Latest update.

doc/man1/openssl-dsa.pod.in

@@ -127,6 +127,9 @@ a public key.
 
 =head1 EXAMPLES
 
+Examples equivalent to these can be found in the documentation for the
+non-deprecated L<openssl-pkey(1)> command.
+
 To remove the pass phrase on a DSA private key:
 
  openssl dsa -in key.pem -out keyout.pem

doc/man1/openssl-ec.pod.in

@@ -37,6 +37,9 @@ B<openssl> B<ec>
 
 =head1 DESCRIPTION
 
+This command has been deprecated.
+The L<openssl-pkey(1)> command should be used instead.
+
 The L<openssl-ec(1)> command processes EC keys. They can be converted between
 various forms and their components printed out. B<Note> OpenSSL uses the
 private key format specified in 'SEC 1: Elliptic Curve Cryptography'
@@ -142,6 +145,9 @@ This option checks the consistency of an EC private or public key.
 
 =head1 EXAMPLES
 
+Examples equivalent to these can be found in the documentation for the
+non-deprecated L<openssl-pkey(1)> command.
+
 To encrypt a private key using triple DES:
 
  openssl ec -in key.pem -des3 -out keyout.pem
@@ -169,13 +175,18 @@ To change the point conversion form to B<compressed>:
 =head1 SEE ALSO
 
 L<openssl(1)>,
+L<openssl-pkey(1)>,
 L<openssl-ecparam(1)>,
 L<openssl-dsa(1)>,
 L<openssl-rsa(1)>
 
+=head1 HISTORY
+
+This command was deprecated in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
-Copyright 2003-2019 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2003-2020 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy

doc/man1/openssl-ecparam.pod.in

@@ -31,6 +31,10 @@ B<openssl ecparam>
 
 =head1 DESCRIPTION
 
+This command has been deprecated.
+The L<openssl-genpkey(1)> and L<openssl-pkeyparam(1)> commands
+should be used instead.
+
 This command is used to manipulate or generate EC parameter files.
 
 OpenSSL is currently not able to generate new groups and therefore
@@ -130,6 +134,9 @@ This option will generate an EC private key using the specified parameters.
 
 =head1 EXAMPLES
 
+Examples equivalent to these can be found in the documentation for the
+non-deprecated L<openssl-genpkey(1)> and L<openssl-pkeyparam(1)> commands.
+
 To create EC parameters with the group 'prime192v1':
 
   openssl ecparam -out ec_param.pem -name prime192v1
@@ -157,12 +164,18 @@ To print out the EC parameters to standard output:
 =head1 SEE ALSO
 
 L<openssl(1)>,
+L<openssl-pkeyparam(1)>,
+L<openssl-genpkey(1)>,
 L<openssl-ec(1)>,
 L<openssl-dsaparam(1)>
 
+=head1 HISTORY
+
+This command was deprecated in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
-Copyright 2003-2019 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2003-2020 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy

doc/man1/openssl-enc.pod.in

@@ -261,7 +261,7 @@ This command does not support authenticated encryption modes
 like CCM and GCM, and will not support such modes in the future.
 This is due to having to begin streaming output (e.g., to standard output
 when B<-out> is not used) before the authentication tag could be validated.
-When this command is used in a pipeline, the receiveing end will not be
+When this command is used in a pipeline, the receiving end will not be
 able to roll back upon authentication failure.  The AEAD modes currently in
 common use also suffer from catastrophic failure of confidentiality and/or
 integrity upon reuse of key/iv/nonce, and since B<openssl enc> places the

doc/man1/openssl-genrsa.pod.in

@@ -36,6 +36,9 @@ B<openssl> B<genrsa>
 
 =head1 DESCRIPTION
 
+This command has been deprecated.
+The L<openssl-genpkey(1)> command should be used instead.
+
 This command generates an RSA private key.
 
 =head1 OPTIONS
@@ -106,8 +109,13 @@ of a key.
 =head1 SEE ALSO
 
 L<openssl(1)>,
+L<openssl-genpkey(1)>,
 L<openssl-gendsa(1)>
 
+=head1 HISTORY
+
+This command was deprecated in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
 Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.

doc/man1/openssl-ocsp.pod.in

@@ -7,6 +7,8 @@ openssl-ocsp - Online Certificate Status Protocol utility
 
 =head1 SYNOPSIS
 
+=head2 OCSP Client
+
 B<openssl> B<ocsp>
 [B<-help>]
 [B<-out> I<file>]
@@ -16,19 +18,18 @@ B<openssl> B<ocsp>
 [B<-signer> I<file>]
 [B<-signkey> I<file>]
 [B<-sign_other> I<file>]
-[B<-no_certs>]
+[B<-nonce>]
+[B<-no_nonce>]
 [B<-req_text>]
 [B<-resp_text>]
 [B<-text>]
+[B<-no_certs>]
 [B<-reqout> I<file>]
 [B<-respout> I<file>]
 [B<-reqin> I<file>]
 [B<-respin> I<file>]
-[B<-nonce>]
-[B<-no_nonce>]
 [B<-url> I<URL>]
 [B<-host> I<host>:I<port>]
-[B<-multi> I<process-count>]
 [B<-header>]
 [B<-timeout> I<seconds>]
 [B<-path>]
@@ -46,6 +47,10 @@ B<openssl> B<ocsp>
 [B<-no_explicit>]
 [B<-port> I<num>]
 [B<-ignore_err>]
+
+=head2 OCSP Server
+
+B<openssl> B<ocsp>
 [B<-index> I<file>]
 [B<-CA> I<file>]
 [B<-rsigner> I<file>]
@@ -60,6 +65,7 @@ B<openssl> B<ocsp>
 [B<-ndays> I<n>]
 [B<-resp_key_id>]
 [B<-nrequest> I<n>]
+[B<-multi> I<process-count>]
 [B<-rcid> I<digest>]
 [B<-I<digest>>]
 {- $OpenSSL::safe::opt_trust_synopsis -}
@@ -171,17 +177,6 @@ the time that the responder is willing to wait for the client request.
 This time is measured from the time the responder accepts the connection until
 the complete request is received.
 
-=item B<-multi> I<process-count>
-
-Run the specified number of OCSP responder child processes, with the parent
-process respawning child processes as needed.
-Child processes will detect changes in the CA index file and automatically
-reload it.
-When running as a responder B<-timeout> option is recommended to limit the time
-each child is willing to wait for the client's OCSP response.
-This option is available on POSIX systems (that support the fork() and other
-required unix system-calls).
-
 =item B<-verify_other> I<file>
 
 File containing additional certificates to search when attempting to locate
@@ -303,19 +298,6 @@ file given with B<-index>.
 
 The certificate to sign OCSP responses with.
 
-=item B<-rother> I<file>
-
-Additional certificates to include in the OCSP response.
-
-=item B<-resp_no_certs>
-
-Don't include any certificates in the OCSP response.
-
-=item B<-resp_key_id>
-
-Identify the signer certificate using the key ID, default is to use the
-subject name.
-
 =item B<-rkey> I<file>
 
 The private key to sign OCSP responses with: if not present the file
@@ -326,6 +308,10 @@ specified in the B<-rsigner> option is used.
 The private key password source. For more information about the format of I<arg>
 see L<openssl(1)/Pass Phrase Options>.
 
+=item B<-rother> I<file>
+
+Additional certificates to include in the OCSP response.
+
 =item B<-rsigopt> I<nm>:I<v>
 
 Pass options to the signature algorithm when signing OCSP responses.
@@ -340,6 +326,15 @@ The digest to use when signing the response.
 Corrupt the response signature before writing it; this can be useful
 for testing.
 
+=item B<-resp_no_certs>
+
+Don't include any certificates in the OCSP response.
+
+=item B<-resp_key_id>
+
+Identify the signer certificate using the key ID, default is to use the
+subject name.
+
 =item B<-port> I<portnum>
 
 Port to listen for OCSP requests on. The port may also be specified
@@ -355,6 +350,18 @@ running instead of terminating upon receiving a malformed request.
 
 The OCSP server will exit after receiving I<number> requests, default unlimited.
 
+=item B<-multi> I<process-count>
+
+Run the specified number of OCSP responder child processes, with the parent
+process respawning child processes as needed.
+Child processes will detect changes in the CA index file and automatically
+reload it.
+When running as a responder B<-timeout> option is recommended to limit the time
+each child is willing to wait for the client's OCSP response.
+This option is available on POSIX systems (that support the fork() and other
+required unix system-calls).
+
+
 =item B<-nmin> I<minutes>, B<-ndays> I<days>
 
 Number of minutes or days when fresh revocation information is available:

doc/man1/openssl-pkey.pod.in

@@ -28,6 +28,8 @@ B<openssl> B<pkey>
 [B<-pubout>]
 [B<-check>]
 [B<-pubcheck>]
+[B<-ec_conv_form> I<arg>]
+[B<-ec_param_enc> I<arg>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
 
 =for openssl ifdef engine
@@ -114,13 +116,37 @@ components.
 This option checks the correctness of either a public key or the public component
 of a key pair.
 
+=item B<-ec_conv_form> I<arg>
+
+This option only applies to elliptic curve based public and private keys.
+
+This specifies how the points on the elliptic curve are converted
+into octet strings. Possible values are: B<compressed> (the default
+value), B<uncompressed> and B<hybrid>. For more information regarding
+the point conversion forms please read the X9.62 standard.
+B<Note> Due to patent issues the B<compressed> option is disabled
+by default for binary curves and can be enabled by defining
+the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
+
+=item B<-ec_param_enc> I<arg>
+
+This option only applies to elliptic curve based public and private keys.
+
+This specifies how the elliptic curve parameters are encoded.
+Possible value are: B<named_curve>, i.e. the ec parameters are
+specified by an OID, or B<explicit> where the ec parameters are
+explicitly given (see RFC 3279 for the definition of the
+EC parameters structures). The default value is B<named_curve>.
+B<Note> the B<implicitlyCA> alternative, as specified in RFC 3279,
+is currently not implemented in OpenSSL.
+
 {- $OpenSSL::safe::opt_engine_item -}
 
 =back
 
 =head1 EXAMPLES
 
-To remove the pass phrase on an RSA private key:
+To remove the pass phrase on a private key:
 
  openssl pkey -in key.pem -out keyout.pem
 
@@ -144,6 +170,14 @@ To just output the public part of a private key:
 
  openssl pkey -in key.pem -pubout -out pubkey.pem
 
+To change the EC parameters encoding to B<explicit>:
+
+ openssl pkey -in key.pem -ec_param_enc explicit -out keyout.pem
+
+To change the EC point conversion form to B<compressed>:
+
+ openssl pkey -in key.pem -ec_conv_form compressed -out keyout.pem
+
 =head1 SEE ALSO
 
 L<openssl(1)>,

doc/man1/openssl-rand.pod.in

@@ -20,8 +20,14 @@ I<num>
 
 =head1 DESCRIPTION
 
-This command outputs I<num> pseudo-random bytes after seeding
-the random number generator once.
+This command generates I<num> random bytes using a cryptographically
+secure pseudo random number generator (CSPRNG).
+
+The random bytes are generated using the L<RAND_bytes(3)> function,
+which provides a security level of 256 bits, provided it managed to
+seed itself successfully from a trusted operating system entropy source.
+Otherwise, the command will fail with a non-zero error code.
+For more details, see L<RAND_bytes(3)>, L<RAND(7)>, and L<RAND_DRBG(7)>.
 
 =head1 OPTIONS
 
@@ -52,7 +58,9 @@ Show the output as a hex string.
 =head1 SEE ALSO
 
 L<openssl(1)>,
-L<RAND_bytes(3)>
+L<RAND_bytes(3)>,
+L<RAND(7)>,
+L<RAND_DRBG(7)>
 
 =head1 COPYRIGHT
 

doc/man1/openssl-rsa.pod.in

@@ -45,6 +45,9 @@ B<openssl> B<rsa>
 
 =head1 DESCRIPTION
 
+This command has been deprecated.
+The L<openssl-pkey(1)> command should be used instead.
+
 This command processes RSA keys. They can be converted between
 various forms and their components printed out. B<Note> this command uses the
 traditional SSLeay compatible format for private key encryption: newer
@@ -137,6 +140,9 @@ Like B<-pubin> and B<-pubout> except B<RSAPublicKey> format is used instead.
 
 =head1 EXAMPLES
 
+Examples equivalent to these can be found in the documentation for the
+non-deprecated L<openssl-pkey(1)> command.
+
 To remove the pass phrase on an RSA private key:
 
  openssl rsa -in key.pem -out keyout.pem
@@ -169,11 +175,16 @@ without having to manually edit them.
 =head1 SEE ALSO
 
 L<openssl(1)>,
+L<openssl-pkey(1)>,
 L<openssl-pkcs8(1)>,
 L<openssl-dsa(1)>,
 L<openssl-genrsa(1)>,
 L<openssl-gendsa(1)>
 
+=head1 HISTORY
+
+This command was deprecated in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
 Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.

doc/man1/openssl-rsautl.pod.in

@@ -38,6 +38,9 @@ B<openssl> B<rsautl>
 
 =head1 DESCRIPTION
 
+This command has been deprecated.
+The L<openssl-pkeyutl(1)> command should be used instead.
+
 This command can be used to sign, verify, encrypt and decrypt
 data using the RSA algorithm.
 
@@ -132,6 +135,9 @@ used to sign or verify small pieces of data.
 
 =head1 EXAMPLES
 
+Examples equivalent to these can be found in the documentation for the
+non-deprecated L<openssl-pkeyutl(1)> command.
+
 Sign some data using a private key:
 
  openssl rsautl -sign -in file -inkey key.pem -out sig
@@ -219,10 +225,15 @@ which it can be seen agrees with the recovered value above.
 =head1 SEE ALSO
 
 L<openssl(1)>,
+L<openssl-pkeyutl(1)>,
 L<openssl-dgst(1)>,
 L<openssl-rsa(1)>,
 L<openssl-genrsa(1)>
 
+=head1 HISTORY
+
+This command was deprecated in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
 Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.

doc/man1/openssl-x509.pod.in

@@ -383,12 +383,12 @@ certificate is being created from another certificate (for example with
 the B<-signkey> or the B<-CA> options). Normally all extensions are
 retained.
 
-=item B<-keyform> B<DER>|B<PEM>
+=item B<-keyform> B<DER>|B<PEM>|B<ENGINE>
 
 The key format; the default is B<PEM>.
 See L<openssl(1)/Format Options> for details.
 
-=item B<-CAform> B<DER>|B<PEM>, B<-CAkeyform> B<DER>|B<PEM>
+=item B<-CAform> B<DER>|B<PEM>, B<-CAkeyform> B<DER>|B<PEM>|B<ENGINE>
 
 The format for the CA certificate and key; the default is B<PEM>.
 See L<openssl(1)/Format Options> for details.

doc/man1/openssl.pod

@@ -795,7 +795,7 @@ B<-xcert>, and B<-xchain> options.
 
 =item B<-xcertform> B<DER>|B<PEM>, B<-xkeyform> B<DER>|B<PEM>
 
-The input format for the extra certifcate and key, respectively.
+The input format for the extra certificate and key, respectively.
 See L<openssl(1)/Format Options> for details.
 
 =back
@@ -1047,7 +1047,7 @@ OpenSSL provides fine-grain control over how the subject and issuer DN's are
 displayed.
 This is specified by using the B<-nameopt> option, which takes a
 comma-separated list of options from the following set.
-An option may be preceeded by a minus sign, C<->, to turn it off.
+An option may be preceded by a minus sign, C<->, to turn it off.
 The default value is C<oneline>.
 The first four are the most commonly used.