-inkey can be an identifier, not just a file

update pkcs12, smime, ts apps.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3507)
(cherry picked from commit 48b5352212d8c68f7fd071ca9f38822b7e954c5a)

diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index 0e69c9c131413ef100a7af6ded8ecbd8a2f82b1d..6c07e810bf2b7add1edb829f991e4a239d00fe14 100644 (file)
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -91,7 +91,7 @@ OPTIONS pkcs12_options[] = {
     {"keypbe", OPT_KEYPBE, 's', "Private key PBE algorithm (default 3DES)"},
     {"rand", OPT_RAND, 's',
      "Load the file(s) into the random number generator"},
-    {"inkey", OPT_INKEY, '<', "Private key if not infile"},
+    {"inkey", OPT_INKEY, 's', "Private key if not infile"},
     {"certfile", OPT_CERTFILE, '<', "Load certs from file"},
     {"name", OPT_NAME, 's', "Use name as friendly name"},
     {"CSP", OPT_CSP, 's', "Microsoft CSP name"},

diff --git a/apps/smime.c b/apps/smime.c
index caa9252e2ab5c2e3f4e34b93c2dee03542d62519..e18d7de75fce9f7eeb48760ce1545dba1b9be166 100644 (file)
--- a/apps/smime.c
+++ b/apps/smime.c
@@ -70,7 +70,7 @@ OPTIONS smime_options[] = {
     {"recip", OPT_RECIP, '<', "Recipient certificate file for decryption"},
     {"in", OPT_IN, '<', "Input file"},
     {"inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER"},
-    {"inkey", OPT_INKEY, '<',
+    {"inkey", OPT_INKEY, 's',
      "Input private key (if not signer or recipient)"},
     {"keyform", OPT_KEYFORM, 'f', "Input private key format (PEM or ENGINE)"},
     {"out", OPT_OUT, '>', "Output file"},

diff --git a/apps/ts.c b/apps/ts.c
index 14c533bdbc18bf601fa7a7483a8ab69e6ba2acc8..0e07c088d0ba676856554045c0e620297851c43f 100644 (file)
--- a/apps/ts.c
+++ b/apps/ts.c
@@ -106,7 +106,7 @@ OPTIONS ts_options[] = {
     {"reply", OPT_REPLY, '-', "Generate a TS reply"},
     {"queryfile", OPT_QUERYFILE, '<', "File containing a TS query"},
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"inkey", OPT_INKEY, '<', "File with private key for reply"},
+    {"inkey", OPT_INKEY, 's', "File with private key for reply"},
     {"signer", OPT_SIGNER, 's', "Signer certificate file"},
     {"chain", OPT_CHAIN, '<', "File with signer CA chain"},
     {"verify", OPT_VERIFY, '-', "Verify a TS response"},

diff --git a/doc/apps/pkcs12.pod b/doc/apps/pkcs12.pod
index 3dea46cdcfba5551e33bc0183d15dbbd20eb4add..2df477699e01aae8f4068bcc0615ea3edcb4ced0 100644 (file)
--- a/doc/apps/pkcs12.pod
+++ b/doc/apps/pkcs12.pod
@@ -10,7 +10,7 @@ B<openssl> B<pkcs12>
 [B<-help>]
 [B<-export>]
 [B<-chain>]
-[B<-inkey filename>]
+[B<-inkey file_or_id>]
 [B<-certfile filename>]
 [B<-name name>]
 [B<-caname name>]
@@ -173,10 +173,12 @@ default.  They must all be in PEM format. The order doesn't matter but one
 private key and its corresponding certificate should be present. If additional
 certificates are present they will also be included in the PKCS#12 file.
 
-=item B<-inkey filename>
+=item B<-inkey file_or_id>
 
 file to read private key from. If not present then a private key must be present
 in the input file.
+If no engine is used, the argument is taken as a file; if an engine is
+specified, the argument is given to the engine as a key identifier.
 
 =item B<-name friendlyname>
 

diff --git a/doc/apps/smime.pod b/doc/apps/smime.pod
index 7980e35e774505e01cea72951feed43af72db293..d3e0214665f8c8f84b6d2134b6967b8284e5cf34 100644 (file)
--- a/doc/apps/smime.pod
+++ b/doc/apps/smime.pod
@@ -54,7 +54,7 @@ B<openssl> B<smime>
 [B<-recip  file>]
 [B<-inform SMIME|PEM|DER>]
 [B<-passin arg>]
-[B<-inkey file>]
+[B<-inkey file_or_id>]
 [B<-out file>]
 [B<-outform SMIME|PEM|DER>]
 [B<-content file>]
@@ -280,13 +280,15 @@ verification was successful.
 the recipients certificate when decrypting a message. This certificate
 must match one of the recipients of the message or an error occurs.
 
-=item B<-inkey file>
+=item B<-inkey file_or_id>
 
 the private key to use when signing or decrypting. This must match the
 corresponding certificate. If this option is not specified then the
 private key must be included in the certificate file specified with
 the B<-recip> or B<-signer> file. When signing this option can be used
 multiple times to specify successive keys.
+If no engine is used, the argument is taken as a file; if an engine is
+specified, the argument is given to the engine as a key identifier.
 
 =item B<-passin arg>
 

diff --git a/doc/apps/ts.pod b/doc/apps/ts.pod
index 2ec98370752c4a0e7a45b983c2a18deb4ddb3c1d..cf30947d35be47d61f642f325b41d1d286338fe9 100644 (file)
--- a/doc/apps/ts.pod
+++ b/doc/apps/ts.pod
@@ -27,7 +27,7 @@ B<-reply>
 [B<-queryfile> request.tsq]
 [B<-passin> password_src]
 [B<-signer> tsa_cert.pem]
-[B<-inkey> private.pem]
+[B<-inkey> file_or_id]
 [B<-sha1|-sha224|-sha256|-sha384|-sha512>]
 [B<-chain> certs_file.pem]
 [B<-tspolicy> object_id]
@@ -243,10 +243,12 @@ timeStamping. The extended key usage must also be critical, otherwise
 the certificate is going to be refused. Overrides the B<signer_cert>
 variable of the config file. (Optional)
 
-=item B<-inkey> private.pem
+=item B<-inkey> file_or_id
 
 The signer private key of the TSA in PEM format. Overrides the
 B<signer_key> config file option. (Optional)
+If no engine is used, the argument is taken as a file; if an engine is
+specified, the argument is given to the engine as a key identifier.
 
 =item B<-sha1|-sha224|-sha256|-sha384|-sha512>