X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=doc%2Fapps%2Fca.pod;h=8dfac0122e787d8dac2a47ae0ccf13fbaecc820a;hp=5db7d9441cad880f63e36d64bef096b6b9199f43;hb=0634424f7c65d76e342eee4e3359f48d3fe2fa9a;hpb=cb26a20cb105d9ef5cb4706ba18ca2fa5a40a790 diff --git a/doc/apps/ca.pod b/doc/apps/ca.pod index 5db7d9441c..8dfac0122e 100644 --- a/doc/apps/ca.pod +++ b/doc/apps/ca.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -8,16 +7,18 @@ ca - sample minimal CA application =head1 SYNOPSIS B B +[B<-help>] [B<-verbose>] [B<-config filename>] [B<-name section>] [B<-gencrl>] [B<-revoke file>] +[B<-status serial>] +[B<-updatedb>] [B<-crl_reason reason>] [B<-crl_hold instruction>] [B<-crl_compromise time>] [B<-crl_CA_compromise time>] -[B<-subj arg>] [B<-crldays days>] [B<-crlhours hours>] [B<-crlexts section>] @@ -27,6 +28,7 @@ B B [B<-md arg>] [B<-policy arg>] [B<-keyfile arg>] +[B<-keyform PEM|DER>] [B<-key arg>] [B<-passin arg>] [B<-cert file>] @@ -45,6 +47,10 @@ B B [B<-extensions section>] [B<-extfile section>] [B<-engine id>] +[B<-subj arg>] +[B<-utf8>] +[B<-create_serial>] +[B<-multivalue-rdn>] =head1 DESCRIPTION @@ -55,10 +61,18 @@ and their status. The options descriptions will be divided into each purpose. -=head1 CA OPTIONS +=head1 COMMAND OPTIONS =over 4 +=item B<-help> + +Print out a usage message. + +=item B<-verbose> + +this prints extra details about the operations being performed. + =item B<-config filename> specifies the configuration file to use. @@ -81,18 +95,18 @@ a single self signed certificate to be signed by the CA. a file containing a single Netscape signed public key and challenge and additional field values to be signed by the CA. See the B -section for information on the required format. +section for information on the required input and output format. =item B<-infiles> if present this should be the last option, all subsequent arguments -are assumed to the the names of files containing certificate requests. +are taken as the names of files containing certificate requests. =item B<-out filename> the output file to output certificates to. The default is standard output. The certificate details will also be printed out to this -file. +file in PEM format (except that B<-spkac> outputs DER format). =item B<-outdir directory> @@ -108,6 +122,11 @@ the CA certificate file. the private key to sign requests with. +=item B<-keyform PEM|DER> + +the format of the data in the private key file. +The default is PEM. + =item B<-key password> the password used to encrypt the private key. Since on some @@ -118,7 +137,7 @@ the 'ps' utility) this option should be used with caution. indicates the issued certificates are to be signed with the key the certificate requests were signed with (given with B<-keyfile>). -Cerificate requests signed with a different key are ignored. If +Certificate requests signed with a different key are ignored. If B<-spkac>, B<-ss_cert> or B<-gencrl> are given, B<-selfsign> is ignored. @@ -131,11 +150,7 @@ self-signed certificate. =item B<-passin arg> the key password source. For more information about the format of B -see the B section in L. - -=item B<-verbose> - -this prints extra details about the operations being performed. +see the B section in L. =item B<-notext> @@ -157,7 +172,8 @@ the number of days to certify the certificate for. =item B<-md alg> -the message digest to use. Possible values include md5, sha1 and mdc2. +the message digest to use. +Any digest supported by the OpenSSL B command can be used. This option also applies to CRLs. =item B<-policy arg> @@ -178,7 +194,7 @@ need this option. =item B<-preserveDN> Normally the DN order of a certificate is the same as the order of the -fields in the relevant policy section. When this option is set the order +fields in the relevant policy section. When this option is set the order is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll. @@ -203,7 +219,9 @@ the section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to B unless the B<-extfile> option is used). If no extension section is present then, a V1 certificate is created. If the extension section -is present (even if it is empty), then a V3 certificate is created. +is present (even if it is empty), then a V3 certificate is created. See the:w +L manual page for details of the +extension section format. =item B<-extfile file> @@ -213,11 +231,39 @@ used). =item B<-engine id> -specifying an engine (by it's unique B string) will cause B +specifying an engine (by its unique B string) will cause B to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. +=item B<-subj arg> + +supersedes subject name given in the request. +The arg must be formatted as I, +characters may be escaped by \ (backslash), no spaces are skipped. + +=item B<-utf8> + +this option causes field values to be interpreted as UTF8 strings, by +default they are interpreted as ASCII. This means that the field +values, whether prompted from a terminal or obtained from a +configuration file, must be valid UTF8 strings. + +=item B<-create_serial> + +if reading serial from the text file as specified in the configuration +fails, specifying this option creates a new random serial to be used as next +serial number. + +=item B<-multivalue-rdn> + +This option causes the -subj argument to be interpreted with full +support for multivalued RDNs. Example: + +I + +If -multi-rdn is not used then the UID value is I<123456+CN=John Doe>. + =back =head1 CRL OPTIONS @@ -241,6 +287,15 @@ the number of hours before the next CRL is due. a filename containing a certificate to revoke. +=item B<-status serial> + +displays the revocation status of the certificate with the specified +serial number and exits. + +=item B<-updatedb> + +Updates the database index to purge expired certificates. + =item B<-crl_reason reason> revocation reason, where B is one of: B, B, @@ -248,7 +303,7 @@ B, B, B, B, B or B. The matching of B is case insensitive. Setting any revocation reason will make the CRL v2. -In practive B is not particularly useful because it is only used +In practice B is not particularly useful because it is only used in delta CRLs which are not currently implemented. =item B<-crl_hold instruction> @@ -268,12 +323,6 @@ B