1 .\" $NetBSD: openssl.1,v 1.14 2015/06/12 17:01:14 christos Exp $
3 .\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.28)
6 .\" ========================================================================
7 .de Sp \" Vertical space (when we can't use .PP)
11 .de Vb \" Begin verbatim text
16 .de Ve \" End verbatim text
20 .\" Set up some character translations and predefined strings. \*(-- will
21 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
22 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
23 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
24 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
25 .\" nothing in troff, for use with C<>.
27 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
31 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
32 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
47 .\" Escape single quotes in literal strings from groff's Unicode transform.
51 .\" If the F register is turned on, we'll generate index entries on stderr for
52 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
53 .\" entries marked with X<> in POD. Of course, you'll have to process the
54 .\" output yourself in some meaningful fashion.
56 .\" Avoid warning from groff about undefined register 'F'.
60 .if \n(.g .if rF .nr rF 1
61 .if (\n(rF:(\n(.g==0)) \{
64 . tm Index:\\$1\t\\n%\t"\\$2"
74 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
75 .\" Fear. Run. Save yourself. No user-serviceable parts.
76 . \" fudge factors for nroff and troff
85 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
91 . \" simple accents for nroff and troff
101 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
102 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
103 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
104 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
105 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
106 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
108 . \" troff and (daisy-wheel) nroff accents
109 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
110 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
111 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
112 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
113 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
114 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
115 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
116 .ds ae a\h'-(\w'a'u*4/10)'e
117 .ds Ae A\h'-(\w'A'u*4/10)'E
118 . \" corrections for vroff
119 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
120 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
121 . \" for low resolution devices (crt and lpr)
122 .if \n(.H>23 .if \n(.V>19 \
135 .\" ========================================================================
137 .IX Title "OPENSSL 1"
138 .TH OPENSSL 1 "2010-01-24" "1.0.1n" "OpenSSL"
139 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
140 .\" way too many mistakes in technical documents.
144 openssl \- OpenSSL command line tool
148 .IX Header "SYNOPSIS"
151 [ \fIcommand_opts\fR ]
152 [ \fIcommand_args\fR ]
154 \&\fBopenssl\fR [ \fBlist-standard-commands\fR | \fBlist-message-digest-commands\fR | \fBlist-cipher-commands\fR | \fBlist-cipher-algorithms\fR | \fBlist-message-digest-algorithms\fR | \fBlist-public-key-algorithms\fR]
156 \&\fBopenssl\fR \fBno\-\fR\fI\s-1XXX\s0\fR [ \fIarbitrary options\fR ]
158 .IX Header "DESCRIPTION"
159 OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (\s-1SSL\s0
160 v2/v3) and Transport Layer Security (\s-1TLS\s0 v1) network protocols and related
161 cryptography standards required by them.
163 The \fBopenssl\fR program is a command line tool for using the various
164 cryptography functions of OpenSSL's \fBcrypto\fR library from the shell.
168 \& o Creation and management of private keys, public keys and parameters
169 \& o Public key cryptographic operations
170 \& o Creation of X.509 certificates, CSRs and CRLs
171 \& o Calculation of Message Digests
172 \& o Encryption and Decryption with Ciphers
173 \& o SSL/TLS Client and Server Tests
174 \& o Handling of S/MIME signed or encrypted mail
175 \& o Time Stamp requests, generation and verification
177 .SH "COMMAND SUMMARY"
178 .IX Header "COMMAND SUMMARY"
179 The \fBopenssl\fR program provides a rich variety of commands (\fIcommand\fR in the
180 \&\s-1SYNOPSIS\s0 above), each of which often has a wealth of options and arguments
181 (\fIcommand_opts\fR and \fIcommand_args\fR in the \s-1SYNOPSIS\s0).
183 The pseudo-commands \fBlist-standard-commands\fR, \fBlist-message-digest-commands\fR,
184 and \fBlist-cipher-commands\fR output a list (one entry per line) of the names
185 of all standard commands, message digest commands, or cipher commands,
186 respectively, that are available in the present \fBopenssl\fR utility.
188 The pseudo-commands \fBlist-cipher-algorithms\fR and
189 \&\fBlist-message-digest-algorithms\fR list all cipher and message digest names, one entry per line. Aliases are listed as:
195 The pseudo-command \fBlist-public-key-algorithms\fR lists all supported public
198 The pseudo-command \fBno\-\fR\fI\s-1XXX\s0\fR tests whether a command of the
199 specified name is available. If no command named \fI\s-1XXX\s0\fR exists, it
200 returns 0 (success) and prints \fBno\-\fR\fI\s-1XXX\s0\fR; otherwise it returns 1
201 and prints \fI\s-1XXX\s0\fR. In both cases, the output goes to \fBstdout\fR and
202 nothing is printed to \fBstderr\fR. Additional command line arguments
203 are always ignored. Since for each cipher there is a command of the
204 same name, this provides an easy way for shell scripts to test for the
205 availability of ciphers in the \fBopenssl\fR program. (\fBno\-\fR\fI\s-1XXX\s0\fR is
206 not able to detect pseudo-commands such as \fBquit\fR,
207 \&\fBlist\-\fR\fI...\fR\fB\-commands\fR, or \fBno\-\fR\fI\s-1XXX\s0\fR itself.)
208 .SS "\s-1STANDARD COMMANDS\s0"
209 .IX Subsection "STANDARD COMMANDS"
210 .IP "\fBasn1parse\fR" 10
212 Parse an \s-1ASN.1\s0 sequence.
215 Certificate Authority (\s-1CA\s0) Management.
216 .IP "\fBciphers\fR" 10
218 Cipher Suite Description Determination.
221 \&\s-1CMS \s0(Cryptographic Message Syntax) utility
224 Certificate Revocation List (\s-1CRL\s0) Management.
225 .IP "\fBcrl2pkcs7\fR" 10
227 \&\s-1CRL\s0 to PKCS#7 Conversion.
230 Message Digest Calculation.
233 Diffie-Hellman Parameter Management.
234 Obsoleted by \fBdhparam\fR.
235 .IP "\fBdhparam\fR" 10
237 Generation and Management of Diffie-Hellman Parameters. Superseded by
238 \&\fBgenpkey\fR and \fBpkeyparam\fR
241 \&\s-1DSA\s0 Data Management.
242 .IP "\fBdsaparam\fR" 10
244 \&\s-1DSA\s0 Parameter Generation and Management. Superseded by
245 \&\fBgenpkey\fR and \fBpkeyparam\fR
248 \&\s-1EC \s0(Elliptic curve) key processing
249 .IP "\fBecparam\fR" 10
251 \&\s-1EC\s0 parameter manipulation and generation
254 Encoding with Ciphers.
255 .IP "\fBengine\fR" 10
257 Engine (loadble module) information and manipulation.
258 .IP "\fBerrstr\fR" 10
260 Error Number to Error String Conversion.
263 Generation of Diffie-Hellman Parameters.
264 Obsoleted by \fBdhparam\fR.
265 .IP "\fBgendsa\fR" 10
267 Generation of \s-1DSA\s0 Private Key from Parameters. Superseded by
268 \&\fBgenpkey\fR and \fBpkey\fR
269 .IP "\fBgenpkey\fR" 10
271 Generation of Private Key or Parameters.
272 .IP "\fBgenrsa\fR" 10
274 Generation of \s-1RSA\s0 Private Key. Superceded by \fBgenpkey\fR.
277 Create or examine a netscape certificate sequence
280 Online Certificate Status Protocol utility.
281 .IP "\fBpasswd\fR" 10
283 Generation of hashed passwords.
284 .IP "\fBpkcs12\fR" 10
286 PKCS#12 Data Management.
289 PKCS#7 Data Management.
292 Public and private key management.
293 .IP "\fBpkeyparam\fR" 10
295 Public key algorithm parameter management.
296 .IP "\fBpkeyutl\fR" 10
298 Public key algorithm cryptographic operation utility.
301 Generate pseudo-random bytes.
304 PKCS#10 X.509 Certificate Signing Request (\s-1CSR\s0) Management.
307 \&\s-1RSA\s0 key management.
308 .IP "\fBrsautl\fR" 10
310 \&\s-1RSA\s0 utility for signing, verification, encryption, and decryption. Superseded
312 .IP "\fBs_client\fR" 10
314 This implements a generic \s-1SSL/TLS\s0 client which can establish a transparent
315 connection to a remote server speaking \s-1SSL/TLS.\s0 It's intended for testing
316 purposes only and provides only rudimentary interface functionality but
317 internally uses mostly all functionality of the OpenSSL \fBssl\fR library.
318 .IP "\fBs_server\fR" 10
320 This implements a generic \s-1SSL/TLS\s0 server which accepts connections from remote
321 clients speaking \s-1SSL/TLS.\s0 It's intended for testing purposes only and provides
322 only rudimentary interface functionality but internally uses mostly all
323 functionality of the OpenSSL \fBssl\fR library. It provides both an own command
324 line oriented protocol for testing \s-1SSL\s0 functions and a simple \s-1HTTP\s0 response
325 facility to emulate an SSL/TLS\-aware webserver.
326 .IP "\fBs_time\fR" 10
328 \&\s-1SSL\s0 Connection Timer.
329 .IP "\fBsess_id\fR" 10
331 \&\s-1SSL\s0 Session Data Management.
334 S/MIME mail processing.
337 Algorithm Speed Measurement.
340 \&\s-1SPKAC\s0 printing and generating utility
343 Time Stamping Authority tool (client/server)
344 .IP "\fBverify\fR" 10
346 X.509 Certificate Verification.
347 .IP "\fBversion\fR" 10
349 OpenSSL Version Information.
352 X.509 Certificate Data Management.
353 .SS "\s-1MESSAGE DIGEST COMMANDS\s0"
354 .IX Subsection "MESSAGE DIGEST COMMANDS"
364 .IP "\fBrmd160\fR" 10
366 \&\s-1RMD\-160\s0 Digest
372 \&\s-1SHA\-1\s0 Digest
373 .IP "\fBsha224\fR" 10
375 \&\s-1SHA\-224\s0 Digest
376 .IP "\fBsha256\fR" 10
378 \&\s-1SHA\-256\s0 Digest
379 .IP "\fBsha384\fR" 10
381 \&\s-1SHA\-384\s0 Digest
382 .IP "\fBsha512\fR" 10
384 \&\s-1SHA\-512\s0 Digest
385 .SS "\s-1ENCODING AND CIPHER COMMANDS\s0"
386 .IX Subsection "ENCODING AND CIPHER COMMANDS"
387 .IP "\fBbase64\fR" 10
390 .IP "\fBbf bf-cbc bf-cfb bf-ecb bf-ofb\fR" 10
391 .IX Item "bf bf-cbc bf-cfb bf-ecb bf-ofb"
393 .IP "\fBcast cast-cbc\fR" 10
394 .IX Item "cast cast-cbc"
396 .IP "\fBcast5\-cbc cast5\-cfb cast5\-ecb cast5\-ofb\fR" 10
397 .IX Item "cast5-cbc cast5-cfb cast5-ecb cast5-ofb"
398 \&\s-1CAST5\s0 Cipher
399 .IP "\fBdes des-cbc des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb des-ede-ofb des-ofb\fR" 10
400 .IX Item "des des-cbc des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb des-ede-ofb des-ofb"
402 .IP "\fBdes3 desx des\-ede3 des\-ede3\-cbc des\-ede3\-cfb des\-ede3\-ofb\fR" 10
403 .IX Item "des3 desx des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb"
405 .IP "\fBidea idea-cbc idea-cfb idea-ecb idea-ofb\fR" 10
406 .IX Item "idea idea-cbc idea-cfb idea-ecb idea-ofb"
408 .IP "\fBrc2 rc2\-cbc rc2\-cfb rc2\-ecb rc2\-ofb\fR" 10
409 .IX Item "rc2 rc2-cbc rc2-cfb rc2-ecb rc2-ofb"
414 .IP "\fBrc5 rc5\-cbc rc5\-cfb rc5\-ecb rc5\-ofb\fR" 10
415 .IX Item "rc5 rc5-cbc rc5-cfb rc5-ecb rc5-ofb"
417 .SH "PASS PHRASE ARGUMENTS"
418 .IX Header "PASS PHRASE ARGUMENTS"
419 Several commands accept password arguments, typically using \fB\-passin\fR
420 and \fB\-passout\fR for input and output passwords respectively. These allow
421 the password to be obtained from a variety of sources. Both of these
422 options take a single argument whose format is described below. If no
423 password argument is given and a password is required then the user is
424 prompted to enter one: this will typically be read from the current
425 terminal with echoing turned off.
426 .IP "\fBpass:password\fR" 10
427 .IX Item "pass:password"
428 the actual password is \fBpassword\fR. Since the password is visible
429 to utilities (like 'ps' under Unix) this form should only be used
430 where security is not important.
431 .IP "\fBenv:var\fR" 10
433 obtain the password from the environment variable \fBvar\fR. Since
434 the environment of other processes is visible on certain platforms
435 (e.g. ps under certain Unix OSes) this option should be used with caution.
436 .IP "\fBfile:pathname\fR" 10
437 .IX Item "file:pathname"
438 the first line of \fBpathname\fR is the password. If the same \fBpathname\fR
439 argument is supplied to \fB\-passin\fR and \fB\-passout\fR arguments then the first
440 line will be used for the input password and the next line for the output
441 password. \fBpathname\fR need not refer to a regular file: it could for example
442 refer to a device or named pipe.
443 .IP "\fBfd:number\fR" 10
445 read the password from the file descriptor \fBnumber\fR. This can be used to
446 send the data via a pipe for example.
449 read the password from standard input.
451 .IX Header "SEE ALSO"
452 \&\fIopenssl_asn1parse\fR\|(1), \fIopenssl_ca\fR\|(1), \fIopenssl.cnf\fR\|(5),
453 \&\fIopenssl_crl\fR\|(1), \fIopenssl_crl2pkcs7\fR\|(1), \fIopenssl_dgst\fR\|(1),
454 \&\fIopenssl_dhparam\fR\|(1), \fIopenssl_dsa\fR\|(1), \fIopenssl_dsaparam\fR\|(1),
455 \&\fIopenssl_enc\fR\|(1), \fIopenssl_gendsa\fR\|(1), \fIgenpkey\fR\|(1),
456 \&\fIopenssl_genrsa\fR\|(1), \fIopenssl_nseq\fR\|(1), \fIopenssl\fR\|(1),
457 \&\fIopenssl_passwd\fR\|(1),
458 \&\fIopenssl_pkcs12\fR\|(1), \fIopenssl_pkcs7\fR\|(1), \fIopenssl_pkcs8\fR\|(1),
459 \&\fIopenssl_rand\fR\|(1), \fIopenssl_req\fR\|(1), \fIopenssl_rsa\fR\|(1),
460 \&\fIopenssl_rsautl\fR\|(1), \fIopenssl_s_client\fR\|(1),
461 \&\fIopenssl_s_server\fR\|(1), \fIs_time\fR\|(1),
462 \&\fIopenssl_smime\fR\|(1), \fIopenssl_spkac\fR\|(1),
463 \&\fIopenssl_verify\fR\|(1), \fIopenssl_version\fR\|(1), \fIopenssl_x509\fR\|(1),
464 \&\fIcrypto\fR\|(3), \fIssl\fR\|(3), \fIx509v3_config\fR\|(5)
467 The \fIopenssl\fR\|(1) document appeared in OpenSSL 0.9.2.
468 The \fBlist\-\fR\fI\s-1XXX\s0\fR\fB\-commands\fR pseudo-commands were added in OpenSSL 0.9.3;
469 The \fBlist\-\fR\fI\s-1XXX\s0\fR\fB\-algorithms\fR pseudo-commands were added in OpenSSL 1.0.0;
470 the \fBno\-\fR\fI\s-1XXX\s0\fR pseudo-commands were added in OpenSSL 0.9.5a.
471 For notes on the availability of other commands, see their individual