1385 lines
39 KiB
HTML
1385 lines
39 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of GPGSM</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>GPGSM</H1>
|
|
Section: GNU Privacy Guard 2.2 (1)<BR>Updated: 2019-11-23<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
<B>gpgsm</B>
|
|
|
|
- CMS encryption and signing tool
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>gpgsm</B>
|
|
|
|
[<B>--homedir</B>
|
|
|
|
<I>dir</I>]
|
|
|
|
[<B>--options</B>
|
|
|
|
<I>file</I>]
|
|
|
|
[<I>options</I>]
|
|
|
|
<I>command</I>
|
|
|
|
[<I>args</I>]
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>gpgsm</B> is a tool similar to <B>gpg</B> to provide digital
|
|
encryption and signing services on X.509 certificates and the CMS
|
|
protocol. It is mainly used as a backend for S/MIME mail processing.
|
|
<B>gpgsm</B> includes a full featured certificate management and
|
|
complies with all rules defined for the German Sphinx project.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>COMMANDS</H2>
|
|
|
|
<P>
|
|
Commands are not distinguished from options except for the fact that
|
|
only one command is allowed.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAF"> </A>
|
|
<H3>Commands not specific to the function</H3>
|
|
|
|
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="1"><B>--version</B>
|
|
|
|
<DD>
|
|
Print the program version and licensing information. Note that you
|
|
cannot abbreviate this command.
|
|
<P>
|
|
<DT id="2"><B>--help, -h</B>
|
|
|
|
<DD>
|
|
Print a usage message summarizing the most useful command-line options.
|
|
Note that you cannot abbreviate this command.
|
|
<P>
|
|
<DT id="3"><B>--warranty</B>
|
|
|
|
<DD>
|
|
Print warranty information. Note that you cannot abbreviate this
|
|
command.
|
|
<P>
|
|
<DT id="4"><B>--dump-options</B>
|
|
|
|
<DD>
|
|
Print a list of all available options and commands. Note that you cannot
|
|
abbreviate this command.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAG"> </A>
|
|
<H3>Commands to select the type of operation</H3>
|
|
|
|
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="5"><B>--encrypt</B>
|
|
|
|
<DD>
|
|
Perform an encryption. The keys the data is encrypted to must be set
|
|
using the option <B>--recipient</B>.
|
|
<P>
|
|
<DT id="6"><B>--decrypt</B>
|
|
|
|
<DD>
|
|
Perform a decryption; the type of input is automatically determined. It
|
|
may either be in binary form or PEM encoded; automatic determination of
|
|
base-64 encoding is not done.
|
|
<P>
|
|
<DT id="7"><B>--sign</B>
|
|
|
|
<DD>
|
|
Create a digital signature. The key used is either the fist one found
|
|
in the keybox or those set with the <B>--local-user</B> option.
|
|
<P>
|
|
<DT id="8"><B>--verify</B>
|
|
|
|
<DD>
|
|
Check a signature file for validity. Depending on the arguments a
|
|
detached signature may also be checked.
|
|
<P>
|
|
<DT id="9"><B>--server</B>
|
|
|
|
<DD>
|
|
Run in server mode and wait for commands on the <B>stdin</B>.
|
|
<P>
|
|
<DT id="10"><B>--call-dirmngr </B><I>command</I> [<I>args</I>]
|
|
|
|
<DD>
|
|
Behave as a Dirmngr client issuing the request <I>command</I> with the
|
|
optional list of <I>args</I>. The output of the Dirmngr is printed
|
|
stdout. Please note that file names given as arguments should have an
|
|
absolute file name (i.e. commencing with <B>/</B>) because they are
|
|
passed verbatim to the Dirmngr and the working directory of the
|
|
Dirmngr might not be the same as the one of this client. Currently it
|
|
is not possible to pass data via stdin to the Dirmngr. <I>command</I>
|
|
should not contain spaces.
|
|
<P>
|
|
This is command is required for certain maintaining tasks of the dirmngr
|
|
where a dirmngr must be able to call back to <B>gpgsm</B>. See the Dirmngr
|
|
manual for details.
|
|
<P>
|
|
<DT id="11"><B>--call-protect-tool </B><I>arguments</I>
|
|
|
|
<DD>
|
|
Certain maintenance operations are done by an external program call
|
|
<B>gpg-protect-tool</B>; this is usually not installed in a directory
|
|
listed in the PATH variable. This command provides a simple wrapper to
|
|
access this tool. <I>arguments</I> are passed verbatim to this command;
|
|
use '--help' to get a list of supported operations.
|
|
<P>
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAH"> </A>
|
|
<H3>How to manage the certificates and keys</H3>
|
|
|
|
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="12"><B>--generate-key</B>
|
|
|
|
<DD>
|
|
|
|
<B>--gen-key</B>
|
|
|
|
This command allows the creation of a certificate signing request or a
|
|
self-signed certificate. It is commonly used along with the
|
|
<B>--output</B> option to save the created CSR or certificate into a
|
|
file. If used with the <B>--batch</B> a parameter file is used to
|
|
create the CSR or certificate and it is further possible to create
|
|
non-self-signed certificates.
|
|
<P>
|
|
<DT id="13"><B>--list-keys</B>
|
|
|
|
<DD>
|
|
|
|
<B>-k</B>
|
|
|
|
List all available certificates stored in the local key database.
|
|
Note that the displayed data might be reformatted for better human
|
|
readability and illegal characters are replaced by safe substitutes.
|
|
<P>
|
|
<DT id="14"><B>--list-secret-keys</B>
|
|
|
|
<DD>
|
|
|
|
<B>-K</B>
|
|
|
|
List all available certificates for which a corresponding a secret key
|
|
is available.
|
|
<P>
|
|
<DT id="15"><B>--list-external-keys </B><I>pattern</I>
|
|
|
|
<DD>
|
|
List certificates matching <I>pattern</I> using an external server. This
|
|
utilizes the <B>dirmngr</B> service.
|
|
<P>
|
|
<DT id="16"><B>--list-chain</B>
|
|
|
|
<DD>
|
|
Same as <B>--list-keys</B> but also prints all keys making up the chain.
|
|
<P>
|
|
<P>
|
|
<DT id="17"><B>--dump-cert</B>
|
|
|
|
<DD>
|
|
|
|
<B>--dump-keys</B>
|
|
|
|
List all available certificates stored in the local key database using a
|
|
format useful mainly for debugging.
|
|
<P>
|
|
<DT id="18"><B>--dump-chain</B>
|
|
|
|
<DD>
|
|
Same as <B>--dump-keys</B> but also prints all keys making up the chain.
|
|
<P>
|
|
<DT id="19"><B>--dump-secret-keys</B>
|
|
|
|
<DD>
|
|
List all available certificates for which a corresponding a secret key
|
|
is available using a format useful mainly for debugging.
|
|
<P>
|
|
<DT id="20"><B>--dump-external-keys </B><I>pattern</I>
|
|
|
|
<DD>
|
|
List certificates matching <I>pattern</I> using an external server.
|
|
This utilizes the <B>dirmngr</B> service. It uses a format useful
|
|
mainly for debugging.
|
|
<P>
|
|
<DT id="21"><B>--keydb-clear-some-cert-flags</B>
|
|
|
|
<DD>
|
|
This is a debugging aid to reset certain flags in the key database
|
|
which are used to cache certain certificate stati. It is especially
|
|
useful if a bad CRL or a weird running OCSP responder did accidentally
|
|
revoke certificate. There is no security issue with this command
|
|
because <B>gpgsm</B> always make sure that the validity of a certificate is
|
|
checked right before it is used.
|
|
<P>
|
|
<DT id="22"><B>--delete-keys </B><I>pattern</I>
|
|
|
|
<DD>
|
|
Delete the keys matching <I>pattern</I>. Note that there is no command
|
|
to delete the secret part of the key directly. In case you need to do
|
|
this, you should run the command <B>gpgsm --dump-secret-keys KEYID</B>
|
|
before you delete the key, copy the string of hex-digits in the
|
|
``keygrip'' line and delete the file consisting of these hex-digits
|
|
and the suffix <B>.key</B> from the '<I>private-keys-v1.d</I>' directory
|
|
below our GnuPG home directory (usually '<I>~/.gnupg</I>').
|
|
<P>
|
|
<DT id="23"><B>--export [</B><I>pattern</I>]
|
|
|
|
<DD>
|
|
Export all certificates stored in the Keybox or those specified by the
|
|
optional <I>pattern</I>. Those pattern consist of a list of user ids
|
|
(see: [how-to-specify-a-user-id]). When used along with the
|
|
<B>--armor</B> option a few informational lines are prepended before
|
|
each block. There is one limitation: As there is no commonly agreed
|
|
upon way to pack more than one certificate into an ASN.1 structure,
|
|
the binary export (i.e. without using <B>armor</B>) works only for
|
|
the export of one certificate. Thus it is required to specify a
|
|
<I>pattern</I> which yields exactly one certificate. Ephemeral
|
|
certificate are only exported if all <I>pattern</I> are given as
|
|
fingerprints or keygrips.
|
|
<P>
|
|
<DT id="24"><B>--export-secret-key-p12 </B><I>key-id</I>
|
|
|
|
<DD>
|
|
Export the private key and the certificate identified by <I>key-id</I>
|
|
using the PKCS#12 format. When used with the <B>--armor</B> option a few
|
|
informational lines are prepended to the output. Note, that the PKCS#12
|
|
format is not very secure and proper transport security should be used
|
|
to convey the exported key. (See: [option --p12-charset].)
|
|
<P>
|
|
<DT id="25"><B>--export-secret-key-p8 </B><I>key-id</I>
|
|
|
|
<DD>
|
|
|
|
<B>--export-secret-key-raw </B><I>key-id</I>
|
|
|
|
Export the private key of the certificate identified by <I>key-id</I>
|
|
with any encryption stripped. The <B>...-raw</B> command exports in
|
|
PKCS#1 format; the <B>...-p8</B> command exports in PKCS#8 format.
|
|
When used with the <B>--armor</B> option a few informational lines are
|
|
prepended to the output. These commands are useful to prepare a key
|
|
for use on a TLS server.
|
|
<P>
|
|
<DT id="26"><B>--import [</B><I>files</I>]
|
|
|
|
<DD>
|
|
Import the certificates from the PEM or binary encoded files as well as
|
|
from signed-only messages. This command may also be used to import a
|
|
secret key from a PKCS#12 file.
|
|
<P>
|
|
<DT id="27"><B>--learn-card</B>
|
|
|
|
<DD>
|
|
Read information about the private keys from the smartcard and import
|
|
the certificates from there. This command utilizes the <B>gpg-agent</B>
|
|
and in turn the <B>scdaemon</B>.
|
|
<P>
|
|
<DT id="28"><B>--change-passphrase </B><I>user_id</I>
|
|
|
|
<DD>
|
|
|
|
<B>--passwd </B><I>user_id</I>
|
|
|
|
Change the passphrase of the private key belonging to the certificate
|
|
specified as <I>user_id</I>. Note, that changing the passphrase/PIN of a
|
|
smartcard is not yet supported.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAI"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
<P>
|
|
<B>GPGSM</B> features a bunch of options to control the exact behaviour
|
|
and to change the default configuration.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAJ"> </A>
|
|
<H3>How to change the configuration</H3>
|
|
|
|
|
|
<P>
|
|
These options are used to change the configuration and are usually found
|
|
in the option file.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="29"><B>--options </B><I>file</I>
|
|
|
|
<DD>
|
|
Reads configuration from <I>file</I> instead of from the default
|
|
per-user configuration file. The default configuration file is named
|
|
'<I>gpgsm.conf</I>' and expected in the '<I>.gnupg</I>' directory directly
|
|
below the home directory of the user.
|
|
<P>
|
|
<DT id="30"><B>--homedir </B><I>dir</I>
|
|
|
|
<DD>
|
|
Set the name of the home directory to <I>dir</I>. If this option is not
|
|
used, the home directory defaults to '<I>~/.gnupg</I>'. It is only
|
|
recognized when given on the command line. It also overrides any home
|
|
directory stated through the environment variable '<I>GNUPGHOME</I>' or
|
|
(on Windows systems) by means of the Registry entry
|
|
<I>HKCU\Software\GNU\GnuPG:HomeDir</I>.
|
|
<P>
|
|
On Windows systems it is possible to install GnuPG as a portable
|
|
application. In this case only this command line option is
|
|
considered, all other ways to set a home directory are ignored.
|
|
<P>
|
|
To install GnuPG as a portable application under Windows, create an
|
|
empty file named '<I>gpgconf.ctl</I>' in the same directory as the tool
|
|
'<I>gpgconf.exe</I>'. The root of the installation is then that
|
|
directory; or, if '<I>gpgconf.exe</I>' has been installed directly below
|
|
a directory named '<I>bin</I>', its parent directory. You also need to
|
|
make sure that the following directories exist and are writable:
|
|
'<I>ROOT/home</I>' for the GnuPG home and '<I>ROOT/var/cache/gnupg</I>'
|
|
for internal cache files.
|
|
<P>
|
|
<P>
|
|
<DT id="31"><B>-v</B>
|
|
|
|
<DD>
|
|
<DT id="32"><B>--verbose</B>
|
|
|
|
<DD>
|
|
Outputs additional information while running.
|
|
You can increase the verbosity by giving several
|
|
verbose commands to <B>gpgsm</B>, such as '-vv'.
|
|
<P>
|
|
<DT id="33"><B>--policy-file </B><I>filename</I>
|
|
|
|
<DD>
|
|
Change the default name of the policy file to <I>filename</I>.
|
|
<P>
|
|
<DT id="34"><B>--agent-program </B><I>file</I>
|
|
|
|
<DD>
|
|
Specify an agent program to be used for secret key operations. The
|
|
default value is determined by running the command <B>gpgconf</B>.
|
|
Note that the pipe symbol (<B>|</B>) is used for a regression test
|
|
suite hack and may thus not be used in the file name.
|
|
<P>
|
|
<DT id="35"><B>--dirmngr-program </B><I>file</I>
|
|
|
|
<DD>
|
|
Specify a dirmngr program to be used for CRL checks. The
|
|
default value is '<I>/usr/bin/dirmngr</I>'.
|
|
<P>
|
|
<DT id="36"><B>--prefer-system-dirmngr</B>
|
|
|
|
<DD>
|
|
This option is obsolete and ignored.
|
|
<P>
|
|
<DT id="37"><B>--disable-dirmngr</B>
|
|
|
|
<DD>
|
|
Entirely disable the use of the Dirmngr.
|
|
<P>
|
|
<DT id="38"><B>--no-autostart</B>
|
|
|
|
<DD>
|
|
Do not start the gpg-agent or the dirmngr if it has not yet been
|
|
started and its service is required. This option is mostly useful on
|
|
machines where the connection to gpg-agent has been redirected to
|
|
another machines. If dirmngr is required on the remote machine, it
|
|
may be started manually using <B>gpgconf --launch dirmngr</B>.
|
|
<P>
|
|
<DT id="39"><B>--no-secmem-warning</B>
|
|
|
|
<DD>
|
|
Do not print a warning when the so called "secure memory" cannot be used.
|
|
<P>
|
|
<DT id="40"><B>--log-file </B><I>file</I>
|
|
|
|
<DD>
|
|
When running in server mode, append all logging output to <I>file</I>.
|
|
Use '<I>socket://</I>' to log to socket.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAK"> </A>
|
|
<H3>Certificate related options</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="41"><B>--enable-policy-checks</B>
|
|
|
|
<DD>
|
|
|
|
<B>--disable-policy-checks</B>
|
|
|
|
By default policy checks are enabled. These options may be used to
|
|
change it.
|
|
<P>
|
|
<DT id="42"><B>--enable-crl-checks</B>
|
|
|
|
<DD>
|
|
|
|
<B>--disable-crl-checks</B>
|
|
|
|
By default the CRL checks are enabled and the DirMngr is used
|
|
to check for revoked certificates. The disable option is most useful
|
|
with an off-line network connection to suppress this check.
|
|
<P>
|
|
<DT id="43"><B>--enable-trusted-cert-crl-check</B>
|
|
|
|
<DD>
|
|
|
|
<B>--disable-trusted-cert-crl-check</B>
|
|
|
|
By default the CRL for trusted root certificates are checked
|
|
like for any other certificates. This allows a CA to revoke its own
|
|
certificates voluntary without the need of putting all ever issued
|
|
certificates into a CRL. The disable option may be used to switch this
|
|
extra check off. Due to the caching done by the Dirmngr, there will not be
|
|
any noticeable performance gain. Note, that this also disables possible
|
|
OCSP checks for trusted root certificates. A more specific way of
|
|
disabling this check is by adding the ``relax'' keyword to the root CA
|
|
line of the '<I>trustlist.txt</I>'
|
|
<P>
|
|
<P>
|
|
<DT id="44"><B>--force-crl-refresh</B>
|
|
|
|
<DD>
|
|
Tell the dirmngr to reload the CRL for each request. For better
|
|
performance, the dirmngr will actually optimize this by suppressing
|
|
the loading for short time intervals (e.g. 30 minutes). This option
|
|
is useful to make sure that a fresh CRL is available for certificates
|
|
hold in the keybox. The suggested way of doing this is by using it
|
|
along with the option <B>--with-validation</B> for a key listing
|
|
command. This option should not be used in a configuration file.
|
|
<P>
|
|
<DT id="45"><B>--enable-ocsp</B>
|
|
|
|
<DD>
|
|
|
|
<B>--disable-ocsp</B>
|
|
|
|
By default OCSP checks are disabled. The enable option may
|
|
be used to enable OCSP checks via Dirmngr. If CRL checks
|
|
are also enabled, CRLs will be used as a fallback if for some reason an
|
|
OCSP request will not succeed. Note, that you have to allow OCSP
|
|
requests in Dirmngr's configuration too (option
|
|
<B>--allow-ocsp</B>) and configure Dirmngr properly. If you do not do
|
|
so you will get the error code 'Not supported'.
|
|
<P>
|
|
<DT id="46"><B>--auto-issuer-key-retrieve</B>
|
|
|
|
<DD>
|
|
If a required certificate is missing while validating the chain of
|
|
certificates, try to load that certificate from an external location.
|
|
This usually means that Dirmngr is employed to search for the
|
|
certificate. Note that this option makes a "web bug" like behavior
|
|
possible. LDAP server operators can see which keys you request, so by
|
|
sending you a message signed by a brand new key (which you naturally
|
|
will not have on your local keybox), the operator can tell both your IP
|
|
address and the time when you verified the signature.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<DT id="47"><B>--validation-model </B><I>name</I>
|
|
|
|
<DD>
|
|
This option changes the default validation model. The only possible
|
|
values are "shell" (which is the default), "chain" which forces the
|
|
use of the chain model and "steed" for a new simplified model. The
|
|
chain model is also used if an option in the '<I>trustlist.txt</I>' or
|
|
an attribute of the certificate requests it. However the standard
|
|
model (shell) is in that case always tried first.
|
|
<P>
|
|
<DT id="48"><B>--ignore-cert-extension </B><I>oid</I>
|
|
|
|
<DD>
|
|
Add <I>oid</I> to the list of ignored certificate extensions. The
|
|
<I>oid</I> is expected to be in dotted decimal form, like
|
|
<B>2.5.29.3</B>. This option may be used more than once. Critical
|
|
flagged certificate extensions matching one of the OIDs in the list
|
|
are treated as if they are actually handled and thus the certificate
|
|
will not be rejected due to an unknown critical extension. Use this
|
|
option with care because extensions are usually flagged as critical
|
|
for a reason.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAL"> </A>
|
|
<H3>Input and Output</H3>
|
|
|
|
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="49"><B>--armor</B>
|
|
|
|
<DD>
|
|
|
|
<B>-a</B>
|
|
|
|
Create PEM encoded output. Default is binary output.
|
|
<P>
|
|
<DT id="50"><B>--base64</B>
|
|
|
|
<DD>
|
|
Create Base-64 encoded output; i.e. PEM without the header lines.
|
|
<P>
|
|
<DT id="51"><B>--assume-armor</B>
|
|
|
|
<DD>
|
|
Assume the input data is PEM encoded. Default is to autodetect the
|
|
encoding but this is may fail.
|
|
<P>
|
|
<DT id="52"><B>--assume-base64</B>
|
|
|
|
<DD>
|
|
Assume the input data is plain base-64 encoded.
|
|
<P>
|
|
<DT id="53"><B>--assume-binary</B>
|
|
|
|
<DD>
|
|
Assume the input data is binary encoded.
|
|
<P>
|
|
<P>
|
|
<DT id="54"><B>--p12-charset </B><I>name</I>
|
|
|
|
<DD>
|
|
<B>gpgsm</B> uses the UTF-8 encoding when encoding passphrases for
|
|
PKCS#12 files. This option may be used to force the passphrase to be
|
|
encoded in the specified encoding <I>name</I>. This is useful if the
|
|
application used to import the key uses a different encoding and thus
|
|
will not be able to import a file generated by <B>gpgsm</B>. Commonly
|
|
used values for <I>name</I> are <B>Latin1</B> and <B>CP850</B>. Note
|
|
that <B>gpgsm</B> itself automagically imports any file with a
|
|
passphrase encoded to the most commonly used encodings.
|
|
<P>
|
|
<P>
|
|
<DT id="55"><B>--default-key </B><I>user_id</I>
|
|
|
|
<DD>
|
|
Use <I>user_id</I> as the standard key for signing. This key is used if
|
|
no other key has been defined as a signing key. Note, that the first
|
|
<B>--local-users</B> option also sets this key if it has not yet been
|
|
set; however <B>--default-key</B> always overrides this.
|
|
<P>
|
|
<P>
|
|
<DT id="56"><B>--local-user </B><I>user_id</I>
|
|
|
|
<DD>
|
|
<DT id="57"><B>-u </B><I>user_id</I>
|
|
|
|
<DD>
|
|
Set the user(s) to be used for signing. The default is the first
|
|
secret key found in the database.
|
|
<P>
|
|
<P>
|
|
<DT id="58"><B>--recipient </B><I>name</I>
|
|
|
|
<DD>
|
|
|
|
<B>-r</B>
|
|
|
|
Encrypt to the user id <I>name</I>. There are several ways a user id
|
|
may be given (see: [how-to-specify-a-user-id]).
|
|
<P>
|
|
<P>
|
|
<DT id="59"><B>--output </B><I>file</I>
|
|
|
|
<DD>
|
|
|
|
<B>-o </B><I>file</I>
|
|
|
|
Write output to <I>file</I>. The default is to write it to stdout.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<DT id="60"><B>--with-key-data</B>
|
|
|
|
<DD>
|
|
Displays extra information with the <B>--list-keys</B> commands. Especially
|
|
a line tagged <B>grp</B> is printed which tells you the keygrip of a
|
|
key. This string is for example used as the file name of the
|
|
secret key. Implies <B>--with-colons</B>.
|
|
<P>
|
|
<P>
|
|
<DT id="61"><B>--with-validation</B>
|
|
|
|
<DD>
|
|
When doing a key listing, do a full validation check for each key and
|
|
print the result. This is usually a slow operation because it
|
|
requires a CRL lookup and other operations.
|
|
<P>
|
|
When used along with <B>--import</B>, a validation of the certificate to
|
|
import is done and only imported if it succeeds the test. Note that
|
|
this does not affect an already available certificate in the DB.
|
|
This option is therefore useful to simply verify a certificate.
|
|
<P>
|
|
<P>
|
|
<DT id="62"><B>--with-md5-fingerprint</B>
|
|
|
|
<DD>
|
|
For standard key listings, also print the MD5 fingerprint of the
|
|
certificate.
|
|
<P>
|
|
<DT id="63"><B>--with-keygrip</B>
|
|
|
|
<DD>
|
|
Include the keygrip in standard key listings. Note that the keygrip is
|
|
always listed in <B>--with-colons</B> mode.
|
|
<P>
|
|
<DT id="64"><B>--with-secret</B>
|
|
|
|
<DD>
|
|
Include info about the presence of a secret key in public key listings
|
|
done with <B>--with-colons</B>.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAM"> </A>
|
|
<H3>How to change how the CMS is created</H3>
|
|
|
|
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="65"><B>--include-certs </B><I>n</I>
|
|
|
|
<DD>
|
|
Using <I>n</I> of -2 includes all certificate except for the root cert,
|
|
-1 includes all certs, 0 does not include any certs, 1 includes only the
|
|
signers cert and all other positive values include up to <I>n</I>
|
|
certificates starting with the signer cert. The default is -2.
|
|
<P>
|
|
<DT id="66"><B>--cipher-algo </B><I>oid</I>
|
|
|
|
<DD>
|
|
Use the cipher algorithm with the ASN.1 object identifier <I>oid</I> for
|
|
encryption. For convenience the strings <B>3DES</B>, <B>AES</B> and
|
|
<B>AES256</B> may be used instead of their OIDs. The default is
|
|
<B>AES</B> (2.16.840.1.101.3.4.1.2).
|
|
<P>
|
|
<DT id="67"><B>--digest-algo name</B>
|
|
|
|
<DD>
|
|
Use <B>name</B> as the message digest algorithm. Usually this
|
|
algorithm is deduced from the respective signing certificate. This
|
|
option forces the use of the given algorithm and may lead to severe
|
|
interoperability problems.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAN"> </A>
|
|
<H3>Doing things one usually do not want to do</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="68"><B>--extra-digest-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Sometimes signatures are broken in that they announce a different digest
|
|
algorithm than actually used. <B>gpgsm</B> uses a one-pass data
|
|
processing model and thus needs to rely on the announced digest
|
|
algorithms to properly hash the data. As a workaround this option may
|
|
be used to tell <B>gpgsm</B> to also hash the data using the algorithm
|
|
<I>name</I>; this slows processing down a little bit but allows verification of
|
|
such broken signatures. If <B>gpgsm</B> prints an error like
|
|
``digest algo 8 has not been enabled'' you may want to try this option,
|
|
with 'SHA256' for <I>name</I>.
|
|
<P>
|
|
<P>
|
|
<DT id="69"><B>--faked-system-time </B><I>epoch</I>
|
|
|
|
<DD>
|
|
This option is only useful for testing; it sets the system time back or
|
|
forth to <I>epoch</I> which is the number of seconds elapsed since the year
|
|
1970. Alternatively <I>epoch</I> may be given as a full ISO time string
|
|
(e.g. "20070924T154812").
|
|
<P>
|
|
<DT id="70"><B>--with-ephemeral-keys</B>
|
|
|
|
<DD>
|
|
Include ephemeral flagged keys in the output of key listings. Note
|
|
that they are included anyway if the key specification for a listing
|
|
is given as fingerprint or keygrip.
|
|
<P>
|
|
<DT id="71"><B>--debug-level </B><I>level</I>
|
|
|
|
<DD>
|
|
Select the debug level for investigating problems. <I>level</I> may be
|
|
a numeric value or by a keyword:
|
|
<P>
|
|
<DL COMPACT><DT id="72"><DD>
|
|
<DL COMPACT>
|
|
<DT id="73"><B>none</B>
|
|
|
|
<DD>
|
|
No debugging at all. A value of less than 1 may be used instead of
|
|
the keyword.
|
|
<DT id="74"><B>basic</B>
|
|
|
|
<DD>
|
|
Some basic debug messages. A value between 1 and 2 may be used
|
|
instead of the keyword.
|
|
<DT id="75"><B>advanced</B>
|
|
|
|
<DD>
|
|
More verbose debug messages. A value between 3 and 5 may be used
|
|
instead of the keyword.
|
|
<DT id="76"><B>expert</B>
|
|
|
|
<DD>
|
|
Even more detailed messages. A value between 6 and 8 may be used
|
|
instead of the keyword.
|
|
<DT id="77"><B>guru</B>
|
|
|
|
<DD>
|
|
All of the debug messages you can get. A value greater than 8 may be
|
|
used instead of the keyword. The creation of hash tracing files is
|
|
only enabled if the keyword is used.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
How these messages are mapped to the actual debugging flags is not
|
|
specified and may change with newer releases of this program. They are
|
|
however carefully selected to best aid in debugging.
|
|
<P>
|
|
<DT id="78"><B>--debug </B><I>flags</I>
|
|
|
|
<DD>
|
|
This option is only useful for debugging and the behaviour may change
|
|
at any time without notice; using <B>--debug-levels</B> is the
|
|
preferred method to select the debug verbosity. FLAGS are bit encoded
|
|
and may be given in usual C-Syntax. The currently defined bits are:
|
|
<P>
|
|
<DL COMPACT><DT id="79"><DD>
|
|
<DL COMPACT>
|
|
<DT id="80"><B>0 (1)</B>
|
|
|
|
<DD>
|
|
X.509 or OpenPGP protocol related data
|
|
<DT id="81"><B>1 (2)</B>
|
|
|
|
<DD>
|
|
values of big number integers
|
|
<DT id="82"><B>2 (4)</B>
|
|
|
|
<DD>
|
|
low level crypto operations
|
|
<DT id="83"><B>5 (32)</B>
|
|
|
|
<DD>
|
|
memory allocation
|
|
<DT id="84"><B>6 (64)</B>
|
|
|
|
<DD>
|
|
caching
|
|
<DT id="85"><B>7 (128)</B>
|
|
|
|
<DD>
|
|
show memory statistics
|
|
<DT id="86"><B>9 (512)</B>
|
|
|
|
<DD>
|
|
write hashed data to files named <B>dbgmd-000*</B>
|
|
<DT id="87"><B>10 (1024)</B>
|
|
|
|
<DD>
|
|
trace Assuan protocol
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
Note, that all flags set using this option may get overridden by
|
|
<B>--debug-level</B>.
|
|
<P>
|
|
<DT id="88"><B>--debug-all</B>
|
|
|
|
<DD>
|
|
Same as <B>--debug=0xffffffff</B>
|
|
<P>
|
|
<DT id="89"><B>--debug-allow-core-dump</B>
|
|
|
|
<DD>
|
|
Usually <B>gpgsm</B> tries to avoid dumping core by well written code and by
|
|
disabling core dumps for security reasons. However, bugs are pretty
|
|
durable beasts and to squash them it is sometimes useful to have a core
|
|
dump. This option enables core dumps unless the Bad Thing happened
|
|
before the option parsing.
|
|
<P>
|
|
<DT id="90"><B>--debug-no-chain-validation</B>
|
|
|
|
<DD>
|
|
This is actually not a debugging option but only useful as such. It
|
|
lets <B>gpgsm</B> bypass all certificate chain validation checks.
|
|
<P>
|
|
<DT id="91"><B>--debug-ignore-expiration</B>
|
|
|
|
<DD>
|
|
This is actually not a debugging option but only useful as such. It
|
|
lets <B>gpgsm</B> ignore all notAfter dates, this is used by the regression
|
|
tests.
|
|
<P>
|
|
<DT id="92"><B>--passphrase-fd n</B>
|
|
|
|
<DD>
|
|
Read the passphrase from file descriptor <B>n</B>. Only the first line
|
|
will be read from file descriptor <B>n</B>. If you use 0 for <B>n</B>,
|
|
the passphrase will be read from STDIN. This can only be used if only
|
|
one passphrase is supplied.
|
|
<P>
|
|
Note that this passphrase is only used if the option <B>--batch</B>
|
|
has also been given.
|
|
<P>
|
|
<DT id="93"><B>--pinentry-mode mode</B>
|
|
|
|
<DD>
|
|
Set the pinentry mode to <B>mode</B>. Allowed values for <B>mode</B>
|
|
are:
|
|
<DL COMPACT><DT id="94"><DD>
|
|
<DL COMPACT>
|
|
<DT id="95"><B>default</B>
|
|
|
|
<DD>
|
|
Use the default of the agent, which is <B>ask</B>.
|
|
<DT id="96"><B>ask</B>
|
|
|
|
<DD>
|
|
Force the use of the Pinentry.
|
|
<DT id="97"><B>cancel</B>
|
|
|
|
<DD>
|
|
Emulate use of Pinentry's cancel button.
|
|
<DT id="98"><B>error</B>
|
|
|
|
<DD>
|
|
Return a Pinentry error (``No Pinentry'').
|
|
<DT id="99"><B>loopback</B>
|
|
|
|
<DD>
|
|
Redirect Pinentry queries to the caller. Note that in contrast to
|
|
Pinentry the user is not prompted again if he enters a bad password.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="100"><B>--request-origin </B><I>origin</I>
|
|
|
|
<DD>
|
|
Tell gpgsm to assume that the operation ultimately originated at
|
|
<I>origin</I>. Depending on the origin certain restrictions are applied
|
|
and the Pinentry may include an extra note on the origin. Supported
|
|
values for <I>origin</I> are: <B>local</B> which is the default,
|
|
<B>remote</B> to indicate a remote origin or <B>browser</B> for an
|
|
operation requested by a web browser.
|
|
<P>
|
|
<DT id="101"><B>--no-common-certs-import</B>
|
|
|
|
<DD>
|
|
Suppress the import of common certificates on keybox creation.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
All the long options may also be given in the configuration file after
|
|
stripping off the two leading dashes.
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAO"> </A>
|
|
<H2>HOW TO SPECIFY A USER ID</H2>
|
|
|
|
<P>
|
|
There are different ways to specify a user ID to GnuPG. Some of them
|
|
are only valid for <B>gpg</B> others are only good for
|
|
<B>gpgsm</B>. Here is the entire list of ways to specify a key:
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="102"><B>By key Id.</B>
|
|
|
|
<DD>
|
|
This format is deduced from the length of the string and its content or
|
|
<B>0x</B> prefix. The key Id of an X.509 certificate are the low 64 bits
|
|
of its SHA-1 fingerprint. The use of key Ids is just a shortcut, for
|
|
all automated processing the fingerprint should be used.
|
|
<P>
|
|
When using <B>gpg</B> an exclamation mark (!) may be appended to
|
|
force using the specified primary or secondary key and not to try and
|
|
calculate which primary or secondary key to use.
|
|
<P>
|
|
The last four lines of the example give the key ID in their long form as
|
|
internally used by the OpenPGP protocol. You can see the long key ID
|
|
using the option <B>--with-colons</B>.
|
|
<P>
|
|
<DL COMPACT><DT id="103"><DD>
|
|
<PRE>
|
|
234567C4
|
|
0F34E556E
|
|
01347A56A
|
|
0xAB123456
|
|
|
|
234AABBCC34567C4
|
|
0F323456784E56EAB
|
|
01AB3FED1347A5612
|
|
0x234AABBCC34567C4
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<DT id="104"><B>By fingerprint.</B>
|
|
|
|
<DD>
|
|
This format is deduced from the length of the string and its content or
|
|
the <B>0x</B> prefix. Note, that only the 20 byte version fingerprint
|
|
is available with <B>gpgsm</B> (i.e. the SHA-1 hash of the
|
|
certificate).
|
|
<P>
|
|
When using <B>gpg</B> an exclamation mark (!) may be appended to
|
|
force using the specified primary or secondary key and not to try and
|
|
calculate which primary or secondary key to use.
|
|
<P>
|
|
The best way to specify a key Id is by using the fingerprint. This
|
|
avoids any ambiguities in case that there are duplicated key IDs.
|
|
<P>
|
|
<DL COMPACT><DT id="105"><DD>
|
|
<PRE>
|
|
1234343434343434C434343434343434
|
|
123434343434343C3434343434343734349A3434
|
|
0E12343434343434343434EAB3484343434343434
|
|
0xE12343434343434343434EAB3484343434343434
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<B>gpgsm</B> also accepts colons between each pair of hexadecimal
|
|
digits because this is the de-facto standard on how to present X.509
|
|
fingerprints. <B>gpg</B> also allows the use of the space
|
|
separated SHA-1 fingerprint as printed by the key listing commands.
|
|
<P>
|
|
<DT id="106"><B>By exact match on OpenPGP user ID.</B>
|
|
|
|
<DD>
|
|
This is denoted by a leading equal sign. It does not make sense for
|
|
X.509 certificates.
|
|
<P>
|
|
<DL COMPACT><DT id="107"><DD>
|
|
<PRE>
|
|
=Heinrich Heine <<A HREF="mailto:heinrichh@uni-duesseldorf.de">heinrichh@uni-duesseldorf.de</A>>
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="108"><B>By exact match on an email address.</B>
|
|
|
|
<DD>
|
|
This is indicated by enclosing the email address in the usual way
|
|
with left and right angles.
|
|
<P>
|
|
<DL COMPACT><DT id="109"><DD>
|
|
<PRE>
|
|
<<A HREF="mailto:heinrichh@uni-duesseldorf.de">heinrichh@uni-duesseldorf.de</A>>
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="110"><B>By partial match on an email address.</B>
|
|
|
|
<DD>
|
|
This is indicated by prefixing the search string with an <B>@</B>.
|
|
This uses a substring search but considers only the mail address
|
|
(i.e. inside the angle brackets).
|
|
<P>
|
|
<DL COMPACT><DT id="111"><DD>
|
|
<PRE>
|
|
@heinrichh
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="112"><B>By exact match on the subject's DN.</B>
|
|
|
|
<DD>
|
|
This is indicated by a leading slash, directly followed by the RFC-2253
|
|
encoded DN of the subject. Note that you can't use the string printed
|
|
by <B>gpgsm --list-keys</B> because that one has been reordered and modified
|
|
for better readability; use <B>--with-colons</B> to print the raw
|
|
(but standard escaped) RFC-2253 string.
|
|
<P>
|
|
<DL COMPACT><DT id="113"><DD>
|
|
<PRE>
|
|
/CN=Heinrich Heine,O=Poets,L=Paris,C=FR
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="114"><B>By exact match on the issuer's DN.</B>
|
|
|
|
<DD>
|
|
This is indicated by a leading hash mark, directly followed by a slash
|
|
and then directly followed by the RFC-2253 encoded DN of the issuer.
|
|
This should return the Root cert of the issuer. See note above.
|
|
<P>
|
|
<DL COMPACT><DT id="115"><DD>
|
|
<PRE>
|
|
#/CN=Root Cert,O=Poets,L=Paris,C=FR
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="116"><B>By exact match on serial number and issuer's DN.</B>
|
|
|
|
<DD>
|
|
This is indicated by a hash mark, followed by the hexadecimal
|
|
representation of the serial number, then followed by a slash and the
|
|
RFC-2253 encoded DN of the issuer. See note above.
|
|
<P>
|
|
<DL COMPACT><DT id="117"><DD>
|
|
<PRE>
|
|
#4F03/CN=Root Cert,O=Poets,L=Paris,C=FR
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="118"><B>By keygrip.</B>
|
|
|
|
<DD>
|
|
This is indicated by an ampersand followed by the 40 hex digits of a
|
|
keygrip. <B>gpgsm</B> prints the keygrip when using the command
|
|
<B>--dump-cert</B>.
|
|
<P>
|
|
<DL COMPACT><DT id="119"><DD>
|
|
<PRE>
|
|
&D75F22C3F86E355877348498CDC92BD21010A480
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="120"><B>By substring match.</B>
|
|
|
|
<DD>
|
|
This is the default mode but applications may want to explicitly
|
|
indicate this by putting the asterisk in front. Match is not case
|
|
sensitive.
|
|
<P>
|
|
<DL COMPACT><DT id="121"><DD>
|
|
<PRE>
|
|
Heine
|
|
*Heine
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="122"><B>. and + prefixes</B>
|
|
|
|
<DD>
|
|
These prefixes are reserved for looking up mails anchored at the end
|
|
and for a word search mode. They are not yet implemented and using
|
|
them is undefined.
|
|
<P>
|
|
<P>
|
|
Please note that we have reused the hash mark identifier which was used
|
|
in old GnuPG versions to indicate the so called local-id. It is not
|
|
anymore used and there should be no conflict when used with X.509 stuff.
|
|
<P>
|
|
Using the RFC-2253 format of DNs has the drawback that it is not
|
|
possible to map them back to the original encoding, however we don't
|
|
have to do this because our key database stores this encoding as meta
|
|
data.
|
|
<P>
|
|
<P>
|
|
</DL>
|
|
<A NAME="lbAP"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="123"><DD>
|
|
<PRE>
|
|
$ gpgsm -er <A HREF="mailto:goo@bar.net">goo@bar.net</A> <plaintext >ciphertext
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAQ"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<P>
|
|
There are a few configuration files to control certain aspects of
|
|
<B>gpgsm</B>'s operation. Unless noted, they are expected in the
|
|
current home directory (see: [option --homedir]).
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="124"><B>gpgsm.conf</B>
|
|
|
|
<DD>
|
|
This is the standard configuration file read by <B>gpgsm</B> on
|
|
startup. It may contain any valid long option; the leading two dashes
|
|
may not be entered and the option may not be abbreviated. This default
|
|
name may be changed on the command line (see: [gpgsm-option --options]).
|
|
You should backup this file.
|
|
<P>
|
|
<P>
|
|
<DT id="125"><B>policies.txt</B>
|
|
|
|
<DD>
|
|
This is a list of allowed CA policies. This file should list the
|
|
object identifiers of the policies line by line. Empty lines and
|
|
lines starting with a hash mark are ignored. Policies missing in this
|
|
file and not marked as critical in the certificate will print only a
|
|
warning; certificates with policies marked as critical and not listed
|
|
in this file will fail the signature verification. You should backup
|
|
this file.
|
|
<P>
|
|
For example, to allow only the policy 2.289.9.9, the file should look
|
|
like this:
|
|
<P>
|
|
<DL COMPACT><DT id="126"><DD>
|
|
<DL COMPACT><DT id="127"><DD>
|
|
<PRE>
|
|
# Allowed policies
|
|
2.289.9.9
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="128"><B>qualified.txt</B>
|
|
|
|
<DD>
|
|
This is the list of root certificates used for qualified certificates.
|
|
They are defined as certificates capable of creating legally binding
|
|
signatures in the same way as handwritten signatures are. Comments
|
|
start with a hash mark and empty lines are ignored. Lines do have a
|
|
length limit but this is not a serious limitation as the format of the
|
|
entries is fixed and checked by <B>gpgsm</B>: A non-comment line starts with
|
|
optional whitespace, followed by exactly 40 hex characters, white space
|
|
and a lowercased 2 letter country code. Additional data delimited with
|
|
by a white space is current ignored but might late be used for other
|
|
purposes.
|
|
<P>
|
|
Note that even if a certificate is listed in this file, this does not
|
|
mean that the certificate is trusted; in general the certificates listed
|
|
in this file need to be listed also in '<I>trustlist.txt</I>'.
|
|
<P>
|
|
This is a global file an installed in the data directory
|
|
(e.g. '<I>/usr/share/gnupg/qualified.txt</I>'). GnuPG installs a suitable
|
|
file with root certificates as used in Germany. As new Root-CA
|
|
certificates may be issued over time, these entries may need to be
|
|
updated; new distributions of this software should come with an updated
|
|
list but it is still the responsibility of the Administrator to check
|
|
that this list is correct.
|
|
<P>
|
|
Every time <B>gpgsm</B> uses a certificate for signing or verification
|
|
this file will be consulted to check whether the certificate under
|
|
question has ultimately been issued by one of these CAs. If this is the
|
|
case the user will be informed that the verified signature represents a
|
|
legally binding (``qualified'') signature. When creating a signature
|
|
using such a certificate an extra prompt will be issued to let the user
|
|
confirm that such a legally binding signature shall really be created.
|
|
<P>
|
|
Because this software has not yet been approved for use with such
|
|
certificates, appropriate notices will be shown to indicate this fact.
|
|
<P>
|
|
<DT id="129"><B>help.txt</B>
|
|
|
|
<DD>
|
|
This is plain text file with a few help entries used with
|
|
<B>pinentry</B> as well as a large list of help items for
|
|
<B>gpg</B> and <B>gpgsm</B>. The standard file has English help
|
|
texts; to install localized versions use filenames like '<I>help.LL.txt</I>'
|
|
with LL denoting the locale. GnuPG comes with a set of predefined help
|
|
files in the data directory (e.g. '<I>/usr/share/gnupg/gnupg/help.de.txt</I>')
|
|
and allows overriding of any help item by help files stored in the
|
|
system configuration directory (e.g. '<I>/etc/gnupg/help.de.txt</I>').
|
|
For a reference of the help file's syntax, please see the installed
|
|
'<I>help.txt</I>' file.
|
|
<P>
|
|
<P>
|
|
<DT id="130"><B>com-certs.pem</B>
|
|
|
|
<DD>
|
|
This file is a collection of common certificates used to populated a
|
|
newly created '<I>pubring.kbx</I>'. An administrator may replace this
|
|
file with a custom one. The format is a concatenation of PEM encoded
|
|
X.509 certificates. This global file is installed in the data directory
|
|
(e.g. '<I>/usr/share/gnupg/com-certs.pem</I>').
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
Note that on larger installations, it is useful to put predefined files
|
|
into the directory '<I>/etc/skel/.gnupg/</I>' so that newly created users
|
|
start up with a working configuration. For existing users a small
|
|
helper script is provided to create these files (see: [addgnupghome]).
|
|
<P>
|
|
For internal purposes <B>gpgsm</B> creates and maintains a few other files;
|
|
they all live in the current home directory (see: [option
|
|
--homedir]). Only <B>gpgsm</B> may modify these files.
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="131"><B>pubring.kbx</B>
|
|
|
|
<DD>
|
|
This a database file storing the certificates as well as meta
|
|
information. For debugging purposes the tool <B>kbxutil</B> may be
|
|
used to show the internal structure of this file. You should backup
|
|
this file.
|
|
<P>
|
|
<DT id="132"><B>random_seed</B>
|
|
|
|
<DD>
|
|
This content of this file is used to maintain the internal state of the
|
|
random number generator across invocations. The same file is used by
|
|
other programs of this software too.
|
|
<P>
|
|
<DT id="133"><B>S.gpg-agent</B>
|
|
|
|
<DD>
|
|
If this file exists
|
|
<B>gpgsm</B> will first try to connect to this socket for
|
|
accessing <B>gpg-agent</B> before starting a new <B>gpg-agent</B>
|
|
instance. Under Windows this socket (which in reality be a plain file
|
|
describing a regular TCP listening port) is the standard way of
|
|
connecting the <B>gpg-agent</B>.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAR"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gpg2">gpg2</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gpg-agent">gpg-agent</A></B>(1)
|
|
<P>
|
|
The full documentation for this tool is maintained as a Texinfo manual.
|
|
If GnuPG and the info program are properly installed at your site, the
|
|
command
|
|
<P>
|
|
<DL COMPACT><DT id="134"><DD>
|
|
<PRE>
|
|
info gnupg
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
should give you access to the complete manual including a menu structure
|
|
and an index.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="135"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="136"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="137"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="138"><A HREF="#lbAE">COMMANDS</A><DD>
|
|
<DL>
|
|
<DT id="139"><A HREF="#lbAF">Commands not specific to the function</A><DD>
|
|
<DT id="140"><A HREF="#lbAG">Commands to select the type of operation</A><DD>
|
|
<DT id="141"><A HREF="#lbAH">How to manage the certificates and keys</A><DD>
|
|
</DL>
|
|
<DT id="142"><A HREF="#lbAI">OPTIONS</A><DD>
|
|
<DL>
|
|
<DT id="143"><A HREF="#lbAJ">How to change the configuration</A><DD>
|
|
<DT id="144"><A HREF="#lbAK">Certificate related options</A><DD>
|
|
<DT id="145"><A HREF="#lbAL">Input and Output</A><DD>
|
|
<DT id="146"><A HREF="#lbAM">How to change how the CMS is created</A><DD>
|
|
<DT id="147"><A HREF="#lbAN">Doing things one usually do not want to do</A><DD>
|
|
</DL>
|
|
<DT id="148"><A HREF="#lbAO">HOW TO SPECIFY A USER ID</A><DD>
|
|
<DT id="149"><A HREF="#lbAP">EXAMPLES</A><DD>
|
|
<DT id="150"><A HREF="#lbAQ">FILES</A><DD>
|
|
<DT id="151"><A HREF="#lbAR">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:15 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|