Latest update.

2020-03-08 13:10:50 +09:00
parent b412d79e8b
commit be29e7bcc6
274 changed files with 2778 additions and 763 deletions
@@ -174,11 +174,18 @@ Sign the request:

 CA.pl -signreq

+=head1 ENVIRONMENT
+
+The environment variable B<OPENSSL_CONFIG> may be used to specify a
+configuration option and value to the B<req> and B<ca> commands invoked by
+this script. It's value should be the option and pathname, as in
+C<-config /path/to/conf-file>.
+
 =head1 NOTES

 Most of the filenames mentioned can be modified by editing the B<CA.pl> script.

-If the demoCA directory already exists then the B<-newca> command will not
+If the F<demoCA> directory already exists then the B<-newca> command will not
 overwrite it and will do nothing. This can happen if a previous call using
 the B<-newca> option terminated abnormally. To get the correct behaviour
 delete the demoCA directory if it already exists.
@@ -1,113 +1,163 @@

-# Keep this in sync with .gitignore!
 DEPEND[]= \
+         openssl-asn1parse.pod \
         openssl-ca.pod \
+         openssl-ciphers.pod \
+         openssl-cmds.pod \
         openssl-cms.pod \
+         openssl-crl2pkcs7.pod \
         openssl-crl.pod \
         openssl-dgst.pod \
         openssl-dhparam.pod \
-         openssl-dsa.pod \
         openssl-dsaparam.pod \
-         openssl-ec.pod \
+         openssl-dsa.pod \
         openssl-ecparam.pod \
+         openssl-ec.pod \
         openssl-enc.pod \
+         openssl-engine.pod \
+         openssl-errstr.pod \
+         openssl-fipsinstall.pod \
         openssl-gendsa.pod \
         openssl-genpkey.pod \
         openssl-genrsa.pod \
+         openssl-info.pod \
+         openssl-kdf.pod \
+         openssl-list.pod \
+         openssl-mac.pod \
+         openssl-nseq.pod \
         openssl-ocsp.pod \
         openssl-passwd.pod \
         openssl-pkcs12.pod \
         openssl-pkcs7.pod \
         openssl-pkcs8.pod \
-         openssl-pkey.pod \
         openssl-pkeyparam.pod \
+         openssl-pkey.pod \
         openssl-pkeyutl.pod \
+         openssl-prime.pod \
+         openssl-provider.pod \
         openssl-rand.pod \
+         openssl-rehash.pod \
         openssl-req.pod \
         openssl-rsa.pod \
         openssl-rsautl.pod \
         openssl-s_client.pod \
-         openssl-s_server.pod \
-         openssl-s_time.pod \
+         openssl-sess_id.pod \
         openssl-smime.pod \
         openssl-speed.pod \
         openssl-spkac.pod \
         openssl-srp.pod \
+         openssl-s_server.pod \
+         openssl-s_time.pod \
         openssl-storeutl.pod \
         openssl-ts.pod \
         openssl-verify.pod \
+         openssl-version.pod \
         openssl-x509.pod

+DEPEND[openssl-asn1parse.pod]=../perlvars.pm
 DEPEND[openssl-ca.pod]=../perlvars.pm
+DEPEND[openssl-ciphers.pod]=../perlvars.pm
+DEPEND[openssl-cmds.pod]=../perlvars.pm
 DEPEND[openssl-cms.pod]=../perlvars.pm
+DEPEND[openssl-crl2pkcs7.pod]=../perlvars.pm
 DEPEND[openssl-crl.pod]=../perlvars.pm
 DEPEND[openssl-dgst.pod]=../perlvars.pm
 DEPEND[openssl-dhparam.pod]=../perlvars.pm
-DEPEND[openssl-dsa.pod]=../perlvars.pm
 DEPEND[openssl-dsaparam.pod]=../perlvars.pm
-DEPEND[openssl-ec.pod]=../perlvars.pm
+DEPEND[openssl-dsa.pod]=../perlvars.pm
 DEPEND[openssl-ecparam.pod]=../perlvars.pm
+DEPEND[openssl-ec.pod]=../perlvars.pm
 DEPEND[openssl-enc.pod]=../perlvars.pm
+DEPEND[openssl-engine.pod]=../perlvars.pm
+DEPEND[openssl-errstr.pod]=../perlvars.pm
+DEPEND[openssl-fipsinstall.pod]=../perlvars.pm
 DEPEND[openssl-gendsa.pod]=../perlvars.pm
 DEPEND[openssl-genpkey.pod]=../perlvars.pm
 DEPEND[openssl-genrsa.pod]=../perlvars.pm
+DEPEND[openssl-info.pod]=../perlvars.pm
+DEPEND[openssl-kdf.pod]=../perlvars.pm
+DEPEND[openssl-list.pod]=../perlvars.pm
+DEPEND[openssl-mac.pod]=../perlvars.pm
+DEPEND[openssl-nseq.pod]=../perlvars.pm
 DEPEND[openssl-ocsp.pod]=../perlvars.pm
 DEPEND[openssl-passwd.pod]=../perlvars.pm
 DEPEND[openssl-pkcs12.pod]=../perlvars.pm
 DEPEND[openssl-pkcs7.pod]=../perlvars.pm
 DEPEND[openssl-pkcs8.pod]=../perlvars.pm
-DEPEND[openssl-pkey.pod]=../perlvars.pm
 DEPEND[openssl-pkeyparam.pod]=../perlvars.pm
+DEPEND[openssl-pkey.pod]=../perlvars.pm
 DEPEND[openssl-pkeyutl.pod]=../perlvars.pm
+DEPEND[openssl-prime.pod]=../perlvars.pm
+DEPEND[openssl-provider.pod]=../perlvars.pm
 DEPEND[openssl-rand.pod]=../perlvars.pm
+DEPEND[openssl-rehash.pod]=../perlvars.pm
 DEPEND[openssl-req.pod]=../perlvars.pm
 DEPEND[openssl-rsa.pod]=../perlvars.pm
 DEPEND[openssl-rsautl.pod]=../perlvars.pm
 DEPEND[openssl-s_client.pod]=../perlvars.pm
-DEPEND[openssl-s_server.pod]=../perlvars.pm
-DEPEND[openssl-s_time.pod]=../perlvars.pm
+DEPEND[openssl-sess_id.pod]=../perlvars.pm
 DEPEND[openssl-smime.pod]=../perlvars.pm
 DEPEND[openssl-speed.pod]=../perlvars.pm
 DEPEND[openssl-spkac.pod]=../perlvars.pm
 DEPEND[openssl-srp.pod]=../perlvars.pm
+DEPEND[openssl-s_server.pod]=../perlvars.pm
+DEPEND[openssl-s_time.pod]=../perlvars.pm
 DEPEND[openssl-storeutl.pod]=../perlvars.pm
 DEPEND[openssl-ts.pod]=../perlvars.pm
 DEPEND[openssl-verify.pod]=../perlvars.pm
+DEPEND[openssl-version.pod]=../perlvars.pm
 DEPEND[openssl-x509.pod]=../perlvars.pm

+GENERATE[openssl-asn1parse.pod]=openssl-asn1parse.pod.in
 GENERATE[openssl-ca.pod]=openssl-ca.pod.in
+GENERATE[openssl-ciphers.pod]=openssl-ciphers.pod.in
+GENERATE[openssl-cmds.pod]=openssl-cmds.pod.in
 GENERATE[openssl-cms.pod]=openssl-cms.pod.in
+GENERATE[openssl-crl2pkcs7.pod]=openssl-crl2pkcs7.pod.in
 GENERATE[openssl-crl.pod]=openssl-crl.pod.in
 GENERATE[openssl-dgst.pod]=openssl-dgst.pod.in
 GENERATE[openssl-dhparam.pod]=openssl-dhparam.pod.in
-GENERATE[openssl-dsa.pod]=openssl-dsa.pod.in
 GENERATE[openssl-dsaparam.pod]=openssl-dsaparam.pod.in
-GENERATE[openssl-ec.pod]=openssl-ec.pod.in
+GENERATE[openssl-dsa.pod]=openssl-dsa.pod.in
 GENERATE[openssl-ecparam.pod]=openssl-ecparam.pod.in
+GENERATE[openssl-ec.pod]=openssl-ec.pod.in
 GENERATE[openssl-enc.pod]=openssl-enc.pod.in
+GENERATE[openssl-engine.pod]=openssl-engine.pod.in
+GENERATE[openssl-errstr.pod]=openssl-errstr.pod.in
+GENERATE[openssl-fipsinstall.pod]=openssl-fipsinstall.pod.in
 GENERATE[openssl-gendsa.pod]=openssl-gendsa.pod.in
 GENERATE[openssl-genpkey.pod]=openssl-genpkey.pod.in
 GENERATE[openssl-genrsa.pod]=openssl-genrsa.pod.in
+GENERATE[openssl-info.pod]=openssl-info.pod.in
+GENERATE[openssl-kdf.pod]=openssl-kdf.pod.in
+GENERATE[openssl-list.pod]=openssl-list.pod.in
+GENERATE[openssl-mac.pod]=openssl-mac.pod.in
+GENERATE[openssl-nseq.pod]=openssl-nseq.pod.in
 GENERATE[openssl-ocsp.pod]=openssl-ocsp.pod.in
 GENERATE[openssl-passwd.pod]=openssl-passwd.pod.in
 GENERATE[openssl-pkcs12.pod]=openssl-pkcs12.pod.in
 GENERATE[openssl-pkcs7.pod]=openssl-pkcs7.pod.in
 GENERATE[openssl-pkcs8.pod]=openssl-pkcs8.pod.in
-GENERATE[openssl-pkey.pod]=openssl-pkey.pod.in
 GENERATE[openssl-pkeyparam.pod]=openssl-pkeyparam.pod.in
+GENERATE[openssl-pkey.pod]=openssl-pkey.pod.in
 GENERATE[openssl-pkeyutl.pod]=openssl-pkeyutl.pod.in
+GENERATE[openssl-prime.pod]=openssl-prime.pod.in
+GENERATE[openssl-provider.pod]=openssl-provider.pod.in
 GENERATE[openssl-rand.pod]=openssl-rand.pod.in
+GENERATE[openssl-rehash.pod]=openssl-rehash.pod.in
 GENERATE[openssl-req.pod]=openssl-req.pod.in
 GENERATE[openssl-rsa.pod]=openssl-rsa.pod.in
 GENERATE[openssl-rsautl.pod]=openssl-rsautl.pod.in
 GENERATE[openssl-s_client.pod]=openssl-s_client.pod.in
-GENERATE[openssl-s_server.pod]=openssl-s_server.pod.in
-GENERATE[openssl-s_time.pod]=openssl-s_time.pod.in
+GENERATE[openssl-sess_id.pod]=openssl-sess_id.pod.in
 GENERATE[openssl-smime.pod]=openssl-smime.pod.in
 GENERATE[openssl-speed.pod]=openssl-speed.pod.in
 GENERATE[openssl-spkac.pod]=openssl-spkac.pod.in
 GENERATE[openssl-srp.pod]=openssl-srp.pod.in
+GENERATE[openssl-s_server.pod]=openssl-s_server.pod.in
+GENERATE[openssl-s_time.pod]=openssl-s_time.pod.in
 GENERATE[openssl-storeutl.pod]=openssl-storeutl.pod.in
 GENERATE[openssl-ts.pod]=openssl-ts.pod.in
 GENERATE[openssl-verify.pod]=openssl-verify.pod.in
+GENERATE[openssl-version.pod]=openssl-version.pod.in
 GENERATE[openssl-x509.pod]=openssl-x509.pod.in
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -12,6 +12,7 @@ B<openssl> B<ca>
 [B<-verbose>]
 [B<-config> I<filename>]
 [B<-name> I<section>]
+[B<-section> I<section>]
 [B<-gencrl>]
 [B<-revoke> I<file>]
 [B<-valid> I<file>]
@@ -59,6 +60,7 @@ B<openssl> B<ca>
 [B<-sm2-hex-id> I<hex-string>]
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<certreq>...]

 =for openssl ifdef engine sm2-id sm2-hex-id
@@ -93,7 +95,7 @@ Specifies the configuration file to use.
 Optional; for a description of the default value,
 see L<openssl(1)/COMMAND SUMMARY>.

-=item B<-name> I<section>
+=item B<-name> I<section>, B<-section> I<section>

 Specifies the configuration file section to use (overrides
 B<default_ca> in the B<ca> section).
@@ -308,6 +310,8 @@ certificate. The argument for this option is string of hexadecimal digits.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 CRL OPTIONS
@@ -769,6 +773,8 @@ seeding mechanism. The new seeding mechanism makes it unnecessary to
 define a RANDFILE for saving and restoring randomness. This option is
 retained mainly for compatibility reasons.

+The B<-section> option was added in OpenSSL 3.0.0.
+
 =head1 SEE ALSO

 L<openssl(1)>,
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -22,6 +23,7 @@ B<openssl> B<ciphers>
 [B<-stdname>]
 [B<-convert> I<name>]
 [B<-ciphersuites> I<val>]
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<cipherlist>]

 =for openssl ifdef ssl3 tls1 tls1_1 tls1_2 tls1_3 psk srp
@@ -40,6 +42,8 @@ determine the appropriate cipherlist.

 Print a usage message.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item B<-s>

 Only list supported ciphers: those consistent with the security level, and
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -46,6 +46,7 @@ B<openssl> B<cms>
 [B<-print>]
 [B<-md> I<digest>]
 [B<-I<cipher>>]
+[B<-wrap> I<cipher>]
 [B<-nointern>]
 [B<-noverify>]
 [B<-nocerts>]
@@ -58,6 +59,7 @@ B<openssl> B<cms>
 [B<-certfile> I<file>]
 [B<-certsout> I<file>]
 [B<-signer> I<file>]
+[B<-originator> I<file>]
 [B<-recip> I<file>]
 [B<-keyid>]
 [B<-receipt_request_all>]
@@ -79,6 +81,7 @@ B<openssl> B<cms>
 {- $OpenSSL::safe::opt_trust_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<cert.pem> ...]

 =for openssl ifdef des-wrap engine
@@ -300,6 +303,12 @@ supported by your version of OpenSSL.
 If not specified triple DES is used. Only used with B<-encrypt> and
 B<-EncryptedData_create> commands.

+=item B<-wrap> I<cipher>
+
+Cipher algorithm to use for key wrap when encrypting the message using Key
+Agreement for key transport. The algorithm specified should be suitable for key
+wrap.
+
 =item B<-nointern>

 When verifying a message normally certificates (if any) included in
@@ -374,6 +383,11 @@ used multiple times if more than one signer is required. If a message is being
 verified then the signers certificates will be written to this file if the
 verification was successful.

+=item B<-originator> I<file>
+
+A certificate of the originator of the encrypted message. Necessary for
+decryption when Key Agreement is in use for a shared key.
+
 =item B<-recip> I<file>

 When decrypting a message this specifies the recipients certificate. The
@@ -477,6 +491,8 @@ Any verification errors cause the command to exit.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item I<cert.pem> ...

 One or more certificates of message recipients: used when encrypting
@@ -29,6 +29,7 @@ B<openssl> B<crl>
 [B<-nextupdate>]
 {- $OpenSSL::safe::opt_name_synopsis -}
 {- $OpenSSL::safe::opt_trust_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef hash_old

@@ -123,6 +124,8 @@ Output the nextUpdate field.

 {- $OpenSSL::safe::opt_trust_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -14,6 +15,7 @@ B<openssl> B<crl2pkcs7>
 [B<-out> I<filename>]
 [B<-certfile> I<filename>]
 [B<-nocrl>]
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =head1 DESCRIPTION

@@ -61,6 +63,8 @@ files.
 Normally a CRL is included in the output file. With this option no CRL is
 included in the output file and a CRL is not read from the input file.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -32,6 +32,7 @@ B<openssl> B<dgst>|I<digest>
 {- $OpenSSL::safe::opt_engine_synopsis -}
 [B<-engine_impl> I<id>]
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<file> ...]

 =head1 DESCRIPTION
@@ -184,6 +185,8 @@ used or it is configured to do so, see L<config(5)/Engine Configuration Module>.
 When used with the B<-engine> option, it specifies to also use
 engine I<id> for digest operations.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item I<file> ...

 File or files to digest. If no files are specified then standard input is
@@ -23,6 +23,7 @@ B<openssl dhparam>
 [B<-5>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<numbits>]

 =for openssl ifdef dsaparam engine
@@ -109,6 +110,8 @@ be loaded by calling the get_dhNNNN() function.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 NOTES
@@ -37,6 +37,7 @@ B<openssl> B<dsa>
 [B<-pubin>]
 [B<-pubout>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef pvk-string pvk-weak pvk-none engine

@@ -123,6 +124,8 @@ a public key.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -20,6 +20,7 @@ B<openssl dsaparam>
 [B<-verbose>]
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<numbits>]

 =head1 DESCRIPTION
@@ -93,6 +94,8 @@ This option specifies that a parameter set should be generated of size
 I<numbits>. It must be the last option. If this option is included then
 the input file (if any) is ignored.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 SEE ALSO
@@ -32,6 +32,7 @@ B<openssl> B<ec>
 [B<-no_public>]
 [B<-check>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -141,6 +142,8 @@ This option checks the consistency of an EC private or public key.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -26,6 +26,7 @@ B<openssl ecparam>
 [B<-genkey>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -130,6 +131,8 @@ This option will generate an EC private key using the specified parameters.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -40,6 +40,7 @@ B<openssl> B<enc>|I<cipher>
 [B<-none>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef z engine ciphers

@@ -197,6 +198,8 @@ Use NULL cipher (no encryption or decryption of input).

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 {- $OpenSSL::safe::opt_engine_item -}

 =back
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -128,21 +129,21 @@ values that can be used.
 =head1 EXAMPLES

 Calculate the mac of a FIPS module F<fips.so> and run a FIPS self test
-for the module, and save the F<fips.conf> configuration file:
+for the module, and save the F<fips.cnf> configuration file:

- openssl fipsinstall -module ./fips.so -out fips.conf -provider_name fips \
+ openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \
         -section_name fipsinstall -mac_name HMAC -macopt digest:SHA256 \
         -macopt hexkey:000102030405060708090A0B0C0D0E0F10111213

-Verify that the configuration file F<fips.conf> contains the correct info:
+Verify that the configuration file F<fips.cnf> contains the correct info:

- openssl fipsinstall -module ./fips.so -in fips.conf  -provider_name fips \
+ openssl fipsinstall -module ./fips.so -in fips.cnf  -provider_name fips \
          -section_name fips_install -mac_name HMAC -macopt digest:SHA256 \
          -macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 -verify

 Corrupt any self tests which have the description 'SHA1':

- openssl fipsinstall -module ./fips.so -out fips.conf -provider_name fips \
+ openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \
         -section_name fipsinstall -mac_name HMAC -macopt digest:SHA256 \
         -macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 \
         -corrupt_desc', 'SHA1'
@@ -26,6 +26,7 @@ B<openssl> B<gendsa>
 [B<-verbose>]
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<paramfile>]

 =for openssl ifdef engine
@@ -76,6 +77,8 @@ The DSA parameter file to use. The parameters in this file determine
 the size of the private key. DSA parameters can be generated and
 examined using the L<openssl-dsaparam(1)> command.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 NOTES
@@ -23,6 +23,7 @@ B<openssl> B<genpkey>
 [B<-genparam>]
 [B<-text>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -104,6 +105,8 @@ parameters along with the PEM or DER structure.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 KEY GENERATION OPTIONS
@@ -30,6 +30,7 @@ B<openssl> B<genrsa>
 [B<-verbose>]
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [B<numbits>]

 =for openssl ifdef engine
@@ -85,6 +86,8 @@ Print extra details about the operations being performed.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item B<numbits>

 The size of the private key to generate in bits. This must be the last option
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -12,6 +13,7 @@ B<openssl kdf>
 [B<-keylen> I<num>]
 [B<-out> I<filename>]
 [B<-binary>]
+{- $OpenSSL::safe::opt_provider_synopsis -}
 I<kdf_name>

 =head1 DESCRIPTION
@@ -79,6 +81,8 @@ To see the list of supported digests, use the command I<list -digest-commands>.

 =back

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item I<kdf_name>

 Specifies the name of a supported KDF algorithm which will be used.
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -23,6 +24,7 @@ B<openssl list>
 [B<-disabled>]
 [B<-objects>]
 [B<-options> I<command>]
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =head1 DESCRIPTION

@@ -102,6 +104,8 @@ of what type of parameter it takes, if any.
 This is an internal option, used for checking that the documentation
 is complete.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head2 Display of algorithm names
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -12,6 +13,7 @@ B<openssl mac>
 [B<-in> I<filename>]
 [B<-out> I<filename>]
 [B<-binary>]
+{- $OpenSSL::safe::opt_provider_synopsis -}
 I<mac_name>

 =head1 DESCRIPTION
@@ -99,6 +101,8 @@ The default is the empty string "".

 =back

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item I<mac_name>

 Specifies the name of a supported MAC algorithm which will be used.
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -11,6 +12,7 @@ B<openssl> B<nseq>
 [B<-in> I<filename>]
 [B<-out> I<filename>]
 [B<-toseq>]
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =head1 DESCRIPTION

@@ -48,6 +50,8 @@ is the certificates contained in it. With the B<-toseq> option the
 situation is reversed: a Netscape certificate sequence is created from
 a file of certificates.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -70,6 +70,7 @@ B<openssl> B<ocsp>
 [B<-I<digest>>]
 {- $OpenSSL::safe::opt_trust_synopsis -}
 {- $OpenSSL::safe::opt_v_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef multi

@@ -269,6 +270,8 @@ digest used by subsequent certificate identifiers.

 {- $OpenSSL::safe::opt_v_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head2 OCSP Server Options
@@ -23,6 +23,7 @@ B<openssl passwd>
 [B<-table>]
 [B<-reverse>]
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<password>]

 =for openssl ifdef crypt
@@ -100,6 +101,8 @@ When the B<-table> option is used, reverse the order of cleartext and hash.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -57,6 +57,7 @@ B<openssl> B<pkcs12>
 {- $OpenSSL::safe::opt_trust_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -293,6 +294,8 @@ Write I<name> as a Microsoft CSP name.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 NOTES
@@ -22,6 +22,7 @@ B<openssl> B<pkcs7>
 [B<-text>]
 [B<-noout>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -77,6 +78,8 @@ if B<-print_certs> is set).

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -29,6 +29,7 @@ B<openssl> B<pkcs8>
 [B<-scrypt_p> I<p>]
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine scrypt scrypt_N scrypt_r scrypt_p

@@ -150,6 +151,8 @@ Sets the scrypt I<N>, I<r> or I<p> parameters.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 NOTES
@@ -31,6 +31,7 @@ B<openssl> B<pkey>
 [B<-ec_conv_form> I<arg>]
 [B<-ec_param_enc> I<arg>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -142,6 +143,8 @@ is currently not implemented in OpenSSL.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -19,6 +19,7 @@ B<openssl> B<pkeyparam>
 [B<-noout>]
 [B<-check>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -59,6 +60,8 @@ This option checks the correctness of parameters.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -37,6 +37,7 @@ B<openssl> B<pkeyutl>
 {- $OpenSSL::safe::opt_engine_synopsis -}
 [B<-engine_impl>]
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine engine_impl

@@ -188,6 +189,8 @@ engine I<id> for crypto operations.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 NOTES
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -12,6 +13,7 @@ B<openssl prime>
 [B<-generate>]
 [B<-bits> I<num>]
 [B<-safe>]
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [B<-checks> I<num>]
 [I<number> ...]

@@ -48,6 +50,8 @@ Generate a prime with I<num> bits.
 When used with B<-generate>, generates a "safe" prime. If the number
 generated is I<n>, then check that C<(I<n>-1)/2> is also prime.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item B<-checks> I<num>

 This parameter is ignored.
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -14,6 +14,7 @@ B<openssl rand>
 [B<-hex>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 I<num>

 =for openssl ifdef engine
@@ -26,7 +27,7 @@ secure pseudo random number generator (CSPRNG).
 The random bytes are generated using the L<RAND_bytes(3)> function,
 which provides a security level of 256 bits, provided it managed to
 seed itself successfully from a trusted operating system entropy source.
-Otherwise, the command will fail with a non-zero error code.
+Otherwise, the command will fail with a nonzero error code.
 For more details, see L<RAND_bytes(3)>, L<RAND(7)>, and L<RAND_DRBG(7)>.

 =head1 OPTIONS
@@ -53,6 +54,8 @@ Show the output as a hex string.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 SEE ALSO
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =for comment
 Original text by James Westby, contributed under the OpenSSL license.
@@ -18,6 +19,7 @@ B<rehash>
 [B<-compat>]
 [B<-n>]
 [B<-v>]
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<directory>] ...

 B<c_rehash>
@@ -26,6 +28,7 @@ B<c_rehash>
 [B<-old>]
 [B<-n>]
 [B<-v>]
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<directory>] ...

 =head1 DESCRIPTION
@@ -116,6 +119,8 @@ releases.
 Print messages about old links removed and new links created.
 By default, this command only lists each directory as it is processed.

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 ENVIRONMENT
@@ -30,6 +30,7 @@ B<openssl> B<req>
 [B<-keygen_engine> I<id>]
 [B<-I<digest>>]
 [B<-config> I<filename>]
+[B<-section> I<name>]
 [B<-multivalue-rdn>]
 [B<-x509>]
 [B<-days> I<n>]
@@ -51,6 +52,7 @@ B<openssl> B<req>
 {- $OpenSSL::safe::opt_name_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine keygen_engine sm2-id sm2-hex-id

@@ -205,6 +207,10 @@ This allows an alternative configuration file to be specified.
 Optional; for a description of the default value,
 see L<openssl(1)/COMMAND SUMMARY>.

+=item B<-section> I<name>
+
+Specifies the name of the section to use; the default is B<req>.
+
 =item B<-subj> I<arg>

 Sets subject name for new request or supersedes the subject name
@@ -323,13 +329,17 @@ argument for this option is string of hexadecimal digits.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 CONFIGURATION FILE FORMAT

 The configuration options are specified in the B<req> section of
-the configuration file. As with all configuration files if no
-value is specified in the specific section (i.e. B<req>) then
+the configuration file. An alternate name be specified by using the
+B<-section> option.
+As with all configuration files, if no
+value is specified in the specific section then
 the initial unnamed or B<default> section is searched too.

 The options available are described in detail below.
@@ -675,6 +685,10 @@ L<openssl-gendsa(1)>,
 L<config(5)>,
 L<x509v3_config(5)>

+=head1 HISTORY
+
+The B<-section> option was added in OpenSSL 3.0.0.
+
 =head1 COPYRIGHT

 Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
@@ -40,6 +40,7 @@ B<openssl> B<rsa>
 [B<-RSAPublicKey_in>]
 [B<-RSAPublicKey_out>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef pvk-strong pvk-weak pvk-none engine

@@ -136,6 +137,8 @@ Like B<-pubin> and B<-pubout> except B<RSAPublicKey> format is used instead.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -33,6 +33,7 @@ B<openssl> B<rsautl>
 [B<-asn1parse>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -126,6 +127,8 @@ B<-verify> option.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 NOTES
@@ -120,6 +120,7 @@ B<openssl> B<s_client>
 {- $OpenSSL::safe::opt_trust_synopsis -}
 {- $OpenSSL::safe::opt_s_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
 [B<-ssl_client_engine> I<id>]
 {- $OpenSSL::safe::opt_v_synopsis -}
@@ -758,6 +759,8 @@ Set the minimal acceptable length, in bits, for B<N>.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 {- $OpenSSL::safe::opt_engine_item -}

 =item B<-ssl_client_engine> I<id>
@@ -140,6 +140,7 @@ B<openssl> B<s_server>
 {- $OpenSSL::safe::opt_trust_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef unix 4 6 unlink no_dhe nextprotoneg use_srtp engine

@@ -661,6 +662,8 @@ data that was sent will be rejected.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 {- $OpenSSL::safe::opt_v_item -}

 If the server requests a client certificate, then
@@ -28,6 +28,7 @@ B<openssl> B<s_time>
 {- $OpenSSL::safe::opt_name_synopsis -}
 [B<-cafile> I<file>]
 {- $OpenSSL::safe::opt_trust_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef ssl3 tls1 tls1_1 tls1_2 tls1_3

@@ -122,6 +123,8 @@ can establish.

 {- $OpenSSL::safe::opt_trust_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item B<-cafile> I<file>

 This is an obsolete synonym for B<-CAfile>.
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -49,6 +49,7 @@ B<openssl> B<smime>
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_v_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 I<cert.pem> ...

 =for openssl ifdef engine
@@ -288,6 +289,8 @@ Any verification errors cause the command to exit.

 {- $OpenSSL::safe::opt_r_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item I<cert.pem> ...

 One or more certificates of message recipients, used when encrypting
@@ -25,6 +25,7 @@ B<openssl speed>
 [B<-mr>]
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<algorithm> ...]

 =for openssl ifdef hmac cmac multi async_jobs engine
@@ -103,6 +104,8 @@ Produce the summary in a mechanical, machine-readable, format.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item I<algorithm> ...

 If any I<algorithm> is given, then those algorithms are tested, otherwise a
@@ -25,6 +25,7 @@ B<openssl> B<spkac>
 [B<-noout>]
 [B<-verify>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -99,6 +100,8 @@ Verifies the digital signature on the supplied SPKAC.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 EXAMPLES
@@ -23,6 +23,7 @@ B<openssl srp>
 [B<-passout> I<arg>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [I<user> ...]

 =for openssl ifdef engine
@@ -74,6 +75,8 @@ see L<openssl(1)/Pass Phrase Options>.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 {- $OpenSSL::safe::opt_r_synopsis -}

 =back
@@ -28,6 +28,7 @@ B<openssl> B<storeutl>
 [B<-fingerprint> I<arg>]
 [B<-I<digest>>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 I<uri> ...

 =head1 DESCRIPTION
@@ -110,6 +111,8 @@ The digest that was used to compute the fingerprint given with B<-fingerprint>.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head1 SEE ALSO
@@ -23,6 +23,7 @@ B<-query>
 [B<-out> I<request.tsq>]
 [B<-text>]
 {- $OpenSSL::safe::opt_r_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 B<openssl> B<ts>
 B<-reply>
@@ -42,6 +43,7 @@ B<-reply>
 [B<-token_out>]
 [B<-text>]
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 B<openssl> B<ts>
 B<-verify>
@@ -54,6 +56,7 @@ B<-verify>
 [B<-CApath> I<dir>]
 [B<-CAstore> I<uri>]
 {- $OpenSSL::safe::opt_v_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine

@@ -285,6 +288,8 @@ instead of DER. (Optional)

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head2 Timestamp Response verification
@@ -21,6 +21,7 @@ B<openssl> B<verify>
 {- $OpenSSL::safe::opt_trust_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
 {- $OpenSSL::safe::opt_v_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}
 [B<-->]
 [I<certificate> ...]

@@ -91,6 +92,8 @@ B<-trusted>, B<-untrusted> or B<-CRLfile> options.

 {- $OpenSSL::safe::opt_v_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =item B<-->

 Indicates the last option. All arguments following this are assumed to be
@@ -1,4 +1,5 @@
 =pod
+{- OpenSSL::safe::output_do_not_edit_headers(); -}

 =head1 NAME

@@ -75,6 +75,7 @@ B<openssl> B<x509>
 {- $OpenSSL::safe::opt_name_synopsis -}
 {- $OpenSSL::safe::opt_r_synopsis -}
 {- $OpenSSL::safe::opt_engine_synopsis -}
+{- $OpenSSL::safe::opt_provider_synopsis -}

 =for openssl ifdef engine subject_hash_old issuer_hash_old

@@ -135,6 +136,8 @@ Cannot be used with the B<-days> option.

 {- $OpenSSL::safe::opt_engine_item -}

+{- $OpenSSL::safe::opt_provider_item -}
+
 =back

 =head2 Display Options
@@ -755,6 +755,26 @@ This file can be used in a subsequent command invocation.

 =back

+=head2 Provider Options
+
+With the move to provider based cryptographic operations in OpenSSL 3.0,
+options were added to allow specific providers or sets of providers to be used.
+
+=over 4
+
+=item B<-provider> I<name>
+
+Use the provider identified by I<name> and use all the methods it
+implements (algorithms, key storage, etc.).  This option can be specified
+multiple time to load more than one provider.
+
+=item B<-provider_path> I<path>
+
+Specify the search I<path> that is used to locate provider modules.  The format
+of I<path> varies depending on the operating system being used.
+
+=back
+
 =head2 Extended Verification Options

 Sometimes there may be more than one certificate chain leading to an