2 .\" SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 .\" Copyright 2018 Allan Jude <allanjude@freebsd.org>
6 .\" Redistribution and use in source and binary forms, with or without
7 .\" modification, are permitted providing that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\" 2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
15 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17 .\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
19 .\" DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
23 .\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
24 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25 .\" POSSIBILITY OF SUCH DAMAGE.
34 .Nd "tool for managing trusted and blacklist TLS certificates"
52 .Ic unblacklist Ar file
56 utility manages the list of TLS Certificate Authorities that are trusted by
57 applications that use OpenSSL.
62 Specify the DESTDIR (overriding values from the environment).
64 Specify the path of the METALOG file (default: $DESTDIR/METALOG).
66 No-Op mode, do not actually perform any actions.
68 be verbose, print details about actions before performing them.
70 Unprivileged mode, do not change the ownership of created links.
71 Do record the ownership in the METALOG file.
74 Primary command functions:
75 .Bl -tag -width blacklisted
77 List all currently trusted certificate authorities.
79 List all currently blacklisted certificates.
81 Rebuild the list of trusted certificate authorities by scanning all directories
84 and all blacklisted certificates in
86 A symbolic link to each trusted certificate is placed in
88 and each blacklisted certificate in
89 .Ev BLACKLISTDESTDIR .
91 Add the specified file to the blacklist.
93 Remove the specified file from the blacklist.
96 .Bl -tag -width BLACKLISTDESTDIR
98 Alternate destination directory to operate on.
100 List of paths to search for trusted certificates.
102 .Pa <DESTDIR>/usr/share/certs/trusted
103 .Pa <DESTDIR>/usr/local/share/certs <DESTDIR>/usr/local/etc/ssl/certs
105 List of paths to search for blacklisted certificates.
107 .Pa <DESTDIR>/usr/share/certs/blacklisted
108 .Pa <DESTDIR>/usr/local/etc/ssl/blacklisted
110 Destination directory for symbolic links to trusted certificates.
112 .Pa <DESTDIR>/etc/ssl/certs
113 .It Ev BLACKLISTDESTDIR
114 Destination directory for symbolic links to blacklisted certificates.
116 .Pa <DESTDIR>/etc/ssl/blacklisted
118 List of file extensions to read as certificate files.
119 Default: *.pem *.crt *.cer *.crl *.0
128 .An Allan Jude Aq Mt allanjude@freebsd.org