documented below.
-Users should consult B<openssl> command documentation for more information.
+L<openssl(1)> commands being invoked per option are documented below.
+Users should consult L<openssl(1)> command documentation for more information.
=back
can be used and the B<OPENSSL_CONF> environment variable changed to point to
the correct path of the configuration file.
-The script is intended as a simple front end for the B<openssl> program for use
-by a beginner. Its behaviour isn't always what is wanted. For more control over the
-behaviour of the certificate commands call the B<openssl> command directly.
+The script is intended as a simple front end for the L<openssl(1)> program for
+use by a beginner. Its behaviour isn't always what is wanted. For more control
+over the behaviour of the certificate commands call the L<openssl(1)> command
+directly.
=head1 SEE ALSO
=head1 DESCRIPTION
-The B<asn1parse> command is a diagnostic utility that can parse ASN.1
-structures. It can also be used to extract data from ASN.1 formatted data.
+This command is a diagnostic utility that can parse ASN.1 structures.
+It can also be used to extract data from ASN.1 formatted data.
=head1 OPTIONS
the first column is the OID in numerical format and should be followed by white
space. The second column is the "short name" which is a single word followed
by white space. The final column is the rest of the line and is the
-"long name". B<asn1parse> displays the long name. Example:
+"long name". Example:
C<1.2.3.4 shortName A long name>
=head1 DESCRIPTION
-The B<ca> command is a minimal CA application. It can be used
+This command is a minimal CA application. It can be used
to sign certificate requests in a variety of forms and generate
CRLs it also maintains a text database of issued certificates
and their status.
=item B<-md> I<alg>
The message digest to use.
-Any digest supported by the OpenSSL B<dgst> command can be used. For signing
+Any digest supported by the L<openssl-dgst(1)> command can be used. For signing
algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message
digest that is set is ignored. This option also applies to CRLs.
=item B<-msie_hack>
-This is a deprecated option to make B<ca> work with very old versions of
-the IE certificate enrollment control "certenr3". It used UniversalStrings
+This is a deprecated option to make this command work with very old versions
+of the IE certificate enrollment control "certenr3". It used UniversalStrings
for almost everything. Since the old control has various security bugs
its use is strongly discouraged.
=head1 CONFIGURATION FILE OPTIONS
-The section of the configuration file containing options for B<ca>
+The section of the configuration file containing options for this command
is found as follows: If the B<-name> command line option is used,
then it names the section to be used. Otherwise the section to
be used must be named in the B<default_ca> option of the B<ca> section
The input to the B<-spkac> command line option is a Netscape
signed public key and challenge. This will usually come from
the B<KEYGEN> tag in an HTML form to create a new private key.
-It is however possible to create SPKACs using the B<spkac> utility.
+It is however possible to create SPKACs using L<openssl-spkac(1)>.
The file should contain the variable SPKAC set to the value of
the SPKAC and also the required DN components as name value pairs.
=head1 EXAMPLES
-Note: these examples assume that the B<ca> directory structure is
-already set up and the relevant files already exist. This usually
-involves creating a CA certificate and private key with B<req>, a
-serial number file and an empty index file and placing them in
-the relevant directories.
+Note: these examples assume that the directory structure this command
+assumes is already set up and the relevant files already exist. This
+usually involves creating a CA certificate and private key with
+L<openssl-req(1)>, a serial number file and an empty index file and
+placing them in the relevant directories.
To use the sample configuration file below the directories demoCA,
demoCA/private and demoCA/newcerts would be created. The CA
0.OU=OpenSSL Group
1.OU=Another Group
-A sample configuration file with the relevant sections for B<ca>:
+A sample configuration file with the relevant sections for this command:
[ ca ]
default_ca = CA_default # The default ca section
numbers of certificates are present because, as the name implies
the database has to be kept in memory.
-The B<ca> command really needs rewriting or the required functionality
+This command really needs rewriting or the required functionality
exposed at either a command or interface level so a more friendly utility
(perl script or GUI) can handle things properly. The script
B<CA.pl> helps a little but not very much.
=head1 WARNINGS
-The B<ca> command is quirky and at times downright unfriendly.
+This command is quirky and at times downright unfriendly.
-The B<ca> utility was originally meant as an example of how to do things
-in a CA. It was not supposed to be used as a full blown CA itself:
+This command was originally meant as an example of how to do
+things in a CA. It was not supposed to be used as a full blown CA itself:
nevertheless some people are using it for this purpose.
-The B<ca> command is effectively a single user command: no locking is
-done on the various files and attempts to run more than one B<ca> command
-on the same database can have unpredictable results.
+This command command is effectively a single user command: no locking
+is done on the various files and attempts to run more than one B<openssl ca>
+command on the same database can have unpredictable results.
The B<copy_extensions> option should be used with caution. If care is
not taken then it can be a security risk. For example if a certificate
=head1 DESCRIPTION
-The B<ciphers> command converts textual OpenSSL cipher lists into ordered
-SSL cipher preference lists. It can be used as a test tool to determine
-the appropriate cipherlist.
+This command converts textual OpenSSL cipher lists into
+ordered SSL cipher preference lists. It can be used as a test tool to
+determine the appropriate cipherlist.
=head1 OPTIONS
=head1 HISTORY
-The B<-V> option for the B<ciphers> command was added in OpenSSL 1.0.0.
+The B<-V> option was added in OpenSSL 1.0.0.
The B<-stdname> is only available if OpenSSL is built with tracing enabled
(B<enable-ssl-trace> argument to Configure) before OpenSSL 1.1.1.
=head1 DESCRIPTION
-The B<cms> command handles S/MIME v3.1 mail. It can encrypt, decrypt, sign and
-verify, compress and uncompress S/MIME messages.
+This command handles S/MIME v3.1 mail. It can encrypt, decrypt,
+sign and verify, compress and uncompress S/MIME messages.
=head1 OPTIONS
=head1 COMPATIBILITY WITH PKCS#7 FORMAT
-The B<smime> utility can only process the older B<PKCS#7> format. The B<cms>
-utility supports Cryptographic Message Syntax format. Use of some features
-will result in messages which cannot be processed by applications which only
-support the older format. These are detailed below.
+L<openssl-smime(1)> can only process the older B<PKCS#7> format.
+B<openssl cms> supports Cryptographic Message Syntax format.
+Use of some features will result in messages which cannot be processed by
+applications which only support the older format. These are detailed below.
The use of the B<-keyid> option with B<-sign> or B<-encrypt>.
The use of OAEP or non-RSA keys with B<-encrypt>.
Additionally the B<-EncryptedData_create> and B<-data_create> type cannot
-be processed by the older B<smime> command.
+be processed by the older L<openssl-smime(1)> command.
=head1 EXAMPLES
=head1 DESCRIPTION
-The B<crl> command processes CRL files in DER or PEM format.
+This command processes CRL files in DER or PEM format.
=head1 OPTIONS
Verify the signature on a CRL by looking up the issuing certificate in
I<dir>. This directory must be a standard certificate directory: that
-is a hash of each subject name (using B<x509 -hash>) should be linked
-to each certificate.
+is a hash of each subject name (using the L<openssl-x509(1)> B<-hash> option)
+should be linked to each certificate.
=back
=head1 DESCRIPTION
-The B<crl2pkcs7> command takes an optional CRL and one or more
+This command takes an optional CRL and one or more
certificates and converts them into a PKCS#7 degenerate "certificates
only" structure.
The output file is a PKCS#7 signed data structure containing no signers and
just certificates and an optional CRL.
-This utility can be used to send certificates and CAs to Netscape as part of
+This command can be used to send certificates and CAs to Netscape as part of
the certificate enrollment process. This involves sending the DER encoded output
as MIME type application/x-x509-user-cert.
=head1 DESCRIPTION
-The digest functions output the message digest of a supplied file or files
-in hexadecimal. The digest functions also generate and verify digital
+This command output the message digest of a supplied file or files
+in hexadecimal, and also generates and verifies digital
signatures using message digests.
-The generic name, B<dgst>, may be used with an option specifying the
+The generic name, B<openssl dgst>, may be used with an option specifying the
algorithm to be used.
The default digest is B<sha256>.
-A supported I<digest> name may also be used as the command name.
-To see the list of supported algorithms, use the I<list --digest-commands>
-command.
+A supported I<digest> name may also be used as the sub-command name.
+To see the list of supported algorithms, use C<openssl list -digest-commands>
=head1 OPTIONS
=item B<-r>
Output the digest in the "coreutils" format, including newlines.
-Used by programs like B<sha1sum>.
+Used by programs like L<sha1sum(1)>.
=item B<-out> I<filename>
=item B<-sign> I<filename>
Digitally sign the digest using the private key in "filename". Note this option
-does not support Ed25519 or Ed448 private keys. Use the B<pkeyutl> command
-instead for this.
+does not support Ed25519 or Ed448 private keys. Use the L<openssl-pkeyutl(1)>
+command instead for this.
=item B<-keyform> I<arg>
The digest mechanisms that are available will depend on the options
used when building OpenSSL.
-The B<list digest-commands> command can be used to list them.
+The C<openssl list -digest-commands> command can be used to list them.
New or agile applications should use probably use SHA-256. Other digests,
particularly SHA-1 and MD5, are still widely used for interoperating
with existing formats and protocols.
-When signing a file, B<dgst> will automatically determine the algorithm
+When signing a file, this command will automatically determine the algorithm
(RSA, ECC, etc) to use for signing based on the private key's ASN.1 info.
When verifying signatures, it only handles the RSA, DSA, or ECDSA signature
itself, not the related data to identify the signer and algorithm used in
=head1 WARNINGS
-The program B<dhparam> combines the functionality of the programs B<dh> and
-B<gendh> in previous versions of OpenSSL. The B<dh> and B<gendh>
-programs are retained for now but may have different purposes in future
-versions of OpenSSL.
+This command combines the functionality of the L<openssl-dh(1)> and the
+L<openssl-gendh(1)> commands in previous OpenSSL versions.
+The L<openssl-dh(1)> and L<openssl-gendh(1)> commands are retained for now but
+may have different purposes in future versions of OpenSSL.
=head1 NOTES
=head1 DESCRIPTION
-The B<dsa> command processes DSA keys. They can be converted between various
+This command processes DSA keys. They can be converted between various
forms and their components printed out. B<Note> This command uses the
traditional SSLeay compatible format for private key encryption: newer
applications should use the more secure PKCS#8 format using the B<pkcs8>
These options encrypt the private key with the specified
cipher before outputting it. A pass phrase is prompted for.
If none of these options is specified the key is written in plain text. This
-means that using the B<dsa> utility to read in an encrypted key with no
-encryption option can be used to remove the pass phrase from a key, or by
-setting the encryption options it can be use to add or change the pass phrase.
+means that this command can be used to remove the pass phrase from a key
+by not giving any encryption option is given, or to add or change the pass
+phrase by setting them.
These options can only be used with PEM format output files.
=item B<-text>
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<dsa>
+Specifying an engine (by its unique I<id> string) will cause L<openssl-dsa(1)>
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<dsaparam>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 DESCRIPTION
-The B<ec> command processes EC keys. They can be converted between various
-forms and their components printed out. B<Note> OpenSSL uses the
+The L<openssl-ec(1)> command processes EC keys. They can be converted between
+various forms and their components printed out. B<Note> OpenSSL uses the
private key format specified in 'SEC 1: Elliptic Curve Cryptography'
(http://www.secg.org/). To convert an OpenSSL EC private key into the
-PKCS#8 private key format use the B<pkcs8> command.
+PKCS#8 private key format use the L<openssl-pkcs8(1)> command.
=head1 OPTIONS
any other cipher supported by OpenSSL before outputting it. A pass phrase is
prompted for.
If none of these options is specified the key is written in plain text. This
-means that using the B<ec> utility to read in an encrypted key with no
+means that using this command to read in an encrypted key with no
encryption option can be used to remove the pass phrase from a key, or by
setting the encryption options it can be use to add or change the pass phrase.
These options can only be used with PEM format output files.
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<ec>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=item B<-list_curves>
-If this options is specified B<ecparam> will print out a list of all
-currently implemented EC parameters names and exit.
+Print out a list of all currently implemented EC parameters names and exit.
=item B<-conv_form> I<arg>
-----END EC PARAMETERS-----
OpenSSL is currently not able to generate new groups and therefore
-B<ecparam> can only create EC parameters from known (named) curves.
+B<openssl ecparam> can only create EC parameters from known (named) curves.
=head1 EXAMPLES
=head1 NOTES
-The program can be called either as B<openssl cipher> or
-B<openssl enc -I<cipher>>. The first form doesn't work with
+The program can be called either as C<openssl I<cipher>> or
+C<openssl enc -I<cipher>>. The first form doesn't work with
engine-provided ciphers, because this form is processed before the
configuration file is read and any ENGINEs loaded.
-Use the B<list> command to get a list of supported ciphers.
+Use the L<openssl-list(1)> command to get a list of supported ciphers.
Engines which provide entirely new encryption algorithms (such as the ccgost
engine which provides gost89 algorithm) should be configured in the
Note that some of these ciphers can be disabled at compile time
and some are available only if an appropriate engine is configured
-in the configuration file. The output of the B<enc> command run with
-the B<-I<ciphers>> option (that is B<openssl enc -I<ciphers>>) produces a
-list of ciphers, supported by your version of OpenSSL, including
+in the configuration file. The output when invoking this command
+with the B<-ciphers> option (that is C<openssl enc -ciphers>) is
+a list of ciphers, supported by your version of OpenSSL, including
ones provided by configured engines.
-The B<enc> program does not support authenticated encryption modes
+This command does not support authenticated encryption modes
like CCM and GCM, and will not support such modes in the future.
-The B<enc> interface by necessity must begin streaming output (e.g.,
-to standard output when B<-out> is not used) before the authentication
-tag could be validated, leading to the usage of B<enc> in pipelines
-that begin processing untrusted data and are not capable of rolling
-back upon authentication failure. The AEAD modes currently in common
-use also suffer from catastrophic failure of confidentiality and/or
-integrity upon reuse of key/iv/nonce, and since B<enc> places the
+This is due to having to begin streaming output (e.g., to standard output
+when B<-out> is not used) before the authentication tag could be validated.
+When this command is used in a pipeline, the receiveing end will not be
+able to roll back upon authentication failure. The AEAD modes currently in
+common use also suffer from catastrophic failure of confidentiality and/or
+integrity upon reuse of key/iv/nonce, and since B<openssl enc> places the
entire burden of key/iv/nonce management upon the user, the risk of
exposing AEAD modes is too great to allow. These key/iv/nonce
-management issues also affect other modes currently exposed in B<enc>,
+management issues also affect other modes currently exposed in this command,
but the failure modes are less extreme in these cases, and the
functionality cannot be removed with a stable release branch.
For bulk encryption of data, whether using authenticated encryption
-modes or other modes, L<cms(1)> is recommended, as it provides a
+modes or other modes, L<openssl-cms(1)> is recommended, as it provides a
standard data format and performs the needed key/iv/nonce management.
The B<-A> option when used with large files doesn't work properly.
-The B<enc> program only supports a fixed number of algorithms with
+The B<openssl enc> command only supports a fixed number of algorithms with
certain parameters. So if, for example, you want to use RC2 with a
76 bit key or RC4 with an 84 bit key you can't use this program.
=head1 DESCRIPTION
-The B<engine> command is used to query the status and capabilities
-of the specified I<engine>'s.
+This command is used to query the status and capabilities
+of the specified I<engine>s.
Engines may be specified before and after all other command-line flags.
Only those specified are queried.
=head1 DESCRIPTION
Sometimes an application will not load error message and only
-numerical forms will be available. The B<errstr> utility can be used to
-display the meaning of the hex code. The hex code is the hex digits after the
-second colon.
+numerical forms will be available. This command can be
+used to display the meaning of the hex code. The hex code is the hex digits
+after the second colon.
=head1 OPTIONS
=head1 DESCRIPTION
-This utility is used to generate a FIPS module configuration file.
+This command is used to generate a FIPS module configuration file.
The generated configuration file consists of:
=over 4
=item B<-mac_name> I<name>
Specifies the name of a supported MAC algorithm which will be used.
-To see the list of supported MAC's use the command I<list -mac-algorithms>.
-The default is "HMAC".
+To see the list of supported MAC's use the command
+C<openssl list -mac-algorithms>. The default is B<HMAC>.
=item B<-macopt> I<nm>:I<v>
Used by HMAC as an alphanumeric string (use if the key contains printable
characters only).
The string length must conform to any restrictions of the MAC algorithm.
-To see the list of supported digests, use the command I<list -digest-commands>.
+To see the list of supported digests, use the command
+C<openssl list -digest-commands>.
=back
The MAC mechanisms that are available will depend on the options
used when building OpenSSL.
-The B<list -mac-algorithms> command can be used to list them.
+The command C<openssl list -mac-algorithms> command can be used to list them.
=head1 SEE ALSO
=head1 DESCRIPTION
-The B<gendsa> command generates a DSA private key from a DSA parameter file
-(which will be typically generated by the B<openssl dsaparam> command).
+This command generates a DSA private key from a DSA parameter file
+(which will be typically generated by the L<openssl-dsaparam(1)> command).
=head1 OPTIONS
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<gendsa>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
The DSA parameter file to use. The parameters in this file determine
the size of the private key. DSA parameters can be generated and
-examined using the B<openssl dsaparam> command.
+examined using the L<openssl-dsaparam(1)> command.
=back
=head1 DESCRIPTION
-The B<genpkey> command generates a private key.
+This command generates a private key.
=head1 OPTIONS
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<genpkey>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms. If used this option should precede all other
=head1 DESCRIPTION
-The B<genrsa> command generates an RSA private key.
+This command generates an RSA private key.
=head1 OPTIONS
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<genrsa>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 HISTORY
-The B<openssl info> command was added in OpenSSL 3.0.
+This command was added in OpenSSL 3.0.
=head1 COPYRIGHT
Used by HMAC as an alphanumeric string (use if the key contains printable
characters only).
The string length must conform to any restrictions of the MAC algorithm.
-To see the list of supported digests, use the command I<list -digest-commands>.
+To see the list of supported digests, use C<openssl list -digest-commands>.
=item B<cipher:>I<string>
=item I<mac_name>
Specifies the name of a supported MAC algorithm which will be used.
-To see the list of supported MAC's use the command I<list -mac-algorithms>.
+To see the list of supported MAC's use the command C<opensssl list
+-mac-algorithms>.
=back
The MAC mechanisms that are available will depend on the options
used when building OpenSSL.
-The B<list -mac-algorithms> command can be used to list them.
+Use C<openssl list -mac-algorithms> to list them.
=head1 SEE ALSO
=head1 DESCRIPTION
-The B<nseq> command takes a file containing a Netscape certificate
+This command takes a file containing a Netscape certificate
sequence and prints out the certificates contained in it or takes a
file of certificates and converts it into a Netscape certificate
sequence.
The Online Certificate Status Protocol (OCSP) enables applications to
determine the (revocation) state of an identified certificate (RFC 2560).
-The B<ocsp> command performs many common OCSP tasks. It can be used
+This command performs many common OCSP tasks. It can be used
to print out requests and responses, create requests and send queries
to an OCSP responder and behave like a mini OCSP server itself.
=item B<-rcid> I<digest>
This option sets the digest algorithm to use for certificate identification
-in the OCSP response. Any digest supported by the OpenSSL B<dgst> command can
+in the OCSP response. Any digest supported by the L<openssl-dgst(1)> command can
be used. The default is the same digest algorithm used in the request.
=item B<-I<digest>>
The I<indexfile> parameter is the name of a text index file in B<ca>
format containing certificate revocation information.
-If the B<-index> option is specified the B<ocsp> utility is in responder
-mode, otherwise it is in client mode. The request(s) the responder
+If the B<-index> option is specified then this command switches to
+responder mode, otherwise it is in client mode. The request(s) the responder
processes can be either specified on the command line (using B<-issuer>
and B<-serial> options), supplied in a file (using the B<-reqin> option)
or via external OCSP clients (if B<-port> or B<-url> is specified).
format of revocation is also inefficient for large quantities of revocation
data.
-It is possible to run the B<ocsp> application in responder mode via a CGI
+It is possible to run this command in responder mode via a CGI
script using the B<-reqin> and B<-respout> options.
=head1 EXAMPLES
=head1 DESCRIPTION
-The B<passwd> command computes the hash of a password typed at
+This command computes the hash of a password typed at
run-time or the hash of each password in a list. The password list is
taken from the named file for option B<-in>, from stdin for
option B<-stdin>, or from the command line, or from the terminal otherwise.
=head1 DESCRIPTION
-The B<pkcs12> command allows PKCS#12 files (sometimes referred to as
+This command allows PKCS#12 files (sometimes referred to as
PFX files) to be created and parsed. PKCS#12 files are used by several
programs including Netscape, MSIE and MS Outlook.
These options allow the algorithm used to encrypt the private key and
certificates to be selected. Any PKCS#5 v1.5 or PKCS#12 PBE algorithm name
can be used (see B<NOTES> section for more information). If a cipher name
-(as output by the B<list-cipher-algorithms> command is specified then it
+(as output by C<openssl list -cipher-algorithms>) is specified then it
is used with PKCS#5 v2.0. For interoperability reasons it is advisable to only
use PKCS#12 algorithms.
=item B<-CApath> I<dir>
CA storage as a directory. This directory must be a standard certificate
-directory: that is a hash of each subject name (using B<x509 -hash>) should be
-linked to each certificate.
+directory: that is a hash of each subject name (using C<openssl x509 -hash>)
+should be linked to each certificate.
=item B<-no-CAfile>
the defaults are fine but occasionally software can't handle triple DES
encrypted private keys, then the option B<-keypbe> I<PBE-SHA1-RC2-40> can
be used to reduce the private key encryption to 40 bit RC2. A complete
-description of all algorithms is contained in the B<pkcs8> manual page.
+description of all algorithms is contained in L<openssl-pkcs8(1)>.
Prior 1.1 release passwords containing non-ASCII characters were encoded
in non-compliant manner, which limited interoperability, in first hand
data. If you use PKCS#12 files in production application you are advised
to convert the data, because implemented heuristic approach is not
MT-safe, its sole goal is to facilitate the data upgrade with this
-utility.
+command.
=head1 EXAMPLES
=head1 DESCRIPTION
-The B<pkcs7> command processes PKCS#7 files in DER or PEM format.
+This command processes PKCS#7 files in DER or PEM format.
=head1 OPTIONS
=item B<-engine> I<id>
-Specifying an engine (by its unique B<id> string) will cause B<pkcs7>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 DESCRIPTION
-The B<pkcs8> command processes private keys in PKCS#8 format. It can handle
+This command processes private keys in PKCS#8 format. It can handle
both unencrypted PKCS#8 PrivateKeyInfo format and EncryptedPrivateKeyInfo
format with a variety of PKCS#5 (v1.5 and v2.0) and PKCS#12 algorithms.
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<pkcs8>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 KEY FORMATS
-Various different formats are used by the pkcs8 utility. These are detailed
+Various different formats are used by this command. These are detailed
below.
If a key is being converted from PKCS#8 form (i.e. the B<-topk8> option is
=head1 DESCRIPTION
-The B<pkey> command processes public or private keys. They can be converted
-between various forms and their components printed out.
+This command processes public or private keys. They can be
+converted between various forms and their components printed out.
=head1 OPTIONS
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<pkey>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 DESCRIPTION
-The B<pkeyparam> command processes public key algorithm parameters.
+This command processes public key algorithm parameters.
They can be checked for correctness and their components printed out.
=head1 OPTIONS
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<pkeyparam>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 DESCRIPTION
-The B<pkeyutl> command can be used to perform low level public key operations
-using any supported algorithm.
+This command can be used to perform low level public key
+operations using any supported algorithm.
=head1 OPTIONS
is omitted but the signature algorithm requires one, a default value will be
used. For signature algorithms like RSA, DSA and ECDSA, SHA-256 will be the
default digest algorithm. For SM2, it will be SM3. If this option is present,
-then the B<-rawin> option must be also specified to B<pkeyutl>.
+then the B<-rawin> option must be also specified.
=item B<-out> I<filename>
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<pkeyutl>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
The value I<alg> should represent a digest name as used in the
EVP_get_digestbyname() function for example B<sha1>. This value is not used to
hash the input data. It is used (by some algorithms) for sanity-checking the
-lengths of data passed in to the B<pkeyutl> and for creating the structures that
-make up the signature (e.g. B<DigestInfo> in RSASSA PKCS#1 v1.5 signatures).
+lengths of data passed in and for creating the structures that make up the
+signature (e.g. B<DigestInfo> in RSASSA PKCS#1 v1.5 signatures).
-This utility does not hash the input data (except where -rawin is used) but
+This command does not hash the input data (except where -rawin is used) but
rather it will use the data directly as input to the signature algorithm.
Depending on the key type, signature type, and mode of padding, the maximum
acceptable lengths of input data differ. The signed data can't be longer than
=head1 DESCRIPTION
-The B<prime> command checks if the specified numbers are prime.
+This command checks if the specified numbers are prime.
If no numbers are given on the command line, the B<-generate> flag should
be used to generate primes according to the requirements specified by the
=head1 DESCRIPTION
-The B<provider> command is used to query the capabilities of the specified
-I<provider>'s.
+This command is used to query the capabilities of the
+
specified I<provider>'s.
=head1 OPTIONS
=head1 DESCRIPTION
-The B<rand> command outputs I<num> pseudo-random bytes after seeding
+This command outputs I<num> pseudo-random bytes after seeding
the random number generator once. As in other B<openssl> command
line tools, PRNG seeding uses the file I<$HOME/>B<.rnd> or B<.rnd>
in addition to the files given in the B<-rand> option. A new
=head1 DESCRIPTION
-On some platforms, the OpenSSL B<rehash> command is available as
-an external script called B<c_rehash>. They are functionally equivalent,
-except for minor differences noted below.
+On some platforms, this command isn't available, and the external
+script B<c_rehash> has to be used instead. They are functionally
+equivalent, except for minor differences noted below.
-B<rehash> scans directories and calculates a hash value of each
-C<.pem>, C<.crt>, C<.cer>, or C<.crl>
+B<openssl rehash> scans directories and calculates a hash value of
+each C<.pem>, C<.crt>, C<.cer>, or C<.crl>
file in the specified directory list and creates symbolic links
for each file, where the name of the link is the hash value.
(If the platform does not support symbolic links, a copy is made.)
-This utility is useful as many programs that use OpenSSL require
+This command is useful as many programs that use OpenSSL require
directories to be set up like this in order to find certificates.
If any directories are named on the command line, then those are
The links created are of the form I<HHHHHHHH.D>, where each I<H>
is a hexadecimal character and I<D> is a single decimal digit.
-When processing a directory, B<rehash> will first remove all links
-that have a name in that syntax, even if they are being used for some
-other purpose.
+When a directory is processed, all links in it that have a name
+in that syntax are first removed, even if they are being used for
+some other purpose.
To skip the removal step, use the B<-n> flag.
Hashes for CRL's look similar except the letter B<r> appears after
the period, like this: I<HHHHHHHH.>B<r>I<D>.
=item B<-v>
Print messages about old links removed and new links created.
-By default, B<rehash> only lists each directory as it is processed.
+By default, this command only lists each directory as it is processed.
=back
=head1 DESCRIPTION
-The B<req> command primarily creates and processes certificate requests
+This command primarily creates and processes certificate requests
in PKCS#10 format. It can additionally create self signed certificates
for use as root CAs for example.
the default key size, specified in the configuration file is used.
All other algorithms support the B<-newkey> I<alg>:I<file> form, where file
-may be an algorithm parameter file, created with B<genpkey -genparam>
+may be an algorithm parameter file, created with C<openssl genpkey -genparam>
or an X.509 certificate for a key with appropriate algorithm.
B<param:>I<file> generates a key using the parameter file or certificate
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<req>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
OU=My Organization
emailAddress=someone@somewhere.org
-This allows external programs (e.g. GUI based) to generate a template file
-with all the field names and values and just pass it to B<req>. An example
+This allows external programs (e.g. GUI based) to generate a template file with
+all the field names and values and just pass it to this command. An example
of this kind of configuration file is contained in the B<EXAMPLES> section.
Alternatively if the B<prompt> option is absent or not set to B<no> then the
=head1 DESCRIPTION
-The B<rsa> command processes RSA keys. They can be converted between various
-forms and their components printed out. B<Note> this command uses the
+This command processes RSA keys. They can be converted between
+various forms and their components printed out. B<Note> this command uses the
traditional SSLeay compatible format for private key encryption: newer
-applications should use the more secure PKCS#8 format using the B<pkcs8>
-utility.
+applications should use the more secure PKCS#8 format using the
+L<openssl-pkcs8(1)> command.
=head1 OPTIONS
These options encrypt the private key with the specified
cipher before outputting it. A pass phrase is prompted for.
If none of these options is specified the key is written in plain text. This
-means that using the B<rsa> utility to read in an encrypted key with no
-encryption option can be used to remove the pass phrase from a key, or by
-setting the encryption options it can be use to add or change the pass phrase.
+means that this command can be used to remove the pass phrase from a key
+by not giving any encryption option is given, or to add or change the pass
+phrase by setting them.
These options can only be used with PEM format output files.
=item B<-text>
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<rsa>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 DESCRIPTION
-The B<rsautl> command can be used to sign, verify, encrypt and decrypt
+This command can be used to sign, verify, encrypt and decrypt
data using the RSA algorithm.
=head1 OPTIONS
=head1 NOTES
-B<rsautl> because it uses the RSA algorithm directly can only be
+Since this command uses the RSA algorithm directly, it can only be
used to sign or verify small pieces of data.
=head1 EXAMPLES
and random padding data visible instead of the 0xff bytes.
It is possible to analyse the signature of certificates using this
-utility in conjunction with B<asn1parse>. Consider the self signed
-example in certs/pca-cert.pem . Running B<asn1parse> as follows yields:
+utility in conjunction with L<openssl-asn1parse(1)>. Consider the self signed
+example in certs/pca-cert.pem . Running L<openssl-asn1parse(1)> as follows
+yields:
openssl asn1parse -in pca-cert.pem
=head1 DESCRIPTION
-The B<s_client> command implements a generic SSL/TLS client which connects
-to a remote host using SSL/TLS. It is a I<very> useful diagnostic tool for
-SSL servers.
+This command implements a generic SSL/TLS client which
+connects to a remote host using SSL/TLS. It is a I<very> useful diagnostic
+tool for SSL servers.
=head1 OPTIONS
-In addition to the options below the B<s_client> utility also supports the
+In addition to the options below, this command also supports the
common and client only options documented
in the "Supported Command Line Commands" section of the L<SSL_CONF_cmd(3)>
manual page.
=item B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-tls1_3>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>, B<-no_tls1_3>
These options require or disable the use of the specified SSL or TLS protocols.
-By default B<s_client> will negotiate the highest mutually supported protocol
+By default, this command will negotiate the highest mutually supported protocol
version.
When a specific TLS version is required, only that version will be offered to
and accepted from the server.
=item B<-dtls>, B<-dtls1>, B<-dtls1_2>
-These options make B<s_client> use DTLS protocols instead of TLS.
-With B<-dtls>, B<s_client> will negotiate any supported DTLS protocol version,
+These options make this command use DTLS protocols instead of TLS.
+With B<-dtls>, it will negotiate any supported DTLS protocol version,
whilst B<-dtls1> and B<-dtls1_2> will only support DTLS1.0 and DTLS1.2
respectively.
This allows the TLSv1.2 and below cipher list sent by the client to be modified.
This list will be combined with any TLSv1.3 ciphersuites that have been
configured. Although the server determines which ciphersuite is used it should
-take the first supported cipher in the list sent by the client. See the
-B<ciphers> command for more information.
+take the first supported cipher in the list sent by the client. See
+L<openssl-ciphers(1)> for more information.
=item B<-ciphersuites> I<val>
This allows the TLSv1.3 ciphersuites sent by the client to be modified. This
list will be combined with any TLSv1.2 and below ciphersuites that have been
configured. Although the server determines which cipher suite is used it should
-take the first supported cipher in the list sent by the client. See the
-B<ciphers> command for more information. The format for this list is a simple
+take the first supported cipher in the list sent by the client. See
+L<openssl-ciphers(1)> for more information. The format for this list is a simple
colon (":") separated list of TLSv1.3 ciphersuite names.
=item B<-starttls> I<protocol>
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<s_client>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 NOTES
-B<s_client> can be used to debug SSL servers. To connect to an SSL HTTP
+This command can be used to debug SSL servers. To connect to an SSL HTTP
server the command:
openssl s_client -connect servername:443
is that a web client complains it has no certificates or gives an empty
list to choose from. This is normally because the server is not sending
the clients certificate authority in its "acceptable CA list" when it
-requests a certificate. By using B<s_client> the CA list can be viewed
+requests a certificate. By using this command, the CA list can be viewed
and checked. However some servers only request client authentication
after a specific URL is requested. To obtain the list in this case it
is necessary to use the B<-prexit> option and send an HTTP request
B<-showcerts> option can be used to show all the certificates sent by the
server.
-The B<s_client> utility is a test tool and is designed to continue the
+This command is a test tool and is designed to continue the
handshake after any certificate verification errors. As a result it will
accept any certificate chain (trusted or not) sent by the peer. None test
applications should B<not> do this as it makes them vulnerable to a MITM
=head1 BUGS
Because this program has a lot of options and also because some of the
-techniques used are rather old, the C source of B<s_client> is rather hard to
-read and not a model of how things should be done.
+techniques used are rather old, the C source for this command is rather
+hard to read and not a model of how things should be done.
A typical SSL client program would be much simpler.
The B<-prexit> option is a bit of a hack. We should really report
=head1 DESCRIPTION
-The B<s_server> command implements a generic SSL/TLS server which listens
-for connections on a given port using SSL/TLS.
+This command implements a generic SSL/TLS server which
+listens for connections on a given port using SSL/TLS.
=head1 OPTIONS
-In addition to the options below the B<s_server> utility also supports the
-common and server only options documented
+In addition to the options below, this command also supports
+the common and server only options documented
in the "Supported Command Line Commands" section of the L<SSL_CONF_cmd(3)>
manual page.
=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-tls1_3>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>, B<-no_tls1_3>
These options require or disable the use of the specified SSL or TLS protocols.
-By default B<s_server> will negotiate the highest mutually supported protocol
-version.
+By default, this command will negotiate the highest mutually supported
+protocol version.
When a specific TLS version is required, only that version will be accepted
from the client.
Note that not all protocols and flags may be available, depending on how
configured. When the client sends a list of supported ciphers the first client
cipher also included in the server list is used. Because the client specifies
the preference order, the order of the server cipherlist is irrelevant. See
-the B<ciphers> command for more information.
+L<openssl-ciphers(1)> for more information.
=item B<-ciphersuites> I<val>
configured. When the client sends a list of supported ciphers the first client
cipher also included in the server list is used. Because the client specifies
the preference order, the order of the server cipherlist is irrelevant. See
-the B<ciphers> command for more information. The format for this list is a
-simple colon (":") separated list of TLSv1.3 ciphersuite names.
+L<openssl-ciphers(1)> command for more information. The format for this list is
+a simple colon (":") separated list of TLSv1.3 ciphersuite names.
=item B<-dhparam> I<infile>
The DH parameter file to use. The ephemeral DH cipher suites generate keys
using a set of DH parameters. If not specified then an attempt is made to
load the parameters from the server certificate file.
-If this fails then a static set of parameters hard coded into the B<s_server>
-program will be used.
+If this fails then a static set of parameters hard coded into this command
+will be used.
=item B<-attime>, B<-check_ss_sig>, B<-crl_check>, B<-crl_check_all>,
B<-explicit_policy>, B<-extended_crl>, B<-ignore_critical>, B<-inhibit_any>,
=item B<-listen>
This option can only be used in conjunction with one of the DTLS options above.
-With this option B<s_server> will listen on a UDP port for incoming connections.
+With this option, this command will listen on a UDP port for incoming
+connections.
Any ClientHellos that arrive will be checked to see if they have a cookie in
them or not.
Any without a cookie will be responded to with a HelloVerifyRequest.
-If a ClientHello with a cookie is received then B<s_server> will connect to
-that peer and complete the handshake.
+If a ClientHello with a cookie is received then this command will
+connect to that peer and complete the handshake.
=item B<-dtls>, B<-dtls1>, B<-dtls1_2>
-These options make B<s_server> use DTLS protocols instead of TLS.
-With B<-dtls>, B<s_server> will negotiate any supported DTLS protocol version,
-whilst B<-dtls1> and B<-dtls1_2> will only support DTLSv1.0 and DTLSv1.2
-respectively.
+These options make this command use DTLS protocols instead of TLS.
+With B<-dtls>, it will negotiate any supported DTLS protocol
+version, whilst B<-dtls1> and B<-dtls1_2> will only support DTLSv1.0 and
+DTLSv1.2 respectively.
=item B<-sctp>
=item B<-engine> I<val>
-Specifying an engine (by its unique id string in I<val>) will cause B<s_server>
-to attempt to obtain a functional reference to the specified engine,
-thus initialising it if needed. The engine will then be set as the default
-for all available algorithms.
+Specifying an engine (by its unique id string in I<val>) will cause
+this command to attempt to obtain a functional reference to the
+specified engine, thus initialising it if needed. The engine will then be
+set as the default for all available algorithms.
=item B<-keylogfile> I<outfile>
=head1 NOTES
-B<s_server> can be used to debug SSL clients. To accept connections from
-a web browser the command:
+This command can be used to debug SSL clients. To accept connections
+from a web browser the command:
openssl s_server -accept 443 -www
is strictly speaking a protocol violation, some SSL clients interpret this to
mean any CA is acceptable. This is useful for debugging purposes.
-The session parameters can printed out using the B<sess_id> program.
+The session parameters can printed out using the L<openssl-sess_id(1)> command.
=head1 BUGS
Because this program has a lot of options and also because some of the
-techniques used are rather old, the C source of B<s_server> is rather hard to
-read and not a model of how things should be done.
+techniques used are rather old, the C source for this command is rather
+hard to read and not a model of how things should be done.
A typical SSL server program would be much simpler.
The output of common ciphers is wrong: it just gives the list of ciphers that
OpenSSL recognizes and the client supports.
-There should be a way for the B<s_server> program to print out details of any
-unknown cipher suites a client says it supports.
+There should be a way for this command to print out details
+of any unknown cipher suites a client says it supports.
=head1 SEE ALSO
=head1 DESCRIPTION
-The B<s_time> command implements a generic SSL/TLS client which connects to a
-remote host using SSL/TLS. It can request a page from the server and includes
-the time to transfer the payload data in its timing measurements. It measures
-the number of connections within a given timeframe, the amount of data
-transferred (if any), and calculates the average time spent for one connection.
+This command implements a generic SSL/TLS client which
+connects to a remote host using SSL/TLS. It can request a page from the server
+and includes the time to transfer the payload data in its timing measurements.
+It measures the number of connections within a given timeframe, the amount of
+data transferred (if any), and calculates the average time spent for one
+connection.
=head1 OPTIONS
=item B<-www> I<page>
This specifies the page to GET from the server. A value of '/' gets the
-index.htm[l] page. If this parameter is not specified, then B<s_time> will only
-perform the handshake to establish SSL connections but not transfer any
-payload data.
+index.htm[l] page. If this parameter is not specified, then this command
+will only perform the handshake to establish SSL connections but not transfer
+any payload data.
=item B<-cert> I<certname>
=item B<-CApath> I<directory>
The directory to use for server certificate verification. This directory
-must be in "hash format", see B<verify> for more information. These are
-also used when building the client certificate chain.
+must be in "hash format", see L<openssl-verify(1)> for more information.
+These are also used when building the client certificate chain.
=item B<-CAfile> I<file>
=item B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-tls1_3>
These options enable specific SSL or TLS protocol versions for the handshake
-initiated by B<s_time>.
-By default B<s_time> negotiates the highest mutually supported protocol
+initiated by this command.
+By default, it negotiates the highest mutually supported protocol
version.
Note that not all protocols and flags may be available, depending on how
OpenSSL was built.
=item B<-time> I<length>
-Specifies how long (in seconds) B<s_time> should establish connections and
-optionally transfer payload data from a server. Server and client performance
-and the link speed determine how many connections B<s_time> can establish.
+Specifies how long (in seconds) this command should establish connections
+and optionally transfer payload data from a server. Server and client
+performance and the link speed determine how many connections it
+can establish.
=back
=head1 NOTES
-B<s_time> can be used to measure the performance of an SSL connection.
+This command can be used to measure the performance of an SSL connection.
To connect to an SSL HTTP server and get the default page the command
openssl s_time -connect servername:443 -www / -CApath yourdir -CAfile yourfile.pem -cipher commoncipher [-ssl3]
would typically be used (https uses port 443). I<commoncipher> is a cipher to
-which both client and server can agree, see the L<ciphers(1)> command
+which both client and server can agree, see the L<openssl-ciphers(1)> command
for details.
If the handshake fails then there are several possible causes, if it is
=head1 DESCRIPTION
-The B<sess_id> process the encoded version of the SSL session structure
-and optionally prints out SSL session details (for example the SSL session
-master key) in human readable format. Since this is a diagnostic tool that
-needs some knowledge of the SSL protocol to use properly, most users will
-not need to use it.
+This command processes the encoded version of the SSL session
+structure and optionally prints out SSL session details (for example
+the SSL session master key) in human readable format. Since this is a
+diagnostic tool that needs some knowledge of the SSL protocol to use
+properly, most users will not need to use it.
=head1 OPTIONS
=head1 DESCRIPTION
-The B<smime> command handles S/MIME mail. It can encrypt, decrypt, sign and
-verify S/MIME messages.
+This command handles S/MIME mail. It can encrypt, decrypt, sign
+and verify S/MIME messages.
=head1 OPTIONS
A directory containing trusted CA certificates, only used with
B<-verify>. This directory must be a standard certificate directory: that
-is a hash of each subject name (using B<x509 -hash>) should be linked
+is a hash of each subject name (using C<openssl x509 -hash>) should be linked
to each certificate.
=item B<-no-CAfile>
The encryption algorithm to use. For example DES (56 bits) - B<-des>,
triple DES (168 bits) - B<-des3>,
EVP_get_cipherbyname() function) can also be used preceded by a dash, for
-example B<-aes-128-cbc>. See L<B<enc>|enc(1)> for list of ciphers
+example B<-aes-128-cbc>. See L<openssl-enc(1)> for list of ciphers
supported by your version of OpenSSL.
If not specified triple DES is used. Only used with B<-encrypt>.
=head1 DESCRIPTION
This command is used to test the performance of cryptographic algorithms.
-To see the list of supported algorithms, use the I<list --digest-commands>
-or I<list --cipher-commands> command. The global CSPRNG is denoted by
+To see the list of supported algorithms, use C<openssl list -digest-commands>
+or C<openssl list -cipher-commands> command. The global CSPRNG is denoted by
the B<rand> algorithm name.
=head1 OPTIONS
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<speed>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=item B<-cmac> I<cipher>
-Time the CMAC algorithm using the specified cipher e.g. B<speed -cmac aes128>.
+Time the CMAC algorithm using the specified cipher e.g.
+C<openssl speed -cmac aes128>.
=item B<-decrypt>
=item I<algorithm> ...
-If any options are given, B<speed> tests those algorithms, otherwise a
+If any I<algorithm> is given, then those algorithms are tested, otherwise a
pre-compiled grand selection is tested.
=back
=head1 DESCRIPTION
-The B<spkac> command processes Netscape signed public key and challenge
+This command processes Netscape signed public key and challenge
(SPKAC) files. It can print out their contents, verify the signature and
produce its own SPKACs from a supplied private key.
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<spkac>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
=head1 NOTES
-A created SPKAC with suitable DN components appended can be fed into
-the B<ca> utility.
+A created SPKAC with suitable DN components appended can be fed to
+L<openssl-ca(1)>.
SPKACs are typically generated by Netscape when a form is submitted
containing the B<KEYGEN> tag as part of the certificate enrollment
=head1 DESCRIPTION
-The B<srp> command is used to maintain an SRP (secure remote password)
-file.
+This command is used to maintain an SRP (secure remote password) file.
At most one of the B<-add>, B<-modify>, B<-delete>, and B<-list> options
can be specified.
These options take zero or more usernames as parameters and perform the
=head1 DESCRIPTION
-The B<storeutl> command can be used to display the contents (after decryption
-as the case may be) fetched from the given URIs.
+This command can be used to display the contents (after
+decryption as the case may be) fetched from the given URIs.
=head1 OPTIONS
=item B<-text>
Prints out the objects in text form, similarly to the B<-text> output from
-B<openssl x509>, B<openssl pkey>, etc.
+L<openssl-x509(1)>, L<openssl-pkey(1)>, etc.
=item B<-engine> I<id>
-specifying an engine (by its unique I<id> string) will cause B<storeutl>
+specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed.
The engine will then be set as the default for all available algorithms.
=head1 HISTORY
-The B<openssl> B<storeutl> app was added in OpenSSL 1.1.1.
+This command was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
=head1 DESCRIPTION
-The B<ts> command is a basic Time Stamping Authority (TSA) client and server
-application as specified in RFC 3161 (Time-Stamp Protocol, TSP). A
+This command is a basic Time Stamping Authority (TSA) client and
+server application as specified in RFC 3161 (Time-Stamp Protocol, TSP). A
TSA can be part of a PKI deployment and its role is to provide long
term proof of the existence of a certain datum before a particular
time. Here is a brief description of the protocol:
There is one DER encoded protocol data unit defined for transporting a time
stamp request to the TSA and one for sending the timestamp response
-back to the client. The B<ts> command has three main functions:
+back to the client. This command has three main functions:
creating a timestamp request based on a data file,
creating a timestamp response based on a request, verifying if a
response corresponds to a particular request or a data file.
=item B<-I<digest>>
The message digest to apply to the data file.
-Any digest supported by the OpenSSL B<dgst> command can be used.
+Any digest supported by the L<openssl-dgst(1)> command can be used.
The default is SHA-256. (Optional)
=item B<-tspolicy> I<object_id>
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<ts>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms. Default is built-in. (Optional)
B<-suiteB_192>, B<-trusted_first>, B<-use_deltas>, B<-auth_level>,
B<-verify_depth>, B<-verify_email>, B<-verify_hostname>, B<-verify_ip>,
B<-verify_name>, and B<-x509_strict> can be used to control timestamp
-verification. See L<verify(1)>.
+verification. See L<openssl-verify(1)>.
=back
=head1 DESCRIPTION
-The B<tsget> command can be used for sending a timestamp request, as
-specified in B<RFC 3161>, to a timestamp server over HTTP or HTTPS and storing
-the timestamp response in a file. This tool cannot be used for creating the
-requests and verifying responses, you can use the OpenSSL B<ts(1)> command to
-do that. B<tsget> can send several requests to the server without closing
-the TCP connection if more than one requests are specified on the command
-line.
+This command can be used for sending a timestamp request, as specified
+in B<RFC 3161>, to a timestamp server over HTTP or HTTPS and storing the
+timestamp response in a file. It cannot be used for creating the requests
+and verifying responses, you have to use L<openssl-ts(1)> to do that. This
+command can send several requests to the server without closing the TCP
+connection if more than one requests are specified on the command line.
-The tool sends the following HTTP request for each timestamp request:
+This command sends the following HTTP request for each timestamp request:
POST url HTTP/1.1
User-Agent: OpenTSA tsget.pl/<version>
...binary request specified by the user...
-B<tsget> expects a response of type application/timestamp-reply, which is
+It expects a response of type application/timestamp-reply, which is
written to a file without any interpretation.
=head1 OPTIONS
=item B<-p> key_password
(HTTPS) Specifies the passphrase for the private key specified by the B<-k>
-argument. If this option is omitted and the key is passphrase protected B<tsget>
-will ask for it. (Optional)
+argument. If this option is omitted and the key is passphrase protected,
+it will be prompted for. (Optional)
=item B<-c> client_cert.pem
=item B<-P> CA_path
(HTTPS) The path containing the trusted CA certificates to verify the peer's
-certificate. The directory must be prepared with the B<c_rehash>
-OpenSSL utility. Either option B<-C> or option B<-P> must be given in case of
-HTTPS. (Optional)
+certificate. The directory must be prepared with L<openssl-rehash(1)>. Either
+option B<-C> or option B<-P> must be given in case of HTTPS. (Optional)
=item B<-rand> file:file...
=head1 DESCRIPTION
-The B<verify> command verifies certificate chains.
+This command verifies certificate chains.
=head1 OPTIONS
=item B<-CApath> I<directory>
A directory of trusted certificates. The certificates should have names
-of the form: F<I<hash>.0> or have symbolic links to them of this
-form (I<hash> is the hashed certificate subject name: see the B<-hash> option
-of the B<x509> utility). Under Unix the B<c_rehash> script will automatically
-create symbolic links to a directory of certificates.
+of the form: F<I<hash>.0> or have symbolic links to them of this form
+(I<hash> is the hashed certificate subject name: see the L<openssl-x509(1)>
+B<-hash> option). Under Unix, L<openssl-rehash(1)> will automatically create
+symbolic links to a directory of certificates.
=item B<-no-CAfile>
=item B<-engine> I<id>
-Specifying an engine I<id> will cause L<verify(1)> to attempt to load the
+Specifying an engine I<id> will cause this command to attempt to load the
specified engine.
The engine will then be set as the default for all its supported algorithms.
If you want to load certificates or CRLs that require engine support via any of
=item B<-purpose> I<purpose>
The intended use for the certificate. If this option is not specified,
-B<verify> will not consider certificate purpose during chain verification.
+this command will not consider certificate purpose during chain
+verification.
Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
information.
policies identified by I<name>.
The trust model determines which auxiliary trust or reject OIDs are applicable
to verifying the given certificate chain.
-See the B<-addtrust> and B<-addreject> options of the L<x509(1)> command-line
-utility.
+See the B<-addtrust> and B<-addreject> options for L<openssl-x509(1)>.
Supported policy names include: B<default>, B<pkcs7>, B<smime_sign>,
B<ssl_client>, B<ssl_server>.
These mimics the combinations of purpose and trust settings used in SSL, CMS
=item I<certificate> ...
-One or more certificates to verify. If no certificates are given, B<verify>
-will attempt to read a certificate from standard input. Certificates must be
-in PEM format.
+One or more certificates to verify. If no certificates are given,
+this command will attempt to read a certificate from standard input.
+Certificates must be in PEM format.
=back
=head1 VERIFY OPERATION
-The B<verify> program uses the same functions as the internal SSL and S/MIME
-verification, therefore this description applies to these verify operations
-too.
+This command uses the same functions as the internal SSL
+and S/MIME verification, therefore this description applies to these verify
+operations too.
There is one crucial difference between the verify operations performed
-by the B<verify> program: wherever possible an attempt is made to continue
-after an error whereas normally the verify operation would halt on the
-first error. This allows all the problems with a certificate chain to be
+by this command: wherever possible an attempt is made to
+continue after an error whereas normally the verify operation would halt on
+the first error. This allows all the problems with a certificate chain to be
determined.
The verify operation consists of a number of separate steps.
=head1 NOTES
-The output of B<openssl version -a> would typically be used when sending
+The output of C<openssl version -a> would typically be used when sending
in a bug report.
=head1 COPYRIGHT
=head1 DESCRIPTION
-The B<x509> command is a multi purpose certificate utility. It can be
-used to display certificate information, convert certificates to
+This command is a multi purpose certificate utility. It can
+be used to display certificate information, convert certificates to
various forms, sign certificate requests like a "mini CA" or edit
certificate trust settings.
The digest to use.
This affects any signing or display option that uses a message
digest, such as the B<-fingerprint>, B<-signkey> and B<-CA> options.
-Any digest supported by the OpenSSL B<dgst> command can be used.
+Any digest supported by the L<openssl-dgst(1)> command can be used.
If not specified then SHA1 is used with B<-fingerprint> or
the default digest for the signing algorithm is used, typically SHA256.
=item B<-engine> I<id>
-Specifying an engine (by its unique I<id> string) will cause B<x509>
+Specifying an engine (by its unique I<id> string) will cause this command
to attempt to obtain a functional reference to the specified engine,
thus initialising it if needed. The engine will then be set as the default
for all available algorithms.
control over the purposes the root CA can be used for. For example a CA
may be trusted for SSL client but not SSL server use.
-See the description of the B<verify> utility for more information on the
-meaning of trust settings.
+See the description in L<openssl-verify(1)> for more information
+on the meaning of trust settings.
Future versions of OpenSSL will recognize trust settings on any
certificate: not just root CAs.
=item B<-trustout>
-This causes B<x509> to output a B<trusted> certificate. An ordinary
+Output a B<trusted> certificate rather than an ordinary. An ordinary
or trusted certificate can be input but by default an ordinary
certificate is output and any trust settings are discarded. With the
B<-trustout> option a trusted certificate is output. A trusted
=head2 Signing Options
-The B<x509> utility can be used to sign certificates and requests: it
+This command can be used to sign certificates and requests: it
can thus behave like a "mini CA".
=over 4
=item B<-CA> I<filename>
Specifies the CA certificate to be used for signing. When this option is
-present B<x509> behaves like a "mini CA". The input file is signed by this
-CA using this option: that is its issuer name is set to the subject name
+present, this command behaves like a "mini CA". The input file is signed by
+this CA using this option: that is its issuer name is set to the subject name
of the CA and it is digitally signed using the CAs private key.
This option is normally combined with the B<-req> option. Without the
=item B<ca_default>
-The value used by the B<ca> utility, equivalent to B<no_issuer>, B<no_pubkey>,
+The value used by L<openssl-ca(1)>, equivalent to B<no_issuer>, B<no_pubkey>,
B<no_header>, and B<no_version>.
=back
The hash algorithm used in the B<-subject_hash> and B<-issuer_hash> options
before OpenSSL 1.0.0 was based on the deprecated MD5 algorithm and the encoding
-of the distinguished name. In OpenSSL 1.0.0 and later it is based on a
-canonical version of the DN using SHA1. This means that any directories using
-the old form must have their links rebuilt using B<c_rehash> or similar.
+of the distinguished name. In OpenSSL 1.0.0 and later it is based on a canonical
+version of the DN using SHA1. This means that any directories using the old
+form must have their links rebuilt using L<openssl-rehash(1)> or similar.
=head1 COPYRIGHT
The list options B<-standard-commands>, B<-digest-commands>,
and B<-cipher-commands> output a list (one entry per line) of the names
of all standard commands, message digest commands, or cipher commands,
-respectively, that are available in the present B<openssl> utility.
+respectively, that are available.
The list parameters B<-cipher-algorithms>, B<-digest-algorithms>,
and B<-mac-algorithms> list all cipher, message digest, and message
projects / oweals / openssl.git / commitdiff