diff options
Diffstat (limited to 'secure/usr.bin/openssl/man/ca.1')
| -rw-r--r-- | secure/usr.bin/openssl/man/ca.1 | 89 |
1 files changed, 58 insertions, 31 deletions
diff --git a/secure/usr.bin/openssl/man/ca.1 b/secure/usr.bin/openssl/man/ca.1 index 90878dbea0e1..223f46464c37 100644 --- a/secure/usr.bin/openssl/man/ca.1 +++ b/secure/usr.bin/openssl/man/ca.1 @@ -1,4 +1,4 @@ -.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.23) +.\" Automatically generated by Pod::Man 2.27 (Pod::Simple 3.28) .\" .\" Standard preamble: .\" ======================================================================== @@ -38,6 +38,8 @@ . ds PI \(*p . ds L" `` . ds R" '' +. ds C` +. ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. @@ -48,17 +50,24 @@ .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. -.ie \nF \{\ -. de IX -. tm Index:\\$1\t\\n%\t"\\$2" +.\" +.\" Avoid warning from groff about undefined register 'F'. +.de IX .. -. nr % 0 -. rr F -.\} -.el \{\ -. de IX +.nr rF 0 +.if \n(.g .if rF .nr rF 1 +.if (\n(rF:(\n(.g==0)) \{ +. if \nF \{ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" .. +. if !\nF==2 \{ +. nr % 0 +. nr F 2 +. \} +. \} .\} +.rr rF .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. @@ -124,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "CA 1" -.TH CA 1 "2013-02-11" "1.0.1e" "OpenSSL" +.TH CA 1 "2015-01-15" "1.0.1l" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -139,6 +148,8 @@ ca \- sample minimal CA application [\fB\-name section\fR] [\fB\-gencrl\fR] [\fB\-revoke file\fR] +[\fB\-status serial\fR] +[\fB\-updatedb\fR] [\fB\-crl_reason reason\fR] [\fB\-crl_hold instruction\fR] [\fB\-crl_compromise time\fR] @@ -152,6 +163,7 @@ ca \- sample minimal CA application [\fB\-md arg\fR] [\fB\-policy arg\fR] [\fB\-keyfile arg\fR] +[\fB\-keyform PEM|DER\fR] [\fB\-key arg\fR] [\fB\-passin arg\fR] [\fB\-cert file\fR] @@ -193,15 +205,15 @@ specifies the configuration file section to use (overrides .IP "\fB\-in filename\fR" 4 .IX Item "-in filename" an input filename containing a single certificate request to be -signed by the \s-1CA\s0. +signed by the \s-1CA.\s0 .IP "\fB\-ss_cert filename\fR" 4 .IX Item "-ss_cert filename" -a single self signed certificate to be signed by the \s-1CA\s0. +a single self signed certificate to be signed by the \s-1CA.\s0 .IP "\fB\-spkac filename\fR" 4 .IX Item "-spkac filename" a file containing a single Netscape signed public key and challenge -and additional field values to be signed by the \s-1CA\s0. See the \fB\s-1SPKAC\s0 \s-1FORMAT\s0\fR -section for information on the required format. +and additional field values to be signed by the \s-1CA.\s0 See the \fB\s-1SPKAC FORMAT\s0\fR +section for information on the required input and output format. .IP "\fB\-infiles\fR" 4 .IX Item "-infiles" if present this should be the last option, all subsequent arguments @@ -210,7 +222,7 @@ are assumed to be the names of files containing certificate requests. .IX Item "-out filename" the output file to output certificates to. The default is standard output. The certificate details will also be printed out to this -file. +file in \s-1PEM\s0 format (except that \fB\-spkac\fR outputs \s-1DER\s0 format). .IP "\fB\-outdir directory\fR" 4 .IX Item "-outdir directory" the directory to output certificates to. The certificate will be @@ -222,6 +234,10 @@ the \s-1CA\s0 certificate file. .IP "\fB\-keyfile filename\fR" 4 .IX Item "-keyfile filename" the private key to sign requests with. +.IP "\fB\-keyform PEM|DER\fR" 4 +.IX Item "-keyform PEM|DER" +the format of the data in the private key file. +The default is \s-1PEM.\s0 .IP "\fB\-key password\fR" 4 .IX Item "-key password" the password used to encrypt the private key. Since on some @@ -243,7 +259,7 @@ self-signed certificate. .IP "\fB\-passin arg\fR" 4 .IX Item "-passin arg" the key password source. For more information about the format of \fBarg\fR -see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). +see the \fB\s-1PASS PHRASE ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). .IP "\fB\-verbose\fR" 4 .IX Item "-verbose" this prints extra details about the operations being performed. @@ -253,11 +269,11 @@ don't output the text form of a certificate to the output file. .IP "\fB\-startdate date\fR" 4 .IX Item "-startdate date" this allows the start date to be explicitly set. The format of the -date is \s-1YYMMDDHHMMSSZ\s0 (the same as an \s-1ASN1\s0 UTCTime structure). +date is \s-1YYMMDDHHMMSSZ \s0(the same as an \s-1ASN1\s0 UTCTime structure). .IP "\fB\-enddate date\fR" 4 .IX Item "-enddate date" this allows the expiry date to be explicitly set. The format of the -date is \s-1YYMMDDHHMMSSZ\s0 (the same as an \s-1ASN1\s0 UTCTime structure). +date is \s-1YYMMDDHHMMSSZ \s0(the same as an \s-1ASN1\s0 UTCTime structure). .IP "\fB\-days arg\fR" 4 .IX Item "-days arg" the number of days to certify the certificate for. @@ -267,9 +283,9 @@ the message digest to use. Possible values include md5, sha1 and mdc2. This option also applies to CRLs. .IP "\fB\-policy arg\fR" 4 .IX Item "-policy arg" -this option defines the \s-1CA\s0 \*(L"policy\*(R" to use. This is a section in +this option defines the \s-1CA \s0\*(L"policy\*(R" to use. This is a section in the configuration file which decides which fields should be mandatory -or match the \s-1CA\s0 certificate. Check out the \fB\s-1POLICY\s0 \s-1FORMAT\s0\fR section +or match the \s-1CA\s0 certificate. Check out the \fB\s-1POLICY FORMAT\s0\fR section for more information. .IP "\fB\-msie_hack\fR" 4 .IX Item "-msie_hack" @@ -288,7 +304,7 @@ DNs match the order of the request. This is not needed for Xenroll. .IP "\fB\-noemailDN\fR" 4 .IX Item "-noemailDN" The \s-1DN\s0 of a certificate can contain the \s-1EMAIL\s0 field if present in the -request \s-1DN\s0, however it is good policy just having the e\-mail set into +request \s-1DN,\s0 however it is good policy just having the e\-mail set into the altName extension of the certificate. When this option is set the \&\s-1EMAIL\s0 field is removed from the certificate' subject and set only in the, eventually present, extensions. The \fBemail_in_dn\fR keyword can be @@ -325,7 +341,7 @@ characters may be escaped by \e (backslash), no spaces are skipped. .IP "\fB\-utf8\fR" 4 .IX Item "-utf8" this option causes field values to be interpreted as \s-1UTF8\s0 strings, by -default they are interpreted as \s-1ASCII\s0. This means that the field +default they are interpreted as \s-1ASCII.\s0 This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid \s-1UTF8\s0 strings. .IP "\fB\-multivalue\-rdn\fR" 4 @@ -351,6 +367,13 @@ the number of hours before the next \s-1CRL\s0 is due. .IP "\fB\-revoke filename\fR" 4 .IX Item "-revoke filename" a filename containing a certificate to revoke. +.IP "\fB\-status serial\fR" 4 +.IX Item "-status serial" +displays the revocation status of the certificate with the specified +serial number and exits. +.IP "\fB\-updatedb\fR" 4 +.IX Item "-updatedb" +Updates the database index to purge expired certificates. .IP "\fB\-crl_reason reason\fR" 4 .IX Item "-crl_reason reason" revocation reason, where \fBreason\fR is one of: \fBunspecified\fR, \fBkeyCompromise\fR, @@ -363,7 +386,7 @@ in delta CRLs which are not currently implemented. .IP "\fB\-crl_hold instruction\fR" 4 .IX Item "-crl_hold instruction" This sets the \s-1CRL\s0 revocation reason code to \fBcertificateHold\fR and the hold -instruction to \fBinstruction\fR which must be an \s-1OID\s0. Although any \s-1OID\s0 can be +instruction to \fBinstruction\fR which must be an \s-1OID.\s0 Although any \s-1OID\s0 can be used only \fBholdInstructionNone\fR (the use of which is discouraged by \s-1RFC2459\s0) \&\fBholdInstructionCallIssuer\fR or \fBholdInstructionReject\fR will normally be used. .IP "\fB\-crl_compromise time\fR" 4 @@ -393,8 +416,8 @@ be used must be named in the \fBdefault_ca\fR option of the \fBca\fR section of the configuration file (or in the default section of the configuration file). Besides \fBdefault_ca\fR, the following options are read directly from the \fBca\fR section: - \s-1RANDFILE\s0 - preserve + \s-1RANDFILE +\&\s0 preserve msie_hack With the exception of \fB\s-1RANDFILE\s0\fR, this is probably a bug and may change in future releases. @@ -407,7 +430,7 @@ the configuration file or the command line equivalent (if any) used. .IP "\fBoid_file\fR" 4 .IX Item "oid_file" -This specifies a file containing additional \fB\s-1OBJECT\s0 \s-1IDENTIFIERS\s0\fR. +This specifies a file containing additional \fB\s-1OBJECT IDENTIFIERS\s0\fR. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed by white space and finally the long name. @@ -450,7 +473,7 @@ present. .IX Item "default_crl_hours default_crl_days" the same as the \fB\-crlhours\fR and the \fB\-crldays\fR options. These will only be used if neither command line option is present. At -least one of these must be present to generate a \s-1CRL\s0. +least one of these must be present to generate a \s-1CRL.\s0 .IP "\fBdefault_md\fR" 4 .IX Item "default_md" the same as the \fB\-md\fR option. The message digest to use. Mandatory. @@ -489,13 +512,13 @@ the same as \fB\-preserveDN\fR .IX Item "email_in_dn" the same as \fB\-noemailDN\fR. If you want the \s-1EMAIL\s0 field to be removed from the \s-1DN\s0 of the certificate simply set this to 'no'. If not present -the default is to allow for the \s-1EMAIL\s0 filed in the certificate's \s-1DN\s0. +the default is to allow for the \s-1EMAIL\s0 filed in the certificate's \s-1DN.\s0 .IP "\fBmsie_hack\fR" 4 .IX Item "msie_hack" the same as \fB\-msie_hack\fR .IP "\fBpolicy\fR" 4 .IX Item "policy" -the same as \fB\-policy\fR. Mandatory. See the \fB\s-1POLICY\s0 \s-1FORMAT\s0\fR section +the same as \fB\-policy\fR. Mandatory. See the \fB\s-1POLICY FORMAT\s0\fR section for more information. .IP "\fBname_opt\fR, \fBcert_opt\fR" 4 .IX Item "name_opt, cert_opt" @@ -546,6 +569,10 @@ The file should contain the variable \s-1SPKAC\s0 set to the value of the \s-1SPKAC\s0 and also the required \s-1DN\s0 components as name value pairs. If you need to include the same component twice then it can be preceded by a number and a '.'. +.PP +When processing \s-1SPKAC\s0 format, the output is \s-1DER\s0 if the \fB\-out\fR +flag is used, but \s-1PEM\s0 format if sending to stdout or the \fB\-outdir\fR +flag is used. .SH "EXAMPLES" .IX Header "EXAMPLES" Note: these examples assume that the \fBca\fR directory structure is @@ -683,7 +710,7 @@ exposed at either a command or interface level so a more friendly utility .PP Any fields in a request that are not present in a policy are silently deleted. This does not happen if the \fB\-preserveDN\fR option is used. To -enforce the absence of the \s-1EMAIL\s0 field within the \s-1DN\s0, as suggested by +enforce the absence of the \s-1EMAIL\s0 field within the \s-1DN,\s0 as suggested by RFCs, regardless the contents of the request' subject the \fB\-noemailDN\fR option can be used. The behaviour should be more friendly and configurable. @@ -695,7 +722,7 @@ create an empty file. The \fBca\fR command is quirky and at times downright unfriendly. .PP The \fBca\fR utility was originally meant as an example of how to do things -in a \s-1CA\s0. It was not supposed to be used as a full blown \s-1CA\s0 itself: +in a \s-1CA.\s0 It was not supposed to be used as a full blown \s-1CA\s0 itself: nevertheless some people are using it for this purpose. .PP The \fBca\fR command is effectively a single user command: no locking is |