Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-04-15 18:45:34 +09:00
parent be29e7bcc6
commit 2015c00c43
573 changed files with 22943 additions and 6714 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man1/CA.pl.pod
+35 -61
View File
@@ -21,13 +21,13 @@ B<-signCA> |
B<-signcert> |
B<-crl> |
B<-newca>
[B<-extra-cmd> I<extra-params>]
[B<-extra-I<cmd>> I<parameter>]
B<CA.pl> B<-pkcs12> [B<-extra-pkcs12> I<extra-params>] [I<certname>]
B<CA.pl> B<-pkcs12> [B<-extra-pkcs12> I<parameter>] [I<certname>]
B<CA.pl> B<-verify> [B<-extra-verify> I<extra-params>] I<certfile> ...
B<CA.pl> B<-verify> [B<-extra-verify> I<parameter>] I<certfile> ...
B<CA.pl> B<-revoke> [B<-extra-ca> I<extra-params>] I<certfile> [I<reason>]
B<CA.pl> B<-revoke> [B<-extra-ca> I<parameter>] I<certfile> [I<reason>]
=head1 DESCRIPTION
@@ -36,6 +36,23 @@ arguments to the L<openssl(1)> command for some common certificate operations.
It is intended to simplify the process of certificate creation and management
by the use of some simple options.
The script is intended as a simple front end for the L<openssl(1)> program for
use by a beginner. Its behaviour isn't always what is wanted. For more control
over the behaviour of the certificate commands call the L<openssl(1)> command
directly.
Most of the filenames mentioned below can be modified by editing the
B<CA.pl> script.
Under some environments it may not be possible to run the B<CA.pl> script
directly (for example Win32) and the default configuration file location may
be wrong. In this case the command:
perl -S CA.pl
can be used and the B<OPENSSL_CONF> environment variable can be set to point to
the correct path of the configuration file.
=head1 OPTIONS
=over 4
@@ -70,6 +87,11 @@ details of the CA will be prompted for. The relevant files and directories
are created in a directory called F<demoCA> in the current directory.
Uses L<openssl-req(1)> and L<openssl-ca(1)>.
If the F<demoCA> directory already exists then the B<-newca> command will not
overwrite it and will do nothing. This can happen if a previous call using
the B<-newca> option terminated abnormally. To get the correct behaviour
delete the directory if it already exists.
=item B<-pkcs12>
Create a PKCS#12 file containing the user certificate, private key and CA
@@ -120,13 +142,15 @@ Verifies certificates against the CA certificate for F<demoCA>. If no
certificates are specified on the command line it tries to verify the file
F<newcert.pem>. Invokes L<openssl-verify(1)>.
=item B<-extra-req> | B<-extra-ca> | B<-extra-pkcs12> | B<-extra-x509> | B<-extra-verify> I<extra-params>
=item B<-extra-I<cmd>> I<parameter>
For each option B<extra-I<cmd>>, pass I<extra-params> to the L<openssl(1)>
For each option B<extra-I<cmd>>, pass I<parameter> to the L<openssl(1)>
sub-command with the same name as I<cmd>, if that sub-command is invoked.
For example, if L<openssl-req(1)> is invoked, the I<extra-params> given with
For example, if L<openssl-req(1)> is invoked, the I<parameter> given with
B<-extra-req> will be passed to it.
Users should consult L<openssl(1)> command documentation for more information.
For multi-word parameters, either repeat the option or quote the I<parameters>
so it looks like one word to your shell.
See the individual command documentation for more information.
=back
@@ -144,66 +168,16 @@ the request and finally create a PKCS#12 file containing it.
CA.pl -signreq
CA.pl -pkcs12 "My Test Certificate"
=head1 DSA CERTIFICATES
Although the B<CA.pl> creates RSA CAs and requests it is still possible to
use it with DSA certificates and requests using the L<openssl-req(1)> command
directly. The following example shows the steps that would typically be taken.
Create some DSA parameters:
openssl dsaparam -out dsap.pem 1024
Create a DSA CA certificate and private key:
openssl req -x509 -newkey dsa:dsap.pem -keyout cacert.pem -out cacert.pem
Create the CA directories and files:
CA.pl -newca
enter a filename (for example, F<cacert.pem>) when prompted for the CA file
name.
Create a DSA certificate request and private key (a different set of parameters
can optionally be created first):
openssl req -out newreq.pem -newkey dsa:dsap.pem
Sign the request:
CA.pl -signreq
=head1 ENVIRONMENT
The environment variable B<OPENSSL> may be used to specify the name of
the OpenSSL program. It can be a full pathname, or a relative one.
The environment variable B<OPENSSL_CONFIG> may be used to specify a
configuration option and value to the B<req> and B<ca> commands invoked by
this script. It's value should be the option and pathname, as in
C<-config /path/to/conf-file>.
=head1 NOTES
Most of the filenames mentioned can be modified by editing the B<CA.pl> script.
If the F<demoCA> directory already exists then the B<-newca> command will not
overwrite it and will do nothing. This can happen if a previous call using
the B<-newca> option terminated abnormally. To get the correct behaviour
delete the demoCA directory if it already exists.
Under some environments it may not be possible to run the B<CA.pl> script
directly (for example Win32) and the default configuration file location may
be wrong. In this case the command:
perl -S CA.pl
can be used and the B<OPENSSL_CONF> environment variable changed to point to
the correct path of the configuration file.
The script is intended as a simple front end for the L<openssl(1)> program for
use by a beginner. Its behaviour isn't always what is wanted. For more control
over the behaviour of the certificate commands call the L<openssl(1)> command
directly.
=head1 SEE ALSO
L<openssl(1)>,
doc/man1/openssl-asn1parse.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-asn1parse - ASN.1 parsing tool
openssl-asn1parse - ASN.1 parsing command
=head1 SYNOPSIS
doc/man1/openssl-ca.pod.in
+20 -19
View File
@@ -53,17 +53,16 @@ B<openssl> B<ca>
[B<-subj> I<arg>]
[B<-utf8>]
[B<-sigopt> I<nm>:I<v>]
[B<-vfyopt> I<nm>:I<v>]
[B<-create_serial>]
[B<-rand_serial>]
[B<-multivalue-rdn>]
[B<-sm2-id> I<string>]
[B<-sm2-hex-id> I<hex-string>]
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<certreq>...]
=for openssl ifdef engine sm2-id sm2-hex-id
=for openssl ifdef engine
=head1 DESCRIPTION
@@ -147,16 +146,26 @@ See L<openssl(1)/Format Options> for details.
=item B<-sigopt> I<nm>:I<v>
Pass options to the signature algorithm during sign or verify operations.
Pass options to the signature algorithm during sign operations.
Names and values of these options are algorithm-specific.
=item B<-vfyopt> I<nm>:I<v>
Pass options to the signature algorithm during verify operations.
Names and values of these options are algorithm-specific.
This often needs to be given while signing too, because the input
certificate signature request is verified against its own public key,
and that verification may need its own set of options.
=item B<-key> I<password>
=for openssl foreign manual ps(1)
The password used to encrypt the private key. Since on some
systems the command line arguments are visible (e.g. Unix with
the L<ps(1)> utility) this option should be used with caution.
systems the command line arguments are visible (e.g., when using
L<ps(1)> on Unix),
this option should be used with caution.
=item B<-selfsign>
@@ -296,16 +305,6 @@ C</DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe>
If B<-multi-rdn> is not used then the UID value is C<123456+CN=John Doe>.
=item B<-sm2-id> I<string>
Specify the ID string to use when verifying an SM2 certificate. The ID string is
required by the SM2 signature algorithm for signing and verification.
=item B<-sm2-hex-id> I<hex-string>
Specify a binary ID string to use when signing or verifying using an SM2
certificate. The argument for this option is string of hexadecimal digits.
{- $OpenSSL::safe::opt_r_item -}
{- $OpenSSL::safe::opt_engine_item -}
@@ -616,7 +615,9 @@ Sign a certificate request:
Sign an SM2 certificate request:
openssl ca -in sm2.csr -out sm2.crt -md sm3 -sigopt "sm2_id:1234567812345678" -sm2-id "1234567812345678"
openssl ca -in sm2.csr -out sm2.crt -md sm3 \
-sigopt "distid:1234567812345678" \
-vfyopt "distid:1234567812345678"
Sign a certificate request, using CA extensions:
@@ -712,8 +713,8 @@ numbers of certificates are present because, as the name implies
the database has to be kept in memory.
This command really needs rewriting or the required functionality
exposed at either a command or interface level so a more friendly utility
(perl script or GUI) can handle things properly. The script
exposed at either a command or interface level so that a more user-friendly
replacement could handle things properly. The script
B<CA.pl> helps a little but not very much.
Any fields in a request that are not present in a policy are silently
doc/man1/openssl-ciphers.pod.in
+15 -2
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-ciphers - SSL cipher display and cipher list tool
openssl-ciphers - SSL cipher display and cipher list command
=head1 SYNOPSIS
@@ -31,7 +31,7 @@ B<openssl> B<ciphers>
=head1 DESCRIPTION
This command converts textual OpenSSL cipher lists into
ordered SSL cipher preference lists. It can be used as a test tool to
ordered SSL cipher preference lists. It can be used to
determine the appropriate cipherlist.
=head1 OPTIONS
@@ -524,6 +524,19 @@ distribution.
TLS_GOSTR341094_WITH_NULL_GOSTR3411 GOST94-NULL-GOST94
TLS_GOSTR341001_WITH_NULL_GOSTR3411 GOST2001-NULL-GOST94
=head2 GOST cipher suites, extending TLS v1.2
Note: these ciphers require an engine which including GOST cryptographic
algorithms, such as the B<gost> engine, which isn't part of the OpenSSL
distribution.
TLS_GOSTR341112_256_WITH_28147_CNT_IMIT GOST2012-GOST8912-GOST8912
TLS_GOSTR341112_256_WITH_NULL_GOSTR3411 GOST2012-NULL-GOST12
Note: GOST2012-GOST8912-GOST8912 is an alias for two ciphers ID
old LEGACY-GOST2012-GOST8912-GOST8912 and new IANA-GOST2012-GOST8912-GOST8912
=head2 Additional Export 1024 and other cipher suites
Note: these ciphers can also be used in SSL v3.
doc/man1/openssl-cms.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-cms - CMS utility
openssl-cms - CMS command
=head1 SYNOPSIS
doc/man1/openssl-crl.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-crl - CRL utility
openssl-crl - CRL command
=head1 SYNOPSIS
doc/man1/openssl-ocsp.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-ocsp - Online Certificate Status Protocol utility
openssl-ocsp - Online Certificate Status Protocol command
=head1 SYNOPSIS
doc/man1/openssl-pkcs12.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-pkcs12 - PKCS#12 file utility
openssl-pkcs12 - PKCS#12 file command
=head1 SYNOPSIS
doc/man1/openssl-pkcs7.pod.in
+1 -1
View File
@@ -7,7 +7,7 @@
=head1 NAME
openssl-pkcs7 - PKCS#7 utility
openssl-pkcs7 - PKCS#7 command
=head1 SYNOPSIS
doc/man1/openssl-pkcs8.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-pkcs8 - PKCS#8 format private key conversion tool
openssl-pkcs8 - PKCS#8 format private key conversion command
=head1 SYNOPSIS
doc/man1/openssl-pkey.pod.in
+1 -1
View File
@@ -7,7 +7,7 @@
=head1 NAME
openssl-pkey - public or private key processing tool
openssl-pkey - public or private key processing command
=head1 SYNOPSIS
doc/man1/openssl-pkeyparam.pod.in
+1 -1
View File
@@ -7,7 +7,7 @@
=head1 NAME
openssl-pkeyparam - public key algorithm parameter processing tool
openssl-pkeyparam - public key algorithm parameter processing command
=head1 SYNOPSIS
doc/man1/openssl-pkeyutl.pod.in
+7 -7
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-pkeyutl - public key algorithm utility
openssl-pkeyutl - public key algorithm command
=head1 SYNOPSIS
@@ -321,18 +321,18 @@ must be known for this to work. If the size of the file cannot be determined
=head1 SM2
The SM2 algorithm supports sign, verify, encrypt and decrypt operations. For
the sign and verify operations, SM2 requires an ID string to be passed in. The
following B<-pkeyopt> value is supported:
the sign and verify operations, SM2 requires an Distinguishing ID string to
be passed in. The following B<-pkeyopt> value is supported:
=over 4
=item B<sm2_id:>I<string>
=item B<distid:>I<string>
This sets the ID string used in SM2 sign or verify operations. While verifying
an SM2 signature, the ID string must be the same one used when signing the data.
Otherwise the verification will fail.
=item B<sm2_hex_id:>I<hex_string>
=item B<hexdistid:>I<hex_string>
This sets the ID string used in SM2 sign or verify operations. While verifying
an SM2 signature, the ID string must be the same one used when signing the data.
@@ -382,12 +382,12 @@ Derive using the same algorithm, but read key from environment variable MYPASS:
Sign some data using an L<SM2(7)> private key and a specific ID:
openssl pkeyutl -sign -in file -inkey sm2.key -out sig -rawin -digest sm3 \
-pkeyopt sm2_id:someid
-pkeyopt distid:someid
Verify some data using an L<SM2(7)> certificate and a specific ID:
openssl pkeyutl -verify -certin -in file -inkey sm2.cert -sigfile sig \
-rawin -digest sm3 -pkeyopt sm2_id:someid
-rawin -digest sm3 -pkeyopt distid:someid
=head1 SEE ALSO
doc/man1/openssl-req.pod.in
+19 -17
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-req - PKCS#10 certificate request and certificate generating utility
openssl-req - PKCS#10 certificate request and certificate generating command
=head1 SYNOPSIS
@@ -45,16 +45,15 @@ B<openssl> B<req>
[B<-subject>]
[B<-subj> I<arg>]
[B<-sigopt> I<nm>:I<v>]
[B<-vfyopt> I<nm>:I<v>]
[B<-batch>]
[B<-verbose>]
[B<-sm2-id> I<string>]
[B<-sm2-hex-id> I<hex-string>]
{- $OpenSSL::safe::opt_name_synopsis -}
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
=for openssl ifdef engine keygen_engine sm2-id sm2-hex-id
=for openssl ifdef engine keygen_engine
=head1 DESCRIPTION
@@ -85,9 +84,22 @@ options (B<-new> and B<-newkey>) are not specified.
=item B<-sigopt> I<nm>:I<v>
Pass options to the signature algorithm during sign or verify operations.
Pass options to the signature algorithm during sign operations.
Names and values of these options are algorithm-specific.
=item B<-vfyopt> I<nm>:I<v>
Pass options to the signature algorithm during verify operations.
Names and values of these options are algorithm-specific.
=begin comment
Maybe it would be preferable to only have -opts instead of -sigopt and
-vfyopt? They are both present here to be compatible with L<openssl-ca(1)>,
which supports both options for good reasons.
=end comment
=item B<-passin> I<arg>, B<-passout> I<arg>
The password source for the input and output file.
@@ -313,16 +325,6 @@ Print extra details about the operations being performed.
Specifies an engine (by its unique I<id> string) which would be used
for key generation operations.
=item B<-sm2-id>
Specify the ID string to use when verifying an SM2 certificate request. The ID
string is required by the SM2 signature algorithm for signing and verification.
=item B<-sm2-hex-id>
Specify a binary ID string to use when verifying an SM2 certificate request. The
argument for this option is string of hexadecimal digits.
{- $OpenSSL::safe::opt_name_item -}
{- $OpenSSL::safe::opt_r_item -}
@@ -531,11 +533,11 @@ Generate a self signed root certificate:
Create an SM2 private key and then generate a certificate request from it:
openssl ecparam -genkey -name SM2 -out sm2.key
openssl req -new -key sm2.key -out sm2.csr -sm3 -sigopt "sm2_id:1234567812345678"
openssl req -new -key sm2.key -out sm2.csr -sm3 -sigopt "distid:1234567812345678"
Examine and verify an SM2 certificate request:
openssl req -verify -in sm2.csr -sm3 -sm2-id 1234567812345678
openssl req -verify -in sm2.csr -sm3 -vfyopt "distid:1234567812345678"
Example of a file pointed to by the B<oid_file> option:
doc/man1/openssl-rsa.pod.in
+1 -1
View File
@@ -7,7 +7,7 @@
=head1 NAME
openssl-rsa - RSA key processing tool
openssl-rsa - RSA key processing command
=head1 SYNOPSIS
doc/man1/openssl-rsautl.pod.in
+2 -2
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-rsautl - RSA utility
openssl-rsautl - RSA command
=head1 SYNOPSIS
@@ -167,7 +167,7 @@ encrypt and decrypt the block would have been of type 2 (the second byte)
and random padding data visible instead of the 0xff bytes.
It is possible to analyse the signature of certificates using this
utility in conjunction with L<openssl-asn1parse(1)>. Consider the self signed
command in conjunction with L<openssl-asn1parse(1)>. Consider the self signed
example in F<certs/pca-cert.pem>. Running L<openssl-asn1parse(1)> as follows
yields:
doc/man1/openssl-s_server.pod.in
+9
View File
@@ -124,6 +124,7 @@ B<openssl> B<s_server>
[B<-nextprotoneg> I<val>]
[B<-use_srtp> I<val>]
[B<-alpn> I<val>]
[B<-sendfile>]
[B<-keylogfile> I<outfile>]
[B<-recv_max_early_data> I<int>]
[B<-max_early_data> I<int>]
@@ -152,6 +153,8 @@ B<openssl> B<s_server>
=for openssl ifdef ssl3 tls1 tls1_1 tls1_2 tls1_3 dtls mtu dtls1 dtls1_2
=for openssl ifdef sendfile
=head1 DESCRIPTION
This command implements a generic SSL/TLS server which
@@ -613,6 +616,12 @@ Protocol names are printable ASCII strings, for example "http/1.1" or
"spdy/3".
The flag B<-nextprotoneg> cannot be specified if B<-tls1_3> is used.
=item B<-sendfile>
If this option is set and KTLS is enabled, SSL_sendfile() will be used
instead of BIO_write() to send the HTTP response requested by a client.
This option is only valid if B<-WWW> or B<-HTTP> is specified.
=item B<-keylogfile> I<outfile>
Appends TLS secrets to the specified keylog file such that external programs
doc/man1/openssl-sess_id.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-sess_id - SSL/TLS session handling utility
openssl-sess_id - SSL/TLS session handling command
=head1 SYNOPSIS
doc/man1/openssl-smime.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-smime - S/MIME utility
openssl-smime - S/MIME command
=head1 SYNOPSIS
doc/man1/openssl-spkac.pod.in
+1 -1
View File
@@ -7,7 +7,7 @@
=head1 NAME
openssl-spkac - SPKAC printing and generating utility
openssl-spkac - SPKAC printing and generating command
=head1 SYNOPSIS
doc/man1/openssl-storeutl.pod.in
+1 -1
View File
@@ -7,7 +7,7 @@
=head1 NAME
openssl-storeutl - STORE utility
openssl-storeutl - STORE command
=head1 SYNOPSIS
doc/man1/openssl-ts.pod.in
+1 -1
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-ts - Time Stamping Authority tool (client/server)
openssl-ts - Time Stamping Authority command
=head1 SYNOPSIS
doc/man1/openssl-verify.pod.in
+8 -16
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-verify - Utility to verify certificates
openssl-verify - certificate verification command
=head1 SYNOPSIS
@@ -12,11 +12,10 @@ B<openssl> B<verify>
[B<-CRLfile> I<file>]
[B<-crl_download>]
[B<-show_chain>]
[B<-sm2-id> I<hexstring>]
[B<-sm2-hex-id> I<hexstring>]
[B<-verbose>]
[B<-trusted> I<file>]
[B<-untrusted> I<file>]
[B<-vfyopt> I<nm>:I<v>]
{- $OpenSSL::safe::opt_name_synopsis -}
{- $OpenSSL::safe::opt_trust_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
@@ -25,7 +24,7 @@ B<openssl> B<verify>
[B<-->]
[I<certificate> ...]
=for openssl ifdef engine sm2-id sm2-hex-id
=for openssl ifdef engine
=head1 DESCRIPTION
@@ -59,16 +58,6 @@ Display information about the certificate chain that has been built (if
successful). Certificates in the chain that came from the untrusted list will be
flagged as "untrusted".
=item B<-sm2-id> I<hexstring>
Specify the ID string to use when verifying an SM2 certificate. The ID string is
required by the SM2 signature algorithm for signing and verification.
=item B<-sm2-hex-id> I<hexstring>
Specify a binary ID string to use when signing or verifying using an SM2
certificate. The argument for this option is string of hexadecimal digits.
=item B<-verbose>
Print extra information about the operations being performed.
@@ -81,6 +70,11 @@ A file of trusted certificates.
A file of untrusted certificates.
=item B<-vfyopt> I<nm>:I<v>
Pass options to the signature algorithm during verify operations.
Names and values of these options are algorithm-specific.
{- $OpenSSL::safe::opt_name_item -}
{- $OpenSSL::safe::opt_engine_item -}
@@ -159,8 +153,6 @@ L<ossl_store-file(7)>
The B<-show_chain> option was added in OpenSSL 1.1.0.
The B<-sm2-id> and B<-sm2-hex-id> options were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
doc/man1/openssl-x509.pod.in
+9 -3
View File
@@ -3,7 +3,7 @@
=head1 NAME
openssl-x509 - Certificate display and signing utility
openssl-x509 - Certificate display and signing command
=head1 SYNOPSIS
@@ -71,6 +71,7 @@ B<openssl> B<x509>
[B<-extfile> I<filename>]
[B<-extensions> I<section>]
[B<-sigopt> I<nm>:I<v>]
[B<-vfyopt> I<nm>:I<v>]
[B<-preserve_dates>]
{- $OpenSSL::safe::opt_name_synopsis -}
{- $OpenSSL::safe::opt_r_synopsis -}
@@ -81,7 +82,7 @@ B<openssl> B<x509>
=head1 DESCRIPTION
This command is a multi purpose certificate utility. It can
This command is a multi-purposes certificate command. It can
be used to display certificate information, convert certificates to
various forms, sign certificate requests like a "mini CA" or edit
certificate trust settings.
@@ -371,7 +372,12 @@ for testing.
=item B<-sigopt> I<nm>:I<v>
Pass options to the signature algorithm during sign or verify operations.
Pass options to the signature algorithm during sign operations.
Names and values of these options are algorithm-specific.
=item B<-vfyopt> I<nm>:I<v>
Pass options to the signature algorithm during verify operations.
Names and values of these options are algorithm-specific.
=item B<-passin> I<arg>
doc/man1/openssl.pod
+13 -13
View File
@@ -2,7 +2,7 @@
=head1 NAME
openssl - OpenSSL command line tool
openssl - OpenSSL command line program
=head1 SYNOPSIS
@@ -29,7 +29,7 @@ OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL
v2/v3) and Transport Layer Security (TLS v1) network protocols and related
cryptography standards required by them.
The B<openssl> program is a command line tool for using the various
The B<openssl> program is a command line program for using the various
cryptography functions of OpenSSL's B<crypto> library from the shell.
It can be used for
@@ -104,7 +104,7 @@ Cipher Suite Description Determination.
=item B<cms>
CMS (Cryptographic Message Syntax) utility.
CMS (Cryptographic Message Syntax) command.
=item B<crl>
@@ -196,7 +196,7 @@ Create or examine a Netscape certificate sequence.
=item B<ocsp>
Online Certificate Status Protocol utility.
Online Certificate Status Protocol command.
=item B<passwd>
@@ -212,7 +212,7 @@ PKCS#7 Data Management.
=item B<pkcs8>
PKCS#8 format private key conversion tool.
PKCS#8 format private key conversion command.
=item B<pkey>
@@ -224,7 +224,7 @@ Public key algorithm parameter management.
=item B<pkeyutl>
Public key algorithm cryptographic operation utility.
Public key algorithm cryptographic operation command.
=item B<prime>
@@ -252,7 +252,7 @@ RSA key management.
=item B<rsautl>
RSA utility for signing, verification, encryption, and decryption. Superseded
RSA command for signing, verification, encryption, and decryption. Superseded
by L<openssl-pkeyutl(1)>.
=item B<s_client>
@@ -289,7 +289,7 @@ Algorithm Speed Measurement.
=item B<spkac>
SPKAC printing and generating utility.
SPKAC printing and generating command.
=item B<srp>
@@ -297,11 +297,11 @@ Maintain SRP password file.
=item B<storeutl>
Utility to list and display certificates, keys, CRLs, etc.
Command to list and display certificates, keys, CRLs, etc.
=item B<ts>
Time Stamping Authority tool (client/server).
Time Stamping Authority command.
=item B<verify>
@@ -727,11 +727,11 @@ Do not use the default store.
=head2 Random State Options
Prior to OpenSSL 3.0, it was common for applications to store information
Prior to OpenSSL 1.1.1, it was common for applications to store information
about the state of the random-number generator in a file that was loaded
at startup and rewritten upon exit. On modern operating systems, this is
generally no longer necessary as OpenSSL will seed itself from the
appropriate CPU flags, device files, and so on. These flags are still
generally no longer necessary as OpenSSL will seed itself from a trusted
entropy source provided by the operating system. These flags are still
supported for special platforms or circumstances that might require them.
It is generally an error to use the same seed file more than once and