Latest update.

doc/man1/cms.pod

@@ -15,6 +15,7 @@ B<openssl> B<cms>
 [B<-verify>]
 [B<-cmsout>]
 [B<-resign>]
+[B<-cades>]
 [B<-data_create>]
 [B<-data_out>]
 [B<-digest_create>]
@@ -158,6 +159,12 @@ Takes an input message and writes out a PEM encoded CMS structure.
 
 Resign a message: take an existing message and one or more new signers.
 
+=item B<-cades>
+
+Add an ESS signing-certificate or ESS signing-certificate-v2 signed-attribute to the SignerInfo, in order to make
+the signature comply with the requirements for a CAdES Basic Electronic Signature (CAdES-BES). See the NOTES
+section for more details.
+
 =item B<-data_create>
 
 Create a CMS B<Data> type.
@@ -553,6 +560,40 @@ The B<-debug_decrypt> option can be used to disable the MMA attack protection
 and return an error if no recipient can be found: this option should be used
 with caution. For a fuller description see L<CMS_decrypt(3)>).
 
+=head1 CAdES Basic Electronic Signature (CAdES-BES)
+
+A CAdES Basic Electronic Signature (CAdES-BES), as defined in the European Standard ETSI EN 319 122-1 V1.1.1, contains:
+
+=over 4
+
+=item *
+
+The signed user data as defined in CMS (RFC 3852);
+
+=item *
+
+Content-type of the EncapsulatedContentInfo value being signed;
+
+=item *
+
+Message-digest of the eContent OCTET STRING within encapContentInfo being signed;
+
+=item *
+
+An ESS signing-certificate or ESS signing-certificate-v2 attribute, as defined in Enhanced Security Services (ESS), RFC 2634 and RFC 5035.
+An ESS signing-certificate attribute only allows for the use of SHA-1 as a digest algorithm.
+An ESS signing-certificate-v2 attribute allows for the use of any digest algorithm.
+
+=item *
+
+The digital signature value computed on the user data and, when present, on the signed attributes.
+
+Note that currently the B<-cades> option applies only to the B<-sign> operation and is ignored during
+the B<-verify> operation, i.e. the signing certification is not checked during the verification process.
+This feature might be added in a future version.
+
+=back
+
 =head1 EXIT CODES
 
 =over 4

doc/man1/ec.pod

@@ -101,10 +101,6 @@ Prints out the public, private key components and parameters.
 
 This option prevents output of the encoded version of the key.
 
-=item B<-modulus>
-
-This option prints out the value of the public key component of the key.
-
 =item B<-pubin>
 
 By default, a private key is read from the input file. With this option a

doc/man1/s_client.pod

@@ -12,6 +12,8 @@ B<openssl> B<s_client>
 [B<-connect host:port>]
 [B<-bind host:port>]
 [B<-proxy host:port>]
+[B<-proxy_user userid>]
+[B<-proxy_pass arg>]
 [B<-unix path>]
 [B<-4>]
 [B<-6>]
@@ -175,6 +177,21 @@ When used with the B<-connect> flag, the program uses the host and port
 specified with this flag and issues an HTTP CONNECT command to connect
 to the desired server.
 
+=item B<-proxy_user userid>
+
+When used with the B<-proxy> flag, the program will attempt to authenticate
+with the specified proxy using basic (base64) authentication.
+NB: Basic authentication is insecure; the credentials are sent to the proxy
+in easily reversible base64 encoding before any TLS/SSL session is established.
+Therefore these credentials are easily recovered by anyone able to sniff/trace
+the network. Use with caution.
+
+=item B<-proxy_pass arg>
+
+The proxy password source, used with the B<-proxy_user> flag.
+For more information about the format of B<arg> see the B<PASS PHRASE ARGUMENTS>
+section in L<openssl(1)>.
+
 =item B<-unix path>
 
 Connect over the specified Unix-domain socket.