1 .\" $OpenBSD: openssl.1,v 1.139 2022/07/19 16:08:09 tb Exp $
2 .\" ====================================================================
3 .\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in
14 .\" the documentation and/or other materials provided with the
17 .\" 3. All advertising materials mentioning features or use of this
18 .\" software must display the following acknowledgment:
19 .\" "This product includes software developed by the OpenSSL Project
20 .\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
22 .\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 .\" endorse or promote products derived from this software without
24 .\" prior written permission. For written permission, please contact
25 .\" openssl-core@openssl.org.
27 .\" 5. Products derived from this software may not be called "OpenSSL"
28 .\" nor may "OpenSSL" appear in their names without prior written
29 .\" permission of the OpenSSL Project.
31 .\" 6. Redistributions of any form whatsoever must retain the following
33 .\" "This product includes software developed by the OpenSSL Project
34 .\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
36 .\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 .\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 .\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 .\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 .\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 .\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 .\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
48 .\" ====================================================================
50 .\" This product includes cryptographic software written by Eric Young
51 .\" (eay@cryptsoft.com). This product includes software written by Tim
52 .\" Hudson (tjh@cryptsoft.com).
55 .\" Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
56 .\" All rights reserved.
58 .\" This package is an SSL implementation written
59 .\" by Eric Young (eay@cryptsoft.com).
60 .\" The implementation was written so as to conform with Netscapes SSL.
62 .\" This library is free for commercial and non-commercial use as long as
63 .\" the following conditions are aheared to. The following conditions
64 .\" apply to all code found in this distribution, be it the RC4, RSA,
65 .\" lhash, DES, etc., code; not just the SSL code. The SSL documentation
66 .\" included with this distribution is covered by the same copyright terms
67 .\" except that the holder is Tim Hudson (tjh@cryptsoft.com).
69 .\" Copyright remains Eric Young's, and as such any Copyright notices in
70 .\" the code are not to be removed.
71 .\" If this package is used in a product, Eric Young should be given attribution
72 .\" as the author of the parts of the library used.
73 .\" This can be in the form of a textual message at program startup or
74 .\" in documentation (online or textual) provided with the package.
76 .\" Redistribution and use in source and binary forms, with or without
77 .\" modification, are permitted provided that the following conditions
79 .\" 1. Redistributions of source code must retain the copyright
80 .\" notice, this list of conditions and the following disclaimer.
81 .\" 2. Redistributions in binary form must reproduce the above copyright
82 .\" notice, this list of conditions and the following disclaimer in the
83 .\" documentation and/or other materials provided with the distribution.
84 .\" 3. All advertising materials mentioning features or use of this software
85 .\" must display the following acknowledgement:
86 .\" "This product includes cryptographic software written by
87 .\" Eric Young (eay@cryptsoft.com)"
88 .\" The word 'cryptographic' can be left out if the rouines from the library
89 .\" being used are not cryptographic related :-).
90 .\" 4. If you include any Windows specific code (or a derivative thereof) from
91 .\" the apps directory (application code) you must include an
93 .\" "This product includes software written by Tim Hudson
94 .\" (tjh@cryptsoft.com)"
96 .\" THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
97 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
98 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
99 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
100 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
101 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
102 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
103 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
104 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
105 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
108 .\" The licence and distribution terms for any publically available version or
109 .\" derivative of this code cannot be changed. i.e. this code cannot simply be
110 .\" copied and put under another distribution licence
111 .\" [including the GNU Public Licence.]
113 .Dd $Mdocdate: July 19 2022 $
118 .Nd OpenSSL command line tool
126 .Cm list-standard-commands |
127 .Cm list-message-digest-commands |
128 .Cm list-cipher-commands |
129 .Cm list-cipher-algorithms |
130 .Cm list-message-digest-algorithms |
131 .Cm list-public-key-algorithms
134 .Cm no- Ns Ar command
137 is a cryptography toolkit implementing the
138 Transport Layer Security
141 as well as related cryptography standards.
145 program is a command line tool for using the various
146 cryptography functions of
148 crypto library from the shell.
151 .Cm list-standard-commands , list-message-digest-commands ,
153 .Cm list-cipher-commands
155 .Pq one entry per line
156 of the names of all standard commands, message digest commands,
157 or cipher commands, respectively, that are available in the present
162 .Cm list-cipher-algorithms
164 .Cm list-message-digest-algorithms
165 list all cipher and message digest names,
167 Aliases are listed as:
172 .Cm list-public-key-algorithms
173 lists all supported public key algorithms.
176 .Cm no- Ns Ar command
177 tests whether a command of the
178 specified name is available.
184 .Cm no- Ns Ar command ;
185 otherwise it returns 1 and prints
187 In both cases, the output goes to stdout and nothing is printed to stderr.
188 Additional command line arguments are always ignored.
189 Since for each cipher there is a command of the same name,
190 this provides an easy way for shell scripts to test for the
191 availability of ciphers in the
196 .Cm no- Ns Ar command
197 is not able to detect pseudo-commands such as
199 .Cm list- Ns Ar ... Ns Cm -commands ,
201 .Cm no- Ns Ar command
205 .Bl -hang -width "openssl asn1parse"
206 .It Nm openssl asn1parse
209 .Op Fl dlimit Ar number
211 .Op Fl genconf Ar file
214 .Op Fl inform Cm der | pem | txt
215 .Op Fl length Ar number
217 .Op Fl offset Ar number
220 .Op Fl strparse Ar offset
226 command is a diagnostic utility that can parse ASN.1 structures.
227 It can also be used to extract data from ASN.1 formatted data.
229 The options are as follows:
231 .It Fl dlimit Ar number
234 bytes of unknown data in hex form.
236 Dump unknown data in hex form.
237 .It Fl genconf Ar file , Fl genstr Ar str
238 Generate encoded data based on string
242 or both, using the format described in
243 .Xr ASN1_generate_nconf 3 .
246 is present then the string is obtained from the default section
249 The encoded data is passed through the ASN.1 parser and printed out as
250 though it came from a file;
251 the contents can thus be examined and written to a file using the
255 Indent the output according to the
259 The input file to read from, or standard input if not specified.
260 .It Fl inform Cm der | pem | txt
262 .It Fl length Ar number
263 Number of bytes to parse; the default is until end of file.
265 Do not output the parsed version of the input file.
266 .It Fl offset Ar number
267 Starting offset to begin parsing; the default is start of file.
269 A file containing additional object identifiers
272 .Pq object identifier
275 internal table, it will be represented in
277 .Pq for example 1.2.3.4 .
279 Each line consists of three columns:
280 the first column is the OID in numerical format and should be followed by
282 The second column is the
284 which is a single word followed by whitespace.
285 The final column is the rest of the line and is the
288 displays the long name.
290 The DER-encoded output file; the default is no encoded output
291 (useful when combined with
293 .It Fl strparse Ar offset
294 Parse the content octets of the ASN.1 object starting at
296 This option can be used multiple times to
298 into a nested structure.
302 .Bl -hang -width "openssl ca"
307 .Op Fl config Ar file
309 .Op Fl crl_CA_compromise Ar time
310 .Op Fl crl_compromise Ar time
311 .Op Fl crl_hold Ar instruction
312 .Op Fl crl_reason Ar reason
313 .Op Fl crldays Ar days
314 .Op Fl crlexts Ar section
315 .Op Fl crlhours Ar hours
316 .Op Fl crlsec Ar seconds
318 .Op Fl enddate Ar date
319 .Op Fl extensions Ar section
320 .Op Fl extfile Ar file
324 .Op Fl key Ar password
325 .Op Fl keyfile Ar file
326 .Op Fl keyform Cm pem | der
329 .Op Fl multivalue-rdn
330 .Op Fl name Ar section
334 .Op Fl outdir Ar directory
338 .Op Fl revoke Ar file
340 .Op Fl sigopt Ar nm:v
342 .Op Fl ss_cert Ar file
343 .Op Fl startdate Ar date
344 .Op Fl status Ar serial
354 command is a minimal certificate authority (CA) application.
355 It can be used to sign certificate requests in a variety of forms
356 and generate certificate revocation lists (CRLs).
357 It also maintains a text database of issued certificates and their status.
359 The options relevant to CAs are as follows:
360 .Bl -tag -width "XXXX"
363 In this mode no questions will be asked
364 and all certificates will be certified automatically.
366 The CA certificate file.
367 .It Fl config Ar file
368 Specify an alternative configuration file.
370 If reading the serial from the text file as specified in the
371 configuration fails, create a new random serial to be used as the
374 The number of days to certify the certificate for.
375 .It Fl enddate Ar date
377 The format of the date is [YY]YYMMDDHHMMSSZ,
378 with all four year digits required for dates from 2050 onwards.
379 .It Fl extensions Ar section
380 The section of the configuration file containing certificate extensions
381 to be added when a certificate is issued (defaults to
386 If no extension section is present, a V1 certificate is created.
387 If the extension section is present
388 .Pq even if it is empty ,
389 then a V3 certificate is created.
392 manual page for details of the extension section format.
393 .It Fl extfile Ar file
394 An additional configuration
396 to read certificate extensions from
397 (using the default section unless the
399 option is also used).
403 containing a single certificate request to be signed by the CA.
405 If present, this should be the last option; all subsequent arguments
406 are assumed to be the names of files containing certificate requests.
407 .It Fl key Ar password
410 used to encrypt the private key.
411 Since on some systems the command line arguments are visible,
412 this option should be used with caution.
413 .It Fl keyfile Ar file
414 The private key to sign requests with.
415 .It Fl keyform Cm pem | der
416 Private key file format.
420 The message digest to use.
421 Possible values include
425 This option also applies to CRLs.
427 This is a legacy option to make
429 work with very old versions of the IE certificate enrollment control
431 It used UniversalStrings for almost everything.
432 Since the old control has various security bugs,
433 its use is strongly discouraged.
436 does not need this option.
437 .It Fl multivalue-rdn
438 This option causes the
440 argument to be interpreted with full support for multivalued RDNs,
442 .Qq "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" .
445 is not used, the UID value is set to
446 .Qq "123456+CN=John Doe" .
447 .It Fl name Ar section
448 Specifies the configuration file
456 The DN of a certificate can contain the EMAIL field if present in the
457 request DN, however it is good policy just having the email set into
460 extension of the certificate.
461 When this option is set, the EMAIL field is removed from the certificate's
462 subject and set only in the, eventually present, extensions.
465 keyword can be used in the configuration file to enable this behaviour.
467 Don't output the text form of a certificate to the output file.
469 The output file to output certificates to.
470 The default is standard output.
471 The certificate details will also be printed out to this file in
472 PEM format, except that
475 .It Fl outdir Ar directory
478 to output certificates to.
479 The certificate will be written to a file consisting of the
480 serial number in hex with
484 The key password source.
489 The policy section in the configuration file
490 consists of a set of variables corresponding to certificate DN fields.
491 The values may be one of
493 (the value must match the same field in the CA certificate),
495 (the value must be present), or
497 (the value may be present).
498 Any fields not mentioned in the policy section
499 are silently deleted, unless the
502 but this can be regarded more of a quirk than intended behaviour.
504 Normally, the DN order of a certificate is the same as the order of the
505 fields in the relevant policy section.
506 When this option is set, the order is the same as the request.
507 This is largely for compatibility with the older IE enrollment control
508 which would only accept certificates if their DNs matched the order of the
510 This is not needed for Xenroll.
512 Indicates the issued certificates are to be signed with the key the
513 certificate requests were signed with, given with
515 Certificate requests signed with a different key are ignored.
525 A consequence of using
527 is that the self-signed certificate appears among the entries in
528 the certificate database (see the configuration option
530 and uses the same serial number counter as all other certificates
531 signed with the self-signed certificate.
532 .It Fl sigopt Ar nm:v
533 Pass options to the signature algorithm during sign or certify operations.
534 The names and values of these options are algorithm-specific.
536 A file containing a single Netscape signed public key and challenge,
537 and additional field values to be signed by the CA.
538 This will usually come from the
539 KEYGEN tag in an HTML form to create a new private key.
540 It is, however, possible to create SPKACs using the
544 The file should contain the variable SPKAC set to the value of
545 the SPKAC and also the required DN components as name value pairs.
546 If it's necessary to include the same component twice,
547 then it can be preceded by a number and a
549 .It Fl ss_cert Ar file
550 A single self-signed certificate to be signed by the CA.
551 .It Fl startdate Ar date
553 The format of the date is [YY]YYMMDDHHMMSSZ,
554 with all four year digits required for dates from 2050 onwards.
556 Supersedes the subject name given in the request.
561 .Pf / Ar type0 Ns = Ar value0 Ns / Ar type 1 Ns = Ar value 1 Ns /
562 .Ar type2 Ns = Ar ... ;
564 characters may be escaped by
567 no spaces are skipped.
569 Interpret field values read from a terminal or obtained from a
570 configuration file as UTF-8 strings.
571 By default, they are interpreted as ASCII.
573 Print extra details about the operations being performed.
576 The options relevant to CRLs are as follows:
577 .Bl -tag -width "XXXX"
578 .It Fl crl_CA_compromise Ar time
581 except the revocation reason is set to CACompromise.
582 .It Fl crl_compromise Ar time
583 Set the revocation reason to keyCompromise and the compromise time to
586 should be in GeneralizedTime format, i.e. YYYYMMDDHHMMSSZ.
587 .It Fl crl_hold Ar instruction
588 Set the CRL revocation reason code to certificateHold and the hold
591 which must be an OID.
592 Although any OID can be used, only holdInstructionNone
593 (the use of which is discouraged by RFC 2459), holdInstructionCallIssuer or
594 holdInstructionReject will normally be used.
595 .It Fl crl_reason Ar reason
596 Revocation reason, where
599 unspecified, keyCompromise, CACompromise, affiliationChanged, superseded,
600 cessationOfOperation, certificateHold or removeFromCRL.
604 Setting any revocation reason will make the CRL v2.
605 In practice, removeFromCRL is not particularly useful because it is only used
606 in delta CRLs which are not currently implemented.
607 .It Fl crldays Ar days
608 The number of days before the next CRL is due.
609 This is the days from now to place in the CRL
612 .It Fl crlexts Ar section
615 of the configuration file containing CRL extensions to include.
616 If no CRL extension section is present then a V1 CRL is created;
617 if the CRL extension section is present
618 (even if it is empty)
619 then a V2 CRL is created.
620 The CRL extensions specified are CRL extensions and not CRL entry extensions.
621 It should be noted that some software can't handle V2 CRLs.
624 manual page for details of the extension section format.
625 .It Fl crlhours Ar hours
626 The number of hours before the next CRL is due.
627 .It Fl crlsec Ar seconds
628 The number of seconds before the next CRL is due.
630 Generate a CRL based on information in the index file.
631 .It Fl revoke Ar file
634 containing a certificate to revoke.
635 .It Fl status Ar serial
636 Show the status of the certificate with serial number
639 Update the database index to purge expired certificates.
642 Many of the options can be set in the
644 section of the configuration file
645 (or in the default section of the configuration file),
654 are read directly from the
658 Many of the configuration file options are identical to command line
660 Where the option is present in the configuration file and the command line,
661 the command line value is used.
662 Where an option is described as mandatory, then it must be present in
663 the configuration file or the command line equivalent
666 .Bl -tag -width "XXXX"
670 It gives the file containing the CA certificate.
672 .It Cm copy_extensions
673 Determines how extensions in certificate requests should be handled.
676 or this option is not present, then extensions are
677 ignored and not copied to the certificate.
680 then any extensions present in the request that are not already present
681 are copied to the certificate.
684 then all extensions in the request are copied to the certificate:
685 if the extension is already present in the certificate it is deleted first.
689 option should be used with caution.
690 If care is not taken, it can be a security risk.
691 For example, if a certificate request contains a
693 extension with CA:TRUE and the
697 and the user does not spot
698 this when the certificate is displayed, then this will hand the requester
699 a valid CA certificate.
701 This situation can be avoided by setting
707 with CA:FALSE in the configuration file.
708 Then if the request contains a
710 extension, it will be ignored.
712 The main use of this option is to allow a certificate request to supply
713 values for certain extensions such as
715 .It Cm crl_extensions
719 A text file containing the next CRL number to use in hex.
720 The CRL number will be inserted in the CRLs only if this file exists.
721 If this file is present, it must contain a valid CRL number.
723 The text database file to use.
725 This file must be present, though initially it will be empty.
726 .It Cm default_crl_hours , default_crl_days
732 These will only be used if neither command line option is present.
733 At least one of these must be present to generate a CRL.
738 The number of days to certify a certificate for.
739 .It Cm default_enddate
743 Either this option or
745 .Pq or the command line equivalents
751 The message digest to use.
753 .It Cm default_startdate
757 The start date to certify a certificate for.
758 If not set, the current time is used.
762 If the EMAIL field is to be removed from the DN of the certificate,
765 If not present, the default is to allow for the EMAIL field in the
770 .It Cm name_opt , cert_opt
771 These options allow the format used to display the certificate details
772 when asking the user to confirm signing.
773 All the options supported by the
779 switches can be used here, except that
783 are permanently set and cannot be disabled
784 (this is because the certificate signature cannot be displayed because
785 the certificate has not been signed at this point).
787 For convenience, the value
789 is accepted by both to produce a reasonable output.
791 If neither option is present, the format used in earlier versions of
794 Use of the old format is strongly discouraged
795 because it only displays fields mentioned in the
798 mishandles multicharacter string types and does not display extensions.
803 It specifies the directory where new certificates will be placed.
806 This specifies a file containing additional object identifiers.
807 Each line of the file should consist of the numerical form of the
808 object identifier followed by whitespace, then the short name followed
809 by whitespace and finally the long name.
811 This specifies a section in the configuration file containing extra
813 Each line should consist of the short name of the object identifier
816 and the numerical form.
817 The short and long names are the same when this option is used.
829 The file containing the CA private key.
832 A text file containing the next serial number to use in hex.
834 This file must be present and contain a valid serial number.
835 .It Cm unique_subject
838 is given, the valid certificate entries in the
839 database must have unique subjects.
843 several valid certificate entries may have the exact same subject.
847 Note that it is valid in some circumstances for certificates to be created
849 In cases where there are multiple certificates without
850 subjects this does not count as a duplicate.
851 .It Cm x509_extensions
857 .Bl -hang -width "openssl certhash"
858 .It Nm openssl certhash
867 command calculates a hash value of
869 file in the specified directory list and creates symbolic links for each file,
870 where the name of the link is the hash value.
872 .Xr SSL_CTX_load_verify_locations 3
873 manual page for how hash links are used.
875 The links created are of the form
879 is a hexadecimal character and
881 is a single decimal digit.
882 The hashes for CRLs look similar, except the letter
884 appears after the period, like this:
886 When processing a directory,
888 will first remove all links that have a name in that syntax and invalid
891 Multiple objects may have the same hash; they will be indicated by
895 Duplicates are found by comparing the full SHA256 fingerprint.
896 A warning will be displayed if a duplicate is found.
898 A warning will also be displayed if there are files that cannot be parsed as
899 either a certificate or a CRL.
901 The options are as follows:
904 Perform a dry-run, and do not make any changes.
906 Print extra details about the processing.
908 Specify the directories to process.
924 string from the format documented in
925 .Xr SSL_CTX_set_cipher_list 3
926 into an ordered SSL cipher suite preference list.
929 string is specified, the
933 The options are as follows:
936 Print a brief usage message.
938 Only list ciphers that are supported by the TLS method.
939 .It Fl tls1 | tls1_1 | tls1_2 | tls1_3
940 In combination with the
942 option, list the ciphers which could be used
943 if the specified protocol version were negotiated.
946 List ciphers with cipher suite code in hex format,
947 cipher name, and a complete description of protocol version,
948 key exchange, authentication, encryption, and mac algorithms.
952 but without cipher suite codes.
956 .Bl -hang -width "openssl cms"
960 .Fl aes128 | aes192 | aes256 | camellia128 |
961 .Fl camellia192 | camellia256 | des | des3 |
962 .Fl rc2-40 | rc2-64 | rc2-128
964 .Op Fl CAfile Ar file
965 .Op Fl CApath Ar directory
967 .Op Fl certfile Ar file
968 .Op Fl certsout Ar file
971 .Op Fl content Ar file
979 .Op Fl econtent_type Ar type
981 .Op Fl EncryptedData_decrypt
982 .Op Fl EncryptedData_encrypt
985 .Op Fl inform Cm der | pem | smime
987 .Op Fl keyform Cm der | pem
989 .Op Fl keyopt Ar nm:v
991 .Op Fl no_attr_verify
992 .Op Fl no_content_verify
993 .Op Fl no_signer_cert_verify
1004 .Op Fl outform Cm der | pem | smime
1005 .Op Fl passin Ar src
1007 .Op Fl pwri_password Ar arg
1008 .Op Fl rctform Cm der | pem | smime
1009 .Op Fl receipt_request_all | receipt_request_first
1010 .Op Fl receipt_request_from Ar addr
1011 .Op Fl receipt_request_print
1012 .Op Fl receipt_request_to Ar addr
1013 .Op Fl recip Ar file
1015 .Op Fl secretkey Ar key
1016 .Op Fl secretkeyid Ar id
1019 .Op Fl signer Ar file
1020 .Op Fl stream | indef | noindef
1026 .Op Fl verify_receipt Ar file
1027 .Op Fl verify_retcode
1034 command handles S/MIME v3.1 mail.
1035 It can encrypt, decrypt, sign and verify, compress and uncompress S/MIME
1038 The MIME message must be sent without any blank lines between the headers and
1040 Some mail programs will automatically add a blank line.
1041 Piping the mail directly to sendmail is one way to achieve the correct format.
1043 The supplied message to be signed or encrypted must include the necessary MIME
1044 headers or many S/MIME clients won't display it properly (if at all).
1047 option to automatically add plain text headers.
1049 A "signed and encrypted" message is one where a signed message is then
1051 This can be produced by encrypting an already signed message.
1053 There are various operation options that set the type of operation to be
1055 The meaning of the other options varies according to the operation type.
1056 .Bl -tag -width "XXXX"
1058 Encrypt mail for the given recipient certificates.
1059 Input file is the message to be encrypted.
1060 The output file is the encrypted mail in MIME format.
1061 The actual CMS type is EnvelopedData.
1062 Note that no revocation check is done for the recipient cert, so if that
1063 key has been compromised, others may be able to decrypt the text.
1065 Decrypt mail using the supplied certificate and private key.
1066 Expects an encrypted mail message in MIME format for the input file.
1067 The decrypted mail is written to the output file.
1069 Sign mail using the supplied certificate and private key.
1070 Input file is the message to be signed.
1071 The signed message in MIME format is written to the output file.
1074 Expects a signed mail message on input and outputs the signed data.
1075 Both clear text and opaque signing are supported.
1077 Take an input message and write out a PEM encoded CMS structure.
1080 Take an existing message and one or more new signers.
1081 This operation uses an existing message digest when adding a new signer.
1082 This means that attributes must be present in at least one existing
1083 signer using the same message digest or this operation will fail.
1085 Create a CMS Data type.
1087 Output a content from the input CMS Data type.
1088 .It Fl digest_create
1089 Create a CMS DigestedData type.
1090 .It Fl digest_verify
1091 Verify a CMS DigestedData type and output the content.
1093 Create a CMS CompressedData type.
1094 Must be compiled with zlib support for this option to work.
1096 Uncompress a CMS CompressedData type and output the content.
1097 Must be compiled with zlib support for this option to work.
1098 .It Fl EncryptedData_encrypt
1099 Encrypt a content using supplied symmetric key and algorithm using a
1100 CMS EncryptedData type.
1101 .It Fl EncryptedData_decrypt
1102 Decrypt a CMS EncryptedData type using supplied symmetric key.
1104 Generate and output a signed receipt for the supplied message.
1105 The input message must contain a signed receipt request.
1106 Functionality is otherwise similar to the
1110 .Fl verify_receipt Ar file
1112 Verify a signed receipt in file.
1113 The input message must contain the original receipt request.
1114 Functionality is otherwise similar to the
1119 The remaining options are as follows:
1120 .Bl -tag -width "XXXX"
1122 .Fl aes128 | aes192 | aes256 | camellia128 |
1123 .Fl camellia192 | camellia256 | des | des3 |
1124 .Fl rc2-40 | rc2-64 | rc2-128
1126 The encryption algorithm to use.
1127 128-, 192-, or 256-bit AES, 128-, 192-, or 256-bit CAMELLIA,
1128 DES (56 bits), triple DES (168 bits),
1129 or 40-, 64-, or 128-bit RC2, respectively;
1130 if not specified, triple DES is
1135 .Fl EncryptedData_encrypt
1138 Normally the input message is converted to "canonical" format which is
1139 effectively using CR/LF as end of line, as required by the S/MIME specification.
1140 When this option is present, no translation occurs.
1141 This is useful when handling binary data which may not be in MIME format.
1142 .It Fl CAfile Ar file
1143 A file containing trusted CA certificates, used with
1146 .Fl verify_receipt .
1147 .It Fl CApath Ar directory
1148 A directory containing trusted CA certificates, used with
1151 .Fl verify_receipt .
1152 This directory must be a standard certificate directory: that is a hash
1153 of each subject name (using
1155 should be linked to each certificate.
1157 One or more certificates of message recipients: used when encrypting a message.
1158 .It Fl certfile Ar file
1159 Allows additional certificates to be specified.
1160 When signing, these will be included with the message.
1161 When verifying, these will be searched for the signer's certificates.
1162 The certificates should be in PEM format.
1163 .It Fl certsout Ar file
1164 A file that any certificates contained in the message are written to.
1170 .Fl ignore_critical ,
1177 Set various certificate chain validation options.
1180 command for details.
1181 .It Fl content Ar file
1182 A file containing the detached content.
1183 This is only useful with the
1186 This is only usable if the CMS structure is using the detached signature
1187 form where the content is not included.
1188 This option will override any content if the input format is S/MIME and
1189 it uses the multipart/signed MIME content type.
1191 Output a S/MIME message with CR/LF end of line.
1192 .It Fl debug_decrypt
1193 Set the CMS_DEBUG_DECRYPT flag when decrypting.
1194 This option should be used with caution, since this can be used to disable
1195 the MMA attack protection and return an error if no recipient can be found.
1198 manual page for details of the flag.
1204 The relevant mail headers.
1205 These are included outside the signed portion of a message so they may
1206 be included manually.
1207 If signing then many S/MIME mail clients check the signer's certificate's
1208 email address matches that specified in the From: address.
1209 .It Fl econtent_type Ar type
1210 Set the encapsulated content type, used with
1212 If not supplied, the Data type is used.
1213 The type argument can be any valid OID name in either text or numerical format.
1215 The input message to be encrypted or signed or the message to be decrypted or
1217 .It Fl inform Cm der | pem | smime
1218 The input format for the CMS structure.
1221 which reads an S/MIME format message.
1225 format change this to expect PEM and DER format CMS structures instead.
1226 This currently only affects the input format of the CMS structure; if no
1227 CMS structure is being input (for example with
1231 this option has no effect.
1232 .It Fl inkey Ar file
1233 The private key to use when signing or decrypting.
1234 This must match the corresponding certificate.
1235 If this option is not specified then the private key must be included in
1236 the certificate file specified with the
1241 When signing, this option can be used multiple times to specify successive keys.
1242 .It Fl keyform Cm der | pem
1243 Input private key format.
1247 Use subject key identifier to identify certificates instead of issuer
1248 name and serial number.
1249 The supplied certificate must include a subject key identifier extension.
1255 .It Fl keyopt Ar nm:v
1256 Set customised parameters for the preceding key or certificate
1257 for encryption and signing.
1258 It can currently be used to set RSA-PSS for signing, RSA-OAEP for
1259 encryption or to modify default parameters for ECDH.
1260 This option can be used multiple times.
1262 The digest algorithm to use when signing or resigning.
1263 If not present then the default digest algorithm for the signing key
1264 will be used (usually SHA1).
1265 .It Fl no_attr_verify
1266 Do not verify the signer's attribute of a signature.
1267 .It Fl no_content_verify
1268 Do not verify the content of a signed message.
1269 .It Fl no_signer_cert_verify
1270 Do not verify the signer's certificate of a signed message.
1272 Do not include attributes.
1273 Normally when a message is signed a set of attributes are included which
1274 include the signing time and supported symmetric algorithms.
1275 With this option they are not included.
1277 Do not include the signer's certificate.
1278 This will reduce the size of the signed message but the verifier must
1279 have a copy of the signer's certificate available locally (passed using
1282 option for example).
1284 When signing a message, use opaque signing.
1285 This form is more resistant to translation by mail relays but it cannot be
1286 read by mail agents that do not support S/MIME.
1287 Without this option cleartext signing with the MIME type multipart/signed is
1290 Only the certificates specified in the
1293 When verifying a message, normally certificates (if any) included in the
1294 message are searched for the signing certificate.
1295 The supplied certificates can still be used as untrusted CAs however.
1297 Output an old S/MIME content type like "application/x-pkcs7-".
1299 Do not output the parsed CMS structure for the
1302 This is useful when combined with the
1304 option or if the syntax of the CMS structure is being checked.
1306 Do not try to verify the signatures on the message.
1308 Exclude the list of supported algorithms from signed attributes; other
1309 options such as signing time and content type are still included.
1311 Do not verify the signer's certificate of a signed message.
1313 The message text that has been decrypted or verified or the output MIME
1314 format message that has been signed or verified.
1315 .It Fl outform Cm der | pem | smime
1316 This specifies the output format for the CMS structure.
1319 which writes an S/MIME format message.
1323 format change this to write PEM and DER format CMS structures instead.
1324 This currently only affects the output format of the CMS structure; if
1325 no CMS structure is being output (for example with
1329 this option has no effect.
1330 .It Fl passin Ar src
1331 The private key password source.
1333 Print out all fields of the CMS structure for the
1336 This is mainly useful for testing purposes.
1337 .It Fl pwri_password Ar arg
1338 Specify PasswordRecipientInfo (PWRI) password to use.
1344 .It Fl rctform Cm der | pem | smime
1345 Specify the format for a signed receipt for use with the
1350 .It Fl receipt_request_all | receipt_request_first
1351 Indicate requests should be provided by all recipient or first tier
1352 recipients (those mailed directly and not from a mailing list), for the
1354 operation to include a signed receipt request.
1356 .Fl receipt_request_from
1358 .It Fl receipt_request_from Ar addr
1359 Add an explicit email address where receipts should be supplied.
1360 .It Fl receipt_request_print
1361 Print out the contents of any signed receipt requests for the
1364 .It Fl receipt_request_to Ar addr
1365 Add an explicit email address where signed receipts should be sent to.
1366 This option must be supplied if a signed receipt is requested.
1367 .It Fl recip Ar file
1368 When decrypting a message, this specifies the recipient's certificate.
1369 The certificate must match one of the recipients of the message or an
1371 When encrypting a message, this option may be used multiple times to
1372 specify each recipient.
1373 This form must be used if customised parameters are required (for example to
1375 Only certificates carrying RSA, Diffie-Hellman or EC keys are supported
1377 .It Fl secretkey Ar key
1378 Specify symmetric key to use.
1379 The key must be supplied in hex format and be consistent with the
1382 .Fl EncryptedData_encrypt ,
1383 .Fl EncryptedData_decrypt ,
1392 the supplied key is used to wrap or unwrap the content encryption key
1393 using an AES key in the KEKRecipientInfo type.
1394 .It Fl secretkeyid Ar id
1395 The key identifier for the supplied symmetric key for KEKRecipientInfo type.
1396 This option must be present if the
1402 operations the id is used to locate the relevant key; if it is not supplied
1403 then an attempt is used to decrypt any KEKRecipientInfo structures.
1404 .It Fl signer Ar file
1405 A signing certificate when signing or resigning a message; this option
1406 can be used multiple times if more than one signer is required.
1407 If a message is being verified then the signers certificates will be
1408 written to this file if the verification was successful.
1418 options are equivalent and enable streaming I/O for encoding operations.
1419 This permits single pass processing of data without the need to hold the
1420 entire contents in memory, potentially supporting very large files.
1421 Streaming is automatically set for S/MIME signing with detached data if
1422 the output format is
1424 it is currently off by default for all other operations.
1426 disable streaming I/O where it would produce an indefinite length
1427 constructed encoding.
1428 This option currently has no effect.
1430 Add plain text (text/plain) MIME headers to the supplied message if
1431 encrypting or signing.
1432 If decrypting or verifying, it strips off text headers: if the decrypted
1433 or verified message is not of MIME type text/plain then an error occurs.
1434 .It Fl verify_retcode
1435 Set verification error code to exit code to indicate what verification error
1440 Exit code value minus 32 shows verification error code.
1443 command for the list of verification error code.
1450 .Bl -tag -width "XXXX" -offset 3n -compact
1452 The operation was completely successful.
1454 An error occurred parsing the command options.
1456 One of the input files could not be read.
1458 An error occurred creating the CMS file or when reading the MIME message.
1460 An error occurred decrypting or verifying the message.
1462 The message was verified correctly but an error occurred writing out the
1463 signer's certificates.
1465 An error occurred writing the output file.
1467 A verify error occurred while
1473 .Bl -hang -width "openssl crl"
1476 .Op Fl CAfile Ar file
1477 .Op Fl CApath Ar dir
1483 .Op Fl inform Cm der | pem
1486 .Op Fl nameopt Ar option
1490 .Op Fl outform Cm der | pem
1498 command processes CRL files in DER or PEM format.
1500 The options are as follows:
1502 .It Fl CAfile Ar file
1503 Verify the signature on a CRL by looking up the issuing certificate in
1505 .It Fl CApath Ar directory
1506 Verify the signature on a CRL by looking up the issuing certificate in
1508 This directory must be a standard certificate directory,
1509 i.e. a hash of each subject name (using
1511 should be linked to each certificate.
1513 Print the CRL number.
1515 Print the CRL fingerprint.
1517 Output a hash of the issuer name.
1518 This can be used to look up CRLs in a directory by issuer name.
1520 Output an old-style (MD5) hash of the issuer name.
1522 The input file to read from, or standard input if not specified.
1523 .It Fl inform Cm der | pem
1526 Output the issuer name.
1531 .It Fl nameopt Ar option
1532 Specify certificate name options.
1538 Do not output the encoded version of the CRL.
1540 The output file to write to, or standard output if not specified.
1541 .It Fl outform Cm der | pem
1544 Print the CRL in plain text.
1546 Verify the signature on the CRL.
1550 .Bl -hang -width "openssl crl2pkcs7"
1551 .It Nm openssl crl2pkcs7
1553 .Op Fl certfile Ar file
1555 .Op Fl inform Cm der | pem
1558 .Op Fl outform Cm der | pem
1564 command takes an optional CRL and one or more
1565 certificates and converts them into a PKCS#7 degenerate
1566 .Qq certificates only
1569 The options are as follows:
1571 .It Fl certfile Ar file
1572 Add the certificates in PEM
1574 to the PKCS#7 structure.
1575 This option can be used more than once
1576 to read certificates from multiple files.
1580 or standard input if not specified.
1581 .It Fl inform Cm der | pem
1584 Normally, a CRL is included in the output file.
1585 With this option, no CRL is
1586 included in the output file and a CRL is not read from the input file.
1588 Write the PKCS#7 structure to
1590 or standard output if not specified.
1591 .It Fl outform Cm der | pem
1596 .Bl -hang -width "openssl dgst"
1604 .Op Fl keyform Cm pem
1605 .Op Fl mac Ar algorithm
1606 .Op Fl macopt Ar nm : Ns Ar v
1608 .Op Fl passin Ar arg
1609 .Op Fl prverify Ar file
1611 .Op Fl signature Ar file
1612 .Op Fl sigopt Ar nm : Ns Ar v
1613 .Op Fl verify Ar file
1618 The digest functions output the message digest of a supplied
1622 in hexadecimal form.
1623 They can also be used for digital signing and verification.
1625 The options are as follows:
1628 Output the digest or signature in binary form.
1630 Print the digest in two-digit groups separated by colons.
1632 Print BIO debugging information.
1634 Use the specified message
1636 The default is SHA256.
1637 The available digests can be displayed using
1639 .Cm list-message-digest-commands .
1640 The following are equivalent:
1647 Digest is to be output as a hex dump.
1648 This is the default case for a
1650 digest as opposed to a digital signature.
1652 Create a hashed MAC using
1654 .It Fl keyform Cm pem
1655 Specifies the key format to sign the digest with.
1656 .It Fl mac Ar algorithm
1657 Create a keyed Message Authentication Code (MAC).
1658 The most popular MAC algorithm is HMAC (hash-based MAC),
1659 but there are other MAC algorithms which are not based on hash.
1660 MAC keys and other options should be set via the
1663 .It Fl macopt Ar nm : Ns Ar v
1664 Passes options to the MAC algorithm, specified by
1666 The following options are supported by HMAC:
1668 .It Cm key : Ns Ar string
1669 Specifies the MAC key as an alphanumeric string
1670 (use if the key contain printable characters only).
1671 String length must conform to any restrictions of the MAC algorithm.
1672 .It Cm hexkey : Ns Ar string
1673 Specifies the MAC key in hexadecimal form (two hex digits per byte).
1674 Key length must conform to any restrictions of the MAC algorithm.
1677 The output file to write to,
1678 or standard output if not specified.
1679 .It Fl passin Ar arg
1680 The key password source.
1681 .It Fl prverify Ar file
1682 Verify the signature using the private key in
1684 The output is either
1687 .Qq Verification Failure .
1689 Print the digest in coreutils format.
1691 Digitally sign the digest using the private key in
1693 .It Fl signature Ar file
1694 The actual signature to verify.
1695 .It Fl sigopt Ar nm : Ns Ar v
1696 Pass options to the signature algorithm during sign or verify operations.
1697 The names and values of these options are algorithm-specific.
1698 .It Fl verify Ar file
1699 Verify the signature using the public key in
1701 The output is either
1704 .Qq Verification Failure .
1706 File or files to digest.
1707 If no files are specified then standard input is used.
1711 .Bl -hang -width "openssl dhparam"
1712 .It Nm openssl dhparam
1719 .Op Fl inform Cm der | pem
1722 .Op Fl outform Cm der | pem
1730 command is used to manipulate DH parameter files.
1731 Only the older PKCS#3 DH is supported,
1732 not the newer X9.42 DH.
1734 The options are as follows:
1737 The generator to use;
1739 If present, the input file is ignored and parameters are generated instead.
1741 Convert the parameters into C code.
1742 The parameters can then be loaded by calling the
1743 .No get_dh Ns Ar numbits
1746 Check the DH parameters.
1748 Read or create DSA parameters,
1749 converted to DH format on output.
1753 .Pq such that (p-1)/2 is also prime
1754 will be used for DH parameter generation.
1756 DH parameter generation with the
1758 option is much faster,
1759 and the recommended exponent length is shorter,
1760 which makes DH key exchange more efficient.
1761 Beware that with such DSA-style DH parameters,
1762 a fresh DH key should be created for each use to
1763 avoid small-subgroup attacks that may be possible otherwise.
1765 The input file to read from,
1766 or standard input if not specified.
1767 .It Fl inform Cm der | pem
1770 Do not output the encoded version of the parameters.
1772 The output file to write to,
1773 or standard output if not specified.
1774 .It Fl outform Cm der | pem
1777 Print the DH parameters in plain text.
1779 Generate a parameter set of size
1781 It must be the last option.
1782 If not present, a value of 2048 is used.
1783 If this value is present, the input file is ignored and
1784 parameters are generated instead.
1788 .Bl -hang -width "openssl dsa"
1792 .Fl aes128 | aes192 | aes256 |
1796 .Op Fl inform Cm der | pem | pvk
1800 .Op Fl outform Cm der | pem | pvk
1801 .Op Fl passin Ar arg
1802 .Op Fl passout Ar arg
1805 .Op Fl pvk-none | pvk-strong | pvk-weak
1812 command processes DSA keys.
1813 They can be converted between various forms and their components printed out.
1816 This command uses the traditional
1818 compatible format for private key encryption:
1819 newer applications should use the more secure PKCS#8 format using the
1823 The options are as follows:
1826 .Fl aes128 | aes192 | aes256 |
1829 Encrypt the private key with the AES, DES, or the triple DES
1830 ciphers, respectively, before outputting it.
1831 A pass phrase is prompted for.
1832 If none of these options are specified, the key is written in plain text.
1833 This means that using the
1835 utility to read an encrypted key with no encryption option can be used to
1836 remove the pass phrase from a key,
1837 or by setting the encryption options it can be used to add or change
1839 These options can only be used with PEM format output files.
1841 The input file to read from,
1842 or standard input if not specified.
1843 If the key is encrypted, a pass phrase will be prompted for.
1844 .It Fl inform Cm der | pem | pvk
1847 Print the value of the public key component of the key.
1849 Do not output the encoded version of the key.
1851 The output file to write to,
1852 or standard output if not specified.
1853 If any encryption options are set then a pass phrase will be
1855 .It Fl outform Cm der | pem | pvk
1857 .It Fl passin Ar arg
1858 The key password source.
1859 .It Fl passout Ar arg
1860 The output file password source.
1862 Read in a public key, not a private key.
1864 Output a public key, not a private key.
1865 Automatically set if the input is a public key.
1867 .Fl pvk-none | pvk-strong | pvk-weak
1869 Enable or disable PVK encoding.
1873 Print the public/private key in plain text.
1877 .Bl -hang -width "openssl dsaparam"
1878 .It Nm openssl dsaparam
1883 .Op Fl inform Cm der | pem
1886 .Op Fl outform Cm der | pem
1894 command is used to manipulate or generate DSA parameter files.
1896 The options are as follows:
1899 Convert the parameters into C code.
1900 The parameters can then be loaded by calling the
1901 .No get_dsa Ns Ar XXX
1904 Generate a DSA key either using the specified or generated
1907 The input file to read from,
1908 or standard input if not specified.
1911 parameter is included, then this option is ignored.
1912 .It Fl inform Cm der | pem
1915 Do not output the encoded version of the parameters.
1917 The output file to write to,
1918 or standard output if not specified.
1919 .It Fl outform Cm der | pem
1922 Print the DSA parameters in plain text.
1924 Generate a parameter set of size
1926 If this option is included, the input file is ignored.
1930 .Bl -hang -width "openssl ec"
1933 .Op Fl conv_form Ar arg
1937 .Op Fl inform Cm der | pem
1940 .Op Fl outform Cm der | pem
1941 .Op Fl param_enc Ar arg
1943 .Op Fl passin Ar arg
1944 .Op Fl passout Ar arg
1953 command processes EC keys.
1954 They can be converted between various
1955 forms and their components printed out.
1957 uses the private key format specified in
1958 .Dq SEC 1: Elliptic Curve Cryptography
1959 .Pq Lk https://www.secg.org/ .
1961 EC private key into the PKCS#8 private key format use the
1965 The options are as follows:
1967 .It Fl conv_form Ar arg
1968 Specify how the points on the elliptic curve are converted
1970 Possible values are:
1976 For more information regarding
1977 the point conversion forms see the X9.62 standard.
1979 Due to patent issues the
1981 option is disabled by default for binary curves
1982 and can be enabled by defining the preprocessor macro
1983 .Dv OPENSSL_EC_BIN_PT_COMP
1986 Encrypt the private key with DES, triple DES, or
1987 any other cipher supported by
1989 A pass phrase is prompted for.
1990 If none of these options are specified, the key is written in plain text.
1991 This means that using the
1993 utility to read in an encrypted key with no
1994 encryption option can be used to remove the pass phrase from a key,
1995 or by setting the encryption options
1996 it can be used to add or change the pass phrase.
1997 These options can only be used with PEM format output files.
1999 The input file to read a key from,
2000 or standard input if not specified.
2001 If the key is encrypted, a pass phrase will be prompted for.
2002 .It Fl inform Cm der | pem
2005 Do not output the encoded version of the key.
2007 The output filename to write to,
2008 or standard output if not specified.
2009 If any encryption options are set then a pass phrase will be prompted for.
2010 .It Fl outform Cm der | pem
2012 .It Fl param_enc Ar arg
2013 Specify how the elliptic curve parameters are encoded.
2016 i.e. the EC parameters are specified by an OID; or
2018 where the EC parameters are explicitly given
2019 (see RFC 3279 for the definition of the EC parameter structures).
2020 The default value is
2025 as specified in RFC 3279,
2026 is currently not implemented.
2028 Print the elliptic curve parameters.
2029 .It Fl passin Ar arg
2030 The key password source.
2031 .It Fl passout Ar arg
2032 The output file password source.
2034 Read in a public key, not a private key.
2036 Output a public key, not a private key.
2037 Automatically set if the input is a public key.
2039 Print the public/private key in plain text.
2043 .Bl -hang -width "openssl ecparam"
2044 .It Nm openssl ecparam
2048 .Op Fl conv_form Ar arg
2051 .Op Fl inform Cm der | pem
2057 .Op Fl outform Cm der | pem
2058 .Op Fl param_enc Ar arg
2065 command is used to manipulate or generate EC parameter files.
2067 is not able to generate new groups so
2069 can only create EC parameters from known (named) curves.
2071 The options are as follows:
2074 Convert the EC parameters into C code.
2075 The parameters can then be loaded by calling the
2076 .No get_ec_group_ Ns Ar XXX
2079 Validate the elliptic curve parameters.
2080 .It Fl conv_form Ar arg
2081 Specify how the points on the elliptic curve are converted
2083 Possible values are:
2089 For more information regarding
2090 the point conversion forms see the X9.62 standard.
2092 Due to patent issues the
2094 option is disabled by default for binary curves
2095 and can be enabled by defining the preprocessor macro
2096 .Dv OPENSSL_EC_BIN_PT_COMP
2099 Generate an EC private key using the specified parameters.
2101 The input file to read from,
2102 or standard input if not specified.
2103 .It Fl inform Cm der | pem
2107 currently implemented EC parameter names and exit.
2109 Use the EC parameters with the specified "short" name.
2111 Do not include the seed for the parameter generation
2112 in the ECParameters structure (see RFC 3279).
2114 Do not output the encoded version of the parameters.
2116 The output file to write to,
2117 or standard output if not specified.
2118 .It Fl outform Cm der | pem
2120 .It Fl param_enc Ar arg
2121 Specify how the elliptic curve parameters are encoded.
2124 i.e. the EC parameters are specified by an OID, or
2126 where the EC parameters are explicitly given
2127 (see RFC 3279 for the definition of the EC parameter structures).
2128 The default value is
2132 alternative, as specified in RFC 3279,
2133 is currently not implemented.
2135 Print the EC parameters in plain text.
2139 .Bl -hang -width "openssl enc"
2145 .Op Fl bufsize Ar number
2148 .Op Fl iter Ar iterations
2151 .Op Fl k Ar password
2152 .Op Fl kfile Ar file
2165 The symmetric cipher commands allow data to be encrypted or decrypted
2166 using various block and stream ciphers using keys based on passwords
2167 or explicitly provided.
2168 Base64 encoding or decoding can also be performed either by itself
2169 or in addition to the encryption or decryption.
2170 The program can be called either as
2171 .Nm openssl Ar ciphername
2173 .Nm openssl enc - Ns Ar ciphername .
2175 Some of the ciphers do not have large keys and others have security
2176 implications if not used correctly.
2177 All the block ciphers normally use PKCS#5 padding,
2178 also known as standard block padding.
2179 If padding is disabled, the input data must be a multiple of the cipher
2182 The options are as follows:
2187 option is set, then base64 process the data on one line.
2189 Base64 process the data.
2190 This means that if encryption is taking place, the data is base64-encoded
2192 If decryption is set, the input data is base64-decoded before
2194 .It Fl bufsize Ar number
2195 Set the buffer size for I/O.
2197 Decrypt the input data.
2199 Debug the BIOs used for I/O.
2201 Encrypt the input data.
2202 This is the default.
2204 The input file to read from,
2205 or standard input if not specified.
2206 .It Fl iter Ar iterations
2207 Use the pbkdf2 key derivation function, with
2209 as the number of iterations.
2213 .Pq initialisation vector
2215 this must be represented as a string comprised only of hex digits.
2218 is specified using the
2221 the IV must explicitly be defined.
2222 When a password is being specified using one of the other options,
2223 the IV is generated from this password.
2228 this must be represented as a string comprised only of hex digits.
2229 If only the key is specified,
2230 the IV must also be specified using the
2241 option will be used and the IV generated from the password will be taken.
2242 It probably does not make much sense to specify both
2246 .It Fl k Ar password
2249 to derive the key from.
2253 .It Fl kfile Ar file
2254 Read the password to derive the key from the first line of
2262 to create a key from a pass phrase.
2263 Currently, the default value is
2266 Use NULL cipher (no encryption or decryption of input).
2268 Disable standard block padding.
2270 Don't use a salt in the key derivation routines.
2271 This option should never be used
2272 since it makes it possible to perform efficient dictionary
2273 attacks on the password and to attack stream cipher encrypted data.
2275 The output file to write to,
2276 or standard output if not specified.
2278 Print out the salt, key, and IV used, then immediately exit;
2279 don't do any encryption or decryption.
2281 Print out the salt, key, and IV used.
2283 The password source.
2285 Use the pbkdf2 key derivation function, with
2286 the default of 10000 iterations.
2291 this must be represented as a string comprised only of hex digits.
2293 Use a salt in the key derivation routines (the default).
2294 When the salt is being used,
2295 the first eight bytes of the encrypted data are reserved for the salt:
2296 it is randomly generated when encrypting a file and read from the
2297 encrypted file when it is decrypted.
2299 Print extra details about the processing.
2309 command performs error number to error string conversion,
2310 generating a human-readable string representing the error code
2312 The string is obtained through the
2313 .Xr ERR_error_string_n 3
2314 function and has the following format:
2316 .Dl error:[error code]:[library name]:[function name]:[reason string]
2319 is an 8-digit hexadecimal number.
2320 The remaining fields
2327 The options are as follows:
2330 Print debugging statistics about various aspects of the hash table.
2334 .Bl -hang -width "openssl gendsa"
2335 .It Nm openssl gendsa
2338 .Fl aes128 | aes192 | aes256 | camellia128 |
2339 .Fl camellia192 | camellia256 | des | des3 | idea
2342 .Op Fl passout Ar arg
2349 command generates a DSA private key from a DSA parameter file
2350 (typically generated by the
2351 .Nm openssl dsaparam
2353 DSA key generation is little more than random number generation so it is
2358 The options are as follows:
2361 .Fl aes128 | aes192 | aes256 |
2362 .Fl camellia128 | camellia192 | camellia256 |
2366 Encrypt the private key with the AES, CAMELLIA, DES, triple DES
2367 or the IDEA ciphers, respectively, before outputting it.
2368 A pass phrase is prompted for.
2369 If none of these options are specified, no encryption is used.
2371 The output file to write to,
2372 or standard output if not specified.
2373 .It Fl passout Ar arg
2374 The output file password source.
2376 Specify the DSA parameter file to use.
2377 The parameters in this file determine the size of the private key.
2381 .Bl -hang -width "openssl genpkey"
2382 .It Nm openssl genpkey
2384 .Op Fl algorithm Ar alg
2388 .Op Fl outform Cm der | pem
2389 .Op Fl paramfile Ar file
2391 .Op Fl pkeyopt Ar opt : Ns Ar value
2398 command generates private keys.
2400 program is encouraged over the algorithm specific utilities
2401 because additional algorithm options can be used.
2403 The options are as follows:
2405 .It Fl algorithm Ar alg
2406 The public key algorithm to use,
2407 such as RSA, DSA, or DH.
2408 This option must precede any
2415 are mutually exclusive.
2417 Encrypt the private key with the supplied cipher.
2418 Any algorithm name accepted by
2419 .Xr EVP_get_cipherbyname 3
2422 Generate a set of parameters instead of a private key.
2423 This option must precede any
2430 The output file to write to,
2431 or standard output if not specified.
2432 .It Fl outform Cm der | pem
2434 .It Fl paramfile Ar file
2435 Some public key algorithms generate a private key based on a set of parameters,
2436 which can be supplied using this option.
2437 If this option is used, the public key
2438 algorithm used is determined by the parameters.
2439 This option must precede any
2446 are mutually exclusive.
2448 The output file password source.
2449 .It Fl pkeyopt Ar opt : Ns Ar value
2450 Set the public key algorithm option
2455 .Bl -tag -width Ds -offset indent
2456 .It rsa_keygen_bits : Ns Ar numbits
2458 The number of bits in the generated key.
2459 The default is 2048.
2460 .It rsa_keygen_pubexp : Ns Ar value
2462 The RSA public exponent value.
2463 This can be a large decimal or hexadecimal value if preceded by 0x.
2464 The default is 65537.
2465 .It dsa_paramgen_bits : Ns Ar numbits
2467 The number of bits in the generated parameters.
2468 The default is 1024.
2469 .It dh_paramgen_prime_len : Ns Ar numbits
2471 The number of bits in the prime parameter
2473 .It dh_paramgen_generator : Ns Ar value
2475 The value to use for the generator
2477 .It ec_paramgen_curve : Ns Ar curve
2479 The elliptic curve to use.
2482 Print the private/public key in plain text.
2486 .Bl -hang -width "openssl genrsa"
2487 .It Nm openssl genrsa
2491 .Fl aes128 | aes192 | aes256 | camellia128 |
2492 .Fl camellia192 | camellia256 | des | des3 | idea
2495 .Op Fl passout Ar arg
2502 command generates an RSA private key,
2503 which essentially involves the generation of two prime numbers.
2504 When generating the key,
2505 various symbols will be output to indicate the progress of the generation.
2508 represents each number which has passed an initial sieve test;
2510 means a number has passed a single round of the Miller-Rabin primality test;
2512 means the number has failed primality testing
2513 and needs to be generated afresh.
2514 A newline means that the number has passed all the prime tests
2515 (the actual number depends on the key size).
2517 The options are as follows:
2520 The public exponent to use, either 3 or 65537.
2521 The default is 65537.
2523 .Fl aes128 | aes192 | aes256 |
2524 .Fl camellia128 | camellia192 | camellia256 |
2528 Encrypt the private key with the AES, CAMELLIA, DES, triple DES
2529 or the IDEA ciphers, respectively, before outputting it.
2530 If none of these options are specified, no encryption is used.
2531 If encryption is used, a pass phrase is prompted for,
2532 if it is not supplied via the
2536 The output file to write to,
2537 or standard output if not specified.
2538 .It Fl passout Ar arg
2539 The output file password source.
2541 The size of the private key to generate in bits.
2542 This must be the last option specified.
2543 The default is 2048.
2554 command takes a file containing a Netscape certificate sequence
2555 (an alternative to the standard PKCS#7 format)
2556 and prints out the certificates contained in it,
2557 or takes a file of certificates
2558 and converts it into a Netscape certificate sequence.
2560 The options are as follows:
2563 The input file to read from,
2564 or standard input if not specified.
2566 The output file to write to,
2567 or standard output if not specified.
2569 Normally, a Netscape certificate sequence will be input and the output
2570 is the certificates contained in it.
2573 option the situation is reversed:
2574 a Netscape certificate sequence is created from a file of certificates.
2578 .Bl -hang -width "openssl ocsp"
2582 .Op Fl CAfile Ar file
2583 .Op Fl CApath Ar directory
2586 .Op Fl header Ar name value
2587 .Op Fl host Ar hostname : Ns Ar port
2589 .Op Fl index Ar indexfile
2590 .Op Fl issuer Ar file
2591 .Op Fl ndays Ar days
2592 .Op Fl nmin Ar minutes
2593 .Op Fl no_cert_checks
2594 .Op Fl no_cert_verify
2600 .Op Fl no_signature_verify
2603 .Op Fl nrequest Ar number
2606 .Op Fl port Ar portnum
2608 .Op Fl reqin Ar file
2609 .Op Fl reqout Ar file
2611 .Op Fl resp_no_certs
2613 .Op Fl respin Ar file
2614 .Op Fl respout Ar file
2616 .Op Fl rother Ar file
2617 .Op Fl rsigner Ar file
2618 .Op Fl serial Ar num
2619 .Op Fl sign_other Ar file
2620 .Op Fl signer Ar file
2621 .Op Fl signkey Ar file
2622 .Op Fl status_age Ar age
2624 .Op Fl timeout Ar seconds
2626 .Op Fl url Ar responder_url
2627 .Op Fl VAfile Ar file
2628 .Op Fl validity_period Ar nsec
2629 .Op Fl verify_other Ar file
2633 The Online Certificate Status Protocol (OCSP)
2634 enables applications to determine the (revocation) state
2635 of an identified certificate (RFC 2560).
2639 command performs many common OCSP tasks.
2640 It can be used to print out requests and responses,
2641 create requests and send queries to an OCSP responder,
2642 and behave like a mini OCSP server itself.
2644 The options are as follows:
2646 .It Fl CAfile Ar file , Fl CApath Ar directory
2647 A file or path containing trusted CA certificates,
2648 used to verify the signature on the OCSP response.
2653 The issuer certificate is taken from the previous
2655 option, or an error occurs if no issuer certificate is specified.
2657 Use the digest algorithm
2659 for certificate identification in the OCSP request.
2660 By default SHA1 is used.
2662 .Fl host Ar hostname : Ns Ar port ,
2671 specifies the HTTP path name to use, or
2674 .It Fl header Ar name value
2675 Add the header name with the specified value to the OCSP request that is sent
2677 This may be repeated.
2678 .It Fl issuer Ar file
2679 The current issuer certificate, in PEM format.
2680 Can be used multiple times and must come before any
2683 .It Fl no_cert_checks
2684 Don't perform any additional checks on the OCSP response signer's certificate.
2685 That is, do not make any checks to see if the signer's certificate is
2686 authorised to provide the necessary status information:
2687 as a result this option should only be used for testing purposes.
2688 .It Fl no_cert_verify
2689 Don't verify the OCSP response signer's certificate at all.
2690 Since this option allows the OCSP response to be signed by any certificate,
2691 it should only be used for testing purposes.
2693 Don't include any certificates in the signed request.
2695 Do not use certificates in the response as additional untrusted CA
2698 Don't check the explicit trust for OCSP signing in the root CA certificate.
2700 Ignore certificates contained in the OCSP response
2701 when searching for the signer's certificate.
2702 The signer's certificate must be specified with either the
2707 .It Fl no_signature_verify
2708 Don't check the signature on the OCSP response.
2709 Since this option tolerates invalid signatures on OCSP responses,
2710 it will normally only be used for testing purposes.
2711 .It Fl nonce , no_nonce
2712 Add an OCSP nonce extension to a request,
2713 or disable an OCSP nonce addition.
2714 Normally, if an OCSP request is input using the
2716 option no nonce is added:
2719 option will force the addition of a nonce.
2720 If an OCSP request is being created (using the
2725 a nonce is automatically added; specifying
2729 Don't attempt to verify the OCSP response signature or the nonce values.
2730 This is normally only be used for debugging
2731 since it disables all verification of the responder's certificate.
2733 Specify the output file to write to,
2734 or standard output if not specified.
2735 .It Fl req_text , resp_text , text
2736 Print out the text form of the OCSP request, response, or both, respectively.
2737 .It Fl reqin Ar file , Fl respin Ar file
2738 Read an OCSP request or response file from
2740 These options are ignored
2741 if an OCSP request or response creation is implied by other options
2742 (for example with the
2747 .It Fl reqout Ar file , Fl respout Ar file
2748 Write out the DER-encoded certificate request or response to
2750 .It Fl serial Ar num
2753 option except the certificate with serial number
2755 is added to the request.
2756 The serial number is interpreted as a decimal integer unless preceded by
2758 Negative integers can also be specified
2759 by preceding the value with a minus sign.
2760 .It Fl sign_other Ar file
2761 Additional certificates to include in the signed request.
2762 .It Fl signer Ar file , Fl signkey Ar file
2763 Sign the OCSP request using the certificate specified in the
2765 option and the private key specified by the
2770 option is not present, then the private key is read from the same file
2772 If neither option is specified, the OCSP request is not signed.
2773 .It Fl timeout Ar seconds
2774 Connection timeout to the OCSP responder in seconds.
2776 The certificates specified by the
2778 option should be explicitly trusted and no additional checks will be
2780 This is useful when the complete responder certificate chain is not available
2781 or trusting a root CA is not appropriate.
2782 .It Fl url Ar responder_url
2783 Specify the responder URL.
2786 URLs can be specified.
2787 .It Fl VAfile Ar file
2788 A file containing explicitly trusted responder certificates.
2794 .It Fl validity_period Ar nsec , Fl status_age Ar age
2795 The range of times, in seconds, which will be tolerated in an OCSP response.
2796 Each certificate status response includes a notBefore time
2797 and an optional notAfter time.
2798 The current time should fall between these two values,
2799 but the interval between the two times may be only a few seconds.
2800 In practice the OCSP responder and clients' clocks may not be precisely
2801 synchronised and so such a check may fail.
2804 option can be used to specify an acceptable error range in seconds,
2805 the default value being 5 minutes.
2807 If the notAfter time is omitted from a response,
2808 it means that new status information is immediately available.
2809 In this case the age of the notBefore field is checked
2810 to see it is not older than
2813 By default, this additional check is not performed.
2814 .It Fl verify_other Ar file
2815 A file containing additional certificates to search
2816 when attempting to locate the OCSP response signing certificate.
2817 Some responders omit the actual signer's certificate from the response,
2818 so this can be used to supply the necessary certificate.
2821 The options for the OCSP server are as follows:
2822 .Bl -tag -width "XXXX"
2824 CA certificate corresponding to the revocation information in
2827 Ignore the invalid response.
2828 .It Fl index Ar indexfile
2830 is a text index file in ca format
2831 containing certificate revocation information.
2833 If this option is specified,
2835 is in responder mode, otherwise it is in client mode.
2836 The requests the responder processes can be either specified on
2837 the command line (using the
2841 options), supplied in a file (using the
2843 option), or via external OCSP clients (if
2849 If this option is present, then the
2853 options must also be present.
2854 .It Fl nmin Ar minutes , Fl ndays Ar days
2859 when fresh revocation information is available:
2860 used in the nextUpdate field.
2861 If neither option is present,
2862 the nextUpdate field is omitted,
2863 meaning fresh revocation information is immediately available.
2864 .It Fl nrequest Ar number
2865 Exit after receiving
2867 requests (the default is unlimited).
2868 .It Fl port Ar portnum
2869 Port to listen for OCSP requests on.
2870 May also be specified using the
2874 Identify the signer certificate using the key ID;
2875 the default is to use the subject name.
2876 .It Fl resp_no_certs
2877 Don't include any certificates in the OCSP response.
2879 The private key to sign OCSP responses with;
2880 if not present, the file specified in the
2883 .It Fl rother Ar file
2884 Additional certificates to include in the OCSP response.
2885 .It Fl rsigner Ar file
2886 The certificate to sign OCSP responses with.
2889 Initially the OCSP responder certificate is located and the signature on
2890 the OCSP request checked using the responder certificate's public key.
2891 Then a normal certificate verify is performed on the OCSP responder certificate
2892 building up a certificate chain in the process.
2893 The locations of the trusted certificates used to build the chain can be
2898 options or they will be looked for in the standard
2900 certificates directory.
2902 If the initial verify fails, the OCSP verify process halts with an error.
2903 Otherwise the issuing CA certificate in the request is compared to the OCSP
2904 responder certificate: if there is a match then the OCSP verify succeeds.
2906 Otherwise the OCSP responder certificate's CA is checked against the issuing
2907 CA certificate in the request.
2908 If there is a match and the OCSPSigning extended key usage is present
2909 in the OCSP responder certificate, then the OCSP verify succeeds.
2911 Otherwise the root CA of the OCSP responder's CA is checked to see if it
2912 is trusted for OCSP signing.
2913 If it is, the OCSP verify succeeds.
2915 If none of these checks is successful, the OCSP verify fails.
2916 What this effectively means is that if the OCSP responder certificate is
2917 authorised directly by the CA it is issuing revocation information about
2918 (and it is correctly configured),
2919 then verification will succeed.
2921 If the OCSP responder is a global responder,
2922 which can give details about multiple CAs
2923 and has its own separate certificate chain,
2924 then its root CA can be trusted for OCSP signing.
2925 Alternatively, the responder certificate itself can be explicitly trusted
2931 .Bl -hang -width "openssl passwd"
2932 .It Nm openssl passwd
2934 .Op Fl 1 | apr1 | crypt
2939 .Op Fl salt Ar string
2948 command computes the hash of a password.
2950 The options are as follows:
2962 Apache variant of the
2969 algorithm (the default).
2974 Don't verify when reading a password from the terminal.
2976 Don't output warnings when passwords given on the command line are truncated.
2978 Switch table columns.
2979 This only makes sense in conjunction with the
2982 .It Fl salt Ar string
2983 Use the salt specified by
2985 When reading a password from the terminal, this implies
2988 Read passwords from standard input.
2990 In the output list, prepend the cleartext password and a TAB character
2991 to each password hash.
2995 .Bl -hang -width "openssl pkcs7"
2996 .It Nm openssl pkcs7
2999 .Op Fl inform Cm der | pem
3002 .Op Fl outform Cm der | pem
3011 command processes PKCS#7 files in DER or PEM format.
3012 The PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC 2315.
3014 The options are as follows:
3017 The input file to read from,
3018 or standard input if not specified.
3019 .It Fl inform Cm der | pem
3022 Don't output the encoded version of the PKCS#7 structure
3027 The output to write to,
3028 or standard output if not specified.
3029 .It Fl outform Cm der | pem
3032 Print the ASN.1 representation of PKCS#7 structure.
3034 Print any certificates or CRLs contained in the file,
3035 preceded by their subject and issuer names in a one-line format.
3037 Print certificate details in full rather than just subject and issuer names.
3041 .Bl -hang -width "openssl pkcs8"
3042 .It Nm openssl pkcs8
3045 .Op Fl inform Cm der | pem
3049 .Op Fl outform Cm der | pem
3050 .Op Fl passin Ar arg
3051 .Op Fl passout Ar arg
3060 command processes private keys
3061 (both encrypted and unencrypted)
3063 with a variety of PKCS#5 (v1.5 and v2.0) and PKCS#12 algorithms.
3064 The default encryption is only 56 bits;
3065 keys encrypted using PKCS#5 v2.0 algorithms and high iteration counts
3068 The options are as follows:
3071 The input file to read from,
3072 or standard input if not specified.
3073 If the key is encrypted, a pass phrase will be prompted for.
3074 .It Fl inform Cm der | pem
3077 Generate an unencrypted PrivateKeyInfo structure.
3078 This option does not encrypt private keys at all
3079 and should only be used when absolutely necessary.
3081 Use an iteration count of 1.
3084 section below for a detailed explanation of this option.
3086 The output file to write to,
3087 or standard output if none is specified.
3088 If any encryption options are set, a pass phrase will be prompted for.
3089 .It Fl outform Cm der | pem
3091 .It Fl passin Ar arg
3092 The key password source.
3093 .It Fl passout Ar arg
3094 The output file password source.
3096 Read a traditional format private key and write a PKCS#8 format key.
3098 Specify a PKCS#5 v1.5 or PKCS#12 algorithm to use.
3100 .Bl -tag -width "XXXX" -compact
3103 .It PBE-SHA1-RC2-64 | PBE-MD5-RC2-64 | PBE-SHA1-DES
3104 64-bit RC2 or 56-bit DES.
3105 .It PBE-SHA1-RC4-128 | PBE-SHA1-RC4-40 | PBE-SHA1-3DES
3106 .It PBE-SHA1-2DES | PBE-SHA1-RC2-128 | PBE-SHA1-RC2-40
3107 PKCS#12 password-based encryption algorithm,
3108 which allow strong encryption algorithms like triple DES or 128-bit RC2.
3111 Use PKCS#5 v2.0 algorithms.
3112 Supports algorithms such as 168-bit triple DES or 128-bit RC2,
3113 however not many implementations support PKCS#5 v2.0 yet
3114 (if using private keys with
3116 this doesn't matter).
3119 is the encryption algorithm to use;
3120 valid values include des, des3, and rc2.
3121 It is recommended that des3 is used.
3125 .Bl -hang -width "openssl pkcs12"
3126 .It Nm openssl pkcs12
3129 .Fl aes128 | aes192 | aes256 | camellia128 |
3130 .Fl camellia192 | camellia256 | des | des3 | idea
3133 .Op Fl CAfile Ar file
3134 .Op Fl caname Ar name
3135 .Op Fl CApath Ar directory
3136 .Op Fl certfile Ar file
3137 .Op Fl certpbe Ar alg
3145 .Op Fl inkey Ar file
3147 .Op Fl keypbe Ar alg
3150 .Op Fl macalg Ar alg
3162 .Op Fl passin Ar arg
3163 .Op Fl passout Ar arg
3164 .Op Fl password Ar arg
3171 command allows PKCS#12 files
3172 .Pq sometimes referred to as PFX files
3173 to be created and parsed.
3174 By default, a PKCS#12 file is parsed;
3175 a PKCS#12 file can be created by using the
3179 The options for parsing a PKCS12 file are as follows:
3180 .Bl -tag -width "XXXX"
3182 .Fl aes128 | aes192 | aes256 |
3183 .Fl camellia128 | camellia192 | camellia256 |
3187 Encrypt private keys using AES, CAMELLIA, DES, triple DES
3188 or the IDEA ciphers, respectively.
3189 The default is triple DES.
3191 Only output CA certificates
3192 .Pq not client certificates .
3194 Only output client certificates
3195 .Pq not CA certificates .
3197 The input file to read from,
3198 or standard input if not specified.
3200 Output additional information about the PKCS#12 file structure,
3201 algorithms used, and iteration counts.
3203 Do not output certificates.
3205 Do not encrypt private keys.
3207 Do not output private keys.
3209 Do not attempt to verify the integrity MAC before reading the file.
3211 Do not output the keys and certificates to the output file
3212 version of the PKCS#12 file.
3214 The output file to write to,
3215 or standard output if not specified.
3216 .It Fl passin Ar arg
3217 The key password source.
3218 .It Fl passout Ar arg
3219 The output file password source.
3221 Prompt for separate integrity and encryption passwords: most software
3222 always assumes these are the same so this option will render such
3223 PKCS#12 files unreadable.
3226 The options for PKCS12 file creation are as follows:
3227 .Bl -tag -width "XXXX"
3228 .It Fl CAfile Ar file
3229 CA storage as a file.
3230 .It Fl CApath Ar directory
3231 CA storage as a directory.
3232 The directory must be a standard certificate directory:
3233 that is, a hash of each subject name (using
3235 should be linked to each certificate.
3236 .It Fl caname Ar name
3239 for other certificates.
3240 May be used multiple times to specify names for all certificates
3241 in the order they appear.
3242 .It Fl certfile Ar file
3243 A file to read additional certificates from.
3244 .It Fl certpbe Ar alg , Fl keypbe Ar alg
3245 Specify the algorithm used to encrypt the private key and
3246 certificates to be selected.
3247 Any PKCS#5 v1.5 or PKCS#12 PBE algorithm name can be used.
3250 .Cm list-cipher-algorithms
3251 command) is specified then it
3252 is used with PKCS#5 v2.0.
3253 For interoperability reasons it is advisable to only use PKCS#12 algorithms.
3255 Include the entire certificate chain of the user certificate.
3256 The standard CA store is used for this search.
3257 If the search fails, it is considered a fatal error.
3261 as a Microsoft CSP name.
3263 Encrypt the certificate using triple DES; this may render the PKCS#12
3264 file unreadable by some
3267 By default, the private key is encrypted using triple DES and the
3268 certificate using 40-bit RC2.
3270 Create a PKCS#12 file (rather than parsing one).
3272 The input file to read from,
3273 or standard input if not specified.
3274 The order doesn't matter but one private key and its corresponding
3275 certificate should be present.
3276 If additional certificates are present, they will also be included
3277 in the PKCS#12 file.
3278 .It Fl inkey Ar file
3279 File to read a private key from.
3280 If not present, a private key must be present in the input file.
3281 .It Fl keyex | keysig
3282 Specify whether the private key is to be used for key exchange or just signing.
3285 software will only allow 512-bit RSA keys to be
3286 used for encryption purposes, but arbitrary length keys for signing.
3289 option marks the key for signing only.
3290 Signing only keys can be used for S/MIME signing, authenticode
3291 (ActiveX control signing)
3292 and SSL client authentication.
3294 Add local machine keyset attribute to private key.
3295 .It Fl macalg Ar alg
3296 Specify the MAC digest algorithm.
3297 The default is SHA1.
3299 Included for compatibility only:
3300 it used to be needed to use MAC iterations counts
3301 but they are now used by default.
3305 for the certificate and private key.
3306 This name is typically displayed in list boxes by software importing the file.
3308 Don't attempt to provide the MAC integrity.
3309 .It Fl nomaciter , noiter
3310 Affect the iteration counts on the MAC and key algorithms.
3312 To discourage attacks by using large dictionaries of common passwords,
3313 the algorithm that derives keys from passwords can have an iteration count
3314 applied to it: this causes a certain part of the algorithm to be repeated
3316 The MAC is used to check the file integrity but since it will normally
3317 have the same password as the keys and certificates it could also be attacked.
3318 By default, both MAC and encryption iteration counts are set to 2048;
3319 using these options the MAC and encryption iteration counts can be set to 1.
3320 Since this reduces the file security, you should not use these options
3321 unless you really have to.
3322 Most software supports both MAC and key iteration counts.
3324 The output file to write to,
3325 or standard output if not specified.
3326 .It Fl passin Ar arg
3327 The key password source.
3328 .It Fl passout Ar arg
3329 The output file password source.
3330 .It Fl password Ar arg
3343 .Bl -hang -width "openssl pkey"
3349 .Op Fl inform Cm der | pem
3352 .Op Fl outform Cm der | pem
3353 .Op Fl passin Ar arg
3354 .Op Fl passout Ar arg
3365 command processes public or private keys.
3366 They can be converted between various forms
3367 and their components printed out.
3369 The options are as follows:
3372 Check the validity of a key pair.
3374 Encrypt the private key with the specified cipher.
3375 Any algorithm name accepted by
3376 .Xr EVP_get_cipherbyname 3
3377 is acceptable, such as
3380 The input file to read from,
3381 or standard input if not specified.
3382 If the key is encrypted, a pass phrase will be prompted for.
3383 .It Fl inform Cm der | pem
3386 Do not output the encoded version of the key.
3388 The output file to write to,
3389 or standard output if not specified.
3390 If any encryption options are set then a pass phrase
3391 will be prompted for.
3392 .It Fl outform Cm der | pem
3394 .It Fl passin Ar arg
3395 The key password source.
3396 .It Fl passout Ar arg
3397 The output file password source.
3399 Check the validity of a public key
3400 or the public component of a key pair.
3402 Read in a public key, not a private key.
3404 Output a public key, not a private key.
3405 Automatically set if the input is a public key.
3407 Print the public/private key in plain text.
3409 Print out only public key components
3410 even if a private key is being processed.
3414 .Cm openssl pkeyparam
3423 command processes public or private keys.
3424 The key type is determined by the PEM headers.
3426 The options are as follows:
3429 check the correctness of parameters.
3431 The input file to read from,
3432 or standard input if not specified.
3434 Do not output the encoded version of the parameters.
3436 The output file to write to,
3437 or standard output if not specified.
3439 Print the parameters in plain text.
3443 .Bl -hang -width "openssl pkeyutl"
3444 .It Nm openssl pkeyutl
3453 .Op Fl inkey Ar file
3454 .Op Fl keyform Cm der | pem
3456 .Op Fl passin Ar arg
3457 .Op Fl peerform Cm der | pem
3458 .Op Fl peerkey Ar file
3459 .Op Fl pkeyopt Ar opt : Ns Ar value
3462 .Op Fl sigfile Ar file
3465 .Op Fl verifyrecover
3471 command can be used to perform public key operations using
3472 any supported algorithm.
3474 The options are as follows:
3477 ASN.1 parse the output data.
3478 This is useful when combined with the
3480 option when an ASN.1 structure is signed.
3482 The input is a certificate containing a public key.
3484 Decrypt the input data using a private key.
3486 Derive a shared secret using the peer key.
3488 Encrypt the input data using a public key.
3490 Hex dump the output data.
3492 The input file to read from,
3493 or standard input if not specified.
3494 .It Fl inkey Ar file
3496 By default it should be a private key.
3497 .It Fl keyform Cm der | pem
3500 The output file to write to,
3501 or standard output if not specified.
3502 .It Fl passin Ar arg
3503 The key password source.
3504 .It Fl peerform Cm der | pem
3505 The peer key format.
3506 .It Fl peerkey Ar file
3507 The peer key file, used by key derivation (agreement) operations.
3508 .It Fl pkeyopt Ar opt : Ns Ar value
3509 Set the public key algorithm option
3513 Unless otherwise mentioned, all algorithms support the format
3514 .Ar digest : Ns Ar alg ,
3515 which specifies the digest to use
3516 for sign, verify, and verifyrecover operations.
3519 should represent a digest name as used in the
3520 .Xr EVP_get_digestbyname 3
3523 The RSA algorithm supports the
3524 encrypt, decrypt, sign, verify, and verifyrecover operations in general.
3525 Some padding modes only support some of these
3528 .It rsa_padding_mode : Ns Ar mode
3529 This sets the RSA padding mode.
3530 Acceptable values for
3545 In PKCS#1 padding if the message digest is not set then the supplied data is
3546 signed or verified directly instead of using a DigestInfo structure.
3547 If a digest is set then a DigestInfo
3548 structure is used and its length
3549 must correspond to the digest type.
3550 For oeap mode only encryption and decryption is supported.
3551 For x931 if the digest type is set it is used to format the block data;
3552 otherwise the first byte is used to specify the X9.31 digest ID.
3553 Sign, verify, and verifyrecover can be performed in this mode.
3554 For pss mode only sign and verify are supported and the digest type must be
3556 .It rsa_pss_saltlen : Ns Ar len
3558 mode only this option specifies the salt length.
3559 Two special values are supported:
3560 -1 sets the salt length to the digest length.
3561 When signing, -2 sets the salt length to the maximum permissible value.
3562 When verifying, -2 causes the salt length to be automatically determined
3563 based on the PSS block structure.
3566 The DSA algorithm supports the sign and verify operations.
3567 Currently there are no additional options other than
3569 Only the SHA1 digest can be used and this digest is assumed by default.
3571 The DH algorithm supports the derive operation
3572 and no additional options.
3574 The EC algorithm supports the sign, verify, and derive operations.
3575 The sign and verify operations use ECDSA and derive uses ECDH.
3576 Currently there are no additional options other than
3578 Only the SHA1 digest can be used and this digest is assumed by default.
3580 The input file is a public key.
3582 Reverse the order of the input buffer.
3583 .It Fl sigfile Ar file
3584 Signature file (verify operation only).
3586 Sign the input data and output the signed result.
3587 This requires a private key.
3589 Verify the input data against the signature file and indicate if the
3590 verification succeeded or failed.
3591 .It Fl verifyrecover
3592 Verify the input data and output the recovered data.
3606 command is used to generate prime numbers,
3607 or to check numbers for primality.
3608 Results are probabilistic:
3609 they have an exceedingly high likelihood of being correct,
3610 but are not guaranteed.
3612 The options are as follows:
3615 Specify the number of bits in the generated prime number.
3616 Must be used in conjunction with
3619 Perform a Miller-Rabin probabilistic primality test with
3624 Generate a pseudo-random prime number.
3625 Must be used in conjunction with
3628 Output in hex format.
3633 (i.e. a prime p so that (p-1)/2 is also prime).
3641 .Bl -hang -width "openssl rand"
3655 pseudo-random bytes.
3657 The options are as follows:
3660 Perform base64 encoding on the output.
3662 Specify hexadecimal output.
3664 The output file to write to,
3665 or standard output if not specified.
3669 .Bl -hang -width "openssl req"
3672 .Op Fl addext Ar ext
3674 .Op Fl config Ar file
3676 .Op Fl extensions Ar section
3678 .Op Fl inform Cm der | pem
3679 .Op Fl key Ar keyfile
3680 .Op Fl keyform Cm der | pem
3681 .Op Fl keyout Ar file
3682 .Op Fl md4 | md5 | sha1
3684 .Op Fl multivalue-rdn
3685 .Op Fl nameopt Ar option
3688 .Op Fl newkey Ar arg
3692 .Op Fl outform Cm der | pem
3693 .Op Fl passin Ar arg
3694 .Op Fl passout Ar arg
3695 .Op Fl pkeyopt Ar opt:value
3697 .Op Fl reqexts Ar section
3698 .Op Fl reqopt Ar option
3699 .Op Fl set_serial Ar n
3700 .Op Fl sigopt Ar nm:v
3713 command primarily creates and processes certificate requests
3715 It can additionally create self-signed certificates,
3716 for use as root CAs, for example.
3718 The options are as follows:
3720 .It Fl addext Ar ext
3721 Add a specific extension to the certificate (if the
3723 option is present) or certificate request.
3724 The argument must have the form of a key=value pair as it would appear in a
3726 This option can be given multiple times.
3728 Non-interactive mode.
3729 .It Fl config Ar file
3730 Specify an alternative configuration file.
3732 Specify the number of days to certify the certificate for.
3733 The default is 30 days.
3737 .It Fl extensions Ar section , Fl reqexts Ar section
3738 Specify alternative sections to include certificate
3741 or certificate request extensions,
3742 allowing several different sections to be used in the same configuration file.
3744 The input file to read a request from,
3745 or standard input if not specified.
3746 A request is only read if the creation options
3751 .It Fl inform Cm der | pem
3753 .It Fl key Ar keyfile
3754 The file to read the private key from.
3755 It also accepts PKCS#8 format private keys for PEM format files.
3756 .It Fl keyform Cm der | pem
3757 The format of the private key file specified in the
3762 .It Fl keyout Ar file
3763 The file to write the newly created private key to.
3764 If this option is not specified,
3765 the filename present in the configuration file is used.
3766 .It Fl md5 | sha1 | sha256
3767 The message digest to sign the request with.
3768 This overrides the digest algorithm specified in the configuration file.
3770 Some public key algorithms may override this choice.
3771 For instance, DSA signatures always use SHA1.
3773 Print the value of the modulus of the public key contained in the request.
3774 .It Fl multivalue-rdn
3775 This option causes the
3777 argument to be interpreted with full support for multivalued RDNs,
3779 .Qq "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" .
3782 is not used, the UID value is set to
3783 .Qq "123456+CN=John Doe" .
3784 .It Fl nameopt Ar option , Fl reqopt Ar option
3785 Determine how the subject or issuer names are displayed.
3787 can be a single option or multiple options separated by commas.
3788 Alternatively, these options may be used more than once to set multiple options.
3791 section below for details.
3793 Generate a new certificate request.
3794 The user is prompted for the relevant field values.
3795 The actual fields prompted for and their maximum and minimum sizes
3796 are specified in the configuration file and any requested extensions.
3800 option is not used, it will generate a new RSA private
3801 key using information specified in the configuration file.
3803 Add the word NEW to the PEM file header and footer lines
3804 on the outputted request.
3805 Some software and CAs need this.
3806 .It Fl newkey Ar arg
3807 Create a new certificate request and a new private key.
3808 The argument takes one of several forms.
3810 .No rsa : Ns Ar nbits
3811 generates an RSA key
3817 the default key size is used.
3819 .No dsa : Ns Ar file
3820 generates a DSA key using the parameters in
3823 .No param : Ns Ar file
3824 generates a key using the parameters or certificate in
3827 All other algorithms support the form
3828 .Ar algorithm : Ns Ar file ,
3829 where file may be an algorithm parameter file,
3831 .Cm genpkey -genparam
3832 command or an X.509 certificate for a key with appropriate algorithm.
3835 in which case any parameters can be specified via the
3839 Do not encrypt the private key.
3841 Do not output the encoded version of the request.
3843 The output file to write to,
3844 or standard output if not specified.
3845 .It Fl outform Cm der | pem
3847 .It Fl passin Ar arg
3848 The key password source.
3849 .It Fl passout Ar arg
3850 The output file password source.
3851 .It Fl pkeyopt Ar opt:value
3852 Set the public key algorithm option
3857 Output the public key.
3858 .It Fl reqopt Ar option
3859 Customise the output format used with
3863 argument can be a single option or multiple options separated by commas.
3864 See also the discussion of
3869 .It Fl set_serial Ar n
3870 Serial number to use when outputting a self-signed certificate.
3871 This may be specified as a decimal value or a hex value if preceded by
3873 It is possible to use negative serial numbers but this is not recommended.
3874 .It Fl sigopt Ar nm:v
3875 Pass options to the signature algorithm during sign operation.
3876 The names and values of these options are algorithm-specific.
3878 Replaces the subject field of an input request
3879 with the specified data and output the modified request.
3881 must be formatted as /type0=value0/type1=value1/type2=...;
3882 characters may be escaped by
3885 no spaces are skipped.
3887 Print the request subject (or certificate subject if
3891 Print the certificate request in plain text.
3893 Interpret field values as UTF8 strings, not ASCII.
3895 Print extra details about the operations being performed.
3897 Verify the signature on the request.
3899 Output a self-signed certificate instead of a certificate request.
3900 This is typically used to generate a test certificate or a self-signed root CA.
3901 The extensions added to the certificate (if any)
3902 are specified in the configuration file.
3903 Unless specified using the
3905 option, 0 is used for the serial number.
3908 The configuration options are specified in the
3910 section of the configuration file.
3911 The options available are as follows:
3912 .Bl -tag -width "XXXX"
3914 The section containing any request attributes: its format
3916 .Cm distinguished_name .
3917 Typically these may contain the challengePassword or unstructuredName types.
3918 They are currently ignored by the
3920 request signing utilities, but some CAs might want them.
3922 The default key size, in bits.
3923 The default is 2048.
3926 option is used and can be overridden by using the
3929 .It Cm default_keyfile
3930 The default file to write a private key to,
3931 or standard output if not specified.
3932 It can be overridden by the
3936 The digest algorithm to use.
3937 Possible values include
3943 It can be overridden on the command line.
3944 .It Cm distinguished_name
3945 The section containing the distinguished name fields to
3946 prompt for when generating a certificate or certificate request.
3947 The format is described below.
3951 and a private key is generated, it is not encrypted.
3952 It is equivalent to the
3957 is an equivalent option.
3958 .It Cm input_password | output_password
3959 The passwords for the input private key file (if present)
3960 and the output private key file (if one will be created).
3961 The command line options
3965 override the configuration file values.
3967 A file containing additional OBJECT IDENTIFIERS.
3968 Each line of the file should consist of the numerical form of the
3969 object identifier, followed by whitespace, then the short name followed
3970 by whitespace and finally the long name.
3972 Specify a section in the configuration file containing extra
3974 Each line should consist of the short name of the
3975 object identifier followed by
3977 and the numerical form.
3978 The short and long names are the same when this option is used.
3982 it disables prompting of certificate fields
3983 and just takes values from the config file directly.
3984 It also changes the expected format of the
3985 .Cm distinguished_name
3989 .It Cm req_extensions
3990 The configuration file section containing a list of
3991 extensions to add to the certificate request.
3992 It can be overridden by the
3996 Limit the string types for encoding certain fields.
3997 The following values may be used, limiting strings to the indicated types:
3998 .Bl -tag -width "MASK:number"
4001 This is the default, as recommended by PKIX in RFC 2459.
4003 PrintableString, IA5String, T61String, BMPString, UTF8String.
4005 PrintableString, IA5String, BMPString, UTF8String.
4006 Inspired by the PKIX recommendation in RFC 2459 for certificates
4007 generated before 2004, but differs by also permitting IA5String.
4009 PrintableString, IA5String, T61String, UniversalString.
4010 A workaround for some ancient software that had problems
4011 with the variable-sized BMPString and UTF8String types.
4012 .It Cm MASK : Ns Ar number
4013 An explicit bitmask of permitted types, where
4015 is a C-style hex, decimal, or octal number that's a bit-wise OR of
4018 .In openssl/asn1.h .
4023 field values are interpreted as UTF8 strings.
4024 .It Cm x509_extensions
4025 The configuration file section containing a list of
4026 extensions to add to a certificate generated when the
4029 It can be overridden by the
4031 command line switch.
4034 There are two separate formats for the distinguished name and attribute
4040 then these sections just consist of field names and values.
4043 option is absent or not set to
4045 then the file contains field prompting information of the form:
4046 .Bd -unfilled -offset indent
4048 fieldName_default="default field value"
4054 is the field name being used, for example
4059 string is used to ask the user to enter the relevant details.
4060 If the user enters nothing, the default value is used;
4061 if no default value is present, the field is omitted.
4062 A field can still be omitted if a default value is present,
4063 if the user just enters the
4067 The number of characters entered must be between the
4068 fieldName_min and fieldName_max limits:
4069 there may be additional restrictions based on the field being used
4072 can only ever be two characters long and must fit in a
4073 .Cm PrintableString ) .
4075 Some fields (such as
4076 .Cm organizationName )
4077 can be used more than once in a DN.
4078 This presents a problem because configuration files will
4079 not recognize the same name occurring twice.
4080 To avoid this problem, if the
4082 contains some characters followed by a full stop, they will be ignored.
4083 So, for example, a second
4084 .Cm organizationName
4085 can be input by calling it
4086 .Qq 1.organizationName .
4088 The actual permitted field names are any object identifier short or
4090 These are compiled into
4092 and include the usual values such as
4093 .Cm commonName , countryName , localityName , organizationName ,
4094 .Cm organizationalUnitName , stateOrProvinceName .
4097 is included as well as
4098 .Cm name , surname , givenName , initials
4102 Additional object identifiers can be defined with the
4106 options in the configuration file.
4107 Any additional fields will be treated as though they were a
4108 .Cm DirectoryString .
4111 .Bl -hang -width "openssl rsa"
4114 .Op Fl aes128 | aes192 | aes256 | des | des3
4117 .Op Fl inform Cm der | net | pem | pvk
4121 .Op Fl outform Cm der | net | pem | pvk
4122 .Op Fl passin Ar arg
4123 .Op Fl passout Ar arg
4126 .Op Fl pvk-none | pvk-strong | pvk-weak
4127 .Op Fl RSAPublicKey_in
4128 .Op Fl RSAPublicKey_out
4135 command processes RSA keys.
4136 They can be converted between various forms and their components printed out.
4138 uses the traditional
4140 compatible format for private key encryption:
4141 newer applications should use the more secure PKCS#8 format using the
4145 The options are as follows:
4147 .It Fl aes128 | aes192 | aes256 | des | des3
4148 Encrypt the private key with the AES, DES,
4149 or the triple DES ciphers, respectively, before outputting it.
4150 A pass phrase is prompted for.
4151 If none of these options are specified, the key is written in plain text.
4152 This means that using the
4154 utility to read in an encrypted key with no encryption option can be used
4155 to remove the pass phrase from a key, or by setting the encryption options
4156 it can be used to add or change the pass phrase.
4157 These options can only be used with PEM format output files.
4159 Check the consistency of an RSA private key.
4161 The input file to read from,
4162 or standard input if not specified.
4163 If the key is encrypted, a pass phrase will be prompted for.
4164 .It Fl inform Cm der | net | pem | pvk
4167 Do not output the encoded version of the key.
4169 Print the value of the modulus of the key.
4171 The output file to write to,
4172 or standard output if not specified.
4173 .It Fl outform Cm der | net | pem | pvk
4175 .It Fl passin Ar arg
4176 The key password source.
4177 .It Fl passout Ar arg
4178 The output file password source.
4180 Read in a public key,
4183 Output a public key,
4185 Automatically set if the input is a public key.
4187 .Fl pvk-none | pvk-strong | pvk-weak
4189 Enable or disable PVK encoding.
4192 .It Fl RSAPublicKey_in , RSAPublicKey_out
4199 format is used instead.
4201 Print the public/private key components in plain text.
4205 .Bl -hang -width "openssl rsautl"
4206 .It Nm openssl rsautl
4214 .Op Fl inkey Ar file
4215 .Op Fl keyform Cm der | pem
4216 .Op Fl oaep | pkcs | raw | x931
4218 .Op Fl passin Ar arg
4228 command can be used to sign, verify, encrypt and decrypt
4229 data using the RSA algorithm.
4231 The options are as follows:
4234 Asn1parse the output data; this is useful when combined with the
4238 The input is a certificate containing an RSA public key.
4240 Decrypt the input data using an RSA private key.
4242 Encrypt the input data using an RSA public key.
4244 Hex dump the output data.
4246 The input to read from,
4247 or standard input if not specified.
4248 .It Fl inkey Ar file
4249 The input key file; by default an RSA private key.
4250 .It Fl keyform Cm der | pem
4251 The private key format.
4254 .It Fl oaep | pkcs | raw | x931
4256 PKCS#1 OAEP, PKCS#1 v1.5 (the default), no padding, or ANSI X9.31,
4258 For signatures, only
4264 The output file to write to,
4265 or standard output if not specified.
4266 .It Fl passin Ar arg
4267 The key password source.
4269 The input file is an RSA public key.
4271 Reverse the order of the input buffer.
4273 Sign the input data and output the signed result.
4274 This requires an RSA private key.
4276 Verify the input data and output the recovered data.
4280 .Bl -hang -width "openssl s_client"
4281 .It Nm openssl s_client
4284 .Op Fl alpn Ar protocols
4286 .Op Fl CAfile Ar file
4287 .Op Fl CApath Ar directory
4289 .Op Fl certform Cm der | pem
4291 .Op Fl cipher Ar cipherlist
4292 .Op Fl connect Ar host Ns Op : Ns Ar port
4294 .Op Fl crl_check_all
4301 .Op Fl groups Ar list
4304 .Op Fl ignore_critical
4305 .Op Fl issuer_checks
4306 .Op Fl key Ar keyfile
4307 .Op Fl keyform Cm der | pem
4308 .Op Fl keymatexport Ar label
4309 .Op Fl keymatexportlen Ar len
4310 .Op Fl legacy_server_connect
4317 .Op Fl no_legacy_server_connect
4328 .Op Fl proxy Ar host : Ns Ar port
4331 .Op Fl servername Ar name
4333 .Op Fl sess_in Ar file
4334 .Op Fl sess_out Ar file
4336 .Op Fl starttls Ar protocol
4345 .Op Fl use_srtp Ar profiles
4346 .Op Fl verify Ar depth
4347 .Op Fl verify_return_error
4349 .Op Fl xmpphost Ar host
4355 command implements a generic SSL/TLS client which connects
4356 to a remote host using SSL/TLS.
4358 If a connection is established with an SSL server, any data received
4359 from the server is displayed and any key presses will be sent to the
4361 When used interactively (which means neither
4365 have been given), the session will be renegotiated if the line begins with an
4367 if the line begins with a
4369 or if end of file is reached, the connection will be closed down.
4371 The options are as follows:
4374 Attempt connections using IPv4 only.
4376 Attempt connections using IPv6 only.
4377 .It Fl alpn Ar protocols
4378 Enable the Application-Layer Protocol Negotiation.
4380 is a comma-separated list of protocol names that the client should advertise
4383 Enable various workarounds for buggy implementations.
4384 .It Fl CAfile Ar file
4387 containing trusted certificates to use during server authentication
4388 and to use when attempting to build the client certificate chain.
4389 .It Fl CApath Ar directory
4392 to use for server certificate verification.
4393 This directory must be in
4397 for more information.
4398 These are also used when building the client certificate chain.
4400 The certificate to use, if one is requested by the server.
4401 The default is not to use a certificate.
4402 .It Fl certform Cm der | pem
4403 The certificate format.
4411 .Fl ignore_critical ,
4416 Set various certificate chain validation options.
4419 command for details.
4420 .It Fl cipher Ar cipherlist
4421 Modify the cipher list sent by the client.
4422 Although the server determines which cipher suite is used, it should take
4423 the first supported cipher in the list sent by the client.
4426 command for more information.
4427 .It Fl connect Ar host Ns Op : Ns Ar port
4433 If not specified, an attempt is made to connect to the local host
4435 Alternatively, the host and port pair may be separated using a forward-slash
4437 which is useful for numeric IPv6 addresses.
4439 Translate a line feed from the terminal into CR+LF,
4440 as required by some servers.
4442 Print extensive debugging information, including a hex dump of all traffic.
4444 Permit any version of DTLS.
4446 Permit only DTLS1.0.
4448 Permit only DTLS1.2.
4449 .It Fl groups Ar list
4450 Set the supported elliptic curve groups to the colon separated
4452 of group NIDs or names as documented in
4453 .Xr SSL_CTX_set1_groups_list 3 .
4458 The default is localhost.
4460 Inhibit shutting down the connection when end of file is reached in the input.
4461 .It Fl key Ar keyfile
4462 The private key to use.
4463 If not specified, the certificate file will be used.
4464 .It Fl keyform Cm der | pem
4465 The private key format.
4468 .It Fl keymatexport Ar label
4469 Export keying material using label.
4470 .It Fl keymatexportlen Ar len
4471 Export len bytes of keying material (default 20).
4472 .It Fl legacy_server_connect , no_legacy_server_connect
4473 Allow or disallow initial connection to servers that don't support RI.
4475 Show all protocol messages with hex dump.
4477 Set the link layer MTU.
4479 Turn on non-blocking I/O.
4481 Test non-blocking I/O.
4483 Shut down the connection when end of file is reached in the input.
4484 Can be used to override the implicit
4488 .It Fl no_tls1 | no_tls1_1 | no_tls1_2 | no_tls1_3
4489 Disable the use of TLS1.0, 1.1, 1.2 and 1.3 respectively.
4491 Disable RFC 4507 session ticket support.
4493 The private key password source.
4495 Pause 1 second between each read and write call.
4500 The default is 4433.
4502 Print session information when the program exits.
4503 This will always attempt
4504 to print out information even if the connection fails.
4505 Normally, information will only be printed out once if the connection succeeds.
4506 This option is useful because the cipher in use may be renegotiated
4507 or the connection may fail because a client certificate is required or is
4508 requested only after an attempt is made to access a certain URL.
4509 Note that the output produced by this option is not always accurate
4510 because a connection might never have been established.
4511 .It Fl proxy Ar host : Ns Ar port
4512 Use the HTTP proxy at
4516 The connection to the proxy is done in cleartext and the
4518 argument is given to the proxy.
4519 If not specified, localhost is used as final destination.
4520 After that, switch the connection through the proxy to the destination
4523 Inhibit printing of session and certificate information.
4524 This implicitly turns on
4528 Reconnect to the same server 5 times using the same session ID; this can
4529 be used as a test that session caching is working.
4530 .It Fl servername Ar name
4531 Include the TLS Server Name Indication (SNI) extension in the ClientHello
4532 message, using the specified server
4535 Display the whole server certificate chain: normally only the server
4536 certificate itself is displayed.
4538 Use the server's cipher preferences.
4539 .It Fl sess_in Ar file
4540 Load TLS session from file.
4541 The client will attempt to resume a connection from this session.
4542 .It Fl sess_out Ar file
4543 Output TLS session to file.
4544 .It Fl starttls Ar protocol
4545 Send the protocol-specific messages to switch to TLS for communication.
4547 is a keyword for the intended protocol.
4548 Currently, the supported keywords are
4556 Print the SSL session states.
4558 Send a certificate status request to the server (OCSP stapling).
4559 The server response (if any) is printed out.
4561 Enable send/receive timeout on DTLS connections.
4562 .It Fl tls1 | tls1_1 | tls1_2 | tls1_3
4563 Permit only TLS1.0, 1.1, 1.2 or 1.3 respectively.
4565 Print a hex dump of any TLS extensions received from the server.
4566 .It Fl use_srtp Ar profiles
4567 Offer SRTP key management with a colon-separated profile list.
4568 .It Fl verify Ar depth
4569 Turn on server certificate verification,
4570 with a maximum length of
4572 Currently the verify operation continues after errors so all the problems
4573 with a certificate chain can be seen.
4574 As a side effect the connection will never fail due to a server
4575 certificate verify failure.
4576 .It Fl verify_return_error
4577 Return verification error.
4578 .It Fl xmpphost Ar hostname
4580 .Fl starttls Ar xmpp ,
4581 specify the host for the "to" attribute of the stream element.
4582 If this option is not specified then the host specified with
4588 .Bl -hang -width "openssl s_server"
4589 .It Nm openssl s_server
4591 .Op Fl accept Ar port
4592 .Op Fl alpn Ar protocols
4594 .Op Fl CAfile Ar file
4595 .Op Fl CApath Ar directory
4597 .Op Fl cert2 Ar file
4598 .Op Fl certform Cm der | pem
4599 .Op Fl cipher Ar cipherlist
4600 .Op Fl context Ar id
4602 .Op Fl crl_check_all
4604 .Op Fl dcert Ar file
4605 .Op Fl dcertform Cm der | pem
4607 .Op Fl dhparam Ar file
4609 .Op Fl dkeyform Cm der | pem
4614 .Op Fl groups Ar list
4616 .Op Fl id_prefix Ar arg
4617 .Op Fl key Ar keyfile
4618 .Op Fl key2 Ar keyfile
4619 .Op Fl keyform Cm der | pem
4620 .Op Fl keymatexport Ar label
4621 .Op Fl keymatexportlen Ar len
4624 .Op Fl naccept Ar num
4625 .Op Fl named_curve Ar arg
4640 .Op Fl servername Ar name
4641 .Op Fl servername_fatal
4645 .Op Fl status_timeout Ar nsec
4646 .Op Fl status_url Ar url
4647 .Op Fl status_verbose
4654 .Op Fl use_srtp Ar profiles
4655 .Op Fl Verify Ar depth
4656 .Op Fl verify Ar depth
4657 .Op Fl verify_return_error
4665 command implements a generic SSL/TLS server which listens
4666 for connections on a given port using SSL/TLS.
4668 If a connection request is established with a client and neither the
4672 option has been used, then any data received
4673 from the client is displayed and any key presses are sent to the client.
4674 Certain single letter commands perform special operations:
4676 .Bl -tag -width "XXXX" -compact
4678 Send plain text, which should cause the client to disconnect.
4680 End the current SSL connection and exit.
4682 End the current SSL connection, but still accept new connections.
4684 Renegotiate the SSL session and request a client certificate.
4686 Renegotiate the SSL session.
4688 Print out some session cache status information.
4691 The options are as follows:
4693 .It Fl accept Ar port
4697 The default is port 4433.
4698 .It Fl alpn Ar protocols
4699 Enable the Application-Layer Protocol Negotiation.
4701 is a comma-separated list of supported protocol names.
4703 Enable various workarounds for buggy implementations.
4704 .It Fl CAfile Ar file
4707 containing trusted certificates to use during client authentication
4708 and to use when attempting to build the server certificate chain.
4709 The list is also used in the list of acceptable client CAs passed to the
4710 client when a certificate is requested.
4711 .It Fl CApath Ar directory
4714 to use for client certificate verification.
4715 This directory must be in
4719 for more information.
4720 These are also used when building the server certificate chain.
4722 The certificate to use: most server's cipher suites require the use of a
4723 certificate and some require a certificate with a certain public key type.
4724 For example, the DSS cipher suites require a certificate containing a DSS
4726 If not specified, the file
4729 .It Fl cert2 Ar file
4730 The certificate to use for servername.
4731 .It Fl certform Cm der | pem
4732 The certificate format.
4735 .It Fl cipher Ar cipherlist
4736 Modify the cipher list used by the server.
4737 This allows the cipher list used by the server to be modified.
4738 When the client sends a list of supported ciphers, the first client cipher
4739 also included in the server list is used.
4740 Because the client specifies the preference order, the order of the server
4741 cipherlist is irrelevant.
4744 command for more information.
4745 .It Fl context Ar id
4746 Set the SSL context ID.
4747 It can be given any string value.
4748 .It Fl crl_check , crl_check_all
4749 Check the peer certificate has not been revoked by its CA.
4750 The CRLs are appended to the certificate file.
4752 checks all CRLs of all CAs in the chain.
4754 Translate a line feed from the terminal into CR+LF.
4755 .It Fl dcert Ar file , Fl dkey Ar file
4756 Specify an additional certificate and private key; these behave in the
4761 options except there is no default if they are not specified
4762 (no additional certificate or key is used).
4763 By using RSA and DSS certificates and keys,
4764 a server can support clients which only support RSA or DSS cipher suites
4765 by using an appropriate certificate.
4766 .It Fl dcertform Cm der | pem , Fl dkeyform Cm der | pem , Fl dpass Ar arg
4767 Additional certificate and private key format, and private key password source,
4770 Print extensive debugging information, including a hex dump of all traffic.
4771 .It Fl dhparam Ar file
4772 The DH parameter file to use.
4773 The ephemeral DH cipher suites generate keys
4774 using a set of DH parameters.
4775 If not specified, an attempt is made to
4776 load the parameters from the server certificate file.
4777 If this fails, a static set of parameters hard coded into the
4779 program will be used.
4781 Permit any version of DTLS.
4783 Permit only DTLS1.0.
4785 Permit only DTLS1.2.
4786 .It Fl groups Ar list
4787 Set the supported elliptic curve groups to the colon separated
4789 of group NIDs or names as documented in
4790 .Xr SSL_CTX_set1_groups_list 3 .
4792 Emulate a simple web server.
4793 Pages are resolved relative to the current directory.
4794 For example if the URL
4795 .Pa https://myhost/page.html
4796 is requested, the file
4799 The files loaded are assumed to contain a complete and correct HTTP
4800 response (lines that are part of the HTTP response line and headers
4801 must end with CRLF).
4802 .It Fl id_prefix Ar arg
4803 Generate SSL/TLS session IDs prefixed by
4805 This is mostly useful for testing any SSL/TLS code
4806 that wish to deal with multiple servers,
4807 when each of which might be generating a unique range of session IDs.
4808 .It Fl key Ar keyfile
4809 The private key to use.
4810 If not specified, the certificate file will be used.
4811 .It Fl key2 Ar keyfile
4812 The private key to use for servername.
4813 .It Fl keyform Cm der | pem
4814 The private key format.
4817 .It Fl keymatexport Ar label
4818 Export keying material using label.
4819 .It Fl keymatexportlen Ar len
4820 Export len bytes of keying material (default 20).
4822 Show all protocol messages with hex dump.
4824 Set the link layer MTU.
4825 .It Fl naccept Ar num
4826 Terminate server after
4829 .It Fl named_curve Ar arg
4830 Specify the elliptic curve name to use for ephemeral ECDH keys.
4831 This option is deprecated; use
4835 Turn on non-blocking I/O.
4837 Test non-blocking I/O.
4839 Disable session caching.
4841 Disable ephemeral DH cipher suites.
4843 Disable ephemeral ECDH cipher suites.
4845 Disable RFC 4507 session ticket support.
4846 .It Fl no_tls1 | no_tls1_1 | no_tls1_2 | no_tls1_3
4847 Disable the use of TLS1.0, 1.1, 1.2, and 1.3, respectively.
4849 Disable temporary RSA key generation.
4851 Do not use a certificate.
4852 This restricts the cipher suites available to the anonymous ones
4853 (currently just anonymous DH).
4855 The private key password source.
4857 Inhibit printing of session and certificate information.
4858 .It Fl servername Ar name
4859 Set the TLS Server Name Indication (SNI) extension with
4861 .It Fl servername_fatal
4862 Send fatal alert if servername does not match.
4863 The default is warning alert.
4865 Use server's cipher preferences.
4867 Print the SSL session states.
4869 Enables certificate status request support (OCSP stapling).
4870 .It Fl status_timeout Ar nsec
4871 Sets the timeout for OCSP response in seconds.
4872 .It Fl status_url Ar url
4873 Sets a fallback responder URL to use if no responder URL is present in the
4875 Without this option, an error is returned if the server certificate does not
4876 contain a responder address.
4877 .It Fl status_verbose
4878 Enables certificate status request support (OCSP stapling) and gives a verbose
4879 printout of the OCSP response.
4881 Enable send/receive timeout on DTLS connections.
4882 .It Fl tls1 | tls1_1 | tls1_2 | tls1_3
4883 Permit only TLS1.0, 1.1, 1.2, or 1.3, respectively.
4885 Print a hex dump of any TLS extensions received from the server.
4886 .It Fl use_srtp Ar profiles
4887 Offer SRTP key management with a colon-separated profile list.
4888 .It Fl verify_return_error
4889 Return verification error.
4891 Emulate a simple web server.
4892 Pages are resolved relative to the current directory.
4893 For example if the URL
4894 .Pa https://myhost/page.html
4895 is requested, the file
4899 Send a status message to the client when it connects,
4900 including information about the ciphers used and various session parameters.
4901 The output is in HTML format so this option will normally be used with a
4903 .It Fl Verify Ar depth , Fl verify Ar depth
4904 Request a certificate chain from the client,
4905 with a maximum length of
4909 the client must supply a certificate or an error occurs;
4912 a certificate is requested but the client does not have to send one.
4916 .Bl -hang -width "openssl s_time"
4917 .It Nm openssl s_time
4920 .Op Fl CAfile Ar file
4921 .Op Fl CApath Ar directory
4923 .Op Fl cipher Ar cipherlist
4924 .Op Fl connect Ar host Ns Op : Ns Ar port
4925 .Op Fl key Ar keyfile
4930 .Op Fl time Ar seconds
4931 .Op Fl verify Ar depth
4938 command implements a generic SSL/TLS client which connects to a
4939 remote host using SSL/TLS.
4940 It can request a page from the server and includes
4941 the time to transfer the payload data in its timing measurements.
4942 It measures the number of connections within a given timeframe,
4943 the amount of data transferred
4945 and calculates the average time spent for one connection.
4947 The options are as follows:
4950 Enable various workarounds for buggy implementations.
4951 .It Fl CAfile Ar file
4954 containing trusted certificates to use during server authentication
4955 and to use when attempting to build the client certificate chain.
4956 .It Fl CApath Ar directory
4957 The directory to use for server certificate verification.
4958 This directory must be in
4962 for more information.
4963 These are also used when building the client certificate chain.
4965 The certificate to use, if one is requested by the server.
4966 The default is not to use a certificate.
4967 .It Fl cipher Ar cipherlist
4968 Modify the cipher list sent by the client.
4969 Although the server determines which cipher suite is used,
4970 it should take the first supported cipher in the list sent by the client.
4973 command for more information.
4974 .It Fl connect Ar host Ns Op : Ns Ar port
4975 The host and port to connect to.
4976 .It Fl key Ar keyfile
4977 The private key to use.
4978 If not specified, the certificate file will be used.
4980 Turn on non-blocking I/O.
4982 Perform the timing test using a new session ID for each connection.
4988 they are both on by default and executed in sequence.
4990 Shut down the connection without sending a
4992 shutdown alert to the server.
4994 Perform the timing test using the same session ID for each connection.
5000 they are both on by default and executed in sequence.
5001 .It Fl time Ar seconds
5004 benchmarks to the number of
5006 The default is 30 seconds.
5007 .It Fl verify Ar depth
5008 Turn on server certificate verification,
5009 with a maximum length of
5011 Currently the verify operation continues after errors, so all the problems
5012 with a certificate chain can be seen.
5014 the connection will never fail due to a server certificate verify failure.
5016 The page to GET from the server.
5019 gets the index.htm[l] page.
5020 If this parameter is not specified,
5022 will only perform the handshake to establish SSL connections
5023 but not transfer any payload data.
5027 .Bl -hang -width "openssl sess_id"
5028 .It Nm openssl sess_id
5031 .Op Fl context Ar ID
5033 .Op Fl inform Cm der | pem
5036 .Op Fl outform Cm der | pem
5043 program processes the encoded version of the SSL session structure and
5044 optionally prints out SSL session details
5045 (for example the SSL session master key)
5046 in human-readable format.
5048 The options are as follows:
5051 If a certificate is present in the session,
5052 it will be output using this option;
5055 option is also present, then it will be printed out in text form.
5056 .It Fl context Ar ID
5059 The ID can be any string of characters.
5061 The input file to read from,
5062 or standard input if not specified.
5063 .It Fl inform Cm der | pem
5066 uses an ASN.1 DER-encoded format containing session details.
5067 The precise format can vary from one version to the next.
5069 is the default format: it consists of the DER
5070 format base64-encoded with additional header and footer lines.
5072 Do not output the encoded version of the session.
5074 The output file to write to,
5075 or standard output if not specified.
5076 .It Fl outform Cm der | pem
5079 Print the various public or private key components in plain text,
5080 in addition to the encoded version.
5085 is composed as follows:
5087 .Bl -tag -width "Verify return code " -offset 3n -compact
5089 The protocol in use.
5091 The actual raw SSL or TLS cipher code.
5093 The SSL session ID, in hex format.
5095 The session ID context, in hex format.
5097 The SSL session master key.
5099 The key argument; this is only used in SSL v2.
5101 The session start time.
5105 The timeout, in seconds.
5106 .It Verify return code
5107 The return code when a certificate is verified.
5110 Since the SSL session output contains the master key, it is possible to read
5111 the contents of an encrypted session using this information.
5112 Therefore appropriate security precautions
5113 should be taken if the information is being output by a
5116 This is, however, strongly discouraged and should only be used for
5120 .Bl -hang -width "openssl smime"
5121 .It Nm openssl smime
5124 .Fl aes128 | aes192 | aes256 | des |
5125 .Fl des3 | rc2-40 | rc2-64 | rc2-128
5128 .Op Fl CAfile Ar file
5129 .Op Fl CApath Ar directory
5130 .Op Fl certfile Ar file
5132 .Op Fl content Ar file
5134 .Op Fl crl_check_all
5139 .Op Fl ignore_critical
5142 .Op Fl inform Cm der | pem | smime
5143 .Op Fl inkey Ar file
5144 .Op Fl issuer_checks
5145 .Op Fl keyform Cm der | pem
5157 .Op Fl outform Cm der | pem | smime
5158 .Op Fl passin Ar arg
5161 .Op Fl recip Ar file
5164 .Op Fl signer Ar file
5177 command handles S/MIME mail.
5178 It can encrypt, decrypt, sign, and verify S/MIME messages.
5180 The MIME message must be sent without any blank lines between the
5181 headers and the output.
5182 Some mail programs will automatically add a blank line.
5183 Piping the mail directly to an MTA is one way to
5184 achieve the correct format.
5186 The supplied message to be signed or encrypted must include the necessary
5187 MIME headers or many S/MIME clients won't display it properly (if at all).
5190 option to automatically add plain text headers.
5193 .Qq signed and encrypted
5194 message is one where a signed message is then encrypted.
5195 This can be produced by encrypting an already signed message.
5197 There are a number of operations that can be performed, as follows:
5198 .Bl -tag -width "XXXX"
5200 Decrypt mail using the supplied certificate and private key.
5201 The input file is an encrypted mail message in MIME format.
5202 The decrypted mail is written to the output file.
5204 Encrypt mail for the given recipient certificates.
5205 The input is the message to be encrypted.
5206 The output file is the encrypted mail, in MIME format.
5208 Take an input message and write out a PEM-encoded PKCS#7 structure.
5210 Resign a message: take an existing message and one or more new signers.
5212 Sign mail using the supplied certificate and private key.
5213 The input file is the message to be signed.
5214 The signed message, in MIME format, is written to the output file.
5217 The input is a signed mail message and the output is the signed data.
5218 Both clear text and opaque signing is supported.
5221 The remaining options are as follows:
5222 .Bl -tag -width "XXXX"
5224 .Fl aes128 | aes192 | aes256 | des |
5225 .Fl des3 | rc2-40 | rc2-64 | rc2-128
5227 The encryption algorithm to use.
5228 128-, 192-, or 256-bit AES, DES (56 bits), triple DES (168 bits),
5229 or 40-, 64-, or 128-bit RC2, respectively;
5230 if not specified, 40-bit RC2 is
5235 Normally, the input message is converted to
5237 format which uses CR/LF as end of line,
5238 as required by the S/MIME specification.
5239 When this option is present, no translation occurs.
5240 This is useful when handling binary data which may not be in MIME format.
5241 .It Fl CAfile Ar file
5244 containing trusted CA certificates; only used with
5246 .It Fl CApath Ar directory
5249 containing trusted CA certificates; only used with
5251 This directory must be a standard certificate directory:
5252 that is, a hash of each subject name (using
5254 should be linked to each certificate.
5256 One or more certificates of message recipients: used when encrypting
5258 .It Fl certfile Ar file
5259 Allows additional certificates to be specified.
5260 When signing, these will be included with the message.
5261 When verifying, these will be searched for the signers' certificates.
5262 The certificates should be in PEM format.
5268 .Fl ignore_critical ,
5273 Set various certificate chain validation options.
5276 command for details.
5277 .It Fl content Ar file
5278 A file containing the detached content.
5279 This is only useful with the
5282 and only usable if the PKCS#7 structure is using the detached
5283 signature form where the content is not included.
5284 This option will override any content if the input format is S/MIME
5285 and it uses the multipart/signed MIME content type.
5291 The relevant mail headers.
5292 These are included outside the signed
5293 portion of a message so they may be included manually.
5294 When signing, many S/MIME
5295 mail clients check that the signer's certificate email
5296 address matches the From: address.
5298 The input file to read from.
5300 Enable streaming I/O for encoding operations.
5301 This permits single pass processing of data without
5302 the need to hold the entire contents in memory,
5303 potentially supporting very large files.
5304 Streaming is automatically set for S/MIME signing with detached
5305 data if the output format is SMIME;
5306 it is currently off by default for all other operations.
5307 .It Fl inform Cm der | pem | smime
5309 .It Fl inkey Ar file
5310 The private key to use when signing or decrypting,
5311 which must match the corresponding certificate.
5312 If this option is not specified, the private key must be included
5313 in the certificate file specified with
5320 this option can be used multiple times to specify successive keys.
5321 .It Fl keyform Cm der | pem
5322 Input private key format.
5326 The digest algorithm to use when signing or resigning.
5327 If not present then the default digest algorithm for the signing key is used
5330 Do not include attributes.
5332 Do not include the signer's certificate.
5333 This will reduce the size of the signed message but the verifier must
5334 have a copy of the signer's certificate available locally (passed using the
5336 option, for example).
5338 Do not do chain verification of signers' certificates: that is,
5339 don't use the certificates in the signed message as untrusted CAs.
5341 When signing a message, use opaque signing: this form is more resistant
5342 to translation by mail relays but it cannot be read by mail agents that
5343 do not support S/MIME.
5344 Without this option cleartext signing with the MIME type
5345 multipart/signed is used.
5347 Disable streaming I/O where it would produce an encoding of indefinite length
5348 (currently has no effect).
5350 Only use certificates specified in the
5352 The supplied certificates can still be used as untrusted CAs.
5354 Do not try to verify the signatures on the message.
5356 Exclude the list of supported algorithms from signed attributes,
5357 other options such as signing time and content type are still included.
5359 Do not verify the signer's certificate of a signed message.
5361 The output file to write to.
5362 .It Fl outform Cm der | pem | smime
5364 The default is smime, which writes an S/MIME format message.
5368 change this to write PEM and DER format PKCS#7 structures instead.
5369 This currently only affects the output format of the PKCS#7
5370 structure; if no PKCS#7 structure is being output (for example with
5374 this option has no effect.
5375 .It Fl passin Ar arg
5376 The key password source.
5377 .It Fl recip Ar file
5378 The recipients certificate when decrypting a message.
5380 must match one of the recipients of the message or an error occurs.
5381 .It Fl signer Ar file
5382 A signing certificate when signing or resigning a message;
5383 this option can be used multiple times if more than one signer is required.
5384 If a message is being verified, the signer's certificates will be
5385 written to this file if the verification was successful.
5390 Add plain text (text/plain) MIME
5391 headers to the supplied message if encrypting or signing.
5392 If decrypting or verifying, it strips off text headers:
5393 if the decrypted or verified message is not of MIME type text/plain
5394 then an error occurs.
5401 .Bl -tag -width "XXXX" -offset 3n -compact
5403 The operation was completely successful.
5405 An error occurred parsing the command options.
5407 One of the input files could not be read.
5409 An error occurred creating the file or when reading the message.
5411 An error occurred decrypting or verifying the message.
5413 An error occurred writing certificates.
5417 .Bl -hang -width "openssl speed"
5418 .It Nm openssl speed
5423 .Op Fl evp Ar algorithm
5425 .Op Fl multi Ar number
5431 command is used to test the performance of cryptographic algorithms.
5432 .Bl -tag -width "XXXX"
5434 Perform the test using
5436 The default is to test all algorithms.
5438 Time decryption instead of encryption;
5442 Measure time in real time instead of CPU user time.
5443 .It Fl evp Ar algorithm
5444 Perform the test using one of the algorithms accepted by
5445 .Xr EVP_get_cipherbyname 3 .
5447 Produce machine readable output.
5448 .It Fl multi Ar number
5451 benchmarks in parallel.
5455 .Bl -hang -width "openssl spkac"
5456 .It Nm openssl spkac
5458 .Op Fl challenge Ar string
5460 .Op Fl key Ar keyfile
5463 .Op Fl passin Ar arg
5465 .Op Fl spkac Ar spkacname
5466 .Op Fl spksect Ar section
5473 command processes signed public key and challenge (SPKAC) files.
5474 It can print out their contents, verify the signature,
5475 and produce its own SPKACs from a supplied private key.
5477 The options are as follows:
5479 .It Fl challenge Ar string
5480 The challenge string, if an SPKAC is being created.
5482 The input file to read from,
5483 or standard input if not specified.
5487 .It Fl key Ar keyfile
5488 Create an SPKAC file using the private key in
5491 .Fl in , noout , spksect ,
5494 options are ignored, if present.
5496 Do not output the text version of the SPKAC.
5498 The output file to write to,
5499 or standard output if not specified.
5500 .It Fl passin Ar arg
5501 The key password source.
5503 Output the public key of an SPKAC.
5504 .It Fl spkac Ar spkacname
5505 An alternative name for the variable containing the SPKAC.
5506 The default is "SPKAC".
5507 This option affects both generated and input SPKAC files.
5508 .It Fl spksect Ar section
5509 An alternative name for the
5511 containing the SPKAC.
5513 Verify the digital signature on the supplied SPKAC.
5518 .Bl -hang -width "openssl ts"
5521 .Op Fl md4 | md5 | ripemd160 | sha1
5523 .Op Fl config Ar configfile
5524 .Op Fl data Ar file_to_hash
5525 .Op Fl digest Ar digest_bytes
5526 .Op Fl in Ar request.tsq
5528 .Op Fl out Ar request.tsq
5529 .Op Fl policy Ar object_id
5533 .Op Fl chain Ar certs_file.pem
5534 .Op Fl config Ar configfile
5535 .Op Fl in Ar response.tsr
5536 .Op Fl inkey Ar private.pem
5537 .Op Fl out Ar response.tsr
5538 .Op Fl passin Ar arg
5539 .Op Fl policy Ar object_id
5540 .Op Fl queryfile Ar request.tsq
5541 .Op Fl section Ar tsa_section
5542 .Op Fl signer Ar tsa_cert.pem
5548 .Op Fl CAfile Ar trusted_certs.pem
5549 .Op Fl CApath Ar trusted_cert_path
5550 .Op Fl data Ar file_to_hash
5551 .Op Fl digest Ar digest_bytes
5552 .Op Fl in Ar response.tsr
5553 .Op Fl queryfile Ar request.tsq
5555 .Op Fl untrusted Ar cert_file.pem
5561 command is a basic Time Stamping Authority (TSA) client and server
5562 application as specified in RFC 3161 (Time-Stamp Protocol, TSP).
5563 A TSA can be part of a PKI deployment and its role is to provide long
5564 term proof of the existence of specific data.
5565 Here is a brief description of the protocol:
5568 The TSA client computes a one-way hash value for a data file and sends
5569 the hash to the TSA.
5571 The TSA attaches the current date and time to the received hash value,
5572 signs them and sends the time stamp token back to the client.
5573 By creating this token the TSA certifies the existence of the original
5574 data file at the time of response generation.
5576 The TSA client receives the time stamp token and verifies the
5578 It also checks if the token contains the same hash
5579 value that it had sent to the TSA.
5582 There is one DER-encoded protocol data unit defined for transporting a time
5583 stamp request to the TSA and one for sending the time stamp response
5587 command has three main functions:
5588 creating a time stamp request based on a data file;
5589 creating a time stamp response based on a request;
5590 and verifying if a response corresponds
5591 to a particular request or a data file.
5593 There is no support for sending the requests/responses automatically
5594 over HTTP or TCP yet as suggested in RFC 3161.
5595 Users must send the requests either by FTP or email.
5599 switch can be used for creating and printing a time stamp
5600 request with the following options:
5603 Expect the TSA to include its signing certificate in the response.
5604 .It Fl config Ar configfile
5605 Specify an alternative configuration file.
5606 Only the OID section is used.
5607 .It Fl data Ar file_to_hash
5608 The data file for which the time stamp request needs to be created.
5609 The default is standard input.
5610 .It Fl digest Ar digest_bytes
5611 Specify the message imprint explicitly without the data file.
5612 The imprint must be specified in a hexadecimal format,
5613 two characters per byte,
5614 the bytes optionally separated by colons.
5615 The number of bytes must match the message digest algorithm in use.
5616 .It Fl in Ar request.tsq
5617 A previously created time stamp request in DER
5618 format that will be printed into the output file.
5619 Useful for examining the content of a request in human-readable format.
5620 .It Fl md4 | md5 | ripemd160 | sha | sha1
5621 The message digest to apply to the data file.
5622 It supports all the message digest algorithms that are supported by the
5625 The default is SHA1.
5627 Specify no nonce in the request.
5628 The default, to include a 64-bit long pseudo-random nonce,
5629 is recommended to protect against replay attacks.
5630 .It Fl out Ar request.tsq
5631 The output file to write to,
5632 or standard output if not specified.
5633 .It Fl policy Ar object_id
5634 The policy that the client expects the TSA to use for creating the
5636 Either dotted OID notation or OID names defined
5637 in the config file can be used.
5638 If no policy is requested, the TSA uses its own default policy.
5640 Output in human-readable text format instead of DER.
5643 A time stamp response (TimeStampResp) consists of a response status
5644 and the time stamp token itself (ContentInfo),
5645 if the token generation was successful.
5648 command is for creating a time stamp
5649 response or time stamp token based on a request and printing the
5650 response/token in human-readable format.
5653 is not specified the output is always a time stamp response (TimeStampResp),
5654 otherwise it is a time stamp token (ContentInfo).
5656 .It Fl chain Ar certs_file.pem
5657 The collection of PEM certificates
5658 that will be included in the response
5659 in addition to the signer certificate if the
5661 option was used for the request.
5662 This file is supposed to contain the certificate chain
5663 for the signer certificate from its issuer upwards.
5666 command does not build a certificate chain automatically.
5667 .It Fl config Ar configfile
5668 Specify an alternative configuration file.
5669 .It Fl in Ar response.tsr
5670 Specify a previously created time stamp response (or time stamp token, if
5673 in DER format that will be written to the output file.
5674 This option does not require a request;
5675 it is useful, for example,
5676 to examine the content of a response or token
5677 or to extract the time stamp token from a response.
5678 If the input is a token and the output is a time stamp response, a default
5680 status info is added to the token.
5681 .It Fl inkey Ar private.pem
5682 The signer private key of the TSA in PEM format.
5686 .It Fl out Ar response.tsr
5687 The response is written to this file.
5688 The format and content of the file depends on other options (see
5692 The default is stdout.
5693 .It Fl passin Ar arg
5694 The key password source.
5695 .It Fl policy Ar object_id
5696 The default policy to use for the response.
5697 Either dotted OID notation or OID names defined
5698 in the config file can be used.
5699 If no policy is requested, the TSA uses its own default policy.
5700 .It Fl queryfile Ar request.tsq
5701 The file containing a DER-encoded time stamp request.
5702 .It Fl section Ar tsa_section
5703 The config file section containing the settings for response generation.
5704 .It Fl signer Ar tsa_cert.pem
5705 The PEM signer certificate of the TSA.
5706 The TSA signing certificate must have exactly one extended key usage
5707 assigned to it: timeStamping.
5708 The extended key usage must also be critical,
5709 otherwise the certificate is going to be refused.
5712 variable of the config file.
5714 Output in human-readable text format instead of DER.
5716 The input is a DER-encoded time stamp token (ContentInfo)
5717 instead of a time stamp response (TimeStampResp).
5719 The output is a time stamp token (ContentInfo)
5720 instead of a time stamp response (TimeStampResp).
5725 command is for verifying if a time stamp response or time stamp token
5726 is valid and matches a particular time stamp request or data file.
5729 command does not use the configuration file.
5731 .It Fl CAfile Ar trusted_certs.pem
5732 The file containing a set of trusted self-signed PEM CA certificates.
5735 for additional details.
5736 Either this option or
5739 .It Fl CApath Ar trusted_cert_path
5740 The directory containing the trusted CA certificates of the client.
5743 for additional details.
5744 Either this option or
5747 .It Fl data Ar file_to_hash
5748 The response or token must be verified against
5750 The file is hashed with the message digest algorithm specified in the token.
5755 options must not be specified with this one.
5756 .It Fl digest Ar digest_bytes
5757 The response or token must be verified against the message digest specified
5759 The number of bytes must match the message digest algorithm
5760 specified in the token.
5765 options must not be specified with this one.
5766 .It Fl in Ar response.tsr
5767 The time stamp response that needs to be verified, in DER format.
5768 This option in mandatory.
5769 .It Fl queryfile Ar request.tsq
5770 The original time stamp request, in DER format.
5775 options must not be specified with this one.
5777 The input is a DER-encoded time stamp token (ContentInfo)
5778 instead of a time stamp response (TimeStampResp).
5779 .It Fl untrusted Ar cert_file.pem
5780 Additional untrusted PEM certificates which may be needed
5781 when building the certificate chain for the TSA's signing certificate.
5782 This file must contain the TSA signing certificate and
5783 all intermediate CA certificates unless the response includes them.
5786 Options specified on the command line always override
5787 the settings in the config file:
5789 .It Cm tsa Ar section , Cm default_tsa
5790 This is the main section and it specifies the name of another section
5791 that contains all the options for the
5794 This section can be overridden with the
5796 command line switch.
5806 The file containing the hexadecimal serial number of the
5807 last time stamp response created.
5808 This number is incremented by 1 for each response.
5809 If the file does not exist at the time of response generation,
5810 a new file is created with serial number 1.
5811 This parameter is mandatory.
5813 TSA signing certificate, in PEM format.
5816 command line option.
5818 A set of PEM-encoded certificates that need to be
5819 included in the response.
5822 command line option.
5824 The private key of the TSA, in PEM format.
5827 command line option.
5828 .It Cm default_policy
5829 The default policy to use when the request does not mandate any policy.
5832 command line option.
5833 .It Cm other_policies
5834 Comma separated list of policies that are also acceptable by the TSA
5835 and used only if the request explicitly specifies one of them.
5837 The list of message digest algorithms that the TSA accepts.
5838 At least one algorithm must be specified.
5839 This parameter is mandatory.
5841 The accuracy of the time source of the TSA in seconds, milliseconds
5843 For example, secs:1, millisecs:500, microsecs:100.
5844 If any of the components is missing,
5845 zero is assumed for that field.
5846 .It Cm clock_precision_digits
5847 The maximum number of digits, which represent the fraction of seconds,
5848 that need to be included in the time field.
5849 The trailing zeroes must be removed from the time,
5850 so there might actually be fewer digits
5851 or no fraction of seconds at all.
5852 The maximum value is 6;
5855 If this option is yes,
5856 the responses generated by this TSA can always be ordered,
5857 even if the time difference between two responses is less
5858 than the sum of their accuracies.
5861 Set this option to yes if the subject name of the TSA must be included in
5862 the TSA name field of the response.
5864 .It Cm ess_cert_id_chain
5865 The SignedData objects created by the TSA always contain the
5866 certificate identifier of the signing certificate in a signed
5867 attribute (see RFC 2634, Enhanced Security Services).
5868 If this option is set to yes and either the
5872 option is specified then the certificate identifiers of the chain will also
5873 be included in the SigningCertificate signed attribute.
5874 If this variable is set to no,
5875 only the signing certificate identifier is included.
5880 .Bl -hang -width "openssl verify"
5881 .It Nm openssl verify
5883 .Op Fl CAfile Ar file
5884 .Op Fl CApath Ar directory
5886 .Op Fl CRLfile Ar file
5888 .Op Fl crl_check_all
5889 .Op Fl explicit_policy
5892 .Op Fl ignore_critical
5895 .Op Fl issuer_checks
5896 .Op Fl legacy_verify
5898 .Op Fl purpose Ar purpose
5899 .Op Fl trusted Ar file
5900 .Op Fl untrusted Ar file
5909 command verifies certificate chains.
5911 The options are as follows:
5913 .It Fl CAfile Ar file
5916 of trusted certificates.
5919 should contain multiple certificates in PEM format, concatenated together.
5920 .It Fl CApath Ar directory
5923 of trusted certificates.
5924 The certificates, or symbolic links to them,
5925 should have names of the form
5929 is the hashed certificate subject name
5936 Verify the signature on the self-signed root CA.
5937 This is disabled by default
5938 because it doesn't add any security.
5939 .It Fl CRLfile Ar file
5942 should contain one or more CRLs in PEM format.
5944 Check end entity certificate validity by attempting to look up a valid CRL.
5945 If a valid CRL cannot be found, an error occurs.
5946 .It Fl crl_check_all
5947 Check the validity of all certificates in the chain by attempting
5948 to look up valid CRLs.
5949 .It Fl explicit_policy
5950 Set policy variable require-explicit-policy (RFC 3280).
5952 Enable extended CRL features such as indirect CRLs and alternate CRL
5955 Print a usage message.
5956 .It Fl ignore_critical
5957 Ignore critical extensions instead of rejecting the certificate.
5959 Set policy variable inhibit-any-policy (RFC 3280).
5961 Set policy variable inhibit-policy-mapping (RFC 3280).
5962 .It Fl issuer_checks
5963 Print diagnostics relating to searches for the issuer certificate
5964 of the current certificate
5965 showing why each candidate issuer certificate was rejected.
5966 The presence of rejection messages
5967 does not itself imply that anything is wrong:
5968 during the normal verify process several rejections may take place.
5969 .It Fl legacy_verify
5970 Use the legacy X.509 certificate chain verification code.
5972 Enable certificate policy processing.
5973 .It Fl purpose Ar purpose
5974 The intended use for the certificate.
5975 Without this option no chain verification will be done.
5976 Currently accepted uses are
5977 .Cm sslclient , sslserver ,
5978 .Cm nssslserver , smimesign ,
5979 .Cm smimeencrypt , crlsign ,
5983 .It Fl trusted Ar file
5986 of trusted certificates.
5989 should contain multiple certificates.
5990 .It Fl untrusted Ar file
5993 of untrusted certificates.
5996 should contain multiple certificates.
5998 Print extra information about the operations being performed.
6000 Disable workarounds for broken certificates which have to be disabled
6001 for strict X.509 compliance.
6006 If no certificate files are included, an attempt is made to read
6007 a certificate from standard input.
6008 If the first certificate filename begins with a dash,
6009 use a lone dash to mark the last option.
6014 program uses the same functions as the internal SSL and S/MIME verification,
6015 with one crucial difference:
6016 wherever possible an attempt is made to continue after an error,
6017 whereas normally the verify operation would halt on the first error.
6018 This allows all the problems with a certificate chain to be determined.
6020 The verify operation consists of a number of separate steps.
6021 Firstly a certificate chain is built up starting from the supplied certificate
6022 and ending in the root CA.
6023 It is an error if the whole chain cannot be built up.
6024 The chain is built up by looking up the issuer's certificate of the current
6026 If a certificate is found which is its own issuer, it is assumed
6029 All certificates whose subject name matches the issuer name
6030 of the current certificate are subject to further tests.
6031 The relevant authority key identifier components of the current certificate
6032 (if present) must match the subject key identifier (if present)
6033 and issuer and serial number of the candidate issuer;
6036 extension of the candidate issuer (if present) must permit certificate signing.
6038 The lookup first looks in the list of untrusted certificates and if no match
6039 is found the remaining lookups are from the trusted certificates.
6040 The root CA is always looked up in the trusted certificate list:
6041 if the certificate to verify is a root certificate,
6042 then an exact match must be found in the trusted list.
6044 The second operation is to check every untrusted certificate's extensions for
6045 consistency with the supplied purpose.
6048 option is not included, then no checks are done.
6051 certificate must have extensions compatible with the supplied purpose
6052 and all other certificates must also be valid CA certificates.
6053 The precise extensions required are described in more detail in
6058 The third operation is to check the trust settings on the root CA.
6059 The root CA should be trusted for the supplied purpose.
6060 A certificate with no trust settings is considered to be valid for
6063 The final operation is to check the validity of the certificate chain.
6064 The validity period is checked against the current system time and the
6068 dates in the certificate.
6069 The certificate signatures are also checked at this point.
6071 If all operations complete successfully, the certificate is considered
6073 If any operation fails then the certificate is not valid.
6074 When a verify operation fails, the output messages can be somewhat cryptic.
6075 The general form of the error message is:
6077 server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024-bit)
6078 error 24 at 1 depth lookup:invalid CA certificate
6081 The first line contains the name of the certificate being verified, followed by
6082 the subject name of the certificate.
6083 The second line contains the error number and the depth.
6084 The depth is the number of the certificate being verified when a
6085 problem was detected starting with zero for the certificate being verified
6086 itself, then 1 for the CA that signed the certificate and so on.
6087 Finally a text version of the error number is presented.
6089 An exhaustive list of the error codes and messages is shown below; this also
6090 includes the name of the error code as defined in the header file
6091 .In openssl/x509_vfy.h .
6092 Some of the error codes are defined but never returned: these are described as
6094 .Bl -tag -width "XXXX"
6096 The operation was successful.
6097 .It 2 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT
6098 The issuer certificate of an untrusted certificate could not be found.
6099 .It 3 X509_V_ERR_UNABLE_TO_GET_CRL
6100 The CRL of a certificate could not be found.
6101 .It 4 X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE
6102 The certificate signature could not be decrypted.
6103 This means that the actual signature value could not be determined
6104 rather than it not matching the expected value.
6105 This is only meaningful for RSA keys.
6106 .It 5 X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE
6107 The CRL signature could not be decrypted.
6108 This means that the actual signature value could not be determined
6109 rather than it not matching the expected value.
6111 .It 6 X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY
6112 The public key in the certificate
6113 .Cm SubjectPublicKeyInfo
6115 .It 7 X509_V_ERR_CERT_SIGNATURE_FAILURE
6116 The signature of the certificate is invalid.
6117 .It 8 X509_V_ERR_CRL_SIGNATURE_FAILURE
6118 The signature of the certificate is invalid.
6119 .It 9 X509_V_ERR_CERT_NOT_YET_VALID
6120 The certificate is not yet valid: the
6122 date is after the current time.
6123 .It 10 X509_V_ERR_CERT_HAS_EXPIRED
6124 The certificate has expired; that is, the
6126 date is before the current time.
6127 .It 11 X509_V_ERR_CRL_NOT_YET_VALID
6128 The CRL is not yet valid.
6129 .It 12 X509_V_ERR_CRL_HAS_EXPIRED
6130 The CRL has expired.
6131 .It 13 X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD
6134 field contains an invalid time.
6135 .It 14 X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD
6138 field contains an invalid time.
6139 .It 15 X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD
6142 field contains an invalid time.
6143 .It 16 X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD
6146 field contains an invalid time.
6147 .It 17 X509_V_ERR_OUT_OF_MEM
6148 An error occurred trying to allocate memory.
6149 This should never happen.
6150 .It 18 X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
6151 The passed certificate is self-signed and the same certificate cannot be
6152 found in the list of trusted certificates.
6153 .It 19 X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN
6154 The certificate chain could be built up using the untrusted certificates but
6155 the root could not be found locally.
6156 .It 20 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
6157 The issuer certificate of a locally looked up certificate could not be found.
6158 This normally means the list of trusted certificates is not complete.
6159 .It 21 X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE
6160 No signatures could be verified because the chain contains only one
6161 certificate and it is not self-signed.
6162 .It 22 X509_V_ERR_CERT_CHAIN_TOO_LONG
6163 The certificate chain length is greater than the supplied maximum depth.
6165 .It 23 X509_V_ERR_CERT_REVOKED
6166 The certificate has been revoked.
6167 .It 24 X509_V_ERR_INVALID_CA
6168 A CA certificate is invalid.
6169 Either it is not a CA or its extensions are not consistent
6170 with the supplied purpose.
6171 .It 25 X509_V_ERR_PATH_LENGTH_EXCEEDED
6173 .Cm basicConstraints
6174 pathlength parameter has been exceeded.
6175 .It 26 X509_V_ERR_INVALID_PURPOSE
6176 The supplied certificate cannot be used for the specified purpose.
6177 .It 27 X509_V_ERR_CERT_UNTRUSTED
6178 The root CA is not marked as trusted for the specified purpose.
6179 .It 28 X509_V_ERR_CERT_REJECTED
6180 The root CA is marked to reject the specified purpose.
6181 .It 29 X509_V_ERR_SUBJECT_ISSUER_MISMATCH
6182 The current candidate issuer certificate was rejected because its subject name
6183 did not match the issuer name of the current certificate.
6184 Only displayed when the
6187 .It 30 X509_V_ERR_AKID_SKID_MISMATCH
6188 The current candidate issuer certificate was rejected because its subject key
6189 identifier was present and did not match the authority key identifier current
6191 Only displayed when the
6194 .It 31 X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH
6195 The current candidate issuer certificate was rejected because its issuer name
6196 and serial number were present and did not match the authority key identifier
6197 of the current certificate.
6198 Only displayed when the
6201 .It 32 X509_V_ERR_KEYUSAGE_NO_CERTSIGN
6202 The current candidate issuer certificate was rejected because its
6204 extension does not permit certificate signing.
6205 .It 50 X509_V_ERR_APPLICATION_VERIFICATION
6206 An application specific error.
6216 command is used to print out version information about
6219 The options are as follows:
6222 All information: this is the same as setting all the other flags.
6224 The date the current version of
6233 Option information: various options set when the library was built.
6243 .Bl -hang -width "openssl x509"
6247 .Op Fl addreject Ar arg
6248 .Op Fl addtrust Ar arg
6251 .Op Fl CAcreateserial
6252 .Op Fl CAform Cm der | pem
6253 .Op Fl CAkey Ar file
6254 .Op Fl CAkeyform Cm der | pem
6255 .Op Fl CAserial Ar file
6256 .Op Fl certopt Ar option
6257 .Op Fl checkend Ar arg
6265 .Op Fl extensions Ar section
6266 .Op Fl extfile Ar file
6270 .Op Fl inform Cm der | net | pem
6273 .Op Fl issuer_hash_old
6274 .Op Fl keyform Cm der | pem
6277 .Op Fl nameopt Ar option
6283 .Op Fl outform Cm der | net | pem
6284 .Op Fl passin Ar arg
6289 .Op Fl set_serial Ar n
6290 .Op Fl setalias Ar arg
6291 .Op Fl signkey Ar file
6292 .Op Fl sigopt Ar nm:v
6296 .Op Fl subject_hash_old
6305 command is a multi-purpose certificate utility.
6306 It can be used to display certificate information, convert certificates to
6307 various forms, sign certificate requests like a
6309 or edit certificate trust settings.
6311 The following are x509 input, output, and general purpose options:
6312 .Bl -tag -width "XXXX"
6314 The input file to read from,
6315 or standard input if not specified.
6316 .It Fl inform Cm der | net | pem
6318 Normally, the command will expect an X.509 certificate,
6319 but this can change if other options such as
6324 This affects any signing or display option that uses a message digest,
6326 .Fl fingerprint , signkey ,
6330 If not specified, MD5 is used.
6331 SHA1 is always used with DSA keys.
6333 The output file to write to,
6334 or standard output if none is specified.
6335 .It Fl outform Cm der | net | pem
6337 .It Fl passin Ar arg
6338 The key password source.
6341 The following are x509 display options:
6342 .Bl -tag -width "XXXX"
6344 Output the certificate in the form of a C source file.
6345 .It Fl certopt Ar option
6346 Customise the output format used with
6348 either using a list of comma-separated options or by specifying
6351 The default behaviour is to print all fields.
6352 The options are as follows:
6354 .Bl -tag -width "no_extensions" -offset indent -compact
6357 .Cm no_issuer , no_pubkey , no_header ,
6358 .Cm no_version , no_sigdump ,
6362 Equivalent to no output options at all.
6364 Print unsupported certificate extensions.
6366 Hex dump unsupported extensions.
6368 Print an error message for unsupported certificate extensions.
6370 ASN.1 parse unsupported extensions.
6372 Do not print certificate trust information.
6373 .It Cm no_extensions
6374 Do not print X509V3 extensions.
6376 Do not print header (Certificate and Data) information.
6378 Do not print the issuer name.
6380 Do not print the public key.
6382 Do not print the serial number.
6384 Do not give a hexadecimal dump of the certificate signature.
6386 Do not print the signature algorithm used.
6388 Do not print the subject name.
6396 Do not print the version number.
6399 Print the start and expiry date of a certificate.
6401 Output the email addresses, if any.
6403 Print the expiry date of the certificate; that is, the
6407 Print the digest of the DER-encoded version of the whole certificate.
6412 Print the issuer name.
6414 Print the hash of the certificate issuer name.
6415 .It Fl issuer_hash_old
6416 Print the hash of the certificate issuer name
6417 using the older algorithm as used by
6419 versions before 1.0.0.
6421 Print the value of the modulus of the public key contained in the certificate.
6422 .It Fl nameopt Ar option
6423 Customise how the subject or issuer names are displayed,
6424 either using a list of comma-separated options or by specifying
6427 The default behaviour is to use the
6431 which can be preceded by a dash to turn them off,
6433 .Bl -tag -width "XXXX"
6435 Align field values for a more readable output.
6440 equivalent to specifying no options at all.
6442 Reverse the fields of the DN, as required by RFC 2253.
6443 As a side effect, this also reverses the order of multiple AVAs.
6448 it allows the DER encoding of the structure to be unambiguously determined.
6450 Any fields that need to be hexdumped are
6451 dumped using the DER encoding of the field.
6452 Otherwise just the content octets will be displayed.
6453 Both options use the RFC 2253 #XXXX... format.
6455 Dump non-character string types
6456 (for example OCTET STRING);
6457 usually, non-character string types are displayed
6458 as though each content octet represents a single character.
6460 Dump any field whose OID is not recognised by
6465 characters required by RFC 2253 in a field that is
6469 is escaped at the beginning of a string
6470 and a space character at the beginning or end of a string.
6472 Escape control characters.
6473 That is, those with ASCII values less than 0x20 (space)
6474 and the delete (0x7f) character.
6475 They are escaped using the RFC 2253 \eXX notation (where XX are two hex
6476 digits representing the character value).
6478 Escape characters with the MSB set; that is, with ASCII values larger than
6483 .Cm esc_ctrl , esc_msb , sep_multiline ,
6484 .Cm space_eq , lname ,
6488 Do not attempt to interpret multibyte characters.
6489 That is, content octets are merely dumped as though one octet
6490 represents each character.
6491 This is useful for diagnostic purposes
6492 but results in rather odd looking output.
6493 .It Cm nofname , sname , lname , oid
6494 Alter how the field name is displayed:
6496 does not display the field at all;
6498 uses the short name form (CN for
6504 represents the OID in numerical form and is useful for diagnostic purpose.
6506 A one line format which is more readable than
6509 .Cm esc_2253 , esc_ctrl , esc_msb , utf8 ,
6510 .Cm dump_nostr , dump_der , use_quote , sep_comma_plus_spc ,
6515 Displays names compatible with RFC 2253.
6517 .Cm esc_2253 , esc_ctrl ,
6518 .Cm esc_msb , utf8 , dump_nostr , dump_unknown ,
6519 .Cm dump_der , sep_comma_plus , dn_rev ,
6522 .It Cm sep_comma_plus , sep_comma_plus_space , sep_semi_plus_space , sep_multiline
6523 Determine the field separators:
6524 the first character is between RDNs and the second between multiple AVAs
6525 (multiple AVAs are very rare and their use is discouraged).
6526 The options ending in
6528 additionally place a space after the separator to make it more readable.
6530 uses a linefeed character for the RDN separator and a spaced
6532 for the AVA separator,
6533 as well as indenting the fields by four characters.
6535 Show the type of the ASN.1 character string.
6536 The type precedes the field contents.
6538 .Qq BMPSTRING: Hello World .
6540 Place spaces round the
6542 character which follows the field name.
6544 Escape some characters by surrounding the whole string with
6547 Without the option, all escaping is done with the
6551 Convert all strings to UTF8 format first, as required by RFC 2253.
6552 On a UTF8 compatible terminal,
6553 the use of this option (and not setting
6555 may result in the correct display of multibyte characters.
6556 Usually, multibyte characters larger than 0xff
6557 are represented using the format \eUXXXX for 16 bits and \eWXXXXXXXX
6559 and any UTF8Strings are converted to their character form first.
6562 Print the next serial number.
6564 Do not output the encoded version of the request.
6566 Print the OCSP responder addresses, if any.
6568 Print OCSP hash values for the subject name and public key.
6570 Print the public key.
6572 Print the certificate serial number.
6573 .It Fl sigopt Ar nm:v
6574 Pass options to the signature algorithm during sign or certify operations.
6575 The names and values of these options are algorithm-specific.
6577 Print the start date of the certificate; that is, the
6581 Print the subject name.
6583 Print the hash of the certificate subject name.
6586 to form an index to allow certificates in a directory to be looked up
6588 .It Fl subject_hash_old
6589 Print the hash of the certificate subject name
6590 using the older algorithm as used by
6592 versions before 1.0.0.
6594 Print the full certificate in text form.
6597 A trusted certificate is a certificate which has several
6598 additional pieces of information attached to it such as the permitted
6599 and prohibited uses of the certificate and an alias.
6600 When a certificate is being verified, at least one certificate must be trusted.
6601 By default, a trusted certificate must be stored locally and be a root CA.
6602 The following are x509 trust settings options:
6603 .Bl -tag -width "XXXX"
6604 .It Fl addreject Ar arg
6605 Add a prohibited use.
6606 Accepts the same values as the
6609 .It Fl addtrust Ar arg
6610 Add a trusted certificate use.
6611 Any object name can be used here, but currently only
6618 (S/MIME email) are used.
6620 Output the certificate alias.
6622 Clear all the prohibited or rejected uses of the certificate.
6624 Clear all the permitted or trusted uses of the certificate.
6626 Perform tests on the certificate extensions.
6627 The same code is used when verifying untrusted certificates in chains,
6628 so this section is useful if a chain is rejected by the verify code.
6631 .Cm basicConstraints
6632 extension CA flag is used to determine whether the
6633 certificate can be used as a CA.
6634 If the CA flag is true, it is a CA;
6635 if the CA flag is false, it is not a CA.
6636 All CAs should have the CA flag set to true.
6639 .Cm basicConstraints
6640 extension is absent, then the certificate is
6641 considered to be a possible CA;
6642 other extensions are checked according to the intended use of the certificate.
6643 A warning is given in this case because the certificate should really not
6644 be regarded as a CA.
6645 However it is allowed to be a CA to work around some broken software.
6647 If the certificate is a V1 certificate
6648 (and thus has no extensions) and it is self-signed,
6649 it is also assumed to be a CA but a warning is again given.
6650 This is to work around the problem of Verisign roots
6651 which are V1 self-signed certificates.
6655 extension is present, then additional restraints are
6656 made on the uses of the certificate.
6657 A CA certificate must have the
6661 extension is present.
6663 The extended key usage extension places additional restrictions on the
6665 If this extension is present, whether critical or not,
6666 the key can only be used for the purposes specified.
6668 A complete description of each test is given below.
6670 .Cm basicConstraints
6673 and V1 certificates above apply to all CA certificates.
6674 .Bl -tag -width "XXXX"
6676 The extended key usage extension must be absent or include the
6677 web client authentication OID.
6679 must be absent or it must have the
6680 .Cm digitalSignature
6682 The Netscape certificate type must be absent
6683 or it must have the SSL client bit set.
6685 The extended key usage extension must be absent or include the
6686 web client authentication OID.
6687 The Netscape certificate type must be absent
6688 or it must have the SSL CA bit set:
6689 this is used as a workaround if the
6690 .Cm basicConstraints
6691 extension is absent.
6693 The extended key usage extension must be absent or include the
6694 web server authentication and/or one of the SGC OIDs.
6696 must be absent or it must have the
6697 .Cm digitalSignature
6700 set, or both bits set.
6701 The Netscape certificate type must be absent or have the SSL server bit set.
6703 The extended key usage extension must be absent or include the
6704 web server authentication and/or one of the SGC OIDs.
6705 The Netscape certificate type must be absent or the SSL CA bit must be set:
6706 this is used as a workaround if the
6707 .Cm basicConstraints
6708 extension is absent.
6709 .It Netscape SSL Server
6710 For Netscape SSL clients to connect to an SSL server; it must have the
6714 extension is present.
6715 This isn't always valid because some cipher suites use the key for
6717 Otherwise it is the same as a normal SSL server.
6718 .It Common S/MIME Client Tests
6719 The extended key usage extension must be absent or include the
6720 email protection OID.
6721 The Netscape certificate type must be absent or should have the S/MIME bit set.
6722 If the S/MIME bit is not set in Netscape certificate type, then the SSL
6723 client bit is tolerated as an alternative but a warning is shown:
6724 this is because some Verisign certificates don't set the S/MIME bit.
6726 In addition to the common S/MIME client tests, the
6727 .Cm digitalSignature
6728 bit must be set if the
6730 extension is present.
6731 .It S/MIME Encryption
6732 In addition to the common S/MIME tests, the
6734 bit must be set if the
6736 extension is present.
6738 The extended key usage extension must be absent or include the
6739 email protection OID.
6740 The Netscape certificate type must be absent
6741 or must have the S/MIME CA bit set:
6742 this is used as a workaround if the
6743 .Cm basicConstraints
6744 extension is absent.
6748 extension must be absent or it must have the CRL signing bit set.
6750 The normal CA tests apply, except the
6751 .Cm basicConstraints
6752 extension must be present.
6754 .It Fl setalias Ar arg
6755 Set the alias of the certificate,
6756 allowing the certificate to be referred to using a nickname,
6758 .Qq Steve's Certificate .
6760 Output a trusted certificate
6761 (the default if any trust settings are modified).
6762 An ordinary or trusted certificate can be input, but by default an ordinary
6763 certificate is output and any trust settings are discarded.
6768 utility can be used to sign certificates and requests:
6769 it can thus behave like a mini CA.
6770 The following are x509 signing options:
6771 .Bl -tag -width "XXXX"
6773 The CA certificate to be used for signing.
6774 When this option is present,
6776 behaves like a mini CA.
6777 The input file is signed by the CA using this option;
6778 that is, its issuer name is set to the subject name of the CA and it is
6779 digitally signed using the CA's private key.
6781 This option is normally combined with the
6786 option, the input is a certificate which must be self-signed.
6787 .It Fl CAcreateserial
6788 Create the CA serial number file if it does not exist
6789 instead of generating an error.
6790 The file will contain the serial number
6792 and the certificate being signed will have
6794 as its serial number.
6795 .It Fl CAform Cm der | pem
6796 The format of the CA certificate file.
6799 .It Fl CAkey Ar file
6800 Set the CA private key to sign a certificate with.
6801 Otherwise it is assumed that the CA private key is present
6802 in the CA certificate file.
6803 .It Fl CAkeyform Cm der | pem
6804 The format of the CA private key.
6807 .It Fl CAserial Ar file
6808 Use the serial number in
6810 to sign a certificate.
6811 The file should consist of one line containing an even number of hex digits
6812 with the serial number to use.
6813 After each use the serial number is incremented and written out
6816 The default filename consists of the CA certificate file base name with
6819 For example, if the CA certificate file is called
6821 it expects to find a serial number file called
6823 .It Fl checkend Ar arg
6824 Check whether the certificate expires in the next
6827 If so, exit with return value 1;
6828 otherwise exit with return value 0.
6830 Delete any extensions from a certificate.
6831 This option is used when a certificate is being created from another
6832 certificate (for example with the
6837 Normally, all extensions are retained.
6839 The number of days to make a certificate valid for.
6840 The default is 30 days.
6841 .It Fl extensions Ar section
6842 The section to add certificate extensions from.
6843 If this option is not specified, the extensions should either be
6844 contained in the unnamed (default) section
6845 or the default section should contain a variable called
6847 which contains the section to use.
6848 .It Fl extfile Ar file
6849 File containing certificate extensions to use.
6850 If not specified, no extensions are added to the certificate.
6851 .It Fl keyform Cm der | pem
6852 The format of the private key file used in the
6856 Expect a certificate request on input instead of a certificate.
6857 .It Fl set_serial Ar n
6858 The serial number to use.
6859 This option can be used with either the
6864 If used in conjunction with the
6866 option, the serial number file (as specified by the
6870 options) is not used.
6872 The serial number can be decimal or hex (if preceded by
6874 Negative serial numbers can also be specified but their use is not recommended.
6875 .It Fl signkey Ar file
6878 using the supplied private key.
6880 If the input file is a certificate, it sets the issuer name to the
6881 subject name (i.e. makes it self-signed),
6882 changes the public key to the supplied value,
6883 and changes the start and end dates.
6884 The start date is set to the current time and the end date is set to
6885 a value determined by the
6888 Any certificate extensions are retained unless the
6892 If the input is a certificate request, a self-signed certificate
6893 is created using the supplied private key using the subject name in
6896 Convert a certificate into a certificate request.
6899 option is used to pass the required private key.
6902 Several commands share a common syntax,
6905 Password arguments, typically specified using
6909 for input and output passwords,
6910 allow passwords to be obtained from a variety of sources.
6911 Both of these options take a single argument, described below.
6912 If no password argument is given and a password is required,
6913 then the user is prompted to enter one:
6914 this will typically be read from the current terminal with echoing turned off.
6915 .Bl -tag -width "pass:password" -offset indent
6916 .It Cm pass : Ns Ar password
6917 The actual password is
6919 Since the password is visible to utilities,
6920 this form should only be used where security is not important.
6921 .It Cm env : Ns Ar var
6922 Obtain the password from the environment variable
6924 Since the environment of other processes is visible,
6925 this option should be used with caution.
6926 .It Cm file : Ns Ar path
6932 argument is supplied to
6936 then the first line will be used for the input password and the next line
6937 for the output password.
6939 need not refer to a regular file:
6940 it could, for example, refer to a device or named pipe.
6941 .It Cm fd : Ns Ar number
6942 Read the password from the file descriptor
6944 This can be used to send the data via a pipe, for example.
6946 Read the password from standard input.
6949 Input/output formats,
6950 typically specified using
6954 indicate the format being read from or written to.
6955 The argument is case insensitive.
6957 .Bl -tag -width Ds -offset indent -compact
6959 Distinguished Encoding Rules (DER)
6962 Insecure legacy format.
6964 Privacy Enhanced Mail (PEM)
6969 An SMIME format message.
6974 The following environment variables affect the execution of
6976 .Bl -tag -width "/etc/ssl/openssl.cnf"
6978 The location of the master configuration file.
6981 .Bl -tag -width "/etc/ssl/openssl.cnf" -compact
6983 Default config directory for
6985 .It Pa /etc/ssl/lib/
6987 .It Pa /etc/ssl/private/
6988 Default private key directory.
6989 .It Pa /etc/ssl/openssl.cnf
6990 Default configuration file for
6992 .It Pa /etc/ssl/x509v3.cnf
6993 Default configuration file for
7010 .%T The TLS Protocol Version 1.0
7019 .%T Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names
7026 .%T PKCS #7: Cryptographic Message Syntax Version 1.5
7036 .%T Internet X.509 Public Key Infrastructure Certificate and CRL Profile
7047 .%T X.509 Internet Public Key Infrastructure Online Certificate Status Protocol \(en OCSP
7054 .%T Cryptographic Message Syntax
7061 .%T Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)