Remove '=for openssl ifdef'

[openssl.git] / doc / man1 / openssl-pkcs12.pod.in

diff --git a/doc/man1/openssl-pkcs12.pod.in b/doc/man1/openssl-pkcs12.pod.in
index 65c10d1adbd4042df465696403837bd82268e948..92503dc914664c88f230ba734673e3304cd28c17 100644 (file)
--- a/doc/man1/openssl-pkcs12.pod.in
+++ b/doc/man1/openssl-pkcs12.pod.in
@@ -68,8 +68,6 @@ PKCS#12 output (export) options:
 [B<-maciter>]
 [B<-nomac>]
 
-=for openssl ifdef engine
-
 =head1 DESCRIPTION
 
 This command allows PKCS#12 files (sometimes referred to as
@@ -85,8 +83,13 @@ The PKCS#12 export encryption and MAC options such as B<-certpbe> and B<-iter>
 and many further options such as B<-chain> are relevant only with B<-export>.
 Conversely, the options regarding encryption of private keys when outputting
 PKCS#12 input are relevant only when the B<-export> option is not given.
+
 The default encryption algorithm is AES-256-CBC with PBKDF2 for key derivation.
 
+When encountering problems loading legacy PKCS#12 files that involve,
+for example, RC2-40-CBC,
+try using the B<-legacy> option and, if needed, the B<-provider-path> option.
+
 =over 4
 
 =item B<-help>
@@ -132,6 +135,11 @@ and so the input is just verified.
 =item B<-legacy>
 
 Use legacy mode of operation and automatically load the legacy provider.
+If OpenSSL is not installed system-wide,
+it is necessary to also use, for example, C<-provider-path ./providers>
+or to set the environment variable B<OPENSSL_MODULES>
+to point to the directory where the providers can be found.
+
 In the legacy mode, the default algorithm for certificate encryption
 is RC2_CBC or 3DES_CBC depending on whether the RC2 cipher is enabled
 in the build. The default algorithm for private key encryption is 3DES_CBC.
@@ -333,7 +341,7 @@ then both, the private key and the certificates are encrypted using triple DES.
 
 =item B<-macalg> I<digest>
 
-Specify the MAC digest algorithm. If not included them SHA1 will be used.
+Specify the MAC digest algorithm. If not included SHA1 will be used.
 
 =item B<-iter> I<count>
 
@@ -362,7 +370,9 @@ to be needed to use MAC iterations counts but they are now used by default.
 
 =item B<-nomac>
 
-Don't attempt to provide the MAC integrity.
+Do not attempt to provide the MAC integrity. This can be useful with the FIPS
+provider as the PKCS12 MAC requires PKCS12KDF which is not an approved FIPS
+algorithm and cannot be supported by the FIPS provider.
 
 =back