Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-07-13 19:13:22 +09:00
parent 9a23f88dc2
commit 2e57f602ae
542 changed files with 17287 additions and 6184 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man1/ca.pod
+16
View File
@@ -57,6 +57,8 @@ B<openssl> B<ca>
[B<-multivalue-rdn>]
[B<-rand file...>]
[B<-writerand file>]
[B<-sm2-id string>]
[B<-sm2-hex-id hex-string>]
=head1 DESCRIPTION
@@ -303,6 +305,16 @@ all others.
Writes random data to the specified I<file> upon exit.
This can be used with a subsequent B<-rand> flag.
=item B<-sm2-id>
Specify the ID string to use when verifying an SM2 certificate. The ID string is
required by the SM2 signature algorithm for signing and verification.
=item B<-sm2-hex-id>
Specify a binary ID string to use when signing or verifying using an SM2
certificate. The argument for this option is string of hexadecimal digits.
=back
=head1 CRL OPTIONS
@@ -600,6 +612,10 @@ Sign a certificate request:
openssl ca -in req.pem -out newcert.pem
Sign an SM2 certificate request:
openssl ca -in sm2.csr -out sm2.crt -md sm3 -sigopt "sm2_id:1234567812345678" -sm2-id "1234567812345678"
Sign a certificate request, using CA extensions:
openssl ca -in req.pem -extensions v3_ca -out newcert.pem
doc/man1/kdf.pod
+1
View File
@@ -150,6 +150,7 @@ L<EVP_KDF_PBKDF2(7)>
L<EVP_KDF_HKDF(7)>
L<EVP_KDF_SS(7)>
L<EVP_KDF_SSHKDF(7)>
L<pkeyutl(1)>
=head1 HISTORY
doc/man1/mac.pod
+1 -1
View File
@@ -76,7 +76,7 @@ To see the list of supported digests, use the command I<list -digest-commands>.
=item B<cipher:string>
Used by CMAC and GMAC to specifiy the cipher algorithm.
Used by CMAC and GMAC to specify the cipher algorithm.
For CMAC it must be one of AES-128-CBC, AES-192-CBC, AES-256-CBC or
DES-EDE3-CBC.
For GMAC it should be a GCM mode cipher e.g. AES-128-GCM.
doc/man1/pkeyutl.pod
+2 -1
View File
@@ -395,7 +395,8 @@ Verify some data using an L<SM2(7)> certificate and a specific ID:
L<genpkey(1)>, L<pkey(1)>, L<rsautl(1)>
L<dgst(1)>, L<rsa(1)>, L<genrsa(1)>,
L<EVP_PKEY_CTX_set_hkdf_md(3)>, L<EVP_PKEY_CTX_set_tls1_prf_md(3)>
L<EVP_PKEY_CTX_set_hkdf_md(3)>, L<EVP_PKEY_CTX_set_tls1_prf_md(3)>,
L<kdf(1)>
=head1 COPYRIGHT
doc/man1/req.pod
+21
View File
@@ -50,6 +50,8 @@ B<openssl> B<req>
[B<-batch>]
[B<-verbose>]
[B<-engine id>]
[B<-sm2-id string>]
[B<-sm2-hex-id hex-string>]
=head1 DESCRIPTION
@@ -339,6 +341,16 @@ for all available algorithms.
Specifies an engine (by its unique B<id> string) which would be used
for key generation operations.
=item B<-sm2-id>
Specify the ID string to use when verifying an SM2 certificate. The ID string is
required by the SM2 signature algorithm for signing and verification.
=item B<-sm2-hex-id>
Specify a binary ID string to use when signing or verifying using an SM2
certificate. The argument for this option is string of hexadecimal digits.
=back
=head1 CONFIGURATION FILE FORMAT
@@ -534,6 +546,15 @@ Generate a self signed root certificate:
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out req.pem
Create an SM2 private key and then generate a certificate request from it:
openssl ecparam -genkey -name SM2 -out sm2.key
openssl req -new -key sm2.key -out sm2.csr -sm3 -sigopt "sm2_id:1234567812345678"
Examine and verify an SM2 certificate request:
openssl req -verify -in sm2.csr -sm3 -sm2-id 1234567812345678
Example of a file pointed to by the B<oid_file> option:
1.2.3.4 shortName A longer Name
doc/man1/ts.pod
+8 -7
View File
@@ -170,7 +170,7 @@ in use. (Optional)
The message digest to apply to the data file.
Any digest supported by the OpenSSL B<dgst> command can be used.
The default is SHA-1. (Optional)
The default is SHA-256. (Optional)
=item B<-tspolicy> object_id
@@ -518,7 +518,7 @@ included. Default is no. (Optional)
=item B<ess_cert_id_alg>
This option specifies the hash function to be used to calculate the TSA's
public key certificate identifier. Default is sha1. (Optional)
public key certificate identifier. Default is sha256. (Optional)
=back
@@ -530,8 +530,9 @@ openssl/apps/openssl.cnf will do.
=head2 Time Stamp Request
To create a time stamp request for design1.txt with SHA-1
without nonce and policy and no certificate is required in the response:
To create a time stamp request for design1.txt with SHA-256 digest,
without nonce and policy, and without requirement for a certificate
in the response:
openssl ts -query -data design1.txt -no_nonce \
-out design1.tsq
@@ -546,12 +547,12 @@ To print the content of the previous request in human readable format:
openssl ts -query -in design1.tsq -text
To create a time stamp request which includes the MD-5 digest
of design2.txt, requests the signer certificate and nonce,
To create a time stamp request which includes the SHA-512 digest
of design2.txt, requests the signer certificate and nonce, and
specifies a policy id (assuming the tsa_policy1 name is defined in the
OID section of the config file):
openssl ts -query -data design2.txt -md5 \
openssl ts -query -data design2.txt -sha512 \
-tspolicy tsa_policy1 -cert -out design2.tsq
=head2 Time Stamp Response