1188 lines
36 KiB
HTML
1188 lines
36 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of X509</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>X509</H1>
|
|
Section: OpenSSL (1SSL)<BR>Updated: 2021-03-22<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
openssl-x509, x509 - Certificate display and signing utility
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
|
|
|
|
<B>openssl</B> <B>x509</B>
|
|
[<B>-help</B>]
|
|
[<B>-inform DER|PEM</B>]
|
|
[<B>-outform DER|PEM</B>]
|
|
[<B>-keyform DER|PEM|ENGINE</B>]
|
|
[<B>-CAform DER|PEM</B>]
|
|
[<B>-CAkeyform DER|PEM</B>]
|
|
[<B>-in filename</B>]
|
|
[<B>-out filename</B>]
|
|
[<B>-serial</B>]
|
|
[<B>-hash</B>]
|
|
[<B>-subject_hash</B>]
|
|
[<B>-issuer_hash</B>]
|
|
[<B>-ocspid</B>]
|
|
[<B>-subject</B>]
|
|
[<B>-issuer</B>]
|
|
[<B>-nameopt option</B>]
|
|
[<B>-email</B>]
|
|
[<B>-ocsp_uri</B>]
|
|
[<B>-startdate</B>]
|
|
[<B>-enddate</B>]
|
|
[<B>-purpose</B>]
|
|
[<B>-dates</B>]
|
|
[<B>-checkend num</B>]
|
|
[<B>-modulus</B>]
|
|
[<B>-pubkey</B>]
|
|
[<B>-fingerprint</B>]
|
|
[<B>-alias</B>]
|
|
[<B>-noout</B>]
|
|
[<B>-trustout</B>]
|
|
[<B>-clrtrust</B>]
|
|
[<B>-clrreject</B>]
|
|
[<B>-addtrust arg</B>]
|
|
[<B>-addreject arg</B>]
|
|
[<B>-setalias arg</B>]
|
|
[<B>-days arg</B>]
|
|
[<B>-set_serial n</B>]
|
|
[<B>-signkey arg</B>]
|
|
[<B>-passin arg</B>]
|
|
[<B>-x509toreq</B>]
|
|
[<B>-req</B>]
|
|
[<B>-CA filename</B>]
|
|
[<B>-CAkey filename</B>]
|
|
[<B>-CAcreateserial</B>]
|
|
[<B>-CAserial filename</B>]
|
|
[<B>-force_pubkey key</B>]
|
|
[<B>-text</B>]
|
|
[<B>-ext extensions</B>]
|
|
[<B>-certopt option</B>]
|
|
[<B>-C</B>]
|
|
[<B>-</B>digest<B></B>]
|
|
[<B>-clrext</B>]
|
|
[<B>-extfile filename</B>]
|
|
[<B>-extensions section</B>]
|
|
[<B>-sigopt nm:v</B>]
|
|
[<B>-rand file...</B>]
|
|
[<B>-writerand file</B>]
|
|
[<B>-engine id</B>]
|
|
[<B>-preserve_dates</B>]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
|
|
|
|
The <B>x509</B> command is a multi purpose certificate utility. It can be
|
|
used to display certificate information, convert certificates to
|
|
various forms, sign certificate requests like a ``mini <FONT SIZE="-1">CA''</FONT> or edit
|
|
certificate trust settings.
|
|
<P>
|
|
|
|
Since there are a large number of options they will split up into
|
|
various sections.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
|
|
|
|
<A NAME="lbAF"> </A>
|
|
<H3>Input, Output, and General Purpose Options</H3>
|
|
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-help</B><DD>
|
|
|
|
|
|
Print out a usage message.
|
|
<DT id="2"><B>-inform DER|PEM</B><DD>
|
|
|
|
|
|
This specifies the input format normally the command will expect an X509
|
|
certificate but this can change if other options such as <B>-req</B> are
|
|
present. The <FONT SIZE="-1">DER</FONT> format is the <FONT SIZE="-1">DER</FONT> encoding of the certificate and <FONT SIZE="-1">PEM</FONT>
|
|
is the base64 encoding of the <FONT SIZE="-1">DER</FONT> encoding with header and footer lines
|
|
added. The default format is <FONT SIZE="-1">PEM.</FONT>
|
|
<DT id="3"><B>-outform DER|PEM</B><DD>
|
|
|
|
|
|
This specifies the output format, the options have the same meaning and default
|
|
as the <B>-inform</B> option.
|
|
<DT id="4"><B>-in filename</B><DD>
|
|
|
|
|
|
This specifies the input filename to read a certificate from or standard input
|
|
if this option is not specified.
|
|
<DT id="5"><B>-out filename</B><DD>
|
|
|
|
|
|
This specifies the output filename to write to or standard output by
|
|
default.
|
|
<DT id="6"><B>-</B>digest<B></B><DD>
|
|
|
|
|
|
The digest to use.
|
|
This affects any signing or display option that uses a message
|
|
digest, such as the <B>-fingerprint</B>, <B>-signkey</B> and <B>-CA</B> options.
|
|
Any digest supported by the OpenSSL <B>dgst</B> command can be used.
|
|
If not specified then <FONT SIZE="-1">SHA1</FONT> is used with <B>-fingerprint</B> or
|
|
the default digest for the signing algorithm is used, typically <FONT SIZE="-1">SHA256.</FONT>
|
|
<DT id="7"><B>-rand file...</B><DD>
|
|
|
|
|
|
A file or files containing random data used to seed the random number
|
|
generator.
|
|
Multiple files can be specified separated by an OS-dependent character.
|
|
The separator is <B>;</B> for MS-Windows, <B>,</B> for OpenVMS, and <B>:</B> for
|
|
all others.
|
|
<DT id="8">[<B>-writerand file</B>]<DD>
|
|
|
|
|
|
Writes random data to the specified <I>file</I> upon exit.
|
|
This can be used with a subsequent <B>-rand</B> flag.
|
|
<DT id="9"><B>-engine id</B><DD>
|
|
|
|
|
|
Specifying an engine (by its unique <B>id</B> string) will cause <B>x509</B>
|
|
to attempt to obtain a functional reference to the specified engine,
|
|
thus initialising it if needed. The engine will then be set as the default
|
|
for all available algorithms.
|
|
<DT id="10"><B>-preserve_dates</B><DD>
|
|
|
|
|
|
When signing a certificate, preserve the ``notBefore'' and ``notAfter'' dates instead
|
|
of adjusting them to current time and duration. Cannot be used with the <B>-days</B> option.
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H3>Display Options</H3>
|
|
|
|
|
|
|
|
Note: the <B>-alias</B> and <B>-purpose</B> options are also display options
|
|
but are described in the <B></B><FONT SIZE="-1"><B>TRUST SETTINGS</B></FONT><B></B> section.
|
|
<DL COMPACT>
|
|
<DT id="11"><B>-text</B><DD>
|
|
|
|
|
|
Prints out the certificate in text form. Full details are output including the
|
|
public key, signature algorithms, issuer and subject names, serial number
|
|
any extensions present and any trust settings.
|
|
<DT id="12"><B>-ext extensions</B><DD>
|
|
|
|
|
|
Prints out the certificate extensions in text form. Extensions are specified
|
|
with a comma separated string, e.g., ``subjectAltName,subjectKeyIdentifier''.
|
|
See the <B><A HREF="/cgi-bin/man/man2html?5+x509v3_config">x509v3_config</A></B>(5) manual page for the extension names.
|
|
<DT id="13"><B>-certopt option</B><DD>
|
|
|
|
|
|
Customise the output format used with <B>-text</B>. The <B>option</B> argument
|
|
can be a single option or multiple options separated by commas. The
|
|
<B>-certopt</B> switch may be also be used more than once to set multiple
|
|
options. See the <B></B><FONT SIZE="-1"><B>TEXT OPTIONS</B></FONT><B></B> section for more information.
|
|
<DT id="14"><B>-noout</B><DD>
|
|
|
|
|
|
This option prevents output of the encoded version of the certificate.
|
|
<DT id="15"><B>-pubkey</B><DD>
|
|
|
|
|
|
Outputs the certificate's SubjectPublicKeyInfo block in <FONT SIZE="-1">PEM</FONT> format.
|
|
<DT id="16"><B>-modulus</B><DD>
|
|
|
|
|
|
This option prints out the value of the modulus of the public key
|
|
contained in the certificate.
|
|
<DT id="17"><B>-serial</B><DD>
|
|
|
|
|
|
Outputs the certificate serial number.
|
|
<DT id="18"><B>-subject_hash</B><DD>
|
|
|
|
|
|
Outputs the ``hash'' of the certificate subject name. This is used in OpenSSL to
|
|
form an index to allow certificates in a directory to be looked up by subject
|
|
name.
|
|
<DT id="19"><B>-issuer_hash</B><DD>
|
|
|
|
|
|
Outputs the ``hash'' of the certificate issuer name.
|
|
<DT id="20"><B>-ocspid</B><DD>
|
|
|
|
|
|
Outputs the <FONT SIZE="-1">OCSP</FONT> hash values for the subject name and public key.
|
|
<DT id="21"><B>-hash</B><DD>
|
|
|
|
|
|
Synonym for ``-subject_hash'' for backward compatibility reasons.
|
|
<DT id="22"><B>-subject_hash_old</B><DD>
|
|
|
|
|
|
Outputs the ``hash'' of the certificate subject name using the older algorithm
|
|
as used by OpenSSL before version 1.0.0.
|
|
<DT id="23"><B>-issuer_hash_old</B><DD>
|
|
|
|
|
|
Outputs the ``hash'' of the certificate issuer name using the older algorithm
|
|
as used by OpenSSL before version 1.0.0.
|
|
<DT id="24"><B>-subject</B><DD>
|
|
|
|
|
|
Outputs the subject name.
|
|
<DT id="25"><B>-issuer</B><DD>
|
|
|
|
|
|
Outputs the issuer name.
|
|
<DT id="26"><B>-nameopt option</B><DD>
|
|
|
|
|
|
Option which determines how the subject or issuer names are displayed. The
|
|
<B>option</B> argument can be a single option or multiple options separated by
|
|
commas. Alternatively the <B>-nameopt</B> switch may be used more than once to
|
|
set multiple options. See the <B></B><FONT SIZE="-1"><B>NAME OPTIONS</B></FONT><B></B> section for more information.
|
|
<DT id="27"><B>-email</B><DD>
|
|
|
|
|
|
Outputs the email address(es) if any.
|
|
<DT id="28"><B>-ocsp_uri</B><DD>
|
|
|
|
|
|
Outputs the <FONT SIZE="-1">OCSP</FONT> responder address(es) if any.
|
|
<DT id="29"><B>-startdate</B><DD>
|
|
|
|
|
|
Prints out the start date of the certificate, that is the notBefore date.
|
|
<DT id="30"><B>-enddate</B><DD>
|
|
|
|
|
|
Prints out the expiry date of the certificate, that is the notAfter date.
|
|
<DT id="31"><B>-dates</B><DD>
|
|
|
|
|
|
Prints out the start and expiry dates of a certificate.
|
|
<DT id="32"><B>-checkend arg</B><DD>
|
|
|
|
|
|
Checks if the certificate expires within the next <B>arg</B> seconds and exits
|
|
non-zero if yes it will expire or zero if not.
|
|
<DT id="33"><B>-fingerprint</B><DD>
|
|
|
|
|
|
Calculates and outputs the digest of the <FONT SIZE="-1">DER</FONT> encoded version of the entire
|
|
certificate (see digest options).
|
|
This is commonly called a ``fingerprint''. Because of the nature of message
|
|
digests, the fingerprint of a certificate is unique to that certificate and
|
|
two certificates with the same fingerprint can be considered to be the same.
|
|
<DT id="34"><B>-C</B><DD>
|
|
|
|
|
|
This outputs the certificate in the form of a C source file.
|
|
</DL>
|
|
<A NAME="lbAH"> </A>
|
|
<H3>Trust Settings</H3>
|
|
|
|
|
|
|
|
A <B>trusted certificate</B> is an ordinary certificate which has several
|
|
additional pieces of information attached to it such as the permitted
|
|
and prohibited uses of the certificate and an ``alias''.
|
|
<P>
|
|
|
|
Normally when a certificate is being verified at least one certificate
|
|
must be ``trusted''. By default a trusted certificate must be stored
|
|
locally and must be a root <FONT SIZE="-1">CA:</FONT> any certificate chain ending in this <FONT SIZE="-1">CA</FONT>
|
|
is then usable for any purpose.
|
|
<P>
|
|
|
|
Trust settings currently are only used with a root <FONT SIZE="-1">CA.</FONT> They allow a finer
|
|
control over the purposes the root <FONT SIZE="-1">CA</FONT> can be used for. For example a <FONT SIZE="-1">CA</FONT>
|
|
may be trusted for <FONT SIZE="-1">SSL</FONT> client but not <FONT SIZE="-1">SSL</FONT> server use.
|
|
<P>
|
|
|
|
See the description of the <B>verify</B> utility for more information on the
|
|
meaning of trust settings.
|
|
<P>
|
|
|
|
Future versions of OpenSSL will recognize trust settings on any
|
|
certificate: not just root CAs.
|
|
<DL COMPACT>
|
|
<DT id="35"><B>-trustout</B><DD>
|
|
|
|
|
|
This causes <B>x509</B> to output a <B>trusted</B> certificate. An ordinary
|
|
or trusted certificate can be input but by default an ordinary
|
|
certificate is output and any trust settings are discarded. With the
|
|
<B>-trustout</B> option a trusted certificate is output. A trusted
|
|
certificate is automatically output if any trust settings are modified.
|
|
<DT id="36"><B>-setalias arg</B><DD>
|
|
|
|
|
|
Sets the alias of the certificate. This will allow the certificate
|
|
to be referred to using a nickname for example ``Steve's Certificate''.
|
|
<DT id="37"><B>-alias</B><DD>
|
|
|
|
|
|
Outputs the certificate alias, if any.
|
|
<DT id="38"><B>-clrtrust</B><DD>
|
|
|
|
|
|
Clears all the permitted or trusted uses of the certificate.
|
|
<DT id="39"><B>-clrreject</B><DD>
|
|
|
|
|
|
Clears all the prohibited or rejected uses of the certificate.
|
|
<DT id="40"><B>-addtrust arg</B><DD>
|
|
|
|
|
|
Adds a trusted certificate use.
|
|
Any object name can be used here but currently only <B>clientAuth</B> (<FONT SIZE="-1">SSL</FONT> client
|
|
use), <B>serverAuth</B> (<FONT SIZE="-1">SSL</FONT> server use), <B>emailProtection</B> (S/MIME email) and
|
|
<B>anyExtendedKeyUsage</B> are used.
|
|
As of OpenSSL 1.1.0, the last of these blocks all purposes when rejected or
|
|
enables all purposes when trusted.
|
|
Other OpenSSL applications may define additional uses.
|
|
<DT id="41"><B>-addreject arg</B><DD>
|
|
|
|
|
|
Adds a prohibited use. It accepts the same values as the <B>-addtrust</B>
|
|
option.
|
|
<DT id="42"><B>-purpose</B><DD>
|
|
|
|
|
|
This option performs tests on the certificate extensions and outputs
|
|
the results. For a more complete description see the <B></B><FONT SIZE="-1"><B>CERTIFICATE
|
|
EXTENSIONS</B></FONT><B></B> section.
|
|
</DL>
|
|
<A NAME="lbAI"> </A>
|
|
<H3>Signing Options</H3>
|
|
|
|
|
|
|
|
The <B>x509</B> utility can be used to sign certificates and requests: it
|
|
can thus behave like a ``mini <FONT SIZE="-1">CA''.</FONT>
|
|
<DL COMPACT>
|
|
<DT id="43"><B>-signkey arg</B><DD>
|
|
|
|
|
|
This option causes the input file to be self signed using the supplied
|
|
private key or engine. The private key's format is specified with the
|
|
<B>-keyform</B> option.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
If the input file is a certificate it sets the issuer name to the
|
|
subject name (i.e. makes it self signed) changes the public key to the
|
|
supplied value and changes the start and end dates. The start date is
|
|
set to the current time and the end date is set to a value determined
|
|
by the <B>-days</B> option. Any certificate extensions are retained unless
|
|
the <B>-clrext</B> option is supplied; this includes, for example, any existing
|
|
key identifier extensions.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
If the input is a certificate request then a self signed certificate
|
|
is created using the supplied private key using the subject name in
|
|
the request.
|
|
<DT id="44"><B>-sigopt nm:v</B><DD>
|
|
|
|
|
|
Pass options to the signature algorithm during sign or verify operations.
|
|
Names and values of these options are algorithm-specific.
|
|
<DT id="45"><B>-passin arg</B><DD>
|
|
|
|
|
|
The key password source. For more information about the format of <B>arg</B>
|
|
see the <B></B><FONT SIZE="-1"><B>PASS PHRASE ARGUMENTS</B></FONT><B></B> section in <B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1).
|
|
<DT id="46"><B>-clrext</B><DD>
|
|
|
|
|
|
Delete any extensions from a certificate. This option is used when a
|
|
certificate is being created from another certificate (for example with
|
|
the <B>-signkey</B> or the <B>-CA</B> options). Normally all extensions are
|
|
retained.
|
|
<DT id="47"><B>-keyform PEM|DER|ENGINE</B><DD>
|
|
|
|
|
|
Specifies the format (<FONT SIZE="-1">DER</FONT> or <FONT SIZE="-1">PEM</FONT>) of the private key file used in the
|
|
<B>-signkey</B> option.
|
|
<DT id="48"><B>-days arg</B><DD>
|
|
|
|
|
|
Specifies the number of days to make a certificate valid for. The default
|
|
is 30 days. Cannot be used with the <B>-preserve_dates</B> option.
|
|
<DT id="49"><B>-x509toreq</B><DD>
|
|
|
|
|
|
Converts a certificate into a certificate request. The <B>-signkey</B> option
|
|
is used to pass the required private key.
|
|
<DT id="50"><B>-req</B><DD>
|
|
|
|
|
|
By default a certificate is expected on input. With this option a
|
|
certificate request is expected instead.
|
|
<DT id="51"><B>-set_serial n</B><DD>
|
|
|
|
|
|
Specifies the serial number to use. This option can be used with either
|
|
the <B>-signkey</B> or <B>-CA</B> options. If used in conjunction with the <B>-CA</B>
|
|
option the serial number file (as specified by the <B>-CAserial</B> or
|
|
<B>-CAcreateserial</B> options) is not used.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
The serial number can be decimal or hex (if preceded by <B>0x</B>).
|
|
<DT id="52"><B>-CA filename</B><DD>
|
|
|
|
|
|
Specifies the <FONT SIZE="-1">CA</FONT> certificate to be used for signing. When this option is
|
|
present <B>x509</B> behaves like a ``mini <FONT SIZE="-1">CA''.</FONT> The input file is signed by this
|
|
<FONT SIZE="-1">CA</FONT> using this option: that is its issuer name is set to the subject name
|
|
of the <FONT SIZE="-1">CA</FONT> and it is digitally signed using the CAs private key.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
This option is normally combined with the <B>-req</B> option. Without the
|
|
<B>-req</B> option the input is a certificate which must be self signed.
|
|
<DT id="53"><B>-CAkey filename</B><DD>
|
|
|
|
|
|
Sets the <FONT SIZE="-1">CA</FONT> private key to sign a certificate with. If this option is
|
|
not specified then it is assumed that the <FONT SIZE="-1">CA</FONT> private key is present in
|
|
the <FONT SIZE="-1">CA</FONT> certificate file.
|
|
<DT id="54"><B>-CAserial filename</B><DD>
|
|
|
|
|
|
Sets the <FONT SIZE="-1">CA</FONT> serial number file to use.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
When the <B>-CA</B> option is used to sign a certificate it uses a serial
|
|
number specified in a file. This file consists of one line containing
|
|
an even number of hex digits with the serial number to use. After each
|
|
use the serial number is incremented and written out to the file again.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
The default filename consists of the <FONT SIZE="-1">CA</FONT> certificate file base name with
|
|
``.srl'' appended. For example if the <FONT SIZE="-1">CA</FONT> certificate file is called
|
|
``mycacert.pem'' it expects to find a serial number file called ``mycacert.srl''.
|
|
<DT id="55"><B>-CAcreateserial</B><DD>
|
|
|
|
|
|
With this option the <FONT SIZE="-1">CA</FONT> serial number file is created if it does not exist:
|
|
it will contain the serial number ``02'' and the certificate being signed will
|
|
have the 1 as its serial number. If the <B>-CA</B> option is specified
|
|
and the serial number file does not exist a random number is generated;
|
|
this is the recommended practice.
|
|
<DT id="56"><B>-extfile filename</B><DD>
|
|
|
|
|
|
File containing certificate extensions to use. If not specified then
|
|
no extensions are added to the certificate.
|
|
<DT id="57"><B>-extensions section</B><DD>
|
|
|
|
|
|
The section to add certificate extensions from. If this option is not
|
|
specified then the extensions should either be contained in the unnamed
|
|
(default) section or the default section should contain a variable called
|
|
``extensions'' which contains the section to use. See the
|
|
<B><A HREF="/cgi-bin/man/man2html?5+x509v3_config">x509v3_config</A></B>(5) manual page for details of the
|
|
extension section format.
|
|
<DT id="58"><B>-force_pubkey key</B><DD>
|
|
|
|
|
|
When a certificate is created set its public key to <B>key</B> instead of the
|
|
key in the certificate or certificate request. This option is useful for
|
|
creating certificates where the algorithm can't normally sign requests, for
|
|
example <FONT SIZE="-1">DH.</FONT>
|
|
|
|
|
|
<P>
|
|
|
|
|
|
The format or <B>key</B> can be specified using the <B>-keyform</B> option.
|
|
</DL>
|
|
<A NAME="lbAJ"> </A>
|
|
<H3>Name Options</H3>
|
|
|
|
|
|
|
|
The <B>nameopt</B> command line switch determines how the subject and issuer
|
|
names are displayed. If no <B>nameopt</B> switch is present the default ``oneline''
|
|
format is used which is compatible with previous versions of OpenSSL.
|
|
Each option is described in detail below, all options can be preceded by
|
|
a <B>-</B> to turn the option off. Only the first four will normally be used.
|
|
<DL COMPACT>
|
|
<DT id="59"><B>compat</B><DD>
|
|
|
|
|
|
Use the old format.
|
|
<DT id="60"><B></B><FONT SIZE="-1"><B>RFC2253</B></FONT><B></B><DD>
|
|
|
|
|
|
Displays names compatible with <FONT SIZE="-1">RFC2253</FONT> equivalent to <B>esc_2253</B>, <B>esc_ctrl</B>,
|
|
<B>esc_msb</B>, <B>utf8</B>, <B>dump_nostr</B>, <B>dump_unknown</B>, <B>dump_der</B>,
|
|
<B>sep_comma_plus</B>, <B>dn_rev</B> and <B>sname</B>.
|
|
<DT id="61"><B>oneline</B><DD>
|
|
|
|
|
|
A oneline format which is more readable than <FONT SIZE="-1">RFC2253.</FONT> It is equivalent to
|
|
specifying the <B>esc_2253</B>, <B>esc_ctrl</B>, <B>esc_msb</B>, <B>utf8</B>, <B>dump_nostr</B>,
|
|
<B>dump_der</B>, <B>use_quote</B>, <B>sep_comma_plus_space</B>, <B>space_eq</B> and <B>sname</B>
|
|
options. This is the <I>default</I> of no name options are given explicitly.
|
|
<DT id="62"><B>multiline</B><DD>
|
|
|
|
|
|
A multiline format. It is equivalent <B>esc_ctrl</B>, <B>esc_msb</B>, <B>sep_multiline</B>,
|
|
<B>space_eq</B>, <B>lname</B> and <B>align</B>.
|
|
<DT id="63"><B>esc_2253</B><DD>
|
|
|
|
|
|
Escape the ``special'' characters required by <FONT SIZE="-1">RFC2253</FONT> in a field. That is
|
|
<B>,+"<>;</B>. Additionally <B>#</B> is escaped at the beginning of a string
|
|
and a space character at the beginning or end of a string.
|
|
<DT id="64"><B>esc_2254</B><DD>
|
|
|
|
|
|
Escape the ``special'' characters required by <FONT SIZE="-1">RFC2254</FONT> in a field. That is
|
|
the <B></B><FONT SIZE="-1"><B>NUL</B></FONT><B></B> character as well as and <B>()*</B>.
|
|
<DT id="65"><B>esc_ctrl</B><DD>
|
|
|
|
|
|
Escape control characters. That is those with <FONT SIZE="-1">ASCII</FONT> values less than
|
|
0x20 (space) and the delete (0x7f) character. They are escaped using the
|
|
<FONT SIZE="-1">RFC2253</FONT> \XX notation (where <FONT SIZE="-1">XX</FONT> are two hex digits representing the
|
|
character value).
|
|
<DT id="66"><B>esc_msb</B><DD>
|
|
|
|
|
|
Escape characters with the <FONT SIZE="-1">MSB</FONT> set, that is with <FONT SIZE="-1">ASCII</FONT> values larger than
|
|
127.
|
|
<DT id="67"><B>use_quote</B><DD>
|
|
|
|
|
|
Escapes some characters by surrounding the whole string with <B>"</B> characters,
|
|
without the option all escaping is done with the <B>\</B> character.
|
|
<DT id="68"><B>utf8</B><DD>
|
|
|
|
|
|
Convert all strings to <FONT SIZE="-1">UTF8</FONT> format first. This is required by <FONT SIZE="-1">RFC2253.</FONT> If
|
|
you are lucky enough to have a <FONT SIZE="-1">UTF8</FONT> compatible terminal then the use
|
|
of this option (and <B>not</B> setting <B>esc_msb</B>) may result in the correct
|
|
display of multibyte (international) characters. Is this option is not
|
|
present then multibyte characters larger than 0xff will be represented
|
|
using the format \UXXXX for 16 bits and \WXXXXXXXX for 32 bits.
|
|
Also if this option is off any UTF8Strings will be converted to their
|
|
character form first.
|
|
<DT id="69"><B>ignore_type</B><DD>
|
|
|
|
|
|
This option does not attempt to interpret multibyte characters in any
|
|
way. That is their content octets are merely dumped as though one octet
|
|
represents each character. This is useful for diagnostic purposes but
|
|
will result in rather odd looking output.
|
|
<DT id="70"><B>show_type</B><DD>
|
|
|
|
|
|
Show the type of the <FONT SIZE="-1">ASN1</FONT> character string. The type precedes the
|
|
field contents. For example ``<FONT SIZE="-1">BMPSTRING:</FONT> Hello World''.
|
|
<DT id="71"><B>dump_der</B><DD>
|
|
|
|
|
|
When this option is set any fields that need to be hexdumped will
|
|
be dumped using the <FONT SIZE="-1">DER</FONT> encoding of the field. Otherwise just the
|
|
content octets will be displayed. Both options use the <FONT SIZE="-1">RFC2253</FONT>
|
|
<B>#XXXX...</B> format.
|
|
<DT id="72"><B>dump_nostr</B><DD>
|
|
|
|
|
|
Dump non character string types (for example <FONT SIZE="-1">OCTET STRING</FONT>) if this
|
|
option is not set then non character string types will be displayed
|
|
as though each content octet represents a single character.
|
|
<DT id="73"><B>dump_all</B><DD>
|
|
|
|
|
|
Dump all fields. This option when used with <B>dump_der</B> allows the
|
|
<FONT SIZE="-1">DER</FONT> encoding of the structure to be unambiguously determined.
|
|
<DT id="74"><B>dump_unknown</B><DD>
|
|
|
|
|
|
Dump any field whose <FONT SIZE="-1">OID</FONT> is not recognised by OpenSSL.
|
|
<DT id="75"><B>sep_comma_plus</B>, <B>sep_comma_plus_space</B>, <B>sep_semi_plus_space</B>, <B>sep_multiline</B><DD>
|
|
|
|
|
|
These options determine the field separators. The first character is
|
|
between RDNs and the second between multiple AVAs (multiple AVAs are
|
|
very rare and their use is discouraged). The options ending in
|
|
``space'' additionally place a space after the separator to make it
|
|
more readable. The <B>sep_multiline</B> uses a linefeed character for
|
|
the <FONT SIZE="-1">RDN</FONT> separator and a spaced <B>+</B> for the <FONT SIZE="-1">AVA</FONT> separator. It also
|
|
indents the fields by four characters. If no field separator is specified
|
|
then <B>sep_comma_plus_space</B> is used by default.
|
|
<DT id="76"><B>dn_rev</B><DD>
|
|
|
|
|
|
Reverse the fields of the <FONT SIZE="-1">DN.</FONT> This is required by <FONT SIZE="-1">RFC2253.</FONT> As a side
|
|
effect this also reverses the order of multiple AVAs but this is
|
|
permissible.
|
|
<DT id="77"><B>nofname</B>, <B>sname</B>, <B>lname</B>, <B>oid</B><DD>
|
|
|
|
|
|
These options alter how the field name is displayed. <B>nofname</B> does
|
|
not display the field at all. <B>sname</B> uses the ``short name'' form
|
|
(<FONT SIZE="-1">CN</FONT> for commonName for example). <B>lname</B> uses the long form.
|
|
<B>oid</B> represents the <FONT SIZE="-1">OID</FONT> in numerical form and is useful for
|
|
diagnostic purpose.
|
|
<DT id="78"><B>align</B><DD>
|
|
|
|
|
|
Align field values for a more readable output. Only usable with
|
|
<B>sep_multiline</B>.
|
|
<DT id="79"><B>space_eq</B><DD>
|
|
|
|
|
|
Places spaces round the <B>=</B> character which follows the field
|
|
name.
|
|
</DL>
|
|
<A NAME="lbAK"> </A>
|
|
<H3>Text Options</H3>
|
|
|
|
|
|
|
|
As well as customising the name output format, it is also possible to
|
|
customise the actual fields printed using the <B>certopt</B> options when
|
|
the <B>text</B> option is present. The default behaviour is to print all fields.
|
|
<DL COMPACT>
|
|
<DT id="80"><B>compatible</B><DD>
|
|
|
|
|
|
Use the old format. This is equivalent to specifying no output options at all.
|
|
<DT id="81"><B>no_header</B><DD>
|
|
|
|
|
|
Don't print header information: that is the lines saying ``Certificate''
|
|
and ``Data''.
|
|
<DT id="82"><B>no_version</B><DD>
|
|
|
|
|
|
Don't print out the version number.
|
|
<DT id="83"><B>no_serial</B><DD>
|
|
|
|
|
|
Don't print out the serial number.
|
|
<DT id="84"><B>no_signame</B><DD>
|
|
|
|
|
|
Don't print out the signature algorithm used.
|
|
<DT id="85"><B>no_validity</B><DD>
|
|
|
|
|
|
Don't print the validity, that is the <B>notBefore</B> and <B>notAfter</B> fields.
|
|
<DT id="86"><B>no_subject</B><DD>
|
|
|
|
|
|
Don't print out the subject name.
|
|
<DT id="87"><B>no_issuer</B><DD>
|
|
|
|
|
|
Don't print out the issuer name.
|
|
<DT id="88"><B>no_pubkey</B><DD>
|
|
|
|
|
|
Don't print out the public key.
|
|
<DT id="89"><B>no_sigdump</B><DD>
|
|
|
|
|
|
Don't give a hexadecimal dump of the certificate signature.
|
|
<DT id="90"><B>no_aux</B><DD>
|
|
|
|
|
|
Don't print out certificate trust information.
|
|
<DT id="91"><B>no_extensions</B><DD>
|
|
|
|
|
|
Don't print out any X509V3 extensions.
|
|
<DT id="92"><B>ext_default</B><DD>
|
|
|
|
|
|
Retain default extension behaviour: attempt to print out unsupported
|
|
certificate extensions.
|
|
<DT id="93"><B>ext_error</B><DD>
|
|
|
|
|
|
Print an error message for unsupported certificate extensions.
|
|
<DT id="94"><B>ext_parse</B><DD>
|
|
|
|
|
|
<FONT SIZE="-1">ASN1</FONT> parse unsupported extensions.
|
|
<DT id="95"><B>ext_dump</B><DD>
|
|
|
|
|
|
Hex dump unsupported extensions.
|
|
<DT id="96"><B>ca_default</B><DD>
|
|
|
|
|
|
The value used by the <B>ca</B> utility, equivalent to <B>no_issuer</B>, <B>no_pubkey</B>,
|
|
<B>no_header</B>, and <B>no_version</B>.
|
|
</DL>
|
|
<A NAME="lbAL"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
|
|
|
|
Note: in these examples the '\' means the example should be all on one
|
|
line.
|
|
<P>
|
|
|
|
Display the contents of a certificate:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -noout -text
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Display the ``Subject Alternative Name'' extension of a certificate:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -noout -ext subjectAltName
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Display more extensions of a certificate:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Display the certificate serial number:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -noout -serial
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Display the certificate subject name:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -noout -subject
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Display the certificate subject name in <FONT SIZE="-1">RFC2253</FONT> form:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -noout -subject -nameopt RFC2253
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Display the certificate subject name in oneline form on a terminal
|
|
supporting <FONT SIZE="-1">UTF8:</FONT>
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Display the certificate <FONT SIZE="-1">SHA1</FONT> fingerprint:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -sha1 -in cert.pem -noout -fingerprint
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Convert a certificate from <FONT SIZE="-1">PEM</FONT> to <FONT SIZE="-1">DER</FONT> format:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Convert a certificate to a certificate request:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -x509toreq -in cert.pem -out req.pem -signkey key.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Convert a certificate request into a self signed certificate using
|
|
extensions for a <FONT SIZE="-1">CA:</FONT>
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca \
|
|
-signkey key.pem -out cacert.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Sign a certificate request using the <FONT SIZE="-1">CA</FONT> certificate above and add user
|
|
certificate extensions:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr \
|
|
-CA cacert.pem -CAkey key.pem -CAcreateserial
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Set a certificate to be trusted for <FONT SIZE="-1">SSL</FONT> client use and change set its alias to
|
|
``Steve's Class 1 <FONT SIZE="-1">CA''</FONT>
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in cert.pem -addtrust clientAuth \
|
|
-setalias "Steve's Class 1 CA" -out trust.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
|
|
|
|
The <FONT SIZE="-1">PEM</FONT> format uses the header and footer lines:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
-----BEGIN CERTIFICATE-----
|
|
-----END CERTIFICATE-----
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
it will also handle files containing:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
-----BEGIN X509 CERTIFICATE-----
|
|
-----END X509 CERTIFICATE-----
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Trusted certificates have the lines
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
-----BEGIN TRUSTED CERTIFICATE-----
|
|
-----END TRUSTED CERTIFICATE-----
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
The conversion to <FONT SIZE="-1">UTF8</FONT> format used with the name options assumes that
|
|
T61Strings use the <FONT SIZE="-1">ISO8859-1</FONT> character set. This is wrong but Netscape
|
|
and <FONT SIZE="-1">MSIE</FONT> do this as do many certificates. So although this is incorrect
|
|
it is more likely to display the majority of certificates correctly.
|
|
<P>
|
|
|
|
The <B>-email</B> option searches the subject name and the subject alternative
|
|
name extension. Only unique email addresses will be printed out: it will
|
|
not print the same address more than once.
|
|
<A NAME="lbAN"> </A>
|
|
<H2>CERTIFICATE EXTENSIONS</H2>
|
|
|
|
|
|
|
|
The <B>-purpose</B> option checks the certificate extensions and determines
|
|
what the certificate can be used for. The actual checks done are rather
|
|
complex and include various hacks and workarounds to handle broken
|
|
certificates and software.
|
|
<P>
|
|
|
|
The same code is used when verifying untrusted certificates in chains
|
|
so this section is useful if a chain is rejected by the verify code.
|
|
<P>
|
|
|
|
The basicConstraints extension <FONT SIZE="-1">CA</FONT> flag is used to determine whether the
|
|
certificate can be used as a <FONT SIZE="-1">CA.</FONT> If the <FONT SIZE="-1">CA</FONT> flag is true then it is a <FONT SIZE="-1">CA,</FONT>
|
|
if the <FONT SIZE="-1">CA</FONT> flag is false then it is not a <FONT SIZE="-1">CA.</FONT> <B>All</B> CAs should have the
|
|
<FONT SIZE="-1">CA</FONT> flag set to true.
|
|
<P>
|
|
|
|
If the basicConstraints extension is absent then the certificate is
|
|
considered to be a ``possible <FONT SIZE="-1">CA''</FONT> other extensions are checked according
|
|
to the intended use of the certificate. A warning is given in this case
|
|
because the certificate should really not be regarded as a <FONT SIZE="-1">CA:</FONT> however
|
|
it is allowed to be a <FONT SIZE="-1">CA</FONT> to work around some broken software.
|
|
<P>
|
|
|
|
If the certificate is a V1 certificate (and thus has no extensions) and
|
|
it is self signed it is also assumed to be a <FONT SIZE="-1">CA</FONT> but a warning is again
|
|
given: this is to work around the problem of Verisign roots which are V1
|
|
self signed certificates.
|
|
<P>
|
|
|
|
If the keyUsage extension is present then additional restraints are
|
|
made on the uses of the certificate. A <FONT SIZE="-1">CA</FONT> certificate <B>must</B> have the
|
|
keyCertSign bit set if the keyUsage extension is present.
|
|
<P>
|
|
|
|
The extended key usage extension places additional restrictions on the
|
|
certificate uses. If this extension is present (whether critical or not)
|
|
the key can only be used for the purposes specified.
|
|
<P>
|
|
|
|
A complete description of each test is given below. The comments about
|
|
basicConstraints and keyUsage and V1 certificates above apply to <B>all</B>
|
|
<FONT SIZE="-1">CA</FONT> certificates.
|
|
<DL COMPACT>
|
|
<DT id="97"><B></B><FONT SIZE="-1"><B>SSL</B></FONT><B> Client</B><DD>
|
|
|
|
|
|
The extended key usage extension must be absent or include the ``web client
|
|
authentication'' <FONT SIZE="-1">OID.</FONT> keyUsage must be absent or it must have the
|
|
digitalSignature bit set. Netscape certificate type must be absent or it must
|
|
have the <FONT SIZE="-1">SSL</FONT> client bit set.
|
|
<DT id="98"><B></B><FONT SIZE="-1"><B>SSL</B></FONT><B> Client </B><FONT SIZE="-1"><B>CA</B></FONT><B></B><DD>
|
|
|
|
|
|
The extended key usage extension must be absent or include the ``web client
|
|
authentication'' <FONT SIZE="-1">OID.</FONT> Netscape certificate type must be absent or it must have
|
|
the <FONT SIZE="-1">SSL CA</FONT> bit set: this is used as a work around if the basicConstraints
|
|
extension is absent.
|
|
<DT id="99"><B></B><FONT SIZE="-1"><B>SSL</B></FONT><B> Server</B><DD>
|
|
|
|
|
|
The extended key usage extension must be absent or include the ``web server
|
|
authentication'' and/or one of the <FONT SIZE="-1">SGC</FONT> OIDs. keyUsage must be absent or it
|
|
must have the digitalSignature, the keyEncipherment set or both bits set.
|
|
Netscape certificate type must be absent or have the <FONT SIZE="-1">SSL</FONT> server bit set.
|
|
<DT id="100"><B></B><FONT SIZE="-1"><B>SSL</B></FONT><B> Server </B><FONT SIZE="-1"><B>CA</B></FONT><B></B><DD>
|
|
|
|
|
|
The extended key usage extension must be absent or include the ``web server
|
|
authentication'' and/or one of the <FONT SIZE="-1">SGC</FONT> OIDs. Netscape certificate type must
|
|
be absent or the <FONT SIZE="-1">SSL CA</FONT> bit must be set: this is used as a work around if the
|
|
basicConstraints extension is absent.
|
|
<DT id="101"><B>Netscape </B><FONT SIZE="-1"><B>SSL</B></FONT><B> Server</B><DD>
|
|
|
|
|
|
For Netscape <FONT SIZE="-1">SSL</FONT> clients to connect to an <FONT SIZE="-1">SSL</FONT> server it must have the
|
|
keyEncipherment bit set if the keyUsage extension is present. This isn't
|
|
always valid because some cipher suites use the key for digital signing.
|
|
Otherwise it is the same as a normal <FONT SIZE="-1">SSL</FONT> server.
|
|
<DT id="102"><B>Common S/MIME Client Tests</B><DD>
|
|
|
|
|
|
The extended key usage extension must be absent or include the ``email
|
|
protection'' <FONT SIZE="-1">OID.</FONT> Netscape certificate type must be absent or should have the
|
|
S/MIME bit set. If the S/MIME bit is not set in Netscape certificate type
|
|
then the <FONT SIZE="-1">SSL</FONT> client bit is tolerated as an alternative but a warning is shown:
|
|
this is because some Verisign certificates don't set the S/MIME bit.
|
|
<DT id="103"><B>S/MIME Signing</B><DD>
|
|
|
|
|
|
In addition to the common S/MIME client tests the digitalSignature bit or
|
|
the nonRepudiation bit must be set if the keyUsage extension is present.
|
|
<DT id="104"><B>S/MIME Encryption</B><DD>
|
|
|
|
|
|
In addition to the common S/MIME tests the keyEncipherment bit must be set
|
|
if the keyUsage extension is present.
|
|
<DT id="105"><B>S/MIME </B><FONT SIZE="-1"><B>CA</B></FONT><B></B><DD>
|
|
|
|
|
|
The extended key usage extension must be absent or include the ``email
|
|
protection'' <FONT SIZE="-1">OID.</FONT> Netscape certificate type must be absent or must have the
|
|
S/MIME <FONT SIZE="-1">CA</FONT> bit set: this is used as a work around if the basicConstraints
|
|
extension is absent.
|
|
<DT id="106"><B></B><FONT SIZE="-1"><B>CRL</B></FONT><B> Signing</B><DD>
|
|
|
|
|
|
The keyUsage extension must be absent or it must have the <FONT SIZE="-1">CRL</FONT> signing bit
|
|
set.
|
|
<DT id="107"><B></B><FONT SIZE="-1"><B>CRL</B></FONT><B> Signing </B><FONT SIZE="-1"><B>CA</B></FONT><B></B><DD>
|
|
|
|
|
|
The normal <FONT SIZE="-1">CA</FONT> tests apply. Except in this case the basicConstraints extension
|
|
must be present.
|
|
</DL>
|
|
<A NAME="lbAO"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
|
|
|
|
Extensions in certificates are not transferred to certificate requests and
|
|
vice versa.
|
|
<P>
|
|
|
|
It is possible to produce invalid certificates or requests by specifying the
|
|
wrong private key or using inconsistent options in some cases: these should
|
|
be checked.
|
|
<P>
|
|
|
|
There should be options to explicitly set such things as start and end
|
|
dates rather than an offset from the current time.
|
|
<A NAME="lbAP"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+req">req</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+ca">ca</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+genrsa">genrsa</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gendsa">gendsa</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+verify">verify</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?5+x509v3_config">x509v3_config</A></B>(5)
|
|
<A NAME="lbAQ"> </A>
|
|
<H2>HISTORY</H2>
|
|
|
|
|
|
|
|
The hash algorithm used in the <B>-subject_hash</B> and <B>-issuer_hash</B> options
|
|
before OpenSSL 1.0.0 was based on the deprecated <FONT SIZE="-1">MD5</FONT> algorithm and the encoding
|
|
of the distinguished name. In OpenSSL 1.0.0 and later it is based on a
|
|
canonical version of the <FONT SIZE="-1">DN</FONT> using <FONT SIZE="-1">SHA1.</FONT> This means that any directories using
|
|
the old form must have their links rebuilt using <B>c_rehash</B> or similar.
|
|
<A NAME="lbAR"> </A>
|
|
<H2>COPYRIGHT</H2>
|
|
|
|
|
|
|
|
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
|
|
<P>
|
|
|
|
Licensed under the OpenSSL license (the ``License''). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file <FONT SIZE="-1">LICENSE</FONT> in the source distribution or at
|
|
<<A HREF="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</A>>.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="108"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="109"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="110"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="111"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DL>
|
|
<DT id="112"><A HREF="#lbAF">Input, Output, and General Purpose Options</A><DD>
|
|
<DT id="113"><A HREF="#lbAG">Display Options</A><DD>
|
|
<DT id="114"><A HREF="#lbAH">Trust Settings</A><DD>
|
|
<DT id="115"><A HREF="#lbAI">Signing Options</A><DD>
|
|
<DT id="116"><A HREF="#lbAJ">Name Options</A><DD>
|
|
<DT id="117"><A HREF="#lbAK">Text Options</A><DD>
|
|
</DL>
|
|
<DT id="118"><A HREF="#lbAL">EXAMPLES</A><DD>
|
|
<DT id="119"><A HREF="#lbAM">NOTES</A><DD>
|
|
<DT id="120"><A HREF="#lbAN">CERTIFICATE EXTENSIONS</A><DD>
|
|
<DT id="121"><A HREF="#lbAO">BUGS</A><DD>
|
|
<DT id="122"><A HREF="#lbAP">SEE ALSO</A><DD>
|
|
<DT id="123"><A HREF="#lbAQ">HISTORY</A><DD>
|
|
<DT id="124"><A HREF="#lbAR">COPYRIGHT</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:29 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|