| blob | c42643c270eaf8dab84da88d39e3cedd3e276420 |
1 '\" te
2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH KMFCFG 1 "Feb 3, 2009"
7 .SH NAME
8 kmfcfg \- Key Management Policy and Plugin Configuration Utility
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBkmfcfg\fR \fIsubcommand\fR [\fIoption\fR ...]
13 .fi
15 .SH DESCRIPTION
16 .sp
17 .LP
18 The \fBkmfcfg\fR command allows users to configure Key Management Framework
19 (KMF) policy databases. The KMF policy database (DB) restricts the use of keys
20 and certificates that are managed through the KMF framework.
21 .sp
22 .LP
23 \fBkmfcfg\fR provides the ability to list, create, modify, delete, import and
24 export policy definitions either in the system default database file
25 \fB/etc/security/kmfpolicy.xml\fR or a user-defined database file.
26 .sp
27 .LP
28 For plugin configuration, \fBkmfcfg\fR allows users to display plugin
29 information, install or uninstall a KMF plugin, and modify the plugin option.
30 .SH SUBCOMMANDS
31 .sp
32 .LP
33 The following subcommands are supported:
34 .sp
35 .ne 2
36 .na
37 \fB\fBcreate\fR\fR
38 .ad
39 .sp .6
40 .RS 4n
41 Adds a new policy into the policy database file.
42 .sp
43 The format for the \fBcreate\fR subcommand is as follows:
44 .sp
45 .in +2
46 .nf
47 create [dbfile=\fIdbfile\fR] policy=\fIpolicyname\fR
48 [ignore-date=true|false]
49 [ignore-unknown-eku=true|false]
50 [ignore-trust-anchor=true|false]
51 [validity-adjusttime=\fIadjusttime\fR]
52 [ta-name=trust anchor subject DN]
53 [ta-serial=trust anchor serial number]
54 [ocsp-responder=\fIURL\fR]
55 [ocsp-proxy=\fIURL\fR]
56 [ocsp-use-cert-responder=true|false]
57 [ocsp-response-lifetime=timelimit]
58 [ocsp-ignore-response-sign=true|false]
59 [ocsp-responder-cert-name=Issuer DN]
60 [ocsp-responder-cert-serial=\fIserial number\fR]
61 [crl-basefilename=\fIbasefilename\fR]
62 [crl-directory=\fIdirectory\fR]
63 [crl-get-crl-uri=true|false]
64 [crl-proxy=\fIURL\fR]
65 [crl-ignore-crl-sign=true|false]
66 [crl-ignore-crl-date=true|false]
67 [keyusage=digitalSignature|nonRepudiation
68 |keyEncipherment | dataEncipherment |
69 keyAgreement |keyCertSign |
70 cRLSign | encipherOnly | decipherOnly],[...]
71 [ekunames=serverAuth | clientAuth |
72 codeSigning | emailProtection |
73 ipsecEndSystem | ipsecTunnel |
74 ipsecUser | timeStamping |
75 OCSPSigning],[...]
76 [ekuoids=\fIOID,OID,OID...\fR]
77 .fi
78 .in -2
79 .sp
81 The \fBcreate\fR subcommand supports the following options:
82 .sp
83 .ne 2
84 .na
85 \fB\fBcrl-basefilename=\fR\fIfilename\fR\fR
86 .ad
87 .br
88 .na
89 \fB\fBcrl-directory=\fR\fIdirectory\fR\fR
90 .ad
91 .sp .6
92 .RS 4n
93 These two attributes are used to specify the location for CRL files. The
94 \fBcrl-basefilename\fR attribute represents the base filename for a CRL file.
95 The \fBcrl-directory\fR attribute represents the directory for CRL files, which
96 defaults to the current directory.
97 .sp
98 If the \fBcrl-get-crl-uri\fR attribute is set to \fBtrue\fR and the
99 \fBcrl-basefilename\fR is not specified, the \fBbasefilename\fR for the cached
100 CRL file is the basename of the URI used to fetch the CRL file.
101 .sp
102 If the \fBcrl-get-crl-uri\fR attribute is set to \fBfalse\fR the
103 \fBcrl-basefilename\fR needs to be specified to indicate an input CRL file. The
104 setting for \fBcrl-get-crl-uri\fR is \fBfalse\fR by default.
105 .sp
106 These two attributes only apply to the file-based CRL plugins. The current
107 file-based CRL plugins are \fBfile\fR and \fBpkcs11\fR keystores. For the
108 \fBnss\fR keystore, the CRL location is always the NSS internal database.
109 .RE
111 .sp
112 .ne 2
113 .na
114 \fB\fBcrl-get-crl-uri=true | false\fR\fR
115 .ad
116 .sp .6
117 .RS 4n
118 Configure if a CRL file is fetched and cached dynamically as part of the
119 certificate validation, using the URI information from the certificate's
120 distribution points extension.
121 .sp
122 The default for this attribute is \fBfalse\fR.
123 .RE
125 .sp
126 .ne 2
127 .na
128 \fB\fBcrl-ignore-crl-date=true | false\fR\fR
129 .ad
130 .sp .6
131 .RS 4n
132 If \fBcrl-ignore-crl-date\fR is set to true, the validity time period of the
133 CRL is not checked.
134 .sp
135 The default for this attribute is \fBfalse\fR.
136 .RE
138 .sp
139 .ne 2
140 .na
141 \fB\fBcrl-ignore-crl-sign=true | false\fR\fR
142 .ad
143 .sp .6
144 .RS 4n
145 If \fBcrl-ignore-crl-sign\fR is set to \fBtrue\fR, the signature of the CRL is
146 not checked.
147 .sp
148 The default for this attribute is \fBfalse\fR.
149 .RE
151 .sp
152 .ne 2
153 .na
154 \fB\fBcrl-proxy=\fR \fIURL\fR\fR
155 .ad
156 .sp .6
157 .RS 4n
158 Sets the proxy server name and port for dynamically retrieving a CRL file when
159 \fBcrl-get-crl-uri\fR is set to \fBtrue\fR.
160 .sp
161 The port number is optional. If the port number is not specified, the default
162 value is \fB8080\fR. An example \fBcrl-proxy\fR setting might be:
163 \fBcrl-proxy=webcache.sfbay:8080\fR.
164 .RE
166 .sp
167 .ne 2
168 .na
169 \fB\fBdbfile=\fR\fIdbfile\fR\fR
170 .ad
171 .sp .6
172 .RS 4n
173 The DB file to add the new policy. If not specified, the default is the system
174 KMF policy database file \fB/etc/security/kmfpolicy.xml\fR.
175 .RE
177 .sp
178 .ne 2
179 .na
180 \fB\fBekuoids=\fR\fIEKUOIDS\fR\fR
181 .ad
182 .sp .6
183 .RS 4n
184 A comma separated list of Extended Key Usage OIDs that are required by the
185 policy being defined. The OIDs are expressed in \fBdot notation\fR, for
186 example, \fB1.2.3.4\fR. An example \fBekuoids\fR setting might be:
187 \fBekuoids=1.2.3.4,9.8.7.6.5\fR.
188 .RE
190 .sp
191 .ne 2
192 .na
193 \fB\fBekunames=\fR\fIEKUNAMES\fR\fR
194 .ad
195 .sp .6
196 .RS 4n
197 A comma separated list of Extended Key Usage names that are required by the
198 policy being defined. The list of values allowed for \fIEKUNAMES\fR are:
199 \fBserverAuth\fR, \fBclientAuth\fR, \fBcodeSigning\fR, \fBemailProtection\fR,
200 \fBipsecEndSystem\fR, \fBipsecTunnel\fR, \fBipsecUser\fR, \fBtimeStamping\fR,
201 and \fBOCSPSigning\fR
202 .sp
203 The OCSP, CRL, key usage and extended key usage checkings are off by default.
204 To turn on any one of them, specify one or more attributes for the particular
205 checking. For example, if the \fBocsp-responder\fR attribute is set, then the
206 OCSP checking is turned on. If the \fBekuname\fR attribute or the \fBekuoids\fR
207 attribute is set, then the extended key usage checking is turned on.
208 .RE
210 .sp
211 .ne 2
212 .na
213 \fB\fBignore-date=true | false\fR\fR
214 .ad
215 .sp .6
216 .RS 4n
217 Set the \fBIgnore Date\fR option for this policy. By default this value is
218 \fBfalse\fR. If \fBtrue\fR is specified, the policy ignores the validity
219 periods defined in the certificates when evaluating their validity.
220 .RE
222 .sp
223 .ne 2
224 .na
225 \fB\fBignore-unknown-eku=true | false\fR\fR
226 .ad
227 .sp .6
228 .RS 4n
229 Set the \fBIgnore Unknown EKU\fR option for this policy. By default this value
230 is \fBfalse\fR. If \fBtrue\fR, the policy ignores any unrecognized EKU values
231 in the Extended Key Usage extension.
232 .RE
234 .sp
235 .ne 2
236 .na
237 \fB\fBignore-trust-anchor=true | false\fR\fR
238 .ad
239 .sp .6
240 .RS 4n
241 Set the \fBIgnore Trust Anchor\fR option for this policy. By default this value
242 is \fBfalse\fR. If \fBtrue\fR is specified, the policy does not verify the
243 signature of the subject certificate using trust anchor certificate at
244 validation.
245 .RE
247 .sp
248 .ne 2
249 .na
250 \fB\fBkeyusage=\fR\fIKUVALUES\fR\fR
251 .ad
252 .sp .6
253 .RS 4n
254 A comma separated list of key usage values that are required by the policy
255 being defined. The list of values allowed are: \fBdigitalSignature\fR,
256 \fBnonRepudiation\fR, \fBkeyEncipherment\fR, \fBdataEncipherment\fR,
257 \fBkeyAgreement\fR, \fBkeyCertSign\fR, \fBcRLSign\fR, \fBencipherOnly\fR,
258 \fBdecipherOnly\fR
259 .RE
261 .sp
262 .ne 2
263 .na
264 \fB\fBocsp-ignore-response-sign=true | false\fR\fR
265 .ad
266 .sp .6
267 .RS 4n
268 If this attribute is set to \fBtrue\fR, the signature of the OCSP response is
269 not verified. This attribute value is default to \fBfalse\fR.
270 .RE
272 .sp
273 .ne 2
274 .na
275 \fB\fBocsp-proxy=\fR\fIURL\fR\fR
276 .ad
277 .sp .6
278 .RS 4n
279 Set the proxy server name and port for OCSP. The port number is optional. If
280 the port number is not specified, the default value is 8080. An example
281 \fBocsp-proxy\fR setting might be: \fBocsp-proxy="webcache.sfbay:8080"\fR
282 .RE
284 .sp
285 .ne 2
286 .na
287 \fB\fBocsp-response-lifetime=\fR\fItimelimit\fR\fR
288 .ad
289 .sp .6
290 .RS 4n
291 Set the \fBfreshness\fR period that a response must be. The \fItimelimit\fR can
292 be specified by \fInumber-day\fR, \fInumber-hour\fR, \fInumber-minute\fR, or
293 \fInumber-second\fR. An example \fBocsp-response-lifetime\fR setting might
294 be:\fBocsp-response-lifetime=6-hour\fR.
295 .RE
297 .sp
298 .ne 2
299 .na
300 \fB\fBocsp-responder-cert-name=\fR\fIIssuerDN\fR\fR
301 .ad
302 .br
303 .na
304 \fB\fBocsp-responder-cert-serial=\fR\fIserialNumber\fR\fR
305 .ad
306 .sp .6
307 .RS 4n
308 These two attributes represent the OCSP responder certificate. The
309 \fBocsp-responder-cert-name\fR is to specify the issuer name of the
310 certificate. See the \fBta-name\fR option for example. The
311 \fIocsp-responder-cert-serial\fR is for the serial number and must be specified
312 as a hex value, for example, \fB0x0102030405060708090a0b0c0d0e0f\fR. If an OCSP
313 responder is different from the issuer of the certificate and if the OCSP
314 response needs to be verified, an OCSP responder certificate information should
315 be provided.
316 .RE
318 .sp
319 .ne 2
320 .na
321 \fB\fBocsp-responder=\fR\fIURL\fR\fR
322 .ad
323 .sp .6
324 .RS 4n
325 Set the OCSP responder URL for use with the OCSP validation method. For
326 example, \fBocsp-responder=http://ocsp.verisign.com/ocsp/status\fR
327 .RE
329 .sp
330 .ne 2
331 .na
332 \fBo\fBcsp-use-cert-responder=true | fals\fRe\fR
333 .ad
334 .sp .6
335 .RS 4n
336 Configure this policy to always use the responder defined in the certificate
337 itself if possible.
338 .RE
340 .sp
341 .ne 2
342 .na
343 \fB\fBpolicy=\fR\fIpolicyname\fR\fR
344 .ad
345 .sp .6
346 .RS 4n
347 The policy record to be created. \fIpolicyname\fR is required.
348 .RE
350 .sp
351 .ne 2
352 .na
353 \fB\fBvalidity-adjusttime=\fR\fIadjusttime\fR\fR
354 .ad
355 .sp .6
356 .RS 4n
357 Set the adjust time for both ends of validity period for a certificate. The
358 time can be specified by \fInumber-day, number-hour, number-minute, or
359 number-second\fR. An example \fBvalidity-adjusttime\fR setting might be:
360 \fBvalidity-adjusttime=6-hour. ta-name="Subject DN" ta-serial=serialNumber\fR
361 .sp
362 These two attributes represent the trust anchor certificate and are used to
363 find the trust anchor certificate in the keystore. The \fIta-name\fR is to
364 specify the distinguished name of the trust anchor certificate subject name.
365 For example, \fBta-name="O=Sun Microsystems Inc., \ OU=Solaris Security
366 Technologies Group, \ L=Ashburn, ST=VA, C=US, CN=John Smith"\fR The serial
367 number of the TA certificate. This, along with the Issuer DN, is used to find
368 the TA certificate in the keystore. The serial number must be specified as a
369 hex value, for example, \fB0x0102030405060708090a0b0c0d0e\fR The trust anchor
370 attributes need to be set, if the value of \fBignore-trust-anchor\fR attribute
371 is false.
372 .RE
374 .RE
376 .sp
377 .ne 2
378 .na
379 \fB\fBdelete\fR\fR
380 .ad
381 .sp .6
382 .RS 4n
383 Deletes any policy matching the indicated policy name. The system default
384 policy (\fBdefault\fR) cannot be deleted.
385 .sp
386 The format for the \fBdelete\fR subcommand is as follows:
387 .sp
388 .in +2
389 .nf
390 delete [dbfile=\fIdbfile\fR] policy=\fIpolicyname\fR
391 .fi
392 .in -2
393 .sp
395 The \fBdelete\fR subcommand supports the following options:
396 .sp
397 .ne 2
398 .na
399 \fBdbfile=\fIdbfile\fR\fR
400 .ad
401 .RS 21n
402 Read policy definitions from the indicated file. If \fIdbfile\fR is not
403 specified, , the default is the system KMF policy database file:
404 \fB/etc/security/kmfpolicy.xml\fR.
405 .RE
407 .sp
408 .ne 2
409 .na
410 \fBpolicy=\fIpolicyname\fR\fR
411 .ad
412 .RS 21n
413 The name of the policy to delete. \fIpolicyname\fR is required, if using the
414 system database.
415 .RE
417 .RE
419 .sp
420 .ne 2
421 .na
422 \fB\fBexport\fR\fR
423 .ad
424 .sp .6
425 .RS 4n
426 Exports a policy from one policy database file to another policy database file.
427 .sp
428 The format for the \fBexport\fR subcommand is as follows:
429 .sp
430 .in +2
431 .nf
432 kmfcfg export policy=\fIpolicyname\fR outfile=\fInewdbfile\fR [dbfile=\fIdbfile\fR]
433 .fi
434 .in -2
435 .sp
437 The \fBexport\fR subcommand supports the following options:
438 .sp
439 .ne 2
440 .na
441 \fBdbfile=\fIdbfile\fR\fR
442 .ad
443 .RS 24n
444 The DB file where the exported policy is read. If \fIdbfile\fR is not
445 specified, the default is the system KMF policy database file:
446 \fB/etc/security/kmfpolicy.xml\fR.
447 .RE
449 .sp
450 .ne 2
451 .na
452 \fBoutfile=\fIoutputdbfile\fR\fR
453 .ad
454 .RS 24n
455 The DB file where the exported policy is stored.
456 .RE
458 .sp
459 .ne 2
460 .na
461 \fBpolicy=\fIpolicyname\fR\fR
462 .ad
463 .RS 24n
464 The policy record to be exported.
465 .RE
467 .RE
469 .sp
470 .ne 2
471 .na
472 \fB\fBhelp\fR\fR
473 .ad
474 .sp .6
475 .RS 4n
476 Displays help for the \fBkmfcfg\fR command.
477 .sp
478 The format for the \fBhelp\fR subcommand is as follows:
479 .sp
480 .in +2
481 .nf
482 help
483 .fi
484 .in -2
485 .sp
487 .RE
489 .sp
490 .ne 2
491 .na
492 \fB\fBimport\fR\fR
493 .ad
494 .sp .6
495 .RS 4n
496 Imports a policy from one policy database file to another policy database file.
497 .sp
498 The format for the \fBimport\fR subcommand is as follows:
499 .sp
500 .in +2
501 .nf
502 kmfcfg import policy=\fIpolicyname\fR infile=\fIinputdbfile\fR [dbfile=\fIdbfile\fR]
503 .fi
504 .in -2
505 .sp
507 The \fBimport\fR subcommand supports the following options:
508 .sp
509 .ne 2
510 .na
511 \fBpolicy=\fIpolicyname\fR\fR
512 .ad
513 .RS 22n
514 The policy record to be imported.
515 .RE
517 .sp
518 .ne 2
519 .na
520 \fBinfile=\fIinputdbfile\fR\fR
521 .ad
522 .RS 22n
523 The DB file to read the policy from.
524 .RE
526 .sp
527 .ne 2
528 .na
529 \fBdbfile=\fIoutdbfile\fR\fR
530 .ad
531 .RS 22n
532 The DB file to add the new policy. If not specified, the default is the system
533 KMF policy database file \fB/etc/security/kmfpolicy.xml\fR.
534 .RE
536 .RE
538 .sp
539 .ne 2
540 .na
541 \fB\fBlist\fR\fR
542 .ad
543 .sp .6
544 .RS 4n
545 Without arguments, lists all policy definitions from the default system
546 database.
547 .sp
548 The format for the \fBlist\fR subcommand is as follows:
549 .sp
550 .in +2
551 .nf
552 list [dbfile=\fIdbfile\fR] [policy=\fIpolicyname\fR]
553 .fi
554 .in -2
555 .sp
557 The \fBlist\fR subcommand supports the following options:
558 .sp
559 .ne 2
560 .na
561 \fBdbfile=\fIdbfile\fR\fR
562 .ad
563 .RS 21n
564 Reads policy definitions from the indicated file. If not specified, the default
565 is the system KMF policy database file \fB/etc/security/kmfpolicy.xml\fR.
566 .RE
568 .sp
569 .ne 2
570 .na
571 \fBpolicy=\fIpolicyname\fR\fR
572 .ad
573 .RS 21n
574 Only display policy definition for the named policy.
575 .RE
577 .RE
579 .sp
580 .ne 2
581 .na
582 \fB\fBmodify\fR\fR
583 .ad
584 .sp .6
585 .RS 4n
586 Modifies any policy matching the indicated name. The system default policy
587 (\fBdefault\fR) cannot be modified.
588 .sp
589 The format for the \fBmodify\fR subcommand is as follows:
590 .sp
591 .in +2
592 .nf
593 modify [dbfile=\fIdbfile\fR] policy=\fIpolicyname\fR
594 [ignore-date=true|false]
595 [ignore-unknown-eku=true|false]
596 [ignore-trust-anchor=true|false]
597 [validity-adjusttime=\fIadjusttime\fR]
598 [ta-name=trust anchor subject DN]
599 [ta-serial=trust anchor serial number]
600 [ocsp-responder=\fIURL\fR]
601 [ocsp-proxy=\fIURL\fR]
602 [ocsp-use-cert-responder=true|false]
603 [ocsp-response-lifetime=timelimit]
604 [ocsp-ignore-response-sign=true|false]
605 [ocsp-responder-cert-name=Issuer DN]
606 [ocsp-responder-cert-serial=serial number]
607 [ocsp-none=true|false]
608 [crl-basefilename=\fIbasefilename\fR]
609 [crl-directory=\fIdirectory\fR]
610 [crl-get-crl-uri=true|false]
611 [crl-proxy=URL]
612 [crl-ignore-crl-sign=true|false]
613 [crl-ignore-crl-date=true|false]
614 [crl-none=true|false]
615 [keyusage=digitalSignature| nonRepudiation
616 |keyEncipherment | dataEncipherment |
617 keyAgreement |keyCertSign |
618 cRLSign | encipherOnly | decipherOnly],[...]
619 [keyusage-none=true|false]
620 [ekunames=serverAuth | clientAuth |
621 codeSigning | emailProtection |
622 ipsecEndSystem | ipsecTunnel |
623 ipsecUser | timeStamping |
624 OCSPSigning],[...]
625 [ekuoids=OID,OID,OID]
626 [eku-none=true|false]
627 .fi
628 .in -2
629 .sp
631 The \fBmodify\fR subcommand supports many of the same options as the
632 \fBcreate\fR subcommand. For descriptions of shared options, see the create
633 subcommand.
634 .sp
635 The \fBmodify\fR subcommand supports the following unique options:
636 .sp
637 .ne 2
638 .na
639 \fB\fBcrl-none=true | false\fR\fR
640 .ad
641 .RS 30n
642 If \fBcrl-none\fR is set to \fBtrue\fR, CRL checking is turned off. If this
643 attribute is set to \fBtrue\fR, other CRL attributes cannot be set.
644 .RE
646 .sp
647 .ne 2
648 .na
649 \fBdfile=[\fIdbfile\fR]\fR
650 .ad
651 .RS 30n
652 The database file to modify a policy. If not specified, the default is the
653 system KMF policy database file \fB/etc/security/kmfpolicy.xml\fR.
654 .RE
656 .sp
657 .ne 2
658 .na
659 \fBeku-none=true | false\fR
660 .ad
661 .RS 30n
662 If \fBeku-none\fR is set to \fBtrue\fR, extended key usage checking is turned
663 off. The extended key usage attributes, \fBekuname\fR and \fBekuoids\fR cannot
664 be set at the same time if \fBeku-none\fR is set to \fBtrue\fR.
665 .RE
667 .sp
668 .ne 2
669 .na
670 \fBkeyusage-none=true | false\fR
671 .ad
672 .RS 30n
673 If \fBkeyusage-none\fR is set to true, key usage checking is turned off.
674 .sp
675 The \fBkeyusage\fR attribute cannot be set at the same time if this attribute
676 is set to \fBtrue\fR.
677 .RE
679 .sp
680 .ne 2
681 .na
682 \fBocsp-none=true | false\fR
683 .ad
684 .RS 30n
685 If \fBocsp-none\fR is set to true, OCSP checking is turned off. Any other OCSP
686 attribute is not set at the same time if this attribute is set to \fBtrue\fR.
687 .RE
689 .sp
690 .ne 2
691 .na
692 \fBpolicy=\fIpolicyname\fR\fR
693 .ad
694 .RS 30n
695 The name of the policy to modify. \fIpolicyname\fR is required.
696 The \fBdefault\fR policy in the system KMF policy database cannot be modified.
697 .RE
699 .RE
701 .SS "Plugin Subcommands"
702 .sp
703 .ne 2
704 .na
705 \fB\fBinstall keystore=\fR\fIkeystore_name\fR \fBmodulepath=\fR\fIpathname\fR\e
706 \fB[option=\fR\fIoption_str\fR\fB]\fR\fR
707 .ad
708 .sp .6
709 .RS 4n
710 Install a plugin into the system. The \fBmodulepath\fR field specifies the
711 pathname to a KMF plugin shared library object. If \fIpathname\fR is not
712 specified as an absolute pathname, shared library objects are assumed to be
713 relative to \fB/lib/security/$ISA/\fR. The \fBISA\fR token is replaced by an
714 implementation defined directory name which defines the pathname relative to
715 the calling program's instruction set architecture.
716 .RE
718 .sp
719 .ne 2
720 .na
721 \fB\fBlist plugin\fR\fR
722 .ad
723 .sp .6
724 .RS 4n
725 Display KMF plugin information.
726 .sp
727 Without the \fBplugin\fRkeyword, \fBkmfcfg list\fR shows the policy information
728 as described in the \fBSUBCOMMANDS\fR section.
729 .RE
731 .sp
732 .ne 2
733 .na
734 \fB\fBmodify plugin keystore=\fR\fIkeystore_name\fR
735 \fBoption=\fR\fIoption_str\fR\fR
736 .ad
737 .sp .6
738 .RS 4n
739 Modify the \fBplugin\fR option. The \fBplugin\fR option is defined by the
740 plugin and is interpreted by the plugin specifically, therefore this command
741 accepts any option string.
742 .sp
743 Without the \fBplugin\fR keyword, \fBkmfcfg modify\fR updates the policy
744 configuration as described in the \fBSUBCOMMANDS\fR section.
745 .RE
747 .sp
748 .ne 2
749 .na
750 \fB\fBuninstall keystore=\fR\fIkeystore_name\fR\fR
751 .ad
752 .sp .6
753 .RS 4n
754 Uninstall the plugin with the \fIkeystore_name\fR.
755 .RE
757 .SH EXAMPLES
758 .LP
759 \fBExample 1 \fRCreating a New Policy
760 .sp
761 .LP
762 The following example creates a new policy called IPSEC in the system database:
764 .sp
765 .in +2
766 .nf
767 $ kmfcfg create IPSEC \e
768 ignore-trust-anchor=true \e
769 ocsp-use-cert-responder=true \e
770 keyusage=keyAgreement,keyEncipherment,dataEncipherment \e
771 ekuname=ipsecTunnel,ipsecUser
772 .fi
773 .in -2
774 .sp
776 .SH EXIT STATUS
777 .sp
778 .LP
779 The following exit values are returned:
780 .sp
781 .ne 2
782 .na
783 \fB\fB0\fR\fR
784 .ad
785 .RS 6n
786 Successful completion.
787 .RE
789 .sp
790 .ne 2
791 .na
792 \fB\fB>0\fR\fR
793 .ad
794 .RS 6n
795 An error occurred.
796 .RE
798 .SH FILES
799 .sp
800 .ne 2
801 .na
802 \fB\fB/etc/security/kmfpolicy.xml\fR\fR
803 .ad
804 .sp .6
805 .RS 4n
806 Default system policy database
807 .RE
809 .SH ATTRIBUTES
810 .sp
811 .LP
812 See \fBattributes\fR(5) for descriptions of the following attributes:
813 .sp
815 .sp
816 .TS
817 box;
818 c | c
819 l | l .
820 ATTRIBUTE TYPE ATTRIBUTE VALUE
821 _
822 Interface Stability Uncommitted
823 .TE
825 .SH SEE ALSO
826 .sp
827 .LP
828 \fBattributes\fR(5)