1 .\" Automatically generated by Pod::Man 4.10 (Pod::Simple 3.35)
4 .\" ========================================================================
5 .de Sp \" Vertical space (when we can't use .PP)
9 .de Vb \" Begin verbatim text
14 .de Ve \" End verbatim text
18 .\" Set up some character translations and predefined strings. \*(-- will
19 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
20 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
21 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
22 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
23 .\" nothing in troff, for use with C<>.
25 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
29 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
30 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
45 .\" Escape single quotes in literal strings from groff's Unicode transform.
49 .\" If the F register is >0, we'll generate index entries on stderr for
50 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
51 .\" entries marked with X<> in POD. Of course, you'll have to process the
52 .\" output yourself in some meaningful fashion.
54 .\" Avoid warning from groff about undefined register 'F'.
58 .if \n(.g .if rF .nr rF 1
59 .if (\n(rF:(\n(.g==0)) \{\
62 . tm Index:\\$1\t\\n%\t"\\$2"
72 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
73 .\" Fear. Run. Save yourself. No user-serviceable parts.
74 . \" fudge factors for nroff and troff
83 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
89 . \" simple accents for nroff and troff
99 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
100 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
101 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
102 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
103 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
104 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
106 . \" troff and (daisy-wheel) nroff accents
107 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
108 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
109 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
110 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
111 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
112 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
113 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
114 .ds ae a\h'-(\w'a'u*4/10)'e
115 .ds Ae A\h'-(\w'A'u*4/10)'E
116 . \" corrections for vroff
117 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
118 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
119 . \" for low resolution devices (crt and lpr)
120 .if \n(.H>23 .if \n(.V>19 \
133 .\" ========================================================================
136 .TH X509 1 "2019-05-28" "1.1.1c" "OpenSSL"
137 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
138 .\" way too many mistakes in technical documents.
142 openssl\-x509, x509 \- Certificate display and signing utility
144 .IX Header "SYNOPSIS"
145 \&\fBopenssl\fR \fBx509\fR
147 [\fB\-inform DER|PEM\fR]
148 [\fB\-outform DER|PEM\fR]
149 [\fB\-keyform DER|PEM\fR]
150 [\fB\-CAform DER|PEM\fR]
151 [\fB\-CAkeyform DER|PEM\fR]
152 [\fB\-in filename\fR]
153 [\fB\-out filename\fR]
156 [\fB\-subject_hash\fR]
157 [\fB\-issuer_hash\fR]
161 [\fB\-nameopt option\fR]
168 [\fB\-checkend num\fR]
171 [\fB\-fingerprint\fR]
177 [\fB\-addtrust arg\fR]
178 [\fB\-addreject arg\fR]
179 [\fB\-setalias arg\fR]
181 [\fB\-set_serial n\fR]
182 [\fB\-signkey filename\fR]
186 [\fB\-CA filename\fR]
187 [\fB\-CAkey filename\fR]
188 [\fB\-CAcreateserial\fR]
189 [\fB\-CAserial filename\fR]
190 [\fB\-force_pubkey key\fR]
192 [\fB\-ext extensions\fR]
193 [\fB\-certopt option\fR]
195 [\fB\-\f(BIdigest\fB\fR]
197 [\fB\-extfile filename\fR]
198 [\fB\-extensions section\fR]
199 [\fB\-rand file...\fR]
200 [\fB\-writerand file\fR]
202 [\fB\-preserve_dates\fR]
204 .IX Header "DESCRIPTION"
205 The \fBx509\fR command is a multi purpose certificate utility. It can be
206 used to display certificate information, convert certificates to
207 various forms, sign certificate requests like a \*(L"mini \s-1CA\*(R"\s0 or edit
208 certificate trust settings.
210 Since there are a large number of options they will split up into
214 .SS "Input, Output, and General Purpose Options"
215 .IX Subsection "Input, Output, and General Purpose Options"
218 Print out a usage message.
219 .IP "\fB\-inform DER|PEM\fR" 4
220 .IX Item "-inform DER|PEM"
221 This specifies the input format normally the command will expect an X509
222 certificate but this can change if other options such as \fB\-req\fR are
223 present. The \s-1DER\s0 format is the \s-1DER\s0 encoding of the certificate and \s-1PEM\s0
224 is the base64 encoding of the \s-1DER\s0 encoding with header and footer lines
225 added. The default format is \s-1PEM.\s0
226 .IP "\fB\-outform DER|PEM\fR" 4
227 .IX Item "-outform DER|PEM"
228 This specifies the output format, the options have the same meaning and default
229 as the \fB\-inform\fR option.
230 .IP "\fB\-in filename\fR" 4
231 .IX Item "-in filename"
232 This specifies the input filename to read a certificate from or standard input
233 if this option is not specified.
234 .IP "\fB\-out filename\fR" 4
235 .IX Item "-out filename"
236 This specifies the output filename to write to or standard output by
238 .IP "\fB\-\f(BIdigest\fB\fR" 4
241 This affects any signing or display option that uses a message
242 digest, such as the \fB\-fingerprint\fR, \fB\-signkey\fR and \fB\-CA\fR options.
243 Any digest supported by the OpenSSL \fBdgst\fR command can be used.
244 If not specified then \s-1SHA1\s0 is used with \fB\-fingerprint\fR or
245 the default digest for the signing algorithm is used, typically \s-1SHA256.\s0
246 .IP "\fB\-rand file...\fR" 4
247 .IX Item "-rand file..."
248 A file or files containing random data used to seed the random number
250 Multiple files can be specified separated by an OS-dependent character.
251 The separator is \fB;\fR for MS-Windows, \fB,\fR for OpenVMS, and \fB:\fR for
253 .IP "[\fB\-writerand file\fR]" 4
254 .IX Item "[-writerand file]"
255 Writes random data to the specified \fIfile\fR upon exit.
256 This can be used with a subsequent \fB\-rand\fR flag.
257 .IP "\fB\-engine id\fR" 4
258 .IX Item "-engine id"
259 Specifying an engine (by its unique \fBid\fR string) will cause \fBx509\fR
260 to attempt to obtain a functional reference to the specified engine,
261 thus initialising it if needed. The engine will then be set as the default
262 for all available algorithms.
263 .IP "\fB\-preserve_dates\fR" 4
264 .IX Item "-preserve_dates"
265 When signing a certificate, preserve the \*(L"notBefore\*(R" and \*(L"notAfter\*(R" dates instead
266 of adjusting them to current time and duration. Cannot be used with the \fB\-days\fR option.
267 .SS "Display Options"
268 .IX Subsection "Display Options"
269 Note: the \fB\-alias\fR and \fB\-purpose\fR options are also display options
270 but are described in the \fB\s-1TRUST SETTINGS\s0\fR section.
273 Prints out the certificate in text form. Full details are output including the
274 public key, signature algorithms, issuer and subject names, serial number
275 any extensions present and any trust settings.
276 .IP "\fB\-ext extensions\fR" 4
277 .IX Item "-ext extensions"
278 Prints out the certificate extensions in text form. Extensions are specified
279 with a comma separated string, e.g., \*(L"subjectAltName,subjectKeyIdentifier\*(R".
280 See the \fBx509v3_config\fR\|(5) manual page for the extension names.
281 .IP "\fB\-certopt option\fR" 4
282 .IX Item "-certopt option"
283 Customise the output format used with \fB\-text\fR. The \fBoption\fR argument
284 can be a single option or multiple options separated by commas. The
285 \&\fB\-certopt\fR switch may be also be used more than once to set multiple
286 options. See the \fB\s-1TEXT OPTIONS\s0\fR section for more information.
287 .IP "\fB\-noout\fR" 4
289 This option prevents output of the encoded version of the certificate.
290 .IP "\fB\-pubkey\fR" 4
292 Outputs the certificate's SubjectPublicKeyInfo block in \s-1PEM\s0 format.
293 .IP "\fB\-modulus\fR" 4
295 This option prints out the value of the modulus of the public key
296 contained in the certificate.
297 .IP "\fB\-serial\fR" 4
299 Outputs the certificate serial number.
300 .IP "\fB\-subject_hash\fR" 4
301 .IX Item "-subject_hash"
302 Outputs the \*(L"hash\*(R" of the certificate subject name. This is used in OpenSSL to
303 form an index to allow certificates in a directory to be looked up by subject
305 .IP "\fB\-issuer_hash\fR" 4
306 .IX Item "-issuer_hash"
307 Outputs the \*(L"hash\*(R" of the certificate issuer name.
308 .IP "\fB\-ocspid\fR" 4
310 Outputs the \s-1OCSP\s0 hash values for the subject name and public key.
313 Synonym for \*(L"\-subject_hash\*(R" for backward compatibility reasons.
314 .IP "\fB\-subject_hash_old\fR" 4
315 .IX Item "-subject_hash_old"
316 Outputs the \*(L"hash\*(R" of the certificate subject name using the older algorithm
317 as used by OpenSSL before version 1.0.0.
318 .IP "\fB\-issuer_hash_old\fR" 4
319 .IX Item "-issuer_hash_old"
320 Outputs the \*(L"hash\*(R" of the certificate issuer name using the older algorithm
321 as used by OpenSSL before version 1.0.0.
322 .IP "\fB\-subject\fR" 4
324 Outputs the subject name.
325 .IP "\fB\-issuer\fR" 4
327 Outputs the issuer name.
328 .IP "\fB\-nameopt option\fR" 4
329 .IX Item "-nameopt option"
330 Option which determines how the subject or issuer names are displayed. The
331 \&\fBoption\fR argument can be a single option or multiple options separated by
332 commas. Alternatively the \fB\-nameopt\fR switch may be used more than once to
333 set multiple options. See the \fB\s-1NAME OPTIONS\s0\fR section for more information.
334 .IP "\fB\-email\fR" 4
336 Outputs the email address(es) if any.
337 .IP "\fB\-ocsp_uri\fR" 4
339 Outputs the \s-1OCSP\s0 responder address(es) if any.
340 .IP "\fB\-startdate\fR" 4
341 .IX Item "-startdate"
342 Prints out the start date of the certificate, that is the notBefore date.
343 .IP "\fB\-enddate\fR" 4
345 Prints out the expiry date of the certificate, that is the notAfter date.
346 .IP "\fB\-dates\fR" 4
348 Prints out the start and expiry dates of a certificate.
349 .IP "\fB\-checkend arg\fR" 4
350 .IX Item "-checkend arg"
351 Checks if the certificate expires within the next \fBarg\fR seconds and exits
352 non-zero if yes it will expire or zero if not.
353 .IP "\fB\-fingerprint\fR" 4
354 .IX Item "-fingerprint"
355 Calculates and outputs the digest of the \s-1DER\s0 encoded version of the entire
356 certificate (see digest options).
357 This is commonly called a \*(L"fingerprint\*(R". Because of the nature of message
358 digests, the fingerprint of a certificate is unique to that certificate and
359 two certificates with the same fingerprint can be considered to be the same.
362 This outputs the certificate in the form of a C source file.
364 .IX Subsection "Trust Settings"
365 A \fBtrusted certificate\fR is an ordinary certificate which has several
366 additional pieces of information attached to it such as the permitted
367 and prohibited uses of the certificate and an \*(L"alias\*(R".
369 Normally when a certificate is being verified at least one certificate
370 must be \*(L"trusted\*(R". By default a trusted certificate must be stored
371 locally and must be a root \s-1CA:\s0 any certificate chain ending in this \s-1CA\s0
372 is then usable for any purpose.
374 Trust settings currently are only used with a root \s-1CA.\s0 They allow a finer
375 control over the purposes the root \s-1CA\s0 can be used for. For example a \s-1CA\s0
376 may be trusted for \s-1SSL\s0 client but not \s-1SSL\s0 server use.
378 See the description of the \fBverify\fR utility for more information on the
379 meaning of trust settings.
381 Future versions of OpenSSL will recognize trust settings on any
382 certificate: not just root CAs.
383 .IP "\fB\-trustout\fR" 4
385 This causes \fBx509\fR to output a \fBtrusted\fR certificate. An ordinary
386 or trusted certificate can be input but by default an ordinary
387 certificate is output and any trust settings are discarded. With the
388 \&\fB\-trustout\fR option a trusted certificate is output. A trusted
389 certificate is automatically output if any trust settings are modified.
390 .IP "\fB\-setalias arg\fR" 4
391 .IX Item "-setalias arg"
392 Sets the alias of the certificate. This will allow the certificate
393 to be referred to using a nickname for example \*(L"Steve's Certificate\*(R".
394 .IP "\fB\-alias\fR" 4
396 Outputs the certificate alias, if any.
397 .IP "\fB\-clrtrust\fR" 4
399 Clears all the permitted or trusted uses of the certificate.
400 .IP "\fB\-clrreject\fR" 4
401 .IX Item "-clrreject"
402 Clears all the prohibited or rejected uses of the certificate.
403 .IP "\fB\-addtrust arg\fR" 4
404 .IX Item "-addtrust arg"
405 Adds a trusted certificate use.
406 Any object name can be used here but currently only \fBclientAuth\fR (\s-1SSL\s0 client
407 use), \fBserverAuth\fR (\s-1SSL\s0 server use), \fBemailProtection\fR (S/MIME email) and
408 \&\fBanyExtendedKeyUsage\fR are used.
409 As of OpenSSL 1.1.0, the last of these blocks all purposes when rejected or
410 enables all purposes when trusted.
411 Other OpenSSL applications may define additional uses.
412 .IP "\fB\-addreject arg\fR" 4
413 .IX Item "-addreject arg"
414 Adds a prohibited use. It accepts the same values as the \fB\-addtrust\fR
416 .IP "\fB\-purpose\fR" 4
418 This option performs tests on the certificate extensions and outputs
419 the results. For a more complete description see the \fB\s-1CERTIFICATE
420 EXTENSIONS\s0\fR section.
421 .SS "Signing Options"
422 .IX Subsection "Signing Options"
423 The \fBx509\fR utility can be used to sign certificates and requests: it
424 can thus behave like a \*(L"mini \s-1CA\*(R".\s0
425 .IP "\fB\-signkey filename\fR" 4
426 .IX Item "-signkey filename"
427 This option causes the input file to be self signed using the supplied
430 If the input file is a certificate it sets the issuer name to the
431 subject name (i.e. makes it self signed) changes the public key to the
432 supplied value and changes the start and end dates. The start date is
433 set to the current time and the end date is set to a value determined
434 by the \fB\-days\fR option. Any certificate extensions are retained unless
435 the \fB\-clrext\fR option is supplied; this includes, for example, any existing
436 key identifier extensions.
438 If the input is a certificate request then a self signed certificate
439 is created using the supplied private key using the subject name in
441 .IP "\fB\-passin arg\fR" 4
442 .IX Item "-passin arg"
443 The key password source. For more information about the format of \fBarg\fR
444 see the \fB\s-1PASS PHRASE ARGUMENTS\s0\fR section in \fBopenssl\fR\|(1).
445 .IP "\fB\-clrext\fR" 4
447 Delete any extensions from a certificate. This option is used when a
448 certificate is being created from another certificate (for example with
449 the \fB\-signkey\fR or the \fB\-CA\fR options). Normally all extensions are
451 .IP "\fB\-keyform PEM|DER\fR" 4
452 .IX Item "-keyform PEM|DER"
453 Specifies the format (\s-1DER\s0 or \s-1PEM\s0) of the private key file used in the
454 \&\fB\-signkey\fR option.
455 .IP "\fB\-days arg\fR" 4
457 Specifies the number of days to make a certificate valid for. The default
458 is 30 days. Cannot be used with the \fB\-preserve_dates\fR option.
459 .IP "\fB\-x509toreq\fR" 4
460 .IX Item "-x509toreq"
461 Converts a certificate into a certificate request. The \fB\-signkey\fR option
462 is used to pass the required private key.
465 By default a certificate is expected on input. With this option a
466 certificate request is expected instead.
467 .IP "\fB\-set_serial n\fR" 4
468 .IX Item "-set_serial n"
469 Specifies the serial number to use. This option can be used with either
470 the \fB\-signkey\fR or \fB\-CA\fR options. If used in conjunction with the \fB\-CA\fR
471 option the serial number file (as specified by the \fB\-CAserial\fR or
472 \&\fB\-CAcreateserial\fR options) is not used.
474 The serial number can be decimal or hex (if preceded by \fB0x\fR).
475 .IP "\fB\-CA filename\fR" 4
476 .IX Item "-CA filename"
477 Specifies the \s-1CA\s0 certificate to be used for signing. When this option is
478 present \fBx509\fR behaves like a \*(L"mini \s-1CA\*(R".\s0 The input file is signed by this
479 \&\s-1CA\s0 using this option: that is its issuer name is set to the subject name
480 of the \s-1CA\s0 and it is digitally signed using the CAs private key.
482 This option is normally combined with the \fB\-req\fR option. Without the
483 \&\fB\-req\fR option the input is a certificate which must be self signed.
484 .IP "\fB\-CAkey filename\fR" 4
485 .IX Item "-CAkey filename"
486 Sets the \s-1CA\s0 private key to sign a certificate with. If this option is
487 not specified then it is assumed that the \s-1CA\s0 private key is present in
488 the \s-1CA\s0 certificate file.
489 .IP "\fB\-CAserial filename\fR" 4
490 .IX Item "-CAserial filename"
491 Sets the \s-1CA\s0 serial number file to use.
493 When the \fB\-CA\fR option is used to sign a certificate it uses a serial
494 number specified in a file. This file consists of one line containing
495 an even number of hex digits with the serial number to use. After each
496 use the serial number is incremented and written out to the file again.
498 The default filename consists of the \s-1CA\s0 certificate file base name with
499 \&\*(L".srl\*(R" appended. For example if the \s-1CA\s0 certificate file is called
500 \&\*(L"mycacert.pem\*(R" it expects to find a serial number file called \*(L"mycacert.srl\*(R".
501 .IP "\fB\-CAcreateserial\fR" 4
502 .IX Item "-CAcreateserial"
503 With this option the \s-1CA\s0 serial number file is created if it does not exist:
504 it will contain the serial number \*(L"02\*(R" and the certificate being signed will
505 have the 1 as its serial number. If the \fB\-CA\fR option is specified
506 and the serial number file does not exist a random number is generated;
507 this is the recommended practice.
508 .IP "\fB\-extfile filename\fR" 4
509 .IX Item "-extfile filename"
510 File containing certificate extensions to use. If not specified then
511 no extensions are added to the certificate.
512 .IP "\fB\-extensions section\fR" 4
513 .IX Item "-extensions section"
514 The section to add certificate extensions from. If this option is not
515 specified then the extensions should either be contained in the unnamed
516 (default) section or the default section should contain a variable called
517 \&\*(L"extensions\*(R" which contains the section to use. See the
518 \&\fBx509v3_config\fR\|(5) manual page for details of the
519 extension section format.
520 .IP "\fB\-force_pubkey key\fR" 4
521 .IX Item "-force_pubkey key"
522 When a certificate is created set its public key to \fBkey\fR instead of the
523 key in the certificate or certificate request. This option is useful for
524 creating certificates where the algorithm can't normally sign requests, for
527 The format or \fBkey\fR can be specified using the \fB\-keyform\fR option.
529 .IX Subsection "Name Options"
530 The \fBnameopt\fR command line switch determines how the subject and issuer
531 names are displayed. If no \fBnameopt\fR switch is present the default \*(L"oneline\*(R"
532 format is used which is compatible with previous versions of OpenSSL.
533 Each option is described in detail below, all options can be preceded by
534 a \fB\-\fR to turn the option off. Only the first four will normally be used.
538 .IP "\fB\s-1RFC2253\s0\fR" 4
540 Displays names compatible with \s-1RFC2253\s0 equivalent to \fBesc_2253\fR, \fBesc_ctrl\fR,
541 \&\fBesc_msb\fR, \fButf8\fR, \fBdump_nostr\fR, \fBdump_unknown\fR, \fBdump_der\fR,
542 \&\fBsep_comma_plus\fR, \fBdn_rev\fR and \fBsname\fR.
543 .IP "\fBoneline\fR" 4
545 A oneline format which is more readable than \s-1RFC2253.\s0 It is equivalent to
546 specifying the \fBesc_2253\fR, \fBesc_ctrl\fR, \fBesc_msb\fR, \fButf8\fR, \fBdump_nostr\fR,
547 \&\fBdump_der\fR, \fBuse_quote\fR, \fBsep_comma_plus_space\fR, \fBspace_eq\fR and \fBsname\fR
548 options. This is the \fIdefault\fR of no name options are given explicitly.
549 .IP "\fBmultiline\fR" 4
551 A multiline format. It is equivalent \fBesc_ctrl\fR, \fBesc_msb\fR, \fBsep_multiline\fR,
552 \&\fBspace_eq\fR, \fBlname\fR and \fBalign\fR.
553 .IP "\fBesc_2253\fR" 4
555 Escape the \*(L"special\*(R" characters required by \s-1RFC2253\s0 in a field. That is
556 \&\fB,+"<>;\fR. Additionally \fB#\fR is escaped at the beginning of a string
557 and a space character at the beginning or end of a string.
558 .IP "\fBesc_2254\fR" 4
560 Escape the \*(L"special\*(R" characters required by \s-1RFC2254\s0 in a field. That is
561 the \fB\s-1NUL\s0\fR character as well as and \fB()*\fR.
562 .IP "\fBesc_ctrl\fR" 4
564 Escape control characters. That is those with \s-1ASCII\s0 values less than
565 0x20 (space) and the delete (0x7f) character. They are escaped using the
566 \&\s-1RFC2253\s0 \eXX notation (where \s-1XX\s0 are two hex digits representing the
568 .IP "\fBesc_msb\fR" 4
570 Escape characters with the \s-1MSB\s0 set, that is with \s-1ASCII\s0 values larger than
572 .IP "\fBuse_quote\fR" 4
574 Escapes some characters by surrounding the whole string with \fB"\fR characters,
575 without the option all escaping is done with the \fB\e\fR character.
578 Convert all strings to \s-1UTF8\s0 format first. This is required by \s-1RFC2253.\s0 If
579 you are lucky enough to have a \s-1UTF8\s0 compatible terminal then the use
580 of this option (and \fBnot\fR setting \fBesc_msb\fR) may result in the correct
581 display of multibyte (international) characters. Is this option is not
582 present then multibyte characters larger than 0xff will be represented
583 using the format \eUXXXX for 16 bits and \eWXXXXXXXX for 32 bits.
584 Also if this option is off any UTF8Strings will be converted to their
585 character form first.
586 .IP "\fBignore_type\fR" 4
587 .IX Item "ignore_type"
588 This option does not attempt to interpret multibyte characters in any
589 way. That is their content octets are merely dumped as though one octet
590 represents each character. This is useful for diagnostic purposes but
591 will result in rather odd looking output.
592 .IP "\fBshow_type\fR" 4
594 Show the type of the \s-1ASN1\s0 character string. The type precedes the
595 field contents. For example \*(L"\s-1BMPSTRING:\s0 Hello World\*(R".
596 .IP "\fBdump_der\fR" 4
598 When this option is set any fields that need to be hexdumped will
599 be dumped using the \s-1DER\s0 encoding of the field. Otherwise just the
600 content octets will be displayed. Both options use the \s-1RFC2253\s0
601 \&\fB#XXXX...\fR format.
602 .IP "\fBdump_nostr\fR" 4
603 .IX Item "dump_nostr"
604 Dump non character string types (for example \s-1OCTET STRING\s0) if this
605 option is not set then non character string types will be displayed
606 as though each content octet represents a single character.
607 .IP "\fBdump_all\fR" 4
609 Dump all fields. This option when used with \fBdump_der\fR allows the
610 \&\s-1DER\s0 encoding of the structure to be unambiguously determined.
611 .IP "\fBdump_unknown\fR" 4
612 .IX Item "dump_unknown"
613 Dump any field whose \s-1OID\s0 is not recognised by OpenSSL.
614 .IP "\fBsep_comma_plus\fR, \fBsep_comma_plus_space\fR, \fBsep_semi_plus_space\fR, \fBsep_multiline\fR" 4
615 .IX Item "sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline"
616 These options determine the field separators. The first character is
617 between RDNs and the second between multiple AVAs (multiple AVAs are
618 very rare and their use is discouraged). The options ending in
619 \&\*(L"space\*(R" additionally place a space after the separator to make it
620 more readable. The \fBsep_multiline\fR uses a linefeed character for
621 the \s-1RDN\s0 separator and a spaced \fB+\fR for the \s-1AVA\s0 separator. It also
622 indents the fields by four characters. If no field separator is specified
623 then \fBsep_comma_plus_space\fR is used by default.
626 Reverse the fields of the \s-1DN.\s0 This is required by \s-1RFC2253.\s0 As a side
627 effect this also reverses the order of multiple AVAs but this is
629 .IP "\fBnofname\fR, \fBsname\fR, \fBlname\fR, \fBoid\fR" 4
630 .IX Item "nofname, sname, lname, oid"
631 These options alter how the field name is displayed. \fBnofname\fR does
632 not display the field at all. \fBsname\fR uses the \*(L"short name\*(R" form
633 (\s-1CN\s0 for commonName for example). \fBlname\fR uses the long form.
634 \&\fBoid\fR represents the \s-1OID\s0 in numerical form and is useful for
638 Align field values for a more readable output. Only usable with
639 \&\fBsep_multiline\fR.
640 .IP "\fBspace_eq\fR" 4
642 Places spaces round the \fB=\fR character which follows the field
645 .IX Subsection "Text Options"
646 As well as customising the name output format, it is also possible to
647 customise the actual fields printed using the \fBcertopt\fR options when
648 the \fBtext\fR option is present. The default behaviour is to print all fields.
649 .IP "\fBcompatible\fR" 4
650 .IX Item "compatible"
651 Use the old format. This is equivalent to specifying no output options at all.
652 .IP "\fBno_header\fR" 4
654 Don't print header information: that is the lines saying \*(L"Certificate\*(R"
656 .IP "\fBno_version\fR" 4
657 .IX Item "no_version"
658 Don't print out the version number.
659 .IP "\fBno_serial\fR" 4
661 Don't print out the serial number.
662 .IP "\fBno_signame\fR" 4
663 .IX Item "no_signame"
664 Don't print out the signature algorithm used.
665 .IP "\fBno_validity\fR" 4
666 .IX Item "no_validity"
667 Don't print the validity, that is the \fBnotBefore\fR and \fBnotAfter\fR fields.
668 .IP "\fBno_subject\fR" 4
669 .IX Item "no_subject"
670 Don't print out the subject name.
671 .IP "\fBno_issuer\fR" 4
673 Don't print out the issuer name.
674 .IP "\fBno_pubkey\fR" 4
676 Don't print out the public key.
677 .IP "\fBno_sigdump\fR" 4
678 .IX Item "no_sigdump"
679 Don't give a hexadecimal dump of the certificate signature.
682 Don't print out certificate trust information.
683 .IP "\fBno_extensions\fR" 4
684 .IX Item "no_extensions"
685 Don't print out any X509V3 extensions.
686 .IP "\fBext_default\fR" 4
687 .IX Item "ext_default"
688 Retain default extension behaviour: attempt to print out unsupported
689 certificate extensions.
690 .IP "\fBext_error\fR" 4
692 Print an error message for unsupported certificate extensions.
693 .IP "\fBext_parse\fR" 4
695 \&\s-1ASN1\s0 parse unsupported extensions.
696 .IP "\fBext_dump\fR" 4
698 Hex dump unsupported extensions.
699 .IP "\fBca_default\fR" 4
700 .IX Item "ca_default"
701 The value used by the \fBca\fR utility, equivalent to \fBno_issuer\fR, \fBno_pubkey\fR,
702 \&\fBno_header\fR, and \fBno_version\fR.
704 .IX Header "EXAMPLES"
705 Note: in these examples the '\e' means the example should be all on one
708 Display the contents of a certificate:
711 \& openssl x509 \-in cert.pem \-noout \-text
714 Display the \*(L"Subject Alternative Name\*(R" extension of a certificate:
717 \& openssl x509 \-in cert.pem \-noout \-ext subjectAltName
720 Display more extensions of a certificate:
723 \& openssl x509 \-in cert.pem \-noout \-ext subjectAltName,nsCertType
726 Display the certificate serial number:
729 \& openssl x509 \-in cert.pem \-noout \-serial
732 Display the certificate subject name:
735 \& openssl x509 \-in cert.pem \-noout \-subject
738 Display the certificate subject name in \s-1RFC2253\s0 form:
741 \& openssl x509 \-in cert.pem \-noout \-subject \-nameopt RFC2253
744 Display the certificate subject name in oneline form on a terminal
745 supporting \s-1UTF8:\s0
748 \& openssl x509 \-in cert.pem \-noout \-subject \-nameopt oneline,\-esc_msb
751 Display the certificate \s-1SHA1\s0 fingerprint:
754 \& openssl x509 \-sha1 \-in cert.pem \-noout \-fingerprint
757 Convert a certificate from \s-1PEM\s0 to \s-1DER\s0 format:
760 \& openssl x509 \-in cert.pem \-inform PEM \-out cert.der \-outform DER
763 Convert a certificate to a certificate request:
766 \& openssl x509 \-x509toreq \-in cert.pem \-out req.pem \-signkey key.pem
769 Convert a certificate request into a self signed certificate using
770 extensions for a \s-1CA:\s0
773 \& openssl x509 \-req \-in careq.pem \-extfile openssl.cnf \-extensions v3_ca \e
774 \& \-signkey key.pem \-out cacert.pem
777 Sign a certificate request using the \s-1CA\s0 certificate above and add user
778 certificate extensions:
781 \& openssl x509 \-req \-in req.pem \-extfile openssl.cnf \-extensions v3_usr \e
782 \& \-CA cacert.pem \-CAkey key.pem \-CAcreateserial
785 Set a certificate to be trusted for \s-1SSL\s0 client use and change set its alias to
786 \&\*(L"Steve's Class 1 \s-1CA\*(R"\s0
789 \& openssl x509 \-in cert.pem \-addtrust clientAuth \e
790 \& \-setalias "Steve\*(Aqs Class 1 CA" \-out trust.pem
794 The \s-1PEM\s0 format uses the header and footer lines:
797 \& \-\-\-\-\-BEGIN CERTIFICATE\-\-\-\-\-
798 \& \-\-\-\-\-END CERTIFICATE\-\-\-\-\-
801 it will also handle files containing:
804 \& \-\-\-\-\-BEGIN X509 CERTIFICATE\-\-\-\-\-
805 \& \-\-\-\-\-END X509 CERTIFICATE\-\-\-\-\-
808 Trusted certificates have the lines
811 \& \-\-\-\-\-BEGIN TRUSTED CERTIFICATE\-\-\-\-\-
812 \& \-\-\-\-\-END TRUSTED CERTIFICATE\-\-\-\-\-
815 The conversion to \s-1UTF8\s0 format used with the name options assumes that
816 T61Strings use the \s-1ISO8859\-1\s0 character set. This is wrong but Netscape
817 and \s-1MSIE\s0 do this as do many certificates. So although this is incorrect
818 it is more likely to display the majority of certificates correctly.
820 The \fB\-email\fR option searches the subject name and the subject alternative
821 name extension. Only unique email addresses will be printed out: it will
822 not print the same address more than once.
823 .SH "CERTIFICATE EXTENSIONS"
824 .IX Header "CERTIFICATE EXTENSIONS"
825 The \fB\-purpose\fR option checks the certificate extensions and determines
826 what the certificate can be used for. The actual checks done are rather
827 complex and include various hacks and workarounds to handle broken
828 certificates and software.
830 The same code is used when verifying untrusted certificates in chains
831 so this section is useful if a chain is rejected by the verify code.
833 The basicConstraints extension \s-1CA\s0 flag is used to determine whether the
834 certificate can be used as a \s-1CA.\s0 If the \s-1CA\s0 flag is true then it is a \s-1CA,\s0
835 if the \s-1CA\s0 flag is false then it is not a \s-1CA.\s0 \fBAll\fR CAs should have the
836 \&\s-1CA\s0 flag set to true.
838 If the basicConstraints extension is absent then the certificate is
839 considered to be a \*(L"possible \s-1CA\*(R"\s0 other extensions are checked according
840 to the intended use of the certificate. A warning is given in this case
841 because the certificate should really not be regarded as a \s-1CA:\s0 however
842 it is allowed to be a \s-1CA\s0 to work around some broken software.
844 If the certificate is a V1 certificate (and thus has no extensions) and
845 it is self signed it is also assumed to be a \s-1CA\s0 but a warning is again
846 given: this is to work around the problem of Verisign roots which are V1
847 self signed certificates.
849 If the keyUsage extension is present then additional restraints are
850 made on the uses of the certificate. A \s-1CA\s0 certificate \fBmust\fR have the
851 keyCertSign bit set if the keyUsage extension is present.
853 The extended key usage extension places additional restrictions on the
854 certificate uses. If this extension is present (whether critical or not)
855 the key can only be used for the purposes specified.
857 A complete description of each test is given below. The comments about
858 basicConstraints and keyUsage and V1 certificates above apply to \fBall\fR
859 \&\s-1CA\s0 certificates.
860 .IP "\fB\s-1SSL\s0 Client\fR" 4
861 .IX Item "SSL Client"
862 The extended key usage extension must be absent or include the \*(L"web client
863 authentication\*(R" \s-1OID.\s0 keyUsage must be absent or it must have the
864 digitalSignature bit set. Netscape certificate type must be absent or it must
865 have the \s-1SSL\s0 client bit set.
866 .IP "\fB\s-1SSL\s0 Client \s-1CA\s0\fR" 4
867 .IX Item "SSL Client CA"
868 The extended key usage extension must be absent or include the \*(L"web client
869 authentication\*(R" \s-1OID.\s0 Netscape certificate type must be absent or it must have
870 the \s-1SSL CA\s0 bit set: this is used as a work around if the basicConstraints
872 .IP "\fB\s-1SSL\s0 Server\fR" 4
873 .IX Item "SSL Server"
874 The extended key usage extension must be absent or include the \*(L"web server
875 authentication\*(R" and/or one of the \s-1SGC\s0 OIDs. keyUsage must be absent or it
876 must have the digitalSignature, the keyEncipherment set or both bits set.
877 Netscape certificate type must be absent or have the \s-1SSL\s0 server bit set.
878 .IP "\fB\s-1SSL\s0 Server \s-1CA\s0\fR" 4
879 .IX Item "SSL Server CA"
880 The extended key usage extension must be absent or include the \*(L"web server
881 authentication\*(R" and/or one of the \s-1SGC\s0 OIDs. Netscape certificate type must
882 be absent or the \s-1SSL CA\s0 bit must be set: this is used as a work around if the
883 basicConstraints extension is absent.
884 .IP "\fBNetscape \s-1SSL\s0 Server\fR" 4
885 .IX Item "Netscape SSL Server"
886 For Netscape \s-1SSL\s0 clients to connect to an \s-1SSL\s0 server it must have the
887 keyEncipherment bit set if the keyUsage extension is present. This isn't
888 always valid because some cipher suites use the key for digital signing.
889 Otherwise it is the same as a normal \s-1SSL\s0 server.
890 .IP "\fBCommon S/MIME Client Tests\fR" 4
891 .IX Item "Common S/MIME Client Tests"
892 The extended key usage extension must be absent or include the \*(L"email
893 protection\*(R" \s-1OID.\s0 Netscape certificate type must be absent or should have the
894 S/MIME bit set. If the S/MIME bit is not set in Netscape certificate type
895 then the \s-1SSL\s0 client bit is tolerated as an alternative but a warning is shown:
896 this is because some Verisign certificates don't set the S/MIME bit.
897 .IP "\fBS/MIME Signing\fR" 4
898 .IX Item "S/MIME Signing"
899 In addition to the common S/MIME client tests the digitalSignature bit or
900 the nonRepudiation bit must be set if the keyUsage extension is present.
901 .IP "\fBS/MIME Encryption\fR" 4
902 .IX Item "S/MIME Encryption"
903 In addition to the common S/MIME tests the keyEncipherment bit must be set
904 if the keyUsage extension is present.
905 .IP "\fBS/MIME \s-1CA\s0\fR" 4
907 The extended key usage extension must be absent or include the \*(L"email
908 protection\*(R" \s-1OID.\s0 Netscape certificate type must be absent or must have the
909 S/MIME \s-1CA\s0 bit set: this is used as a work around if the basicConstraints
911 .IP "\fB\s-1CRL\s0 Signing\fR" 4
912 .IX Item "CRL Signing"
913 The keyUsage extension must be absent or it must have the \s-1CRL\s0 signing bit
915 .IP "\fB\s-1CRL\s0 Signing \s-1CA\s0\fR" 4
916 .IX Item "CRL Signing CA"
917 The normal \s-1CA\s0 tests apply. Except in this case the basicConstraints extension
921 Extensions in certificates are not transferred to certificate requests and
924 It is possible to produce invalid certificates or requests by specifying the
925 wrong private key or using inconsistent options in some cases: these should
928 There should be options to explicitly set such things as start and end
929 dates rather than an offset from the current time.
931 .IX Header "SEE ALSO"
932 \&\fBreq\fR\|(1), \fBca\fR\|(1), \fBgenrsa\fR\|(1),
933 \&\fBgendsa\fR\|(1), \fBverify\fR\|(1),
934 \&\fBx509v3_config\fR\|(5)
937 The hash algorithm used in the \fB\-subject_hash\fR and \fB\-issuer_hash\fR options
938 before OpenSSL 1.0.0 was based on the deprecated \s-1MD5\s0 algorithm and the encoding
939 of the distinguished name. In OpenSSL 1.0.0 and later it is based on a
940 canonical version of the \s-1DN\s0 using \s-1SHA1.\s0 This means that any directories using
941 the old form must have their links rebuilt using \fBc_rehash\fR or similar.
943 .IX Header "COPYRIGHT"
944 Copyright 2000\-2019 The OpenSSL Project Authors. All Rights Reserved.
946 Licensed under the OpenSSL license (the \*(L"License\*(R"). You may not use
947 this file except in compliance with the License. You can obtain a copy
948 in the file \s-1LICENSE\s0 in the source distribution or at
949 <https://www.openssl.org/source/license.html>.
projects / FreeBSD / FreeBSD.git / blob