X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=doc%2Fapps%2Fca.pod;h=8dfac0122e787d8dac2a47ae0ccf13fbaecc820a;hp=1d180706cc7cd63fae4ce41e14b7054a9e13bdb8;hb=0634424f7c65d76e342eee4e3359f48d3fe2fa9a;hpb=4c583c36596cd86feebd983b0313733fe9870500 diff --git a/doc/apps/ca.pod b/doc/apps/ca.pod index 1d180706cc..8dfac0122e 100644 --- a/doc/apps/ca.pod +++ b/doc/apps/ca.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -8,6 +7,7 @@ ca - sample minimal CA application =head1 SYNOPSIS B B +[B<-help>] [B<-verbose>] [B<-config filename>] [B<-name section>] @@ -49,6 +49,7 @@ B B [B<-engine id>] [B<-subj arg>] [B<-utf8>] +[B<-create_serial>] [B<-multivalue-rdn>] =head1 DESCRIPTION @@ -60,10 +61,18 @@ and their status. The options descriptions will be divided into each purpose. -=head1 CA OPTIONS +=head1 COMMAND OPTIONS =over 4 +=item B<-help> + +Print out a usage message. + +=item B<-verbose> + +this prints extra details about the operations being performed. + =item B<-config filename> specifies the configuration file to use. @@ -91,7 +100,7 @@ section for information on the required input and output format. =item B<-infiles> if present this should be the last option, all subsequent arguments -are assumed to the the names of files containing certificate requests. +are taken as the names of files containing certificate requests. =item B<-out filename> @@ -141,11 +150,7 @@ self-signed certificate. =item B<-passin arg> the key password source. For more information about the format of B -see the B section in L. - -=item B<-verbose> - -this prints extra details about the operations being performed. +see the B section in L. =item B<-notext> @@ -167,7 +172,8 @@ the number of days to certify the certificate for. =item B<-md alg> -the message digest to use. Possible values include md5, sha1 and mdc2. +the message digest to use. +Any digest supported by the OpenSSL B command can be used. This option also applies to CRLs. =item B<-policy arg> @@ -188,7 +194,7 @@ need this option. =item B<-preserveDN> Normally the DN order of a certificate is the same as the order of the -fields in the relevant policy section. When this option is set the order +fields in the relevant policy section. When this option is set the order is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll. @@ -214,7 +220,7 @@ to be added when a certificate is issued (defaults to B unless the B<-extfile> option is used). If no extension section is present then, a V1 certificate is created. If the extension section is present (even if it is empty), then a V3 certificate is created. See the:w -L manual page for details of the +L manual page for details of the extension section format. =item B<-extfile file> @@ -238,11 +244,17 @@ characters may be escaped by \ (backslash), no spaces are skipped. =item B<-utf8> -this option causes field values to be interpreted as UTF8 strings, by +this option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings. +=item B<-create_serial> + +if reading serial from the text file as specified in the configuration +fails, specifying this option creates a new random serial to be used as next +serial number. + =item B<-multivalue-rdn> This option causes the -subj argument to be interpreted with full @@ -319,7 +331,7 @@ created, if the CRL extension section is present (even if it is empty) then a V2 CRL is created. The CRL extensions specified are CRL extensions and B CRL entry extensions. It should be noted that some software (for example Netscape) can't handle V2 CRLs. See -L manual page for details of the +L manual page for details of the extension section format. =back @@ -353,7 +365,7 @@ any) used. This specifies a file containing additional B. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed -by white space and finally the long name. +by white space and finally the long name. =item B @@ -380,12 +392,12 @@ CA private key. Mandatory. =item B a file used to read and write random number seed information, or -an EGD socket (see L). +an EGD socket (see L). =item B the same as the B<-days> option. The number of days to certify -a certificate for. +a certificate for. =item B @@ -406,7 +418,7 @@ least one of these must be present to generate a CRL. =item B -the same as the B<-md> option. The message digest to use. Mandatory. +the same as the B<-md> option. Mandatory. =item B @@ -508,7 +520,7 @@ this can be regarded more of a quirk than intended behaviour. The input to the B<-spkac> command line option is a Netscape signed public key and challenge. This will usually come from -the B tag in an HTML form to create a new private key. +the B tag in an HTML form to create a new private key. It is however possible to create SPKACs using the B utility. The file should contain the variable SPKAC set to the value of @@ -568,18 +580,18 @@ A sample configuration file with the relevant sections for B: [ ca ] default_ca = CA_default # The default ca section - + [ CA_default ] dir = ./demoCA # top dir database = $dir/index.txt # index file. - new_certs_dir = $dir/newcerts # new certs dir - + new_certs_dir = $dir/newcerts # new certs dir + certificate = $dir/cacert.pem # The CA cert serial = $dir/serial # serial no file private_key = $dir/private/cakey.pem# CA private key RANDFILE = $dir/private/.rand # random number file - + default_days = 365 # how long to certify for default_crl_days= 30 # how long before next CRL default_md = md5 # md to use @@ -587,9 +599,9 @@ A sample configuration file with the relevant sections for B: policy = policy_any # default policy email_in_dn = no # Don't add the email into cert DN - name_opt = ca_default # Subject name display option - cert_opt = ca_default # Certificate display option - copy_extensions = none # Don't copy extensions from request + name_opt = ca_default # Subject name display option + cert_opt = ca_default # Certificate display option + copy_extensions = none # Don't copy extensions from request [ policy_any ] countryName = supplied @@ -623,7 +635,7 @@ be overridden by the B<-config> command line option. =head1 RESTRICTIONS -The text database index file is a critical part of the process and +The text database index file is a critical part of the process and if corrupted it can be difficult to fix. It is theoretically possible to rebuild the index file from all the issued certificates and a current CRL: however there is no option to do this. @@ -690,7 +702,16 @@ then even if a certificate is issued with CA:TRUE it will not be valid. =head1 SEE ALSO -L, L, L, L, -L, L +L, L, L, L, +L, L + +=head1 COPYRIGHT + +Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the OpenSSL license (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. =cut