| blob | 62a078fd1b9ec10e1d33b311a717a093677fc35c |
1 .\" $NetBSD: openssl_CA.pl.1,v 1.14 2015/06/12 17:01:14 christos Exp $
2 .\"
3 .\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.28)
4 .\"
5 .\" Standard preamble:
6 .\" ========================================================================
7 .de Sp \" Vertical space (when we can't use .PP)
8 .if t .sp .5v
9 .if n .sp
10 ..
11 .de Vb \" Begin verbatim text
12 .ft CW
13 .nf
14 .ne \\$1
15 ..
16 .de Ve \" End verbatim text
17 .ft R
18 .fi
19 ..
20 .\" Set up some character translations and predefined strings. \*(-- will
21 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
22 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
23 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
24 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
25 .\" nothing in troff, for use with C<>.
26 .tr \(*W-
27 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
28 .ie n \{\
29 . ds -- \(*W-
30 . ds PI pi
31 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
32 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
33 . ds L" ""
34 . ds R" ""
35 . ds C` ""
36 . ds C' ""
37 'br\}
38 .el\{\
39 . ds -- \|\(em\|
40 . ds PI \(*p
41 . ds L" ``
42 . ds R" ''
43 . ds C`
44 . ds C'
45 'br\}
46 .\"
47 .\" Escape single quotes in literal strings from groff's Unicode transform.
48 .ie \n(.g .ds Aq \(aq
49 .el .ds Aq '
50 .\"
51 .\" If the F register is turned on, we'll generate index entries on stderr for
52 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
53 .\" entries marked with X<> in POD. Of course, you'll have to process the
54 .\" output yourself in some meaningful fashion.
55 .\"
56 .\" Avoid warning from groff about undefined register 'F'.
57 .de IX
58 ..
59 .nr rF 0
60 .if \n(.g .if rF .nr rF 1
61 .if (\n(rF:(\n(.g==0)) \{
62 . if \nF \{
63 . de IX
64 . tm Index:\\$1\t\\n%\t"\\$2"
65 ..
66 . if !\nF==2 \{
67 . nr % 0
68 . nr F 2
69 . \}
70 . \}
71 .\}
72 .rr rF
73 .\"
74 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
75 .\" Fear. Run. Save yourself. No user-serviceable parts.
76 . \" fudge factors for nroff and troff
77 .if n \{\
78 . ds #H 0
79 . ds #V .8m
80 . ds #F .3m
81 . ds #[ \f1
82 . ds #] \fP
83 .\}
84 .if t \{\
85 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
86 . ds #V .6m
87 . ds #F 0
88 . ds #[ \&
89 . ds #] \&
90 .\}
91 . \" simple accents for nroff and troff
92 .if n \{\
93 . ds ' \&
94 . ds ` \&
95 . ds ^ \&
96 . ds , \&
97 . ds ~ ~
98 . ds /
99 .\}
100 .if t \{\
101 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
102 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
103 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
104 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
105 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
106 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
107 .\}
108 . \" troff and (daisy-wheel) nroff accents
109 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
110 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
111 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
112 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
113 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
114 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
115 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
116 .ds ae a\h'-(\w'a'u*4/10)'e
117 .ds Ae A\h'-(\w'A'u*4/10)'E
118 . \" corrections for vroff
119 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
120 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
121 . \" for low resolution devices (crt and lpr)
122 .if \n(.H>23 .if \n(.V>19 \
123 \{\
124 . ds : e
125 . ds 8 ss
126 . ds o a
127 . ds d- d\h'-1'\(ga
128 . ds D- D\h'-1'\(hy
129 . ds th \o'bp'
130 . ds Th \o'LP'
131 . ds ae ae
132 . ds Ae AE
133 .\}
134 .rm #[ #] #H #V #F C
135 .\" ========================================================================
136 .\"
137 .IX Title "CA.PL 1"
138 .TH CA.PL 1 "2013-02-05" "1.0.1n" "OpenSSL"
139 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
140 .\" way too many mistakes in technical documents.
141 .if n .ad l
142 .nh
143 .SH "NAME"
144 CA.pl \- friendlier interface for OpenSSL certificate programs
145 .SH "LIBRARY"
146 libcrypto, -lcrypto
147 .SH "SYNOPSIS"
148 .IX Header "SYNOPSIS"
149 \&\fB\s-1CA\s0.pl\fR
150 [\fB\-?\fR]
151 [\fB\-h\fR]
152 [\fB\-help\fR]
153 [\fB\-newcert\fR]
154 [\fB\-newreq\fR]
155 [\fB\-newreq\-nodes\fR]
156 [\fB\-newca\fR]
157 [\fB\-xsign\fR]
158 [\fB\-sign\fR]
159 [\fB\-signreq\fR]
160 [\fB\-signcert\fR]
161 [\fB\-verify\fR]
162 [\fBfiles\fR]
163 .SH "DESCRIPTION"
164 .IX Header "DESCRIPTION"
165 The \fB\s-1CA\s0.pl\fR script is a perl script that supplies the relevant command line
166 arguments to the \fBopenssl\fR command for some common certificate operations.
167 It is intended to simplify the process of certificate creation and management
168 by the use of some simple options.
169 .SH "COMMAND OPTIONS"
170 .IX Header "COMMAND OPTIONS"
171 .IP "\fB?\fR, \fB\-h\fR, \fB\-help\fR" 4
172 .IX Item "?, -h, -help"
173 prints a usage message.
174 .IP "\fB\-newcert\fR" 4
175 .IX Item "-newcert"
176 creates a new self signed certificate. The private key is written to the file
177 \&\*(L"newkey.pem\*(R" and the request written to the file \*(L"newreq.pem\*(R".
178 .IP "\fB\-newreq\fR" 4
179 .IX Item "-newreq"
180 creates a new certificate request. The private key is written to the file
181 \&\*(L"newkey.pem\*(R" and the request written to the file \*(L"newreq.pem\*(R".
182 .IP "\fB\-newreq\-nodes\fR" 4
183 .IX Item "-newreq-nodes"
184 is like \fB\-newreq\fR except that the private key will not be encrypted.
185 .IP "\fB\-newca\fR" 4
186 .IX Item "-newca"
187 creates a new \s-1CA\s0 hierarchy for use with the \fBca\fR program (or the \fB\-signcert\fR
188 and \fB\-xsign\fR options). The user is prompted to enter the filename of the \s-1CA\s0
189 certificates (which should also contain the private key) or by hitting \s-1ENTER\s0
190 details of the \s-1CA\s0 will be prompted for. The relevant files and directories
191 are created in a directory called \*(L"demoCA\*(R" in the current directory.
192 .IP "\fB\-pkcs12\fR" 4
193 .IX Item "-pkcs12"
194 create a PKCS#12 file containing the user certificate, private key and \s-1CA\s0
195 certificate. It expects the user certificate and private key to be in the
196 file \*(L"newcert.pem\*(R" and the \s-1CA\s0 certificate to be in the file demoCA/cacert.pem,
197 it creates a file \*(L"newcert.p12\*(R". This command can thus be called after the
198 \&\fB\-sign\fR option. The PKCS#12 file can be imported directly into a browser.
199 If there is an additional argument on the command line it will be used as the
200 \&\*(L"friendly name\*(R" for the certificate (which is typically displayed in the browser
201 list box), otherwise the name \*(L"My Certificate\*(R" is used.
202 .IP "\fB\-sign\fR, \fB\-signreq\fR, \fB\-xsign\fR" 4
203 .IX Item "-sign, -signreq, -xsign"
204 calls the \fBca\fR program to sign a certificate request. It expects the request
205 to be in the file \*(L"newreq.pem\*(R". The new certificate is written to the file
206 \&\*(L"newcert.pem\*(R" except in the case of the \fB\-xsign\fR option when it is written
207 to standard output.
208 .IP "\fB\-signCA\fR" 4
209 .IX Item "-signCA"
210 this option is the same as the \fB\-signreq\fR option except it uses the configuration
211 file section \fBv3_ca\fR and so makes the signed request a valid \s-1CA\s0 certificate. This
212 is useful when creating intermediate \s-1CA\s0 from a root \s-1CA.\s0
213 .IP "\fB\-signcert\fR" 4
214 .IX Item "-signcert"
215 this option is the same as \fB\-sign\fR except it expects a self signed certificate
216 to be present in the file \*(L"newreq.pem\*(R".
217 .IP "\fB\-verify\fR" 4
218 .IX Item "-verify"
219 verifies certificates against the \s-1CA\s0 certificate for \*(L"demoCA\*(R". If no certificates
220 are specified on the command line it tries to verify the file \*(L"newcert.pem\*(R".
221 .IP "\fBfiles\fR" 4
222 .IX Item "files"
223 one or more optional certificate file names for use with the \fB\-verify\fR command.
224 .SH "EXAMPLES"
225 .IX Header "EXAMPLES"
226 Create a \s-1CA\s0 hierarchy:
227 .PP
228 .Vb 1
229 \& CA.pl \-newca
230 .Ve
231 .PP
232 Complete certificate creation example: create a \s-1CA,\s0 create a request, sign
233 the request and finally create a PKCS#12 file containing it.
234 .PP
235 .Vb 4
236 \& CA.pl \-newca
237 \& CA.pl \-newreq
238 \& CA.pl \-signreq
239 \& CA.pl \-pkcs12 "My Test Certificate"
240 .Ve
241 .SH "DSA CERTIFICATES"
242 .IX Header "DSA CERTIFICATES"
243 Although the \fB\s-1CA\s0.pl\fR creates \s-1RSA\s0 CAs and requests it is still possible to
244 use it with \s-1DSA\s0 certificates and requests using the \fIopenssl_req\fR\|(1) command
245 directly. The following example shows the steps that would typically be taken.
246 .PP
247 Create some \s-1DSA\s0 parameters:
248 .PP
249 .Vb 1
250 \& openssl dsaparam \-out dsap.pem 1024
251 .Ve
252 .PP
253 Create a \s-1DSA CA\s0 certificate and private key:
254 .PP
255 .Vb 1
256 \& openssl req \-x509 \-newkey dsa:dsap.pem \-keyout cacert.pem \-out cacert.pem
257 .Ve
258 .PP
259 Create the \s-1CA\s0 directories and files:
260 .PP
261 .Vb 1
262 \& CA.pl \-newca
263 .Ve
264 .PP
265 enter cacert.pem when prompted for the \s-1CA\s0 file name.
266 .PP
267 Create a \s-1DSA\s0 certificate request and private key (a different set of parameters
268 can optionally be created first):
269 .PP
270 .Vb 1
271 \& openssl req \-out newreq.pem \-newkey dsa:dsap.pem
272 .Ve
273 .PP
274 Sign the request:
275 .PP
276 .Vb 1
277 \& CA.pl \-signreq
278 .Ve
279 .SH "NOTES"
280 .IX Header "NOTES"
281 Most of the filenames mentioned can be modified by editing the \fB\s-1CA\s0.pl\fR script.
282 .PP
283 If the demoCA directory already exists then the \fB\-newca\fR command will not
284 overwrite it and will do nothing. This can happen if a previous call using
285 the \fB\-newca\fR option terminated abnormally. To get the correct behaviour
286 delete the demoCA directory if it already exists.
287 .PP
288 Under some environments it may not be possible to run the \fB\s-1CA\s0.pl\fR script
289 directly (for example Win32) and the default configuration file location may
290 be wrong. In this case the command:
291 .PP
292 .Vb 1
293 \& perl \-S CA.pl
294 .Ve
295 .PP
296 can be used and the \fB\s-1OPENSSL_CONF\s0\fR environment variable changed to point to
297 the correct path of the configuration file \*(L"openssl.cnf\*(R".
298 .PP
299 The script is intended as a simple front end for the \fBopenssl\fR program for use
300 by a beginner. Its behaviour isn't always what is wanted. For more control over the
301 behaviour of the certificate commands call the \fBopenssl\fR command directly.
302 .SH "ENVIRONMENT VARIABLES"
303 .IX Header "ENVIRONMENT VARIABLES"
304 The variable \fB\s-1OPENSSL_CONF\s0\fR if defined allows an alternative configuration
305 file location to be specified, it should contain the full path to the
306 configuration file, not just its directory.
307 .SH "SEE ALSO"
308 .IX Header "SEE ALSO"
309 \&\fIopenssl_x509\fR\|(1), \fIopenssl_ca\fR\|(1), \fIopenssl_req\fR\|(1), \fIopenssl_pkcs12\fR\|(1),
310 \&\fIopenssl.cnf\fR\|(5)