812 lines
24 KiB
HTML
812 lines
24 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of DIRMNGR</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>DIRMNGR</H1>
|
|
Section: GNU Privacy Guard 2.2 (8)<BR>Updated: 2019-11-23<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
<B>dirmngr</B>
|
|
|
|
- CRL and OCSP daemon
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>dirmngr</B>
|
|
|
|
[<I>options</I>]
|
|
|
|
<I>command</I>
|
|
|
|
[<I>args</I>]
|
|
|
|
<P>
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
Since version 2.1 of GnuPG, <B>dirmngr</B> takes care of accessing
|
|
the OpenPGP keyservers. As with previous versions it is also used as
|
|
a server for managing and downloading certificate revocation lists
|
|
(CRLs) for X.509 certificates, downloading X.509 certificates, and
|
|
providing access to OCSP providers. Dirmngr is invoked internally by
|
|
<B>gpg</B>, <B>gpgsm</B>, or via the <B>gpg-connect-agent</B>
|
|
tool.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>COMMANDS</H2>
|
|
|
|
<P>
|
|
Commands are not distinguished from options except for the fact that
|
|
only one command is allowed.
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="1"><B>--version</B>
|
|
|
|
<DD>
|
|
Print the program version and licensing information. Note that you cannot
|
|
abbreviate this command.
|
|
<P>
|
|
<DT id="2"><B>--help, -h</B>
|
|
|
|
<DD>
|
|
Print a usage message summarizing the most useful command-line options.
|
|
Note that you cannot abbreviate this command.
|
|
<P>
|
|
<DT id="3"><B>--dump-options</B>
|
|
|
|
<DD>
|
|
Print a list of all available options and commands. Note that you cannot
|
|
abbreviate this command.
|
|
<P>
|
|
<DT id="4"><B>--server</B>
|
|
|
|
<DD>
|
|
Run in server mode and wait for commands on the <B>stdin</B>. The
|
|
default mode is to create a socket and listen for commands there.
|
|
This is only used for testing.
|
|
<P>
|
|
<DT id="5"><B>--daemon</B>
|
|
|
|
<DD>
|
|
Run in background daemon mode and listen for commands on a socket.
|
|
This is the way <B>dirmngr</B> is started on demand by the other
|
|
GnuPG components. To force starting <B>dirmngr</B> it is in
|
|
general best to use <B>gpgconf --launch dirmngr</B>.
|
|
<P>
|
|
<DT id="6"><B>--supervised</B>
|
|
|
|
<DD>
|
|
Run in the foreground, sending logs to stderr, and listening on file
|
|
descriptor 3, which must already be bound to a listening socket. This
|
|
is useful when running under systemd or other similar process
|
|
supervision schemes. This option is not supported on Windows.
|
|
<P>
|
|
<DT id="7"><B>--list-crls</B>
|
|
|
|
<DD>
|
|
List the contents of the CRL cache on <B>stdout</B>. This is probably
|
|
only useful for debugging purposes.
|
|
<P>
|
|
<DT id="8"><B>--load-crl </B><I>file</I>
|
|
|
|
<DD>
|
|
This command requires a filename as additional argument, and it will
|
|
make Dirmngr try to import the CRL in <I>file</I> into it's cache.
|
|
Note, that this is only possible if Dirmngr is able to retrieve the
|
|
CA's certificate directly by its own means. In general it is better
|
|
to use <B>gpgsm</B>'s <B>--call-dirmngr loadcrl filename</B> command
|
|
so that <B>gpgsm</B> can help dirmngr.
|
|
<P>
|
|
<DT id="9"><B>--fetch-crl </B><I>url</I>
|
|
|
|
<DD>
|
|
This command requires an URL as additional argument, and it will make
|
|
dirmngr try to retrieve and import the CRL from that <I>url</I> into
|
|
it's cache. This is mainly useful for debugging purposes. The
|
|
<B>dirmngr-client</B> provides the same feature for a running dirmngr.
|
|
<P>
|
|
<DT id="10"><B>--shutdown</B>
|
|
|
|
<DD>
|
|
This commands shuts down an running instance of Dirmngr. This command
|
|
has currently no effect.
|
|
<P>
|
|
<DT id="11"><B>--flush</B>
|
|
|
|
<DD>
|
|
This command removes all CRLs from Dirmngr's cache. Client requests
|
|
will thus trigger reading of fresh CRLs.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
<P>
|
|
Note that all long options with the exception of <B>--options</B>
|
|
and <B>--homedir</B> may also be given in the configuration file
|
|
after stripping off the two leading dashes.
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="12"><B>--options </B><I>file</I>
|
|
|
|
<DD>
|
|
Reads configuration from <I>file</I> instead of from the default
|
|
per-user configuration file. The default configuration file is named
|
|
'<I>dirmngr.conf</I>' and expected in the home directory.
|
|
<P>
|
|
<DT id="13"><B>--homedir </B><I>dir</I>
|
|
|
|
<DD>
|
|
Set the name of the home directory to <I>dir</I>. This option is only
|
|
effective when used on the command line. The default is
|
|
the directory named '<I>.gnupg</I>' directly below the home directory
|
|
of the user unless the environment variable <B>GNUPGHOME</B> has been set
|
|
in which case its value will be used. Many kinds of data are stored within
|
|
this directory.
|
|
<P>
|
|
<P>
|
|
<DT id="14"><B>-v</B>
|
|
|
|
<DD>
|
|
<DT id="15"><B>--verbose</B>
|
|
|
|
<DD>
|
|
Outputs additional information while running.
|
|
You can increase the verbosity by giving several
|
|
verbose commands to <B>dirmngr</B>, such as <B>-vv</B>.
|
|
<P>
|
|
<P>
|
|
<DT id="16"><B>--log-file </B><I>file</I>
|
|
|
|
<DD>
|
|
Append all logging output to <I>file</I>. This is very helpful in
|
|
seeing what the agent actually does. Use '<I>socket://</I>' to log to
|
|
socket.
|
|
<P>
|
|
<DT id="17"><B>--debug-level </B><I>level</I>
|
|
|
|
<DD>
|
|
Select the debug level for investigating problems. <I>level</I> may be a
|
|
numeric value or by a keyword:
|
|
<P>
|
|
<DL COMPACT><DT id="18"><DD>
|
|
<DL COMPACT>
|
|
<DT id="19"><B>none</B>
|
|
|
|
<DD>
|
|
No debugging at all. A value of less than 1 may be used instead of
|
|
the keyword.
|
|
<DT id="20"><B>basic</B>
|
|
|
|
<DD>
|
|
Some basic debug messages. A value between 1 and 2 may be used
|
|
instead of the keyword.
|
|
<DT id="21"><B>advanced</B>
|
|
|
|
<DD>
|
|
More verbose debug messages. A value between 3 and 5 may be used
|
|
instead of the keyword.
|
|
<DT id="22"><B>expert</B>
|
|
|
|
<DD>
|
|
Even more detailed messages. A value between 6 and 8 may be used
|
|
instead of the keyword.
|
|
<DT id="23"><B>guru</B>
|
|
|
|
<DD>
|
|
All of the debug messages you can get. A value greater than 8 may be
|
|
used instead of the keyword. The creation of hash tracing files is
|
|
only enabled if the keyword is used.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
How these messages are mapped to the actual debugging flags is not
|
|
specified and may change with newer releases of this program. They are
|
|
however carefully selected to best aid in debugging.
|
|
<P>
|
|
<DT id="24"><B>--debug </B><I>flags</I>
|
|
|
|
<DD>
|
|
Set debugging flags. This option is only useful for debugging and its
|
|
behavior may change with a new release. All flags are or-ed and may
|
|
be given in C syntax (e.g. 0x0042) or as a comma separated list of
|
|
flag names. To get a list of all supported flags the single word
|
|
"help" can be used.
|
|
<P>
|
|
<DT id="25"><B>--debug-all</B>
|
|
|
|
<DD>
|
|
Same as <B>--debug=0xffffffff</B>
|
|
<P>
|
|
<DT id="26"><B>--tls-debug </B><I>level</I>
|
|
|
|
<DD>
|
|
Enable debugging of the TLS layer at <I>level</I>. The details of the
|
|
debug level depend on the used TLS library and are not set in stone.
|
|
<P>
|
|
<DT id="27"><B>--debug-wait </B><I>n</I>
|
|
|
|
<DD>
|
|
When running in server mode, wait <I>n</I> seconds before entering the
|
|
actual processing loop and print the pid. This gives time to attach a
|
|
debugger.
|
|
<P>
|
|
<DT id="28"><B>--disable-check-own-socket</B>
|
|
|
|
<DD>
|
|
On some platforms <B>dirmngr</B> is able to detect the removal of
|
|
its socket file and shutdown itself. This option disable this
|
|
self-test for debugging purposes.
|
|
<P>
|
|
<DT id="29"><B>-s</B>
|
|
|
|
<DD>
|
|
|
|
<B>--sh</B>
|
|
|
|
|
|
<B>-c</B>
|
|
|
|
|
|
<B>--csh</B>
|
|
|
|
Format the info output in daemon mode for use with the standard Bourne
|
|
shell respective the C-shell. The default is to guess it based on the
|
|
environment variable <B>SHELL</B> which is in almost all cases
|
|
sufficient.
|
|
<P>
|
|
<DT id="30"><B>--force</B>
|
|
|
|
<DD>
|
|
Enabling this option forces loading of expired CRLs; this is only
|
|
useful for debugging.
|
|
<P>
|
|
<DT id="31"><B>--use-tor</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-use-tor</B>
|
|
|
|
The option <B>--use-tor</B> switches Dirmngr and thus GnuPG into
|
|
``Tor mode'' to route all network access via Tor (an anonymity
|
|
network). Certain other features are disabled in this mode. The
|
|
effect of <B>--use-tor</B> cannot be overridden by any other command
|
|
or even by reloading dirmngr. The use of <B>--no-use-tor</B>
|
|
disables the use of Tor. The default is to use Tor if it is available
|
|
on startup or after reloading dirmngr.
|
|
<P>
|
|
<DT id="32"><B>--standard-resolver</B>
|
|
|
|
<DD>
|
|
This option forces the use of the system's standard DNS resolver code.
|
|
This is mainly used for debugging. Note that on Windows a standard
|
|
resolver is not used and all DNS access will return the error ``Not
|
|
Implemented'' if this option is used. Using this together with enabled
|
|
Tor mode returns the error ``Not Enabled''.
|
|
<P>
|
|
<DT id="33"><B>--recursive-resolver</B>
|
|
|
|
<DD>
|
|
When possible use a recursive resolver instead of a stub resolver.
|
|
<P>
|
|
<DT id="34"><B>--resolver-timeout </B><I>n</I>
|
|
|
|
<DD>
|
|
Set the timeout for the DNS resolver to N seconds. The default are 30
|
|
seconds.
|
|
<P>
|
|
<DT id="35"><B>--connect-timeout </B><I>n</I>
|
|
|
|
<DD>
|
|
<DT id="36"><B>--connect-quick-timeout </B><I>n</I>
|
|
|
|
<DD>
|
|
Set the timeout for HTTP and generic TCP connection attempts to N
|
|
seconds. The value set with the quick variant is used when the
|
|
--quick option has been given to certain Assuan commands. The quick
|
|
value is capped at the value of the regular connect timeout. The
|
|
default values are 15 and 2 seconds. Note that the timeout values are
|
|
for each connection attempt; the connection code will attempt to
|
|
connect all addresses listed for a server.
|
|
<P>
|
|
<DT id="37"><B>--listen-backlog </B><I>n</I>
|
|
|
|
<DD>
|
|
Set the size of the queue for pending connections. The default is 64.
|
|
<P>
|
|
<DT id="38"><B>--allow-version-check</B>
|
|
|
|
<DD>
|
|
Allow Dirmngr to connect to <B><A HREF="https://versions.gnupg.org">https://versions.gnupg.org</A></B> to get
|
|
the list of current software versions.
|
|
On debian-packaged versions, this option does nothing since software
|
|
updates should be handled by the distribution.
|
|
See the option
|
|
<B>--query-swdb</B> of the command <B>gpgconf</B> for more
|
|
details. Note, that regardless of this option a version check can
|
|
always be triggered using this command:
|
|
<P>
|
|
<DL COMPACT><DT id="39"><DD>
|
|
<PRE>
|
|
gpg-connect-agent --dirmngr 'loadswdb --force' /bye
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="40"><B>--keyserver </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as your keyserver. This is the server that <B>gpg</B>
|
|
communicates with to receive keys, send keys, and search for
|
|
keys. The format of the <I>name</I> is a URI:
|
|
`scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
|
|
"hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
|
|
keyservers, or "mailto" for the Graff email keyserver. Note that your
|
|
particular installation of GnuPG may have other keyserver types
|
|
available as well. Keyserver schemes are case-insensitive. After the
|
|
keyserver name, optional keyserver configuration options may be
|
|
provided. These are the same as the <B>--keyserver-options</B> of
|
|
<B>gpg</B>, but apply only to this particular keyserver.
|
|
<P>
|
|
Most keyservers synchronize with each other, so there is generally no
|
|
need to send keys to more than one server. The keyserver
|
|
<B><A HREF="hkp://keys.gnupg.net">hkp://keys.gnupg.net</A></B> uses round robin DNS to give a different
|
|
keyserver each time you use it.
|
|
<P>
|
|
If exactly two keyservers are configured and only one is a Tor hidden
|
|
service (.onion), Dirmngr selects the keyserver to use depending on
|
|
whether Tor is locally running or not. The check for a running Tor is
|
|
done for each new connection.
|
|
<P>
|
|
If no keyserver is explicitly configured, dirmngr will use the
|
|
built-in default of <A HREF="hkps://keys.openpgp.org.">hkps://keys.openpgp.org.</A>
|
|
<P>
|
|
Note that the above default is a Debian-specific choice. Upstream
|
|
GnuPG prefers <A HREF="hkps://hkps.pool.sks-keyservers.net.">hkps://hkps.pool.sks-keyservers.net.</A> See
|
|
/usr/share/doc/gpgconf/NEWS.Debian.gz for more details.
|
|
<P>
|
|
<DT id="41"><B>--nameserver </B><I>ipaddr</I>
|
|
|
|
<DD>
|
|
In ``Tor mode'' Dirmngr uses a public resolver via Tor to resolve DNS
|
|
names. If the default public resolver, which is <B>8.8.8.8</B>, shall
|
|
not be used a different one can be given using this option. Note that
|
|
a numerical IP address must be given (IPv6 or IPv4) and that no error
|
|
checking is done for <I>ipaddr</I>.
|
|
<P>
|
|
<DT id="42"><B>--disable-ipv4</B>
|
|
|
|
<DD>
|
|
<DT id="43"><B>--disable-ipv6</B>
|
|
|
|
<DD>
|
|
Disable the use of all IPv4 or IPv6 addresses.
|
|
<P>
|
|
<DT id="44"><B>--disable-ldap</B>
|
|
|
|
<DD>
|
|
Entirely disables the use of LDAP.
|
|
<P>
|
|
<DT id="45"><B>--disable-http</B>
|
|
|
|
<DD>
|
|
Entirely disables the use of HTTP.
|
|
<P>
|
|
<DT id="46"><B>--ignore-http-dp</B>
|
|
|
|
<DD>
|
|
When looking for the location of a CRL, the to be tested certificate
|
|
usually contains so called CRL Distribution Point (DP) entries
|
|
which are URLs describing the way to access the CRL. The first found DP
|
|
entry is used. With this option all entries using the HTTP
|
|
scheme are ignored when looking for a suitable DP.
|
|
<P>
|
|
<DT id="47"><B>--ignore-ldap-dp</B>
|
|
|
|
<DD>
|
|
This is similar to <B>--ignore-http-dp</B> but ignores entries using
|
|
the LDAP scheme. Both options may be combined resulting in
|
|
ignoring DPs entirely.
|
|
<P>
|
|
<DT id="48"><B>--ignore-ocsp-service-url</B>
|
|
|
|
<DD>
|
|
Ignore all OCSP URLs contained in the certificate. The effect is to
|
|
force the use of the default responder.
|
|
<P>
|
|
<DT id="49"><B>--honor-http-proxy</B>
|
|
|
|
<DD>
|
|
If the environment variable '<I>http_proxy</I>' has been set, use its
|
|
value to access HTTP servers.
|
|
<P>
|
|
<DT id="50"><B>--http-proxy </B><I>host</I>[:<I>port</I>]
|
|
|
|
<DD>
|
|
Use <I>host</I> and <I>port</I> to access HTTP servers. The use of this
|
|
option overrides the environment variable '<I>http_proxy</I>' regardless
|
|
whether <B>--honor-http-proxy</B> has been set.
|
|
<P>
|
|
<P>
|
|
<DT id="51"><B>--ldap-proxy </B><I>host</I>[:<I>port</I>]
|
|
|
|
<DD>
|
|
Use <I>host</I> and <I>port</I> to connect to LDAP servers. If <I>port</I>
|
|
is omitted, port 389 (standard LDAP port) is used. This overrides any
|
|
specified host and port part in a LDAP URL and will also be used if host
|
|
and port have been omitted from the URL.
|
|
<P>
|
|
<DT id="52"><B>--only-ldap-proxy</B>
|
|
|
|
<DD>
|
|
Never use anything else but the LDAP "proxy" as configured with
|
|
<B>--ldap-proxy</B>. Usually <B>dirmngr</B> tries to use other
|
|
configured LDAP server if the connection using the "proxy" failed.
|
|
<P>
|
|
<P>
|
|
<DT id="53"><B>--ldapserverlist-file </B><I>file</I>
|
|
|
|
<DD>
|
|
Read the list of LDAP servers to consult for CRLs and certificates from
|
|
file instead of the default per-user ldap server list file. The default
|
|
value for <I>file</I> is '<I>dirmngr_ldapservers.conf</I>'.
|
|
<P>
|
|
This server list file contains one LDAP server per line in the format
|
|
<P>
|
|
<B>hostname:port:username:password:base_dn</B>
|
|
<P>
|
|
Lines starting with a '#' are comments.
|
|
<P>
|
|
Note that as usual all strings entered are expected to be UTF-8 encoded.
|
|
Obviously this will lead to problems if the password has originally been
|
|
encoded as Latin-1. There is no other solution here than to put such a
|
|
password in the binary encoding into the file (i.e. non-ascii characters
|
|
won't show up readable). ([The <B>gpgconf</B> tool might be
|
|
helpful for frontends as it enables editing this configuration file using
|
|
percent-escaped strings.])
|
|
<P>
|
|
<P>
|
|
<DT id="54"><B>--ldaptimeout </B><I>secs</I>
|
|
|
|
<DD>
|
|
Specify the number of seconds to wait for an LDAP query before timing
|
|
out. The default are 15 seconds. 0 will never timeout.
|
|
<P>
|
|
<P>
|
|
<DT id="55"><B>--add-servers</B>
|
|
|
|
<DD>
|
|
This option makes dirmngr add any servers it discovers when validating
|
|
certificates against CRLs to the internal list of servers to consult for
|
|
certificates and CRLs.
|
|
<P>
|
|
This option is useful when trying to validate a certificate that has
|
|
a CRL distribution point that points to a server that is not already
|
|
listed in the ldapserverlist. Dirmngr will always go to this server and
|
|
try to download the CRL, but chances are high that the certificate used
|
|
to sign the CRL is located on the same server. So if dirmngr doesn't add
|
|
that new server to list, it will often not be able to verify the
|
|
signature of the CRL unless the <B>--add-servers</B> option is used.
|
|
<P>
|
|
Note: The current version of dirmngr has this option disabled by default.
|
|
<P>
|
|
<P>
|
|
<DT id="56"><B>--allow-ocsp</B>
|
|
|
|
<DD>
|
|
This option enables OCSP support if requested by the client.
|
|
<P>
|
|
OCSP requests are rejected by default because they may violate the
|
|
privacy of the user; for example it is possible to track the time when
|
|
a user is reading a mail.
|
|
<P>
|
|
<P>
|
|
<DT id="57"><B>--ocsp-responder </B><I>url</I>
|
|
|
|
<DD>
|
|
Use <I>url</I> as the default OCSP Responder if the certificate does
|
|
not contain information about an assigned responder. Note, that
|
|
<B>--ocsp-signer</B> must also be set to a valid certificate.
|
|
<P>
|
|
<DT id="58"><B>--ocsp-signer </B><I>fpr</I>|<I>file</I>
|
|
|
|
<DD>
|
|
Use the certificate with the fingerprint <I>fpr</I> to check the
|
|
responses of the default OCSP Responder. Alternatively a filename can be
|
|
given in which case the response is expected to be signed by one of the
|
|
certificates described in that file. Any argument which contains a
|
|
slash, dot or tilde is considered a filename. Usual filename expansion
|
|
takes place: A tilde at the start followed by a slash is replaced by the
|
|
content of '<I>HOME</I>', no slash at start describes a relative filename
|
|
which will be searched at the home directory. To make sure that the
|
|
<I>file</I> is searched in the home directory, either prepend the name
|
|
with "./" or use a name which contains a dot.
|
|
<P>
|
|
If a response has been signed by a certificate described by these
|
|
fingerprints no further check upon the validity of this certificate is
|
|
done.
|
|
<P>
|
|
The format of the <I>FILE</I> is a list of SHA-1 fingerprint, one per
|
|
line with optional colons between the bytes. Empty lines and lines
|
|
prefix with a hash mark are ignored.
|
|
<P>
|
|
<P>
|
|
<DT id="59"><B>--ocsp-max-clock-skew </B><I>n</I>
|
|
|
|
<DD>
|
|
The number of seconds a skew between the OCSP responder and them local
|
|
clock is accepted. Default is 600 (10 minutes).
|
|
<P>
|
|
<DT id="60"><B>--ocsp-max-period </B><I>n</I>
|
|
|
|
<DD>
|
|
Seconds a response is at maximum considered valid after the time given
|
|
in the thisUpdate field. Default is 7776000 (90 days).
|
|
<P>
|
|
<DT id="61"><B>--ocsp-current-period </B><I>n</I>
|
|
|
|
<DD>
|
|
The number of seconds an OCSP response is considered valid after the
|
|
time given in the NEXT_UPDATE datum. Default is 10800 (3 hours).
|
|
<P>
|
|
<P>
|
|
<DT id="62"><B>--max-replies </B><I>n</I>
|
|
|
|
<DD>
|
|
Do not return more that <I>n</I> items in one query. The default is
|
|
10.
|
|
<P>
|
|
<DT id="63"><B>--ignore-cert-extension </B><I>oid</I>
|
|
|
|
<DD>
|
|
Add <I>oid</I> to the list of ignored certificate extensions. The
|
|
<I>oid</I> is expected to be in dotted decimal form, like
|
|
<B>2.5.29.3</B>. This option may be used more than once. Critical
|
|
flagged certificate extensions matching one of the OIDs in the list
|
|
are treated as if they are actually handled and thus the certificate
|
|
won't be rejected due to an unknown critical extension. Use this
|
|
option with care because extensions are usually flagged as critical
|
|
for a reason.
|
|
<P>
|
|
<DT id="64"><B>--hkp-cacert </B><I>file</I>
|
|
|
|
<DD>
|
|
Use the root certificates in <I>file</I> for verification of the TLS
|
|
certificates used with <B>hkps</B> (keyserver access over TLS). If
|
|
the file is in PEM format a suffix of <B>.pem</B> is expected for
|
|
<I>file</I>. This option may be given multiple times to add more
|
|
root certificates. Tilde expansion is supported.
|
|
<P>
|
|
If no <B>hkp-cacert</B> directive is present, dirmngr will make a
|
|
reasonable choice: if the keyserver in question is the special pool
|
|
<B>hkps.pool.sks-keyservers.net</B>, it will use the bundled root
|
|
certificate for that pool. Otherwise, it will use the system CAs.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
<P>
|
|
Here is an example on how to show dirmngr's internal table of OpenPGP
|
|
keyserver addresses. The output is intended for debugging purposes
|
|
and not part of a defined API.
|
|
<P>
|
|
<DL COMPACT><DT id="65"><DD>
|
|
<PRE>
|
|
gpg-connect-agent --dirmngr 'keyserver --hosttable' /bye
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
To inhibit the use of a particular host you have noticed in one of the
|
|
keyserver pools, you may use
|
|
<P>
|
|
<DL COMPACT><DT id="66"><DD>
|
|
<PRE>
|
|
gpg-connect-agent --dirmngr 'keyserver --dead pgpkeys.bnd.de' /bye
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
The description of the <B>keyserver</B> command can be printed using
|
|
<P>
|
|
<DL COMPACT><DT id="67"><DD>
|
|
<PRE>
|
|
gpg-connect-agent --dirmngr 'help keyserver' /bye
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAH"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<P>
|
|
Dirmngr makes use of several directories when running in daemon mode:
|
|
There are a few configuration files whih control the operation of
|
|
dirmngr. By default they may all be found in the current home
|
|
directory (see: [option --homedir]).
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="68"><B>dirmngr.conf</B>
|
|
|
|
<DD>
|
|
This is the standard configuration file read by <B>dirmngr</B> on
|
|
startup. It may contain any valid long option; the leading two dashes
|
|
may not be entered and the option may not be abbreviated. This file
|
|
is also read after a <B>SIGHUP</B> however not all options will
|
|
actually have an effect. This default name may be changed on the
|
|
command line (see: [option --options]). You should backup this file.
|
|
<P>
|
|
<DT id="69"><B>/etc/gnupg/trusted-certs</B>
|
|
|
|
<DD>
|
|
This directory should be filled with certificates of Root CAs you
|
|
are trusting in checking the CRLs and signing OCSP Responses.
|
|
<P>
|
|
Usually these are the same certificates you use with the applications
|
|
making use of dirmngr. It is expected that each of these certificate
|
|
files contain exactly one DER encoded certificate in a file
|
|
with the suffix '<I>.crt</I>' or '<I>.der</I>'. <B>dirmngr</B> reads
|
|
those certificates on startup and when given a SIGHUP. Certificates
|
|
which are not readable or do not make up a proper X.509 certificate
|
|
are ignored; see the log file for details.
|
|
<P>
|
|
Applications using dirmngr (e.g. gpgsm) can request these
|
|
certificates to complete a trust chain in the same way as with the
|
|
extra-certs directory (see below).
|
|
<P>
|
|
Note that for OCSP responses the certificate specified using the option
|
|
<B>--ocsp-signer</B> is always considered valid to sign OCSP requests.
|
|
<P>
|
|
<DT id="70"><B>/etc/gnupg/extra-certs</B>
|
|
|
|
<DD>
|
|
This directory may contain extra certificates which are preloaded
|
|
into the internal cache on startup. Applications using dirmngr (e.g. gpgsm)
|
|
can request cached certificates to complete a trust chain.
|
|
This is convenient in cases you have a couple intermediate CA certificates
|
|
or certificates usually used to sign OCSP responses.
|
|
These certificates are first tried before going
|
|
out to the net to look for them. These certificates must also be
|
|
DER encoded and suffixed with '<I>.crt</I>' or '<I>.der</I>'.
|
|
<P>
|
|
<DT id="71"><B>~/.gnupg/crls.d</B>
|
|
|
|
<DD>
|
|
This directory is used to store cached CRLs. The '<I>crls.d</I>'
|
|
part will be created by dirmngr if it does not exists but you need to
|
|
make sure that the upper directory exists.
|
|
<P>
|
|
<P>
|
|
</DL>
|
|
<A NAME="lbAI"> </A>
|
|
<H2>SIGNALS</H2>
|
|
|
|
<P>
|
|
A running <B>dirmngr</B> may be controlled by signals, i.e. using
|
|
the <B>kill</B> command to send a signal to the process.
|
|
<P>
|
|
Here is a list of supported signals:
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="72"><B>SIGHUP</B>
|
|
|
|
<DD>
|
|
This signal flushes all internally cached CRLs as well as any cached
|
|
certificates. Then the certificate cache is reinitialized as on
|
|
startup. Options are re-read from the configuration file. Instead of
|
|
sending this signal it is better to use
|
|
<DL COMPACT><DT id="73"><DD>
|
|
<PRE>
|
|
gpgconf --reload dirmngr
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="74"><B>SIGTERM</B>
|
|
|
|
<DD>
|
|
Shuts down the process but waits until all current requests are
|
|
fulfilled. If the process has received 3 of these signals and requests
|
|
are still pending, a shutdown is forced. You may also use
|
|
<DL COMPACT><DT id="75"><DD>
|
|
<PRE>
|
|
gpgconf --kill dirmngr
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
instead of this signal
|
|
<P>
|
|
<DT id="76"><B>SIGINT</B>
|
|
|
|
<DD>
|
|
Shuts down the process immediately.
|
|
<P>
|
|
<P>
|
|
<DT id="77"><B>SIGUSR1</B>
|
|
|
|
<DD>
|
|
This prints some caching statistics to the log file.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gpgsm">gpgsm</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?1+dirmngr-client">dirmngr-client</A></B>(1)
|
|
<P>
|
|
The full documentation for this tool is maintained as a Texinfo manual.
|
|
If GnuPG and the info program are properly installed at your site, the
|
|
command
|
|
<P>
|
|
<DL COMPACT><DT id="78"><DD>
|
|
<PRE>
|
|
info gnupg
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
should give you access to the complete manual including a menu structure
|
|
and an index.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="79"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="80"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="81"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="82"><A HREF="#lbAE">COMMANDS</A><DD>
|
|
<DT id="83"><A HREF="#lbAF">OPTIONS</A><DD>
|
|
<DT id="84"><A HREF="#lbAG">EXAMPLES</A><DD>
|
|
<DT id="85"><A HREF="#lbAH">FILES</A><DD>
|
|
<DT id="86"><A HREF="#lbAI">SIGNALS</A><DD>
|
|
<DT id="87"><A HREF="#lbAJ">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:11 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|