• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• COPYRIGHT

NAME

openssl-version, version - print OpenSSL version information

SYNOPSIS

openssl version [-help] [-a] [-v] [-b] [-o] [-f] [-p] [-d] [-e]

DESCRIPTION

This command is used to print out version information about OpenSSL.

OPTIONS

-help

Print out a usage message.

-a

All information, this is the same as setting all the other flags.

-v

The current OpenSSL version.

-b

The date the current version of OpenSSL was built.

-o

Option information: various options set when the library was built.

-f

Compilation flags.

-p

Platform setting.

-d

OPENSSLDIR setting.

-e

ENGINESDIR setting.

NOTES

The output of openssl version -a would typically be used when sending in a bug report.

COPYRIGHT

Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
  • OCSP Client Options
  • OCSP Server Options
• OCSP Response verification.
• NOTES
• EXAMPLES
• HISTORY
• COPYRIGHT

NAME

openssl-ocsp, ocsp - Online Certificate Status Protocol utility

SYNOPSIS

openssl ocsp [-help] [-out file] [-issuer file] [-cert file] [-serial n] [-signer file] [-signkey file] [-sign_other file] [-no_certs] [-req_text] [-resp_text] [-text] [-reqout file] [-respout file] [-reqin file] [-respin file] [-nonce] [-no_nonce] [-url URL] [-host host:port] [-multi process-count] [-header] [-path] [-CApath dir] [-CAfile file] [-no-CAfile] [-no-CApath] [-attime timestamp] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-no_check_time] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-VAfile file] [-validity_period n] [-status_age n] [-noverify] [-verify_other file] [-trust_other] [-no_intern] [-no_signature_verify] [-no_cert_verify] [-no_chain] [-no_cert_checks] [-no_explicit] [-port num] [-ignore_err] [-index file] [-CA file] [-rsigner file] [-rkey file] [-rother file] [-rsigopt nm:v] [-resp_no_certs] [-nmin n] [-ndays n] [-resp_key_id] [-nrequest n] [-digest]

DESCRIPTION

The Online Certificate Status Protocol (OCSP) enables applications to determine the (revocation) state of an identified certificate (RFC 2560).

The ocsp command performs many common OCSP tasks. It can be used to print out requests and responses, create requests and send queries to an OCSP responder and behave like a mini OCSP server itself.

OPTIONS

This command operates as either a client or a server. The options are described below, divided into those two modes.

OCSP Client Options

-help

Print out a usage message.

-out filename

specify output filename, default is standard output.

-issuer filename

This specifies the current issuer certificate. This option can be used multiple times. The certificate specified in filename must be in PEM format. This option MUST come before any -cert options.

-cert filename

Add the certificate filename to the request. The issuer certificate is taken from the previous issuer option, or an error occurs if no issuer certificate is specified.

-serial num

Same as the cert option except the certificate with serial number num is added to the request. The serial number is interpreted as a decimal integer unless preceded by 0x. Negative integers can also be specified by preceding the value by a - sign.

-signer filename, -signkey filename

Sign the OCSP request using the certificate specified in the signer option and the private key specified by the signkey option. If the signkey option is not present then the private key is read from the same file as the certificate. If neither option is specified then the OCSP request is not signed.

-sign_other filename

Additional certificates to include in the signed request.

-nonce, -no_nonce

Add an OCSP nonce extension to a request or disable OCSP nonce addition. Normally if an OCSP request is input using the reqin option no nonce is added: using the nonce option will force addition of a nonce. If an OCSP request is being created (using cert and serial options) a nonce is automatically added specifying no_nonce overrides this.

-req_text, -resp_text, -text

Print out the text form of the OCSP request, response or both respectively.

-reqout file, -respout file

Write out the DER encoded certificate request or response to file.

-reqin file, -respin file

Read OCSP request or response file from file. These option are ignored if OCSP request or response creation is implied by other options (for example with serial, cert and host options).

-url responder_url

Specify the responder URL. Both HTTP and HTTPS (SSL/TLS) URLs can be specified.

-host hostname:port, -path pathname

If the host option is present then the OCSP request is sent to the host hostname on port port. path specifies the HTTP pathname to use or "/" by default. This is equivalent to specifying -url with scheme http:// and the given hostname, port, and pathname.

-header name=value

Adds the header name with the specified value to the OCSP request that is sent to the responder. This may be repeated.

-timeout seconds

Connection timeout to the OCSP responder in seconds. On POSIX systems, when running as an OCSP responder, this option also limits the time that the responder is willing to wait for the client request. This time is measured from the time the responder accepts the connection until the complete request is received.

-multi process-count

Run the specified number of OCSP responder child processes, with the parent process respawning child processes as needed. Child processes will detect changes in the CA index file and automatically reload it. When running as a responder -timeout option is recommended to limit the time each child is willing to wait for the client's OCSP response. This option is available on POSIX systems (that support the fork() and other required unix system-calls).

-CAfile file, -CApath pathname

File or pathname containing trusted CA certificates. These are used to verify the signature on the OCSP response.

-no-CAfile

Do not load the trusted CA certificates from the default file location

-no-CApath

Do not load the trusted CA certificates from the default directory location

-attime, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -no_check_time, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict

Set different certificate verification options. See verify(1) manual page for details.

-verify_other file

File containing additional certificates to search when attempting to locate the OCSP response signing certificate. Some responders omit the actual signer's certificate from the response: this option can be used to supply the necessary certificate in such cases.

-trust_other

The certificates specified by the -verify_other option should be explicitly trusted and no additional checks will be performed on them. This is useful when the complete responder certificate chain is not available or trusting a root CA is not appropriate.

-VAfile file

File containing explicitly trusted responder certificates. Equivalent to the -verify_other and -trust_other options.

-noverify

Don't attempt to verify the OCSP response signature or the nonce values. This option will normally only be used for debugging since it disables all verification of the responders certificate.

-no_intern

Ignore certificates contained in the OCSP response when searching for the signers certificate. With this option the signers certificate must be specified with either the -verify_other or -VAfile options.

-no_signature_verify

Don't check the signature on the OCSP response. Since this option tolerates invalid signatures on OCSP responses it will normally only be used for testing purposes.

-no_cert_verify

Don't verify the OCSP response signers certificate at all. Since this option allows the OCSP response to be signed by any certificate it should only be used for testing purposes.

-no_chain

Do not use certificates in the response as additional untrusted CA certificates.

-no_explicit

Do not explicitly trust the root CA if it is set to be trusted for OCSP signing.

-no_cert_checks

Don't perform any additional checks on the OCSP response signers certificate. That is do not make any checks to see if the signers certificate is authorised to provide the necessary status information: as a result this option should only be used for testing purposes.

-validity_period nsec, -status_age age

These options specify the range of times, in seconds, which will be tolerated in an OCSP response. Each certificate status response includes a notBefore time and an optional notAfter time. The current time should fall between these two values, but the interval between the two times may be only a few seconds. In practice the OCSP responder and clients clocks may not be precisely synchronised and so such a check may fail. To avoid this the -validity_period option can be used to specify an acceptable error range in seconds, the default value is 5 minutes.

If the notAfter time is omitted from a response then this means that new status information is immediately available. In this case the age of the notBefore field is checked to see it is not older than age seconds old. By default this additional check is not performed.

-digest

This option sets digest algorithm to use for certificate identification in the OCSP request. Any digest supported by the OpenSSL dgst command can be used. The default is SHA-1. This option may be used multiple times to specify the digest used by subsequent certificate identifiers.

OCSP Server Options

-index indexfile

The indexfile parameter is the name of a text index file in ca format containing certificate revocation information.

If the index option is specified the ocsp utility is in responder mode, otherwise it is in client mode. The request(s) the responder processes can be either specified on the command line (using issuer and serial options), supplied in a file (using the reqin option) or via external OCSP clients (if port or url is specified).

If the index option is present then the CA and rsigner options must also be present.

-CA file

CA certificate corresponding to the revocation information in indexfile.

-rsigner file

The certificate to sign OCSP responses with.

-rother file

Additional certificates to include in the OCSP response.

-resp_no_certs

Don't include any certificates in the OCSP response.

-resp_key_id

Identify the signer certificate using the key ID, default is to use the subject name.

-rkey file

The private key to sign OCSP responses with: if not present the file specified in the rsigner option is used.

-rsigopt nm:v

Pass options to the signature algorithm when signing OCSP responses. Names and values of these options are algorithm-specific.

-port portnum

Port to listen for OCSP requests on. The port may also be specified using the url option.

-ignore_err

Ignore malformed requests or responses: When acting as an OCSP client, retry if a malformed response is received. When acting as an OCSP responder, continue running instead of terminating upon receiving a malformed request.

-nrequest number

The OCSP server will exit after receiving number requests, default unlimited.

-nmin minutes, -ndays days

Number of minutes or days when fresh revocation information is available: used in the nextUpdate field. If neither option is present then the nextUpdate field is omitted meaning fresh revocation information is immediately available.

OCSP Response verification.

OCSP Response follows the rules specified in RFC2560.

Initially the OCSP responder certificate is located and the signature on the OCSP request checked using the responder certificate's public key.

Then a normal certificate verify is performed on the OCSP responder certificate building up a certificate chain in the process. The locations of the trusted certificates used to build the chain can be specified by the CAfile and CApath options or they will be looked for in the standard OpenSSL certificates directory.

If the initial verify fails then the OCSP verify process halts with an error.

Otherwise the issuing CA certificate in the request is compared to the OCSP responder certificate: if there is a match then the OCSP verify succeeds.

Otherwise the OCSP responder certificate's CA is checked against the issuing CA certificate in the request. If there is a match and the OCSPSigning extended key usage is present in the OCSP responder certificate then the OCSP verify succeeds.

Otherwise, if -no_explicit is not set the root CA of the OCSP responders CA is checked to see if it is trusted for OCSP signing. If it is the OCSP verify succeeds.

If none of these checks is successful then the OCSP verify fails.

What this effectively means if that if the OCSP responder certificate is authorised directly by the CA it is issuing revocation information about (and it is correctly configured) then verification will succeed.

If the OCSP responder is a "global responder" which can give details about multiple CAs and has its own separate certificate chain then its root CA can be trusted for OCSP signing. For example:

 openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem

Alternatively the responder certificate itself can be explicitly trusted with the -VAfile option.

NOTES

As noted, most of the verify options are for testing or debugging purposes. Normally only the -CApath, -CAfile and (if the responder is a 'global VA') -VAfile options need to be used.

The OCSP server is only useful for test and demonstration purposes: it is not really usable as a full OCSP responder. It contains only a very simple HTTP request handling and can only handle the POST form of OCSP queries. It also handles requests serially meaning it cannot respond to new requests until it has processed the current one. The text index file format of revocation is also inefficient for large quantities of revocation data.

It is possible to run the ocsp application in responder mode via a CGI script using the reqin and respout options.

EXAMPLES

Create an OCSP request and write it to a file:

 openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem -reqout req.der

Send a query to an OCSP responder with URL http://ocsp.myhost.com/ save the response to a file, print it out in text form, and verify the response:

 openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \
     -url http://ocsp.myhost.com/ -resp_text -respout resp.der

Read in an OCSP response and print out text form:

 openssl ocsp -respin resp.der -text -noverify

OCSP server on port 8888 using a standard ca configuration, and a separate responder certificate. All requests and responses are printed to a file.

 openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
        -text -out log.txt

As above but exit after processing one request:

 openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
     -nrequest 1

Query status information using an internally generated request:

 openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
     -issuer demoCA/cacert.pem -serial 1

Query status information using request read from a file, and write the response to a second file.

 openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
     -reqin req.der -respout resp.der

HISTORY

The -no_alt_chains option was added in OpenSSL 1.1.0.

COPYRIGHT

Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• EXAMPLES
• NOTES
• RESTRICTIONS
• SEE ALSO
• COPYRIGHT

NAME

openssl-pkcs7, pkcs7 - PKCS#7 utility

SYNOPSIS

openssl pkcs7 [-help] [-inform PEM|DER] [-outform PEM|DER] [-in filename] [-out filename] [-print_certs] [-text] [-noout] [-engine id]

DESCRIPTION

The pkcs7 command processes PKCS#7 files in DER or PEM format.

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format. DER format is DER encoded PKCS#7 v1.5 structure.PEM (the default) is a base64 encoded version of the DER form with header and footer lines.

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read from or standard input if this option is not specified.

-out filename

Specifies the output filename to write to or standard output by default.

-print_certs

Prints out any certificates or CRLs contained in the file. They are preceded by their subject and issuer names in one line format.

-text

Prints out certificates details in full rather than just subject and issuer names.

-noout

Don't output the encoded version of the PKCS#7 structure (or certificates is -print_certs is set).

-engine id

Specifying an engine (by its unique id string) will cause pkcs7 to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

EXAMPLES

Convert a PKCS#7 file from PEM to DER:

 openssl pkcs7 -in file.pem -outform DER -out file.der

Output all certificates in a file:

 openssl pkcs7 -in file.pem -print_certs -out certs.pem

NOTES

The PEM PKCS#7 format uses the header and footer lines:

 -----BEGIN PKCS7-----
 -----END PKCS7-----

For compatibility with some CAs it will also accept:

 -----BEGIN CERTIFICATE-----
 -----END CERTIFICATE-----

RESTRICTIONS

There is no option to print out all the fields of a PKCS#7 file.

This PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC2315 they cannot currently parse, for example, the new CMS as described in RFC2630.

SEE ALSO

crl2pkcs7(1)

COPYRIGHT

Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• BUGS
• SEE ALSO
• COPYRIGHT

NAME

openssl-s_time, s_time - SSL/TLS performance timing program

SYNOPSIS

openssl s_time [-help] [-connect host:port] [-www page] [-cert filename] [-key filename] [-CApath directory] [-CAfile filename] [-no-CAfile] [-no-CApath] [-reuse] [-new] [-verify depth] [-nameopt option] [-time seconds] [-ssl3] [-bugs] [-cipher cipherlist] [-ciphersuites val]

DESCRIPTION

The s_time command implements a generic SSL/TLS client which connects to a remote host using SSL/TLS. It can request a page from the server and includes the time to transfer the payload data in its timing measurements. It measures the number of connections within a given timeframe, the amount of data transferred (if any), and calculates the average time spent for one connection.

OPTIONS

-help

Print out a usage message.

-connect host:port

This specifies the host and optional port to connect to.

-www page

This specifies the page to GET from the server. A value of '/' gets the index.htm[l] page. If this parameter is not specified, then s_time will only perform the handshake to establish SSL connections but not transfer any payload data.

-cert certname

The certificate to use, if one is requested by the server. The default is not to use a certificate. The file is in PEM format.

-key keyfile

The private key to use. If not specified then the certificate file will be used. The file is in PEM format.

-verify depth

The verify depth to use. This specifies the maximum length of the server certificate chain and turns on server certificate verification. Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure.

-nameopt option

Option which determines how the subject or issuer names are displayed. The option argument can be a single option or multiple options separated by commas. Alternatively the -nameopt switch may be used more than once to set multiple options. See the x509(1) manual page for details.

-CApath directory

The directory to use for server certificate verification. This directory must be in "hash format", see verify for more information. These are also used when building the client certificate chain.

-CAfile file

A file containing trusted certificates to use during server authentication and to use when attempting to build the client certificate chain.

-no-CAfile

Do not load the trusted CA certificates from the default file location

-no-CApath

Do not load the trusted CA certificates from the default directory location

-new

Performs the timing test using a new session ID for each connection. If neither -new nor -reuse are specified, they are both on by default and executed in sequence.

-reuse

Performs the timing test using the same session ID; this can be used as a test that session caching is working. If neither -new nor -reuse are specified, they are both on by default and executed in sequence.

-ssl3

This option disables the use of SSL version 3. By default the initial handshake uses a method which should be compatible with all servers and permit them to use SSL v3 or TLS as appropriate.

The timing program is not as rich in options to turn protocols on and off as the s_client(1) program and may not connect to all servers. Unfortunately there are a lot of ancient and broken servers in use which cannot handle this technique and will fail to connect. Some servers only work if TLS is turned off with the -ssl3 option.

Note that this option may not be available, depending on how OpenSSL was built.

-bugs

There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.

-cipher cipherlist

This allows the TLSv1.2 and below cipher list sent by the client to be modified. This list will be combined with any TLSv1.3 ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See ciphers(1) for more information.

-ciphersuites val

This allows the TLSv1.3 ciphersuites sent by the client to be modified. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See ciphers(1) for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.

-time length

Specifies how long (in seconds) s_time should establish connections and optionally transfer payload data from a server. Server and client performance and the link speed determine how many connections s_time can establish.

NOTES

s_time can be used to measure the performance of an SSL connection. To connect to an SSL HTTP server and get the default page the command

 openssl s_time -connect servername:443 -www / -CApath yourdir -CAfile yourfile.pem -cipher commoncipher [-ssl3]

would typically be used (https uses port 443). 'commoncipher' is a cipher to which both client and server can agree, see the ciphers(1) command for details.

If the handshake fails then there are several possible causes, if it is nothing obvious like no client certificate then the -bugs and -ssl3 options can be tried in case it is a buggy server. In particular you should play with these options before submitting a bug report to an OpenSSL mailing list.

A frequent problem when attempting to get client certificates working is that a web client complains it has no certificates or gives an empty list to choose from. This is normally because the server is not sending the clients certificate authority in its "acceptable CA list" when it requests a certificate. By using s_client(1) the CA list can be viewed and checked. However, some servers only request client authentication after a specific URL is requested. To obtain the list in this case it is necessary to use the -prexit option of s_client(1) and send an HTTP request for an appropriate page.

If a certificate is specified on the command line using the -cert option it will not be used unless the server specifically requests a client certificate. Therefore, merely including a client certificate on the command line is no guarantee that the certificate works.

BUGS

Because this program does not have all the options of the s_client(1) program to turn protocols on and off, you may not be able to measure the performance of all protocols with all servers.

The -verify option should really exit if the server verification fails.

SEE ALSO

s_client(1), s_server(1), ciphers(1)

COPYRIGHT

Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• ENVIRONMENT VARIABLES
• EXAMPLES
• SEE ALSO
• COPYRIGHT

NAME

openssl-tsget, tsget - Time Stamping HTTP/HTTPS client

SYNOPSIS

tsget -h server_url [-e extension] [-o output] [-v] [-d] [-k private_key.pem] [-p key_password] [-c client_cert.pem] [-C CA_certs.pem] [-P CA_path] [-r file:file...] [-g EGD_socket] [request]...

DESCRIPTION

The tsget command can be used for sending a timestamp request, as specified in RFC 3161, to a timestamp server over HTTP or HTTPS and storing the timestamp response in a file. This tool cannot be used for creating the requests and verifying responses, you can use the OpenSSL ts(1) command to do that. tsget can send several requests to the server without closing the TCP connection if more than one requests are specified on the command line.

The tool sends the following HTTP request for each timestamp request:

        POST url HTTP/1.1
        User-Agent: OpenTSA tsget.pl/<version>
        Host: <host>:<port>
        Pragma: no-cache
        Content-Type: application/timestamp-query
        Accept: application/timestamp-reply
        Content-Length: length of body

        ...binary request specified by the user...

tsget expects a response of type application/timestamp-reply, which is written to a file without any interpretation.

OPTIONS

-h server_url

The URL of the HTTP/HTTPS server listening for timestamp requests.

-e extension

If the -o option is not given this argument specifies the extension of the output files. The base name of the output file will be the same as those of the input files. Default extension is '.tsr'. (Optional)

-o output

This option can be specified only when just one request is sent to the server. The timestamp response will be written to the given output file. '-' means standard output. In case of multiple timestamp requests or the absence of this argument the names of the output files will be derived from the names of the input files and the default or specified extension argument. (Optional)

-v

The name of the currently processed request is printed on standard error. (Optional)

-d

Switches on verbose mode for the underlying curl library. You can see detailed debug messages for the connection. (Optional)

-k private_key.pem

(HTTPS) In case of certificate-based client authentication over HTTPS <private_key.pem> must contain the private key of the user. The private key file can optionally be protected by a passphrase. The -c option must also be specified. (Optional)

-p key_password

(HTTPS) Specifies the passphrase for the private key specified by the -k argument. If this option is omitted and the key is passphrase protected tsget will ask for it. (Optional)

-c client_cert.pem

(HTTPS) In case of certificate-based client authentication over HTTPS <client_cert.pem> must contain the X.509 certificate of the user. The -k option must also be specified. If this option is not specified no certificate-based client authentication will take place. (Optional)

-C CA_certs.pem

(HTTPS) The trusted CA certificate store. The certificate chain of the peer's certificate must include one of the CA certificates specified in this file. Either option -C or option -P must be given in case of HTTPS. (Optional)

-P CA_path

(HTTPS) The path containing the trusted CA certificates to verify the peer's certificate. The directory must be prepared with the c_rehash OpenSSL utility. Either option -C or option -P must be given in case of HTTPS. (Optional)

-rand file:file...

The files containing random data for seeding the random number generator. Multiple files can be specified, the separator is ; for MS-Windows, , for VMS and : for all other platforms. (Optional)

-g EGD_socket

The name of an EGD socket to get random data from. (Optional)

[request]...

List of files containing RFC 3161 DER-encoded timestamp requests. If no requests are specified only one request will be sent to the server and it will be read from the standard input. (Optional)

ENVIRONMENT VARIABLES

The TSGET environment variable can optionally contain default arguments. The content of this variable is added to the list of command line arguments.

EXAMPLES

The examples below presume that file1.tsq and file2.tsq contain valid timestamp requests, tsa.opentsa.org listens at port 8080 for HTTP requests and at port 8443 for HTTPS requests, the TSA service is available at the /tsa absolute path.

Get a timestamp response for file1.tsq over HTTP, output is written to file1.tsr:

  tsget -h http://tsa.opentsa.org:8080/tsa file1.tsq

Get a timestamp response for file1.tsq and file2.tsq over HTTP showing progress, output is written to file1.reply and file2.reply respectively:

  tsget -h http://tsa.opentsa.org:8080/tsa -v -e .reply \
        file1.tsq file2.tsq

Create a timestamp request, write it to file3.tsq, send it to the server and write the response to file3.tsr:

  openssl ts -query -data file3.txt -cert | tee file3.tsq \
        | tsget -h http://tsa.opentsa.org:8080/tsa \
        -o file3.tsr

Get a timestamp response for file1.tsq over HTTPS without client authentication:

  tsget -h https://tsa.opentsa.org:8443/tsa \
        -C cacerts.pem file1.tsq

Get a timestamp response for file1.tsq over HTTPS with certificate-based client authentication (it will ask for the passphrase if client_key.pem is protected):

  tsget -h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
        -k client_key.pem -c client_cert.pem file1.tsq

You can shorten the previous command line if you make use of the TSGET environment variable. The following commands do the same as the previous example:

  TSGET='-h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
        -k client_key.pem -c client_cert.pem'
  export TSGET
  tsget file1.tsq

SEE ALSO

openssl(1), ts(1), curl(1), RFC 3161

COPYRIGHT

Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• EXAMPLES
• SEE ALSO
• COPYRIGHT

NAME

openssl-ec, ec - EC key processing

SYNOPSIS

openssl ec [-help] [-inform PEM|DER] [-outform PEM|DER] [-in filename] [-passin arg] [-out filename] [-passout arg] [-des] [-des3] [-idea] [-text] [-noout] [-param_out] [-pubin] [-pubout] [-conv_form arg] [-param_enc arg] [-no_public] [-check] [-engine id]

DESCRIPTION

The ec command processes EC keys. They can be converted between various forms and their components printed out. Note OpenSSL uses the private key format specified in 'SEC 1: Elliptic Curve Cryptography' (http://www.secg.org/). To convert an OpenSSL EC private key into the PKCS#8 private key format use the pkcs8 command.

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format. The DER option with a private key uses an ASN.1 DER encoded SEC1 private key. When used with a public key it uses the SubjectPublicKeyInfo structure as specified in RFC 3280. The PEM form is the default format: it consists of the DER format base64 encoded with additional header and footer lines. In the case of a private key PKCS#8 format is also accepted.

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.

-passin arg

The input file password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-out filename

This specifies the output filename to write a key to or standard output by is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should not be the same as the input filename.

-passout arg

The output file password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-des|-des3|-idea

These options encrypt the private key with the DES, triple DES, IDEA or any other cipher supported by OpenSSL before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the ec utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.

-text

Prints out the public, private key components and parameters.

-noout

This option prevents output of the encoded version of the key.

-pubin

By default, a private key is read from the input file. With this option a public key is read instead.

-pubout

By default a private key is output. With this option a public key will be output instead. This option is automatically set if the input is a public key.

-conv_form

This specifies how the points on the elliptic curve are converted into octet strings. Possible values are: compressed (the default value), uncompressed and hybrid. For more information regarding the point conversion forms please read the X9.62 standard. Note Due to patent issues the compressed option is disabled by default for binary curves and can be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at compile time.

-param_enc arg

This specifies how the elliptic curve parameters are encoded. Possible value are: named_curve, i.e. the ec parameters are specified by an OID, or explicit where the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures). The default value is named_curve. Note the implicitlyCA alternative, as specified in RFC 3279, is currently not implemented in OpenSSL.

-no_public

This option omits the public key components from the private key output.

-check

This option checks the consistency of an EC private or public key.

-engine id

Specifying an engine (by its unique id string) will cause ec to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

NOTES

The PEM private key format uses the header and footer lines:

 -----BEGIN EC PRIVATE KEY-----
 -----END EC PRIVATE KEY-----

The PEM public key format uses the header and footer lines:

 -----BEGIN PUBLIC KEY-----
 -----END PUBLIC KEY-----

EXAMPLES

To encrypt a private key using triple DES:

 openssl ec -in key.pem -des3 -out keyout.pem

To convert a private key from PEM to DER format:

 openssl ec -in key.pem -outform DER -out keyout.der

To print out the components of a private key to standard output:

 openssl ec -in key.pem -text -noout

To just output the public part of a private key:

 openssl ec -in key.pem -pubout -out pubkey.pem

To change the parameters encoding to explicit:

 openssl ec -in key.pem -param_enc explicit -out keyout.pem

To change the point conversion form to compressed:

 openssl ec -in key.pem -conv_form compressed -out keyout.pem

SEE ALSO

ecparam(1), dsa(1), rsa(1)

COPYRIGHT

Copyright 2003-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• CONNECTED COMMANDS
• NOTES
• BUGS
• SEE ALSO
• HISTORY
• COPYRIGHT

NAME

openssl-s_server, s_server - SSL/TLS server program

SYNOPSIS

openssl s_server [-help] [-port +int] [-accept val] [-unix val] [-4] [-6] [-unlink] [-context val] [-verify int] [-Verify int] [-cert infile] [-nameopt val] [-naccept +int] [-serverinfo val] [-certform PEM|DER] [-key infile] [-keyform format] [-pass val] [-dcert infile] [-dcertform PEM|DER] [-dkey infile] [-dkeyform PEM|DER] [-dpass val] [-nbio_test] [-crlf] [-debug] [-msg] [-msgfile outfile] [-state] [-CAfile infile] [-CApath dir] [-no-CAfile] [-no-CApath] [-nocert] [-quiet] [-no_resume_ephemeral] [-www] [-WWW] [-servername] [-servername_fatal] [-cert2 infile] [-key2 infile] [-tlsextdebug] [-HTTP] [-id_prefix val] [-rand file...] [-writerand file] [-keymatexport val] [-keymatexportlen +int] [-CRL infile] [-crl_download] [-cert_chain infile] [-dcert_chain infile] [-chainCApath dir] [-verifyCApath dir] [-no_cache] [-ext_cache] [-CRLform PEM|DER] [-verify_return_error] [-verify_quiet] [-build_chain] [-chainCAfile infile] [-verifyCAfile infile] [-ign_eof] [-no_ign_eof] [-status] [-status_verbose] [-status_timeout int] [-status_url val] [-status_file infile] [-trace] [-security_debug] [-security_debug_verbose] [-brief] [-rev] [-async] [-ssl_config val] [-max_send_frag +int] [-split_send_frag +int] [-max_pipelines +int] [-read_buf +int] [-no_ssl3] [-no_tls1] [-no_tls1_1] [-no_tls1_2] [-no_tls1_3] [-bugs] [-no_comp] [-comp] [-no_ticket] [-num_tickets] [-serverpref] [-legacy_renegotiation] [-no_renegotiation] [-legacy_server_connect] [-no_resumption_on_reneg] [-no_legacy_server_connect] [-allow_no_dhe_kex] [-prioritize_chacha] [-strict] [-sigalgs val] [-client_sigalgs val] [-groups val] [-curves val] [-named_curve val] [-cipher val] [-ciphersuites val] [-dhparam infile] [-record_padding val] [-debug_broken_protocol] [-policy val] [-purpose val] [-verify_name val] [-verify_depth int] [-auth_level int] [-attime intmax] [-verify_hostname val] [-verify_email val] [-verify_ip] [-ignore_critical] [-issuer_checks] [-crl_check] [-crl_check_all] [-policy_check] [-explicit_policy] [-inhibit_any] [-inhibit_map] [-x509_strict] [-extended_crl] [-use_deltas] [-policy_print] [-check_ss_sig] [-trusted_first] [-suiteB_128_only] [-suiteB_128] [-suiteB_192] [-partial_chain] [-no_alt_chains] [-no_check_time] [-allow_proxy_certs] [-xkey] [-xcert] [-xchain] [-xchain_build] [-xcertform PEM|DER] [-xkeyform PEM|DER] [-nbio] [-psk_identity val] [-psk_hint val] [-psk val] [-psk_session file] [-srpvfile infile] [-srpuserseed val] [-ssl3] [-tls1] [-tls1_1] [-tls1_2] [-tls1_3] [-dtls] [-timeout] [-mtu +int] [-listen] [-dtls1] [-dtls1_2] [-sctp] [-sctp_label_bug] [-no_dhe] [-nextprotoneg val] [-use_srtp val] [-alpn val] [-engine val] [-keylogfile outfile] [-max_early_data int] [-early_data] [-anti_replay] [-no_anti_replay]

DESCRIPTION

The s_server command implements a generic SSL/TLS server which listens for connections on a given port using SSL/TLS.

OPTIONS

In addition to the options below the s_server utility also supports the common and server only options documented in the "Supported Command Line Commands" section of the SSL_CONF_cmd(3) manual page.

-help

Print out a usage message.

-port +int

The TCP port to listen on for connections. If not specified 4433 is used.

-accept val

The optional TCP host and port to listen on for connections. If not specified, *:4433 is used.

-unix val

Unix domain socket to accept on.

-4

Use IPv4 only.

-6

Use IPv6 only.

-unlink

For -unix, unlink any existing socket first.

-context val

Sets the SSL context id. It can be given any string value. If this option is not present a default value will be used.

-verify int, -Verify int

The verify depth to use. This specifies the maximum length of the client certificate chain and makes the server request a certificate from the client. With the -verify option a certificate is requested but the client does not have to send one, with the -Verify option the client must supply a certificate or an error occurs.

If the cipher suite cannot request a client certificate (for example an anonymous cipher suite or PSK) this option has no effect.

-cert infile

The certificate to use, most servers cipher suites require the use of a certificate and some require a certificate with a certain public key type: for example the DSS cipher suites require a certificate containing a DSS (DSA) key. If not specified then the filename "server.pem" will be used.

-cert_chain

A file containing trusted certificates to use when attempting to build the client/server certificate chain related to the certificate specified via the -cert option.

-build_chain

Specify whether the application should build the certificate chain to be provided to the client.

-nameopt val

Option which determines how the subject or issuer names are displayed. The val argument can be a single option or multiple options separated by commas. Alternatively the -nameopt switch may be used more than once to set multiple options. See the x509(1) manual page for details.

-naccept +int

The server will exit after receiving the specified number of connections, default unlimited.

-serverinfo val

A file containing one or more blocks of PEM data. Each PEM block must encode a TLS ServerHello extension (2 bytes type, 2 bytes length, followed by "length" bytes of extension data). If the client sends an empty TLS ClientHello extension matching the type, the corresponding ServerHello extension will be returned.

-certform PEM|DER

The certificate format to use: DER or PEM. PEM is the default.

-key infile

The private key to use. If not specified then the certificate file will be used.

-keyform format

The private format to use: DER or PEM. PEM is the default.

-pass val

The private key password source. For more information about the format of val see "Pass Phrase Options" in openssl(1).

-dcert infile, -dkey infile

Specify an additional certificate and private key, these behave in the same manner as the -cert and -key options except there is no default if they are not specified (no additional certificate and key is used). As noted above some cipher suites require a certificate containing a key of a certain type. Some cipher suites need a certificate carrying an RSA key and some a DSS (DSA) key. By using RSA and DSS certificates and keys a server can support clients which only support RSA or DSS cipher suites by using an appropriate certificate.

-dcert_chain

A file containing trusted certificates to use when attempting to build the server certificate chain when a certificate specified via the -dcert option is in use.

-dcertform PEM|DER, -dkeyform PEM|DER, -dpass val

Additional certificate and private key format and passphrase respectively.

-xkey infile, -xcert infile, -xchain

Specify an extra certificate, private key and certificate chain. These behave in the same manner as the -cert, -key and -cert_chain options. When specified, the callback returning the first valid chain will be in use by the server.

-xchain_build

Specify whether the application should build the certificate chain to be provided to the client for the extra certificates provided via -xkey infile, -xcert infile, -xchain options.

-xcertform PEM|DER, -xkeyform PEM|DER

Extra certificate and private key format respectively.

-nbio_test

Tests non blocking I/O.

-crlf

This option translated a line feed from the terminal into CR+LF.

-debug

Print extensive debugging information including a hex dump of all traffic.

-msg

Show all protocol messages with hex dump.

-msgfile outfile

File to send output of -msg or -trace to, default standard output.

-state

Prints the SSL session states.

-CAfile infile

A file containing trusted certificates to use during client authentication and to use when attempting to build the server certificate chain. The list is also used in the list of acceptable client CAs passed to the client when a certificate is requested.

-CApath dir

The directory to use for client certificate verification. This directory must be in "hash format", see verify(1) for more information. These are also used when building the server certificate chain.

-chainCApath dir

The directory to use for building the chain provided to the client. This directory must be in "hash format", see verify(1) for more information.

-chainCAfile file

A file containing trusted certificates to use when attempting to build the server certificate chain.

-no-CAfile

Do not load the trusted CA certificates from the default file location.

-no-CApath

Do not load the trusted CA certificates from the default directory location.

-nocert

If this option is set then no certificate is used. This restricts the cipher suites available to the anonymous ones (currently just anonymous DH).

-quiet

Inhibit printing of session and certificate information.

-www

Sends a status message back to the client when it connects. This includes information about the ciphers used and various session parameters. The output is in HTML format so this option will normally be used with a web browser. Cannot be used in conjunction with -early_data.

-WWW

Emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be loaded. Cannot be used in conjunction with -early_data.

-tlsextdebug

Print a hex dump of any TLS extensions received from the server.

-HTTP

Emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be loaded. The files loaded are assumed to contain a complete and correct HTTP response (lines that are part of the HTTP response line and headers must end with CRLF). Cannot be used in conjunction with -early_data.

-id_prefix val

Generate SSL/TLS session IDs prefixed by val. This is mostly useful for testing any SSL/TLS code (e.g. proxies) that wish to deal with multiple servers, when each of which might be generating a unique range of session IDs (e.g. with a certain prefix).

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

-verify_return_error

Verification errors normally just print a message but allow the connection to continue, for debugging purposes. If this option is used, then verification errors close the connection.

-status

Enables certificate status request support (aka OCSP stapling).

-status_verbose

Enables certificate status request support (aka OCSP stapling) and gives a verbose printout of the OCSP response.

-status_timeout int

Sets the timeout for OCSP response to int seconds.

-status_url val

Sets a fallback responder URL to use if no responder URL is present in the server certificate. Without this option an error is returned if the server certificate does not contain a responder address.

-status_file infile

Overrides any OCSP responder URLs from the certificate and always provides the OCSP Response stored in the file. The file must be in DER format.

-trace

Show verbose trace output of protocol messages. OpenSSL needs to be compiled with enable-ssl-trace for this option to work.

-brief

Provide a brief summary of connection parameters instead of the normal verbose output.

-rev

Simple test server which just reverses the text received from the client and sends it back to the server. Also sets -brief. Cannot be used in conjunction with -early_data.

-async

Switch on asynchronous mode. Cryptographic operations will be performed asynchronously. This will only have an effect if an asynchronous capable engine is also used via the -engine option. For test purposes the dummy async engine (dasync) can be used (if available).

-max_send_frag +int

The maximum size of data fragment to send. See SSL_CTX_set_max_send_fragment(3) for further information.

-split_send_frag +int

The size used to split data for encrypt pipelines. If more data is written in one go than this value then it will be split into multiple pipelines, up to the maximum number of pipelines defined by max_pipelines. This only has an effect if a suitable cipher suite has been negotiated, an engine that supports pipelining has been loaded, and max_pipelines is greater than 1. See SSL_CTX_set_split_send_fragment(3) for further information.

-max_pipelines +int

The maximum number of encrypt/decrypt pipelines to be used. This will only have an effect if an engine has been loaded that supports pipelining (e.g. the dasync engine) and a suitable cipher suite has been negotiated. The default value is 1. See SSL_CTX_set_max_pipelines(3) for further information.

-read_buf +int

The default read buffer size to be used for connections. This will only have an effect if the buffer size is larger than the size that would otherwise be used and pipelining is in use (see SSL_CTX_set_default_read_buffer_len(3) for further information).

-ssl2, -ssl3, -tls1, -tls1_1, -tls1_2, -tls1_3, -no_ssl2, -no_ssl3, -no_tls1, -no_tls1_1, -no_tls1_2, -no_tls1_3

These options require or disable the use of the specified SSL or TLS protocols. By default s_server will negotiate the highest mutually supported protocol version. When a specific TLS version is required, only that version will be accepted from the client. Note that not all protocols and flags may be available, depending on how OpenSSL was built.

-bugs

There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.

-no_comp

Disable negotiation of TLS compression. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.

-comp

Enable negotiation of TLS compression. This option was introduced in OpenSSL 1.1.0. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.

-no_ticket

Disable RFC4507bis session ticket support. This option has no effect if TLSv1.3 is negotiated. See -num_tickets.

-num_tickets

Control the number of tickets that will be sent to the client after a full handshake in TLSv1.3. The default number of tickets is 2. This option does not affect the number of tickets sent after a resumption handshake.

-serverpref

Use the server's cipher preferences, rather than the client's preferences.

-prioritize_chacha

Prioritize ChaCha ciphers when preferred by clients. Requires -serverpref.

-no_resumption_on_reneg

Set the SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION option.

-client_sigalgs val

Signature algorithms to support for client certificate authentication (colon-separated list).

-named_curve val

Specifies the elliptic curve to use. NOTE: this is single curve, not a list. For a list of all possible curves, use:

    $ openssl ecparam -list_curves

-cipher val

This allows the list of TLSv1.2 and below ciphersuites used by the server to be modified. This list is combined with any TLSv1.3 ciphersuites that have been configured. When the client sends a list of supported ciphers the first client cipher also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist is irrelevant. See the ciphers command for more information.

-ciphersuites val

This allows the list of TLSv1.3 ciphersuites used by the server to be modified. This list is combined with any TLSv1.2 and below ciphersuites that have been configured. When the client sends a list of supported ciphers the first client cipher also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist is irrelevant. See the ciphers command for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.

-dhparam infile

The DH parameter file to use. The ephemeral DH cipher suites generate keys using a set of DH parameters. If not specified then an attempt is made to load the parameters from the server certificate file. If this fails then a static set of parameters hard coded into the s_server program will be used.

-attime, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -no_check_time, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict

Set different peer certificate verification options. See the verify(1) manual page for details.

-crl_check, -crl_check_all

Check the peer certificate has not been revoked by its CA. The CRL(s) are appended to the certificate file. With the -crl_check_all option all CRLs of all CAs in the chain are checked.

-nbio

Turns on non blocking I/O.

-psk_identity val

Expect the client to send PSK identity val when using a PSK cipher suite, and warn if they do not. By default, the expected PSK identity is the string "Client_identity".

-psk_hint val

Use the PSK identity hint val when using a PSK cipher suite.

-psk val

Use the PSK key val when using a PSK cipher suite. The key is given as a hexadecimal number without leading 0x, for example -psk 1a2b3c4d. This option must be provided in order to use a PSK cipher.

-psk_session file

Use the pem encoded SSL_SESSION data stored in file as the basis of a PSK. Note that this will only work if TLSv1.3 is negotiated.

-listen

This option can only be used in conjunction with one of the DTLS options above. With this option s_server will listen on a UDP port for incoming connections. Any ClientHellos that arrive will be checked to see if they have a cookie in them or not. Any without a cookie will be responded to with a HelloVerifyRequest. If a ClientHello with a cookie is received then s_server will connect to that peer and complete the handshake.

-dtls, -dtls1, -dtls1_2

These options make s_server use DTLS protocols instead of TLS. With -dtls, s_server will negotiate any supported DTLS protocol version, whilst -dtls1 and -dtls1_2 will only support DTLSv1.0 and DTLSv1.2 respectively.

-sctp

Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in conjunction with -dtls, -dtls1 or -dtls1_2. This option is only available where OpenSSL has support for SCTP enabled.

-sctp_label_bug

Use the incorrect behaviour of older OpenSSL implementations when computing endpoint-pair shared secrets for DTLS/SCTP. This allows communication with older broken implementations but breaks interoperability with correct implementations. Must be used in conjunction with -sctp. This option is only available where OpenSSL has support for SCTP enabled.

-no_dhe

If this option is set then no DH parameters will be loaded effectively disabling the ephemeral DH cipher suites.

-alpn val, -nextprotoneg val

These flags enable the Application-Layer Protocol Negotiation or Next Protocol Negotiation (NPN) extension, respectively. ALPN is the IETF standard and replaces NPN. The val list is a comma-separated list of supported protocol names. The list should contain the most desirable protocols first. Protocol names are printable ASCII strings, for example "http/1.1" or "spdy/3". The flag -nextprotoneg cannot be specified if -tls1_3 is used.

-engine val

Specifying an engine (by its unique id string in val) will cause s_server to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

-keylogfile outfile

Appends TLS secrets to the specified keylog file such that external programs (like Wireshark) can decrypt TLS connections.

-max_early_data int

Change the default maximum early data bytes that are specified for new sessions and any incoming early data (when used in conjunction with the -early_data flag). The default value is approximately 16k. The argument must be an integer greater than or equal to 0.

-early_data

Accept early data where possible. Cannot be used in conjunction with -www, -WWW, -HTTP or -rev.

-anti_replay, -no_anti_replay

Switches replay protection on or off, respectively. Replay protection is on by default unless overridden by a configuration file. When it is on, OpenSSL will automatically detect if a session ticket has been used more than once, TLSv1.3 has been negotiated, and early data is enabled on the server. A full handshake is forced if a session ticket is used a second or subsequent time. Any early data that was sent will be rejected.

CONNECTED COMMANDS

If a connection request is established with an SSL client and neither the -www nor the -WWW option has been used then normally any data received from the client is displayed and any key presses will be sent to the client.

Certain commands are also recognized which perform special operations. These commands are a letter which must appear at the start of a line. They are listed below.

q

End the current SSL connection but still accept new connections.

Q

End the current SSL connection and exit.

r

Renegotiate the SSL session (TLSv1.2 and below only).

R

Renegotiate the SSL session and request a client certificate (TLSv1.2 and below only).

P

Send some plain text down the underlying TCP connection: this should cause the client to disconnect due to a protocol violation.

S

Print out some session cache status information.

B

Send a heartbeat message to the client (DTLS only)

k

Send a key update message to the client (TLSv1.3 only)

K

Send a key update message to the client and request one back (TLSv1.3 only)

c

Send a certificate request to the client (TLSv1.3 only)

NOTES

s_server can be used to debug SSL clients. To accept connections from a web browser the command:

 openssl s_server -accept 443 -www

can be used for example.

Although specifying an empty list of CAs when requesting a client certificate is strictly speaking a protocol violation, some SSL clients interpret this to mean any CA is acceptable. This is useful for debugging purposes.

The session parameters can printed out using the sess_id program.

BUGS

Because this program has a lot of options and also because some of the techniques used are rather old, the C source of s_server is rather hard to read and not a model of how things should be done. A typical SSL server program would be much simpler.

The output of common ciphers is wrong: it just gives the list of ciphers that OpenSSL recognizes and the client supports.

There should be a way for the s_server program to print out details of any unknown cipher suites a client says it supports.

SEE ALSO

SSL_CONF_cmd(3), sess_id(1), s_client(1), ciphers(1) SSL_CTX_set_max_send_fragment(3), SSL_CTX_set_split_send_fragment(3), SSL_CTX_set_max_pipelines(3)

HISTORY

The -no_alt_chains option was added in OpenSSL 1.1.0.

The -allow-no-dhe-kex and -prioritize_chacha options were added in OpenSSL 1.1.1.

COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• EXIT CODES
• COMPATIBILITY WITH PKCS#7 format.
• EXAMPLES
• BUGS
• HISTORY
• COPYRIGHT

NAME

openssl-cms, cms - CMS utility

SYNOPSIS

openssl cms [-help] [-encrypt] [-decrypt] [-sign] [-verify] [-cmsout] [-resign] [-data_create] [-data_out] [-digest_create] [-digest_verify] [-compress] [-uncompress] [-EncryptedData_encrypt] [-sign_receipt] [-verify_receipt receipt] [-in filename] [-inform SMIME|PEM|DER] [-rctform SMIME|PEM|DER] [-out filename] [-outform SMIME|PEM|DER] [-stream -indef -noindef] [-noindef] [-content filename] [-text] [-noout] [-print] [-CAfile file] [-CApath dir] [-no-CAfile] [-no-CApath] [-attime timestamp] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-no_check_time] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-md digest] [-cipher] [-nointern] [-noverify] [-nocerts] [-noattr] [-nosmimecap] [-binary] [-crlfeol] [-asciicrlf] [-nodetach] [-certfile file] [-certsout file] [-signer file] [-recip file] [-keyid] [-receipt_request_all] [-receipt_request_first] [-receipt_request_from emailaddress] [-receipt_request_to emailaddress] [-receipt_request_print] [-secretkey key] [-secretkeyid id] [-econtent_type type] [-inkey file] [-keyopt name:parameter] [-passin arg] [-rand file...] [-writerand file] [cert.pem...] [-to addr] [-from addr] [-subject subj] [cert.pem]...

DESCRIPTION

The cms command handles S/MIME v3.1 mail. It can encrypt, decrypt, sign and verify, compress and uncompress S/MIME messages.

OPTIONS

There are fourteen operation options that set the type of operation to be performed. The meaning of the other options varies according to the operation type.

-help

Print out a usage message.

-encrypt

Encrypt mail for the given recipient certificates. Input file is the message to be encrypted. The output file is the encrypted mail in MIME format. The actual CMS type is <B>EnvelopedData<B>.

Note that no revocation check is done for the recipient cert, so if that key has been compromised, others may be able to decrypt the text.

-decrypt

Decrypt mail using the supplied certificate and private key. Expects an encrypted mail message in MIME format for the input file. The decrypted mail is written to the output file.

-debug_decrypt

This option sets the CMS_DEBUG_DECRYPT flag. This option should be used with caution: see the notes section below.

-sign

Sign mail using the supplied certificate and private key. Input file is the message to be signed. The signed message in MIME format is written to the output file.

-verify

Verify signed mail. Expects a signed mail message on input and outputs the signed data. Both clear text and opaque signing is supported.

-cmsout

Takes an input message and writes out a PEM encoded CMS structure.

-resign

Resign a message: take an existing message and one or more new signers.

-data_create

Create a CMS Data type.

-data_out

Data type and output the content.

-digest_create

Create a CMS DigestedData type.

-digest_verify

Verify a CMS DigestedData type and output the content.

-compress

Create a CMS CompressedData type. OpenSSL must be compiled with zlib support for this option to work, otherwise it will output an error.

-uncompress

Uncompress a CMS CompressedData type and output the content. OpenSSL must be compiled with zlib support for this option to work, otherwise it will output an error.

-EncryptedData_encrypt

Encrypt content using supplied symmetric key and algorithm using a CMS EncryptedData type and output the content.

-sign_receipt

Generate and output a signed receipt for the supplied message. The input message must contain a signed receipt request. Functionality is otherwise similar to the -sign operation.

-verify_receipt receipt

Verify a signed receipt in filename receipt. The input message must contain the original receipt request. Functionality is otherwise similar to the -verify operation.

-in filename

The input message to be encrypted or signed or the message to be decrypted or verified.

-inform SMIME|PEM|DER

This specifies the input format for the CMS structure. The default is SMIME which reads an S/MIME format message. PEM and DER format change this to expect PEM and DER format CMS structures instead. This currently only affects the input format of the CMS structure, if no CMS structure is being input (for example with -encrypt or -sign) this option has no effect.

-rctform SMIME|PEM|DER

Specify the format for a signed receipt for use with the -receipt_verify operation.

-out filename

The message text that has been decrypted or verified or the output MIME format message that has been signed or verified.

-outform SMIME|PEM|DER

This specifies the output format for the CMS structure. The default is SMIME which writes an S/MIME format message. PEM and DER format change this to write PEM and DER format CMS structures instead. This currently only affects the output format of the CMS structure, if no CMS structure is being output (for example with -verify or -decrypt) this option has no effect.

-stream -indef -noindef

The -stream and -indef options are equivalent and enable streaming I/O for encoding operations. This permits single pass processing of data without the need to hold the entire contents in memory, potentially supporting very large files. Streaming is automatically set for S/MIME signing with detached data if the output format is SMIME it is currently off by default for all other operations.

-noindef

Disable streaming I/O where it would produce and indefinite length constructed encoding. This option currently has no effect. In future streaming will be enabled by default on all relevant operations and this option will disable it.

-content filename

This specifies a file containing the detached content, this is only useful with the -verify command. This is only usable if the CMS structure is using the detached signature form where the content is not included. This option will override any content if the input format is S/MIME and it uses the multipart/signed MIME content type.

-text

This option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs.

-noout

For the -cmsout operation do not output the parsed CMS structure. This is useful when combined with the -print option or if the syntax of the CMS structure is being checked.

-print

For the -cmsout operation print out all fields of the CMS structure. This is mainly useful for testing purposes.

-CAfile file

A file containing trusted CA certificates, only used with -verify.

-CApath dir

A directory containing trusted CA certificates, only used with -verify. This directory must be a standard certificate directory: that is a hash of each subject name (using x509 -hash) should be linked to each certificate.

-no-CAfile

Do not load the trusted CA certificates from the default file location

-no-CApath

Do not load the trusted CA certificates from the default directory location

-md digest

Digest algorithm to use when signing or resigning. If not present then the default digest algorithm for the signing key will be used (usually SHA1).

-cipher

The encryption algorithm to use. For example triple DES (168 bits) - -des3 or 256 bit AES - -aes256. Any standard algorithm name (as used by the EVP_get_cipherbyname() function) can also be used preceded by a dash, for example -aes-128-cbc. See enc(1) for a list of ciphers supported by your version of OpenSSL.

If not specified triple DES is used. Only used with -encrypt and -EncryptedData_create commands.

-nointern

When verifying a message normally certificates (if any) included in the message are searched for the signing certificate. With this option only the certificates specified in the -certfile option are used. The supplied certificates can still be used as untrusted CAs however.

-noverify

Do not verify the signers certificate of a signed message.

-nocerts

When signing a message the signer's certificate is normally included with this option it is excluded. This will reduce the size of the signed message but the verifier must have a copy of the signers certificate available locally (passed using the -certfile option for example).

-noattr

Normally when a message is signed a set of attributes are included which include the signing time and supported symmetric algorithms. With this option they are not included.

-nosmimecap

Exclude the list of supported algorithms from signed attributes, other options such as signing time and content type are still included.

-binary

Normally the input message is converted to "canonical" format which is effectively using CR and LF as end of line: as required by the S/MIME specification. When this option is present no translation occurs. This is useful when handling binary data which may not be in MIME format.

-crlfeol

Normally the output file uses a single LF as end of line. When this option is present CRLF is used instead.

-asciicrlf

When signing use ASCII CRLF format canonicalisation. This strips trailing whitespace from all lines, deletes trailing blank lines at EOF and sets the encapsulated content type. This option is normally used with detached content and an output signature format of DER. This option is not normally needed when verifying as it is enabled automatically if the encapsulated content format is detected.

-nodetach

When signing a message use opaque signing: this form is more resistant to translation by mail relays but it cannot be read by mail agents that do not support S/MIME. Without this option cleartext signing with the MIME type multipart/signed is used.

-certfile file

Allows additional certificates to be specified. When signing these will be included with the message. When verifying these will be searched for the signers certificates. The certificates should be in PEM format.

-certsout file

Any certificates contained in the message are written to file.

-signer file

A signing certificate when signing or resigning a message, this option can be used multiple times if more than one signer is required. If a message is being verified then the signers certificates will be written to this file if the verification was successful.

-recip file

When decrypting a message this specifies the recipients certificate. The certificate must match one of the recipients of the message or an error occurs.

When encrypting a message this option may be used multiple times to specify each recipient. This form must be used if customised parameters are required (for example to specify RSA-OAEP).

Only certificates carrying RSA, Diffie-Hellman or EC keys are supported by this option.

-keyid

Use subject key identifier to identify certificates instead of issuer name and serial number. The supplied certificate must include a subject key identifier extension. Supported by -sign and -encrypt options.

-receipt_request_all, -receipt_request_first

For -sign option include a signed receipt request. Indicate requests should be provided by all recipient or first tier recipients (those mailed directly and not from a mailing list). Ignored it -receipt_request_from is included.

-receipt_request_from emailaddress

For -sign option include a signed receipt request. Add an explicit email address where receipts should be supplied.

-receipt_request_to emailaddress

Add an explicit email address where signed receipts should be sent to. This option must but supplied if a signed receipt it requested.

-receipt_request_print

For the -verify operation print out the contents of any signed receipt requests.

-secretkey key

Specify symmetric key to use. The key must be supplied in hex format and be consistent with the algorithm used. Supported by the -EncryptedData_encrypt -EncryptedData_decrypt, -encrypt and -decrypt options. When used with -encrypt or -decrypt the supplied key is used to wrap or unwrap the content encryption key using an AES key in the KEKRecipientInfo type.

-secretkeyid id

The key identifier for the supplied symmetric key for KEKRecipientInfo type. This option must be present if the -secretkey option is used with -encrypt. With -decrypt operations the id is used to locate the relevant key if it is not supplied then an attempt is used to decrypt any KEKRecipientInfo structures.

-econtent_type type

Set the encapsulated content type to type if not supplied the Data type is used. The type argument can be any valid OID name in either text or numerical format.

-inkey file

The private key to use when signing or decrypting. This must match the corresponding certificate. If this option is not specified then the private key must be included in the certificate file specified with the -recip or -signer file. When signing this option can be used multiple times to specify successive keys.

-keyopt name:opt

For signing and encryption this option can be used multiple times to set customised parameters for the preceding key or certificate. It can currently be used to set RSA-PSS for signing, RSA-OAEP for encryption or to modify default parameters for ECDH.

-passin arg

The private key password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

cert.pem...

One or more certificates of message recipients: used when encrypting a message.

-to, -from, -subject

The relevant mail headers. These are included outside the signed portion of a message so they may be included manually. If signing then many S/MIME mail clients check the signers certificate's email address matches that specified in the From: address.

-attime, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -no_check_time, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict

Set various certificate chain validation options. See the verify(1) manual page for details.

NOTES

The MIME message must be sent without any blank lines between the headers and the output. Some mail programs will automatically add a blank line. Piping the mail directly to sendmail is one way to achieve the correct format.

The supplied message to be signed or encrypted must include the necessary MIME headers or many S/MIME clients won't display it properly (if at all). You can use the -text option to automatically add plain text headers.

A "signed and encrypted" message is one where a signed message is then encrypted. This can be produced by encrypting an already signed message: see the examples section.

This version of the program only allows one signer per message but it will verify multiple signers on received messages. Some S/MIME clients choke if a message contains multiple signers. It is possible to sign messages "in parallel" by signing an already signed message.

The options -encrypt and -decrypt reflect common usage in S/MIME clients. Strictly speaking these process CMS enveloped data: CMS encrypted data is used for other purposes.

The -resign option uses an existing message digest when adding a new signer. This means that attributes must be present in at least one existing signer using the same message digest or this operation will fail.

The -stream and -indef options enable streaming I/O support. As a result the encoding is BER using indefinite length constructed encoding and no longer DER. Streaming is supported for the -encrypt operation and the -sign operation if the content is not detached.

Streaming is always used for the -sign operation with detached data but since the content is no longer part of the CMS structure the encoding remains DER.

If the -decrypt option is used without a recipient certificate then an attempt is made to locate the recipient by trying each potential recipient in turn using the supplied private key. To thwart the MMA attack (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) all recipients are tried whether they succeed or not and if no recipients match the message is "decrypted" using a random key which will typically output garbage. The -debug_decrypt option can be used to disable the MMA attack protection and return an error if no recipient can be found: this option should be used with caution. For a fuller description see CMS_decrypt(3)).

EXIT CODES

0

The operation was completely successfully.

1

An error occurred parsing the command options.

2

One of the input files could not be read.

3

An error occurred creating the CMS file or when reading the MIME message.

4

An error occurred decrypting or verifying the message.

5

The message was verified correctly but an error occurred writing out the signers certificates.

COMPATIBILITY WITH PKCS#7 format.

The smime utility can only process the older PKCS#7 format. The cms utility supports Cryptographic Message Syntax format. Use of some features will result in messages which cannot be processed by applications which only support the older format. These are detailed below.

The use of the -keyid option with -sign or -encrypt.

The -outform PEM option uses different headers.

The -compress option.

The -secretkey option when used with -encrypt.

The use of PSS with -sign.

The use of OAEP or non-RSA keys with -encrypt.

Additionally the -EncryptedData_create and -data_create type cannot be processed by the older smime command.

EXAMPLES

Create a cleartext signed message:

 openssl cms -sign -in message.txt -text -out mail.msg \
        -signer mycert.pem

Create an opaque signed message

 openssl cms -sign -in message.txt -text -out mail.msg -nodetach \
        -signer mycert.pem

Create a signed message, include some additional certificates and read the private key from another file:

 openssl cms -sign -in in.txt -text -out mail.msg \
        -signer mycert.pem -inkey mykey.pem -certfile mycerts.pem

Create a signed message with two signers, use key identifier:

 openssl cms -sign -in message.txt -text -out mail.msg \
        -signer mycert.pem -signer othercert.pem -keyid

Send a signed message under Unix directly to sendmail, including headers:

 openssl cms -sign -in in.txt -text -signer mycert.pem \
        -from steve@openssl.org -to someone@somewhere \
        -subject "Signed message" | sendmail someone@somewhere

Verify a message and extract the signer's certificate if successful:

 openssl cms -verify -in mail.msg -signer user.pem -out signedtext.txt

Send encrypted mail using triple DES:

 openssl cms -encrypt -in in.txt -from steve@openssl.org \
        -to someone@somewhere -subject "Encrypted message" \
        -des3 user.pem -out mail.msg

Sign and encrypt mail:

 openssl cms -sign -in ml.txt -signer my.pem -text \
        | openssl cms -encrypt -out mail.msg \
        -from steve@openssl.org -to someone@somewhere \
        -subject "Signed and Encrypted message" -des3 user.pem

Note: the encryption command does not include the -text option because the message being encrypted already has MIME headers.

Decrypt mail:

 openssl cms -decrypt -in mail.msg -recip mycert.pem -inkey key.pem

The output from Netscape form signing is a PKCS#7 structure with the detached signature format. You can use this program to verify the signature by line wrapping the base64 encoded structure and surrounding it with:

 -----BEGIN PKCS7-----
 -----END PKCS7-----

and using the command,

 openssl cms -verify -inform PEM -in signature.pem -content content.txt

alternatively you can base64 decode the signature and use

 openssl cms -verify -inform DER -in signature.der -content content.txt

Create an encrypted message using 128 bit Camellia:

 openssl cms -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem

Add a signer to an existing message:

 openssl cms -resign -in mail.msg -signer newsign.pem -out mail2.msg

Sign mail using RSA-PSS:

 openssl cms -sign -in message.txt -text -out mail.msg \
        -signer mycert.pem -keyopt rsa_padding_mode:pss

Create encrypted mail using RSA-OAEP:

 openssl cms -encrypt -in plain.txt -out mail.msg \
        -recip cert.pem -keyopt rsa_padding_mode:oaep

Use SHA256 KDF with an ECDH certificate:

 openssl cms -encrypt -in plain.txt -out mail.msg \
        -recip ecdhcert.pem -keyopt ecdh_kdf_md:sha256

BUGS

The MIME parser isn't very clever: it seems to handle most messages that I've thrown at it but it may choke on others.

The code currently will only write out the signer's certificate to a file: if the signer has a separate encryption certificate this must be manually extracted. There should be some heuristic that determines the correct encryption certificate.

Ideally a database should be maintained of a certificates for each email address.

The code doesn't currently take note of the permitted symmetric encryption algorithms as supplied in the SMIMECapabilities signed attribute. this means the user has to manually include the correct encryption algorithm. It should store the list of permitted ciphers in a database and only use those.

No revocation checking is done on the signer's certificate.

The -binary option does not work correctly when processing text input which (contrary to the S/MIME specification) uses LF rather than CRLF line endings.

HISTORY

The use of multiple -signer options and the -resign command were first added in OpenSSL 1.0.0.

The keyopt option was added in OpenSSL 1.0.2.

Support for RSA-OAEP and RSA-PSS was added in OpenSSL 1.0.2.

The use of non-RSA keys with -encrypt and -decrypt was added in OpenSSL 1.0.2.

The -no_alt_chains option was added in OpenSSL 1.0.2b.

COPYRIGHT

Copyright 2008-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• SEE ALSO
• COPYRIGHT

NAME

openssl-dsaparam, dsaparam - DSA parameter manipulation and generation

SYNOPSIS

openssl dsaparam [-help] [-inform DER|PEM] [-outform DER|PEM] [-in filename] [-out filename] [-noout] [-text] [-C] [-rand file...] [-writerand file] [-genkey] [-engine id] [numbits]

DESCRIPTION

This command is used to manipulate or generate DSA parameter files.

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format. The DER option uses an ASN1 DER encoded form compatible with RFC2459 (PKIX) DSS-Parms that is a SEQUENCE consisting of p, q and g respectively. The PEM form is the default format: it consists of the DER format base64 encoded with additional header and footer lines.

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read parameters from or standard input if this option is not specified. If the numbits parameter is included then this option will be ignored.

-out filename

This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should not be the same as the input filename.

-noout

This option inhibits the output of the encoded version of the parameters.

-text

This option prints out the DSA parameters in human readable form.

-C

This option converts the parameters into C code. The parameters can then be loaded by calling the get_dsaXXX() function.

-genkey

This option will generate a DSA either using the specified or generated parameters.

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

numbits

This option specifies that a parameter set should be generated of size numbits. It must be the last option. If this option is included then the input file (if any) is ignored.

-engine id

Specifying an engine (by its unique id string) will cause dsaparam to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

NOTES

PEM format DSA parameters use the header and footer lines:

 -----BEGIN DSA PARAMETERS-----
 -----END DSA PARAMETERS-----

DSA parameter generation is a slow process and as a result the same set of DSA parameters is often used to generate several distinct keys.

SEE ALSO

gendsa(1), dsa(1), genrsa(1), rsa(1)

COPYRIGHT

Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• EXAMPLES
• NOTES
• BUGS
• COPYRIGHT

NAME

openssl-nseq, nseq - create or examine a Netscape certificate sequence

SYNOPSIS

openssl nseq [-help] [-in filename] [-out filename] [-toseq]

DESCRIPTION

The nseq command takes a file containing a Netscape certificate sequence and prints out the certificates contained in it or takes a file of certificates and converts it into a Netscape certificate sequence.

OPTIONS

-help

Print out a usage message.

-in filename

This specifies the input filename to read or standard input if this option is not specified.

-out filename

Specifies the output filename or standard output by default.

-toseq

Normally a Netscape certificate sequence will be input and the output is the certificates contained in it. With the -toseq option the situation is reversed: a Netscape certificate sequence is created from a file of certificates.

EXAMPLES

Output the certificates in a Netscape certificate sequence

 openssl nseq -in nseq.pem -out certs.pem

Create a Netscape certificate sequence

 openssl nseq -in certs.pem -toseq -out nseq.pem

NOTES

The PEM encoded form uses the same headers and footers as a certificate:

 -----BEGIN CERTIFICATE-----
 -----END CERTIFICATE-----

A Netscape certificate sequence is a Netscape specific format that can be sent to browsers as an alternative to the standard PKCS#7 format when several certificates are sent to the browser: for example during certificate enrollment. It is used by Netscape certificate server for example.

BUGS

This program needs a few more options: like allowing DER or PEM input and output files and allowing multiple certificate files to be used.

COPYRIGHT

Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• SEE ALSO
• COPYRIGHT

NAME

openssl-gendsa, gendsa - generate a DSA private key from a set of parameters

SYNOPSIS

openssl gendsa [-help] [-out filename] [-aes128] [-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128] [-camellia192] [-camellia256] [-des] [-des3] [-idea] [-rand file...] [-writerand file] [-engine id] [paramfile]

DESCRIPTION

The gendsa command generates a DSA private key from a DSA parameter file (which will be typically generated by the openssl dsaparam command).

OPTIONS

-help

Print out a usage message.

-out filename

Output the key to the specified file. If this argument is not specified then standard output is used.

-aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea

These options encrypt the private key with specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified no encryption is used.

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

-engine id

Specifying an engine (by its unique id string) will cause gendsa to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

paramfile

This option specifies the DSA parameter file to use. The parameters in this file determine the size of the private key. DSA parameters can be generated and examined using the openssl dsaparam command.

NOTES

DSA key generation is little more than random number generation so it is much quicker that RSA key generation for example.

SEE ALSO

dsaparam(1), dsa(1), genrsa(1), rsa(1)

COPYRIGHT

Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• OUTPUT
• NOTES
• BUGS
• SEE ALSO
• COPYRIGHT

NAME

openssl-sess_id, sess_id - SSL/TLS session handling utility

SYNOPSIS

openssl sess_id [-help] [-inform PEM|DER] [-outform PEM|DER|NSS] [-in filename] [-out filename] [-text] [-noout] [-context ID]

DESCRIPTION

The sess_id process the encoded version of the SSL session structure and optionally prints out SSL session details (for example the SSL session master key) in human readable format. Since this is a diagnostic tool that needs some knowledge of the SSL protocol to use properly, most users will not need to use it.

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format. The DER option uses an ASN1 DER encoded format containing session details. The precise format can vary from one version to the next. The PEM form is the default format: it consists of the DER format base64 encoded with additional header and footer lines.

-outform DER|PEM|NSS

This specifies the output format. The PEM and DER options have the same meaning and default as the -inform option. The NSS option outputs the session id and the master key in NSS keylog format.

-in filename

This specifies the input filename to read session information from or standard input by default.

-out filename

This specifies the output filename to write session information to or standard output if this option is not specified.

-text

Prints out the various public or private key components in plain text in addition to the encoded version.

-cert

If a certificate is present in the session it will be output using this option, if the -text option is also present then it will be printed out in text form.

-noout

This option prevents output of the encoded version of the session.

-context ID

This option can set the session id so the output session information uses the supplied ID. The ID can be any string of characters. This option won't normally be used.

OUTPUT

Typical output:

 SSL-Session:
     Protocol  : TLSv1
     Cipher    : 0016
     Session-ID: 871E62626C554CE95488823752CBD5F3673A3EF3DCE9C67BD916C809914B40ED
     Session-ID-ctx: 01000000
     Master-Key: A7CEFC571974BE02CAC305269DC59F76EA9F0B180CB6642697A68251F2D2BB57E51DBBB4C7885573192AE9AEE220FACD
     Key-Arg   : None
     Start Time: 948459261
     Timeout   : 300 (sec)
     Verify return code 0 (ok)

These are described below in more detail.

Protocol

This is the protocol in use TLSv1.3, TLSv1.2, TLSv1.1, TLSv1 or SSLv3.

Cipher

The cipher used this is the actual raw SSL or TLS cipher code, see the SSL or TLS specifications for more information.

Session-ID

The SSL session ID in hex format.

Session-ID-ctx

The session ID context in hex format.

Master-Key

This is the SSL session master key.

Start Time

This is the session start time represented as an integer in standard Unix format.

Timeout

The timeout in seconds.

Verify return code

This is the return code when an SSL client certificate is verified.

NOTES

The PEM encoded session format uses the header and footer lines:

 -----BEGIN SSL SESSION PARAMETERS-----
 -----END SSL SESSION PARAMETERS-----

Since the SSL session output contains the master key it is possible to read the contents of an encrypted session using this information. Therefore, appropriate security precautions should be taken if the information is being output by a "real" application. This is however strongly discouraged and should only be used for debugging purposes.

BUGS

The cipher and start time should be printed out in human readable form.

SEE ALSO

ciphers(1), s_server(1)

COPYRIGHT

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• SUPPORTED CIPHERS
• EXAMPLES
• BUGS
• HISTORY
• COPYRIGHT

NAME

openssl-enc, enc - symmetric cipher routines

SYNOPSIS

openssl enc -cipher [-help] [-list] [-ciphers] [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a] [-base64] [-A] [-k password] [-kfile filename] [-K key] [-iv IV] [-S salt] [-salt] [-nosalt] [-z] [-md digest] [-iter count] [-pbkdf2] [-p] [-P] [-bufsize number] [-nopad] [-debug] [-none] [-rand file...] [-writerand file] [-engine id]

openssl [cipher] [...]

DESCRIPTION

The symmetric cipher commands allow data to be encrypted or decrypted using various block and stream ciphers using keys based on passwords or explicitly provided. Base64 encoding or decoding can also be performed either by itself or in addition to the encryption or decryption.

OPTIONS

-help

Print out a usage message.

-list

List all supported ciphers.

-ciphers

Alias of -list to display all supported ciphers.

-in filename

The input filename, standard input by default.

-out filename

The output filename, standard output by default.

-pass arg

The password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-e

Encrypt the input data: this is the default.

-d

Decrypt the input data.

-a

Base64 process the data. This means that if encryption is taking place the data is base64 encoded after encryption. If decryption is set then the input data is base64 decoded before being decrypted.

-base64

Same as -a

-A

If the -a option is set then base64 process the data on one line.

-k password

The password to derive the key from. This is for compatibility with previous versions of OpenSSL. Superseded by the -pass argument.

-kfile filename

Read the password to derive the key from the first line of filename. This is for compatibility with previous versions of OpenSSL. Superseded by the -pass argument.

-md digest

Use the specified digest to create the key from the passphrase. The default algorithm is sha-256.

-iter count

Use a given number of iterations on the password in deriving the encryption key. High values increase the time required to brute-force the resulting file. This option enables the use of PBKDF2 algorithm to derive the key.

-pbkdf2

Use PBKDF2 algorithm with default iteration count unless otherwise specified.

-nosalt

Don't use a salt in the key derivation routines. This option SHOULD NOT be used except for test purposes or compatibility with ancient versions of OpenSSL.

-salt

Use salt (randomly generated or provide with -S option) when encrypting, this is the default.

-S salt

The actual salt to use: this must be represented as a string of hex digits.

-K key

The actual key to use: this must be represented as a string comprised only of hex digits. If only the key is specified, the IV must additionally specified using the -iv option. When both a key and a password are specified, the key given with the -K option will be used and the IV generated from the password will be taken. It does not make much sense to specify both key and password.

-iv IV

The actual IV to use: this must be represented as a string comprised only of hex digits. When only the key is specified using the -K option, the IV must explicitly be defined. When a password is being specified using one of the other options, the IV is generated from this password.

-p

Print out the key and IV used.

-P

Print out the key and IV used then immediately exit: don't do any encryption or decryption.

-bufsize number

Set the buffer size for I/O.

-nopad

Disable standard block padding.

-debug

Debug the BIOs used for I/O.

-z

Compress or decompress encrypted data using zlib after encryption or before decryption. This option exists only if OpenSSL was compiled with the zlib or zlib-dynamic option.

-none

Use NULL cipher (no encryption or decryption of input).

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

NOTES

The program can be called either as openssl cipher or openssl enc -cipher. The first form doesn't work with engine-provided ciphers, because this form is processed before the configuration file is read and any ENGINEs loaded. Use the list command to get a list of supported ciphers.

Engines which provide entirely new encryption algorithms (such as the ccgost engine which provides gost89 algorithm) should be configured in the configuration file. Engines specified on the command line using -engine options can only be used for hardware-assisted implementations of ciphers which are supported by the OpenSSL core or another engine specified in the configuration file.

When the enc command lists supported ciphers, ciphers provided by engines, specified in the configuration files are listed too.

A password will be prompted for to derive the key and IV if necessary.

The -salt option should ALWAYS be used if the key is being derived from a password unless you want compatibility with previous versions of OpenSSL.

Without the -salt option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data. The reason for this is that without the salt the same password always generates the same encryption key. When the salt is being used the first eight bytes of the encrypted data are reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted.

Some of the ciphers do not have large keys and others have security implications if not used correctly. A beginner is advised to just use a strong block cipher, such as AES, in CBC mode.

All the block ciphers normally use PKCS#5 padding, also known as standard block padding. This allows a rudimentary integrity or password check to be performed. However, since the chance of random data passing the test is better than 1 in 256 it isn't a very good test.

If padding is disabled then the input data must be a multiple of the cipher block length.

All RC2 ciphers have the same key and effective key length.

Blowfish and RC5 algorithms use a 128 bit key.

SUPPORTED CIPHERS

Note that some of these ciphers can be disabled at compile time and some are available only if an appropriate engine is configured in the configuration file. The output of the enc command run with the -ciphers option (that is openssl enc -ciphers) produces a list of ciphers, supported by your version of OpenSSL, including ones provided by configured engines.

The enc program does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the future. The enc interface by necessity must begin streaming output (e.g., to standard output when -out is not used) before the authentication tag could be validated, leading to the usage of enc in pipelines that begin processing untrusted data and are not capable of rolling back upon authentication failure. The AEAD modes currently in common use also suffer from catastrophic failure of confidentiality and/or integrity upon reuse of key/iv/nonce, and since enc places the entire burden of key/iv/nonce management upon the user, the risk of exposing AEAD modes is too great to allow. These key/iv/nonce management issues also affect other modes currently exposed in enc, but the failure modes are less extreme in these cases, and the functionality cannot be removed with a stable release branch. For bulk encryption of data, whether using authenticated encryption modes or other modes, cms(1) is recommended, as it provides a standard data format and performs the needed key/iv/nonce management.

 base64             Base 64

 bf-cbc             Blowfish in CBC mode
 bf                 Alias for bf-cbc
 blowfish           Alias for bf-cbc
 bf-cfb             Blowfish in CFB mode
 bf-ecb             Blowfish in ECB mode
 bf-ofb             Blowfish in OFB mode

 cast-cbc           CAST in CBC mode
 cast               Alias for cast-cbc
 cast5-cbc          CAST5 in CBC mode
 cast5-cfb          CAST5 in CFB mode
 cast5-ecb          CAST5 in ECB mode
 cast5-ofb          CAST5 in OFB mode

 chacha20           ChaCha20 algorithm

 des-cbc            DES in CBC mode
 des                Alias for des-cbc
 des-cfb            DES in CFB mode
 des-ofb            DES in OFB mode
 des-ecb            DES in ECB mode

 des-ede-cbc        Two key triple DES EDE in CBC mode
 des-ede            Two key triple DES EDE in ECB mode
 des-ede-cfb        Two key triple DES EDE in CFB mode
 des-ede-ofb        Two key triple DES EDE in OFB mode

 des-ede3-cbc       Three key triple DES EDE in CBC mode
 des-ede3           Three key triple DES EDE in ECB mode
 des3               Alias for des-ede3-cbc
 des-ede3-cfb       Three key triple DES EDE CFB mode
 des-ede3-ofb       Three key triple DES EDE in OFB mode

 desx               DESX algorithm.

 gost89             GOST 28147-89 in CFB mode (provided by ccgost engine)
 gost89-cnt        `GOST 28147-89 in CNT mode (provided by ccgost engine)

 idea-cbc           IDEA algorithm in CBC mode
 idea               same as idea-cbc
 idea-cfb           IDEA in CFB mode
 idea-ecb           IDEA in ECB mode
 idea-ofb           IDEA in OFB mode

 rc2-cbc            128 bit RC2 in CBC mode
 rc2                Alias for rc2-cbc
 rc2-cfb            128 bit RC2 in CFB mode
 rc2-ecb            128 bit RC2 in ECB mode
 rc2-ofb            128 bit RC2 in OFB mode
 rc2-64-cbc         64 bit RC2 in CBC mode
 rc2-40-cbc         40 bit RC2 in CBC mode

 rc4                128 bit RC4
 rc4-64             64 bit RC4
 rc4-40             40 bit RC4

 rc5-cbc            RC5 cipher in CBC mode
 rc5                Alias for rc5-cbc
 rc5-cfb            RC5 cipher in CFB mode
 rc5-ecb            RC5 cipher in ECB mode
 rc5-ofb            RC5 cipher in OFB mode

 seed-cbc           SEED cipher in CBC mode
 seed               Alias for seed-cbc
 seed-cfb           SEED cipher in CFB mode
 seed-ecb           SEED cipher in ECB mode
 seed-ofb           SEED cipher in OFB mode

 sm4-cbc            SM4 cipher in CBC mode
 sm4                Alias for sm4-cbc
 sm4-cfb            SM4 cipher in CFB mode
 sm4-ctr            SM4 cipher in CTR mode
 sm4-ecb            SM4 cipher in ECB mode
 sm4-ofb            SM4 cipher in OFB mode

 aes-[128|192|256]-cbc  128/192/256 bit AES in CBC mode
 aes[128|192|256]       Alias for aes-[128|192|256]-cbc
 aes-[128|192|256]-cfb  128/192/256 bit AES in 128 bit CFB mode
 aes-[128|192|256]-cfb1 128/192/256 bit AES in 1 bit CFB mode
 aes-[128|192|256]-cfb8 128/192/256 bit AES in 8 bit CFB mode
 aes-[128|192|256]-ctr  128/192/256 bit AES in CTR mode
 aes-[128|192|256]-ecb  128/192/256 bit AES in ECB mode
 aes-[128|192|256]-ofb  128/192/256 bit AES in OFB mode

 aria-[128|192|256]-cbc  128/192/256 bit ARIA in CBC mode
 aria[128|192|256]       Alias for aria-[128|192|256]-cbc
 aria-[128|192|256]-cfb  128/192/256 bit ARIA in 128 bit CFB mode
 aria-[128|192|256]-cfb1 128/192/256 bit ARIA in 1 bit CFB mode
 aria-[128|192|256]-cfb8 128/192/256 bit ARIA in 8 bit CFB mode
 aria-[128|192|256]-ctr  128/192/256 bit ARIA in CTR mode
 aria-[128|192|256]-ecb  128/192/256 bit ARIA in ECB mode
 aria-[128|192|256]-ofb  128/192/256 bit ARIA in OFB mode

 camellia-[128|192|256]-cbc  128/192/256 bit Camellia in CBC mode
 camellia[128|192|256]       Alias for camellia-[128|192|256]-cbc
 camellia-[128|192|256]-cfb  128/192/256 bit Camellia in 128 bit CFB mode
 camellia-[128|192|256]-cfb1 128/192/256 bit Camellia in 1 bit CFB mode
 camellia-[128|192|256]-cfb8 128/192/256 bit Camellia in 8 bit CFB mode
 camellia-[128|192|256]-ctr  128/192/256 bit Camellia in CTR mode
 camellia-[128|192|256]-ecb  128/192/256 bit Camellia in ECB mode
 camellia-[128|192|256]-ofb  128/192/256 bit Camellia in OFB mode

EXAMPLES

Just base64 encode a binary file:

 openssl base64 -in file.bin -out file.b64

Decode the same file

 openssl base64 -d -in file.b64 -out file.bin

Encrypt a file using AES-128 using a prompted password and PBKDF2 key derivation:

 openssl enc -aes128 -pbkdf2 -in file.txt -out file.aes128

Decrypt a file using a supplied password:

 openssl enc -aes128 -pbkdf2 -d -in file.aes128 -out file.txt \
    -pass pass:<password>

Encrypt a file then base64 encode it (so it can be sent via mail for example) using AES-256 in CTR mode and PBKDF2 key derivation:

 openssl enc -aes-256-ctr -pbkdf2 -a -in file.txt -out file.aes256

Base64 decode a file then decrypt it using a password supplied in a file:

 openssl enc -aes-256-ctr -pbkdf2 -d -a -in file.aes256 -out file.txt \
    -pass file:<passfile>

BUGS

The -A option when used with large files doesn't work properly.

The enc program only supports a fixed number of algorithms with certain parameters. So if, for example, you want to use RC2 with a 76 bit key or RC4 with an 84 bit key you can't use this program.

HISTORY

The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0.

The -list option was added in OpenSSL 1.1.1e.

COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• CIPHER LIST FORMAT
• CIPHER STRINGS
• CIPHER SUITE NAMES
  • SSL v3.0 cipher suites
  • TLS v1.0 cipher suites
  • AES cipher suites from RFC3268, extending TLS v1.0
  • Camellia cipher suites from RFC4132, extending TLS v1.0
  • SEED cipher suites from RFC4162, extending TLS v1.0
  • GOST cipher suites from draft-chudov-cryptopro-cptls, extending TLS v1.0
  • Additional Export 1024 and other cipher suites
  • Elliptic curve cipher suites.
  • TLS v1.2 cipher suites
  • ARIA cipher suites from RFC6209, extending TLS v1.2
  • Camellia HMAC-Based cipher suites from RFC6367, extending TLS v1.2
  • Pre-shared keying (PSK) cipher suites
  • ChaCha20-Poly1305 cipher suites, extending TLS v1.2
  • TLS v1.3 cipher suites
  • Older names used by OpenSSL
• NOTES
• EXAMPLES
• SEE ALSO
• HISTORY
• COPYRIGHT

NAME

openssl-ciphers, ciphers - SSL cipher display and cipher list tool

SYNOPSIS

openssl ciphers [-help] [-s] [-v] [-V] [-ssl3] [-tls1] [-tls1_1] [-tls1_2] [-tls1_3] [-s] [-psk] [-srp] [-stdname] [-convert name] [-ciphersuites val] [cipherlist]

DESCRIPTION

The ciphers command converts textual OpenSSL cipher lists into ordered SSL cipher preference lists. It can be used as a test tool to determine the appropriate cipherlist.

OPTIONS

-help

Print a usage message.

-s

Only list supported ciphers: those consistent with the security level, and minimum and maximum protocol version. This is closer to the actual cipher list an application will support.

PSK and SRP ciphers are not enabled by default: they require -psk or -srp to enable them.

It also does not change the default list of supported signature algorithms.

On a server the list of supported ciphers might also exclude other ciphers depending on the configured certificates and presence of DH parameters.

If this option is not used then all ciphers that match the cipherlist will be listed.

-psk

When combined with -s includes cipher suites which require PSK.

-srp

When combined with -s includes cipher suites which require SRP.

-v

Verbose output: For each cipher suite, list details as provided by SSL_CIPHER_description(3).

-V

Like -v, but include the official cipher suite values in hex.

-tls1_3, -tls1_2, -tls1_1, -tls1, -ssl3

In combination with the -s option, list the ciphers which could be used if the specified protocol were negotiated. Note that not all protocols and flags may be available, depending on how OpenSSL was built.

-stdname

Precede each cipher suite by its standard name.

-convert name

Convert a standard cipher name to its OpenSSL name.

-ciphersuites val

Sets the list of TLSv1.3 ciphersuites. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names. By default this value is:

 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

cipherlist

A cipher list of TLSv1.2 and below ciphersuites to convert to a cipher preference list. This list will be combined with any TLSv1.3 ciphersuites that have been configured. If it is not included then the default cipher list will be used. The format is described below.

CIPHER LIST FORMAT

The cipher list consists of one or more cipher strings separated by colons. Commas or spaces are also acceptable separators but colons are normally used.

The actual cipher string can take several different forms.

It can consist of a single cipher suite such as RC4-SHA.

It can represent a list of cipher suites containing a certain algorithm, or cipher suites of a certain type. For example SHA1 represents all ciphers suites using the digest algorithm SHA1 and SSLv3 represents all SSL v3 algorithms.

Lists of cipher suites can be combined in a single cipher string using the + character. This is used as a logical and operation. For example SHA1+DES represents all cipher suites containing the SHA1 and the DES algorithms.

Each cipher string can be optionally preceded by the characters !, - or +.

If ! is used then the ciphers are permanently deleted from the list. The ciphers deleted can never reappear in the list even if they are explicitly stated.

If - is used then the ciphers are deleted from the list, but some or all of the ciphers can be added again by later options.

If + is used then the ciphers are moved to the end of the list. This option doesn't add any new ciphers it just moves matching existing ones.

If none of these characters is present then the string is just interpreted as a list of ciphers to be appended to the current preference list. If the list includes any ciphers already present they will be ignored: that is they will not moved to the end of the list.

The cipher string @STRENGTH can be used at any point to sort the current cipher list in order of encryption algorithm key length.

The cipher string @SECLEVEL=n can be used at any point to set the security level to n, which should be a number between zero and five, inclusive. See SSL_CTX_set_security_level for a description of what each level means.

The cipher list can be prefixed with the DEFAULT keyword, which enables the default cipher list as defined below. Unlike cipher strings, this prefix may not be combined with other strings using + character. For example, DEFAULT+DES is not valid.

The content of the default list is determined at compile time and normally corresponds to ALL:!COMPLEMENTOFDEFAULT:!eNULL.

CIPHER STRINGS

The following is a list of all permitted cipher strings and their meanings.

COMPLEMENTOFDEFAULT

The ciphers included in ALL, but not enabled by default. Currently this includes all RC4 and anonymous ciphers. Note that this rule does not cover eNULL, which is not included by ALL (use COMPLEMENTOFALL if necessary). Note that RC4 based cipher suites are not built into OpenSSL by default (see the enable-weak-ssl-ciphers option to Configure).

ALL

All cipher suites except the eNULL ciphers (which must be explicitly enabled if needed). As of OpenSSL 1.0.0, the ALL cipher suites are sensibly ordered by default.

COMPLEMENTOFALL

The cipher suites not enabled by ALL, currently eNULL.

HIGH

"High" encryption cipher suites. This currently means those with key lengths larger than 128 bits, and some cipher suites with 128-bit keys.

MEDIUM

"Medium" encryption cipher suites, currently some of those using 128 bit encryption.

LOW

"Low" encryption cipher suites, currently those using 64 or 56 bit encryption algorithms but excluding export cipher suites. All these cipher suites have been removed as of OpenSSL 1.1.0.

eNULL, NULL

The "NULL" ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are not enabled via either the DEFAULT or ALL cipher strings. Be careful when building cipherlists out of lower-level primitives such as kRSA or aECDSA as these do overlap with the eNULL ciphers. When in doubt, include !eNULL in your cipherlist.

aNULL

The cipher suites offering no authentication. This is currently the anonymous DH algorithms and anonymous ECDH algorithms. These cipher suites are vulnerable to "man in the middle" attacks and so their use is discouraged. These are excluded from the DEFAULT ciphers, but included in the ALL ciphers. Be careful when building cipherlists out of lower-level primitives such as kDHE or AES as these do overlap with the aNULL ciphers. When in doubt, include !aNULL in your cipherlist.

kRSA, aRSA, RSA

Cipher suites using RSA key exchange or authentication. RSA is an alias for kRSA.

kDHr, kDHd, kDH

Cipher suites using static DH key agreement and DH certificates signed by CAs with RSA and DSS keys or either respectively. All these cipher suites have been removed in OpenSSL 1.1.0.

kDHE, kEDH, DH

Cipher suites using ephemeral DH key agreement, including anonymous cipher suites.

DHE, EDH

Cipher suites using authenticated ephemeral DH key agreement.

ADH

Anonymous DH cipher suites, note that this does not include anonymous Elliptic Curve DH (ECDH) cipher suites.

kEECDH, kECDHE, ECDH

Cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites.

ECDHE, EECDH

Cipher suites using authenticated ephemeral ECDH key agreement.

AECDH

Anonymous Elliptic Curve Diffie-Hellman cipher suites.

aDSS, DSS

Cipher suites using DSS authentication, i.e. the certificates carry DSS keys.

aDH

Cipher suites effectively using DH authentication, i.e. the certificates carry DH keys. All these cipher suites have been removed in OpenSSL 1.1.0.

aECDSA, ECDSA

Cipher suites using ECDSA authentication, i.e. the certificates carry ECDSA keys.

TLSv1.2, TLSv1.0, SSLv3

Lists cipher suites which are only supported in at least TLS v1.2, TLS v1.0 or SSL v3.0 respectively. Note: there are no cipher suites specific to TLS v1.1. Since this is only the minimum version, if, for example, TLSv1.0 is negotiated then both TLSv1.0 and SSLv3.0 cipher suites are available.

Note: these cipher strings do not change the negotiated version of SSL or TLS, they only affect the list of available cipher suites.

AES128, AES256, AES

cipher suites using 128 bit AES, 256 bit AES or either 128 or 256 bit AES.

AESGCM

AES in Galois Counter Mode (GCM): these cipher suites are only supported in TLS v1.2.

AESCCM, AESCCM8

AES in Cipher Block Chaining - Message Authentication Mode (CCM): these cipher suites are only supported in TLS v1.2. AESCCM references CCM cipher suites using both 16 and 8 octet Integrity Check Value (ICV) while AESCCM8 only references 8 octet ICV.

ARIA128, ARIA256, ARIA

Cipher suites using 128 bit ARIA, 256 bit ARIA or either 128 or 256 bit ARIA.

CAMELLIA128, CAMELLIA256, CAMELLIA

Cipher suites using 128 bit CAMELLIA, 256 bit CAMELLIA or either 128 or 256 bit CAMELLIA.

CHACHA20

Cipher suites using ChaCha20.

3DES

Cipher suites using triple DES.

DES

Cipher suites using DES (not triple DES). All these cipher suites have been removed in OpenSSL 1.1.0.

RC4

Cipher suites using RC4.

RC2

Cipher suites using RC2.

IDEA

Cipher suites using IDEA.

SEED

Cipher suites using SEED.

MD5

Cipher suites using MD5.

SHA1, SHA

Cipher suites using SHA1.

SHA256, SHA384

Cipher suites using SHA256 or SHA384.

aGOST

Cipher suites using GOST R 34.10 (either 2001 or 94) for authentication (needs an engine supporting GOST algorithms).

aGOST01

Cipher suites using GOST R 34.10-2001 authentication.

kGOST

Cipher suites, using VKO 34.10 key exchange, specified in the RFC 4357.

GOST94

Cipher suites, using HMAC based on GOST R 34.11-94.

GOST89MAC

Cipher suites using GOST 28147-89 MAC instead of HMAC.

PSK

All cipher suites using pre-shared keys (PSK).

kPSK, kECDHEPSK, kDHEPSK, kRSAPSK

Cipher suites using PSK key exchange, ECDHE_PSK, DHE_PSK or RSA_PSK.

aPSK

Cipher suites using PSK authentication (currently all PSK modes apart from RSA_PSK).

SUITEB128, SUITEB128ONLY, SUITEB192

Enables suite B mode of operation using 128 (permitting 192 bit mode by peer) 128 bit (not permitting 192 bit by peer) or 192 bit level of security respectively. If used these cipherstrings should appear first in the cipher list and anything after them is ignored. Setting Suite B mode has additional consequences required to comply with RFC6460. In particular the supported signature algorithms is reduced to support only ECDSA and SHA256 or SHA384, only the elliptic curves P-256 and P-384 can be used and only the two suite B compliant cipher suites (ECDHE-ECDSA-AES128-GCM-SHA256 and ECDHE-ECDSA-AES256-GCM-SHA384) are permissible.

CIPHER SUITE NAMES

The following lists give the SSL or TLS cipher suites names from the relevant specification and their OpenSSL equivalents. It should be noted, that several cipher suite names do not include the authentication used, e.g. DES-CBC3-SHA. In these cases, RSA authentication is used.

SSL v3.0 cipher suites

 SSL_RSA_WITH_NULL_MD5                   NULL-MD5
 SSL_RSA_WITH_NULL_SHA                   NULL-SHA
 SSL_RSA_WITH_RC4_128_MD5                RC4-MD5
 SSL_RSA_WITH_RC4_128_SHA                RC4-SHA
 SSL_RSA_WITH_IDEA_CBC_SHA               IDEA-CBC-SHA
 SSL_RSA_WITH_3DES_EDE_CBC_SHA           DES-CBC3-SHA

 SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA        DH-DSS-DES-CBC3-SHA
 SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA        DH-RSA-DES-CBC3-SHA
 SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA       DHE-DSS-DES-CBC3-SHA
 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA       DHE-RSA-DES-CBC3-SHA

 SSL_DH_anon_WITH_RC4_128_MD5            ADH-RC4-MD5
 SSL_DH_anon_WITH_3DES_EDE_CBC_SHA       ADH-DES-CBC3-SHA

 SSL_FORTEZZA_KEA_WITH_NULL_SHA          Not implemented.
 SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA  Not implemented.
 SSL_FORTEZZA_KEA_WITH_RC4_128_SHA       Not implemented.

TLS v1.0 cipher suites

 TLS_RSA_WITH_NULL_MD5                   NULL-MD5
 TLS_RSA_WITH_NULL_SHA                   NULL-SHA
 TLS_RSA_WITH_RC4_128_MD5                RC4-MD5
 TLS_RSA_WITH_RC4_128_SHA                RC4-SHA
 TLS_RSA_WITH_IDEA_CBC_SHA               IDEA-CBC-SHA
 TLS_RSA_WITH_3DES_EDE_CBC_SHA           DES-CBC3-SHA

 TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA        Not implemented.
 TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA        Not implemented.
 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA       DHE-DSS-DES-CBC3-SHA
 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA       DHE-RSA-DES-CBC3-SHA

 TLS_DH_anon_WITH_RC4_128_MD5            ADH-RC4-MD5
 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA       ADH-DES-CBC3-SHA

AES cipher suites from RFC3268, extending TLS v1.0

 TLS_RSA_WITH_AES_128_CBC_SHA            AES128-SHA
 TLS_RSA_WITH_AES_256_CBC_SHA            AES256-SHA

 TLS_DH_DSS_WITH_AES_128_CBC_SHA         DH-DSS-AES128-SHA
 TLS_DH_DSS_WITH_AES_256_CBC_SHA         DH-DSS-AES256-SHA
 TLS_DH_RSA_WITH_AES_128_CBC_SHA         DH-RSA-AES128-SHA
 TLS_DH_RSA_WITH_AES_256_CBC_SHA         DH-RSA-AES256-SHA

 TLS_DHE_DSS_WITH_AES_128_CBC_SHA        DHE-DSS-AES128-SHA
 TLS_DHE_DSS_WITH_AES_256_CBC_SHA        DHE-DSS-AES256-SHA
 TLS_DHE_RSA_WITH_AES_128_CBC_SHA        DHE-RSA-AES128-SHA
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA        DHE-RSA-AES256-SHA

 TLS_DH_anon_WITH_AES_128_CBC_SHA        ADH-AES128-SHA
 TLS_DH_anon_WITH_AES_256_CBC_SHA        ADH-AES256-SHA

Camellia cipher suites from RFC4132, extending TLS v1.0

 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA      CAMELLIA128-SHA
 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA      CAMELLIA256-SHA

 TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA   DH-DSS-CAMELLIA128-SHA
 TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA   DH-DSS-CAMELLIA256-SHA
 TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA   DH-RSA-CAMELLIA128-SHA
 TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA   DH-RSA-CAMELLIA256-SHA

 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA  DHE-DSS-CAMELLIA128-SHA
 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA  DHE-DSS-CAMELLIA256-SHA
 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA  DHE-RSA-CAMELLIA128-SHA
 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA  DHE-RSA-CAMELLIA256-SHA

 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA  ADH-CAMELLIA128-SHA
 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA  ADH-CAMELLIA256-SHA

SEED cipher suites from RFC4162, extending TLS v1.0

 TLS_RSA_WITH_SEED_CBC_SHA              SEED-SHA

 TLS_DH_DSS_WITH_SEED_CBC_SHA           DH-DSS-SEED-SHA
 TLS_DH_RSA_WITH_SEED_CBC_SHA           DH-RSA-SEED-SHA

 TLS_DHE_DSS_WITH_SEED_CBC_SHA          DHE-DSS-SEED-SHA
 TLS_DHE_RSA_WITH_SEED_CBC_SHA          DHE-RSA-SEED-SHA

 TLS_DH_anon_WITH_SEED_CBC_SHA          ADH-SEED-SHA

GOST cipher suites from draft-chudov-cryptopro-cptls, extending TLS v1.0

Note: these ciphers require an engine which including GOST cryptographic algorithms, such as the ccgost engine, included in the OpenSSL distribution.

 TLS_GOSTR341094_WITH_28147_CNT_IMIT GOST94-GOST89-GOST89
 TLS_GOSTR341001_WITH_28147_CNT_IMIT GOST2001-GOST89-GOST89
 TLS_GOSTR341094_WITH_NULL_GOSTR3411 GOST94-NULL-GOST94
 TLS_GOSTR341001_WITH_NULL_GOSTR3411 GOST2001-NULL-GOST94

Additional Export 1024 and other cipher suites

Note: these ciphers can also be used in SSL v3.

 TLS_DHE_DSS_WITH_RC4_128_SHA            DHE-DSS-RC4-SHA

Elliptic curve cipher suites.

 TLS_ECDHE_RSA_WITH_NULL_SHA             ECDHE-RSA-NULL-SHA
 TLS_ECDHE_RSA_WITH_RC4_128_SHA          ECDHE-RSA-RC4-SHA
 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA     ECDHE-RSA-DES-CBC3-SHA
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA      ECDHE-RSA-AES128-SHA
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA      ECDHE-RSA-AES256-SHA

 TLS_ECDHE_ECDSA_WITH_NULL_SHA           ECDHE-ECDSA-NULL-SHA
 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA        ECDHE-ECDSA-RC4-SHA
 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA   ECDHE-ECDSA-DES-CBC3-SHA
 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA    ECDHE-ECDSA-AES128-SHA
 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA    ECDHE-ECDSA-AES256-SHA

 TLS_ECDH_anon_WITH_NULL_SHA             AECDH-NULL-SHA
 TLS_ECDH_anon_WITH_RC4_128_SHA          AECDH-RC4-SHA
 TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA     AECDH-DES-CBC3-SHA
 TLS_ECDH_anon_WITH_AES_128_CBC_SHA      AECDH-AES128-SHA
 TLS_ECDH_anon_WITH_AES_256_CBC_SHA      AECDH-AES256-SHA

TLS v1.2 cipher suites

 TLS_RSA_WITH_NULL_SHA256                  NULL-SHA256

 TLS_RSA_WITH_AES_128_CBC_SHA256           AES128-SHA256
 TLS_RSA_WITH_AES_256_CBC_SHA256           AES256-SHA256
 TLS_RSA_WITH_AES_128_GCM_SHA256           AES128-GCM-SHA256
 TLS_RSA_WITH_AES_256_GCM_SHA384           AES256-GCM-SHA384

 TLS_DH_RSA_WITH_AES_128_CBC_SHA256        DH-RSA-AES128-SHA256
 TLS_DH_RSA_WITH_AES_256_CBC_SHA256        DH-RSA-AES256-SHA256
 TLS_DH_RSA_WITH_AES_128_GCM_SHA256        DH-RSA-AES128-GCM-SHA256
 TLS_DH_RSA_WITH_AES_256_GCM_SHA384        DH-RSA-AES256-GCM-SHA384

 TLS_DH_DSS_WITH_AES_128_CBC_SHA256        DH-DSS-AES128-SHA256
 TLS_DH_DSS_WITH_AES_256_CBC_SHA256        DH-DSS-AES256-SHA256
 TLS_DH_DSS_WITH_AES_128_GCM_SHA256        DH-DSS-AES128-GCM-SHA256
 TLS_DH_DSS_WITH_AES_256_GCM_SHA384        DH-DSS-AES256-GCM-SHA384

 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256       DHE-RSA-AES128-SHA256
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256       DHE-RSA-AES256-SHA256
 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256       DHE-RSA-AES128-GCM-SHA256
 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384       DHE-RSA-AES256-GCM-SHA384

 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       DHE-DSS-AES128-SHA256
 TLS_DHE_DSS_WITH_AES_256_CBC_SHA256       DHE-DSS-AES256-SHA256
 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256       DHE-DSS-AES128-GCM-SHA256
 TLS_DHE_DSS_WITH_AES_256_GCM_SHA384       DHE-DSS-AES256-GCM-SHA384

 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256     ECDHE-RSA-AES128-SHA256
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384     ECDHE-RSA-AES256-SHA384
 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256     ECDHE-RSA-AES128-GCM-SHA256
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384     ECDHE-RSA-AES256-GCM-SHA384

 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256   ECDHE-ECDSA-AES128-SHA256
 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384   ECDHE-ECDSA-AES256-SHA384
 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256   ECDHE-ECDSA-AES128-GCM-SHA256
 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384   ECDHE-ECDSA-AES256-GCM-SHA384

 TLS_DH_anon_WITH_AES_128_CBC_SHA256       ADH-AES128-SHA256
 TLS_DH_anon_WITH_AES_256_CBC_SHA256       ADH-AES256-SHA256
 TLS_DH_anon_WITH_AES_128_GCM_SHA256       ADH-AES128-GCM-SHA256
 TLS_DH_anon_WITH_AES_256_GCM_SHA384       ADH-AES256-GCM-SHA384

 RSA_WITH_AES_128_CCM                      AES128-CCM
 RSA_WITH_AES_256_CCM                      AES256-CCM
 DHE_RSA_WITH_AES_128_CCM                  DHE-RSA-AES128-CCM
 DHE_RSA_WITH_AES_256_CCM                  DHE-RSA-AES256-CCM
 RSA_WITH_AES_128_CCM_8                    AES128-CCM8
 RSA_WITH_AES_256_CCM_8                    AES256-CCM8
 DHE_RSA_WITH_AES_128_CCM_8                DHE-RSA-AES128-CCM8
 DHE_RSA_WITH_AES_256_CCM_8                DHE-RSA-AES256-CCM8
 ECDHE_ECDSA_WITH_AES_128_CCM              ECDHE-ECDSA-AES128-CCM
 ECDHE_ECDSA_WITH_AES_256_CCM              ECDHE-ECDSA-AES256-CCM
 ECDHE_ECDSA_WITH_AES_128_CCM_8            ECDHE-ECDSA-AES128-CCM8
 ECDHE_ECDSA_WITH_AES_256_CCM_8            ECDHE-ECDSA-AES256-CCM8

ARIA cipher suites from RFC6209, extending TLS v1.2

Note: the CBC modes mentioned in this RFC are not supported.

 TLS_RSA_WITH_ARIA_128_GCM_SHA256          ARIA128-GCM-SHA256
 TLS_RSA_WITH_ARIA_256_GCM_SHA384          ARIA256-GCM-SHA384
 TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256      DHE-RSA-ARIA128-GCM-SHA256
 TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384      DHE-RSA-ARIA256-GCM-SHA384
 TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256      DHE-DSS-ARIA128-GCM-SHA256
 TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384      DHE-DSS-ARIA256-GCM-SHA384
 TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256  ECDHE-ECDSA-ARIA128-GCM-SHA256
 TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384  ECDHE-ECDSA-ARIA256-GCM-SHA384
 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256    ECDHE-ARIA128-GCM-SHA256
 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384    ECDHE-ARIA256-GCM-SHA384
 TLS_PSK_WITH_ARIA_128_GCM_SHA256          PSK-ARIA128-GCM-SHA256
 TLS_PSK_WITH_ARIA_256_GCM_SHA384          PSK-ARIA256-GCM-SHA384
 TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256      DHE-PSK-ARIA128-GCM-SHA256
 TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384      DHE-PSK-ARIA256-GCM-SHA384
 TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256      RSA-PSK-ARIA128-GCM-SHA256
 TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384      RSA-PSK-ARIA256-GCM-SHA384

Camellia HMAC-Based cipher suites from RFC6367, extending TLS v1.2

 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256
 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384
 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   ECDHE-RSA-CAMELLIA128-SHA256
 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   ECDHE-RSA-CAMELLIA256-SHA384

Pre-shared keying (PSK) cipher suites

 PSK_WITH_NULL_SHA                         PSK-NULL-SHA
 DHE_PSK_WITH_NULL_SHA                     DHE-PSK-NULL-SHA
 RSA_PSK_WITH_NULL_SHA                     RSA-PSK-NULL-SHA

 PSK_WITH_RC4_128_SHA                      PSK-RC4-SHA
 PSK_WITH_3DES_EDE_CBC_SHA                 PSK-3DES-EDE-CBC-SHA
 PSK_WITH_AES_128_CBC_SHA                  PSK-AES128-CBC-SHA
 PSK_WITH_AES_256_CBC_SHA                  PSK-AES256-CBC-SHA

 DHE_PSK_WITH_RC4_128_SHA                  DHE-PSK-RC4-SHA
 DHE_PSK_WITH_3DES_EDE_CBC_SHA             DHE-PSK-3DES-EDE-CBC-SHA
 DHE_PSK_WITH_AES_128_CBC_SHA              DHE-PSK-AES128-CBC-SHA
 DHE_PSK_WITH_AES_256_CBC_SHA              DHE-PSK-AES256-CBC-SHA

 RSA_PSK_WITH_RC4_128_SHA                  RSA-PSK-RC4-SHA
 RSA_PSK_WITH_3DES_EDE_CBC_SHA             RSA-PSK-3DES-EDE-CBC-SHA
 RSA_PSK_WITH_AES_128_CBC_SHA              RSA-PSK-AES128-CBC-SHA
 RSA_PSK_WITH_AES_256_CBC_SHA              RSA-PSK-AES256-CBC-SHA

 PSK_WITH_AES_128_GCM_SHA256               PSK-AES128-GCM-SHA256
 PSK_WITH_AES_256_GCM_SHA384               PSK-AES256-GCM-SHA384
 DHE_PSK_WITH_AES_128_GCM_SHA256           DHE-PSK-AES128-GCM-SHA256
 DHE_PSK_WITH_AES_256_GCM_SHA384           DHE-PSK-AES256-GCM-SHA384
 RSA_PSK_WITH_AES_128_GCM_SHA256           RSA-PSK-AES128-GCM-SHA256
 RSA_PSK_WITH_AES_256_GCM_SHA384           RSA-PSK-AES256-GCM-SHA384

 PSK_WITH_AES_128_CBC_SHA256               PSK-AES128-CBC-SHA256
 PSK_WITH_AES_256_CBC_SHA384               PSK-AES256-CBC-SHA384
 PSK_WITH_NULL_SHA256                      PSK-NULL-SHA256
 PSK_WITH_NULL_SHA384                      PSK-NULL-SHA384
 DHE_PSK_WITH_AES_128_CBC_SHA256           DHE-PSK-AES128-CBC-SHA256
 DHE_PSK_WITH_AES_256_CBC_SHA384           DHE-PSK-AES256-CBC-SHA384
 DHE_PSK_WITH_NULL_SHA256                  DHE-PSK-NULL-SHA256
 DHE_PSK_WITH_NULL_SHA384                  DHE-PSK-NULL-SHA384
 RSA_PSK_WITH_AES_128_CBC_SHA256           RSA-PSK-AES128-CBC-SHA256
 RSA_PSK_WITH_AES_256_CBC_SHA384           RSA-PSK-AES256-CBC-SHA384
 RSA_PSK_WITH_NULL_SHA256                  RSA-PSK-NULL-SHA256
 RSA_PSK_WITH_NULL_SHA384                  RSA-PSK-NULL-SHA384
 PSK_WITH_AES_128_GCM_SHA256               PSK-AES128-GCM-SHA256
 PSK_WITH_AES_256_GCM_SHA384               PSK-AES256-GCM-SHA384

 ECDHE_PSK_WITH_RC4_128_SHA                ECDHE-PSK-RC4-SHA
 ECDHE_PSK_WITH_3DES_EDE_CBC_SHA           ECDHE-PSK-3DES-EDE-CBC-SHA
 ECDHE_PSK_WITH_AES_128_CBC_SHA            ECDHE-PSK-AES128-CBC-SHA
 ECDHE_PSK_WITH_AES_256_CBC_SHA            ECDHE-PSK-AES256-CBC-SHA
 ECDHE_PSK_WITH_AES_128_CBC_SHA256         ECDHE-PSK-AES128-CBC-SHA256
 ECDHE_PSK_WITH_AES_256_CBC_SHA384         ECDHE-PSK-AES256-CBC-SHA384
 ECDHE_PSK_WITH_NULL_SHA                   ECDHE-PSK-NULL-SHA
 ECDHE_PSK_WITH_NULL_SHA256                ECDHE-PSK-NULL-SHA256
 ECDHE_PSK_WITH_NULL_SHA384                ECDHE-PSK-NULL-SHA384

 PSK_WITH_CAMELLIA_128_CBC_SHA256          PSK-CAMELLIA128-SHA256
 PSK_WITH_CAMELLIA_256_CBC_SHA384          PSK-CAMELLIA256-SHA384

 DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256      DHE-PSK-CAMELLIA128-SHA256
 DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384      DHE-PSK-CAMELLIA256-SHA384

 RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256      RSA-PSK-CAMELLIA128-SHA256
 RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384      RSA-PSK-CAMELLIA256-SHA384

 ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256    ECDHE-PSK-CAMELLIA128-SHA256
 ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384    ECDHE-PSK-CAMELLIA256-SHA384

 PSK_WITH_AES_128_CCM                      PSK-AES128-CCM
 PSK_WITH_AES_256_CCM                      PSK-AES256-CCM
 DHE_PSK_WITH_AES_128_CCM                  DHE-PSK-AES128-CCM
 DHE_PSK_WITH_AES_256_CCM                  DHE-PSK-AES256-CCM
 PSK_WITH_AES_128_CCM_8                    PSK-AES128-CCM8
 PSK_WITH_AES_256_CCM_8                    PSK-AES256-CCM8
 DHE_PSK_WITH_AES_128_CCM_8                DHE-PSK-AES128-CCM8
 DHE_PSK_WITH_AES_256_CCM_8                DHE-PSK-AES256-CCM8

ChaCha20-Poly1305 cipher suites, extending TLS v1.2

 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256      ECDHE-RSA-CHACHA20-POLY1305
 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256    ECDHE-ECDSA-CHACHA20-POLY1305
 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256        DHE-RSA-CHACHA20-POLY1305
 TLS_PSK_WITH_CHACHA20_POLY1305_SHA256            PSK-CHACHA20-POLY1305
 TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256      ECDHE-PSK-CHACHA20-POLY1305
 TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256        DHE-PSK-CHACHA20-POLY1305
 TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256        RSA-PSK-CHACHA20-POLY1305

TLS v1.3 cipher suites

 TLS_AES_128_GCM_SHA256                     TLS_AES_128_GCM_SHA256
 TLS_AES_256_GCM_SHA384                     TLS_AES_256_GCM_SHA384
 TLS_CHACHA20_POLY1305_SHA256               TLS_CHACHA20_POLY1305_SHA256
 TLS_AES_128_CCM_SHA256                     TLS_AES_128_CCM_SHA256
 TLS_AES_128_CCM_8_SHA256                   TLS_AES_128_CCM_8_SHA256

Older names used by OpenSSL

The following names are accepted by older releases:

 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA    EDH-RSA-DES-CBC3-SHA (DHE-RSA-DES-CBC3-SHA)
 SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA    EDH-DSS-DES-CBC3-SHA (DHE-DSS-DES-CBC3-SHA)

NOTES

Some compiled versions of OpenSSL may not include all the ciphers listed here because some ciphers were excluded at compile time.

EXAMPLES

Verbose listing of all OpenSSL ciphers including NULL ciphers:

 openssl ciphers -v 'ALL:eNULL'

Include all ciphers except NULL and anonymous DH then sort by strength:

 openssl ciphers -v 'ALL:!ADH:@STRENGTH'

Include all ciphers except ones with no encryption (eNULL) or no authentication (aNULL):

 openssl ciphers -v 'ALL:!aNULL'

Include only 3DES ciphers and then place RSA ciphers last:

 openssl ciphers -v '3DES:+RSA'

Include all RC4 ciphers but leave out those without authentication:

 openssl ciphers -v 'RC4:!COMPLEMENTOFDEFAULT'

Include all ciphers with RSA authentication but leave out ciphers without encryption.

 openssl ciphers -v 'RSA:!COMPLEMENTOFALL'

Set security level to 2 and display all ciphers consistent with level 2:

 openssl ciphers -s -v 'ALL:@SECLEVEL=2'

SEE ALSO

s_client(1), s_server(1), ssl(7)

HISTORY

The -V option for the ciphers command was added in OpenSSL 1.0.0.

The -stdname is only available if OpenSSL is built with tracing enabled (enable-ssl-trace argument to Configure) before OpenSSL 1.1.1.

The -convert option was added in OpenSSL 1.1.1.

COPYRIGHT

Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
  • Input, Output, and General Purpose Options
  • Display Options
  • Trust Settings
  • Signing Options
  • Name Options
  • Text Options
• EXAMPLES
• NOTES
• CERTIFICATE EXTENSIONS
• BUGS
• SEE ALSO
• HISTORY
• COPYRIGHT

NAME

openssl-x509, x509 - Certificate display and signing utility

SYNOPSIS

openssl x509 [-help] [-inform DER|PEM] [-outform DER|PEM] [-keyform DER|PEM|ENGINE] [-CAform DER|PEM] [-CAkeyform DER|PEM] [-in filename] [-out filename] [-serial] [-hash] [-subject_hash] [-issuer_hash] [-ocspid] [-subject] [-issuer] [-nameopt option] [-email] [-ocsp_uri] [-startdate] [-enddate] [-purpose] [-dates] [-checkend num] [-modulus] [-pubkey] [-fingerprint] [-alias] [-noout] [-trustout] [-clrtrust] [-clrreject] [-addtrust arg] [-addreject arg] [-setalias arg] [-days arg] [-set_serial n] [-signkey arg] [-passin arg] [-x509toreq] [-req] [-CA filename] [-CAkey filename] [-CAcreateserial] [-CAserial filename] [-force_pubkey key] [-text] [-ext extensions] [-certopt option] [-C] [-digest] [-clrext] [-extfile filename] [-extensions section] [-sigopt nm:v] [-rand file...] [-writerand file] [-engine id] [-preserve_dates]

DESCRIPTION

The x509 command is a multi purpose certificate utility. It can be used to display certificate information, convert certificates to various forms, sign certificate requests like a "mini CA" or edit certificate trust settings.

Since there are a large number of options they will split up into various sections.

OPTIONS

Input, Output, and General Purpose Options

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format normally the command will expect an X509 certificate but this can change if other options such as -req are present. The DER format is the DER encoding of the certificate and PEM is the base64 encoding of the DER encoding with header and footer lines added. The default format is PEM.

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read a certificate from or standard input if this option is not specified.

-out filename

This specifies the output filename to write to or standard output by default.

-digest

The digest to use. This affects any signing or display option that uses a message digest, such as the -fingerprint, -signkey and -CA options. Any digest supported by the OpenSSL dgst command can be used. If not specified then SHA1 is used with -fingerprint or the default digest for the signing algorithm is used, typically SHA256.

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

-engine id

Specifying an engine (by its unique id string) will cause x509 to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

-preserve_dates

When signing a certificate, preserve the "notBefore" and "notAfter" dates instead of adjusting them to current time and duration. Cannot be used with the -days option.

Display Options

Note: the -alias and -purpose options are also display options but are described in the TRUST SETTINGS section.

-text

Prints out the certificate in text form. Full details are output including the public key, signature algorithms, issuer and subject names, serial number any extensions present and any trust settings.

-ext extensions

Prints out the certificate extensions in text form. Extensions are specified with a comma separated string, e.g., "subjectAltName,subjectKeyIdentifier". See the x509v3_config(5) manual page for the extension names.

-certopt option

Customise the output format used with -text. The option argument can be a single option or multiple options separated by commas. The -certopt switch may be also be used more than once to set multiple options. See the TEXT OPTIONS section for more information.

-noout

This option prevents output of the encoded version of the certificate.

-pubkey

Outputs the certificate's SubjectPublicKeyInfo block in PEM format.

-modulus

This option prints out the value of the modulus of the public key contained in the certificate.

-serial

Outputs the certificate serial number.

-subject_hash

Outputs the "hash" of the certificate subject name. This is used in OpenSSL to form an index to allow certificates in a directory to be looked up by subject name.

-issuer_hash

Outputs the "hash" of the certificate issuer name.

-ocspid

Outputs the OCSP hash values for the subject name and public key.

-hash

Synonym for "-subject_hash" for backward compatibility reasons.

-subject_hash_old

Outputs the "hash" of the certificate subject name using the older algorithm as used by OpenSSL before version 1.0.0.

-issuer_hash_old

Outputs the "hash" of the certificate issuer name using the older algorithm as used by OpenSSL before version 1.0.0.

-subject

Outputs the subject name.

-issuer

Outputs the issuer name.

-nameopt option

Option which determines how the subject or issuer names are displayed. The option argument can be a single option or multiple options separated by commas. Alternatively the -nameopt switch may be used more than once to set multiple options. See the NAME OPTIONS section for more information.

-email

Outputs the email address(es) if any.

-ocsp_uri

Outputs the OCSP responder address(es) if any.

-startdate

Prints out the start date of the certificate, that is the notBefore date.

-enddate

Prints out the expiry date of the certificate, that is the notAfter date.

-dates

Prints out the start and expiry dates of a certificate.

-checkend arg

Checks if the certificate expires within the next arg seconds and exits nonzero if yes it will expire or zero if not.

-fingerprint

Calculates and outputs the digest of the DER encoded version of the entire certificate (see digest options). This is commonly called a "fingerprint". Because of the nature of message digests, the fingerprint of a certificate is unique to that certificate and two certificates with the same fingerprint can be considered to be the same.

-C

This outputs the certificate in the form of a C source file.

Trust Settings

A trusted certificate is an ordinary certificate which has several additional pieces of information attached to it such as the permitted and prohibited uses of the certificate and an "alias".

Normally when a certificate is being verified at least one certificate must be "trusted". By default a trusted certificate must be stored locally and must be a root CA: any certificate chain ending in this CA is then usable for any purpose.

Trust settings currently are only used with a root CA. They allow a finer control over the purposes the root CA can be used for. For example a CA may be trusted for SSL client but not SSL server use.

See the description of the verify utility for more information on the meaning of trust settings.

Future versions of OpenSSL will recognize trust settings on any certificate: not just root CAs.

-trustout

This causes x509 to output a trusted certificate. An ordinary or trusted certificate can be input but by default an ordinary certificate is output and any trust settings are discarded. With the -trustout option a trusted certificate is output. A trusted certificate is automatically output if any trust settings are modified.

-setalias arg

Sets the alias of the certificate. This will allow the certificate to be referred to using a nickname for example "Steve's Certificate".

-alias

Outputs the certificate alias, if any.

-clrtrust

Clears all the permitted or trusted uses of the certificate.

-clrreject

Clears all the prohibited or rejected uses of the certificate.

-addtrust arg

Adds a trusted certificate use. Any object name can be used here but currently only clientAuth (SSL client use), serverAuth (SSL server use), emailProtection (S/MIME email) and anyExtendedKeyUsage are used. As of OpenSSL 1.1.0, the last of these blocks all purposes when rejected or enables all purposes when trusted. Other OpenSSL applications may define additional uses.

-addreject arg

Adds a prohibited use. It accepts the same values as the -addtrust option.

-purpose

This option performs tests on the certificate extensions and outputs the results. For a more complete description see the CERTIFICATE EXTENSIONS section.

Signing Options

The x509 utility can be used to sign certificates and requests: it can thus behave like a "mini CA".

-signkey arg

This option causes the input file to be self signed using the supplied private key or engine. The private key's format is specified with the -keyform option.

If the input file is a certificate it sets the issuer name to the subject name (i.e. makes it self signed) changes the public key to the supplied value and changes the start and end dates. The start date is set to the current time and the end date is set to a value determined by the -days option. Any certificate extensions are retained unless the -clrext option is supplied; this includes, for example, any existing key identifier extensions.

If the input is a certificate request then a self signed certificate is created using the supplied private key using the subject name in the request.

-sigopt nm:v

Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.

-passin arg

The key password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-clrext

Delete any extensions from a certificate. This option is used when a certificate is being created from another certificate (for example with the -signkey or the -CA options). Normally all extensions are retained.

-keyform PEM|DER|ENGINE

Specifies the format (DER or PEM) of the private key file used in the -signkey option.

-days arg

Specifies the number of days to make a certificate valid for. The default is 30 days. Cannot be used with the -preserve_dates option.

-x509toreq

Converts a certificate into a certificate request. The -signkey option is used to pass the required private key.

-req

By default a certificate is expected on input. With this option a certificate request is expected instead.

-set_serial n

Specifies the serial number to use. This option can be used with either the -signkey or -CA options. If used in conjunction with the -CA option the serial number file (as specified by the -CAserial or -CAcreateserial options) is not used.

The serial number can be decimal or hex (if preceded by 0x).

-CA filename

Specifies the CA certificate to be used for signing. When this option is present x509 behaves like a "mini CA". The input file is signed by this CA using this option: that is its issuer name is set to the subject name of the CA and it is digitally signed using the CAs private key.

This option is normally combined with the -req option. Without the -req option the input is a certificate which must be self signed.

-CAkey filename

Sets the CA private key to sign a certificate with. If this option is not specified then it is assumed that the CA private key is present in the CA certificate file.

-CAserial filename

Sets the CA serial number file to use.

When creating a certificate with this option, and with the -CA option, the certificate serial number is stored in the given file. This file consists of one line containing an even number of hex digits with the serial number used last time. After reading this number, it is incremented and used, and the file is updated.

The default filename consists of the CA certificate file base name with ".srl" appended. For example if the CA certificate file is called "mycacert.pem" it expects to find a serial number file called "mycacert.srl".

If the -CA option is specified and neither <-CAserial> or <-CAcreateserial> is given and the default serial number file does not exist, a random number is generated; this is the recommended practice.

-CAcreateserial

With this option and the -CA option the CA serial number file is created if it does not exist. A random number is generated, used for the certificate, and saved into the serial number file determined as described above.

-extfile filename

File containing certificate extensions to use. If not specified then no extensions are added to the certificate.

-extensions section

The section to add certificate extensions from. If this option is not specified then the extensions should either be contained in the unnamed (default) section or the default section should contain a variable called "extensions" which contains the section to use. See the x509v3_config(5) manual page for details of the extension section format.

-force_pubkey key

When a certificate is created set its public key to key instead of the key in the certificate or certificate request. This option is useful for creating certificates where the algorithm can't normally sign requests, for example DH.

The format or key can be specified using the -keyform option.

Name Options

The nameopt command line switch determines how the subject and issuer names are displayed. If no nameopt switch is present the default "oneline" format is used which is compatible with previous versions of OpenSSL. Each option is described in detail below, all options can be preceded by a - to turn the option off. Only the first four will normally be used.

compat

Use the old format.

RFC2253

Displays names compatible with RFC2253 equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_unknown, dump_der, sep_comma_plus, dn_rev and sname.

oneline

A oneline format which is more readable than RFC2253. It is equivalent to specifying the esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_der, use_quote, sep_comma_plus_space, space_eq and sname options. This is the default of no name options are given explicitly.

multiline

A multiline format. It is equivalent esc_ctrl, esc_msb, sep_multiline, space_eq, lname and align.

esc_2253

Escape the "special" characters required by RFC2253 in a field. That is ,+"<>;. Additionally # is escaped at the beginning of a string and a space character at the beginning or end of a string.

esc_2254

Escape the "special" characters required by RFC2254 in a field. That is the NUL character as well as and ()*.

esc_ctrl

Escape control characters. That is those with ASCII values less than 0x20 (space) and the delete (0x7f) character. They are escaped using the RFC2253 \XX notation (where XX are two hex digits representing the character value).

esc_msb

Escape characters with the MSB set, that is with ASCII values larger than 127.

use_quote

Escapes some characters by surrounding the whole string with " characters, without the option all escaping is done with the \ character.

utf8

Convert all strings to UTF8 format first. This is required by RFC2253. If you are lucky enough to have a UTF8 compatible terminal then the use of this option (and not setting esc_msb) may result in the correct display of multibyte (international) characters. Is this option is not present then multibyte characters larger than 0xff will be represented using the format \UXXXX for 16 bits and \WXXXXXXXX for 32 bits. Also if this option is off any UTF8Strings will be converted to their character form first.

ignore_type

This option does not attempt to interpret multibyte characters in any way. That is their content octets are merely dumped as though one octet represents each character. This is useful for diagnostic purposes but will result in rather odd looking output.

show_type

Show the type of the ASN1 character string. The type precedes the field contents. For example "BMPSTRING: Hello World".

dump_der

When this option is set any fields that need to be hexdumped will be dumped using the DER encoding of the field. Otherwise just the content octets will be displayed. Both options use the RFC2253 #XXXX... format.

dump_nostr

Dump non character string types (for example OCTET STRING) if this option is not set then non character string types will be displayed as though each content octet represents a single character.

dump_all

Dump all fields. This option when used with dump_der allows the DER encoding of the structure to be unambiguously determined.

dump_unknown

Dump any field whose OID is not recognised by OpenSSL.

sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline

These options determine the field separators. The first character is between RDNs and the second between multiple AVAs (multiple AVAs are very rare and their use is discouraged). The options ending in "space" additionally place a space after the separator to make it more readable. The sep_multiline uses a linefeed character for the RDN separator and a spaced + for the AVA separator. It also indents the fields by four characters. If no field separator is specified then sep_comma_plus_space is used by default.

dn_rev

Reverse the fields of the DN. This is required by RFC2253. As a side effect this also reverses the order of multiple AVAs but this is permissible.

nofname, sname, lname, oid

These options alter how the field name is displayed. nofname does not display the field at all. sname uses the "short name" form (CN for commonName for example). lname uses the long form. oid represents the OID in numerical form and is useful for diagnostic purpose.

align

Align field values for a more readable output. Only usable with sep_multiline.

space_eq

Places spaces round the = character which follows the field name.

Text Options

As well as customising the name output format, it is also possible to customise the actual fields printed using the certopt options when the text option is present. The default behaviour is to print all fields.

compatible

Use the old format. This is equivalent to specifying no output options at all.

no_header

Don't print header information: that is the lines saying "Certificate" and "Data".

no_version

Don't print out the version number.

no_serial

Don't print out the serial number.

no_signame

Don't print out the signature algorithm used.

no_validity

Don't print the validity, that is the notBefore and notAfter fields.

no_subject

Don't print out the subject name.

no_issuer

Don't print out the issuer name.

no_pubkey

Don't print out the public key.

no_sigdump

Don't give a hexadecimal dump of the certificate signature.

no_aux

Don't print out certificate trust information.

no_extensions

Don't print out any X509V3 extensions.

ext_default

Retain default extension behaviour: attempt to print out unsupported certificate extensions.

ext_error

Print an error message for unsupported certificate extensions.

ext_parse

ASN1 parse unsupported extensions.

ext_dump

Hex dump unsupported extensions.

ca_default

The value used by the ca utility, equivalent to no_issuer, no_pubkey, no_header, and no_version.

EXAMPLES

Note: in these examples the '\' means the example should be all on one line.

Display the contents of a certificate:

 openssl x509 -in cert.pem -noout -text

Display the "Subject Alternative Name" extension of a certificate:

 openssl x509 -in cert.pem -noout -ext subjectAltName

Display more extensions of a certificate:

 openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType

Display the certificate serial number:

 openssl x509 -in cert.pem -noout -serial

Display the certificate subject name:

 openssl x509 -in cert.pem -noout -subject

Display the certificate subject name in RFC2253 form:

 openssl x509 -in cert.pem -noout -subject -nameopt RFC2253

Display the certificate subject name in oneline form on a terminal supporting UTF8:

 openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb

Display the certificate SHA1 fingerprint:

 openssl x509 -sha1 -in cert.pem -noout -fingerprint

Convert a certificate from PEM to DER format:

 openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER

Convert a certificate to a certificate request:

 openssl x509 -x509toreq -in cert.pem -out req.pem -signkey key.pem

Convert a certificate request into a self signed certificate using extensions for a CA:

 openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca \
        -signkey key.pem -out cacert.pem

Sign a certificate request using the CA certificate above and add user certificate extensions:

 openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr \
        -CA cacert.pem -CAkey key.pem -CAcreateserial

Set a certificate to be trusted for SSL client use and change set its alias to "Steve's Class 1 CA"

 openssl x509 -in cert.pem -addtrust clientAuth \
        -setalias "Steve's Class 1 CA" -out trust.pem

NOTES

The PEM format uses the header and footer lines:

 -----BEGIN CERTIFICATE-----
 -----END CERTIFICATE-----

it will also handle files containing:

 -----BEGIN X509 CERTIFICATE-----
 -----END X509 CERTIFICATE-----

Trusted certificates have the lines

 -----BEGIN TRUSTED CERTIFICATE-----
 -----END TRUSTED CERTIFICATE-----

The conversion to UTF8 format used with the name options assumes that T61Strings use the ISO8859-1 character set. This is wrong but Netscape and MSIE do this as do many certificates. So although this is incorrect it is more likely to display the majority of certificates correctly.

The -email option searches the subject name and the subject alternative name extension. Only unique email addresses will be printed out: it will not print the same address more than once.

CERTIFICATE EXTENSIONS

The -purpose option checks the certificate extensions and determines what the certificate can be used for. The actual checks done are rather complex and include various hacks and workarounds to handle broken certificates and software.

The same code is used when verifying untrusted certificates in chains so this section is useful if a chain is rejected by the verify code.

The basicConstraints extension CA flag is used to determine whether the certificate can be used as a CA. If the CA flag is true then it is a CA, if the CA flag is false then it is not a CA. All CAs should have the CA flag set to true.

If the basicConstraints extension is absent then the certificate is considered to be a "possible CA" other extensions are checked according to the intended use of the certificate. A warning is given in this case because the certificate should really not be regarded as a CA: however it is allowed to be a CA to work around some broken software.

If the certificate is a V1 certificate (and thus has no extensions) and it is self signed it is also assumed to be a CA but a warning is again given: this is to work around the problem of Verisign roots which are V1 self signed certificates.

If the keyUsage extension is present then additional restraints are made on the uses of the certificate. A CA certificate must have the keyCertSign bit set if the keyUsage extension is present.

The extended key usage extension places additional restrictions on the certificate uses. If this extension is present (whether critical or not) the key can only be used for the purposes specified.

A complete description of each test is given below. The comments about basicConstraints and keyUsage and V1 certificates above apply to all CA certificates.

SSL Client

The extended key usage extension must be absent or include the "web client authentication" OID. keyUsage must be absent or it must have the digitalSignature bit set. Netscape certificate type must be absent or it must have the SSL client bit set.

SSL Client CA

The extended key usage extension must be absent or include the "web client authentication" OID. Netscape certificate type must be absent or it must have the SSL CA bit set: this is used as a work around if the basicConstraints extension is absent.

SSL Server

The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. keyUsage must be absent or it must have the digitalSignature, the keyEncipherment set or both bits set. Netscape certificate type must be absent or have the SSL server bit set.

SSL Server CA

The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. Netscape certificate type must be absent or the SSL CA bit must be set: this is used as a work around if the basicConstraints extension is absent.

Netscape SSL Server

For Netscape SSL clients to connect to an SSL server it must have the keyEncipherment bit set if the keyUsage extension is present. This isn't always valid because some cipher suites use the key for digital signing. Otherwise it is the same as a normal SSL server.

Common S/MIME Client Tests

The extended key usage extension must be absent or include the "email protection" OID. Netscape certificate type must be absent or should have the S/MIME bit set. If the S/MIME bit is not set in Netscape certificate type then the SSL client bit is tolerated as an alternative but a warning is shown: this is because some Verisign certificates don't set the S/MIME bit.

S/MIME Signing

In addition to the common S/MIME client tests the digitalSignature bit or the nonRepudiation bit must be set if the keyUsage extension is present.

S/MIME Encryption

In addition to the common S/MIME tests the keyEncipherment bit must be set if the keyUsage extension is present.

S/MIME CA

The extended key usage extension must be absent or include the "email protection" OID. Netscape certificate type must be absent or must have the S/MIME CA bit set: this is used as a work around if the basicConstraints extension is absent.

CRL Signing

The keyUsage extension must be absent or it must have the CRL signing bit set.

CRL Signing CA

The normal CA tests apply. Except in this case the basicConstraints extension must be present.

BUGS

Extensions in certificates are not transferred to certificate requests and vice versa.

It is possible to produce invalid certificates or requests by specifying the wrong private key or using inconsistent options in some cases: these should be checked.

There should be options to explicitly set such things as start and end dates rather than an offset from the current time.

SEE ALSO

req(1), ca(1), genrsa(1), gendsa(1), verify(1), x509v3_config(5)

HISTORY

The hash algorithm used in the -subject_hash and -issuer_hash options before OpenSSL 1.0.0 was based on the deprecated MD5 algorithm and the encoding of the distinguished name. In OpenSSL 1.0.0 and later it is based on a canonical version of the DN using SHA1. This means that any directories using the old form must have their links rebuilt using c_rehash or similar.

COPYRIGHT

Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• EXAMPLES
• SEE ALSO
• COPYRIGHT

NAME

openssl-dsa, dsa - DSA key processing

SYNOPSIS

openssl dsa [-help] [-inform PEM|DER] [-outform PEM|DER] [-in filename] [-passin arg] [-out filename] [-passout arg] [-aes128] [-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128] [-camellia192] [-camellia256] [-des] [-des3] [-idea] [-text] [-noout] [-modulus] [-pubin] [-pubout] [-engine id]

DESCRIPTION

The dsa command processes DSA keys. They can be converted between various forms and their components printed out. Note This command uses the traditional SSLeay compatible format for private key encryption: newer applications should use the more secure PKCS#8 format using the pkcs8

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format. The DER option with a private key uses an ASN1 DER encoded form of an ASN.1 SEQUENCE consisting of the values of version (currently zero), p, q, g, the public and private key components respectively as ASN.1 INTEGERs. When used with a public key it uses a SubjectPublicKeyInfo structure: it is an error if the key is not DSA.

The PEM form is the default format: it consists of the DER format base64 encoded with additional header and footer lines. In the case of a private key PKCS#8 format is also accepted.

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.

-passin arg

The input file password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-out filename

This specifies the output filename to write a key to or standard output by is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should not be the same as the input filename.

-passout arg

The output file password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea

These options encrypt the private key with the specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the dsa utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.

-text

Prints out the public, private key components and parameters.

-noout

This option prevents output of the encoded version of the key.

-modulus

This option prints out the value of the public key component of the key.

-pubin

By default, a private key is read from the input file. With this option a public key is read instead.

-pubout

By default, a private key is output. With this option a public key will be output instead. This option is automatically set if the input is a public key.

-engine id

Specifying an engine (by its unique id string) will cause dsa to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

NOTES

The PEM private key format uses the header and footer lines:

 -----BEGIN DSA PRIVATE KEY-----
 -----END DSA PRIVATE KEY-----

The PEM public key format uses the header and footer lines:

 -----BEGIN PUBLIC KEY-----
 -----END PUBLIC KEY-----

EXAMPLES

To remove the pass phrase on a DSA private key:

 openssl dsa -in key.pem -out keyout.pem

To encrypt a private key using triple DES:

 openssl dsa -in key.pem -des3 -out keyout.pem

To convert a private key from PEM to DER format:

 openssl dsa -in key.pem -outform DER -out keyout.der

To print out the components of a private key to standard output:

 openssl dsa -in key.pem -text -noout

To just output the public part of a private key:

 openssl dsa -in key.pem -pubout -out pubkey.pem

SEE ALSO

dsaparam(1), gendsa(1), rsa(1), genrsa(1)

COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• EXIT CODES
• EXAMPLES
• BUGS
• HISTORY
• COPYRIGHT

NAME

openssl-smime, smime - S/MIME utility

SYNOPSIS

openssl smime [-help] [-encrypt] [-decrypt] [-sign] [-resign] [-verify] [-pk7out] [-binary] [-crlfeol] [-cipher] [-in file] [-CAfile file] [-CApath dir] [-no-CAfile] [-no-CApath] [-attime timestamp] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-certfile file] [-signer file] [-recip file] [-inform SMIME|PEM|DER] [-passin arg] [-inkey file_or_id] [-out file] [-outform SMIME|PEM|DER] [-content file] [-to addr] [-from ad] [-subject s] [-text] [-indef] [-noindef] [-stream] [-rand file...] [-writerand file] [-md digest] [cert.pem]...

DESCRIPTION

The smime command handles S/MIME mail. It can encrypt, decrypt, sign and verify S/MIME messages.

OPTIONS

There are six operation options that set the type of operation to be performed. The meaning of the other options varies according to the operation type.

-help

Print out a usage message.

-encrypt

Encrypt mail for the given recipient certificates. Input file is the message to be encrypted. The output file is the encrypted mail in MIME format.

Note that no revocation check is done for the recipient cert, so if that key has been compromised, others may be able to decrypt the text.

-decrypt

Decrypt mail using the supplied certificate and private key. Expects an encrypted mail message in MIME format for the input file. The decrypted mail is written to the output file.

-sign

Sign mail using the supplied certificate and private key. Input file is the message to be signed. The signed message in MIME format is written to the output file.

-verify

Verify signed mail. Expects a signed mail message on input and outputs the signed data. Both clear text and opaque signing is supported.

-pk7out

Takes an input message and writes out a PEM encoded PKCS#7 structure.

-resign

Resign a message: take an existing message and one or more new signers.

-in filename

The input message to be encrypted or signed or the MIME message to be decrypted or verified.

-inform SMIME|PEM|DER

This specifies the input format for the PKCS#7 structure. The default is SMIME which reads an S/MIME format message. PEM and DER format change this to expect PEM and DER format PKCS#7 structures instead. This currently only affects the input format of the PKCS#7 structure, if no PKCS#7 structure is being input (for example with -encrypt or -sign) this option has no effect.

-out filename

The message text that has been decrypted or verified or the output MIME format message that has been signed or verified.

-outform SMIME|PEM|DER

This specifies the output format for the PKCS#7 structure. The default is SMIME which write an S/MIME format message. PEM and DER format change this to write PEM and DER format PKCS#7 structures instead. This currently only affects the output format of the PKCS#7 structure, if no PKCS#7 structure is being output (for example with -verify or -decrypt) this option has no effect.

-stream -indef -noindef

The -stream and -indef options are equivalent and enable streaming I/O for encoding operations. This permits single pass processing of data without the need to hold the entire contents in memory, potentially supporting very large files. Streaming is automatically set for S/MIME signing with detached data if the output format is SMIME it is currently off by default for all other operations.

-noindef

Disable streaming I/O where it would produce and indefinite length constructed encoding. This option currently has no effect. In future streaming will be enabled by default on all relevant operations and this option will disable it.

-content filename

This specifies a file containing the detached content, this is only useful with the -verify command. This is only usable if the PKCS#7 structure is using the detached signature form where the content is not included. This option will override any content if the input format is S/MIME and it uses the multipart/signed MIME content type.

-text

This option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs.

-CAfile file

A file containing trusted CA certificates, only used with -verify.

-CApath dir

A directory containing trusted CA certificates, only used with -verify. This directory must be a standard certificate directory: that is a hash of each subject name (using x509 -hash) should be linked to each certificate.

-no-CAfile

Do not load the trusted CA certificates from the default file location.

-no-CApath

Do not load the trusted CA certificates from the default directory location.

-md digest

Digest algorithm to use when signing or resigning. If not present then the default digest algorithm for the signing key will be used (usually SHA1).

-cipher

The encryption algorithm to use. For example DES (56 bits) - -des, triple DES (168 bits) - -des3, EVP_get_cipherbyname() function) can also be used preceded by a dash, for example -aes-128-cbc. See enc for list of ciphers supported by your version of OpenSSL.

If not specified triple DES is used. Only used with -encrypt.

-nointern

When verifying a message normally certificates (if any) included in the message are searched for the signing certificate. With this option only the certificates specified in the -certfile option are used. The supplied certificates can still be used as untrusted CAs however.

-noverify

Do not verify the signers certificate of a signed message.

-nochain

Do not do chain verification of signers certificates: that is don't use the certificates in the signed message as untrusted CAs.

-nosigs

Don't try to verify the signatures on the message.

-nocerts

When signing a message the signer's certificate is normally included with this option it is excluded. This will reduce the size of the signed message but the verifier must have a copy of the signers certificate available locally (passed using the -certfile option for example).

-noattr

Normally when a message is signed a set of attributes are included which include the signing time and supported symmetric algorithms. With this option they are not included.

-binary

Normally the input message is converted to "canonical" format which is effectively using CR and LF as end of line: as required by the S/MIME specification. When this option is present no translation occurs. This is useful when handling binary data which may not be in MIME format.

-crlfeol

Normally the output file uses a single LF as end of line. When this option is present CRLF is used instead.

-nodetach

When signing a message use opaque signing: this form is more resistant to translation by mail relays but it cannot be read by mail agents that do not support S/MIME. Without this option cleartext signing with the MIME type multipart/signed is used.

-certfile file

Allows additional certificates to be specified. When signing these will be included with the message. When verifying these will be searched for the signers certificates. The certificates should be in PEM format.

-signer file

A signing certificate when signing or resigning a message, this option can be used multiple times if more than one signer is required. If a message is being verified then the signers certificates will be written to this file if the verification was successful.

-recip file

The recipients certificate when decrypting a message. This certificate must match one of the recipients of the message or an error occurs.

-inkey file_or_id

The private key to use when signing or decrypting. This must match the corresponding certificate. If this option is not specified then the private key must be included in the certificate file specified with the -recip or -signer file. When signing this option can be used multiple times to specify successive keys. If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.

-passin arg

The private key password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

cert.pem...

One or more certificates of message recipients: used when encrypting a message.

-to, -from, -subject

The relevant mail headers. These are included outside the signed portion of a message so they may be included manually. If signing then many S/MIME mail clients check the signers certificate's email address matches that specified in the From: address.

-attime, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict

Set various options of certificate chain verification. See verify(1) manual page for details.

NOTES

The MIME message must be sent without any blank lines between the headers and the output. Some mail programs will automatically add a blank line. Piping the mail directly to sendmail is one way to achieve the correct format.

The supplied message to be signed or encrypted must include the necessary MIME headers or many S/MIME clients won't display it properly (if at all). You can use the -text option to automatically add plain text headers.

A "signed and encrypted" message is one where a signed message is then encrypted. This can be produced by encrypting an already signed message: see the examples section.

This version of the program only allows one signer per message but it will verify multiple signers on received messages. Some S/MIME clients choke if a message contains multiple signers. It is possible to sign messages "in parallel" by signing an already signed message.

The options -encrypt and -decrypt reflect common usage in S/MIME clients. Strictly speaking these process PKCS#7 enveloped data: PKCS#7 encrypted data is used for other purposes.

The -resign option uses an existing message digest when adding a new signer. This means that attributes must be present in at least one existing signer using the same message digest or this operation will fail.

The -stream and -indef options enable streaming I/O support. As a result the encoding is BER using indefinite length constructed encoding and no longer DER. Streaming is supported for the -encrypt operation and the -sign operation if the content is not detached.

Streaming is always used for the -sign operation with detached data but since the content is no longer part of the PKCS#7 structure the encoding remains DER.

EXIT CODES

0

The operation was completely successfully.

1

An error occurred parsing the command options.

2

One of the input files could not be read.

3

An error occurred creating the PKCS#7 file or when reading the MIME message.

4

An error occurred decrypting or verifying the message.

5

The message was verified correctly but an error occurred writing out the signers certificates.

EXAMPLES

Create a cleartext signed message:

 openssl smime -sign -in message.txt -text -out mail.msg \
        -signer mycert.pem

Create an opaque signed message:

 openssl smime -sign -in message.txt -text -out mail.msg -nodetach \
        -signer mycert.pem

Create a signed message, include some additional certificates and read the private key from another file:

 openssl smime -sign -in in.txt -text -out mail.msg \
        -signer mycert.pem -inkey mykey.pem -certfile mycerts.pem

Create a signed message with two signers:

 openssl smime -sign -in message.txt -text -out mail.msg \
        -signer mycert.pem -signer othercert.pem

Send a signed message under Unix directly to sendmail, including headers:

 openssl smime -sign -in in.txt -text -signer mycert.pem \
        -from steve@openssl.org -to someone@somewhere \
        -subject "Signed message" | sendmail someone@somewhere

Verify a message and extract the signer's certificate if successful:

 openssl smime -verify -in mail.msg -signer user.pem -out signedtext.txt

Send encrypted mail using triple DES:

 openssl smime -encrypt -in in.txt -from steve@openssl.org \
        -to someone@somewhere -subject "Encrypted message" \
        -des3 user.pem -out mail.msg

Sign and encrypt mail:

 openssl smime -sign -in ml.txt -signer my.pem -text \
        | openssl smime -encrypt -out mail.msg \
        -from steve@openssl.org -to someone@somewhere \
        -subject "Signed and Encrypted message" -des3 user.pem

Note: the encryption command does not include the -text option because the message being encrypted already has MIME headers.

Decrypt mail:

 openssl smime -decrypt -in mail.msg -recip mycert.pem -inkey key.pem

The output from Netscape form signing is a PKCS#7 structure with the detached signature format. You can use this program to verify the signature by line wrapping the base64 encoded structure and surrounding it with:

 -----BEGIN PKCS7-----
 -----END PKCS7-----

and using the command:

 openssl smime -verify -inform PEM -in signature.pem -content content.txt

Alternatively you can base64 decode the signature and use:

 openssl smime -verify -inform DER -in signature.der -content content.txt

Create an encrypted message using 128 bit Camellia:

 openssl smime -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem

Add a signer to an existing message:

 openssl smime -resign -in mail.msg -signer newsign.pem -out mail2.msg

BUGS

The MIME parser isn't very clever: it seems to handle most messages that I've thrown at it but it may choke on others.

The code currently will only write out the signer's certificate to a file: if the signer has a separate encryption certificate this must be manually extracted. There should be some heuristic that determines the correct encryption certificate.

Ideally a database should be maintained of a certificates for each email address.

The code doesn't currently take note of the permitted symmetric encryption algorithms as supplied in the SMIMECapabilities signed attribute. This means the user has to manually include the correct encryption algorithm. It should store the list of permitted ciphers in a database and only use those.

No revocation checking is done on the signer's certificate.

The current code can only handle S/MIME v2 messages, the more complex S/MIME v3 structures may cause parsing errors.

HISTORY

The use of multiple -signer options and the -resign command were first added in OpenSSL 1.0.0

The -no_alt_chains option was added in OpenSSL 1.1.0.

COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• COPYRIGHT

NAME

openssl-prime, prime - compute prime numbers

SYNOPSIS

openssl prime [-help] [-hex] [-generate] [-bits] [-safe] [-checks] [number...]

DESCRIPTION

The prime command checks if the specified numbers are prime.

If no numbers are given on the command line, the -generate flag should be used to generate primes according to the requirements specified by the rest of the flags.

OPTIONS

[-help]

Display an option summary.

[-hex]

Generate hex output.

[-generate]

Generate a prime number.

[-bits num]

Generate a prime with num bits.

[-safe]

When used with -generate, generates a "safe" prime. If the number generated is n, then check that (n-1)/2 is also prime.

[-checks num]

Perform the checks num times to see that the generated number is prime. The default is 20.

COPYRIGHT

Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
  • Output
• NOTES
• EXAMPLES
• BUGS
• SEE ALSO
• COPYRIGHT

NAME

openssl-asn1parse, asn1parse - ASN.1 parsing tool

SYNOPSIS

openssl asn1parse [-help] [-inform PEM|DER] [-in filename] [-out filename] [-noout] [-offset number] [-length number] [-i] [-oid filename] [-dump] [-dlimit num] [-strparse offset] [-genstr string] [-genconf file] [-strictpem] [-item name]

DESCRIPTION

The asn1parse command is a diagnostic utility that can parse ASN.1 structures. It can also be used to extract data from ASN.1 formatted data.

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

The input format. DER is binary format and PEM (the default) is base64 encoded.

-in filename

The input file, default is standard input.

-out filename

Output file to place the DER encoded data into. If this option is not present then no data will be output. This is most useful when combined with the -strparse option.

-noout

Don't output the parsed version of the input file.

-offset number

Starting offset to begin parsing, default is start of file.

-length number

Number of bytes to parse, default is until end of file.

-i

Indents the output according to the "depth" of the structures.

-oid filename

A file containing additional OBJECT IDENTIFIERs (OIDs). The format of this file is described in the NOTES section below.

-dump

Dump unknown data in hex format.

-dlimit num

Like -dump, but only the first num bytes are output.

-strparse offset

Parse the contents octets of the ASN.1 object starting at offset. This option can be used multiple times to "drill down" into a nested structure.

-genstr string, -genconf file

Generate encoded data based on string, file or both using ASN1_generate_nconf(3) format. If file only is present then the string is obtained from the default section using the name asn1. The encoded data is passed through the ASN1 parser and printed out as though it came from a file, the contents can thus be examined and written to a file using the out option.

-strictpem

If this option is used then -inform will be ignored. Without this option any data in a PEM format input file will be treated as being base64 encoded and processed whether it has the normal PEM BEGIN and END markers or not. This option will ignore any data prior to the start of the BEGIN marker, or after an END marker in a PEM file.

-item name

Attempt to decode and print the data as ASN1_ITEM name. This can be used to print out the fields of any supported ASN.1 structure if the type is known.

Output

The output will typically contain lines like this:

  0:d=0  hl=4 l= 681 cons: SEQUENCE

.....

  229:d=3  hl=3 l= 141 prim: BIT STRING
  373:d=2  hl=3 l= 162 cons: cont [ 3 ]
  376:d=3  hl=3 l= 159 cons: SEQUENCE
  379:d=4  hl=2 l=  29 cons: SEQUENCE
  381:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Subject Key Identifier
  386:d=5  hl=2 l=  22 prim: OCTET STRING
  410:d=4  hl=2 l= 112 cons: SEQUENCE
  412:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Authority Key Identifier
  417:d=5  hl=2 l= 105 prim: OCTET STRING
  524:d=4  hl=2 l=  12 cons: SEQUENCE

.....

This example is part of a self-signed certificate. Each line starts with the offset in decimal. d=XX specifies the current depth. The depth is increased within the scope of any SET or SEQUENCE. hl=XX gives the header length (tag and length octets) of the current type. l=XX gives the length of the contents octets.

The -i option can be used to make the output more readable.

Some knowledge of the ASN.1 structure is needed to interpret the output.

In this example the BIT STRING at offset 229 is the certificate public key. The contents octets of this will contain the public key information. This can be examined using the option -strparse 229 to yield:

    0:d=0  hl=3 l= 137 cons: SEQUENCE
    3:d=1  hl=3 l= 129 prim: INTEGER           :E5D21E1F5C8D208EA7A2166C7FAF9F6BDF2059669C60876DDB70840F1A5AAFA59699FE471F379F1DD6A487E7D5409AB6A88D4A9746E24B91D8CF55DB3521015460C8EDE44EE8A4189F7A7BE77D6CD3A9AF2696F486855CF58BF0EDF2B4068058C7A947F52548DDF7E15E96B385F86422BEA9064A3EE9E1158A56E4A6F47E5897
  135:d=1  hl=2 l=   3 prim: INTEGER           :010001

NOTES

If an OID is not part of OpenSSL's internal table it will be represented in numerical form (for example 1.2.3.4). The file passed to the -oid option allows additional OIDs to be included. Each line consists of three columns, the first column is the OID in numerical format and should be followed by white space. The second column is the "short name" which is a single word followed by white space. The final column is the rest of the line and is the "long name". asn1parse displays the long name. Example:

1.2.3.4 shortName A long name

EXAMPLES

Parse a file:

 openssl asn1parse -in file.pem

Parse a DER file:

 openssl asn1parse -inform DER -in file.der

Generate a simple UTF8String:

 openssl asn1parse -genstr 'UTF8:Hello World'

Generate and write out a UTF8String, don't print parsed output:

 openssl asn1parse -genstr 'UTF8:Hello World' -noout -out utf8.der

Generate using a config file:

 openssl asn1parse -genconf asn1.cnf -noout -out asn1.der

Example config file:

 asn1=SEQUENCE:seq_sect

 [seq_sect]

 field1=BOOL:TRUE
 field2=EXP:0, UTF8:some random string

BUGS

There should be options to change the format of output lines. The output of some ASN.1 types is not well handled (if at all).

SEE ALSO

ASN1_generate_nconf(3)

COPYRIGHT

Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• RSA ALGORITHM
• RSA-PSS ALGORITHM
• DSA ALGORITHM
• DH ALGORITHM
• EC ALGORITHM
• X25519 and X448 ALGORITHMS
• EXAMPLES
• SEE ALSO
• COPYRIGHT

NAME

openssl-pkeyutl, pkeyutl - public key algorithm utility

SYNOPSIS

openssl pkeyutl [-help] [-in file] [-out file] [-sigfile file] [-inkey file] [-keyform PEM|DER|ENGINE] [-passin arg] [-peerkey file] [-peerform PEM|DER|ENGINE] [-pubin] [-certin] [-rev] [-sign] [-verify] [-verifyrecover] [-encrypt] [-decrypt] [-derive] [-kdf algorithm] [-kdflen length] [-pkeyopt opt:value] [-hexdump] [-asn1parse] [-rand file...] [-writerand file] [-engine id] [-engine_impl]

DESCRIPTION

The pkeyutl command can be used to perform low-level public key operations using any supported algorithm.

OPTIONS

-help

Print out a usage message.

-in filename

This specifies the input filename to read data from or standard input if this option is not specified.

-out filename

Specifies the output filename to write to or standard output by default.

-sigfile file

Signature file, required for verify operations only

-inkey file

The input key file, by default it should be a private key.

-keyform PEM|DER|ENGINE

The key format PEM, DER or ENGINE. Default is PEM.

-passin arg

The input key password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-peerkey file

The peer key file, used by key derivation (agreement) operations.

-peerform PEM|DER|ENGINE

The peer key format PEM, DER or ENGINE. Default is PEM.

-pubin

The input file is a public key.

-certin

The input is a certificate containing a public key.

-rev

Reverse the order of the input buffer. This is useful for some libraries (such as CryptoAPI) which represent the buffer in little endian format.

-sign

Sign the input data (which must be a hash) and output the signed result. This requires a private key.

-verify

Verify the input data (which must be a hash) against the signature file and indicate if the verification succeeded or failed.

-verifyrecover

Verify the input data (which must be a hash) and output the recovered data.

-encrypt

Encrypt the input data using a public key.

-decrypt

Decrypt the input data using a private key.

-derive

Derive a shared secret using the peer key.

-kdf algorithm

Use key derivation function algorithm. The supported algorithms are at present TLS1-PRF and HKDF. Note: additional parameters and the KDF output length will normally have to be set for this to work. See EVP_PKEY_CTX_set_hkdf_md(3) and EVP_PKEY_CTX_set_tls1_prf_md(3) for the supported string parameters of each algorithm.

-kdflen length

Set the output length for KDF.

-pkeyopt opt:value

Public key options specified as opt:value. See NOTES below for more details.

-hexdump

hex dump the output data.

-asn1parse

Parse the ASN.1 output data, this is useful when combined with the -verifyrecover option when an ASN1 structure is signed.

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

-engine id

Specifying an engine (by its unique id string) will cause pkeyutl to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

-engine_impl

When used with the -engine option, it specifies to also use engine id for crypto operations.

NOTES

The operations and options supported vary according to the key algorithm and its implementation. The OpenSSL operations and options are indicated below.

Unless otherwise mentioned all algorithms support the digest:alg option which specifies the digest in use for sign, verify and verifyrecover operations. The value alg should represent a digest name as used in the EVP_get_digestbyname() function for example sha1. This value is not used to hash the input data. It is used (by some algorithms) for sanity-checking the lengths of data passed in to the pkeyutl and for creating the structures that make up the signature (e.g. DigestInfo in RSASSA PKCS#1 v1.5 signatures).

This utility does not hash the input data but rather it will use the data directly as input to the signature algorithm. Depending on the key type, signature type, and mode of padding, the maximum acceptable lengths of input data differ. The signed data can't be longer than the key modulus with RSA. In case of ECDSA and DSA the data shouldn't be longer than the field size, otherwise it will be silently truncated to the field size. In any event the input size must not be larger than the largest supported digest size.

In other words, if the value of digest is sha1 the input should be the 20 bytes long binary encoding of the SHA-1 hash function output.

The Ed25519 and Ed448 signature algorithms are not supported by this utility. They accept non-hashed input, but this utility can only be used to sign hashed input.

RSA ALGORITHM

The RSA algorithm generally supports the encrypt, decrypt, sign, verify and verifyrecover operations. However, some padding modes support only a subset of these operations. The following additional pkeyopt values are supported:

rsa_padding_mode:mode

This sets the RSA padding mode. Acceptable values for mode are pkcs1 for PKCS#1 padding, sslv23 for SSLv23 padding, none for no padding, oaep for OAEP mode, x931 for X9.31 mode and pss for PSS.

In PKCS#1 padding if the message digest is not set then the supplied data is signed or verified directly instead of using a DigestInfo structure. If a digest is set then the a DigestInfo structure is used and its the length must correspond to the digest type.

For oaep mode only encryption and decryption is supported.

For x931 if the digest type is set it is used to format the block data otherwise the first byte is used to specify the X9.31 digest ID. Sign, verify and verifyrecover are can be performed in this mode.

For pss mode only sign and verify are supported and the digest type must be specified.

rsa_pss_saltlen:len

For pss mode only this option specifies the salt length. Three special values are supported: "digest" sets the salt length to the digest length, "max" sets the salt length to the maximum permissible value. When verifying "auto" causes the salt length to be automatically determined based on the PSS block structure.

rsa_mgf1_md:digest

For PSS and OAEP padding sets the MGF1 digest. If the MGF1 digest is not explicitly set in PSS mode then the signing digest is used.

rsa_oaep_md:digest

Sets the digest used for the OAEP hash function. If not explicitly set then SHA1 is used.

RSA-PSS ALGORITHM

The RSA-PSS algorithm is a restricted version of the RSA algorithm which only supports the sign and verify operations with PSS padding. The following additional pkeyopt values are supported:

rsa_padding_mode:mode, rsa_pss_saltlen:len, rsa_mgf1_md:digest

These have the same meaning as the RSA algorithm with some additional restrictions. The padding mode can only be set to pss which is the default value.

If the key has parameter restrictions than the digest, MGF1 digest and salt length are set to the values specified in the parameters. The digest and MG cannot be changed and the salt length cannot be set to a value less than the minimum restriction.

DSA ALGORITHM

The DSA algorithm supports signing and verification operations only. Currently there are no additional -pkeyopt options other than digest. The SHA1 digest is assumed by default.

DH ALGORITHM

The DH algorithm only supports the derivation operation and no additional -pkeyopt options.

EC ALGORITHM

The EC algorithm supports sign, verify and derive operations. The sign and verify operations use ECDSA and derive uses ECDH. SHA1 is assumed by default for the -pkeyopt digest option.

X25519 and X448 ALGORITHMS

The X25519 and X448 algorithms support key derivation only. Currently there are no additional options.

EXAMPLES

Sign some data using a private key:

 openssl pkeyutl -sign -in file -inkey key.pem -out sig

Recover the signed data (e.g. if an RSA key is used):

 openssl pkeyutl -verifyrecover -in sig -inkey key.pem

Verify the signature (e.g. a DSA key):

 openssl pkeyutl -verify -in file -sigfile sig -inkey key.pem

Sign data using a message digest value (this is currently only valid for RSA):

 openssl pkeyutl -sign -in file -inkey key.pem -out sig -pkeyopt digest:sha256

Derive a shared secret value:

 openssl pkeyutl -derive -inkey key.pem -peerkey pubkey.pem -out secret

Hexdump 48 bytes of TLS1 PRF using digest SHA256 and shared secret and seed consisting of the single byte 0xFF:

 openssl pkeyutl -kdf TLS1-PRF -kdflen 48 -pkeyopt md:SHA256 \
    -pkeyopt hexsecret:ff -pkeyopt hexseed:ff -hexdump

Decrypt some data using a private key with OAEP padding using SHA256:

 openssl pkeyutl -decrypt -in file -inkey key.pem -out secret \
    -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256

SEE ALSO

genpkey(1), pkey(1), rsautl(1) dgst(1), rsa(1), genrsa(1), EVP_PKEY_CTX_set_hkdf_md(3), EVP_PKEY_CTX_set_tls1_prf_md(3)

COPYRIGHT

Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• COPYRIGHT

NAME

openssl-srp, srp - maintain SRP password file

SYNOPSIS

openssl srp [-help] [-verbose] [-add] [-modify] [-delete] [-list] [-name section] [-config file] [-srpvfile file] [-gn identifier] [-userinfo text...] [-passin arg] [-passout arg] [user...]

DESCRIPTION

The srp command is user to maintain an SRP (secure remote password) file. At most one of the -add, -modify, -delete, and -list options can be specified. These options take zero or more usernames as parameters and perform the appropriate operation on the SRP file. For -list, if no user is given then all users are displayed.

The configuration file to use, and the section within the file, can be specified with the -config and -name flags, respectively. If the config file is not specified, the -srpvfile can be used to just specify the file to operate on.

The -userinfo option specifies additional information to add when adding or modifying a user.

The -gn flag specifies the g and N values, using one of the strengths defined in IETF RFC 5054.

The -passin and -passout arguments are parsed as described in the openssl(1) command.

OPTIONS

[-help]

Display an option summary.

[-verbose]

Generate verbose output while processing.

COPYRIGHT

Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• WARNINGS
• NOTES
• BUGS
• SEE ALSO
• COPYRIGHT

NAME

openssl-dhparam, dhparam - DH parameter manipulation and generation

SYNOPSIS

openssl dhparam [-help] [-inform DER|PEM] [-outform DER|PEM] [-in filename] [-out filename] [-dsaparam] [-check] [-noout] [-text] [-C] [-2] [-5] [-rand file...] [-writerand file] [-engine id] [numbits]

DESCRIPTION

This command is used to manipulate DH parameter files.

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format. The DER option uses an ASN1 DER encoded form compatible with the PKCS#3 DHparameter structure. The PEM form is the default format: it consists of the DER format base64 encoded with additional header and footer lines.

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read parameters from or standard input if this option is not specified.

-out filename

This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should not be the same as the input filename.

-dsaparam

If this option is used, DSA rather than DH parameters are read or created; they are converted to DH format. Otherwise, "strong" primes (such that (p-1)/2 is also prime) will be used for DH parameter generation.

DH parameter generation with the -dsaparam option is much faster, and the recommended exponent length is shorter, which makes DH key exchange more efficient. Beware that with such DSA-style DH parameters, a fresh DH key should be created for each use to avoid small-subgroup attacks that may be possible otherwise.

-check

Performs numerous checks to see if the supplied parameters are valid and displays a warning if not.

-2, -5

The generator to use, either 2 or 5. If present then the input file is ignored and parameters are generated instead. If not present but numbits is present, parameters are generated with the default generator 2.

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

numbits

This option specifies that a parameter set should be generated of size numbits. It must be the last option. If this option is present then the input file is ignored and parameters are generated instead. If this option is not present but a generator (-2 or -5) is present, parameters are generated with a default length of 2048 bits.

-noout

This option inhibits the output of the encoded version of the parameters.

-text

This option prints out the DH parameters in human readable form.

-C

This option converts the parameters into C code. The parameters can then be loaded by calling the get_dhNNNN() function.

-engine id

Specifying an engine (by its unique id string) will cause dhparam to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

WARNINGS

The program dhparam combines the functionality of the programs dh and gendh in previous versions of OpenSSL. The dh and gendh programs are retained for now but may have different purposes in future versions of OpenSSL.

NOTES

PEM format DH parameters use the header and footer lines:

 -----BEGIN DH PARAMETERS-----
 -----END DH PARAMETERS-----

OpenSSL currently only supports the older PKCS#3 DH, not the newer X9.42 DH.

This program manipulates DH parameters not keys.

BUGS

There should be a way to generate and manipulate DH keys.

SEE ALSO

dsaparam(1)

COPYRIGHT

Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• NOTES
• EXAMPLES
• BUGS
• SEE ALSO
• COPYRIGHT

NAME

openssl-rsa, rsa - RSA key processing tool

SYNOPSIS

openssl rsa [-help] [-inform PEM|DER] [-outform PEM|DER] [-in filename] [-passin arg] [-out filename] [-passout arg] [-aes128] [-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128] [-camellia192] [-camellia256] [-des] [-des3] [-idea] [-text] [-noout] [-modulus] [-check] [-pubin] [-pubout] [-RSAPublicKey_in] [-RSAPublicKey_out] [-engine id]

DESCRIPTION

The rsa command processes RSA keys. They can be converted between various forms and their components printed out. Note this command uses the traditional SSLeay compatible format for private key encryption: newer applications should use the more secure PKCS#8 format using the pkcs8 utility.

OPTIONS

-help

Print out a usage message.

-inform DER|PEM

This specifies the input format. The DER option uses an ASN1 DER encoded form compatible with the PKCS#1 RSAPrivateKey or SubjectPublicKeyInfo format. The PEM form is the default format: it consists of the DER format base64 encoded with additional header and footer lines. On input PKCS#8 format private keys are also accepted.

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.

-passin arg

The input file password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-out filename

This specifies the output filename to write a key to or standard output if this option is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should not be the same as the input filename.

-passout password

The output file password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea

These options encrypt the private key with the specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the rsa utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.

-text

Prints out the various public or private key components in plain text in addition to the encoded version.

-noout

This option prevents output of the encoded version of the key.

-modulus

This option prints out the value of the modulus of the key.

-check

This option checks the consistency of an RSA private key.

-pubin

By default a private key is read from the input file: with this option a public key is read instead.

-pubout

By default a private key is output: with this option a public key will be output instead. This option is automatically set if the input is a public key.

-RSAPublicKey_in, -RSAPublicKey_out

Like -pubin and -pubout except RSAPublicKey format is used instead.

-engine id

Specifying an engine (by its unique id string) will cause rsa to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

NOTES

The PEM private key format uses the header and footer lines:

 -----BEGIN RSA PRIVATE KEY-----
 -----END RSA PRIVATE KEY-----

The PEM public key format uses the header and footer lines:

 -----BEGIN PUBLIC KEY-----
 -----END PUBLIC KEY-----

The PEM RSAPublicKey format uses the header and footer lines:

 -----BEGIN RSA PUBLIC KEY-----
 -----END RSA PUBLIC KEY-----

EXAMPLES

To remove the pass phrase on an RSA private key:

 openssl rsa -in key.pem -out keyout.pem

To encrypt a private key using triple DES:

 openssl rsa -in key.pem -des3 -out keyout.pem

To convert a private key from PEM to DER format:

 openssl rsa -in key.pem -outform DER -out keyout.der

To print out the components of a private key to standard output:

 openssl rsa -in key.pem -text -noout

To just output the public part of a private key:

 openssl rsa -in key.pem -pubout -out pubkey.pem

Output the public part of a private key in RSAPublicKey format:

 openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem

BUGS

There should be an option that automatically handles .key files, without having to manually edit them.

SEE ALSO

pkcs8(1), dsa(1), genrsa(1), gendsa(1)

COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• SEE ALSO
• HISTORY
• COPYRIGHT

NAME

openssl-storeutl, storeutl - STORE utility

SYNOPSIS

openssl storeutl [-help] [-out file] [-noout] [-passin arg] [-text arg] [-engine id] [-r] [-certs] [-keys] [-crls] [-subject arg] [-issuer arg] [-serial arg] [-alias arg] [-fingerprint arg] [-digest] uri ...

DESCRIPTION

The storeutl command can be used to display the contents (after decryption as the case may be) fetched from the given URIs.

OPTIONS

-help

Print out a usage message.

-out filename

specifies the output filename to write to or standard output by default.

-noout

this option prevents output of the PEM data.

-passin arg

the key password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-text

Prints out the objects in text form, similarly to the -text output from openssl x509, openssl pkey, etc.

-engine id

specifying an engine (by its unique id string) will cause storeutl to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

-r

Fetch objects recursively when possible.

-certs

-keys

-crls

Only select the certificates, keys or CRLs from the given URI. However, if this URI would return a set of names (URIs), those are always returned.

-subject arg

Search for an object having the subject name arg. The arg must be formatted as /type0=value0/type1=value1/type2=.... Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted but are ignored for the search. That is, a search with an empty value will have the same effect as not specifying the type at all.

-issuer arg

-serial arg

Search for an object having the given issuer name and serial number. These two options must be used together. The issuer arg must be formatted as /type0=value0/type1=value1/type2=..., characters may be escaped by \ (backslash), no spaces are skipped. The serial arg may be specified as a decimal value or a hex value if preceded by 0x.

-alias arg

Search for an object having the given alias.

-fingerprint arg

Search for an object having the given fingerprint.

-digest

The digest that was used to compute the fingerprint given with -fingerprint.

SEE ALSO

openssl(1)

HISTORY

The openssl storeutl app was added in OpenSSL 1.1.1.

COPYRIGHT

Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
• CRL OPTIONS
• CONFIGURATION FILE OPTIONS
• POLICY FORMAT
• SPKAC FORMAT
• EXAMPLES
• FILES
• RESTRICTIONS
• BUGS
• WARNINGS
• HISTORY
• SEE ALSO
• COPYRIGHT

NAME

openssl-ca, ca - sample minimal CA application

SYNOPSIS

openssl ca [-help] [-verbose] [-config filename] [-name section] [-gencrl] [-revoke file] [-valid file] [-status serial] [-updatedb] [-crl_reason reason] [-crl_hold instruction] [-crl_compromise time] [-crl_CA_compromise time] [-crldays days] [-crlhours hours] [-crlexts section] [-startdate date] [-enddate date] [-days arg] [-md arg] [-policy arg] [-keyfile arg] [-keyform PEM|DER] [-key arg] [-passin arg] [-cert file] [-selfsign] [-in file] [-out file] [-notext] [-outdir dir] [-infiles] [-spkac file] [-ss_cert file] [-preserveDN] [-noemailDN] [-batch] [-msie_hack] [-extensions section] [-extfile section] [-engine id] [-subj arg] [-utf8] [-sigopt nm:v] [-create_serial] [-rand_serial] [-multivalue-rdn] [-rand file...] [-writerand file]

DESCRIPTION

The ca command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status.

The options descriptions will be divided into each purpose.

OPTIONS

-help

Print out a usage message.

-verbose

This prints extra details about the operations being performed.

-config filename

Specifies the configuration file to use. Optional; for a description of the default value, see "COMMAND SUMMARY" in openssl(1).

-name section

Specifies the configuration file section to use (overrides default_ca in the ca section).

-in filename

An input filename containing a single certificate request to be signed by the CA.

-ss_cert filename

A single self-signed certificate to be signed by the CA.

-spkac filename

A file containing a single Netscape signed public key and challenge and additional field values to be signed by the CA. See the SPKAC FORMAT section for information on the required input and output format.

-infiles

If present this should be the last option, all subsequent arguments are taken as the names of files containing certificate requests.

-out filename

The output file to output certificates to. The default is standard output. The certificate details will also be printed out to this file in PEM format (except that -spkac outputs DER format).

-outdir directory

The directory to output certificates to. The certificate will be written to a filename consisting of the serial number in hex with ".pem" appended.

-cert

The CA certificate file.

-keyfile filename

The private key to sign requests with.

-keyform PEM|DER

The format of the data in the private key file. The default is PEM.

-sigopt nm:v

Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.

-key password

The password used to encrypt the private key. Since on some systems the command line arguments are visible (e.g. Unix with the 'ps' utility) this option should be used with caution.

-selfsign

Indicates the issued certificates are to be signed with the key the certificate requests were signed with (given with -keyfile). Certificate requests signed with a different key are ignored. If -spkac, -ss_cert or -gencrl are given, -selfsign is ignored.

A consequence of using -selfsign is that the self-signed certificate appears among the entries in the certificate database (see the configuration option database), and uses the same serial number counter as all other certificates sign with the self-signed certificate.

-passin arg

The key password source. For more information about the format of arg see "Pass Phrase Options" in openssl(1).

-notext

Don't output the text form of a certificate to the output file.

-startdate date

This allows the start date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present.

-enddate date

This allows the expiry date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present.

-days arg

The number of days to certify the certificate for.

-md alg

The message digest to use. Any digest supported by the OpenSSL dgst command can be used. For signing algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message digest that is set is ignored. This option also applies to CRLs.

-policy arg

This option defines the CA "policy" to use. This is a section in the configuration file which decides which fields should be mandatory or match the CA certificate. Check out the POLICY FORMAT section for more information.

-msie_hack

This is a deprecated option to make ca work with very old versions of the IE certificate enrollment control "certenr3". It used UniversalStrings for almost everything. Since the old control has various security bugs its use is strongly discouraged.

-preserveDN

Normally the DN order of a certificate is the same as the order of the fields in the relevant policy section. When this option is set the order is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll.

-noemailDN

The DN of a certificate can contain the EMAIL field if present in the request DN, however, it is good policy just having the e-mail set into the altName extension of the certificate. When this option is set the EMAIL field is removed from the certificate' subject and set only in the, eventually present, extensions. The email_in_dn keyword can be used in the configuration file to enable this behaviour.

-batch

This sets the batch mode. In this mode no questions will be asked and all certificates will be certified automatically.

-extensions section

The section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to x509_extensions unless the -extfile option is used). If no extension section is present then, a V1 certificate is created. If the extension section is present (even if it is empty), then a V3 certificate is created. See the x509v3_config(5) manual page for details of the extension section format.

-extfile file

An additional configuration file to read certificate extensions from (using the default section unless the -extensions option is also used).

-engine id

Specifying an engine (by its unique id string) will cause ca to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.

-subj arg

Supersedes subject name given in the request. The arg must be formatted as /type0=value0/type1=value1/type2=.... Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted, but the corresponding type will not be included in the resulting certificate.

-utf8

This option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings.

-create_serial

If reading serial from the text file as specified in the configuration fails, specifying this option creates a new random serial to be used as next serial number. To get random serial numbers, use the -rand_serial flag instead; this should only be used for simple error-recovery.

-rand_serial

Generate a large random number to use as the serial number. This overrides any option or configuration to use a serial number file.

-multivalue-rdn

This option causes the -subj argument to be interpreted with full support for multivalued RDNs. Example:

/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe

If -multi-rdn is not used then the UID value is 123456+CN=John Doe.

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

CRL OPTIONS

-gencrl

This option generates a CRL based on information in the index file.

-crldays num

The number of days before the next CRL is due. That is the days from now to place in the CRL nextUpdate field.

-crlhours num

The number of hours before the next CRL is due.

-revoke filename

A filename containing a certificate to revoke.

-valid filename

A filename containing a certificate to add a Valid certificate entry.

-status serial

Displays the revocation status of the certificate with the specified serial number and exits.

-updatedb

Updates the database index to purge expired certificates.

-crl_reason reason

Revocation reason, where reason is one of: unspecified, keyCompromise, CACompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold or removeFromCRL. The matching of reason is case insensitive. Setting any revocation reason will make the CRL v2.

In practice removeFromCRL is not particularly useful because it is only used in delta CRLs which are not currently implemented.

-crl_hold instruction

This sets the CRL revocation reason code to certificateHold and the hold instruction to instruction which must be an OID. Although any OID can be used only holdInstructionNone (the use of which is discouraged by RFC2459) holdInstructionCallIssuer or holdInstructionReject will normally be used.

-crl_compromise time

This sets the revocation reason to keyCompromise and the compromise time to time. time should be in GeneralizedTime format that is YYYYMMDDHHMMSSZ.

-crl_CA_compromise time

This is the same as crl_compromise except the revocation reason is set to CACompromise.

-crlexts section

The section of the configuration file containing CRL extensions to include. If no CRL extension section is present then a V1 CRL is created, if the CRL extension section is present (even if it is empty) then a V2 CRL is created. The CRL extensions specified are CRL extensions and not CRL entry extensions. It should be noted that some software (for example Netscape) can't handle V2 CRLs. See x509v3_config(5) manual page for details of the extension section format.

CONFIGURATION FILE OPTIONS

The section of the configuration file containing options for ca is found as follows: If the -name command line option is used, then it names the section to be used. Otherwise the section to be used must be named in the default_ca option of the ca section of the configuration file (or in the default section of the configuration file). Besides default_ca, the following options are read directly from the ca section: RANDFILE preserve msie_hack With the exception of RANDFILE, this is probably a bug and may change in future releases.

Many of the configuration file options are identical to command line options. Where the option is present in the configuration file and the command line the command line value is used. Where an option is described as mandatory then it must be present in the configuration file or the command line equivalent (if any) used.

oid_file

This specifies a file containing additional OBJECT IDENTIFIERS. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed by white space and finally the long name.

oid_section

This specifies a section in the configuration file containing extra object identifiers. Each line should consist of the short name of the object identifier followed by = and the numerical form. The short and long names are the same when this option is used.

new_certs_dir

The same as the -outdir command line option. It specifies the directory where new certificates will be placed. Mandatory.

certificate

The same as -cert. It gives the file containing the CA certificate. Mandatory.

private_key

Same as the -keyfile option. The file containing the CA private key. Mandatory.

RANDFILE

At startup the specified file is loaded into the random number generator, and at exit 256 bytes will be written to it.

default_days

The same as the -days option. The number of days to certify a certificate for.

default_startdate

The same as the -startdate option. The start date to certify a certificate for. If not set the current time is used.

default_enddate

The same as the -enddate option. Either this option or default_days (or the command line equivalents) must be present.

default_crl_hours default_crl_days

The same as the -crlhours and the -crldays options. These will only be used if neither command line option is present. At least one of these must be present to generate a CRL.

default_md

The same as the -md option. Mandatory except where the signing algorithm does not require a digest (i.e. Ed25519 and Ed448).

database

The text database file to use. Mandatory. This file must be present though initially it will be empty.

unique_subject

If the value yes is given, the valid certificate entries in the database must have unique subjects. if the value no is given, several valid certificate entries may have the exact same subject. The default value is yes, to be compatible with older (pre 0.9.8) versions of OpenSSL. However, to make CA certificate roll-over easier, it's recommended to use the value no, especially if combined with the -selfsign command line option.

Note that it is valid in some circumstances for certificates to be created without any subject. In the case where there are multiple certificates without subjects this does not count as a duplicate.

serial

A text file containing the next serial number to use in hex. Mandatory. This file must be present and contain a valid serial number.

crlnumber

A text file containing the next CRL number to use in hex. The crl number will be inserted in the CRLs only if this file exists. If this file is present, it must contain a valid CRL number.

x509_extensions

The same as -extensions.

crl_extensions

The same as -crlexts.

preserve

The same as -preserveDN

email_in_dn

The same as -noemailDN. If you want the EMAIL field to be removed from the DN of the certificate simply set this to 'no'. If not present the default is to allow for the EMAIL filed in the certificate's DN.

msie_hack

The same as -msie_hack

policy

The same as -policy. Mandatory. See the POLICY FORMAT section for more information.

name_opt, cert_opt

These options allow the format used to display the certificate details when asking the user to confirm signing. All the options supported by the x509 utilities -nameopt and -certopt switches can be used here, except the no_signame and no_sigdump are permanently set and cannot be disabled (this is because the certificate signature cannot be displayed because the certificate has not been signed at this point).

For convenience the values ca_default are accepted by both to produce a reasonable output.

If neither option is present the format used in earlier versions of OpenSSL is used. Use of the old format is strongly discouraged because it only displays fields mentioned in the policy section, mishandles multicharacter string types and does not display extensions.

copy_extensions

Determines how extensions in certificate requests should be handled. If set to none or this option is not present then extensions are ignored and not copied to the certificate. If set to copy then any extensions present in the request that are not already present are copied to the certificate. If set to copyall then all extensions in the request are copied to the certificate: if the extension is already present in the certificate it is deleted first. See the WARNINGS section before using this option.

The main use of this option is to allow a certificate request to supply values for certain extensions such as subjectAltName.

POLICY FORMAT

The policy section consists of a set of variables corresponding to certificate DN fields. If the value is "match" then the field value must match the same field in the CA certificate. If the value is "supplied" then it must be present. If the value is "optional" then it may be present. Any fields not mentioned in the policy section are silently deleted, unless the -preserveDN option is set but this can be regarded more of a quirk than intended behaviour.

SPKAC FORMAT

The input to the -spkac command line option is a Netscape signed public key and challenge. This will usually come from the KEYGEN tag in an HTML form to create a new private key. It is however possible to create SPKACs using the spkac utility.

The file should contain the variable SPKAC set to the value of the SPKAC and also the required DN components as name value pairs. If you need to include the same component twice then it can be preceded by a number and a '.'.

When processing SPKAC format, the output is DER if the -out flag is used, but PEM format if sending to stdout or the -outdir flag is used.

EXAMPLES

Note: these examples assume that the ca directory structure is already set up and the relevant files already exist. This usually involves creating a CA certificate and private key with req, a serial number file and an empty index file and placing them in the relevant directories.

To use the sample configuration file below the directories demoCA, demoCA/private and demoCA/newcerts would be created. The CA certificate would be copied to demoCA/cacert.pem and its private key to demoCA/private/cakey.pem. A file demoCA/serial would be created containing for example "01" and the empty index file demoCA/index.txt.

Sign a certificate request:

 openssl ca -in req.pem -out newcert.pem

Sign a certificate request, using CA extensions:

 openssl ca -in req.pem -extensions v3_ca -out newcert.pem

Generate a CRL

 openssl ca -gencrl -out crl.pem

Sign several requests:

 openssl ca -infiles req1.pem req2.pem req3.pem

Certify a Netscape SPKAC:

 openssl ca -spkac spkac.txt

A sample SPKAC file (the SPKAC line has been truncated for clarity):

 SPKAC=MIG0MGAwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAn7PDhCeV/xIxUg8V70YRxK2A5
 CN=Steve Test
 emailAddress=steve@openssl.org
 0.OU=OpenSSL Group
 1.OU=Another Group

A sample configuration file with the relevant sections for ca:

 [ ca ]
 default_ca      = CA_default            # The default ca section

 [ CA_default ]

 dir            = ./demoCA              # top dir
 database       = $dir/index.txt        # index file.
 new_certs_dir  = $dir/newcerts         # new certs dir

 certificate    = $dir/cacert.pem       # The CA cert
 serial         = $dir/serial           # serial no file
 #rand_serial    = yes                  # for random serial#'s
 private_key    = $dir/private/cakey.pem# CA private key
 RANDFILE       = $dir/private/.rand    # random number file

 default_days   = 365                   # how long to certify for
 default_crl_days= 30                   # how long before next CRL
 default_md     = md5                   # md to use

 policy         = policy_any            # default policy
 email_in_dn    = no                    # Don't add the email into cert DN

 name_opt       = ca_default            # Subject name display option
 cert_opt       = ca_default            # Certificate display option
 copy_extensions = none                 # Don't copy extensions from request

 [ policy_any ]
 countryName            = supplied
 stateOrProvinceName    = optional
 organizationName       = optional
 organizationalUnitName = optional
 commonName             = supplied
 emailAddress           = optional

FILES

Note: the location of all files can change either by compile time options, configuration file entries, environment variables or command line options. The values below reflect the default values.

 /usr/local/ssl/lib/openssl.cnf - master configuration file
 ./demoCA                       - main CA directory
 ./demoCA/cacert.pem            - CA certificate
 ./demoCA/private/cakey.pem     - CA private key
 ./demoCA/serial                - CA serial number file
 ./demoCA/serial.old            - CA serial number backup file
 ./demoCA/index.txt             - CA text database file
 ./demoCA/index.txt.old         - CA text database backup file
 ./demoCA/certs                 - certificate output file
 ./demoCA/.rnd                  - CA random seed information

RESTRICTIONS

The text database index file is a critical part of the process and if corrupted it can be difficult to fix. It is theoretically possible to rebuild the index file from all the issued certificates and a current CRL: however there is no option to do this.

V2 CRL features like delta CRLs are not currently supported.

Although several requests can be input and handled at once it is only possible to include one SPKAC or self-signed certificate.

BUGS

The use of an in-memory text database can cause problems when large numbers of certificates are present because, as the name implies the database has to be kept in memory.

The ca command really needs rewriting or the required functionality exposed at either a command or interface level so a more friendly utility (perl script or GUI) can handle things properly. The script CA.pl helps a little but not very much.

Any fields in a request that are not present in a policy are silently deleted. This does not happen if the -preserveDN option is used. To enforce the absence of the EMAIL field within the DN, as suggested by RFCs, regardless the contents of the request' subject the -noemailDN option can be used. The behaviour should be more friendly and configurable.

Canceling some commands by refusing to certify a certificate can create an empty file.

WARNINGS

The ca command is quirky and at times downright unfriendly.

The ca utility was originally meant as an example of how to do things in a CA. It was not supposed to be used as a full blown CA itself: nevertheless some people are using it for this purpose.

The ca command is effectively a single user command: no locking is done on the various files and attempts to run more than one ca command on the same database can have unpredictable results.

The copy_extensions option should be used with caution. If care is not taken then it can be a security risk. For example if a certificate request contains a basicConstraints extension with CA:TRUE and the copy_extensions value is set to copyall and the user does not spot this when the certificate is displayed then this will hand the requester a valid CA certificate.

This situation can be avoided by setting copy_extensions to copy and including basicConstraints with CA:FALSE in the configuration file. Then if the request contains a basicConstraints extension it will be ignored.

It is advisable to also include values for other extensions such as keyUsage to prevent a request supplying its own values.

Additional restrictions can be placed on the CA certificate itself. For example if the CA certificate has:

 basicConstraints = CA:TRUE, pathlen:0

then even if a certificate is issued with CA:TRUE it will not be valid.

HISTORY

Since OpenSSL 1.1.1, the program follows RFC5280. Specifically, certificate validity period (specified by any of -startdate, -enddate and -days) will be encoded as UTCTime if the dates are earlier than year 2049 (included), and as GeneralizedTime if the dates are in year 2050 or later.

SEE ALSO

req(1), spkac(1), x509(1), CA.pl(1), config(5), x509v3_config(5)

COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

• NAME
• SYNOPSIS
• DESCRIPTION
• OPTIONS
  • Time Stamp Request generation
  • Time Stamp Response generation
  • Time Stamp Response verification
• CONFIGURATION FILE OPTIONS
• EXAMPLES
  • Time Stamp Request
  • Time Stamp Response
  • Time Stamp Verification
• BUGS
• SEE ALSO
• COPYRIGHT

NAME

openssl-ts, ts - Time Stamping Authority tool (client/server)

SYNOPSIS

openssl ts -query [-rand file...] [-writerand file] [-config configfile] [-data file_to_hash] [-digest digest_bytes] [-digest] [-tspolicy object_id] [-no_nonce] [-cert] [-in request.tsq] [-out request.tsq] [-text]

openssl ts -reply [-config configfile] [-section tsa_section] [-queryfile request.tsq] [-passin password_src] [-signer tsa_cert.pem] [-inkey file_or_id] [-digest] [-chain certs_file.pem] [-tspolicy object_id] [-in response.tsr] [-token_in] [-out response.tsr] [-token_out] [-text] [-engine id]

openssl ts -verify [-data file_to_hash] [-digest digest_bytes] [-queryfile request.tsq] [-in response.tsr] [-token_in] [-CApath trusted_cert_path] [-CAfile trusted_certs.pem] [-untrusted cert_file.pem] [verify options]

verify options: [-attime timestamp] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-issuer_checks] [-no_alt_chains] [-no_check_time] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict]

DESCRIPTION

The ts command is a basic Time Stamping Authority (TSA) client and server application as specified in RFC 3161 (Time-Stamp Protocol, TSP). A TSA can be part of a PKI deployment and its role is to provide long term proof of the existence of a certain datum before a particular time. Here is a brief description of the protocol:

1. The TSA client computes a one-way hash value for a data file and sends the hash to the TSA.

2. The TSA attaches the current date and time to the received hash value, signs them and sends the timestamp token back to the client. By creating this token the TSA certifies the existence of the original data file at the time of response generation.

3. The TSA client receives the timestamp token and verifies the signature on it. It also checks if the token contains the same hash value that it had sent to the TSA.

There is one DER encoded protocol data unit defined for transporting a timestamp request to the TSA and one for sending the timestamp response back to the client. The ts command has three main functions: creating a timestamp request based on a data file, creating a timestamp response based on a request, verifying if a response corresponds to a particular request or a data file.

There is no support for sending the requests/responses automatically over HTTP or TCP yet as suggested in RFC 3161. The users must send the requests either by ftp or e-mail.

OPTIONS

Time Stamp Request generation

The -query switch can be used for creating and printing a timestamp request with the following options:

-rand file...

A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

[-writerand file]

Writes random data to the specified file upon exit. This can be used with a subsequent -rand flag.

-config configfile

The configuration file to use. Optional; for a description of the default value, see "COMMAND SUMMARY" in openssl(1).

-data file_to_hash

The data file for which the timestamp request needs to be created. stdin is the default if neither the -data nor the -digest parameter is specified. (Optional)

-digest digest_bytes

It is possible to specify the message imprint explicitly without the data file. The imprint must be specified in a hexadecimal format, two characters per byte, the bytes optionally separated by colons (e.g. 1A:F6:01:... or 1AF601...). The number of bytes must match the message digest algorithm in use. (Optional)

-digest

The message digest to apply to the data file. Any digest supported by the OpenSSL dgst command can be used. The default is SHA-1. (Optional)

-tspolicy object_id

The policy that the client expects the TSA to use for creating the timestamp token. Either the dotted OID notation or OID names defined in the config file can be used. If no policy is requested the TSA will use its own default policy. (Optional)

-no_nonce

No nonce is specified in the request if this option is given. Otherwise a 64 bit long pseudo-random none is included in the request. It is recommended to use nonce to protect against replay-attacks. (Optional)

-cert

The TSA is expected to include its signing certificate in the response. (Optional)

-in request.tsq

This option specifies a previously created timestamp request in DER format that will be printed into the output file. Useful when you need to examine the content of a request in human-readable format. (Optional)

-out request.tsq

Name of the output file to which the request will be written. Default is stdout. (Optional)

-text

If this option is specified the output is human-readable text format instead of DER. (Optional)

Time Stamp Response generation

A timestamp response (TimeStampResp) consists of a response status and the timestamp token itself (ContentInfo), if the token generation was successful. The -reply command is for creating a timestamp response or timestamp token based on a request and printing the response/token in human-readable format. If -token_out is not specified the output is always a timestamp response (TimeStampResp), otherwise it is a timestamp token (ContentInfo).

-config configfile

The configuration file to use. Optional; for a description of the default value, see "COMMAND SUMMARY" in openssl(1). See CONFIGURATION FILE OPTIONS for configurable variables.

-section tsa_section

The name of the config file section containing the settings for the response generation. If not specified the default TSA section is used, see CONFIGURATION FILE OPTIONS for details. (Optional)

-queryfile request.tsq

The name of the file containing a DER encoded timestamp request. (Optional)

-passin password_src

Specifies the password source for the private key of the TSA. See "Pass Phrase Options" in openssl(1). (Optional)

-signer tsa_cert.pem

The signer certificate of the TSA in PEM format. The TSA signing certificate must have exactly one extended key usage assigned to it: timeStamping. The extended key usage must also be critical, otherwise the certificate is going to be refused. Overrides the signer_cert variable of the config file. (Optional)

-inkey file_or_id

The signer private key of the TSA in PEM format. Overrides the signer_key config file option. (Optional) If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.

-digest

Signing digest to use. Overrides the signer_digest config file option. (Mandatory unless specified in the config file)

-chain certs_file.pem

The collection of certificates in PEM format that will all be included in the response in addition to the signer certificate if the -cert option was used for the request. This file is supposed to contain the certificate chain for the signer certificate from its issuer upwards. The -reply command does not build a certificate chain automatically. (Optional)

-tspolicy object_id

The default policy to use for the response unless the client explicitly requires a particular TSA policy. The OID can be specified either in dotted notation or with its name. Overrides the default_policy config file option. (Optional)

-in response.tsr

Specifies a previously created timestamp response or timestamp token (if -token_in is also specified) in DER format that will be written to the output file. This option does not require a request, it is useful e.g. when you need to examine the content of a response or token or you want to extract the timestamp token from a response. If the input is a token and the output is a timestamp response a default 'granted' status info is added to the token. (Optional)

-token_in

This flag can be used together with the -in option and indicates that the input is a DER encoded timestamp token (ContentInfo) instead of a timestamp response (TimeStampResp). (Optional)

-out response.tsr

The response is written to this file. The format and content of the file depends on other options (see -text, -token_out). The default is stdout. (Optional)

-token_out

The output is a timestamp token (ContentInfo) instead of timestamp response (TimeStampResp). (Optional)

-text

If this option is specified the output is human-readable text format instead of DER. (Optional)

-engine id

Specifying an engine (by its unique id string) will cause ts to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. Default is builtin. (Optional)

Time Stamp Response verification

The -verify command is for verifying if a timestamp response or timestamp token is valid and matches a particular timestamp request or data file. The -verify command does not use the configuration file.

-data file_to_hash

The response or token must be verified against file_to_hash. The file is hashed with the message digest algorithm specified in the token. The -digest and -queryfile options must not be specified with this one. (Optional)

-digest digest_bytes

The response or token must be verified against the message digest specified with this option. The number of bytes must match the message digest algorithm specified in the token. The -data and -queryfile options must not be specified with this one. (Optional)

-queryfile request.tsq

The original timestamp request in DER format. The -data and -digest options must not be specified with this one. (Optional)

-in response.tsr

The timestamp response that needs to be verified in DER format. (Mandatory)

-token_in

This flag can be used together with the -in option and indicates that the input is a DER encoded timestamp token (ContentInfo) instead of a timestamp response (TimeStampResp). (Optional)

-CApath trusted_cert_path

The name of the directory containing the trusted CA certificates of the client. See the similar option of verify(1) for additional details. Either this option or -CAfile must be specified. (Optional)

-CAfile trusted_certs.pem

The name of the file containing a set of trusted self-signed CA certificates in PEM format. See the similar option of verify(1) for additional details. Either this option or -CApath must be specified. (Optional)

-untrusted cert_file.pem

Set of additional untrusted certificates in PEM format which may be needed when building the certificate chain for the TSA's signing certificate. This file must contain the TSA signing certificate and all intermediate CA certificates unless the response includes them. (Optional)

verify options

The options -attime timestamp, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -issuer_checks, -no_alt_chains, -no_check_time, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, and -x509_strict can be used to control timestamp verification. See verify(1).

CONFIGURATION FILE OPTIONS

The -query and -reply commands make use of a configuration file. See config(5) for a general description of the syntax of the config file. The -query command uses only the symbolic OID names section and it can work without it. However, the -reply command needs the config file for its operation.

When there is a command line switch equivalent of a variable the switch always overrides the settings in the config file.

tsa section, default_tsa

This is the main section and it specifies the name of another section that contains all the options for the -reply command. This default section can be overridden with the -section command line switch. (Optional)

oid_file

See ca(1) for description. (Optional)

oid_section

See ca(1) for description. (Optional)

RANDFILE

See ca(1) for description. (Optional)

serial

The name of the file containing the hexadecimal serial number of the last timestamp response created. This number is incremented by 1 for each response. If the file does not exist at the time of response generation a new file is created with serial number 1. (Mandatory)

crypto_device

Specifies the OpenSSL engine that will be set as the default for all available algorithms. The default value is builtin, you can specify any other engines supported by OpenSSL (e.g. use chil for the NCipher HSM). (Optional)

signer_cert

TSA signing certificate in PEM format. The same as the -signer command line option. (Optional)

certs

A file containing a set of PEM encoded certificates that need to be included in the response. The same as the -chain command line option. (Optional)

signer_key

The private key of the TSA in PEM format. The same as the -inkey command line option. (Optional)

signer_digest

Signing digest to use. The same as the -digest command line option. (Mandatory unless specified on the command line)

default_policy

The default policy to use when the request does not mandate any policy. The same as the -tspolicy command line option. (Optional)

other_policies

Comma separated list of policies that are also acceptable by the TSA and used only if the request explicitly specifies one of them. (Optional)

digests

The list of message digest algorithms that the TSA accepts. At least one algorithm must be specified. (Mandatory)

accuracy

The accuracy of the time source of the TSA in seconds, milliseconds and microseconds. E.g. secs:1, millisecs:500, microsecs:100. If any of the components is missing zero is assumed for that field. (Optional)

clock_precision_digits

Specifies the maximum number of digits, which represent the fraction of seconds, that need to be included in the time field. The trailing zeros must be removed from the time, so there might actually be fewer digits, or no fraction of seconds at all. Supported only on UNIX platforms. The maximum value is 6, default is 0. (Optional)

ordering

If this option is yes the responses generated by this TSA can always be ordered, even if the time difference between two responses is less than the sum of their accuracies. Default is no. (Optional)

tsa_name

Set this option to yes if the subject name of the TSA must be included in the TSA name field of the response. Default is no. (Optional)

ess_cert_id_chain

The SignedData objects created by the TSA always contain the certificate identifier of the signing certificate in a signed attribute (see RFC 2634, Enhanced Security Services). If this option is set to yes and either the certs variable or the -chain option is specified then the certificate identifiers of the chain will also be included in the SigningCertificate signed attribute. If this variable is set to no, only the signing certificate identifier is included. Default is no. (Optional)

ess_cert_id_alg

This option specifies the hash function to be used to calculate the TSA's public key certificate identifier. Default is sha1. (Optional)

EXAMPLES

All the examples below presume that OPENSSL_CONF is set to a proper configuration file, e.g. the example configuration file openssl/apps/openssl.cnf will do.

Time Stamp Request

To create a timestamp request for design1.txt with SHA-1 without nonce and policy and no certificate is required in the response:

  openssl ts -query -data design1.txt -no_nonce \
        -out design1.tsq

To create a similar timestamp request with specifying the message imprint explicitly:

  openssl ts -query -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
         -no_nonce -out design1.tsq

To print the content of the previous request in human readable format:

  openssl ts -query -in design1.tsq -text

To create a timestamp request which includes the MD-5 digest of design2.txt, requests the signer certificate and nonce, specifies a policy id (assuming the tsa_policy1 name is defined in the OID section of the config file):

  openssl ts -query -data design2.txt -md5 \
        -tspolicy tsa_policy1 -cert -out design2.tsq

Time Stamp Response

Before generating a response a signing certificate must be created for the TSA that contains the timeStamping critical extended key usage extension without any other key usage extensions. You can add this line to the user certificate section of the config file to generate a proper certificate;

   extendedKeyUsage = critical,timeStamping

See req(1), ca(1), and x509(1) for instructions. The examples below assume that cacert.pem contains the certificate of the CA, tsacert.pem is the signing certificate issued by cacert.pem and tsakey.pem is the private key of the TSA.

To create a timestamp response for a request:

  openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \
        -signer tsacert.pem -out design1.tsr

If you want to use the settings in the config file you could just write:

  openssl ts -reply -queryfile design1.tsq -out design1.tsr

To print a timestamp reply to stdout in human readable format:

  openssl ts -reply -in design1.tsr -text

To create a timestamp token instead of timestamp response:

  openssl ts -reply -queryfile design1.tsq -out design1_token.der -token_out

To print a timestamp token to stdout in human readable format:

  openssl ts -reply -in design1_token.der -token_in -text -token_out

To extract the timestamp token from a response:

  openssl ts -reply -in design1.tsr -out design1_token.der -token_out

To add 'granted' status info to a timestamp token thereby creating a valid response:

  openssl ts -reply -in design1_token.der -token_in -out design1.tsr

Time Stamp Verification

To verify a timestamp reply against a request:

  openssl ts -verify -queryfile design1.tsq -in design1.tsr \
        -CAfile cacert.pem -untrusted tsacert.pem

To verify a timestamp reply that includes the certificate chain:

  openssl ts -verify -queryfile design2.tsq -in design2.tsr \
        -CAfile cacert.pem

To verify a timestamp token against the original data file: openssl ts -verify -data design2.txt -in design2.tsr \ -CAfile cacert.pem

To verify a timestamp token against a message imprint: openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \ -in design2.tsr -CAfile cacert.pem

You could also look at the 'test' directory for more examples.

BUGS

• No support for timestamps over SMTP, though it is quite easy to implement an automatic e-mail based TSA with procmail(1) and perl(1). HTTP server support is provided in the form of a separate apache module. HTTP client support is provided by tsget(1). Pure TCP/IP protocol is not supported.

• The file containing the last serial number of the TSA is not locked when being read or written. This is a problem if more than one instance of openssl(1) is trying to create a timestamp response at the same time. This is not an issue when using the apache server module, it does proper locking.

• Look for the FIXME word in the source files.

• The source code should really be reviewed by somebody else, too.

• More testing is needed, I have done only some basic tests (see test/testtsa).