forked from cory/tildefriends
Add prebuild OpenSSL, and remove SCHANNEL code and whatever it was on MacOS. Build mingw for 64-bit.
git-svn-id: https://www.unprompted.com/svn/projects/tildefriends/trunk@4088 ed5197a5-7fde-0310-b194-c3ffbd925b24
This commit is contained in:
198
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/CA.pl.html
vendored
Normal file
198
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/CA.pl.html
vendored
Normal file
@ -0,0 +1,198 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>CA.pl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#DSA-CERTIFICATES">DSA CERTIFICATES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>CA.pl - friendlier interface for OpenSSL certificate programs</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>CA.pl</b> <b>-?</b> | <b>-h</b> | <b>-help</b></p>
|
||||
|
||||
<p><b>CA.pl</b> <b>-newcert</b> | <b>-newreq</b> | <b>-newreq-nodes</b> | <b>-xsign</b> | <b>-sign</b> | <b>-signCA</b> | <b>-signcert</b> | <b>-crl</b> | <b>-newca</b> [<b>-extra-cmd</b> extra-params]</p>
|
||||
|
||||
<p><b>CA.pl</b> <b>-pkcs12</b> [<b>-extra-pkcs12</b> extra-params] [<b>certname</b>]</p>
|
||||
|
||||
<p><b>CA.pl</b> <b>-verify</b> [<b>-extra-verify</b> extra-params] <b>certfile</b>...</p>
|
||||
|
||||
<p><b>CA.pl</b> <b>-revoke</b> [<b>-extra-ca</b> extra-params] <b>certfile</b> [<b>reason</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>CA.pl</b> script is a perl script that supplies the relevant command line arguments to the <b>openssl</b> command for some common certificate operations. It is intended to simplify the process of certificate creation and management by the use of some simple options.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="h--help"><b>?</b>, <b>-h</b>, <b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="newcert"><b>-newcert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Creates a new self signed certificate. The private key is written to the file "newkey.pem" and the request written to the file "newreq.pem". This argument invokes <b>openssl req</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="newreq"><b>-newreq</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Creates a new certificate request. The private key is written to the file "newkey.pem" and the request written to the file "newreq.pem". Executes <b>openssl req</b> command below the hood.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="newreq-nodes"><b>-newreq-nodes</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Is like <b>-newreq</b> except that the private key will not be encrypted. Uses <b>openssl req</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="newca"><b>-newca</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Creates a new CA hierarchy for use with the <b>ca</b> program (or the <b>-signcert</b> and <b>-xsign</b> options). The user is prompted to enter the filename of the CA certificates (which should also contain the private key) or by hitting ENTER details of the CA will be prompted for. The relevant files and directories are created in a directory called "demoCA" in the current directory. <b>openssl req</b> and <b>openssl ca</b> commands are get invoked.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkcs12"><b>-pkcs12</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create a PKCS#12 file containing the user certificate, private key and CA certificate. It expects the user certificate and private key to be in the file "newcert.pem" and the CA certificate to be in the file demoCA/cacert.pem, it creates a file "newcert.p12". This command can thus be called after the <b>-sign</b> option. The PKCS#12 file can be imported directly into a browser. If there is an additional argument on the command line it will be used as the "friendly name" for the certificate (which is typically displayed in the browser list box), otherwise the name "My Certificate" is used. Delegates work to <b>openssl pkcs12</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign--signcert--xsign"><b>-sign</b>, <b>-signcert</b>, <b>-xsign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Calls the <b>ca</b> program to sign a certificate request. It expects the request to be in the file "newreq.pem". The new certificate is written to the file "newcert.pem" except in the case of the <b>-xsign</b> option when it is written to standard output. Leverages <b>openssl ca</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signCA"><b>-signCA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option is the same as the <b>-signreq</b> option except it uses the configuration file section <b>v3_ca</b> and so makes the signed request a valid CA certificate. This is useful when creating intermediate CA from a root CA. Extra params are passed on to <b>openssl ca</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signcert"><b>-signcert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option is the same as <b>-sign</b> except it expects a self signed certificate to be present in the file "newreq.pem". Extra params are passed on to <b>openssl x509</b> and <b>openssl ca</b> commands.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl"><b>-crl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate a CRL. Executes <b>openssl ca</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="revoke-certfile-reason"><b>-revoke certfile [reason]</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Revoke the certificate contained in the specified <b>certfile</b>. An optional reason may be specified, and must be one of: <b>unspecified</b>, <b>keyCompromise</b>, <b>CACompromise</b>, <b>affiliationChanged</b>, <b>superseded</b>, <b>cessationOfOperation</b>, <b>certificateHold</b>, or <b>removeFromCRL</b>. Leverages <b>openssl ca</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>-verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verifies certificates against the CA certificate for "demoCA". If no certificates are specified on the command line it tries to verify the file "newcert.pem". Invokes <b>openssl verify</b> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="extra-req--extra-ca--extra-pkcs12--extra-x509--extra-verify-extra-params"><b>-extra-req</b> | <b>-extra-ca</b> | <b>-extra-pkcs12</b> | <b>-extra-x509</b> | <b>-extra-verify</b> <extra-params></dt>
|
||||
<dd>
|
||||
|
||||
<p>The purpose of these parameters is to allow optional parameters to be supplied to <b>openssl</b> that this command executes. The <b>-extra-cmd</b> are specific to the option being used and the <b>openssl</b> command getting invoked. For example when this command invokes <b>openssl req</b> extra parameters can be passed on with the <b>-extra-req</b> parameter. The <b>openssl</b> commands being invoked per option are documented below. Users should consult <b>openssl</b> command documentation for more information.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Create a CA hierarchy:</p>
|
||||
|
||||
<pre><code>CA.pl -newca</code></pre>
|
||||
|
||||
<p>Complete certificate creation example: create a CA, create a request, sign the request and finally create a PKCS#12 file containing it.</p>
|
||||
|
||||
<pre><code>CA.pl -newca
|
||||
CA.pl -newreq
|
||||
CA.pl -signreq
|
||||
CA.pl -pkcs12 "My Test Certificate"</code></pre>
|
||||
|
||||
<h1 id="DSA-CERTIFICATES">DSA CERTIFICATES</h1>
|
||||
|
||||
<p>Although the <b>CA.pl</b> creates RSA CAs and requests it is still possible to use it with DSA certificates and requests using the <a href="../man1/req.html">req(1)</a> command directly. The following example shows the steps that would typically be taken.</p>
|
||||
|
||||
<p>Create some DSA parameters:</p>
|
||||
|
||||
<pre><code>openssl dsaparam -out dsap.pem 1024</code></pre>
|
||||
|
||||
<p>Create a DSA CA certificate and private key:</p>
|
||||
|
||||
<pre><code>openssl req -x509 -newkey dsa:dsap.pem -keyout cacert.pem -out cacert.pem</code></pre>
|
||||
|
||||
<p>Create the CA directories and files:</p>
|
||||
|
||||
<pre><code>CA.pl -newca</code></pre>
|
||||
|
||||
<p>enter cacert.pem when prompted for the CA file name.</p>
|
||||
|
||||
<p>Create a DSA certificate request and private key (a different set of parameters can optionally be created first):</p>
|
||||
|
||||
<pre><code>openssl req -out newreq.pem -newkey dsa:dsap.pem</code></pre>
|
||||
|
||||
<p>Sign the request:</p>
|
||||
|
||||
<pre><code>CA.pl -signreq</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Most of the filenames mentioned can be modified by editing the <b>CA.pl</b> script.</p>
|
||||
|
||||
<p>If the demoCA directory already exists then the <b>-newca</b> command will not overwrite it and will do nothing. This can happen if a previous call using the <b>-newca</b> option terminated abnormally. To get the correct behaviour delete the demoCA directory if it already exists.</p>
|
||||
|
||||
<p>Under some environments it may not be possible to run the <b>CA.pl</b> script directly (for example Win32) and the default configuration file location may be wrong. In this case the command:</p>
|
||||
|
||||
<pre><code>perl -S CA.pl</code></pre>
|
||||
|
||||
<p>can be used and the <b>OPENSSL_CONF</b> environment variable changed to point to the correct path of the configuration file.</p>
|
||||
|
||||
<p>The script is intended as a simple front end for the <b>openssl</b> program for use by a beginner. Its behaviour isn't always what is wanted. For more control over the behaviour of the certificate commands call the <b>openssl</b> command directly.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/x509.html">x509(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/pkcs12.html">pkcs12(1)</a>, <a href="../man5/config.html">config(5)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
227
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/asn1parse.html
vendored
Normal file
227
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/asn1parse.html
vendored
Normal file
@ -0,0 +1,227 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>asn1parse</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a>
|
||||
<ul>
|
||||
<li><a href="#Output">Output</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-asn1parse, asn1parse - ASN.1 parsing tool</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>asn1parse</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-offset number</b>] [<b>-length number</b>] [<b>-i</b>] [<b>-oid filename</b>] [<b>-dump</b>] [<b>-dlimit num</b>] [<b>-strparse offset</b>] [<b>-genstr string</b>] [<b>-genconf file</b>] [<b>-strictpem</b>] [<b>-item name</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>asn1parse</b> command is a diagnostic utility that can parse ASN.1 structures. It can also be used to extract data from ASN.1 formatted data.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform</b> <b>DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input format. <b>DER</b> is binary format and <b>PEM</b> (the default) is base64 encoded.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file, default is standard input.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output file to place the DER encoded data into. If this option is not present then no data will be output. This is most useful when combined with the <b>-strparse</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't output the parsed version of the input file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="offset-number"><b>-offset number</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Starting offset to begin parsing, default is start of file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="length-number"><b>-length number</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Number of bytes to parse, default is until end of file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="i"><b>-i</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Indents the output according to the "depth" of the structures.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oid-filename"><b>-oid filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing additional OBJECT IDENTIFIERs (OIDs). The format of this file is described in the NOTES section below.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dump"><b>-dump</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Dump unknown data in hex format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dlimit-num"><b>-dlimit num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Like <b>-dump</b>, but only the first <b>num</b> bytes are output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="strparse-offset"><b>-strparse offset</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Parse the contents octets of the ASN.1 object starting at <b>offset</b>. This option can be used multiple times to "drill down" into a nested structure.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="genstr-string--genconf-file"><b>-genstr string</b>, <b>-genconf file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate encoded data based on <b>string</b>, <b>file</b> or both using <a href="../man3/ASN1_generate_nconf.html">ASN1_generate_nconf(3)</a> format. If <b>file</b> only is present then the string is obtained from the default section using the name <b>asn1</b>. The encoded data is passed through the ASN1 parser and printed out as though it came from a file, the contents can thus be examined and written to a file using the <b>out</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="strictpem"><b>-strictpem</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is used then <b>-inform</b> will be ignored. Without this option any data in a PEM format input file will be treated as being base64 encoded and processed whether it has the normal PEM BEGIN and END markers or not. This option will ignore any data prior to the start of the BEGIN marker, or after an END marker in a PEM file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="item-name"><b>-item name</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Attempt to decode and print the data as <b>ASN1_ITEM name</b>. This can be used to print out the fields of any supported ASN.1 structure if the type is known.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Output">Output</h2>
|
||||
|
||||
<p>The output will typically contain lines like this:</p>
|
||||
|
||||
<pre><code>0:d=0 hl=4 l= 681 cons: SEQUENCE</code></pre>
|
||||
|
||||
<p>.....</p>
|
||||
|
||||
<pre><code>229:d=3 hl=3 l= 141 prim: BIT STRING
|
||||
373:d=2 hl=3 l= 162 cons: cont [ 3 ]
|
||||
376:d=3 hl=3 l= 159 cons: SEQUENCE
|
||||
379:d=4 hl=2 l= 29 cons: SEQUENCE
|
||||
381:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
|
||||
386:d=5 hl=2 l= 22 prim: OCTET STRING
|
||||
410:d=4 hl=2 l= 112 cons: SEQUENCE
|
||||
412:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
|
||||
417:d=5 hl=2 l= 105 prim: OCTET STRING
|
||||
524:d=4 hl=2 l= 12 cons: SEQUENCE</code></pre>
|
||||
|
||||
<p>.....</p>
|
||||
|
||||
<p>This example is part of a self-signed certificate. Each line starts with the offset in decimal. <b>d=XX</b> specifies the current depth. The depth is increased within the scope of any SET or SEQUENCE. <b>hl=XX</b> gives the header length (tag and length octets) of the current type. <b>l=XX</b> gives the length of the contents octets.</p>
|
||||
|
||||
<p>The <b>-i</b> option can be used to make the output more readable.</p>
|
||||
|
||||
<p>Some knowledge of the ASN.1 structure is needed to interpret the output.</p>
|
||||
|
||||
<p>In this example the BIT STRING at offset 229 is the certificate public key. The contents octets of this will contain the public key information. This can be examined using the option <b>-strparse 229</b> to yield:</p>
|
||||
|
||||
<pre><code> 0:d=0 hl=3 l= 137 cons: SEQUENCE
|
||||
3:d=1 hl=3 l= 129 prim: INTEGER :E5D21E1F5C8D208EA7A2166C7FAF9F6BDF2059669C60876DDB70840F1A5AAFA59699FE471F379F1DD6A487E7D5409AB6A88D4A9746E24B91D8CF55DB3521015460C8EDE44EE8A4189F7A7BE77D6CD3A9AF2696F486855CF58BF0EDF2B4068058C7A947F52548DDF7E15E96B385F86422BEA9064A3EE9E1158A56E4A6F47E5897
|
||||
135:d=1 hl=2 l= 3 prim: INTEGER :010001</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>If an OID is not part of OpenSSL's internal table it will be represented in numerical form (for example 1.2.3.4). The file passed to the <b>-oid</b> option allows additional OIDs to be included. Each line consists of three columns, the first column is the OID in numerical format and should be followed by white space. The second column is the "short name" which is a single word followed by white space. The final column is the rest of the line and is the "long name". <b>asn1parse</b> displays the long name. Example:</p>
|
||||
|
||||
<p><code>1.2.3.4 shortName A long name</code></p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Parse a file:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -in file.pem</code></pre>
|
||||
|
||||
<p>Parse a DER file:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -inform DER -in file.der</code></pre>
|
||||
|
||||
<p>Generate a simple UTF8String:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -genstr 'UTF8:Hello World'</code></pre>
|
||||
|
||||
<p>Generate and write out a UTF8String, don't print parsed output:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -genstr 'UTF8:Hello World' -noout -out utf8.der</code></pre>
|
||||
|
||||
<p>Generate using a config file:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -genconf asn1.cnf -noout -out asn1.der</code></pre>
|
||||
|
||||
<p>Example config file:</p>
|
||||
|
||||
<pre><code>asn1=SEQUENCE:seq_sect
|
||||
|
||||
[seq_sect]
|
||||
|
||||
field1=BOOL:TRUE
|
||||
field2=EXP:0, UTF8:some random string</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>There should be options to change the format of output lines. The output of some ASN.1 types is not well handled (if at all).</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ASN1_generate_nconf.html">ASN1_generate_nconf(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
671
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ca.html
vendored
Normal file
671
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ca.html
vendored
Normal file
@ -0,0 +1,671 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ca</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#CRL-OPTIONS">CRL OPTIONS</a></li>
|
||||
<li><a href="#CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</a></li>
|
||||
<li><a href="#POLICY-FORMAT">POLICY FORMAT</a></li>
|
||||
<li><a href="#SPKAC-FORMAT">SPKAC FORMAT</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#FILES">FILES</a></li>
|
||||
<li><a href="#RESTRICTIONS">RESTRICTIONS</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#WARNINGS">WARNINGS</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-ca, ca - sample minimal CA application</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>ca</b> [<b>-help</b>] [<b>-verbose</b>] [<b>-config filename</b>] [<b>-name section</b>] [<b>-gencrl</b>] [<b>-revoke file</b>] [<b>-valid file</b>] [<b>-status serial</b>] [<b>-updatedb</b>] [<b>-crl_reason reason</b>] [<b>-crl_hold instruction</b>] [<b>-crl_compromise time</b>] [<b>-crl_CA_compromise time</b>] [<b>-crldays days</b>] [<b>-crlhours hours</b>] [<b>-crlexts section</b>] [<b>-startdate date</b>] [<b>-enddate date</b>] [<b>-days arg</b>] [<b>-md arg</b>] [<b>-policy arg</b>] [<b>-keyfile arg</b>] [<b>-keyform PEM|DER</b>] [<b>-key arg</b>] [<b>-passin arg</b>] [<b>-cert file</b>] [<b>-selfsign</b>] [<b>-in file</b>] [<b>-out file</b>] [<b>-notext</b>] [<b>-outdir dir</b>] [<b>-infiles</b>] [<b>-spkac file</b>] [<b>-ss_cert file</b>] [<b>-preserveDN</b>] [<b>-noemailDN</b>] [<b>-batch</b>] [<b>-msie_hack</b>] [<b>-extensions section</b>] [<b>-extfile section</b>] [<b>-engine id</b>] [<b>-subj arg</b>] [<b>-utf8</b>] [<b>-sigopt nm:v</b>] [<b>-create_serial</b>] [<b>-rand_serial</b>] [<b>-multivalue-rdn</b>] [<b>-rand file...</b>] [<b>-writerand file</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>ca</b> command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status.</p>
|
||||
|
||||
<p>The options descriptions will be divided into each purpose.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verbose"><b>-verbose</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This prints extra details about the operations being performed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="config-filename"><b>-config filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the configuration file to use. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="name-section"><b>-name section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the configuration file section to use (overrides <b>default_ca</b> in the <b>ca</b> section).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>An input filename containing a single certificate request to be signed by the CA.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ss_cert-filename"><b>-ss_cert filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A single self-signed certificate to be signed by the CA.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="spkac-filename"><b>-spkac filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing a single Netscape signed public key and challenge and additional field values to be signed by the CA. See the <b>SPKAC FORMAT</b> section for information on the required input and output format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="infiles"><b>-infiles</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If present this should be the last option, all subsequent arguments are taken as the names of files containing certificate requests.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file to output certificates to. The default is standard output. The certificate details will also be printed out to this file in PEM format (except that <b>-spkac</b> outputs DER format).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outdir-directory"><b>-outdir directory</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The directory to output certificates to. The certificate will be written to a filename consisting of the serial number in hex with ".pem" appended.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert"><b>-cert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The CA certificate file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyfile-filename"><b>-keyfile filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key to sign requests with.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-PEM-DER"><b>-keyform PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The format of the data in the private key file. The default is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="key-password"><b>-key password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The password used to encrypt the private key. Since on some systems the command line arguments are visible (e.g. Unix with the 'ps' utility) this option should be used with caution.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="selfsign"><b>-selfsign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Indicates the issued certificates are to be signed with the key the certificate requests were signed with (given with <b>-keyfile</b>). Certificate requests signed with a different key are ignored. If <b>-spkac</b>, <b>-ss_cert</b> or <b>-gencrl</b> are given, <b>-selfsign</b> is ignored.</p>
|
||||
|
||||
<p>A consequence of using <b>-selfsign</b> is that the self-signed certificate appears among the entries in the certificate database (see the configuration option <b>database</b>), and uses the same serial number counter as all other certificates sign with the self-signed certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="notext"><b>-notext</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't output the text form of a certificate to the output file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="startdate-date"><b>-startdate date</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the start date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="enddate-date"><b>-enddate date</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the expiry date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="days-arg"><b>-days arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of days to certify the certificate for.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="md-alg"><b>-md alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The message digest to use. Any digest supported by the OpenSSL <b>dgst</b> command can be used. For signing algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message digest that is set is ignored. This option also applies to CRLs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="policy-arg"><b>-policy arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option defines the CA "policy" to use. This is a section in the configuration file which decides which fields should be mandatory or match the CA certificate. Check out the <b>POLICY FORMAT</b> section for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="msie_hack"><b>-msie_hack</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is a deprecated option to make <b>ca</b> work with very old versions of the IE certificate enrollment control "certenr3". It used UniversalStrings for almost everything. Since the old control has various security bugs its use is strongly discouraged.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="preserveDN"><b>-preserveDN</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally the DN order of a certificate is the same as the order of the fields in the relevant policy section. When this option is set the order is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noemailDN"><b>-noemailDN</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The DN of a certificate can contain the EMAIL field if present in the request DN, however it is good policy just having the e-mail set into the altName extension of the certificate. When this option is set the EMAIL field is removed from the certificate' subject and set only in the, eventually present, extensions. The <b>email_in_dn</b> keyword can be used in the configuration file to enable this behaviour.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="batch"><b>-batch</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This sets the batch mode. In this mode no questions will be asked and all certificates will be certified automatically.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="extensions-section"><b>-extensions section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to <b>x509_extensions</b> unless the <b>-extfile</b> option is used). If no extension section is present then, a V1 certificate is created. If the extension section is present (even if it is empty), then a V3 certificate is created. See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="extfile-file"><b>-extfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>An additional configuration file to read certificate extensions from (using the default section unless the <b>-extensions</b> option is also used).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ca</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="subj-arg"><b>-subj arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Supersedes subject name given in the request. The arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>. Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted, but the corresponding type will not be included in the resulting certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="utf8"><b>-utf8</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="create_serial"><b>-create_serial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If reading serial from the text file as specified in the configuration fails, specifying this option creates a new random serial to be used as next serial number. To get random serial numbers, use the <b>-rand_serial</b> flag instead; this should only be used for simple error-recovery.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand_serial"><b>-rand_serial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate a large random number to use as the serial number. This overrides any option or configuration to use a serial number file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="multivalue-rdn"><b>-multivalue-rdn</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option causes the -subj argument to be interpreted with full support for multivalued RDNs. Example:</p>
|
||||
|
||||
<p><i>/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe</i></p>
|
||||
|
||||
<p>If -multi-rdn is not used then the UID value is <i>123456+CN=John Doe</i>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CRL-OPTIONS">CRL OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="gencrl"><b>-gencrl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option generates a CRL based on information in the index file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crldays-num"><b>-crldays num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of days before the next CRL is due. That is the days from now to place in the CRL nextUpdate field.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crlhours-num"><b>-crlhours num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of hours before the next CRL is due.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="revoke-filename"><b>-revoke filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A filename containing a certificate to revoke.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="valid-filename"><b>-valid filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A filename containing a certificate to add a Valid certificate entry.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="status-serial"><b>-status serial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Displays the revocation status of the certificate with the specified serial number and exits.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="updatedb"><b>-updatedb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Updates the database index to purge expired certificates.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_reason-reason"><b>-crl_reason reason</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Revocation reason, where <b>reason</b> is one of: <b>unspecified</b>, <b>keyCompromise</b>, <b>CACompromise</b>, <b>affiliationChanged</b>, <b>superseded</b>, <b>cessationOfOperation</b>, <b>certificateHold</b> or <b>removeFromCRL</b>. The matching of <b>reason</b> is case insensitive. Setting any revocation reason will make the CRL v2.</p>
|
||||
|
||||
<p>In practice <b>removeFromCRL</b> is not particularly useful because it is only used in delta CRLs which are not currently implemented.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_hold-instruction"><b>-crl_hold instruction</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This sets the CRL revocation reason code to <b>certificateHold</b> and the hold instruction to <b>instruction</b> which must be an OID. Although any OID can be used only <b>holdInstructionNone</b> (the use of which is discouraged by RFC2459) <b>holdInstructionCallIssuer</b> or <b>holdInstructionReject</b> will normally be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_compromise-time"><b>-crl_compromise time</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This sets the revocation reason to <b>keyCompromise</b> and the compromise time to <b>time</b>. <b>time</b> should be in GeneralizedTime format that is <b>YYYYMMDDHHMMSSZ</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_CA_compromise-time"><b>-crl_CA_compromise time</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the same as <b>crl_compromise</b> except the revocation reason is set to <b>CACompromise</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crlexts-section"><b>-crlexts section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The section of the configuration file containing CRL extensions to include. If no CRL extension section is present then a V1 CRL is created, if the CRL extension section is present (even if it is empty) then a V2 CRL is created. The CRL extensions specified are CRL extensions and <b>not</b> CRL entry extensions. It should be noted that some software (for example Netscape) can't handle V2 CRLs. See <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</h1>
|
||||
|
||||
<p>The section of the configuration file containing options for <b>ca</b> is found as follows: If the <b>-name</b> command line option is used, then it names the section to be used. Otherwise the section to be used must be named in the <b>default_ca</b> option of the <b>ca</b> section of the configuration file (or in the default section of the configuration file). Besides <b>default_ca</b>, the following options are read directly from the <b>ca</b> section: RANDFILE preserve msie_hack With the exception of <b>RANDFILE</b>, this is probably a bug and may change in future releases.</p>
|
||||
|
||||
<p>Many of the configuration file options are identical to command line options. Where the option is present in the configuration file and the command line the command line value is used. Where an option is described as mandatory then it must be present in the configuration file or the command line equivalent (if any) used.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="oid_file"><b>oid_file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies a file containing additional <b>OBJECT IDENTIFIERS</b>. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed by white space and finally the long name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oid_section"><b>oid_section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies a section in the configuration file containing extra object identifiers. Each line should consist of the short name of the object identifier followed by <b>=</b> and the numerical form. The short and long names are the same when this option is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="new_certs_dir"><b>new_certs_dir</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as the <b>-outdir</b> command line option. It specifies the directory where new certificates will be placed. Mandatory.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certificate"><b>certificate</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as <b>-cert</b>. It gives the file containing the CA certificate. Mandatory.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="private_key"><b>private_key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Same as the <b>-keyfile</b> option. The file containing the CA private key. Mandatory.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="RANDFILE"><b>RANDFILE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>At startup the specified file is loaded into the random number generator, and at exit 256 bytes will be written to it.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_days"><b>default_days</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as the <b>-days</b> option. The number of days to certify a certificate for.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_startdate"><b>default_startdate</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as the <b>-startdate</b> option. The start date to certify a certificate for. If not set the current time is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_enddate"><b>default_enddate</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as the <b>-enddate</b> option. Either this option or <b>default_days</b> (or the command line equivalents) must be present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_crl_hours-default_crl_days"><b>default_crl_hours default_crl_days</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as the <b>-crlhours</b> and the <b>-crldays</b> options. These will only be used if neither command line option is present. At least one of these must be present to generate a CRL.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_md"><b>default_md</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as the <b>-md</b> option. Mandatory except where the signing algorithm does not require a digest (i.e. Ed25519 and Ed448).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="database"><b>database</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The text database file to use. Mandatory. This file must be present though initially it will be empty.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="unique_subject"><b>unique_subject</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If the value <b>yes</b> is given, the valid certificate entries in the database must have unique subjects. if the value <b>no</b> is given, several valid certificate entries may have the exact same subject. The default value is <b>yes</b>, to be compatible with older (pre 0.9.8) versions of OpenSSL. However, to make CA certificate roll-over easier, it's recommended to use the value <b>no</b>, especially if combined with the <b>-selfsign</b> command line option.</p>
|
||||
|
||||
<p>Note that it is valid in some circumstances for certificates to be created without any subject. In the case where there are multiple certificates without subjects this does not count as a duplicate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="serial"><b>serial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A text file containing the next serial number to use in hex. Mandatory. This file must be present and contain a valid serial number.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crlnumber"><b>crlnumber</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A text file containing the next CRL number to use in hex. The crl number will be inserted in the CRLs only if this file exists. If this file is present, it must contain a valid CRL number.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="x509_extensions"><b>x509_extensions</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as <b>-extensions</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_extensions"><b>crl_extensions</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as <b>-crlexts</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="preserve"><b>preserve</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as <b>-preserveDN</b></p>
|
||||
|
||||
</dd>
|
||||
<dt id="email_in_dn"><b>email_in_dn</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as <b>-noemailDN</b>. If you want the EMAIL field to be removed from the DN of the certificate simply set this to 'no'. If not present the default is to allow for the EMAIL filed in the certificate's DN.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="msie_hack1"><b>msie_hack</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as <b>-msie_hack</b></p>
|
||||
|
||||
</dd>
|
||||
<dt id="policy"><b>policy</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The same as <b>-policy</b>. Mandatory. See the <b>POLICY FORMAT</b> section for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="name_opt-cert_opt"><b>name_opt</b>, <b>cert_opt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options allow the format used to display the certificate details when asking the user to confirm signing. All the options supported by the <b>x509</b> utilities <b>-nameopt</b> and <b>-certopt</b> switches can be used here, except the <b>no_signame</b> and <b>no_sigdump</b> are permanently set and cannot be disabled (this is because the certificate signature cannot be displayed because the certificate has not been signed at this point).</p>
|
||||
|
||||
<p>For convenience the values <b>ca_default</b> are accepted by both to produce a reasonable output.</p>
|
||||
|
||||
<p>If neither option is present the format used in earlier versions of OpenSSL is used. Use of the old format is <b>strongly</b> discouraged because it only displays fields mentioned in the <b>policy</b> section, mishandles multicharacter string types and does not display extensions.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="copy_extensions"><b>copy_extensions</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Determines how extensions in certificate requests should be handled. If set to <b>none</b> or this option is not present then extensions are ignored and not copied to the certificate. If set to <b>copy</b> then any extensions present in the request that are not already present are copied to the certificate. If set to <b>copyall</b> then all extensions in the request are copied to the certificate: if the extension is already present in the certificate it is deleted first. See the <b>WARNINGS</b> section before using this option.</p>
|
||||
|
||||
<p>The main use of this option is to allow a certificate request to supply values for certain extensions such as subjectAltName.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="POLICY-FORMAT">POLICY FORMAT</h1>
|
||||
|
||||
<p>The policy section consists of a set of variables corresponding to certificate DN fields. If the value is "match" then the field value must match the same field in the CA certificate. If the value is "supplied" then it must be present. If the value is "optional" then it may be present. Any fields not mentioned in the policy section are silently deleted, unless the <b>-preserveDN</b> option is set but this can be regarded more of a quirk than intended behaviour.</p>
|
||||
|
||||
<h1 id="SPKAC-FORMAT">SPKAC FORMAT</h1>
|
||||
|
||||
<p>The input to the <b>-spkac</b> command line option is a Netscape signed public key and challenge. This will usually come from the <b>KEYGEN</b> tag in an HTML form to create a new private key. It is however possible to create SPKACs using the <b>spkac</b> utility.</p>
|
||||
|
||||
<p>The file should contain the variable SPKAC set to the value of the SPKAC and also the required DN components as name value pairs. If you need to include the same component twice then it can be preceded by a number and a '.'.</p>
|
||||
|
||||
<p>When processing SPKAC format, the output is DER if the <b>-out</b> flag is used, but PEM format if sending to stdout or the <b>-outdir</b> flag is used.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Note: these examples assume that the <b>ca</b> directory structure is already set up and the relevant files already exist. This usually involves creating a CA certificate and private key with <b>req</b>, a serial number file and an empty index file and placing them in the relevant directories.</p>
|
||||
|
||||
<p>To use the sample configuration file below the directories demoCA, demoCA/private and demoCA/newcerts would be created. The CA certificate would be copied to demoCA/cacert.pem and its private key to demoCA/private/cakey.pem. A file demoCA/serial would be created containing for example "01" and the empty index file demoCA/index.txt.</p>
|
||||
|
||||
<p>Sign a certificate request:</p>
|
||||
|
||||
<pre><code>openssl ca -in req.pem -out newcert.pem</code></pre>
|
||||
|
||||
<p>Sign a certificate request, using CA extensions:</p>
|
||||
|
||||
<pre><code>openssl ca -in req.pem -extensions v3_ca -out newcert.pem</code></pre>
|
||||
|
||||
<p>Generate a CRL</p>
|
||||
|
||||
<pre><code>openssl ca -gencrl -out crl.pem</code></pre>
|
||||
|
||||
<p>Sign several requests:</p>
|
||||
|
||||
<pre><code>openssl ca -infiles req1.pem req2.pem req3.pem</code></pre>
|
||||
|
||||
<p>Certify a Netscape SPKAC:</p>
|
||||
|
||||
<pre><code>openssl ca -spkac spkac.txt</code></pre>
|
||||
|
||||
<p>A sample SPKAC file (the SPKAC line has been truncated for clarity):</p>
|
||||
|
||||
<pre><code>SPKAC=MIG0MGAwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAn7PDhCeV/xIxUg8V70YRxK2A5
|
||||
CN=Steve Test
|
||||
emailAddress=steve@openssl.org
|
||||
0.OU=OpenSSL Group
|
||||
1.OU=Another Group</code></pre>
|
||||
|
||||
<p>A sample configuration file with the relevant sections for <b>ca</b>:</p>
|
||||
|
||||
<pre><code>[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # top dir
|
||||
database = $dir/index.txt # index file.
|
||||
new_certs_dir = $dir/newcerts # new certs dir
|
||||
|
||||
certificate = $dir/cacert.pem # The CA cert
|
||||
serial = $dir/serial # serial no file
|
||||
#rand_serial = yes # for random serial#'s
|
||||
private_key = $dir/private/cakey.pem# CA private key
|
||||
RANDFILE = $dir/private/.rand # random number file
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = md5 # md to use
|
||||
|
||||
policy = policy_any # default policy
|
||||
email_in_dn = no # Don't add the email into cert DN
|
||||
|
||||
name_opt = ca_default # Subject name display option
|
||||
cert_opt = ca_default # Certificate display option
|
||||
copy_extensions = none # Don't copy extensions from request
|
||||
|
||||
[ policy_any ]
|
||||
countryName = supplied
|
||||
stateOrProvinceName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional</code></pre>
|
||||
|
||||
<h1 id="FILES">FILES</h1>
|
||||
|
||||
<p>Note: the location of all files can change either by compile time options, configuration file entries, environment variables or command line options. The values below reflect the default values.</p>
|
||||
|
||||
<pre><code>/usr/local/ssl/lib/openssl.cnf - master configuration file
|
||||
./demoCA - main CA directory
|
||||
./demoCA/cacert.pem - CA certificate
|
||||
./demoCA/private/cakey.pem - CA private key
|
||||
./demoCA/serial - CA serial number file
|
||||
./demoCA/serial.old - CA serial number backup file
|
||||
./demoCA/index.txt - CA text database file
|
||||
./demoCA/index.txt.old - CA text database backup file
|
||||
./demoCA/certs - certificate output file
|
||||
./demoCA/.rnd - CA random seed information</code></pre>
|
||||
|
||||
<h1 id="RESTRICTIONS">RESTRICTIONS</h1>
|
||||
|
||||
<p>The text database index file is a critical part of the process and if corrupted it can be difficult to fix. It is theoretically possible to rebuild the index file from all the issued certificates and a current CRL: however there is no option to do this.</p>
|
||||
|
||||
<p>V2 CRL features like delta CRLs are not currently supported.</p>
|
||||
|
||||
<p>Although several requests can be input and handled at once it is only possible to include one SPKAC or self-signed certificate.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The use of an in-memory text database can cause problems when large numbers of certificates are present because, as the name implies the database has to be kept in memory.</p>
|
||||
|
||||
<p>The <b>ca</b> command really needs rewriting or the required functionality exposed at either a command or interface level so a more friendly utility (perl script or GUI) can handle things properly. The script <b>CA.pl</b> helps a little but not very much.</p>
|
||||
|
||||
<p>Any fields in a request that are not present in a policy are silently deleted. This does not happen if the <b>-preserveDN</b> option is used. To enforce the absence of the EMAIL field within the DN, as suggested by RFCs, regardless the contents of the request' subject the <b>-noemailDN</b> option can be used. The behaviour should be more friendly and configurable.</p>
|
||||
|
||||
<p>Canceling some commands by refusing to certify a certificate can create an empty file.</p>
|
||||
|
||||
<h1 id="WARNINGS">WARNINGS</h1>
|
||||
|
||||
<p>The <b>ca</b> command is quirky and at times downright unfriendly.</p>
|
||||
|
||||
<p>The <b>ca</b> utility was originally meant as an example of how to do things in a CA. It was not supposed to be used as a full blown CA itself: nevertheless some people are using it for this purpose.</p>
|
||||
|
||||
<p>The <b>ca</b> command is effectively a single user command: no locking is done on the various files and attempts to run more than one <b>ca</b> command on the same database can have unpredictable results.</p>
|
||||
|
||||
<p>The <b>copy_extensions</b> option should be used with caution. If care is not taken then it can be a security risk. For example if a certificate request contains a basicConstraints extension with CA:TRUE and the <b>copy_extensions</b> value is set to <b>copyall</b> and the user does not spot this when the certificate is displayed then this will hand the requester a valid CA certificate.</p>
|
||||
|
||||
<p>This situation can be avoided by setting <b>copy_extensions</b> to <b>copy</b> and including basicConstraints with CA:FALSE in the configuration file. Then if the request contains a basicConstraints extension it will be ignored.</p>
|
||||
|
||||
<p>It is advisable to also include values for other extensions such as <b>keyUsage</b> to prevent a request supplying its own values.</p>
|
||||
|
||||
<p>Additional restrictions can be placed on the CA certificate itself. For example if the CA certificate has:</p>
|
||||
|
||||
<pre><code>basicConstraints = CA:TRUE, pathlen:0</code></pre>
|
||||
|
||||
<p>then even if a certificate is issued with CA:TRUE it will not be valid.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>Since OpenSSL 1.1.1, the program follows RFC5280. Specifically, certificate validity period (specified by any of <b>-startdate</b>, <b>-enddate</b> and <b>-days</b>) will be encoded as UTCTime if the dates are earlier than year 2049 (included), and as GeneralizedTime if the dates are in year 2050 or later.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/req.html">req(1)</a>, <a href="../man1/spkac.html">spkac(1)</a>, <a href="../man1/x509.html">x509(1)</a>, <a href="../man1/CA.pl.html">CA.pl(1)</a>, <a href="../man5/config.html">config(5)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
811
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ciphers.html
vendored
Normal file
811
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ciphers.html
vendored
Normal file
@ -0,0 +1,811 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ciphers</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#CIPHER-LIST-FORMAT">CIPHER LIST FORMAT</a></li>
|
||||
<li><a href="#CIPHER-STRINGS">CIPHER STRINGS</a></li>
|
||||
<li><a href="#CIPHER-SUITE-NAMES">CIPHER SUITE NAMES</a>
|
||||
<ul>
|
||||
<li><a href="#SSL-v3.0-cipher-suites">SSL v3.0 cipher suites</a></li>
|
||||
<li><a href="#TLS-v1.0-cipher-suites">TLS v1.0 cipher suites</a></li>
|
||||
<li><a href="#AES-cipher-suites-from-RFC3268-extending-TLS-v1.0">AES cipher suites from RFC3268, extending TLS v1.0</a></li>
|
||||
<li><a href="#Camellia-cipher-suites-from-RFC4132-extending-TLS-v1.0">Camellia cipher suites from RFC4132, extending TLS v1.0</a></li>
|
||||
<li><a href="#SEED-cipher-suites-from-RFC4162-extending-TLS-v1.0">SEED cipher suites from RFC4162, extending TLS v1.0</a></li>
|
||||
<li><a href="#GOST-cipher-suites-from-draft-chudov-cryptopro-cptls-extending-TLS-v1.0">GOST cipher suites from draft-chudov-cryptopro-cptls, extending TLS v1.0</a></li>
|
||||
<li><a href="#Additional-Export-1024-and-other-cipher-suites">Additional Export 1024 and other cipher suites</a></li>
|
||||
<li><a href="#Elliptic-curve-cipher-suites">Elliptic curve cipher suites.</a></li>
|
||||
<li><a href="#TLS-v1.2-cipher-suites">TLS v1.2 cipher suites</a></li>
|
||||
<li><a href="#ARIA-cipher-suites-from-RFC6209-extending-TLS-v1.2">ARIA cipher suites from RFC6209, extending TLS v1.2</a></li>
|
||||
<li><a href="#Camellia-HMAC-Based-cipher-suites-from-RFC6367-extending-TLS-v1.2">Camellia HMAC-Based cipher suites from RFC6367, extending TLS v1.2</a></li>
|
||||
<li><a href="#Pre-shared-keying-PSK-cipher-suites">Pre-shared keying (PSK) cipher suites</a></li>
|
||||
<li><a href="#ChaCha20-Poly1305-cipher-suites-extending-TLS-v1.2">ChaCha20-Poly1305 cipher suites, extending TLS v1.2</a></li>
|
||||
<li><a href="#TLS-v1.3-cipher-suites">TLS v1.3 cipher suites</a></li>
|
||||
<li><a href="#Older-names-used-by-OpenSSL">Older names used by OpenSSL</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-ciphers, ciphers - SSL cipher display and cipher list tool</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>ciphers</b> [<b>-help</b>] [<b>-s</b>] [<b>-v</b>] [<b>-V</b>] [<b>-ssl3</b>] [<b>-tls1</b>] [<b>-tls1_1</b>] [<b>-tls1_2</b>] [<b>-tls1_3</b>] [<b>-s</b>] [<b>-psk</b>] [<b>-srp</b>] [<b>-stdname</b>] [<b>-convert name</b>] [<b>-ciphersuites val</b>] [<b>cipherlist</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>ciphers</b> command converts textual OpenSSL cipher lists into ordered SSL cipher preference lists. It can be used as a test tool to determine the appropriate cipherlist.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="s"><b>-s</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Only list supported ciphers: those consistent with the security level, and minimum and maximum protocol version. This is closer to the actual cipher list an application will support.</p>
|
||||
|
||||
<p>PSK and SRP ciphers are not enabled by default: they require <b>-psk</b> or <b>-srp</b> to enable them.</p>
|
||||
|
||||
<p>It also does not change the default list of supported signature algorithms.</p>
|
||||
|
||||
<p>On a server the list of supported ciphers might also exclude other ciphers depending on the configured certificates and presence of DH parameters.</p>
|
||||
|
||||
<p>If this option is not used then all ciphers that match the cipherlist will be listed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk"><b>-psk</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When combined with <b>-s</b> includes cipher suites which require PSK.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="srp"><b>-srp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When combined with <b>-s</b> includes cipher suites which require SRP.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="v"><b>-v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verbose output: For each cipher suite, list details as provided by <a href="../man3/SSL_CIPHER_description.html">SSL_CIPHER_description(3)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="V"><b>-V</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Like <b>-v</b>, but include the official cipher suite values in hex.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="tls1_3--tls1_2--tls1_1--tls1--ssl3"><b>-tls1_3</b>, <b>-tls1_2</b>, <b>-tls1_1</b>, <b>-tls1</b>, <b>-ssl3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>In combination with the <b>-s</b> option, list the ciphers which could be used if the specified protocol were negotiated. Note that not all protocols and flags may be available, depending on how OpenSSL was built.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="stdname"><b>-stdname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Precede each cipher suite by its standard name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="convert-name"><b>-convert name</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Convert a standard cipher <b>name</b> to its OpenSSL name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the list of TLSv1.3 ciphersuites. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names. By default this value is:</p>
|
||||
|
||||
<pre><code>TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256</code></pre>
|
||||
|
||||
</dd>
|
||||
<dt id="cipherlist"><b>cipherlist</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A cipher list of TLSv1.2 and below ciphersuites to convert to a cipher preference list. This list will be combined with any TLSv1.3 ciphersuites that have been configured. If it is not included then the default cipher list will be used. The format is described below.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CIPHER-LIST-FORMAT">CIPHER LIST FORMAT</h1>
|
||||
|
||||
<p>The cipher list consists of one or more <i>cipher strings</i> separated by colons. Commas or spaces are also acceptable separators but colons are normally used.</p>
|
||||
|
||||
<p>The actual cipher string can take several different forms.</p>
|
||||
|
||||
<p>It can consist of a single cipher suite such as <b>RC4-SHA</b>.</p>
|
||||
|
||||
<p>It can represent a list of cipher suites containing a certain algorithm, or cipher suites of a certain type. For example <b>SHA1</b> represents all ciphers suites using the digest algorithm SHA1 and <b>SSLv3</b> represents all SSL v3 algorithms.</p>
|
||||
|
||||
<p>Lists of cipher suites can be combined in a single cipher string using the <b>+</b> character. This is used as a logical <b>and</b> operation. For example <b>SHA1+DES</b> represents all cipher suites containing the SHA1 <b>and</b> the DES algorithms.</p>
|
||||
|
||||
<p>Each cipher string can be optionally preceded by the characters <b>!</b>, <b>-</b> or <b>+</b>.</p>
|
||||
|
||||
<p>If <b>!</b> is used then the ciphers are permanently deleted from the list. The ciphers deleted can never reappear in the list even if they are explicitly stated.</p>
|
||||
|
||||
<p>If <b>-</b> is used then the ciphers are deleted from the list, but some or all of the ciphers can be added again by later options.</p>
|
||||
|
||||
<p>If <b>+</b> is used then the ciphers are moved to the end of the list. This option doesn't add any new ciphers it just moves matching existing ones.</p>
|
||||
|
||||
<p>If none of these characters is present then the string is just interpreted as a list of ciphers to be appended to the current preference list. If the list includes any ciphers already present they will be ignored: that is they will not moved to the end of the list.</p>
|
||||
|
||||
<p>The cipher string <b>@STRENGTH</b> can be used at any point to sort the current cipher list in order of encryption algorithm key length.</p>
|
||||
|
||||
<p>The cipher string <b>@SECLEVEL=n</b> can be used at any point to set the security level to <b>n</b>, which should be a number between zero and five, inclusive. See <a href="/../man3/SSL_CTX_set_security_level.html">SSL_CTX_set_security_level</a> for a description of what each level means.</p>
|
||||
|
||||
<p>The cipher list can be prefixed with the <b>DEFAULT</b> keyword, which enables the default cipher list as defined below. Unlike cipher strings, this prefix may not be combined with other strings using <b>+</b> character. For example, <b>DEFAULT+DES</b> is not valid.</p>
|
||||
|
||||
<p>The content of the default list is determined at compile time and normally corresponds to <b>ALL:!COMPLEMENTOFDEFAULT:!eNULL</b>.</p>
|
||||
|
||||
<h1 id="CIPHER-STRINGS">CIPHER STRINGS</h1>
|
||||
|
||||
<p>The following is a list of all permitted cipher strings and their meanings.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="COMPLEMENTOFDEFAULT"><b>COMPLEMENTOFDEFAULT</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The ciphers included in <b>ALL</b>, but not enabled by default. Currently this includes all RC4 and anonymous ciphers. Note that this rule does not cover <b>eNULL</b>, which is not included by <b>ALL</b> (use <b>COMPLEMENTOFALL</b> if necessary). Note that RC4 based cipher suites are not built into OpenSSL by default (see the enable-weak-ssl-ciphers option to Configure).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ALL"><b>ALL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>All cipher suites except the <b>eNULL</b> ciphers (which must be explicitly enabled if needed). As of OpenSSL 1.0.0, the <b>ALL</b> cipher suites are sensibly ordered by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="COMPLEMENTOFALL"><b>COMPLEMENTOFALL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The cipher suites not enabled by <b>ALL</b>, currently <b>eNULL</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="HIGH"><b>HIGH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>"High" encryption cipher suites. This currently means those with key lengths larger than 128 bits, and some cipher suites with 128-bit keys.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="MEDIUM"><b>MEDIUM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>"Medium" encryption cipher suites, currently some of those using 128 bit encryption.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="LOW"><b>LOW</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>"Low" encryption cipher suites, currently those using 64 or 56 bit encryption algorithms but excluding export cipher suites. All these cipher suites have been removed as of OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="eNULL-NULL"><b>eNULL</b>, <b>NULL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The "NULL" ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are not enabled via either the <b>DEFAULT</b> or <b>ALL</b> cipher strings. Be careful when building cipherlists out of lower-level primitives such as <b>kRSA</b> or <b>aECDSA</b> as these do overlap with the <b>eNULL</b> ciphers. When in doubt, include <b>!eNULL</b> in your cipherlist.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aNULL"><b>aNULL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The cipher suites offering no authentication. This is currently the anonymous DH algorithms and anonymous ECDH algorithms. These cipher suites are vulnerable to "man in the middle" attacks and so their use is discouraged. These are excluded from the <b>DEFAULT</b> ciphers, but included in the <b>ALL</b> ciphers. Be careful when building cipherlists out of lower-level primitives such as <b>kDHE</b> or <b>AES</b> as these do overlap with the <b>aNULL</b> ciphers. When in doubt, include <b>!aNULL</b> in your cipherlist.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kRSA-aRSA-RSA"><b>kRSA</b>, <b>aRSA</b>, <b>RSA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using RSA key exchange or authentication. <b>RSA</b> is an alias for <b>kRSA</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kDHr-kDHd-kDH"><b>kDHr</b>, <b>kDHd</b>, <b>kDH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using static DH key agreement and DH certificates signed by CAs with RSA and DSS keys or either respectively. All these cipher suites have been removed in OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kDHE-kEDH-DH"><b>kDHE</b>, <b>kEDH</b>, <b>DH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using ephemeral DH key agreement, including anonymous cipher suites.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="DHE-EDH"><b>DHE</b>, <b>EDH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using authenticated ephemeral DH key agreement.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ADH"><b>ADH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Anonymous DH cipher suites, note that this does not include anonymous Elliptic Curve DH (ECDH) cipher suites.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kEECDH-kECDHE-ECDH"><b>kEECDH</b>, <b>kECDHE</b>, <b>ECDH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ECDHE-EECDH"><b>ECDHE</b>, <b>EECDH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using authenticated ephemeral ECDH key agreement.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="AECDH"><b>AECDH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Anonymous Elliptic Curve Diffie-Hellman cipher suites.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aDSS-DSS"><b>aDSS</b>, <b>DSS</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using DSS authentication, i.e. the certificates carry DSS keys.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aDH"><b>aDH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites effectively using DH authentication, i.e. the certificates carry DH keys. All these cipher suites have been removed in OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aECDSA-ECDSA"><b>aECDSA</b>, <b>ECDSA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using ECDSA authentication, i.e. the certificates carry ECDSA keys.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="TLSv1.2-TLSv1.0-SSLv3"><b>TLSv1.2</b>, <b>TLSv1.0</b>, <b>SSLv3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Lists cipher suites which are only supported in at least TLS v1.2, TLS v1.0 or SSL v3.0 respectively. Note: there are no cipher suites specific to TLS v1.1. Since this is only the minimum version, if, for example, TLSv1.0 is negotiated then both TLSv1.0 and SSLv3.0 cipher suites are available.</p>
|
||||
|
||||
<p>Note: these cipher strings <b>do not</b> change the negotiated version of SSL or TLS, they only affect the list of available cipher suites.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="AES128-AES256-AES"><b>AES128</b>, <b>AES256</b>, <b>AES</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>cipher suites using 128 bit AES, 256 bit AES or either 128 or 256 bit AES.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="AESGCM"><b>AESGCM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>AES in Galois Counter Mode (GCM): these cipher suites are only supported in TLS v1.2.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="AESCCM-AESCCM8"><b>AESCCM</b>, <b>AESCCM8</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>AES in Cipher Block Chaining - Message Authentication Mode (CCM): these cipher suites are only supported in TLS v1.2. <b>AESCCM</b> references CCM cipher suites using both 16 and 8 octet Integrity Check Value (ICV) while <b>AESCCM8</b> only references 8 octet ICV.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ARIA128-ARIA256-ARIA"><b>ARIA128</b>, <b>ARIA256</b>, <b>ARIA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using 128 bit ARIA, 256 bit ARIA or either 128 or 256 bit ARIA.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAMELLIA128-CAMELLIA256-CAMELLIA"><b>CAMELLIA128</b>, <b>CAMELLIA256</b>, <b>CAMELLIA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using 128 bit CAMELLIA, 256 bit CAMELLIA or either 128 or 256 bit CAMELLIA.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CHACHA20"><b>CHACHA20</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using ChaCha20.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="DES"><b>3DES</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using triple DES.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="DES1"><b>DES</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using DES (not triple DES). All these cipher suites have been removed in OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="RC4"><b>RC4</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using RC4.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="RC2"><b>RC2</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using RC2.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="IDEA"><b>IDEA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using IDEA.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SEED"><b>SEED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using SEED.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="MD5"><b>MD5</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using MD5.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SHA1-SHA"><b>SHA1</b>, <b>SHA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using SHA1.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SHA256-SHA384"><b>SHA256</b>, <b>SHA384</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using SHA256 or SHA384.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aGOST"><b>aGOST</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using GOST R 34.10 (either 2001 or 94) for authentication (needs an engine supporting GOST algorithms).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aGOST01"><b>aGOST01</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using GOST R 34.10-2001 authentication.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kGOST"><b>kGOST</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites, using VKO 34.10 key exchange, specified in the RFC 4357.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="GOST94"><b>GOST94</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites, using HMAC based on GOST R 34.11-94.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="GOST89MAC"><b>GOST89MAC</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using GOST 28147-89 MAC <b>instead of</b> HMAC.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="PSK"><b>PSK</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>All cipher suites using pre-shared keys (PSK).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kPSK-kECDHEPSK-kDHEPSK-kRSAPSK"><b>kPSK</b>, <b>kECDHEPSK</b>, <b>kDHEPSK</b>, <b>kRSAPSK</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using PSK key exchange, ECDHE_PSK, DHE_PSK or RSA_PSK.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aPSK"><b>aPSK</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher suites using PSK authentication (currently all PSK modes apart from RSA_PSK).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SUITEB128-SUITEB128ONLY-SUITEB192"><b>SUITEB128</b>, <b>SUITEB128ONLY</b>, <b>SUITEB192</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enables suite B mode of operation using 128 (permitting 192 bit mode by peer) 128 bit (not permitting 192 bit by peer) or 192 bit level of security respectively. If used these cipherstrings should appear first in the cipher list and anything after them is ignored. Setting Suite B mode has additional consequences required to comply with RFC6460. In particular the supported signature algorithms is reduced to support only ECDSA and SHA256 or SHA384, only the elliptic curves P-256 and P-384 can be used and only the two suite B compliant cipher suites (ECDHE-ECDSA-AES128-GCM-SHA256 and ECDHE-ECDSA-AES256-GCM-SHA384) are permissible.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CIPHER-SUITE-NAMES">CIPHER SUITE NAMES</h1>
|
||||
|
||||
<p>The following lists give the SSL or TLS cipher suites names from the relevant specification and their OpenSSL equivalents. It should be noted, that several cipher suite names do not include the authentication used, e.g. DES-CBC3-SHA. In these cases, RSA authentication is used.</p>
|
||||
|
||||
<h2 id="SSL-v3.0-cipher-suites">SSL v3.0 cipher suites</h2>
|
||||
|
||||
<pre><code>SSL_RSA_WITH_NULL_MD5 NULL-MD5
|
||||
SSL_RSA_WITH_NULL_SHA NULL-SHA
|
||||
SSL_RSA_WITH_RC4_128_MD5 RC4-MD5
|
||||
SSL_RSA_WITH_RC4_128_SHA RC4-SHA
|
||||
SSL_RSA_WITH_IDEA_CBC_SHA IDEA-CBC-SHA
|
||||
SSL_RSA_WITH_3DES_EDE_CBC_SHA DES-CBC3-SHA
|
||||
|
||||
SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA DH-DSS-DES-CBC3-SHA
|
||||
SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA DH-RSA-DES-CBC3-SHA
|
||||
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE-DSS-DES-CBC3-SHA
|
||||
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE-RSA-DES-CBC3-SHA
|
||||
|
||||
SSL_DH_anon_WITH_RC4_128_MD5 ADH-RC4-MD5
|
||||
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA ADH-DES-CBC3-SHA
|
||||
|
||||
SSL_FORTEZZA_KEA_WITH_NULL_SHA Not implemented.
|
||||
SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA Not implemented.
|
||||
SSL_FORTEZZA_KEA_WITH_RC4_128_SHA Not implemented.</code></pre>
|
||||
|
||||
<h2 id="TLS-v1.0-cipher-suites">TLS v1.0 cipher suites</h2>
|
||||
|
||||
<pre><code>TLS_RSA_WITH_NULL_MD5 NULL-MD5
|
||||
TLS_RSA_WITH_NULL_SHA NULL-SHA
|
||||
TLS_RSA_WITH_RC4_128_MD5 RC4-MD5
|
||||
TLS_RSA_WITH_RC4_128_SHA RC4-SHA
|
||||
TLS_RSA_WITH_IDEA_CBC_SHA IDEA-CBC-SHA
|
||||
TLS_RSA_WITH_3DES_EDE_CBC_SHA DES-CBC3-SHA
|
||||
|
||||
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA Not implemented.
|
||||
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA Not implemented.
|
||||
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE-DSS-DES-CBC3-SHA
|
||||
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE-RSA-DES-CBC3-SHA
|
||||
|
||||
TLS_DH_anon_WITH_RC4_128_MD5 ADH-RC4-MD5
|
||||
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA ADH-DES-CBC3-SHA</code></pre>
|
||||
|
||||
<h2 id="AES-cipher-suites-from-RFC3268-extending-TLS-v1.0">AES cipher suites from RFC3268, extending TLS v1.0</h2>
|
||||
|
||||
<pre><code>TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA
|
||||
TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA
|
||||
|
||||
TLS_DH_DSS_WITH_AES_128_CBC_SHA DH-DSS-AES128-SHA
|
||||
TLS_DH_DSS_WITH_AES_256_CBC_SHA DH-DSS-AES256-SHA
|
||||
TLS_DH_RSA_WITH_AES_128_CBC_SHA DH-RSA-AES128-SHA
|
||||
TLS_DH_RSA_WITH_AES_256_CBC_SHA DH-RSA-AES256-SHA
|
||||
|
||||
TLS_DHE_DSS_WITH_AES_128_CBC_SHA DHE-DSS-AES128-SHA
|
||||
TLS_DHE_DSS_WITH_AES_256_CBC_SHA DHE-DSS-AES256-SHA
|
||||
TLS_DHE_RSA_WITH_AES_128_CBC_SHA DHE-RSA-AES128-SHA
|
||||
TLS_DHE_RSA_WITH_AES_256_CBC_SHA DHE-RSA-AES256-SHA
|
||||
|
||||
TLS_DH_anon_WITH_AES_128_CBC_SHA ADH-AES128-SHA
|
||||
TLS_DH_anon_WITH_AES_256_CBC_SHA ADH-AES256-SHA</code></pre>
|
||||
|
||||
<h2 id="Camellia-cipher-suites-from-RFC4132-extending-TLS-v1.0">Camellia cipher suites from RFC4132, extending TLS v1.0</h2>
|
||||
|
||||
<pre><code>TLS_RSA_WITH_CAMELLIA_128_CBC_SHA CAMELLIA128-SHA
|
||||
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA CAMELLIA256-SHA
|
||||
|
||||
TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA DH-DSS-CAMELLIA128-SHA
|
||||
TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA DH-DSS-CAMELLIA256-SHA
|
||||
TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA DH-RSA-CAMELLIA128-SHA
|
||||
TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA DH-RSA-CAMELLIA256-SHA
|
||||
|
||||
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA DHE-DSS-CAMELLIA128-SHA
|
||||
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA DHE-DSS-CAMELLIA256-SHA
|
||||
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA DHE-RSA-CAMELLIA128-SHA
|
||||
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA DHE-RSA-CAMELLIA256-SHA
|
||||
|
||||
TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA ADH-CAMELLIA128-SHA
|
||||
TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA ADH-CAMELLIA256-SHA</code></pre>
|
||||
|
||||
<h2 id="SEED-cipher-suites-from-RFC4162-extending-TLS-v1.0">SEED cipher suites from RFC4162, extending TLS v1.0</h2>
|
||||
|
||||
<pre><code>TLS_RSA_WITH_SEED_CBC_SHA SEED-SHA
|
||||
|
||||
TLS_DH_DSS_WITH_SEED_CBC_SHA DH-DSS-SEED-SHA
|
||||
TLS_DH_RSA_WITH_SEED_CBC_SHA DH-RSA-SEED-SHA
|
||||
|
||||
TLS_DHE_DSS_WITH_SEED_CBC_SHA DHE-DSS-SEED-SHA
|
||||
TLS_DHE_RSA_WITH_SEED_CBC_SHA DHE-RSA-SEED-SHA
|
||||
|
||||
TLS_DH_anon_WITH_SEED_CBC_SHA ADH-SEED-SHA</code></pre>
|
||||
|
||||
<h2 id="GOST-cipher-suites-from-draft-chudov-cryptopro-cptls-extending-TLS-v1.0">GOST cipher suites from draft-chudov-cryptopro-cptls, extending TLS v1.0</h2>
|
||||
|
||||
<p>Note: these ciphers require an engine which including GOST cryptographic algorithms, such as the <b>ccgost</b> engine, included in the OpenSSL distribution.</p>
|
||||
|
||||
<pre><code>TLS_GOSTR341094_WITH_28147_CNT_IMIT GOST94-GOST89-GOST89
|
||||
TLS_GOSTR341001_WITH_28147_CNT_IMIT GOST2001-GOST89-GOST89
|
||||
TLS_GOSTR341094_WITH_NULL_GOSTR3411 GOST94-NULL-GOST94
|
||||
TLS_GOSTR341001_WITH_NULL_GOSTR3411 GOST2001-NULL-GOST94</code></pre>
|
||||
|
||||
<h2 id="Additional-Export-1024-and-other-cipher-suites">Additional Export 1024 and other cipher suites</h2>
|
||||
|
||||
<p>Note: these ciphers can also be used in SSL v3.</p>
|
||||
|
||||
<pre><code>TLS_DHE_DSS_WITH_RC4_128_SHA DHE-DSS-RC4-SHA</code></pre>
|
||||
|
||||
<h2 id="Elliptic-curve-cipher-suites">Elliptic curve cipher suites.</h2>
|
||||
|
||||
<pre><code>TLS_ECDHE_RSA_WITH_NULL_SHA ECDHE-RSA-NULL-SHA
|
||||
TLS_ECDHE_RSA_WITH_RC4_128_SHA ECDHE-RSA-RC4-SHA
|
||||
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ECDHE-RSA-DES-CBC3-SHA
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ECDHE-RSA-AES128-SHA
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ECDHE-RSA-AES256-SHA
|
||||
|
||||
TLS_ECDHE_ECDSA_WITH_NULL_SHA ECDHE-ECDSA-NULL-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ECDHE-ECDSA-RC4-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA ECDHE-ECDSA-DES-CBC3-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDHE-ECDSA-AES128-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDHE-ECDSA-AES256-SHA
|
||||
|
||||
TLS_ECDH_anon_WITH_NULL_SHA AECDH-NULL-SHA
|
||||
TLS_ECDH_anon_WITH_RC4_128_SHA AECDH-RC4-SHA
|
||||
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA AECDH-DES-CBC3-SHA
|
||||
TLS_ECDH_anon_WITH_AES_128_CBC_SHA AECDH-AES128-SHA
|
||||
TLS_ECDH_anon_WITH_AES_256_CBC_SHA AECDH-AES256-SHA</code></pre>
|
||||
|
||||
<h2 id="TLS-v1.2-cipher-suites">TLS v1.2 cipher suites</h2>
|
||||
|
||||
<pre><code>TLS_RSA_WITH_NULL_SHA256 NULL-SHA256
|
||||
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA256 AES128-SHA256
|
||||
TLS_RSA_WITH_AES_256_CBC_SHA256 AES256-SHA256
|
||||
TLS_RSA_WITH_AES_128_GCM_SHA256 AES128-GCM-SHA256
|
||||
TLS_RSA_WITH_AES_256_GCM_SHA384 AES256-GCM-SHA384
|
||||
|
||||
TLS_DH_RSA_WITH_AES_128_CBC_SHA256 DH-RSA-AES128-SHA256
|
||||
TLS_DH_RSA_WITH_AES_256_CBC_SHA256 DH-RSA-AES256-SHA256
|
||||
TLS_DH_RSA_WITH_AES_128_GCM_SHA256 DH-RSA-AES128-GCM-SHA256
|
||||
TLS_DH_RSA_WITH_AES_256_GCM_SHA384 DH-RSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 DH-DSS-AES128-SHA256
|
||||
TLS_DH_DSS_WITH_AES_256_CBC_SHA256 DH-DSS-AES256-SHA256
|
||||
TLS_DH_DSS_WITH_AES_128_GCM_SHA256 DH-DSS-AES128-GCM-SHA256
|
||||
TLS_DH_DSS_WITH_AES_256_GCM_SHA384 DH-DSS-AES256-GCM-SHA384
|
||||
|
||||
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 DHE-RSA-AES128-SHA256
|
||||
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 DHE-RSA-AES256-SHA256
|
||||
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 DHE-RSA-AES128-GCM-SHA256
|
||||
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 DHE-DSS-AES128-SHA256
|
||||
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 DHE-DSS-AES256-SHA256
|
||||
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 DHE-DSS-AES128-GCM-SHA256
|
||||
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 DHE-DSS-AES256-GCM-SHA384
|
||||
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ECDHE-RSA-AES128-SHA256
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 ECDHE-RSA-AES256-SHA384
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDHE-RSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ECDHE-ECDSA-AES128-SHA256
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ECDHE-ECDSA-AES256-SHA384
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_DH_anon_WITH_AES_128_CBC_SHA256 ADH-AES128-SHA256
|
||||
TLS_DH_anon_WITH_AES_256_CBC_SHA256 ADH-AES256-SHA256
|
||||
TLS_DH_anon_WITH_AES_128_GCM_SHA256 ADH-AES128-GCM-SHA256
|
||||
TLS_DH_anon_WITH_AES_256_GCM_SHA384 ADH-AES256-GCM-SHA384
|
||||
|
||||
RSA_WITH_AES_128_CCM AES128-CCM
|
||||
RSA_WITH_AES_256_CCM AES256-CCM
|
||||
DHE_RSA_WITH_AES_128_CCM DHE-RSA-AES128-CCM
|
||||
DHE_RSA_WITH_AES_256_CCM DHE-RSA-AES256-CCM
|
||||
RSA_WITH_AES_128_CCM_8 AES128-CCM8
|
||||
RSA_WITH_AES_256_CCM_8 AES256-CCM8
|
||||
DHE_RSA_WITH_AES_128_CCM_8 DHE-RSA-AES128-CCM8
|
||||
DHE_RSA_WITH_AES_256_CCM_8 DHE-RSA-AES256-CCM8
|
||||
ECDHE_ECDSA_WITH_AES_128_CCM ECDHE-ECDSA-AES128-CCM
|
||||
ECDHE_ECDSA_WITH_AES_256_CCM ECDHE-ECDSA-AES256-CCM
|
||||
ECDHE_ECDSA_WITH_AES_128_CCM_8 ECDHE-ECDSA-AES128-CCM8
|
||||
ECDHE_ECDSA_WITH_AES_256_CCM_8 ECDHE-ECDSA-AES256-CCM8</code></pre>
|
||||
|
||||
<h2 id="ARIA-cipher-suites-from-RFC6209-extending-TLS-v1.2">ARIA cipher suites from RFC6209, extending TLS v1.2</h2>
|
||||
|
||||
<p>Note: the CBC modes mentioned in this RFC are not supported.</p>
|
||||
|
||||
<pre><code>TLS_RSA_WITH_ARIA_128_GCM_SHA256 ARIA128-GCM-SHA256
|
||||
TLS_RSA_WITH_ARIA_256_GCM_SHA384 ARIA256-GCM-SHA384
|
||||
TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 DHE-RSA-ARIA128-GCM-SHA256
|
||||
TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 DHE-RSA-ARIA256-GCM-SHA384
|
||||
TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256 DHE-DSS-ARIA128-GCM-SHA256
|
||||
TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384 DHE-DSS-ARIA256-GCM-SHA384
|
||||
TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 ECDHE-ECDSA-ARIA128-GCM-SHA256
|
||||
TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 ECDHE-ECDSA-ARIA256-GCM-SHA384
|
||||
TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 ECDHE-ARIA128-GCM-SHA256
|
||||
TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 ECDHE-ARIA256-GCM-SHA384
|
||||
TLS_PSK_WITH_ARIA_128_GCM_SHA256 PSK-ARIA128-GCM-SHA256
|
||||
TLS_PSK_WITH_ARIA_256_GCM_SHA384 PSK-ARIA256-GCM-SHA384
|
||||
TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 DHE-PSK-ARIA128-GCM-SHA256
|
||||
TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 DHE-PSK-ARIA256-GCM-SHA384
|
||||
TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 RSA-PSK-ARIA128-GCM-SHA256
|
||||
TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 RSA-PSK-ARIA256-GCM-SHA384</code></pre>
|
||||
|
||||
<h2 id="Camellia-HMAC-Based-cipher-suites-from-RFC6367-extending-TLS-v1.2">Camellia HMAC-Based cipher suites from RFC6367, extending TLS v1.2</h2>
|
||||
|
||||
<pre><code>TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256
|
||||
TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384
|
||||
TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-RSA-CAMELLIA128-SHA256
|
||||
TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-RSA-CAMELLIA256-SHA384</code></pre>
|
||||
|
||||
<h2 id="Pre-shared-keying-PSK-cipher-suites">Pre-shared keying (PSK) cipher suites</h2>
|
||||
|
||||
<pre><code>PSK_WITH_NULL_SHA PSK-NULL-SHA
|
||||
DHE_PSK_WITH_NULL_SHA DHE-PSK-NULL-SHA
|
||||
RSA_PSK_WITH_NULL_SHA RSA-PSK-NULL-SHA
|
||||
|
||||
PSK_WITH_RC4_128_SHA PSK-RC4-SHA
|
||||
PSK_WITH_3DES_EDE_CBC_SHA PSK-3DES-EDE-CBC-SHA
|
||||
PSK_WITH_AES_128_CBC_SHA PSK-AES128-CBC-SHA
|
||||
PSK_WITH_AES_256_CBC_SHA PSK-AES256-CBC-SHA
|
||||
|
||||
DHE_PSK_WITH_RC4_128_SHA DHE-PSK-RC4-SHA
|
||||
DHE_PSK_WITH_3DES_EDE_CBC_SHA DHE-PSK-3DES-EDE-CBC-SHA
|
||||
DHE_PSK_WITH_AES_128_CBC_SHA DHE-PSK-AES128-CBC-SHA
|
||||
DHE_PSK_WITH_AES_256_CBC_SHA DHE-PSK-AES256-CBC-SHA
|
||||
|
||||
RSA_PSK_WITH_RC4_128_SHA RSA-PSK-RC4-SHA
|
||||
RSA_PSK_WITH_3DES_EDE_CBC_SHA RSA-PSK-3DES-EDE-CBC-SHA
|
||||
RSA_PSK_WITH_AES_128_CBC_SHA RSA-PSK-AES128-CBC-SHA
|
||||
RSA_PSK_WITH_AES_256_CBC_SHA RSA-PSK-AES256-CBC-SHA
|
||||
|
||||
PSK_WITH_AES_128_GCM_SHA256 PSK-AES128-GCM-SHA256
|
||||
PSK_WITH_AES_256_GCM_SHA384 PSK-AES256-GCM-SHA384
|
||||
DHE_PSK_WITH_AES_128_GCM_SHA256 DHE-PSK-AES128-GCM-SHA256
|
||||
DHE_PSK_WITH_AES_256_GCM_SHA384 DHE-PSK-AES256-GCM-SHA384
|
||||
RSA_PSK_WITH_AES_128_GCM_SHA256 RSA-PSK-AES128-GCM-SHA256
|
||||
RSA_PSK_WITH_AES_256_GCM_SHA384 RSA-PSK-AES256-GCM-SHA384
|
||||
|
||||
PSK_WITH_AES_128_CBC_SHA256 PSK-AES128-CBC-SHA256
|
||||
PSK_WITH_AES_256_CBC_SHA384 PSK-AES256-CBC-SHA384
|
||||
PSK_WITH_NULL_SHA256 PSK-NULL-SHA256
|
||||
PSK_WITH_NULL_SHA384 PSK-NULL-SHA384
|
||||
DHE_PSK_WITH_AES_128_CBC_SHA256 DHE-PSK-AES128-CBC-SHA256
|
||||
DHE_PSK_WITH_AES_256_CBC_SHA384 DHE-PSK-AES256-CBC-SHA384
|
||||
DHE_PSK_WITH_NULL_SHA256 DHE-PSK-NULL-SHA256
|
||||
DHE_PSK_WITH_NULL_SHA384 DHE-PSK-NULL-SHA384
|
||||
RSA_PSK_WITH_AES_128_CBC_SHA256 RSA-PSK-AES128-CBC-SHA256
|
||||
RSA_PSK_WITH_AES_256_CBC_SHA384 RSA-PSK-AES256-CBC-SHA384
|
||||
RSA_PSK_WITH_NULL_SHA256 RSA-PSK-NULL-SHA256
|
||||
RSA_PSK_WITH_NULL_SHA384 RSA-PSK-NULL-SHA384
|
||||
PSK_WITH_AES_128_GCM_SHA256 PSK-AES128-GCM-SHA256
|
||||
PSK_WITH_AES_256_GCM_SHA384 PSK-AES256-GCM-SHA384
|
||||
|
||||
ECDHE_PSK_WITH_RC4_128_SHA ECDHE-PSK-RC4-SHA
|
||||
ECDHE_PSK_WITH_3DES_EDE_CBC_SHA ECDHE-PSK-3DES-EDE-CBC-SHA
|
||||
ECDHE_PSK_WITH_AES_128_CBC_SHA ECDHE-PSK-AES128-CBC-SHA
|
||||
ECDHE_PSK_WITH_AES_256_CBC_SHA ECDHE-PSK-AES256-CBC-SHA
|
||||
ECDHE_PSK_WITH_AES_128_CBC_SHA256 ECDHE-PSK-AES128-CBC-SHA256
|
||||
ECDHE_PSK_WITH_AES_256_CBC_SHA384 ECDHE-PSK-AES256-CBC-SHA384
|
||||
ECDHE_PSK_WITH_NULL_SHA ECDHE-PSK-NULL-SHA
|
||||
ECDHE_PSK_WITH_NULL_SHA256 ECDHE-PSK-NULL-SHA256
|
||||
ECDHE_PSK_WITH_NULL_SHA384 ECDHE-PSK-NULL-SHA384
|
||||
|
||||
PSK_WITH_CAMELLIA_128_CBC_SHA256 PSK-CAMELLIA128-SHA256
|
||||
PSK_WITH_CAMELLIA_256_CBC_SHA384 PSK-CAMELLIA256-SHA384
|
||||
|
||||
DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 DHE-PSK-CAMELLIA128-SHA256
|
||||
DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 DHE-PSK-CAMELLIA256-SHA384
|
||||
|
||||
RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 RSA-PSK-CAMELLIA128-SHA256
|
||||
RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 RSA-PSK-CAMELLIA256-SHA384
|
||||
|
||||
ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-PSK-CAMELLIA128-SHA256
|
||||
ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-PSK-CAMELLIA256-SHA384
|
||||
|
||||
PSK_WITH_AES_128_CCM PSK-AES128-CCM
|
||||
PSK_WITH_AES_256_CCM PSK-AES256-CCM
|
||||
DHE_PSK_WITH_AES_128_CCM DHE-PSK-AES128-CCM
|
||||
DHE_PSK_WITH_AES_256_CCM DHE-PSK-AES256-CCM
|
||||
PSK_WITH_AES_128_CCM_8 PSK-AES128-CCM8
|
||||
PSK_WITH_AES_256_CCM_8 PSK-AES256-CCM8
|
||||
DHE_PSK_WITH_AES_128_CCM_8 DHE-PSK-AES128-CCM8
|
||||
DHE_PSK_WITH_AES_256_CCM_8 DHE-PSK-AES256-CCM8</code></pre>
|
||||
|
||||
<h2 id="ChaCha20-Poly1305-cipher-suites-extending-TLS-v1.2">ChaCha20-Poly1305 cipher suites, extending TLS v1.2</h2>
|
||||
|
||||
<pre><code>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-RSA-CHACHA20-POLY1305
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-CHACHA20-POLY1305
|
||||
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 DHE-RSA-CHACHA20-POLY1305
|
||||
TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 PSK-CHACHA20-POLY1305
|
||||
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 ECDHE-PSK-CHACHA20-POLY1305
|
||||
TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 DHE-PSK-CHACHA20-POLY1305
|
||||
TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 RSA-PSK-CHACHA20-POLY1305</code></pre>
|
||||
|
||||
<h2 id="TLS-v1.3-cipher-suites">TLS v1.3 cipher suites</h2>
|
||||
|
||||
<pre><code>TLS_AES_128_GCM_SHA256 TLS_AES_128_GCM_SHA256
|
||||
TLS_AES_256_GCM_SHA384 TLS_AES_256_GCM_SHA384
|
||||
TLS_CHACHA20_POLY1305_SHA256 TLS_CHACHA20_POLY1305_SHA256
|
||||
TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_SHA256
|
||||
TLS_AES_128_CCM_8_SHA256 TLS_AES_128_CCM_8_SHA256</code></pre>
|
||||
|
||||
<h2 id="Older-names-used-by-OpenSSL">Older names used by OpenSSL</h2>
|
||||
|
||||
<p>The following names are accepted by older releases:</p>
|
||||
|
||||
<pre><code>SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA EDH-RSA-DES-CBC3-SHA (DHE-RSA-DES-CBC3-SHA)
|
||||
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA EDH-DSS-DES-CBC3-SHA (DHE-DSS-DES-CBC3-SHA)</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Some compiled versions of OpenSSL may not include all the ciphers listed here because some ciphers were excluded at compile time.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Verbose listing of all OpenSSL ciphers including NULL ciphers:</p>
|
||||
|
||||
<pre><code>openssl ciphers -v 'ALL:eNULL'</code></pre>
|
||||
|
||||
<p>Include all ciphers except NULL and anonymous DH then sort by strength:</p>
|
||||
|
||||
<pre><code>openssl ciphers -v 'ALL:!ADH:@STRENGTH'</code></pre>
|
||||
|
||||
<p>Include all ciphers except ones with no encryption (eNULL) or no authentication (aNULL):</p>
|
||||
|
||||
<pre><code>openssl ciphers -v 'ALL:!aNULL'</code></pre>
|
||||
|
||||
<p>Include only 3DES ciphers and then place RSA ciphers last:</p>
|
||||
|
||||
<pre><code>openssl ciphers -v '3DES:+RSA'</code></pre>
|
||||
|
||||
<p>Include all RC4 ciphers but leave out those without authentication:</p>
|
||||
|
||||
<pre><code>openssl ciphers -v 'RC4:!COMPLEMENTOFDEFAULT'</code></pre>
|
||||
|
||||
<p>Include all ciphers with RSA authentication but leave out ciphers without encryption.</p>
|
||||
|
||||
<pre><code>openssl ciphers -v 'RSA:!COMPLEMENTOFALL'</code></pre>
|
||||
|
||||
<p>Set security level to 2 and display all ciphers consistent with level 2:</p>
|
||||
|
||||
<pre><code>openssl ciphers -s -v 'ALL:@SECLEVEL=2'</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man7/ssl.html">ssl(7)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The <b>-V</b> option for the <b>ciphers</b> command was added in OpenSSL 1.0.0.</p>
|
||||
|
||||
<p>The <b>-stdname</b> is only available if OpenSSL is built with tracing enabled (<b>enable-ssl-trace</b> argument to Configure) before OpenSSL 1.1.1.</p>
|
||||
|
||||
<p>The <b>-convert</b> option was added in OpenSSL 1.1.1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
636
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/cms.html
vendored
Normal file
636
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/cms.html
vendored
Normal file
@ -0,0 +1,636 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>cms</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXIT-CODES">EXIT CODES</a></li>
|
||||
<li><a href="#COMPATIBILITY-WITH-PKCS-7-format">COMPATIBILITY WITH PKCS#7 format.</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-cms, cms - CMS utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>cms</b> [<b>-help</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-sign</b>] [<b>-verify</b>] [<b>-cmsout</b>] [<b>-resign</b>] [<b>-data_create</b>] [<b>-data_out</b>] [<b>-digest_create</b>] [<b>-digest_verify</b>] [<b>-compress</b>] [<b>-uncompress</b>] [<b>-EncryptedData_encrypt</b>] [<b>-sign_receipt</b>] [<b>-verify_receipt receipt</b>] [<b>-in filename</b>] [<b>-inform SMIME|PEM|DER</b>] [<b>-rctform SMIME|PEM|DER</b>] [<b>-out filename</b>] [<b>-outform SMIME|PEM|DER</b>] [<b>-stream -indef -noindef</b>] [<b>-noindef</b>] [<b>-content filename</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-print</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-md digest</b>] [<b>-<i>cipher</i></b>] [<b>-nointern</b>] [<b>-noverify</b>] [<b>-nocerts</b>] [<b>-noattr</b>] [<b>-nosmimecap</b>] [<b>-binary</b>] [<b>-crlfeol</b>] [<b>-asciicrlf</b>] [<b>-nodetach</b>] [<b>-certfile file</b>] [<b>-certsout file</b>] [<b>-signer file</b>] [<b>-recip file</b>] [<b>-keyid</b>] [<b>-receipt_request_all</b>] [<b>-receipt_request_first</b>] [<b>-receipt_request_from emailaddress</b>] [<b>-receipt_request_to emailaddress</b>] [<b>-receipt_request_print</b>] [<b>-secretkey key</b>] [<b>-secretkeyid id</b>] [<b>-econtent_type type</b>] [<b>-inkey file</b>] [<b>-keyopt name:parameter</b>] [<b>-passin arg</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>cert.pem...</b>] [<b>-to addr</b>] [<b>-from addr</b>] [<b>-subject subj</b>] [cert.pem]...</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>cms</b> command handles S/MIME v3.1 mail. It can encrypt, decrypt, sign and verify, compress and uncompress S/MIME messages.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>There are fourteen operation options that set the type of operation to be performed. The meaning of the other options varies according to the operation type.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="encrypt"><b>-encrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encrypt mail for the given recipient certificates. Input file is the message to be encrypted. The output file is the encrypted mail in MIME format. The actual CMS type is <B>EnvelopedData<B>.</p>
|
||||
|
||||
<p>Note that no revocation check is done for the recipient cert, so if that key has been compromised, others may be able to decrypt the text.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="decrypt"><b>-decrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Decrypt mail using the supplied certificate and private key. Expects an encrypted mail message in MIME format for the input file. The decrypted mail is written to the output file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="debug_decrypt"><b>-debug_decrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option sets the <b>CMS_DEBUG_DECRYPT</b> flag. This option should be used with caution: see the notes section below.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign"><b>-sign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sign mail using the supplied certificate and private key. Input file is the message to be signed. The signed message in MIME format is written to the output file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>-verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify signed mail. Expects a signed mail message on input and outputs the signed data. Both clear text and opaque signing is supported.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cmsout"><b>-cmsout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Takes an input message and writes out a PEM encoded CMS structure.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="resign"><b>-resign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Resign a message: take an existing message and one or more new signers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="data_create"><b>-data_create</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create a CMS <b>Data</b> type.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="data_out"><b>-data_out</b></dt>
|
||||
<dd>
|
||||
|
||||
<p><b>Data</b> type and output the content.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest_create"><b>-digest_create</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create a CMS <b>DigestedData</b> type.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest_verify"><b>-digest_verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify a CMS <b>DigestedData</b> type and output the content.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="compress"><b>-compress</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create a CMS <b>CompressedData</b> type. OpenSSL must be compiled with <b>zlib</b> support for this option to work, otherwise it will output an error.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="uncompress"><b>-uncompress</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Uncompress a CMS <b>CompressedData</b> type and output the content. OpenSSL must be compiled with <b>zlib</b> support for this option to work, otherwise it will output an error.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="EncryptedData_encrypt"><b>-EncryptedData_encrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encrypt content using supplied symmetric key and algorithm using a CMS <b>EncryptedData</b> type and output the content.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign_receipt"><b>-sign_receipt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate and output a signed receipt for the supplied message. The input message <b>must</b> contain a signed receipt request. Functionality is otherwise similar to the <b>-sign</b> operation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_receipt-receipt"><b>-verify_receipt receipt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify a signed receipt in filename <b>receipt</b>. The input message <b>must</b> contain the original receipt request. Functionality is otherwise similar to the <b>-verify</b> operation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input message to be encrypted or signed or the message to be decrypted or verified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-SMIME-PEM-DER"><b>-inform SMIME|PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format for the CMS structure. The default is <b>SMIME</b> which reads an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to expect PEM and DER format CMS structures instead. This currently only affects the input format of the CMS structure, if no CMS structure is being input (for example with <b>-encrypt</b> or <b>-sign</b>) this option has no effect.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rctform-SMIME-PEM-DER"><b>-rctform SMIME|PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify the format for a signed receipt for use with the <b>-receipt_verify</b> operation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The message text that has been decrypted or verified or the output MIME format message that has been signed or verified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-SMIME-PEM-DER"><b>-outform SMIME|PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format for the CMS structure. The default is <b>SMIME</b> which writes an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to write PEM and DER format CMS structures instead. This currently only affects the output format of the CMS structure, if no CMS structure is being output (for example with <b>-verify</b> or <b>-decrypt</b>) this option has no effect.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="stream--indef--noindef"><b>-stream -indef -noindef</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The <b>-stream</b> and <b>-indef</b> options are equivalent and enable streaming I/O for encoding operations. This permits single pass processing of data without the need to hold the entire contents in memory, potentially supporting very large files. Streaming is automatically set for S/MIME signing with detached data if the output format is <b>SMIME</b> it is currently off by default for all other operations.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noindef"><b>-noindef</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Disable streaming I/O where it would produce and indefinite length constructed encoding. This option currently has no effect. In future streaming will be enabled by default on all relevant operations and this option will disable it.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="content-filename"><b>-content filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies a file containing the detached content, this is only useful with the <b>-verify</b> command. This is only usable if the CMS structure is using the detached signature form where the content is not included. This option will override any content if the input format is S/MIME and it uses the multipart/signed MIME content type.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For the <b>-cmsout</b> operation do not output the parsed CMS structure. This is useful when combined with the <b>-print</b> option or if the syntax of the CMS structure is being checked.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="print"><b>-print</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For the <b>-cmsout</b> operation print out all fields of the CMS structure. This is mainly useful for testing purposes.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file"><b>-CAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted CA certificates, only used with <b>-verify</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-dir"><b>-CApath dir</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A directory containing trusted CA certificates, only used with <b>-verify</b>. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="md-digest"><b>-md digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Digest algorithm to use when signing or resigning. If not present then the default digest algorithm for the signing key will be used (usually SHA1).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher"><b>-<i>cipher</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The encryption algorithm to use. For example triple DES (168 bits) - <b>-des3</b> or 256 bit AES - <b>-aes256</b>. Any standard algorithm name (as used by the EVP_get_cipherbyname() function) can also be used preceded by a dash, for example <b>-aes-128-cbc</b>. See <a href="../man1/enc.html">enc(1)</a> for a list of ciphers supported by your version of OpenSSL.</p>
|
||||
|
||||
<p>If not specified triple DES is used. Only used with <b>-encrypt</b> and <b>-EncryptedData_create</b> commands.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nointern"><b>-nointern</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When verifying a message normally certificates (if any) included in the message are searched for the signing certificate. With this option only the certificates specified in the <b>-certfile</b> option are used. The supplied certificates can still be used as untrusted CAs however.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noverify"><b>-noverify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not verify the signers certificate of a signed message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nocerts"><b>-nocerts</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When signing a message the signer's certificate is normally included with this option it is excluded. This will reduce the size of the signed message but the verifier must have a copy of the signers certificate available locally (passed using the <b>-certfile</b> option for example).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noattr"><b>-noattr</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally when a message is signed a set of attributes are included which include the signing time and supported symmetric algorithms. With this option they are not included.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nosmimecap"><b>-nosmimecap</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Exclude the list of supported algorithms from signed attributes, other options such as signing time and content type are still included.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="binary"><b>-binary</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally the input message is converted to "canonical" format which is effectively using CR and LF as end of line: as required by the S/MIME specification. When this option is present no translation occurs. This is useful when handling binary data which may not be in MIME format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crlfeol"><b>-crlfeol</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally the output file uses a single <b>LF</b> as end of line. When this option is present <b>CRLF</b> is used instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="asciicrlf"><b>-asciicrlf</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When signing use ASCII CRLF format canonicalisation. This strips trailing whitespace from all lines, deletes trailing blank lines at EOF and sets the encapsulated content type. This option is normally used with detached content and an output signature format of DER. This option is not normally needed when verifying as it is enabled automatically if the encapsulated content format is detected.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nodetach"><b>-nodetach</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When signing a message use opaque signing: this form is more resistant to translation by mail relays but it cannot be read by mail agents that do not support S/MIME. Without this option cleartext signing with the MIME type multipart/signed is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certfile-file"><b>-certfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Allows additional certificates to be specified. When signing these will be included with the message. When verifying these will be searched for the signers certificates. The certificates should be in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certsout-file"><b>-certsout file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Any certificates contained in the message are written to <b>file</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signer-file"><b>-signer file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A signing certificate when signing or resigning a message, this option can be used multiple times if more than one signer is required. If a message is being verified then the signers certificates will be written to this file if the verification was successful.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="recip-file"><b>-recip file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When decrypting a message this specifies the recipients certificate. The certificate must match one of the recipients of the message or an error occurs.</p>
|
||||
|
||||
<p>When encrypting a message this option may be used multiple times to specify each recipient. This form <b>must</b> be used if customised parameters are required (for example to specify RSA-OAEP).</p>
|
||||
|
||||
<p>Only certificates carrying RSA, Diffie-Hellman or EC keys are supported by this option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyid"><b>-keyid</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use subject key identifier to identify certificates instead of issuer name and serial number. The supplied certificate <b>must</b> include a subject key identifier extension. Supported by <b>-sign</b> and <b>-encrypt</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="receipt_request_all--receipt_request_first"><b>-receipt_request_all</b>, <b>-receipt_request_first</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For <b>-sign</b> option include a signed receipt request. Indicate requests should be provided by all recipient or first tier recipients (those mailed directly and not from a mailing list). Ignored it <b>-receipt_request_from</b> is included.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="receipt_request_from-emailaddress"><b>-receipt_request_from emailaddress</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For <b>-sign</b> option include a signed receipt request. Add an explicit email address where receipts should be supplied.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="receipt_request_to-emailaddress"><b>-receipt_request_to emailaddress</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Add an explicit email address where signed receipts should be sent to. This option <b>must</b> but supplied if a signed receipt it requested.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="receipt_request_print"><b>-receipt_request_print</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For the <b>-verify</b> operation print out the contents of any signed receipt requests.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="secretkey-key"><b>-secretkey key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify symmetric key to use. The key must be supplied in hex format and be consistent with the algorithm used. Supported by the <b>-EncryptedData_encrypt</b> <b>-EncryptedData_decrypt</b>, <b>-encrypt</b> and <b>-decrypt</b> options. When used with <b>-encrypt</b> or <b>-decrypt</b> the supplied key is used to wrap or unwrap the content encryption key using an AES key in the <b>KEKRecipientInfo</b> type.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="secretkeyid-id"><b>-secretkeyid id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The key identifier for the supplied symmetric key for <b>KEKRecipientInfo</b> type. This option <b>must</b> be present if the <b>-secretkey</b> option is used with <b>-encrypt</b>. With <b>-decrypt</b> operations the <b>id</b> is used to locate the relevant key if it is not supplied then an attempt is used to decrypt any <b>KEKRecipientInfo</b> structures.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="econtent_type-type"><b>-econtent_type type</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the encapsulated content type to <b>type</b> if not supplied the <b>Data</b> type is used. The <b>type</b> argument can be any valid OID name in either text or numerical format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inkey-file"><b>-inkey file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key to use when signing or decrypting. This must match the corresponding certificate. If this option is not specified then the private key must be included in the certificate file specified with the <b>-recip</b> or <b>-signer</b> file. When signing this option can be used multiple times to specify successive keys.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyopt-name:opt"><b>-keyopt name:opt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For signing and encryption this option can be used multiple times to set customised parameters for the preceding key or certificate. It can currently be used to set RSA-PSS for signing, RSA-OAEP for encryption or to modify default parameters for ECDH.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert.pem"><b>cert.pem...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>One or more certificates of message recipients: used when encrypting a message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="to--from--subject"><b>-to, -from, -subject</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The relevant mail headers. These are included outside the signed portion of a message so they may be included manually. If signing then many S/MIME mail clients check the signers certificate's email address matches that specified in the From: address.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set various certificate chain validation options. See the <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The MIME message must be sent without any blank lines between the headers and the output. Some mail programs will automatically add a blank line. Piping the mail directly to sendmail is one way to achieve the correct format.</p>
|
||||
|
||||
<p>The supplied message to be signed or encrypted must include the necessary MIME headers or many S/MIME clients won't display it properly (if at all). You can use the <b>-text</b> option to automatically add plain text headers.</p>
|
||||
|
||||
<p>A "signed and encrypted" message is one where a signed message is then encrypted. This can be produced by encrypting an already signed message: see the examples section.</p>
|
||||
|
||||
<p>This version of the program only allows one signer per message but it will verify multiple signers on received messages. Some S/MIME clients choke if a message contains multiple signers. It is possible to sign messages "in parallel" by signing an already signed message.</p>
|
||||
|
||||
<p>The options <b>-encrypt</b> and <b>-decrypt</b> reflect common usage in S/MIME clients. Strictly speaking these process CMS enveloped data: CMS encrypted data is used for other purposes.</p>
|
||||
|
||||
<p>The <b>-resign</b> option uses an existing message digest when adding a new signer. This means that attributes must be present in at least one existing signer using the same message digest or this operation will fail.</p>
|
||||
|
||||
<p>The <b>-stream</b> and <b>-indef</b> options enable streaming I/O support. As a result the encoding is BER using indefinite length constructed encoding and no longer DER. Streaming is supported for the <b>-encrypt</b> operation and the <b>-sign</b> operation if the content is not detached.</p>
|
||||
|
||||
<p>Streaming is always used for the <b>-sign</b> operation with detached data but since the content is no longer part of the CMS structure the encoding remains DER.</p>
|
||||
|
||||
<p>If the <b>-decrypt</b> option is used without a recipient certificate then an attempt is made to locate the recipient by trying each potential recipient in turn using the supplied private key. To thwart the MMA attack (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) all recipients are tried whether they succeed or not and if no recipients match the message is "decrypted" using a random key which will typically output garbage. The <b>-debug_decrypt</b> option can be used to disable the MMA attack protection and return an error if no recipient can be found: this option should be used with caution. For a fuller description see <a href="../man3/CMS_decrypt.html">CMS_decrypt(3)</a>).</p>
|
||||
|
||||
<h1 id="EXIT-CODES">EXIT CODES</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="pod0">0</dt>
|
||||
<dd>
|
||||
|
||||
<p>The operation was completely successfully.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod1">1</dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred parsing the command options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod2">2</dt>
|
||||
<dd>
|
||||
|
||||
<p>One of the input files could not be read.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod3">3</dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred creating the CMS file or when reading the MIME message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod4">4</dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred decrypting or verifying the message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod5">5</dt>
|
||||
<dd>
|
||||
|
||||
<p>The message was verified correctly but an error occurred writing out the signers certificates.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="COMPATIBILITY-WITH-PKCS-7-format">COMPATIBILITY WITH PKCS#7 format.</h1>
|
||||
|
||||
<p>The <b>smime</b> utility can only process the older <b>PKCS#7</b> format. The <b>cms</b> utility supports Cryptographic Message Syntax format. Use of some features will result in messages which cannot be processed by applications which only support the older format. These are detailed below.</p>
|
||||
|
||||
<p>The use of the <b>-keyid</b> option with <b>-sign</b> or <b>-encrypt</b>.</p>
|
||||
|
||||
<p>The <b>-outform PEM</b> option uses different headers.</p>
|
||||
|
||||
<p>The <b>-compress</b> option.</p>
|
||||
|
||||
<p>The <b>-secretkey</b> option when used with <b>-encrypt</b>.</p>
|
||||
|
||||
<p>The use of PSS with <b>-sign</b>.</p>
|
||||
|
||||
<p>The use of OAEP or non-RSA keys with <b>-encrypt</b>.</p>
|
||||
|
||||
<p>Additionally the <b>-EncryptedData_create</b> and <b>-data_create</b> type cannot be processed by the older <b>smime</b> command.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Create a cleartext signed message:</p>
|
||||
|
||||
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg \
|
||||
-signer mycert.pem</code></pre>
|
||||
|
||||
<p>Create an opaque signed message</p>
|
||||
|
||||
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg -nodetach \
|
||||
-signer mycert.pem</code></pre>
|
||||
|
||||
<p>Create a signed message, include some additional certificates and read the private key from another file:</p>
|
||||
|
||||
<pre><code>openssl cms -sign -in in.txt -text -out mail.msg \
|
||||
-signer mycert.pem -inkey mykey.pem -certfile mycerts.pem</code></pre>
|
||||
|
||||
<p>Create a signed message with two signers, use key identifier:</p>
|
||||
|
||||
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg \
|
||||
-signer mycert.pem -signer othercert.pem -keyid</code></pre>
|
||||
|
||||
<p>Send a signed message under Unix directly to sendmail, including headers:</p>
|
||||
|
||||
<pre><code>openssl cms -sign -in in.txt -text -signer mycert.pem \
|
||||
-from steve@openssl.org -to someone@somewhere \
|
||||
-subject "Signed message" | sendmail someone@somewhere</code></pre>
|
||||
|
||||
<p>Verify a message and extract the signer's certificate if successful:</p>
|
||||
|
||||
<pre><code>openssl cms -verify -in mail.msg -signer user.pem -out signedtext.txt</code></pre>
|
||||
|
||||
<p>Send encrypted mail using triple DES:</p>
|
||||
|
||||
<pre><code>openssl cms -encrypt -in in.txt -from steve@openssl.org \
|
||||
-to someone@somewhere -subject "Encrypted message" \
|
||||
-des3 user.pem -out mail.msg</code></pre>
|
||||
|
||||
<p>Sign and encrypt mail:</p>
|
||||
|
||||
<pre><code>openssl cms -sign -in ml.txt -signer my.pem -text \
|
||||
| openssl cms -encrypt -out mail.msg \
|
||||
-from steve@openssl.org -to someone@somewhere \
|
||||
-subject "Signed and Encrypted message" -des3 user.pem</code></pre>
|
||||
|
||||
<p>Note: the encryption command does not include the <b>-text</b> option because the message being encrypted already has MIME headers.</p>
|
||||
|
||||
<p>Decrypt mail:</p>
|
||||
|
||||
<pre><code>openssl cms -decrypt -in mail.msg -recip mycert.pem -inkey key.pem</code></pre>
|
||||
|
||||
<p>The output from Netscape form signing is a PKCS#7 structure with the detached signature format. You can use this program to verify the signature by line wrapping the base64 encoded structure and surrounding it with:</p>
|
||||
|
||||
<pre><code>-----BEGIN PKCS7-----
|
||||
-----END PKCS7-----</code></pre>
|
||||
|
||||
<p>and using the command,</p>
|
||||
|
||||
<pre><code>openssl cms -verify -inform PEM -in signature.pem -content content.txt</code></pre>
|
||||
|
||||
<p>alternatively you can base64 decode the signature and use</p>
|
||||
|
||||
<pre><code>openssl cms -verify -inform DER -in signature.der -content content.txt</code></pre>
|
||||
|
||||
<p>Create an encrypted message using 128 bit Camellia:</p>
|
||||
|
||||
<pre><code>openssl cms -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem</code></pre>
|
||||
|
||||
<p>Add a signer to an existing message:</p>
|
||||
|
||||
<pre><code>openssl cms -resign -in mail.msg -signer newsign.pem -out mail2.msg</code></pre>
|
||||
|
||||
<p>Sign mail using RSA-PSS:</p>
|
||||
|
||||
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg \
|
||||
-signer mycert.pem -keyopt rsa_padding_mode:pss</code></pre>
|
||||
|
||||
<p>Create encrypted mail using RSA-OAEP:</p>
|
||||
|
||||
<pre><code>openssl cms -encrypt -in plain.txt -out mail.msg \
|
||||
-recip cert.pem -keyopt rsa_padding_mode:oaep</code></pre>
|
||||
|
||||
<p>Use SHA256 KDF with an ECDH certificate:</p>
|
||||
|
||||
<pre><code>openssl cms -encrypt -in plain.txt -out mail.msg \
|
||||
-recip ecdhcert.pem -keyopt ecdh_kdf_md:sha256</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The MIME parser isn't very clever: it seems to handle most messages that I've thrown at it but it may choke on others.</p>
|
||||
|
||||
<p>The code currently will only write out the signer's certificate to a file: if the signer has a separate encryption certificate this must be manually extracted. There should be some heuristic that determines the correct encryption certificate.</p>
|
||||
|
||||
<p>Ideally a database should be maintained of a certificates for each email address.</p>
|
||||
|
||||
<p>The code doesn't currently take note of the permitted symmetric encryption algorithms as supplied in the SMIMECapabilities signed attribute. this means the user has to manually include the correct encryption algorithm. It should store the list of permitted ciphers in a database and only use those.</p>
|
||||
|
||||
<p>No revocation checking is done on the signer's certificate.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The use of multiple <b>-signer</b> options and the <b>-resign</b> command were first added in OpenSSL 1.0.0.</p>
|
||||
|
||||
<p>The <b>keyopt</b> option was added in OpenSSL 1.0.2.</p>
|
||||
|
||||
<p>Support for RSA-OAEP and RSA-PSS was added in OpenSSL 1.0.2.</p>
|
||||
|
||||
<p>The use of non-RSA keys with <b>-encrypt</b> and <b>-decrypt</b> was added in OpenSSL 1.0.2.</p>
|
||||
|
||||
<p>The -no_alt_chains option was added in OpenSSL 1.0.2b.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
170
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/crl.html
vendored
Normal file
170
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/crl.html
vendored
Normal file
@ -0,0 +1,170 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>crl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-crl, crl - CRL utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>crl</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-text</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-nameopt option</b>] [<b>-noout</b>] [<b>-hash</b>] [<b>-issuer</b>] [<b>-lastupdate</b>] [<b>-nextupdate</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>crl</b> command processes CRL files in DER or PEM format.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. <b>DER</b> format is DER encoded CRL structure. <b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out the CRL in text form.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nameopt-option"><b>-nameopt option</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option which determines how the subject or issuer names are displayed. See the description of <b>-nameopt</b> in <a href="../man1/x509.html">x509(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't output the encoded version of the CRL.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hash"><b>-hash</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output a hash of the issuer name. This can be use to lookup CRLs in a directory by issuer name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hash_old"><b>-hash_old</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the "hash" of the CRL issuer name using the older algorithm as used by OpenSSL before version 1.0.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="issuer"><b>-issuer</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the issuer name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="lastupdate"><b>-lastupdate</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the lastUpdate field.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nextupdate"><b>-nextupdate</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the nextUpdate field.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file"><b>-CAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the signature on a CRL by looking up the issuing certificate in <b>file</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-dir"><b>-CApath dir</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the signature on a CRL by looking up the issuing certificate in <b>dir</b>. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The PEM CRL format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN X509 CRL-----
|
||||
-----END X509 CRL-----</code></pre>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Convert a CRL file from PEM to DER:</p>
|
||||
|
||||
<pre><code>openssl crl -in crl.pem -outform DER -out crl.der</code></pre>
|
||||
|
||||
<p>Output the text form of a DER encoded certificate:</p>
|
||||
|
||||
<pre><code>openssl crl -in crl.der -inform DER -text -noout</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>Ideally it should be possible to create a CRL using appropriate options and files too.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/crl2pkcs7.html">crl2pkcs7(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/x509.html">x509(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
119
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/crl2pkcs7.html
vendored
Normal file
119
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/crl2pkcs7.html
vendored
Normal file
@ -0,0 +1,119 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>crl2pkcs7</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-crl2pkcs7, crl2pkcs7 - Create a PKCS#7 structure from a CRL and certificates</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>crl2pkcs7</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-certfile filename</b>] [<b>-nocrl</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>crl2pkcs7</b> command takes an optional CRL and one or more certificates and converts them into a PKCS#7 degenerate "certificates only" structure.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the CRL input format. <b>DER</b> format is DER encoded CRL structure.<b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines. The default format is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the PKCS#7 structure output format. <b>DER</b> format is DER encoded PKCS#7 structure.<b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines. The default format is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a CRL from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the output filename to write the PKCS#7 structure to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certfile-filename"><b>-certfile filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies a filename containing one or more certificates in <b>PEM</b> format. All certificates in the file will be added to the PKCS#7 structure. This option can be used more than once to read certificates form multiple files.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nocrl"><b>-nocrl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally a CRL is included in the output file. With this option no CRL is included in the output file and a CRL is not read from the input file.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Create a PKCS#7 structure from a certificate and CRL:</p>
|
||||
|
||||
<pre><code>openssl crl2pkcs7 -in crl.pem -certfile cert.pem -out p7.pem</code></pre>
|
||||
|
||||
<p>Creates a PKCS#7 structure in DER format with no CRL from several different certificates:</p>
|
||||
|
||||
<pre><code>openssl crl2pkcs7 -nocrl -certfile newcert.pem
|
||||
-certfile demoCA/cacert.pem -outform DER -out p7.der</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The output file is a PKCS#7 signed data structure containing no signers and just certificates and an optional CRL.</p>
|
||||
|
||||
<p>This utility can be used to send certificates and CAs to Netscape as part of the certificate enrollment process. This involves sending the DER encoded output as MIME type application/x-x509-user-cert.</p>
|
||||
|
||||
<p>The <b>PEM</b> encoded form with the header and footer lines removed can be used to install user certificates and CAs in MSIE using the Xenroll control.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/pkcs7.html">pkcs7(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
250
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dgst.html
vendored
Normal file
250
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dgst.html
vendored
Normal file
@ -0,0 +1,250 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>dgst</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-dgst, dgst - perform digest operations</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl dgst</b> [<b>-<i>digest</i></b>] [<b>-help</b>] [<b>-c</b>] [<b>-d</b>] [<b>-list</b>] [<b>-hex</b>] [<b>-binary</b>] [<b>-r</b>] [<b>-out filename</b>] [<b>-sign filename</b>] [<b>-keyform arg</b>] [<b>-passin arg</b>] [<b>-verify filename</b>] [<b>-prverify filename</b>] [<b>-signature filename</b>] [<b>-sigopt nm:v</b>] [<b>-hmac key</b>] [<b>-fips-fingerprint</b>] [<b>-rand file...</b>] [<b>-engine id</b>] [<b>-engine_impl</b>] [<b>file...</b>]</p>
|
||||
|
||||
<p><b>openssl</b> <i>digest</i> [<b>...</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The digest functions output the message digest of a supplied file or files in hexadecimal. The digest functions also generate and verify digital signatures using message digests.</p>
|
||||
|
||||
<p>The generic name, <b>dgst</b>, may be used with an option specifying the algorithm to be used. The default digest is <i>sha256</i>. A supported <i>digest</i> name may also be used as the command name. To see the list of supported algorithms, use the <i>list --digest-commands</i> command.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest"><b>-<i>digest</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies name of a supported digest to be used. To see the list of supported digests, use the command <i>list --digest-commands</i>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="c"><b>-c</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out the digest in two digit groups separated by colons, only relevant if <b>hex</b> format output is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="d"><b>-d</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out BIO debugging information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="list"><b>-list</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out a list of supported message digests.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hex"><b>-hex</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Digest is to be output as a hex dump. This is the default case for a "normal" digest as opposed to a digital signature. See NOTES below for digital signatures using <b>-hex</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="binary"><b>-binary</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the digest or signature in binary form.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="r"><b>-r</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the digest in the "coreutils" format, including newlines. Used by programs like <b>sha1sum</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Filename to output to, or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign-filename"><b>-sign filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Digitally sign the digest using the private key in "filename". Note this option does not support Ed25519 or Ed448 private keys. Use the <b>pkeyutl</b> command instead for this.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-arg"><b>-keyform arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the key format to sign digest with. The DER, PEM, P12, and ENGINE formats are supported.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify-filename"><b>-verify filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the signature using the public key in "filename". The output is either "Verification OK" or "Verification Failure".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="prverify-filename"><b>-prverify filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the signature using the private key in "filename".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signature-filename"><b>-signature filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The actual signature to verify.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hmac-key"><b>-hmac key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create a hashed MAC using "key".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="mac-alg"><b>-mac alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create MAC (keyed Message Authentication Code). The most popular MAC algorithm is HMAC (hash-based MAC), but there are other MAC algorithms which are not based on hash, for instance <b>gost-mac</b> algorithm, supported by <b>ccgost</b> engine. MAC keys and other options should be set via <b>-macopt</b> parameter.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="macopt-nm:v"><b>-macopt nm:v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Passes options to MAC algorithm, specified by <b>-mac</b> key. Following options are supported by both by <b>HMAC</b> and <b>gost-mac</b>:</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="key:string"><b>key:string</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies MAC key as alphanumeric string (use if key contain printable characters only). String length must conform to any restrictions of the MAC algorithm for example exactly 32 chars for gost-mac.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hexkey:string"><b>hexkey:string</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies MAC key in hexadecimal form (two hex digits per byte). Key length must conform to any restrictions of the MAC algorithm for example exactly 32 chars for gost-mac.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="fips-fingerprint"><b>-fips-fingerprint</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Compute HMAC using a specific key for certain OpenSSL-FIPS operations.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use engine <b>id</b> for operations (including private key storage). This engine is not used as source for digest algorithms, unless it is also specified in the configuration file or <b>-engine_impl</b> is also specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine_impl"><b>-engine_impl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When used with the <b>-engine</b> option, it specifies to also use engine <b>id</b> for digest operations.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="file"><b>file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File or files to digest. If no files are specified then standard input is used.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>To create a hex-encoded message digest of a file: openssl dgst -md5 -hex file.txt</p>
|
||||
|
||||
<p>To sign a file using SHA-256 with binary file output: openssl dgst -sha256 -sign privatekey.pem -out signature.sign file.txt</p>
|
||||
|
||||
<p>To verify a signature: openssl dgst -sha256 -verify publickey.pem \ -signature signature.sign \ file.txt</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The digest mechanisms that are available will depend on the options used when building OpenSSL. The <b>list digest-commands</b> command can be used to list them.</p>
|
||||
|
||||
<p>New or agile applications should use probably use SHA-256. Other digests, particularly SHA-1 and MD5, are still widely used for interoperating with existing formats and protocols.</p>
|
||||
|
||||
<p>When signing a file, <b>dgst</b> will automatically determine the algorithm (RSA, ECC, etc) to use for signing based on the private key's ASN.1 info. When verifying signatures, it only handles the RSA, DSA, or ECDSA signature itself, not the related data to identify the signer and algorithm used in formats such as x.509, CMS, and S/MIME.</p>
|
||||
|
||||
<p>A source of random numbers is required for certain signing algorithms, in particular ECDSA and DSA.</p>
|
||||
|
||||
<p>The signing and verify options should only be used if a single file is being signed or verified.</p>
|
||||
|
||||
<p>Hex signatures cannot be verified using <b>openssl</b>. Instead, use "xxd -r" or similar program to transform the hex signature into a binary signature prior to verification.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0. The FIPS-related options were removed in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
170
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dhparam.html
vendored
Normal file
170
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dhparam.html
vendored
Normal file
@ -0,0 +1,170 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>dhparam</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#WARNINGS">WARNINGS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-dhparam, dhparam - DH parameter manipulation and generation</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl dhparam</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-in</b> <i>filename</i>] [<b>-out</b> <i>filename</i>] [<b>-dsaparam</b>] [<b>-check</b>] [<b>-noout</b>] [<b>-text</b>] [<b>-C</b>] [<b>-2</b>] [<b>-5</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<i>numbits</i>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This command is used to manipulate DH parameter files.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with the PKCS#3 DHparameter structure. The PEM form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in</b> <i>filename</i></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read parameters from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out</b> <i>filename</i></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dsaparam"><b>-dsaparam</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is used, DSA rather than DH parameters are read or created; they are converted to DH format. Otherwise, "strong" primes (such that (p-1)/2 is also prime) will be used for DH parameter generation.</p>
|
||||
|
||||
<p>DH parameter generation with the <b>-dsaparam</b> option is much faster, and the recommended exponent length is shorter, which makes DH key exchange more efficient. Beware that with such DSA-style DH parameters, a fresh DH key should be created for each use to avoid small-subgroup attacks that may be possible otherwise.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="check"><b>-check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Performs numerous checks to see if the supplied parameters are valid and displays a warning if not.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-2--5"><b>-2</b>, <b>-5</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The generator to use, either 2 or 5. If present then the input file is ignored and parameters are generated instead. If not present but <b>numbits</b> is present, parameters are generated with the default generator 2.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="numbits"><i>numbits</i></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option specifies that a parameter set should be generated of size <i>numbits</i>. It must be the last option. If this option is present then the input file is ignored and parameters are generated instead. If this option is not present but a generator (<b>-2</b> or <b>-5</b>) is present, parameters are generated with a default length of 2048 bits.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option inhibits the output of the encoded version of the parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prints out the DH parameters in human readable form.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="C"><b>-C</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option converts the parameters into C code. The parameters can then be loaded by calling the get_dhNNNN() function.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>dhparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="WARNINGS">WARNINGS</h1>
|
||||
|
||||
<p>The program <b>dhparam</b> combines the functionality of the programs <b>dh</b> and <b>gendh</b> in previous versions of OpenSSL. The <b>dh</b> and <b>gendh</b> programs are retained for now but may have different purposes in future versions of OpenSSL.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>PEM format DH parameters use the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN DH PARAMETERS-----
|
||||
-----END DH PARAMETERS-----</code></pre>
|
||||
|
||||
<p>OpenSSL currently only supports the older PKCS#3 DH, not the newer X9.42 DH.</p>
|
||||
|
||||
<p>This program manipulates DH parameters not keys.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>There should be a way to generate and manipulate DH keys.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/dsaparam.html">dsaparam(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
178
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dsa.html
vendored
Normal file
178
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dsa.html
vendored
Normal file
@ -0,0 +1,178 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>dsa</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-dsa, dsa - DSA key processing</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>dsa</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-modulus</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>dsa</b> command processes DSA keys. They can be converted between various forms and their components printed out. <b>Note</b> This command uses the traditional SSLeay compatible format for private key encryption: newer applications should use the more secure PKCS#8 format using the <b>pkcs8</b></p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option with a private key uses an ASN1 DER encoded form of an ASN.1 SEQUENCE consisting of the values of version (currently zero), p, q, g, the public and private key components respectively as ASN.1 INTEGERs. When used with a public key it uses a SubjectPublicKeyInfo structure: it is an error if the key is not DSA.</p>
|
||||
|
||||
<p>The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines. In the case of a private key PKCS#8 format is also accepted.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write a key to or standard output by is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-arg"><b>-passout arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options encrypt the private key with the specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the <b>dsa</b> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the public, private key components and parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prevents output of the encoded version of the key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="modulus"><b>-modulus</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prints out the value of the public key component of the key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubin"><b>-pubin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default, a private key is read from the input file. With this option a public key is read instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubout"><b>-pubout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default, a private key is output. With this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>dsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The PEM private key format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN DSA PRIVATE KEY-----
|
||||
-----END DSA PRIVATE KEY-----</code></pre>
|
||||
|
||||
<p>The PEM public key format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN PUBLIC KEY-----
|
||||
-----END PUBLIC KEY-----</code></pre>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>To remove the pass phrase on a DSA private key:</p>
|
||||
|
||||
<pre><code>openssl dsa -in key.pem -out keyout.pem</code></pre>
|
||||
|
||||
<p>To encrypt a private key using triple DES:</p>
|
||||
|
||||
<pre><code>openssl dsa -in key.pem -des3 -out keyout.pem</code></pre>
|
||||
|
||||
<p>To convert a private key from PEM to DER format:</p>
|
||||
|
||||
<pre><code>openssl dsa -in key.pem -outform DER -out keyout.der</code></pre>
|
||||
|
||||
<p>To print out the components of a private key to standard output:</p>
|
||||
|
||||
<pre><code>openssl dsa -in key.pem -text -noout</code></pre>
|
||||
|
||||
<p>To just output the public part of a private key:</p>
|
||||
|
||||
<pre><code>openssl dsa -in key.pem -pubout -out pubkey.pem</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/dsaparam.html">dsaparam(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
144
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dsaparam.html
vendored
Normal file
144
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/dsaparam.html
vendored
Normal file
@ -0,0 +1,144 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>dsaparam</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-dsaparam, dsaparam - DSA parameter manipulation and generation</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl dsaparam</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-text</b>] [<b>-C</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-genkey</b>] [<b>-engine id</b>] [<b>numbits</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This command is used to manipulate or generate DSA parameter files.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with RFC2459 (PKIX) DSS-Parms that is a SEQUENCE consisting of p, q and g respectively. The PEM form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read parameters from or standard input if this option is not specified. If the <b>numbits</b> parameter is included then this option will be ignored.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option inhibits the output of the encoded version of the parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prints out the DSA parameters in human readable form.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="C"><b>-C</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option converts the parameters into C code. The parameters can then be loaded by calling the get_dsaXXX() function.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="genkey"><b>-genkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option will generate a DSA either using the specified or generated parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="numbits"><b>numbits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option specifies that a parameter set should be generated of size <b>numbits</b>. It must be the last option. If this option is included then the input file (if any) is ignored.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>dsaparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>PEM format DSA parameters use the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN DSA PARAMETERS-----
|
||||
-----END DSA PARAMETERS-----</code></pre>
|
||||
|
||||
<p>DSA parameter generation is a slow process and as a result the same set of DSA parameters is often used to generate several distinct keys.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
198
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ec.html
vendored
Normal file
198
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ec.html
vendored
Normal file
@ -0,0 +1,198 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ec</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-ec, ec - EC key processing</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>ec</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-param_out</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-conv_form arg</b>] [<b>-param_enc arg</b>] [<b>-no_public</b>] [<b>-check</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>ec</b> command processes EC keys. They can be converted between various forms and their components printed out. <b>Note</b> OpenSSL uses the private key format specified in 'SEC 1: Elliptic Curve Cryptography' (http://www.secg.org/). To convert an OpenSSL EC private key into the PKCS#8 private key format use the <b>pkcs8</b> command.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option with a private key uses an ASN.1 DER encoded SEC1 private key. When used with a public key it uses the SubjectPublicKeyInfo structure as specified in RFC 3280. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines. In the case of a private key PKCS#8 format is also accepted.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write a key to or standard output by is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-arg"><b>-passout arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="des--des3--idea"><b>-des|-des3|-idea</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options encrypt the private key with the DES, triple DES, IDEA or any other cipher supported by OpenSSL before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the <b>ec</b> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the public, private key components and parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prevents output of the encoded version of the key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubin"><b>-pubin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default, a private key is read from the input file. With this option a public key is read instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubout"><b>-pubout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default a private key is output. With this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="conv_form"><b>-conv_form</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies how the points on the elliptic curve are converted into octet strings. Possible values are: <b>compressed</b> (the default value), <b>uncompressed</b> and <b>hybrid</b>. For more information regarding the point conversion forms please read the X9.62 standard. <b>Note</b> Due to patent issues the <b>compressed</b> option is disabled by default for binary curves and can be enabled by defining the preprocessor macro <b>OPENSSL_EC_BIN_PT_COMP</b> at compile time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="param_enc-arg"><b>-param_enc arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies how the elliptic curve parameters are encoded. Possible value are: <b>named_curve</b>, i.e. the ec parameters are specified by an OID, or <b>explicit</b> where the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures). The default value is <b>named_curve</b>. <b>Note</b> the <b>implicitlyCA</b> alternative, as specified in RFC 3279, is currently not implemented in OpenSSL.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_public"><b>-no_public</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option omits the public key components from the private key output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="check"><b>-check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option checks the consistency of an EC private or public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ec</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The PEM private key format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN EC PRIVATE KEY-----
|
||||
-----END EC PRIVATE KEY-----</code></pre>
|
||||
|
||||
<p>The PEM public key format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN PUBLIC KEY-----
|
||||
-----END PUBLIC KEY-----</code></pre>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>To encrypt a private key using triple DES:</p>
|
||||
|
||||
<pre><code>openssl ec -in key.pem -des3 -out keyout.pem</code></pre>
|
||||
|
||||
<p>To convert a private key from PEM to DER format:</p>
|
||||
|
||||
<pre><code>openssl ec -in key.pem -outform DER -out keyout.der</code></pre>
|
||||
|
||||
<p>To print out the components of a private key to standard output:</p>
|
||||
|
||||
<pre><code>openssl ec -in key.pem -text -noout</code></pre>
|
||||
|
||||
<p>To just output the public part of a private key:</p>
|
||||
|
||||
<pre><code>openssl ec -in key.pem -pubout -out pubkey.pem</code></pre>
|
||||
|
||||
<p>To change the parameters encoding to <b>explicit</b>:</p>
|
||||
|
||||
<pre><code>openssl ec -in key.pem -param_enc explicit -out keyout.pem</code></pre>
|
||||
|
||||
<p>To change the point conversion form to <b>compressed</b>:</p>
|
||||
|
||||
<pre><code>openssl ec -in key.pem -conv_form compressed -out keyout.pem</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/ecparam.html">ecparam(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2003-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
201
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ecparam.html
vendored
Normal file
201
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ecparam.html
vendored
Normal file
@ -0,0 +1,201 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ecparam</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-ecparam, ecparam - EC parameter manipulation and generation</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl ecparam</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-text</b>] [<b>-C</b>] [<b>-check</b>] [<b>-name arg</b>] [<b>-list_curves</b>] [<b>-conv_form arg</b>] [<b>-param_enc arg</b>] [<b>-no_seed</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-genkey</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This command is used to manipulate or generate EC parameter files.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option uses an ASN.1 DER encoded form compatible with RFC 3279 EcpkParameters. The PEM form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read parameters from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option inhibits the output of the encoded version of the parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prints out the EC parameters in human readable form.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="C"><b>-C</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option converts the EC parameters into C code. The parameters can then be loaded by calling the get_ec_group_XXX() function.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="check"><b>-check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Validate the elliptic curve parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="name-arg"><b>-name arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the EC parameters with the specified 'short' name. Use <b>-list_curves</b> to get a list of all currently implemented EC parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="list_curves"><b>-list_curves</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this options is specified <b>ecparam</b> will print out a list of all currently implemented EC parameters names and exit.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="conv_form"><b>-conv_form</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies how the points on the elliptic curve are converted into octet strings. Possible values are: <b>compressed</b>, <b>uncompressed</b> (the default value) and <b>hybrid</b>. For more information regarding the point conversion forms please read the X9.62 standard. <b>Note</b> Due to patent issues the <b>compressed</b> option is disabled by default for binary curves and can be enabled by defining the preprocessor macro <b>OPENSSL_EC_BIN_PT_COMP</b> at compile time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="param_enc-arg"><b>-param_enc arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies how the elliptic curve parameters are encoded. Possible value are: <b>named_curve</b>, i.e. the ec parameters are specified by an OID, or <b>explicit</b> where the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures). The default value is <b>named_curve</b>. <b>Note</b> the <b>implicitlyCA</b> alternative, as specified in RFC 3279, is currently not implemented in OpenSSL.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_seed"><b>-no_seed</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option inhibits that the 'seed' for the parameter generation is included in the ECParameters structure (see RFC 3279).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="genkey"><b>-genkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option will generate an EC private key using the specified parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ecparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>PEM format EC parameters use the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN EC PARAMETERS-----
|
||||
-----END EC PARAMETERS-----</code></pre>
|
||||
|
||||
<p>OpenSSL is currently not able to generate new groups and therefore <b>ecparam</b> can only create EC parameters from known (named) curves.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>To create EC parameters with the group 'prime192v1':</p>
|
||||
|
||||
<pre><code>openssl ecparam -out ec_param.pem -name prime192v1</code></pre>
|
||||
|
||||
<p>To create EC parameters with explicit parameters:</p>
|
||||
|
||||
<pre><code>openssl ecparam -out ec_param.pem -name prime192v1 -param_enc explicit</code></pre>
|
||||
|
||||
<p>To validate given EC parameters:</p>
|
||||
|
||||
<pre><code>openssl ecparam -in ec_param.pem -check</code></pre>
|
||||
|
||||
<p>To create EC parameters and a private key:</p>
|
||||
|
||||
<pre><code>openssl ecparam -out ec_key.pem -name prime192v1 -genkey</code></pre>
|
||||
|
||||
<p>To change the point encoding to 'compressed':</p>
|
||||
|
||||
<pre><code>openssl ecparam -in ec_in.pem -out ec_out.pem -conv_form compressed</code></pre>
|
||||
|
||||
<p>To print out the EC parameters to standard output:</p>
|
||||
|
||||
<pre><code>openssl ecparam -in ec_param.pem -noout -text</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/ec.html">ec(1)</a>, <a href="../man1/dsaparam.html">dsaparam(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2003-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
412
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/enc.html
vendored
Normal file
412
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/enc.html
vendored
Normal file
@ -0,0 +1,412 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>enc</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SUPPORTED-CIPHERS">SUPPORTED CIPHERS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-enc, enc - symmetric cipher routines</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl enc -<i>cipher</i></b> [<b>-help</b>] [<b>-list</b>] [<b>-ciphers</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-pass arg</b>] [<b>-e</b>] [<b>-d</b>] [<b>-a</b>] [<b>-base64</b>] [<b>-A</b>] [<b>-k password</b>] [<b>-kfile filename</b>] [<b>-K key</b>] [<b>-iv IV</b>] [<b>-S salt</b>] [<b>-salt</b>] [<b>-nosalt</b>] [<b>-z</b>] [<b>-md digest</b>] [<b>-iter count</b>] [<b>-pbkdf2</b>] [<b>-p</b>] [<b>-P</b>] [<b>-bufsize number</b>] [<b>-nopad</b>] [<b>-debug</b>] [<b>-none</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<p><b>openssl</b> <i>[cipher]</i> [<b>...</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The symmetric cipher commands allow data to be encrypted or decrypted using various block and stream ciphers using keys based on passwords or explicitly provided. Base64 encoding or decoding can also be performed either by itself or in addition to the encryption or decryption.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="list"><b>-list</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>List all supported ciphers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ciphers"><b>-ciphers</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Alias of -list to display all supported ciphers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input filename, standard input by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output filename, standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pass-arg"><b>-pass arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="e"><b>-e</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encrypt the input data: this is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="d"><b>-d</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Decrypt the input data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="a"><b>-a</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Base64 process the data. This means that if encryption is taking place the data is base64 encoded after encryption. If decryption is set then the input data is base64 decoded before being decrypted.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="base64"><b>-base64</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Same as <b>-a</b></p>
|
||||
|
||||
</dd>
|
||||
<dt id="A"><b>-A</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If the <b>-a</b> option is set then base64 process the data on one line.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="k-password"><b>-k password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The password to derive the key from. This is for compatibility with previous versions of OpenSSL. Superseded by the <b>-pass</b> argument.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kfile-filename"><b>-kfile filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Read the password to derive the key from the first line of <b>filename</b>. This is for compatibility with previous versions of OpenSSL. Superseded by the <b>-pass</b> argument.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="md-digest"><b>-md digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the specified digest to create the key from the passphrase. The default algorithm is sha-256.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="iter-count"><b>-iter count</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use a given number of iterations on the password in deriving the encryption key. High values increase the time required to brute-force the resulting file. This option enables the use of PBKDF2 algorithm to derive the key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pbkdf2"><b>-pbkdf2</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use PBKDF2 algorithm with default iteration count unless otherwise specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nosalt"><b>-nosalt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't use a salt in the key derivation routines. This option <b>SHOULD NOT</b> be used except for test purposes or compatibility with ancient versions of OpenSSL.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="salt"><b>-salt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use salt (randomly generated or provide with <b>-S</b> option) when encrypting, this is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="S-salt"><b>-S salt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The actual salt to use: this must be represented as a string of hex digits.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="K-key"><b>-K key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The actual key to use: this must be represented as a string comprised only of hex digits. If only the key is specified, the IV must additionally specified using the <b>-iv</b> option. When both a key and a password are specified, the key given with the <b>-K</b> option will be used and the IV generated from the password will be taken. It does not make much sense to specify both key and password.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="iv-IV"><b>-iv IV</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The actual IV to use: this must be represented as a string comprised only of hex digits. When only the key is specified using the <b>-K</b> option, the IV must explicitly be defined. When a password is being specified using one of the other options, the IV is generated from this password.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="p"><b>-p</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out the key and IV used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="P"><b>-P</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out the key and IV used then immediately exit: don't do any encryption or decryption.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bufsize-number"><b>-bufsize number</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the buffer size for I/O.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nopad"><b>-nopad</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Disable standard block padding.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="debug"><b>-debug</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Debug the BIOs used for I/O.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="z"><b>-z</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Compress or decompress clear text using zlib before encryption or after decryption. This option exists only if OpenSSL with compiled with zlib or zlib-dynamic option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="none"><b>-none</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use NULL cipher (no encryption or decryption of input).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The program can be called either as <b>openssl cipher</b> or <b>openssl enc -cipher</b>. The first form doesn't work with engine-provided ciphers, because this form is processed before the configuration file is read and any ENGINEs loaded. Use the <b>list</b> command to get a list of supported ciphers.</p>
|
||||
|
||||
<p>Engines which provide entirely new encryption algorithms (such as the ccgost engine which provides gost89 algorithm) should be configured in the configuration file. Engines specified on the command line using -engine options can only be used for hardware-assisted implementations of ciphers which are supported by the OpenSSL core or another engine specified in the configuration file.</p>
|
||||
|
||||
<p>When the enc command lists supported ciphers, ciphers provided by engines, specified in the configuration files are listed too.</p>
|
||||
|
||||
<p>A password will be prompted for to derive the key and IV if necessary.</p>
|
||||
|
||||
<p>The <b>-salt</b> option should <b>ALWAYS</b> be used if the key is being derived from a password unless you want compatibility with previous versions of OpenSSL.</p>
|
||||
|
||||
<p>Without the <b>-salt</b> option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data. The reason for this is that without the salt the same password always generates the same encryption key. When the salt is being used the first eight bytes of the encrypted data are reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted.</p>
|
||||
|
||||
<p>Some of the ciphers do not have large keys and others have security implications if not used correctly. A beginner is advised to just use a strong block cipher, such as AES, in CBC mode.</p>
|
||||
|
||||
<p>All the block ciphers normally use PKCS#5 padding, also known as standard block padding. This allows a rudimentary integrity or password check to be performed. However since the chance of random data passing the test is better than 1 in 256 it isn't a very good test.</p>
|
||||
|
||||
<p>If padding is disabled then the input data must be a multiple of the cipher block length.</p>
|
||||
|
||||
<p>All RC2 ciphers have the same key and effective key length.</p>
|
||||
|
||||
<p>Blowfish and RC5 algorithms use a 128 bit key.</p>
|
||||
|
||||
<h1 id="SUPPORTED-CIPHERS">SUPPORTED CIPHERS</h1>
|
||||
|
||||
<p>Note that some of these ciphers can be disabled at compile time and some are available only if an appropriate engine is configured in the configuration file. The output of the <b>enc</b> command run with the <b>-ciphers</b> option (that is <b>openssl enc -ciphers</b>) produces a list of ciphers, supported by your version of OpenSSL, including ones provided by configured engines.</p>
|
||||
|
||||
<p>The <b>enc</b> program does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the future. The <b>enc</b> interface by necessity must begin streaming output (e.g., to standard output when <b>-out</b> is not used) before the authentication tag could be validated, leading to the usage of <b>enc</b> in pipelines that begin processing untrusted data and are not capable of rolling back upon authentication failure. The AEAD modes currently in common use also suffer from catastrophic failure of confidentiality and/or integrity upon reuse of key/iv/nonce, and since <b>enc</b> places the entire burden of key/iv/nonce management upon the user, the risk of exposing AEAD modes is too great to allow. These key/iv/nonce management issues also affect other modes currently exposed in <b>enc</b>, but the failure modes are less extreme in these cases, and the functionality cannot be removed with a stable release branch. For bulk encryption of data, whether using authenticated encryption modes or other modes, <a href="../man1/cms.html">cms(1)</a> is recommended, as it provides a standard data format and performs the needed key/iv/nonce management.</p>
|
||||
|
||||
<pre><code>base64 Base 64
|
||||
|
||||
bf-cbc Blowfish in CBC mode
|
||||
bf Alias for bf-cbc
|
||||
blowfish Alias for bf-cbc
|
||||
bf-cfb Blowfish in CFB mode
|
||||
bf-ecb Blowfish in ECB mode
|
||||
bf-ofb Blowfish in OFB mode
|
||||
|
||||
cast-cbc CAST in CBC mode
|
||||
cast Alias for cast-cbc
|
||||
cast5-cbc CAST5 in CBC mode
|
||||
cast5-cfb CAST5 in CFB mode
|
||||
cast5-ecb CAST5 in ECB mode
|
||||
cast5-ofb CAST5 in OFB mode
|
||||
|
||||
chacha20 ChaCha20 algorithm
|
||||
|
||||
des-cbc DES in CBC mode
|
||||
des Alias for des-cbc
|
||||
des-cfb DES in CFB mode
|
||||
des-ofb DES in OFB mode
|
||||
des-ecb DES in ECB mode
|
||||
|
||||
des-ede-cbc Two key triple DES EDE in CBC mode
|
||||
des-ede Two key triple DES EDE in ECB mode
|
||||
des-ede-cfb Two key triple DES EDE in CFB mode
|
||||
des-ede-ofb Two key triple DES EDE in OFB mode
|
||||
|
||||
des-ede3-cbc Three key triple DES EDE in CBC mode
|
||||
des-ede3 Three key triple DES EDE in ECB mode
|
||||
des3 Alias for des-ede3-cbc
|
||||
des-ede3-cfb Three key triple DES EDE CFB mode
|
||||
des-ede3-ofb Three key triple DES EDE in OFB mode
|
||||
|
||||
desx DESX algorithm.
|
||||
|
||||
gost89 GOST 28147-89 in CFB mode (provided by ccgost engine)
|
||||
gost89-cnt `GOST 28147-89 in CNT mode (provided by ccgost engine)
|
||||
|
||||
idea-cbc IDEA algorithm in CBC mode
|
||||
idea same as idea-cbc
|
||||
idea-cfb IDEA in CFB mode
|
||||
idea-ecb IDEA in ECB mode
|
||||
idea-ofb IDEA in OFB mode
|
||||
|
||||
rc2-cbc 128 bit RC2 in CBC mode
|
||||
rc2 Alias for rc2-cbc
|
||||
rc2-cfb 128 bit RC2 in CFB mode
|
||||
rc2-ecb 128 bit RC2 in ECB mode
|
||||
rc2-ofb 128 bit RC2 in OFB mode
|
||||
rc2-64-cbc 64 bit RC2 in CBC mode
|
||||
rc2-40-cbc 40 bit RC2 in CBC mode
|
||||
|
||||
rc4 128 bit RC4
|
||||
rc4-64 64 bit RC4
|
||||
rc4-40 40 bit RC4
|
||||
|
||||
rc5-cbc RC5 cipher in CBC mode
|
||||
rc5 Alias for rc5-cbc
|
||||
rc5-cfb RC5 cipher in CFB mode
|
||||
rc5-ecb RC5 cipher in ECB mode
|
||||
rc5-ofb RC5 cipher in OFB mode
|
||||
|
||||
seed-cbc SEED cipher in CBC mode
|
||||
seed Alias for seed-cbc
|
||||
seed-cfb SEED cipher in CFB mode
|
||||
seed-ecb SEED cipher in ECB mode
|
||||
seed-ofb SEED cipher in OFB mode
|
||||
|
||||
sm4-cbc SM4 cipher in CBC mode
|
||||
sm4 Alias for sm4-cbc
|
||||
sm4-cfb SM4 cipher in CFB mode
|
||||
sm4-ctr SM4 cipher in CTR mode
|
||||
sm4-ecb SM4 cipher in ECB mode
|
||||
sm4-ofb SM4 cipher in OFB mode
|
||||
|
||||
aes-[128|192|256]-cbc 128/192/256 bit AES in CBC mode
|
||||
aes[128|192|256] Alias for aes-[128|192|256]-cbc
|
||||
aes-[128|192|256]-cfb 128/192/256 bit AES in 128 bit CFB mode
|
||||
aes-[128|192|256]-cfb1 128/192/256 bit AES in 1 bit CFB mode
|
||||
aes-[128|192|256]-cfb8 128/192/256 bit AES in 8 bit CFB mode
|
||||
aes-[128|192|256]-ctr 128/192/256 bit AES in CTR mode
|
||||
aes-[128|192|256]-ecb 128/192/256 bit AES in ECB mode
|
||||
aes-[128|192|256]-ofb 128/192/256 bit AES in OFB mode
|
||||
|
||||
aria-[128|192|256]-cbc 128/192/256 bit ARIA in CBC mode
|
||||
aria[128|192|256] Alias for aria-[128|192|256]-cbc
|
||||
aria-[128|192|256]-cfb 128/192/256 bit ARIA in 128 bit CFB mode
|
||||
aria-[128|192|256]-cfb1 128/192/256 bit ARIA in 1 bit CFB mode
|
||||
aria-[128|192|256]-cfb8 128/192/256 bit ARIA in 8 bit CFB mode
|
||||
aria-[128|192|256]-ctr 128/192/256 bit ARIA in CTR mode
|
||||
aria-[128|192|256]-ecb 128/192/256 bit ARIA in ECB mode
|
||||
aria-[128|192|256]-ofb 128/192/256 bit ARIA in OFB mode
|
||||
|
||||
camellia-[128|192|256]-cbc 128/192/256 bit Camellia in CBC mode
|
||||
camellia[128|192|256] Alias for camellia-[128|192|256]-cbc
|
||||
camellia-[128|192|256]-cfb 128/192/256 bit Camellia in 128 bit CFB mode
|
||||
camellia-[128|192|256]-cfb1 128/192/256 bit Camellia in 1 bit CFB mode
|
||||
camellia-[128|192|256]-cfb8 128/192/256 bit Camellia in 8 bit CFB mode
|
||||
camellia-[128|192|256]-ctr 128/192/256 bit Camellia in CTR mode
|
||||
camellia-[128|192|256]-ecb 128/192/256 bit Camellia in ECB mode
|
||||
camellia-[128|192|256]-ofb 128/192/256 bit Camellia in OFB mode</code></pre>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Just base64 encode a binary file:</p>
|
||||
|
||||
<pre><code>openssl base64 -in file.bin -out file.b64</code></pre>
|
||||
|
||||
<p>Decode the same file</p>
|
||||
|
||||
<pre><code>openssl base64 -d -in file.b64 -out file.bin</code></pre>
|
||||
|
||||
<p>Encrypt a file using AES-128 using a prompted password and PBKDF2 key derivation:</p>
|
||||
|
||||
<pre><code>openssl enc -aes128 -pbkdf2 -in file.txt -out file.aes128</code></pre>
|
||||
|
||||
<p>Decrypt a file using a supplied password:</p>
|
||||
|
||||
<pre><code>openssl enc -aes128 -pbkdf2 -d -in file.aes128 -out file.txt \
|
||||
-pass pass:<password></code></pre>
|
||||
|
||||
<p>Encrypt a file then base64 encode it (so it can be sent via mail for example) using AES-256 in CTR mode and PBKDF2 key derivation:</p>
|
||||
|
||||
<pre><code>openssl enc -aes-256-ctr -pbkdf2 -a -in file.txt -out file.aes256</code></pre>
|
||||
|
||||
<p>Base64 decode a file then decrypt it using a password supplied in a file:</p>
|
||||
|
||||
<pre><code>openssl enc -aes-256-ctr -pbkdf2 -d -a -in file.aes256 -out file.txt \
|
||||
-pass file:<passfile></code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The <b>-A</b> option when used with large files doesn't work properly.</p>
|
||||
|
||||
<p>The <b>enc</b> program only supports a fixed number of algorithms with certain parameters. So if, for example, you want to use RC2 with a 76 bit key or RC4 with an 84 bit key you can't use this program.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0.</p>
|
||||
|
||||
<p>The <b>-list</b> option was added in OpenSSL 1.1.1e.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
133
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/engine.html
vendored
Normal file
133
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/engine.html
vendored
Normal file
@ -0,0 +1,133 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>engine</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#ENVIRONMENT">ENVIRONMENT</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-engine, engine - load and query engines</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl engine</b> [ <i>engine...</i> ] [<b>-v</b>] [<b>-vv</b>] [<b>-vvv</b>] [<b>-vvv</b>] [<b>-vvv</b>] [<b>-c</b>] [<b>-t</b>] [<b>-tt</b>] [<b>-pre</b> <i>command</i>] [<b>-post</b> <i>command</i>] [ <i>engine...</i> ]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>engine</b> command is used to query the status and capabilities of the specified <b>engine</b>'s. Engines may be specified before and after all other command-line flags. Only those specified are queried.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="v--vv--vvv--vvvv"><b>-v</b> <b>-vv</b> <b>-vvv</b> <b>-vvvv</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Provides information about each specified engine. The first flag lists all the possible run-time control commands; the second adds a description of each command; the third adds the input flags, and the final option adds the internal input flags.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="c"><b>-c</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Lists the capabilities of each engine.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="t"><b>-t</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Tests if each specified engine is available, and displays the answer.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="tt"><b>-tt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Displays an error trace for any unavailable engine.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pre-command"><b>-pre</b> <i>command</i></dt>
|
||||
<dd>
|
||||
|
||||
</dd>
|
||||
<dt id="post-command"><b>-post</b> <i>command</i></dt>
|
||||
<dd>
|
||||
|
||||
<p>Command-line configuration of engines. The <b>-pre</b> command is given to the engine before it is loaded and the <b>-post</b> command is given after the engine is loaded. The <i>command</i> is of the form <i>cmd:val</i> where <i>cmd</i> is the command, and <i>val</i> is the value for the command. See the example below.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>To list all the commands available to a dynamic engine:</p>
|
||||
|
||||
<pre><code>$ openssl engine -t -tt -vvvv dynamic
|
||||
(dynamic) Dynamic engine loading support
|
||||
[ unavailable ]
|
||||
SO_PATH: Specifies the path to the new ENGINE shared library
|
||||
(input flags): STRING
|
||||
NO_VCHECK: Specifies to continue even if version checking fails (boolean)
|
||||
(input flags): NUMERIC
|
||||
ID: Specifies an ENGINE id name for loading
|
||||
(input flags): STRING
|
||||
LIST_ADD: Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)
|
||||
(input flags): NUMERIC
|
||||
DIR_LOAD: Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)
|
||||
(input flags): NUMERIC
|
||||
DIR_ADD: Adds a directory from which ENGINEs can be loaded
|
||||
(input flags): STRING
|
||||
LOAD: Load up the ENGINE specified by other settings
|
||||
(input flags): NO_INPUT</code></pre>
|
||||
|
||||
<p>To list the capabilities of the <i>rsax</i> engine:</p>
|
||||
|
||||
<pre><code>$ openssl engine -c
|
||||
(rsax) RSAX engine support
|
||||
[RSA]
|
||||
(dynamic) Dynamic engine loading support</code></pre>
|
||||
|
||||
<h1 id="ENVIRONMENT">ENVIRONMENT</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="OPENSSL_ENGINES"><b>OPENSSL_ENGINES</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The path to the engines directory.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man5/config.html">config(5)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
64
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/errstr.html
vendored
Normal file
64
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/errstr.html
vendored
Normal file
@ -0,0 +1,64 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>errstr</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-errstr, errstr - lookup error codes</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl errstr error_code</b></p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>Sometimes an application will not load error message and only numerical forms will be available. The <b>errstr</b> utility can be used to display the meaning of the hex code. The hex code is the hex digits after the second colon.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>None.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>The error code:</p>
|
||||
|
||||
<pre><code>27594:error:2006D080:lib(32):func(109):reason(128):bss_file.c:107:</code></pre>
|
||||
|
||||
<p>can be displayed with:</p>
|
||||
|
||||
<pre><code>openssl errstr 2006D080</code></pre>
|
||||
|
||||
<p>to produce the error message:</p>
|
||||
|
||||
<pre><code>error:2006D080:BIO routines:BIO_new_file:no such file</code></pre>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
103
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/gendsa.html
vendored
Normal file
103
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/gendsa.html
vendored
Normal file
@ -0,0 +1,103 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>gendsa</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-gendsa, gendsa - generate a DSA private key from a set of parameters</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>gendsa</b> [<b>-help</b>] [<b>-out filename</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>paramfile</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>gendsa</b> command generates a DSA private key from a DSA parameter file (which will be typically generated by the <b>openssl dsaparam</b> command).</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the key to the specified file. If this argument is not specified then standard output is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options encrypt the private key with specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified no encryption is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>gendsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="paramfile"><b>paramfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option specifies the DSA parameter file to use. The parameters in this file determine the size of the private key. DSA parameters can be generated and examined using the <b>openssl dsaparam</b> command.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>DSA key generation is little more than random number generation so it is much quicker that RSA key generation for example.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/dsaparam.html">dsaparam(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
363
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/genpkey.html
vendored
Normal file
363
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/genpkey.html
vendored
Normal file
@ -0,0 +1,363 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>genpkey</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#KEY-GENERATION-OPTIONS">KEY GENERATION OPTIONS</a>
|
||||
<ul>
|
||||
<li><a href="#RSA-Key-Generation-Options">RSA Key Generation Options</a></li>
|
||||
<li><a href="#RSA-PSS-Key-Generation-Options">RSA-PSS Key Generation Options</a></li>
|
||||
<li><a href="#EC-Key-Generation-Options">EC Key Generation Options</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#PARAMETER-GENERATION-OPTIONS">PARAMETER GENERATION OPTIONS</a>
|
||||
<ul>
|
||||
<li><a href="#DSA-Parameter-Generation-Options">DSA Parameter Generation Options</a></li>
|
||||
<li><a href="#DH-Parameter-Generation-Options">DH Parameter Generation Options</a></li>
|
||||
<li><a href="#EC-Parameter-Generation-Options">EC Parameter Generation Options</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-genpkey, genpkey - generate a private key</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>genpkey</b> [<b>-help</b>] [<b>-out filename</b>] [<b>-outform PEM|DER</b>] [<b>-pass arg</b>] [<b>-<i>cipher</i></b>] [<b>-engine id</b>] [<b>-paramfile file</b>] [<b>-algorithm alg</b>] [<b>-pkeyopt opt:value</b>] [<b>-genparam</b>] [<b>-text</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>genpkey</b> command generates a private key.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the key to the specified file. If this argument is not specified then standard output is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format DER or PEM. The default format is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pass-arg"><b>-pass arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher"><b>-<i>cipher</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option encrypts the private key with the supplied cipher. Any algorithm name accepted by EVP_get_cipherbyname() is acceptable such as <b>des3</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>genpkey</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. If used this option should precede all other options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="algorithm-alg"><b>-algorithm alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Public key algorithm to use such as RSA, DSA or DH. If used this option must precede any <b>-pkeyopt</b> options. The options <b>-paramfile</b> and <b>-algorithm</b> are mutually exclusive. Engines may add algorithms in addition to the standard built-in ones.</p>
|
||||
|
||||
<p>Valid built-in algorithm names for private key generation are RSA, RSA-PSS, EC, X25519, X448, ED25519 and ED448.</p>
|
||||
|
||||
<p>Valid built-in algorithm names for parameter generation (see the <b>-genparam</b> option) are DH, DSA and EC.</p>
|
||||
|
||||
<p>Note that the algorithm name X9.42 DH may be used as a synonym for the DH algorithm. These are identical and do not indicate the type of parameters that will be generated. Use the <b>dh_paramgen_type</b> option to indicate whether PKCS#3 or X9.42 DH parameters are required. See <a href="#DH-Parameter-Generation-Options">"DH Parameter Generation Options"</a> below for more details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkeyopt-opt:value"><b>-pkeyopt opt:value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the public key algorithm option <b>opt</b> to <b>value</b>. The precise set of options supported depends on the public key algorithm used and its implementation. See <a href="#KEY-GENERATION-OPTIONS">"KEY GENERATION OPTIONS"</a> and <a href="#PARAMETER-GENERATION-OPTIONS">"PARAMETER GENERATION OPTIONS"</a> below for more details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="genparam"><b>-genparam</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate a set of parameters instead of a private key. If used this option must precede any <b>-algorithm</b>, <b>-paramfile</b> or <b>-pkeyopt</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="paramfile-filename"><b>-paramfile filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Some public key algorithms generate a private key based on a set of parameters. They can be supplied using this option. If this option is used the public key algorithm used is determined by the parameters. If used this option must precede any <b>-pkeyopt</b> options. The options <b>-paramfile</b> and <b>-algorithm</b> are mutually exclusive.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print an (unencrypted) text representation of private and public keys and parameters along with the PEM or DER structure.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="KEY-GENERATION-OPTIONS">KEY GENERATION OPTIONS</h1>
|
||||
|
||||
<p>The options supported by each algorithm and indeed each implementation of an algorithm can vary. The options for the OpenSSL implementations are detailed below. There are no key generation options defined for the X25519, X448, ED25519 or ED448 algorithms.</p>
|
||||
|
||||
<h2 id="RSA-Key-Generation-Options">RSA Key Generation Options</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="rsa_keygen_bits:numbits"><b>rsa_keygen_bits:numbits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of bits in the generated key. If not specified 2048 is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa_keygen_primes:numprimes"><b>rsa_keygen_primes:numprimes</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of primes in the generated key. If not specified 2 is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa_keygen_pubexp:value"><b>rsa_keygen_pubexp:value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The RSA public exponent value. This can be a large decimal or hexadecimal value if preceded by <b>0x</b>. Default value is 65537.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="RSA-PSS-Key-Generation-Options">RSA-PSS Key Generation Options</h2>
|
||||
|
||||
<p>Note: by default an <b>RSA-PSS</b> key has no parameter restrictions.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="rsa_keygen_bits:numbits-rsa_keygen_primes:numprimes-rsa_keygen_pubexp:value"><b>rsa_keygen_bits:numbits</b>, <b>rsa_keygen_primes:numprimes</b>, <b>rsa_keygen_pubexp:value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options have the same meaning as the <b>RSA</b> algorithm.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa_pss_keygen_md:digest"><b>rsa_pss_keygen_md:digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If set the key is restricted and can only use <b>digest</b> for signing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa_pss_keygen_mgf1_md:digest"><b>rsa_pss_keygen_mgf1_md:digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If set the key is restricted and can only use <b>digest</b> as it's MGF1 parameter.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa_pss_keygen_saltlen:len"><b>rsa_pss_keygen_saltlen:len</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If set the key is restricted and <b>len</b> specifies the minimum salt length.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="EC-Key-Generation-Options">EC Key Generation Options</h2>
|
||||
|
||||
<p>The EC key generation options can also be used for parameter generation.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="ec_paramgen_curve:curve"><b>ec_paramgen_curve:curve</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The EC curve to use. OpenSSL supports NIST curve names such as "P-256".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ec_param_enc:encoding"><b>ec_param_enc:encoding</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The encoding to use for parameters. The "encoding" parameter must be either "named_curve" or "explicit". The default value is "named_curve".</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="PARAMETER-GENERATION-OPTIONS">PARAMETER GENERATION OPTIONS</h1>
|
||||
|
||||
<p>The options supported by each algorithm and indeed each implementation of an algorithm can vary. The options for the OpenSSL implementations are detailed below.</p>
|
||||
|
||||
<h2 id="DSA-Parameter-Generation-Options">DSA Parameter Generation Options</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="dsa_paramgen_bits:numbits"><b>dsa_paramgen_bits:numbits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of bits in the generated prime. If not specified 2048 is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dsa_paramgen_q_bits:numbits"><b>dsa_paramgen_q_bits:numbits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of bits in the q parameter. Must be one of 160, 224 or 256. If not specified 224 is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dsa_paramgen_md:digest"><b>dsa_paramgen_md:digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The digest to use during parameter generation. Must be one of <b>sha1</b>, <b>sha224</b> or <b>sha256</b>. If set, then the number of bits in <b>q</b> will match the output size of the specified digest and the <b>dsa_paramgen_q_bits</b> parameter will be ignored. If not set, then a digest will be used that gives an output matching the number of bits in <b>q</b>, i.e. <b>sha1</b> if q length is 160, <b>sha224</b> if it 224 or <b>sha256</b> if it is 256.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="DH-Parameter-Generation-Options">DH Parameter Generation Options</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="dh_paramgen_prime_len:numbits"><b>dh_paramgen_prime_len:numbits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of bits in the prime parameter <b>p</b>. The default is 2048.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dh_paramgen_subprime_len:numbits"><b>dh_paramgen_subprime_len:numbits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The number of bits in the sub prime parameter <b>q</b>. The default is 256 if the prime is at least 2048 bits long or 160 otherwise. Only relevant if used in conjunction with the <b>dh_paramgen_type</b> option to generate X9.42 DH parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dh_paramgen_generator:value"><b>dh_paramgen_generator:value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The value to use for the generator <b>g</b>. The default is 2.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dh_paramgen_type:value"><b>dh_paramgen_type:value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The type of DH parameters to generate. Use 0 for PKCS#3 DH and 1 for X9.42 DH. The default is 0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dh_rfc5114:num"><b>dh_rfc5114:num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is set, then the appropriate RFC5114 parameters are used instead of generating new parameters. The value <b>num</b> can take the values 1, 2 or 3 corresponding to RFC5114 DH parameters consisting of 1024 bit group with 160 bit subgroup, 2048 bit group with 224 bit subgroup and 2048 bit group with 256 bit subgroup as mentioned in RFC5114 sections 2.1, 2.2 and 2.3 respectively. If present this overrides all other DH parameter options.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="EC-Parameter-Generation-Options">EC Parameter Generation Options</h2>
|
||||
|
||||
<p>The EC parameter generation options are the same as for key generation. See <a href="#EC-Key-Generation-Options">"EC Key Generation Options"</a> above.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The use of the genpkey program is encouraged over the algorithm specific utilities because additional algorithm options and ENGINE provided algorithms can be used.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Generate an RSA private key using default parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -algorithm RSA -out key.pem</code></pre>
|
||||
|
||||
<p>Encrypt output private key using 128 bit AES and the passphrase "hello":</p>
|
||||
|
||||
<pre><code>openssl genpkey -algorithm RSA -out key.pem -aes-128-cbc -pass pass:hello</code></pre>
|
||||
|
||||
<p>Generate a 2048 bit RSA key using 3 as the public exponent:</p>
|
||||
|
||||
<pre><code>openssl genpkey -algorithm RSA -out key.pem \
|
||||
-pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3</code></pre>
|
||||
|
||||
<p>Generate 2048 bit DSA parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -genparam -algorithm DSA -out dsap.pem \
|
||||
-pkeyopt dsa_paramgen_bits:2048</code></pre>
|
||||
|
||||
<p>Generate DSA key from parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -paramfile dsap.pem -out dsakey.pem</code></pre>
|
||||
|
||||
<p>Generate 2048 bit DH parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -genparam -algorithm DH -out dhp.pem \
|
||||
-pkeyopt dh_paramgen_prime_len:2048</code></pre>
|
||||
|
||||
<p>Generate 2048 bit X9.42 DH parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -genparam -algorithm DH -out dhpx.pem \
|
||||
-pkeyopt dh_paramgen_prime_len:2048 \
|
||||
-pkeyopt dh_paramgen_type:1</code></pre>
|
||||
|
||||
<p>Output RFC5114 2048 bit DH parameters with 224 bit subgroup:</p>
|
||||
|
||||
<pre><code>openssl genpkey -genparam -algorithm DH -out dhp.pem -pkeyopt dh_rfc5114:2</code></pre>
|
||||
|
||||
<p>Generate DH key from parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -paramfile dhp.pem -out dhkey.pem</code></pre>
|
||||
|
||||
<p>Generate EC parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -genparam -algorithm EC -out ecp.pem \
|
||||
-pkeyopt ec_paramgen_curve:secp384r1 \
|
||||
-pkeyopt ec_param_enc:named_curve</code></pre>
|
||||
|
||||
<p>Generate EC key from parameters:</p>
|
||||
|
||||
<pre><code>openssl genpkey -paramfile ecp.pem -out eckey.pem</code></pre>
|
||||
|
||||
<p>Generate EC key directly:</p>
|
||||
|
||||
<pre><code>openssl genpkey -algorithm EC -out eckey.pem \
|
||||
-pkeyopt ec_paramgen_curve:P-384 \
|
||||
-pkeyopt ec_param_enc:named_curve</code></pre>
|
||||
|
||||
<p>Generate an X25519 private key:</p>
|
||||
|
||||
<pre><code>openssl genpkey -algorithm X25519 -out xkey.pem</code></pre>
|
||||
|
||||
<p>Generate an ED448 private key:</p>
|
||||
|
||||
<pre><code>openssl genpkey -algorithm ED448 -out xkey.pem</code></pre>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The ability to use NIST curve names, and to generate an EC key directly, were added in OpenSSL 1.0.2. The ability to generate X25519 keys was added in OpenSSL 1.1.0. The ability to generate X448, ED25519 and ED448 keys was added in OpenSSL 1.1.1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
123
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/genrsa.html
vendored
Normal file
123
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/genrsa.html
vendored
Normal file
@ -0,0 +1,123 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>genrsa</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-genrsa, genrsa - generate an RSA private key</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>genrsa</b> [<b>-help</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-f4</b>] [<b>-3</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>-primes num</b>] [<b>numbits</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>genrsa</b> command generates an RSA private key.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the key to the specified file. If this argument is not specified then standard output is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-arg"><b>-passout arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options encrypt the private key with specified cipher before outputting it. If none of these options is specified no encryption is used. If encryption is used a pass phrase is prompted for if it is not supplied via the <b>-passout</b> argument.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="F4--3"><b>-F4|-3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The public exponent to use, either 65537 or 3. The default is 65537.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>genrsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="primes-num"><b>-primes num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify the number of primes to use while generating the RSA key. The <b>num</b> parameter must be a positive integer that is greater than 1 and less than 16. If <b>num</b> is greater than 2, then the generated key is called a 'multi-prime' RSA key, which is defined in RFC 8017.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="numbits"><b>numbits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The size of the private key to generate in bits. This must be the last option specified. The default is 2048 and values less than 512 are not allowed.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>RSA private key generation essentially involves the generation of two or more prime numbers. When generating a private key various symbols will be output to indicate the progress of the generation. A <b>.</b> represents each number which has passed an initial sieve test, <b>+</b> means a number has passed a single round of the Miller-Rabin primality test, <b>*</b> means the current prime starts a regenerating progress due to some failed tests. A newline means that the number has passed all the prime tests (the actual number depends on the key size).</p>
|
||||
|
||||
<p>Because key generation is a random process the time taken to generate a key may vary somewhat. But in general, more primes lead to less generation time of a key.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/gendsa.html">gendsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
111
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/list.html
vendored
Normal file
111
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/list.html
vendored
Normal file
@ -0,0 +1,111 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>list</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-list, list - list algorithms and features</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl list</b> [<b>-help</b>] [<b>-1</b>] [<b>-commands</b>] [<b>-digest-commands</b>] [<b>-digest-algorithms</b>] [<b>-cipher-commands</b>] [<b>-cipher-algorithms</b>] [<b>-public-key-algorithms</b>] [<b>-public-key-methods</b>] [<b>-disabled</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This command is used to generate list of algorithms or disabled features.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-1"><b>-1</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>List the commands, digest-commands, or cipher-commands in a single column. If used, this option must be given first.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="commands"><b>-commands</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of standard commands.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest-commands"><b>-digest-commands</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of message digest commands, which are typically used as input to the <a href="../man1/dgst.html">dgst(1)</a> or <a href="../man1/speed.html">speed(1)</a> commands.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest-algorithms"><b>-digest-algorithms</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of message digest algorithms. If a line is of the form foo => bar then <b>foo</b> is an alias for the official algorithm name, <b>bar</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher-commands"><b>-cipher-commands</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of cipher commands, which are typically used as input to the <a href="../man1/dgst.html">dgst(1)</a> or <a href="../man1/speed.html">speed(1)</a> commands.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher-algorithms"><b>-cipher-algorithms</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of cipher algorithms. If a line is of the form foo => bar then <b>foo</b> is an alias for the official algorithm name, <b>bar</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="public-key-algorithms"><b>-public-key-algorithms</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of public key algorithms, with each algorithm as a block of multiple lines, all but the first are indented.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="public-key-methods"><b>-public-key-methods</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of public key method OIDs: this also includes public key methods without an associated ASN.1 method, for example, KDF algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="disabled"><b>-disabled</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a list of disabled features, those that were compiled out of the installation.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
101
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/nseq.html
vendored
Normal file
101
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/nseq.html
vendored
Normal file
@ -0,0 +1,101 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>nseq</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-nseq, nseq - create or examine a Netscape certificate sequence</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>nseq</b> [<b>-help</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-toseq</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>nseq</b> command takes a file containing a Netscape certificate sequence and prints out the certificates contained in it or takes a file of certificates and converts it into a Netscape certificate sequence.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the output filename or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="toseq"><b>-toseq</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally a Netscape certificate sequence will be input and the output is the certificates contained in it. With the <b>-toseq</b> option the situation is reversed: a Netscape certificate sequence is created from a file of certificates.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Output the certificates in a Netscape certificate sequence</p>
|
||||
|
||||
<pre><code>openssl nseq -in nseq.pem -out certs.pem</code></pre>
|
||||
|
||||
<p>Create a Netscape certificate sequence</p>
|
||||
|
||||
<pre><code>openssl nseq -in certs.pem -toseq -out nseq.pem</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The <b>PEM</b> encoded form uses the same headers and footers as a certificate:</p>
|
||||
|
||||
<pre><code>-----BEGIN CERTIFICATE-----
|
||||
-----END CERTIFICATE-----</code></pre>
|
||||
|
||||
<p>A Netscape certificate sequence is a Netscape specific format that can be sent to browsers as an alternative to the standard PKCS#7 format when several certificates are sent to the browser: for example during certificate enrollment. It is used by Netscape certificate server for example.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>This program needs a few more options: like allowing DER or PEM input and output files and allowing multiple certificate files to be used.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
415
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ocsp.html
vendored
Normal file
415
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ocsp.html
vendored
Normal file
@ -0,0 +1,415 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ocsp</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a>
|
||||
<ul>
|
||||
<li><a href="#OCSP-Client-Options">OCSP Client Options</a></li>
|
||||
<li><a href="#OCSP-Server-Options">OCSP Server Options</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#OCSP-Response-verification">OCSP Response verification.</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-ocsp, ocsp - Online Certificate Status Protocol utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>ocsp</b> [<b>-help</b>] [<b>-out file</b>] [<b>-issuer file</b>] [<b>-cert file</b>] [<b>-serial n</b>] [<b>-signer file</b>] [<b>-signkey file</b>] [<b>-sign_other file</b>] [<b>-no_certs</b>] [<b>-req_text</b>] [<b>-resp_text</b>] [<b>-text</b>] [<b>-reqout file</b>] [<b>-respout file</b>] [<b>-reqin file</b>] [<b>-respin file</b>] [<b>-nonce</b>] [<b>-no_nonce</b>] [<b>-url URL</b>] [<b>-host host:port</b>] [<b>-multi process-count</b>] [<b>-header</b>] [<b>-path</b>] [<b>-CApath dir</b>] [<b>-CAfile file</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-VAfile file</b>] [<b>-validity_period n</b>] [<b>-status_age n</b>] [<b>-noverify</b>] [<b>-verify_other file</b>] [<b>-trust_other</b>] [<b>-no_intern</b>] [<b>-no_signature_verify</b>] [<b>-no_cert_verify</b>] [<b>-no_chain</b>] [<b>-no_cert_checks</b>] [<b>-no_explicit</b>] [<b>-port num</b>] [<b>-ignore_err</b>] [<b>-index file</b>] [<b>-CA file</b>] [<b>-rsigner file</b>] [<b>-rkey file</b>] [<b>-rother file</b>] [<b>-rsigopt nm:v</b>] [<b>-resp_no_certs</b>] [<b>-nmin n</b>] [<b>-ndays n</b>] [<b>-resp_key_id</b>] [<b>-nrequest n</b>] [<b>-<i>digest</i></b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The Online Certificate Status Protocol (OCSP) enables applications to determine the (revocation) state of an identified certificate (RFC 2560).</p>
|
||||
|
||||
<p>The <b>ocsp</b> command performs many common OCSP tasks. It can be used to print out requests and responses, create requests and send queries to an OCSP responder and behave like a mini OCSP server itself.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>This command operates as either a client or a server. The options are described below, divided into those two modes.</p>
|
||||
|
||||
<h2 id="OCSP-Client-Options">OCSP Client Options</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>specify output filename, default is standard output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="issuer-filename"><b>-issuer filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the current issuer certificate. This option can be used multiple times. The certificate specified in <b>filename</b> must be in PEM format. This option <b>MUST</b> come before any <b>-cert</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert-filename"><b>-cert filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Add the certificate <b>filename</b> to the request. The issuer certificate is taken from the previous <b>issuer</b> option, or an error occurs if no issuer certificate is specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="serial-num"><b>-serial num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Same as the <b>cert</b> option except the certificate with serial number <b>num</b> is added to the request. The serial number is interpreted as a decimal integer unless preceded by <b>0x</b>. Negative integers can also be specified by preceding the value by a <b>-</b> sign.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signer-filename--signkey-filename"><b>-signer filename</b>, <b>-signkey filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sign the OCSP request using the certificate specified in the <b>signer</b> option and the private key specified by the <b>signkey</b> option. If the <b>signkey</b> option is not present then the private key is read from the same file as the certificate. If neither option is specified then the OCSP request is not signed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign_other-filename"><b>-sign_other filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Additional certificates to include in the signed request.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nonce--no_nonce"><b>-nonce</b>, <b>-no_nonce</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Add an OCSP nonce extension to a request or disable OCSP nonce addition. Normally if an OCSP request is input using the <b>reqin</b> option no nonce is added: using the <b>nonce</b> option will force addition of a nonce. If an OCSP request is being created (using <b>cert</b> and <b>serial</b> options) a nonce is automatically added specifying <b>no_nonce</b> overrides this.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="req_text--resp_text--text"><b>-req_text</b>, <b>-resp_text</b>, <b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out the text form of the OCSP request, response or both respectively.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="reqout-file--respout-file"><b>-reqout file</b>, <b>-respout file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Write out the DER encoded certificate request or response to <b>file</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="reqin-file--respin-file"><b>-reqin file</b>, <b>-respin file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Read OCSP request or response file from <b>file</b>. These option are ignored if OCSP request or response creation is implied by other options (for example with <b>serial</b>, <b>cert</b> and <b>host</b> options).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="url-responder_url"><b>-url responder_url</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify the responder URL. Both HTTP and HTTPS (SSL/TLS) URLs can be specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="host-hostname:port--path-pathname"><b>-host hostname:port</b>, <b>-path pathname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If the <b>host</b> option is present then the OCSP request is sent to the host <b>hostname</b> on port <b>port</b>. <b>path</b> specifies the HTTP path name to use or "/" by default. This is equivalent to specifying <b>-url</b> with scheme http:// and the given hostname, port, and pathname.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="header-name-value"><b>-header name=value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Adds the header <b>name</b> with the specified <b>value</b> to the OCSP request that is sent to the responder. This may be repeated.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="timeout-seconds"><b>-timeout seconds</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Connection timeout to the OCSP responder in seconds. On POSIX systems, when running as an OCSP responder, this option also limits the time that the responder is willing to wait for the client request. This time is measured from the time the responder accepts the connection until the complete request is received.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="multi-process-count"><b>-multi process-count</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Run the specified number of OCSP responder child processes, with the parent process respawning child processes as needed. Child processes will detect changes in the CA index file and automatically reload it. When running as a responder <b>-timeout</b> option is recommended to limit the time each child is willing to wait for the client's OCSP response. This option is available on POSIX systems (that support the fork() and other required unix system-calls).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file--CApath-pathname"><b>-CAfile file</b>, <b>-CApath pathname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File or pathname containing trusted CA certificates. These are used to verify the signature on the OCSP response.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set different certificate verification options. See <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_other-file"><b>-verify_other file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File containing additional certificates to search when attempting to locate the OCSP response signing certificate. Some responders omit the actual signer's certificate from the response: this option can be used to supply the necessary certificate in such cases.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="trust_other"><b>-trust_other</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificates specified by the <b>-verify_other</b> option should be explicitly trusted and no additional checks will be performed on them. This is useful when the complete responder certificate chain is not available or trusting a root CA is not appropriate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="VAfile-file"><b>-VAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File containing explicitly trusted responder certificates. Equivalent to the <b>-verify_other</b> and <b>-trust_other</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noverify"><b>-noverify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't attempt to verify the OCSP response signature or the nonce values. This option will normally only be used for debugging since it disables all verification of the responders certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_intern"><b>-no_intern</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Ignore certificates contained in the OCSP response when searching for the signers certificate. With this option the signers certificate must be specified with either the <b>-verify_other</b> or <b>-VAfile</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_signature_verify"><b>-no_signature_verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't check the signature on the OCSP response. Since this option tolerates invalid signatures on OCSP responses it will normally only be used for testing purposes.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_cert_verify"><b>-no_cert_verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't verify the OCSP response signers certificate at all. Since this option allows the OCSP response to be signed by any certificate it should only be used for testing purposes.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_chain"><b>-no_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not use certificates in the response as additional untrusted CA certificates.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_explicit"><b>-no_explicit</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not explicitly trust the root CA if it is set to be trusted for OCSP signing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_cert_checks"><b>-no_cert_checks</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't perform any additional checks on the OCSP response signers certificate. That is do not make any checks to see if the signers certificate is authorised to provide the necessary status information: as a result this option should only be used for testing purposes.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="validity_period-nsec--status_age-age"><b>-validity_period nsec</b>, <b>-status_age age</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options specify the range of times, in seconds, which will be tolerated in an OCSP response. Each certificate status response includes a <b>notBefore</b> time and an optional <b>notAfter</b> time. The current time should fall between these two values, but the interval between the two times may be only a few seconds. In practice the OCSP responder and clients clocks may not be precisely synchronised and so such a check may fail. To avoid this the <b>-validity_period</b> option can be used to specify an acceptable error range in seconds, the default value is 5 minutes.</p>
|
||||
|
||||
<p>If the <b>notAfter</b> time is omitted from a response then this means that new status information is immediately available. In this case the age of the <b>notBefore</b> field is checked to see it is not older than <b>age</b> seconds old. By default this additional check is not performed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest"><b>-<i>digest</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option sets digest algorithm to use for certificate identification in the OCSP request. Any digest supported by the OpenSSL <b>dgst</b> command can be used. The default is SHA-1. This option may be used multiple times to specify the digest used by subsequent certificate identifiers.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="OCSP-Server-Options">OCSP Server Options</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="index-indexfile"><b>-index indexfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The <b>indexfile</b> parameter is the name of a text index file in <b>ca</b> format containing certificate revocation information.</p>
|
||||
|
||||
<p>If the <b>index</b> option is specified the <b>ocsp</b> utility is in responder mode, otherwise it is in client mode. The request(s) the responder processes can be either specified on the command line (using <b>issuer</b> and <b>serial</b> options), supplied in a file (using the <b>reqin</b> option) or via external OCSP clients (if <b>port</b> or <b>url</b> is specified).</p>
|
||||
|
||||
<p>If the <b>index</b> option is present then the <b>CA</b> and <b>rsigner</b> options must also be present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CA-file"><b>-CA file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CA certificate corresponding to the revocation information in <b>indexfile</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsigner-file"><b>-rsigner file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate to sign OCSP responses with.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rother-file"><b>-rother file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Additional certificates to include in the OCSP response.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="resp_no_certs"><b>-resp_no_certs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't include any certificates in the OCSP response.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="resp_key_id"><b>-resp_key_id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Identify the signer certificate using the key ID, default is to use the subject name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rkey-file"><b>-rkey file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key to sign OCSP responses with: if not present the file specified in the <b>rsigner</b> option is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsigopt-nm:v"><b>-rsigopt nm:v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Pass options to the signature algorithm when signing OCSP responses. Names and values of these options are algorithm-specific.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="port-portnum"><b>-port portnum</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Port to listen for OCSP requests on. The port may also be specified using the <b>url</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ignore_err"><b>-ignore_err</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Ignore malformed requests or responses: When acting as an OCSP client, retry if a malformed response is received. When acting as an OCSP responder, continue running instead of terminating upon receiving a malformed request.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nrequest-number"><b>-nrequest number</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The OCSP server will exit after receiving <b>number</b> requests, default unlimited.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nmin-minutes--ndays-days"><b>-nmin minutes</b>, <b>-ndays days</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Number of minutes or days when fresh revocation information is available: used in the <b>nextUpdate</b> field. If neither option is present then the <b>nextUpdate</b> field is omitted meaning fresh revocation information is immediately available.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="OCSP-Response-verification">OCSP Response verification.</h1>
|
||||
|
||||
<p>OCSP Response follows the rules specified in RFC2560.</p>
|
||||
|
||||
<p>Initially the OCSP responder certificate is located and the signature on the OCSP request checked using the responder certificate's public key.</p>
|
||||
|
||||
<p>Then a normal certificate verify is performed on the OCSP responder certificate building up a certificate chain in the process. The locations of the trusted certificates used to build the chain can be specified by the <b>CAfile</b> and <b>CApath</b> options or they will be looked for in the standard OpenSSL certificates directory.</p>
|
||||
|
||||
<p>If the initial verify fails then the OCSP verify process halts with an error.</p>
|
||||
|
||||
<p>Otherwise the issuing CA certificate in the request is compared to the OCSP responder certificate: if there is a match then the OCSP verify succeeds.</p>
|
||||
|
||||
<p>Otherwise the OCSP responder certificate's CA is checked against the issuing CA certificate in the request. If there is a match and the OCSPSigning extended key usage is present in the OCSP responder certificate then the OCSP verify succeeds.</p>
|
||||
|
||||
<p>Otherwise, if <b>-no_explicit</b> is <b>not</b> set the root CA of the OCSP responders CA is checked to see if it is trusted for OCSP signing. If it is the OCSP verify succeeds.</p>
|
||||
|
||||
<p>If none of these checks is successful then the OCSP verify fails.</p>
|
||||
|
||||
<p>What this effectively means if that if the OCSP responder certificate is authorised directly by the CA it is issuing revocation information about (and it is correctly configured) then verification will succeed.</p>
|
||||
|
||||
<p>If the OCSP responder is a "global responder" which can give details about multiple CAs and has its own separate certificate chain then its root CA can be trusted for OCSP signing. For example:</p>
|
||||
|
||||
<pre><code>openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem</code></pre>
|
||||
|
||||
<p>Alternatively the responder certificate itself can be explicitly trusted with the <b>-VAfile</b> option.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>As noted, most of the verify options are for testing or debugging purposes. Normally only the <b>-CApath</b>, <b>-CAfile</b> and (if the responder is a 'global VA') <b>-VAfile</b> options need to be used.</p>
|
||||
|
||||
<p>The OCSP server is only useful for test and demonstration purposes: it is not really usable as a full OCSP responder. It contains only a very simple HTTP request handling and can only handle the POST form of OCSP queries. It also handles requests serially meaning it cannot respond to new requests until it has processed the current one. The text index file format of revocation is also inefficient for large quantities of revocation data.</p>
|
||||
|
||||
<p>It is possible to run the <b>ocsp</b> application in responder mode via a CGI script using the <b>reqin</b> and <b>respout</b> options.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Create an OCSP request and write it to a file:</p>
|
||||
|
||||
<pre><code>openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem -reqout req.der</code></pre>
|
||||
|
||||
<p>Send a query to an OCSP responder with URL http://ocsp.myhost.com/ save the response to a file, print it out in text form, and verify the response:</p>
|
||||
|
||||
<pre><code>openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \
|
||||
-url http://ocsp.myhost.com/ -resp_text -respout resp.der</code></pre>
|
||||
|
||||
<p>Read in an OCSP response and print out text form:</p>
|
||||
|
||||
<pre><code>openssl ocsp -respin resp.der -text -noverify</code></pre>
|
||||
|
||||
<p>OCSP server on port 8888 using a standard <b>ca</b> configuration, and a separate responder certificate. All requests and responses are printed to a file.</p>
|
||||
|
||||
<pre><code>openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
|
||||
-text -out log.txt</code></pre>
|
||||
|
||||
<p>As above but exit after processing one request:</p>
|
||||
|
||||
<pre><code>openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
|
||||
-nrequest 1</code></pre>
|
||||
|
||||
<p>Query status information using an internally generated request:</p>
|
||||
|
||||
<pre><code>openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
|
||||
-issuer demoCA/cacert.pem -serial 1</code></pre>
|
||||
|
||||
<p>Query status information using request read from a file, and write the response to a second file.</p>
|
||||
|
||||
<pre><code>openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
|
||||
-reqin req.der -respout resp.der</code></pre>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The -no_alt_chains option was added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
712
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/openssl.html
vendored
Normal file
712
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/openssl.html
vendored
Normal file
@ -0,0 +1,712 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>openssl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#COMMAND-SUMMARY">COMMAND SUMMARY</a>
|
||||
<ul>
|
||||
<li><a href="#Standard-Commands">Standard Commands</a></li>
|
||||
<li><a href="#Message-Digest-Commands">Message Digest Commands</a></li>
|
||||
<li><a href="#Encoding-and-Cipher-Commands">Encoding and Cipher Commands</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a>
|
||||
<ul>
|
||||
<li><a href="#Common-Options">Common Options</a></li>
|
||||
<li><a href="#Pass-Phrase-Options">Pass Phrase Options</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl - OpenSSL command line tool</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <i>command</i> [ <i>command_opts</i> ] [ <i>command_args</i> ]</p>
|
||||
|
||||
<p><b>openssl</b> <b>list</b> [ <b>standard-commands</b> | <b>digest-commands</b> | <b>cipher-commands</b> | <b>cipher-algorithms</b> | <b>digest-algorithms</b> | <b>public-key-algorithms</b>]</p>
|
||||
|
||||
<p><b>openssl</b> <b>no-</b><i>XXX</i> [ <i>arbitrary options</i> ]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them.</p>
|
||||
|
||||
<p>The <b>openssl</b> program is a command line tool for using the various cryptography functions of OpenSSL's <b>crypto</b> library from the shell. It can be used for</p>
|
||||
|
||||
<pre><code>o Creation and management of private keys, public keys and parameters
|
||||
o Public key cryptographic operations
|
||||
o Creation of X.509 certificates, CSRs and CRLs
|
||||
o Calculation of Message Digests
|
||||
o Encryption and Decryption with Ciphers
|
||||
o SSL/TLS Client and Server Tests
|
||||
o Handling of S/MIME signed or encrypted mail
|
||||
o Time Stamp requests, generation and verification</code></pre>
|
||||
|
||||
<h1 id="COMMAND-SUMMARY">COMMAND SUMMARY</h1>
|
||||
|
||||
<p>The <b>openssl</b> program provides a rich variety of commands (<i>command</i> in the SYNOPSIS above), each of which often has a wealth of options and arguments (<i>command_opts</i> and <i>command_args</i> in the SYNOPSIS).</p>
|
||||
|
||||
<p>Detailed documentation and use cases for most standard subcommands are available (e.g., <a href="../man1/x509.html">x509(1)</a> or <a href="../man1/openssl-x509.html">openssl-x509(1)</a>).</p>
|
||||
|
||||
<p>Many commands use an external configuration file for some or all of their arguments and have a <b>-config</b> option to specify that file. The environment variable <b>OPENSSL_CONF</b> can be used to specify the location of the file. If the environment variable is not specified, then the file is named <b>openssl.cnf</b> in the default certificate storage area, whose value depends on the configuration flags specified when the OpenSSL was built.</p>
|
||||
|
||||
<p>The list parameters <b>standard-commands</b>, <b>digest-commands</b>, and <b>cipher-commands</b> output a list (one entry per line) of the names of all standard commands, message digest commands, or cipher commands, respectively, that are available in the present <b>openssl</b> utility.</p>
|
||||
|
||||
<p>The list parameters <b>cipher-algorithms</b> and <b>digest-algorithms</b> list all cipher and message digest names, one entry per line. Aliases are listed as:</p>
|
||||
|
||||
<pre><code>from => to</code></pre>
|
||||
|
||||
<p>The list parameter <b>public-key-algorithms</b> lists all supported public key algorithms.</p>
|
||||
|
||||
<p>The command <b>no-</b><i>XXX</i> tests whether a command of the specified name is available. If no command named <i>XXX</i> exists, it returns 0 (success) and prints <b>no-</b><i>XXX</i>; otherwise it returns 1 and prints <i>XXX</i>. In both cases, the output goes to <b>stdout</b> and nothing is printed to <b>stderr</b>. Additional command line arguments are always ignored. Since for each cipher there is a command of the same name, this provides an easy way for shell scripts to test for the availability of ciphers in the <b>openssl</b> program. (<b>no-</b><i>XXX</i> is not able to detect pseudo-commands such as <b>quit</b>, <b>list</b>, or <b>no-</b><i>XXX</i> itself.)</p>
|
||||
|
||||
<h2 id="Standard-Commands">Standard Commands</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="asn1parse"><b>asn1parse</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Parse an ASN.1 sequence.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ca"><b>ca</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Certificate Authority (CA) Management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ciphers"><b>ciphers</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Cipher Suite Description Determination.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cms"><b>cms</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CMS (Cryptographic Message Syntax) utility.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl"><b>crl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Certificate Revocation List (CRL) Management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl2pkcs7"><b>crl2pkcs7</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CRL to PKCS#7 Conversion.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dgst"><b>dgst</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Message Digest Calculation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dh"><b>dh</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Diffie-Hellman Parameter Management. Obsoleted by <a href="../man1/dhparam.html">dhparam(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dhparam"><b>dhparam</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generation and Management of Diffie-Hellman Parameters. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a> and <a href="../man1/pkeyparam.html">pkeyparam(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dsa"><b>dsa</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>DSA Data Management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dsaparam"><b>dsaparam</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>DSA Parameter Generation and Management. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a> and <a href="../man1/pkeyparam.html">pkeyparam(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ec"><b>ec</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>EC (Elliptic curve) key processing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ecparam"><b>ecparam</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>EC parameter manipulation and generation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="enc"><b>enc</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encoding with Ciphers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine"><b>engine</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Engine (loadable module) information and manipulation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="errstr"><b>errstr</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Error Number to Error String Conversion.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="gendh"><b>gendh</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generation of Diffie-Hellman Parameters. Obsoleted by <a href="../man1/dhparam.html">dhparam(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="gendsa"><b>gendsa</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generation of DSA Private Key from Parameters. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a> and <a href="../man1/pkey.html">pkey(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="genpkey"><b>genpkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generation of Private Key or Parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="genrsa"><b>genrsa</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generation of RSA Private Key. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nseq"><b>nseq</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create or examine a Netscape certificate sequence.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ocsp"><b>ocsp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Online Certificate Status Protocol utility.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passwd"><b>passwd</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generation of hashed passwords.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkcs12"><b>pkcs12</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>PKCS#12 Data Management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkcs7"><b>pkcs7</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>PKCS#7 Data Management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkcs8"><b>pkcs8</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>PKCS#8 format private key conversion tool.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkey"><b>pkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Public and private key management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkeyparam"><b>pkeyparam</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Public key algorithm parameter management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkeyutl"><b>pkeyutl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Public key algorithm cryptographic operation utility.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="prime"><b>prime</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Compute prime numbers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand"><b>rand</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate pseudo-random bytes.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rehash"><b>rehash</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create symbolic links to certificate and CRL files named by the hash values.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="req"><b>req</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>PKCS#10 X.509 Certificate Signing Request (CSR) Management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa"><b>rsa</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>RSA key management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsautl"><b>rsautl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>RSA utility for signing, verification, encryption, and decryption. Superseded by <a href="../man1/pkeyutl.html">pkeyutl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="s_client"><b>s_client</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This implements a generic SSL/TLS client which can establish a transparent connection to a remote server speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL <b>ssl</b> library.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="s_server"><b>s_server</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This implements a generic SSL/TLS server which accepts connections from remote clients speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL <b>ssl</b> library. It provides both an own command line oriented protocol for testing SSL functions and a simple HTTP response facility to emulate an SSL/TLS-aware webserver.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="s_time"><b>s_time</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SSL Connection Timer.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sess_id"><b>sess_id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SSL Session Data Management.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="smime"><b>smime</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>S/MIME mail processing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="speed"><b>speed</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Algorithm Speed Measurement.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="spkac"><b>spkac</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SPKAC printing and generating utility.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="srp"><b>srp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Maintain SRP password file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="storeutl"><b>storeutl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Utility to list and display certificates, keys, CRLs, etc.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ts"><b>ts</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Time Stamping Authority tool (client/server).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>X.509 Certificate Verification.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="version"><b>version</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>OpenSSL Version Information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="x509"><b>x509</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>X.509 Certificate Data Management.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Message-Digest-Commands">Message Digest Commands</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="blake2b512"><b>blake2b512</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>BLAKE2b-512 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="blake2s256"><b>blake2s256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>BLAKE2s-256 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="md2"><b>md2</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>MD2 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="md4"><b>md4</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>MD4 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="md5"><b>md5</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>MD5 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="mdc2"><b>mdc2</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>MDC2 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rmd160"><b>rmd160</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>RMD-160 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha1"><b>sha1</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-1 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha224"><b>sha224</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-2 224 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha256"><b>sha256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-2 256 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha384"><b>sha384</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-2 384 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha512"><b>sha512</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-2 512 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha3-224"><b>sha3-224</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-3 224 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha3-256"><b>sha3-256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-3 256 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha3-384"><b>sha3-384</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-3 384 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sha3-512"><b>sha3-512</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-3 512 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="shake128"><b>shake128</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-3 SHAKE128 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="shake256"><b>shake256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SHA-3 SHAKE256 Digest</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sm3"><b>sm3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SM3 Digest</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Encoding-and-Cipher-Commands">Encoding and Cipher Commands</h2>
|
||||
|
||||
<p>The following aliases provide convenient access to the most used encodings and ciphers.</p>
|
||||
|
||||
<p>Depending on how OpenSSL was configured and built, not all ciphers listed here may be present. See <a href="../man1/enc.html">enc(1)</a> for more information and command usage.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="aes128-aes-128-cbc-aes-128-cfb-aes-128-ctr-aes-128-ecb-aes-128-ofb"><b>aes128</b>, <b>aes-128-cbc</b>, <b>aes-128-cfb</b>, <b>aes-128-ctr</b>, <b>aes-128-ecb</b>, <b>aes-128-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>AES-128 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aes192-aes-192-cbc-aes-192-cfb-aes-192-ctr-aes-192-ecb-aes-192-ofb"><b>aes192</b>, <b>aes-192-cbc</b>, <b>aes-192-cfb</b>, <b>aes-192-ctr</b>, <b>aes-192-ecb</b>, <b>aes-192-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>AES-192 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aes256-aes-256-cbc-aes-256-cfb-aes-256-ctr-aes-256-ecb-aes-256-ofb"><b>aes256</b>, <b>aes-256-cbc</b>, <b>aes-256-cfb</b>, <b>aes-256-ctr</b>, <b>aes-256-ecb</b>, <b>aes-256-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>AES-256 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aria128-aria-128-cbc-aria-128-cfb-aria-128-ctr-aria-128-ecb-aria-128-ofb"><b>aria128</b>, <b>aria-128-cbc</b>, <b>aria-128-cfb</b>, <b>aria-128-ctr</b>, <b>aria-128-ecb</b>, <b>aria-128-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Aria-128 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aria192-aria-192-cbc-aria-192-cfb-aria-192-ctr-aria-192-ecb-aria-192-ofb"><b>aria192</b>, <b>aria-192-cbc</b>, <b>aria-192-cfb</b>, <b>aria-192-ctr</b>, <b>aria-192-ecb</b>, <b>aria-192-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Aria-192 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aria256-aria-256-cbc-aria-256-cfb-aria-256-ctr-aria-256-ecb-aria-256-ofb"><b>aria256</b>, <b>aria-256-cbc</b>, <b>aria-256-cfb</b>, <b>aria-256-ctr</b>, <b>aria-256-ecb</b>, <b>aria-256-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Aria-256 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="base64"><b>base64</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Base64 Encoding</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bf-bf-cbc-bf-cfb-bf-ecb-bf-ofb"><b>bf</b>, <b>bf-cbc</b>, <b>bf-cfb</b>, <b>bf-ecb</b>, <b>bf-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Blowfish Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="camellia128-camellia-128-cbc-camellia-128-cfb-camellia-128-ctr-camellia-128-ecb-camellia-128-ofb"><b>camellia128</b>, <b>camellia-128-cbc</b>, <b>camellia-128-cfb</b>, <b>camellia-128-ctr</b>, <b>camellia-128-ecb</b>, <b>camellia-128-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Camellia-128 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="camellia192-camellia-192-cbc-camellia-192-cfb-camellia-192-ctr-camellia-192-ecb-camellia-192-ofb"><b>camellia192</b>, <b>camellia-192-cbc</b>, <b>camellia-192-cfb</b>, <b>camellia-192-ctr</b>, <b>camellia-192-ecb</b>, <b>camellia-192-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Camellia-192 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="camellia256-camellia-256-cbc-camellia-256-cfb-camellia-256-ctr-camellia-256-ecb-camellia-256-ofb"><b>camellia256</b>, <b>camellia-256-cbc</b>, <b>camellia-256-cfb</b>, <b>camellia-256-ctr</b>, <b>camellia-256-ecb</b>, <b>camellia-256-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Camellia-256 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cast-cast-cbc"><b>cast</b>, <b>cast-cbc</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CAST Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cast5-cbc-cast5-cfb-cast5-ecb-cast5-ofb"><b>cast5-cbc</b>, <b>cast5-cfb</b>, <b>cast5-ecb</b>, <b>cast5-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CAST5 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="chacha20"><b>chacha20</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Chacha20 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="des-des-cbc-des-cfb-des-ecb-des-ede-des-ede-cbc-des-ede-cfb-des-ede-ofb-des-ofb"><b>des</b>, <b>des-cbc</b>, <b>des-cfb</b>, <b>des-ecb</b>, <b>des-ede</b>, <b>des-ede-cbc</b>, <b>des-ede-cfb</b>, <b>des-ede-ofb</b>, <b>des-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>DES Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="des3-desx-des-ede3-des-ede3-cbc-des-ede3-cfb-des-ede3-ofb"><b>des3</b>, <b>desx</b>, <b>des-ede3</b>, <b>des-ede3-cbc</b>, <b>des-ede3-cfb</b>, <b>des-ede3-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Triple-DES Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="idea-idea-cbc-idea-cfb-idea-ecb-idea-ofb"><b>idea</b>, <b>idea-cbc</b>, <b>idea-cfb</b>, <b>idea-ecb</b>, <b>idea-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>IDEA Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rc2-rc2-cbc-rc2-cfb-rc2-ecb-rc2-ofb"><b>rc2</b>, <b>rc2-cbc</b>, <b>rc2-cfb</b>, <b>rc2-ecb</b>, <b>rc2-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>RC2 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rc4"><b>rc4</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>RC4 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rc5-rc5-cbc-rc5-cfb-rc5-ecb-rc5-ofb"><b>rc5</b>, <b>rc5-cbc</b>, <b>rc5-cfb</b>, <b>rc5-ecb</b>, <b>rc5-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>RC5 Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="seed-seed-cbc-seed-cfb-seed-ecb-seed-ofb"><b>seed</b>, <b>seed-cbc</b>, <b>seed-cfb</b>, <b>seed-ecb</b>, <b>seed-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SEED Cipher</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sm4-sm4-cbc-sm4-cfb-sm4-ctr-sm4-ecb-sm4-ofb"><b>sm4</b>, <b>sm4-cbc</b>, <b>sm4-cfb</b>, <b>sm4-ctr</b>, <b>sm4-ecb</b>, <b>sm4-ofb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>SM4 Cipher</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>Details of which options are available depend on the specific command. This section describes some common options with common behavior.</p>
|
||||
|
||||
<h2 id="Common-Options">Common Options</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Provides a terse summary of all options.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Pass-Phrase-Options">Pass Phrase Options</h2>
|
||||
|
||||
<p>Several commands accept password arguments, typically using <b>-passin</b> and <b>-passout</b> for input and output passwords respectively. These allow the password to be obtained from a variety of sources. Both of these options take a single argument whose format is described below. If no password argument is given and a password is required then the user is prompted to enter one: this will typically be read from the current terminal with echoing turned off.</p>
|
||||
|
||||
<p>Note that character encoding may be relevant, please see <a href="../man7/passphrase-encoding.html">passphrase-encoding(7)</a>.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="pass:password"><b>pass:password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The actual password is <b>password</b>. Since the password is visible to utilities (like 'ps' under Unix) this form should only be used where security is not important.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="env:var"><b>env:var</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Obtain the password from the environment variable <b>var</b>. Since the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes) this option should be used with caution.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="file:pathname"><b>file:pathname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The first line of <b>pathname</b> is the password. If the same <b>pathname</b> argument is supplied to <b>-passin</b> and <b>-passout</b> arguments then the first line will be used for the input password and the next line for the output password. <b>pathname</b> need not refer to a regular file: it could for example refer to a device or named pipe.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="fd:number"><b>fd:number</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Read the password from the file descriptor <b>number</b>. This can be used to send the data via a pipe for example.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="stdin"><b>stdin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Read the password from standard input.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/asn1parse.html">asn1parse(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a>, <a href="../man1/cms.html">cms(1)</a>, <a href="../man5/config.html">config(5)</a>, <a href="../man1/crl.html">crl(1)</a>, <a href="../man1/crl2pkcs7.html">crl2pkcs7(1)</a>, <a href="../man1/dgst.html">dgst(1)</a>, <a href="../man1/dhparam.html">dhparam(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/dsaparam.html">dsaparam(1)</a>, <a href="../man1/ec.html">ec(1)</a>, <a href="../man1/ecparam.html">ecparam(1)</a>, <a href="../man1/enc.html">enc(1)</a>, <a href="../man1/engine.html">engine(1)</a>, <a href="../man1/errstr.html">errstr(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/nseq.html">nseq(1)</a>, <a href="../man1/ocsp.html">ocsp(1)</a>, <a href="../man1/passwd.html">passwd(1)</a>, <a href="../man1/pkcs12.html">pkcs12(1)</a>, <a href="../man1/pkcs7.html">pkcs7(1)</a>, <a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/pkey.html">pkey(1)</a>, <a href="../man1/pkeyparam.html">pkeyparam(1)</a>, <a href="../man1/pkeyutl.html">pkeyutl(1)</a>, <a href="../man1/prime.html">prime(1)</a>, <a href="../man1/rand.html">rand(1)</a>, <a href="../man1/rehash.html">rehash(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/rsautl.html">rsautl(1)</a>, <a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man1/s_time.html">s_time(1)</a>, <a href="../man1/sess_id.html">sess_id(1)</a>, <a href="../man1/smime.html">smime(1)</a>, <a href="../man1/speed.html">speed(1)</a>, <a href="../man1/spkac.html">spkac(1)</a>, <a href="../man1/srp.html">srp(1)</a>, <a href="../man1/storeutl.html">storeutl(1)</a>, <a href="../man1/ts.html">ts(1)</a>, <a href="../man1/verify.html">verify(1)</a>, <a href="../man1/version.html">version(1)</a>, <a href="../man1/x509.html">x509(1)</a>, <a href="../man7/crypto.html">crypto(7)</a>, <a href="../man7/ssl.html">ssl(7)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The <b>list-</b><i>XXX</i><b>-algorithms</b> pseudo-commands were added in OpenSSL 1.0.0; For notes on the availability of other commands, see their individual manual pages.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
154
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/passwd.html
vendored
Normal file
154
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/passwd.html
vendored
Normal file
@ -0,0 +1,154 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>passwd</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-passwd, passwd - compute password hashes</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl passwd</b> [<b>-help</b>] [<b>-crypt</b>] [<b>-1</b>] [<b>-apr1</b>] [<b>-aixmd5</b>] [<b>-5</b>] [<b>-6</b>] [<b>-salt</b> <i>string</i>] [<b>-in</b> <i>file</i>] [<b>-stdin</b>] [<b>-noverify</b>] [<b>-quiet</b>] [<b>-table</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] {<i>password</i>}</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>passwd</b> command computes the hash of a password typed at run-time or the hash of each password in a list. The password list is taken from the named file for option <b>-in file</b>, from stdin for option <b>-stdin</b>, or from the command line, or from the terminal otherwise. The Unix standard algorithm <b>crypt</b> and the MD5-based BSD password algorithm <b>1</b>, its Apache variant <b>apr1</b>, and its AIX variant are available.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crypt"><b>-crypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the <b>crypt</b> algorithm (default).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-1"><b>-1</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the MD5 based BSD password algorithm <b>1</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="apr1"><b>-apr1</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the <b>apr1</b> algorithm (Apache variant of the BSD algorithm).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aixmd5"><b>-aixmd5</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the <b>AIX MD5</b> algorithm (AIX variant of the BSD algorithm).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-5"><b>-5</b></dt>
|
||||
<dd>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-6"><b>-6</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the <b>SHA256</b> / <b>SHA512</b> based algorithms defined by Ulrich Drepper. See <a href="https://www.akkadia.org/drepper/SHA-crypt.txt">https://www.akkadia.org/drepper/SHA-crypt.txt</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="salt-string"><b>-salt</b> <i>string</i></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the specified salt. When reading a password from the terminal, this implies <b>-noverify</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-file"><b>-in</b> <i>file</i></dt>
|
||||
<dd>
|
||||
|
||||
<p>Read passwords from <i>file</i>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="stdin"><b>-stdin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Read passwords from <b>stdin</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noverify"><b>-noverify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't verify when reading a password from the terminal.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="quiet"><b>-quiet</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't output warnings when passwords given at the command line are truncated.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="table"><b>-table</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>In the output list, prepend the cleartext password and a TAB character to each password hash.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<pre><code>% openssl passwd -crypt -salt xx password
|
||||
xxj31ZMTZzkVA
|
||||
|
||||
% openssl passwd -1 -salt xxxxxxxx password
|
||||
$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.
|
||||
|
||||
% openssl passwd -apr1 -salt xxxxxxxx password
|
||||
$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0
|
||||
|
||||
% openssl passwd -aixmd5 -salt xxxxxxxx password
|
||||
xxxxxxxx$8Oaipk/GPKhC64w/YVeFD/</code></pre>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
379
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkcs12.html
vendored
Normal file
379
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkcs12.html
vendored
Normal file
@ -0,0 +1,379 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>pkcs12</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#PARSING-OPTIONS">PARSING OPTIONS</a></li>
|
||||
<li><a href="#FILE-CREATION-OPTIONS">FILE CREATION OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-pkcs12, pkcs12 - PKCS#12 file utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>pkcs12</b> [<b>-help</b>] [<b>-export</b>] [<b>-chain</b>] [<b>-inkey file_or_id</b>] [<b>-certfile filename</b>] [<b>-name name</b>] [<b>-caname name</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-nomacver</b>] [<b>-nocerts</b>] [<b>-clcerts</b>] [<b>-cacerts</b>] [<b>-nokeys</b>] [<b>-info</b>] [<b>-des | -des3 | -idea | -aes128 | -aes192 | -aes256 | -aria128 | -aria192 | -aria256 | -camellia128 | -camellia192 | -camellia256 | -nodes</b>] [<b>-noiter</b>] [<b>-maciter | -nomaciter | -nomac</b>] [<b>-twopass</b>] [<b>-descert</b>] [<b>-certpbe cipher</b>] [<b>-keypbe cipher</b>] [<b>-macalg digest</b>] [<b>-keyex</b>] [<b>-keysig</b>] [<b>-password arg</b>] [<b>-passin arg</b>] [<b>-passout arg</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-CSP name</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>pkcs12</b> command allows PKCS#12 files (sometimes referred to as PFX files) to be created and parsed. PKCS#12 files are used by several programs including Netscape, MSIE and MS Outlook.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>There are a lot of options the meaning of some depends of whether a PKCS#12 file is being created or parsed. By default a PKCS#12 file is parsed. A PKCS#12 file can be created by using the <b>-export</b> option (see below).</p>
|
||||
|
||||
<h1 id="PARSING-OPTIONS">PARSING OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies filename of the PKCS#12 file to be parsed. Standard input is used by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The filename to write certificates and private keys to, standard output by default. They are all written in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The PKCS#12 file (i.e. input file) password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-arg"><b>-passout arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Pass phrase source to encrypt any outputted private keys with. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="password-arg"><b>-password arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>With -export, -password is equivalent to -passout. Otherwise, -password is equivalent to -passin.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option inhibits output of the keys and certificates to the output file version of the PKCS#12 file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="clcerts"><b>-clcerts</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Only output client certificates (not CA certificates).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cacerts"><b>-cacerts</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Only output CA certificates (not client certificates).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nocerts"><b>-nocerts</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>No certificates at all will be output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nokeys"><b>-nokeys</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>No private keys will be output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="info"><b>-info</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output additional information about the PKCS#12 file structure, algorithms used and iteration counts.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="des"><b>-des</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use DES to encrypt private keys before outputting.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="des3"><b>-des3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use triple DES to encrypt private keys before outputting, this is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="idea"><b>-idea</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use IDEA to encrypt private keys before outputting.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aes128--aes192--aes256"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use AES to encrypt private keys before outputting.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aria128--aria192--aria256"><b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use ARIA to encrypt private keys before outputting.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="camellia128--camellia192--camellia256"><b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use Camellia to encrypt private keys before outputting.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nodes"><b>-nodes</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't encrypt the private keys at all.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nomacver"><b>-nomacver</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't attempt to verify the integrity MAC before reading the file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="twopass"><b>-twopass</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prompt for separate integrity and encryption passwords: most software always assumes these are the same so this option will render such PKCS#12 files unreadable. Cannot be used in combination with the options -password, -passin (if importing) or -passout (if exporting).</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="FILE-CREATION-OPTIONS">FILE CREATION OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="export"><b>-export</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option specifies that a PKCS#12 file will be created rather than parsed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename1"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies filename to write the PKCS#12 file to. Standard output is used by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename1"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The filename to read certificates and private keys from, standard input by default. They must all be in PEM format. The order doesn't matter but one private key and its corresponding certificate should be present. If additional certificates are present they will also be included in the PKCS#12 file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inkey-file_or_id"><b>-inkey file_or_id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File to read private key from. If not present then a private key must be present in the input file. If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="name-friendlyname"><b>-name friendlyname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the "friendly name" for the certificate and private key. This name is typically displayed in list boxes by software importing the file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certfile-filename"><b>-certfile filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A filename to read additional certificates from.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="caname-friendlyname"><b>-caname friendlyname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the "friendly name" for other certificates. This option may be used multiple times to specify names for all certificates in the order they appear. Netscape ignores friendly names on other certificates whereas MSIE displays them.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pass-arg--passout-arg"><b>-pass arg</b>, <b>-passout arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The PKCS#12 file (i.e. output file) password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-password"><b>-passin password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Pass phrase source to decrypt any input private keys with. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="chain"><b>-chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is present then an attempt is made to include the entire certificate chain of the user certificate. The standard CA store is used for this search. If the search fails it is considered a fatal error.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="descert"><b>-descert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encrypt the certificate using triple DES, this may render the PKCS#12 file unreadable by some "export grade" software. By default the private key is encrypted using triple DES and the certificate using 40 bit RC2 unless RC2 is disabled in which case triple DES is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keypbe-alg--certpbe-alg"><b>-keypbe alg</b>, <b>-certpbe alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options allow the algorithm used to encrypt the private key and certificates to be selected. Any PKCS#5 v1.5 or PKCS#12 PBE algorithm name can be used (see <b>NOTES</b> section for more information). If a cipher name (as output by the <b>list-cipher-algorithms</b> command is specified then it is used with PKCS#5 v2.0. For interoperability reasons it is advisable to only use PKCS#12 algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyex--keysig"><b>-keyex|-keysig</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies that the private key is to be used for key exchange or just signing. This option is only interpreted by MSIE and similar MS software. Normally "export grade" software will only allow 512 bit RSA keys to be used for encryption purposes but arbitrary length keys for signing. The <b>-keysig</b> option marks the key for signing only. Signing only keys can be used for S/MIME signing, authenticode (ActiveX control signing) and SSL client authentication, however due to a bug only MSIE 5.0 and later support the use of signing only keys for SSL client authentication.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="macalg-digest"><b>-macalg digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify the MAC digest algorithm. If not included them SHA1 will be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nomaciter--noiter"><b>-nomaciter</b>, <b>-noiter</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options affect the iteration counts on the MAC and key algorithms. Unless you wish to produce files compatible with MSIE 4.0 you should leave these options alone.</p>
|
||||
|
||||
<p>To discourage attacks by using large dictionaries of common passwords the algorithm that derives keys from passwords can have an iteration count applied to it: this causes a certain part of the algorithm to be repeated and slows it down. The MAC is used to check the file integrity but since it will normally have the same password as the keys and certificates it could also be attacked. By default both MAC and encryption iteration counts are set to 2048, using these options the MAC and encryption iteration counts can be set to 1, since this reduces the file security you should not use these options unless you really have to. Most software supports both MAC and key iteration counts. MSIE 4.0 doesn't support MAC iteration counts so it needs the <b>-nomaciter</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="maciter"><b>-maciter</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option is included for compatibility with previous versions, it used to be needed to use MAC iterations counts but they are now used by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nomac"><b>-nomac</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't attempt to provide the MAC integrity.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file"><b>-CAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CA storage as a file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-dir"><b>-CApath dir</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CA storage as a directory. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CSP-name"><b>-CSP name</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Write <b>name</b> as a Microsoft CSP name.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Although there are a large number of options most of them are very rarely used. For PKCS#12 file parsing only <b>-in</b> and <b>-out</b> need to be used for PKCS#12 file creation <b>-export</b> and <b>-name</b> are also used.</p>
|
||||
|
||||
<p>If none of the <b>-clcerts</b>, <b>-cacerts</b> or <b>-nocerts</b> options are present then all certificates will be output in the order they appear in the input PKCS#12 files. There is no guarantee that the first certificate present is the one corresponding to the private key. Certain software which requires a private key and certificate and assumes the first certificate in the file is the one corresponding to the private key: this may not always be the case. Using the <b>-clcerts</b> option will solve this problem by only outputting the certificate corresponding to the private key. If the CA certificates are required then they can be output to a separate file using the <b>-nokeys -cacerts</b> options to just output CA certificates.</p>
|
||||
|
||||
<p>The <b>-keypbe</b> and <b>-certpbe</b> algorithms allow the precise encryption algorithms for private keys and certificates to be specified. Normally the defaults are fine but occasionally software can't handle triple DES encrypted private keys, then the option <b>-keypbe PBE-SHA1-RC2-40</b> can be used to reduce the private key encryption to 40 bit RC2. A complete description of all algorithms is contained in the <b>pkcs8</b> manual page.</p>
|
||||
|
||||
<p>Prior 1.1 release passwords containing non-ASCII characters were encoded in non-compliant manner, which limited interoperability, in first hand with Windows. But switching to standard-compliant password encoding poses problem accessing old data protected with broken encoding. For this reason even legacy encodings is attempted when reading the data. If you use PKCS#12 files in production application you are advised to convert the data, because implemented heuristic approach is not MT-safe, its sole goal is to facilitate the data upgrade with this utility.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Parse a PKCS#12 file and output it to a file:</p>
|
||||
|
||||
<pre><code>openssl pkcs12 -in file.p12 -out file.pem</code></pre>
|
||||
|
||||
<p>Output only client certificates to a file:</p>
|
||||
|
||||
<pre><code>openssl pkcs12 -in file.p12 -clcerts -out file.pem</code></pre>
|
||||
|
||||
<p>Don't encrypt the private key:</p>
|
||||
|
||||
<pre><code>openssl pkcs12 -in file.p12 -out file.pem -nodes</code></pre>
|
||||
|
||||
<p>Print some info about a PKCS#12 file:</p>
|
||||
|
||||
<pre><code>openssl pkcs12 -in file.p12 -info -noout</code></pre>
|
||||
|
||||
<p>Create a PKCS#12 file:</p>
|
||||
|
||||
<pre><code>openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate"</code></pre>
|
||||
|
||||
<p>Include some extra certificates:</p>
|
||||
|
||||
<pre><code>openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate" \
|
||||
-certfile othercerts.pem</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/pkcs8.html">pkcs8(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
141
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkcs7.html
vendored
Normal file
141
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkcs7.html
vendored
Normal file
@ -0,0 +1,141 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>pkcs7</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RESTRICTIONS">RESTRICTIONS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-pkcs7, pkcs7 - PKCS#7 utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>pkcs7</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-print_certs</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>pkcs7</b> command processes PKCS#7 files in DER or PEM format.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. <b>DER</b> format is DER encoded PKCS#7 v1.5 structure.<b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="print_certs"><b>-print_certs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out any certificates or CRLs contained in the file. They are preceded by their subject and issuer names in one line format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out certificates details in full rather than just subject and issuer names.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't output the encoded version of the PKCS#7 structure (or certificates is <b>-print_certs</b> is set).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkcs7</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Convert a PKCS#7 file from PEM to DER:</p>
|
||||
|
||||
<pre><code>openssl pkcs7 -in file.pem -outform DER -out file.der</code></pre>
|
||||
|
||||
<p>Output all certificates in a file:</p>
|
||||
|
||||
<pre><code>openssl pkcs7 -in file.pem -print_certs -out certs.pem</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The PEM PKCS#7 format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN PKCS7-----
|
||||
-----END PKCS7-----</code></pre>
|
||||
|
||||
<p>For compatibility with some CAs it will also accept:</p>
|
||||
|
||||
<pre><code>-----BEGIN CERTIFICATE-----
|
||||
-----END CERTIFICATE-----</code></pre>
|
||||
|
||||
<h1 id="RESTRICTIONS">RESTRICTIONS</h1>
|
||||
|
||||
<p>There is no option to print out all the fields of a PKCS#7 file.</p>
|
||||
|
||||
<p>This PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC2315 they cannot currently parse, for example, the new CMS as described in RFC2630.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/crl2pkcs7.html">crl2pkcs7(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
291
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkcs8.html
vendored
Normal file
291
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkcs8.html
vendored
Normal file
@ -0,0 +1,291 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>pkcs8</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#KEY-FORMATS">KEY FORMATS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#PKCS-5-v1.5-and-PKCS-12-algorithms">PKCS#5 v1.5 and PKCS#12 algorithms.</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#STANDARDS">STANDARDS</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-pkcs8, pkcs8 - PKCS#8 format private key conversion tool</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>pkcs8</b> [<b>-help</b>] [<b>-topk8</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-iter count</b>] [<b>-noiter</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-nocrypt</b>] [<b>-traditional</b>] [<b>-v2 alg</b>] [<b>-v2prf alg</b>] [<b>-v1 alg</b>] [<b>-engine id</b>] [<b>-scrypt</b>] [<b>-scrypt_N N</b>] [<b>-scrypt_r r</b>] [<b>-scrypt_p p</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>pkcs8</b> command processes private keys in PKCS#8 format. It can handle both unencrypted PKCS#8 PrivateKeyInfo format and EncryptedPrivateKeyInfo format with a variety of PKCS#5 (v1.5 and v2.0) and PKCS#12 algorithms.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="topk8"><b>-topk8</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally a PKCS#8 private key is expected on input and a private key will be written to the output file. With the <b>-topk8</b> option the situation is reversed: it reads a private key and writes a PKCS#8 format key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format: see <a href="#KEY-FORMATS">"KEY FORMATS"</a> for more details. The default format is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format: see <a href="#KEY-FORMATS">"KEY FORMATS"</a> for more details. The default format is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="traditional"><b>-traditional</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When this option is present and <b>-topk8</b> is not a traditional format private key is written.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write a key to or standard output by default. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-arg"><b>-passout arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="iter-count"><b>-iter count</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When creating new PKCS#8 containers, use a given number of iterations on the password in deriving the encryption key for the PKCS#8 output. High values increase the time required to brute-force a PKCS#8 container.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nocrypt"><b>-nocrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>PKCS#8 keys generated or input are normally PKCS#8 EncryptedPrivateKeyInfo structures using an appropriate password based encryption algorithm. With this option an unencrypted PrivateKeyInfo structure is expected or output. This option does not encrypt private keys at all and should only be used when absolutely necessary. Certain software such as some versions of Java code signing software used unencrypted private keys.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="v2-alg"><b>-v2 alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option sets the PKCS#5 v2.0 algorithm.</p>
|
||||
|
||||
<p>The <b>alg</b> argument is the encryption algorithm to use, valid values include <b>aes128</b>, <b>aes256</b> and <b>des3</b>. If this option isn't specified then <b>aes256</b> is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="v2prf-alg"><b>-v2prf alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option sets the PRF algorithm to use with PKCS#5 v2.0. A typical value value would be <b>hmacWithSHA256</b>. If this option isn't set then the default for the cipher is used or <b>hmacWithSHA256</b> if there is no default.</p>
|
||||
|
||||
<p>Some implementations may not support custom PRF algorithms and may require the <b>hmacWithSHA1</b> option to work.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="v1-alg"><b>-v1 alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option indicates a PKCS#5 v1.5 or PKCS#12 algorithm should be used. Some older implementations may not support PKCS#5 v2.0 and may require this option. If not specified PKCS#5 v2.0 form is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkcs8</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="scrypt"><b>-scrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Uses the <b>scrypt</b> algorithm for private key encryption using default parameters: currently N=16384, r=8 and p=1 and AES in CBC mode with a 256 bit key. These parameters can be modified using the <b>-scrypt_N</b>, <b>-scrypt_r</b>, <b>-scrypt_p</b> and <b>-v2</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="scrypt_N-N--scrypt_r-r--scrypt_p-p"><b>-scrypt_N N</b> <b>-scrypt_r r</b> <b>-scrypt_p p</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the scrypt <b>N</b>, <b>r</b> or <b>p</b> parameters.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="KEY-FORMATS">KEY FORMATS</h1>
|
||||
|
||||
<p>Various different formats are used by the pkcs8 utility. These are detailed below.</p>
|
||||
|
||||
<p>If a key is being converted from PKCS#8 form (i.e. the <b>-topk8</b> option is not used) then the input file must be in PKCS#8 format. An encrypted key is expected unless <b>-nocrypt</b> is included.</p>
|
||||
|
||||
<p>If <b>-topk8</b> is not used and <b>PEM</b> mode is set the output file will be an unencrypted private key in PKCS#8 format. If the <b>-traditional</b> option is used then a traditional format private key is written instead.</p>
|
||||
|
||||
<p>If <b>-topk8</b> is not used and <b>DER</b> mode is set the output file will be an unencrypted private key in traditional DER format.</p>
|
||||
|
||||
<p>If <b>-topk8</b> is used then any supported private key can be used for the input file in a format specified by <b>-inform</b>. The output file will be encrypted PKCS#8 format using the specified encryption parameters unless <b>-nocrypt</b> is included.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>By default, when converting a key to PKCS#8 format, PKCS#5 v2.0 using 256 bit AES with HMAC and SHA256 is used.</p>
|
||||
|
||||
<p>Some older implementations do not support PKCS#5 v2.0 format and require the older PKCS#5 v1.5 form instead, possibly also requiring insecure weak encryption algorithms such as 56 bit DES.</p>
|
||||
|
||||
<p>The encrypted form of a PEM encode PKCS#8 files uses the following headers and footers:</p>
|
||||
|
||||
<pre><code>-----BEGIN ENCRYPTED PRIVATE KEY-----
|
||||
-----END ENCRYPTED PRIVATE KEY-----</code></pre>
|
||||
|
||||
<p>The unencrypted form uses:</p>
|
||||
|
||||
<pre><code>-----BEGIN PRIVATE KEY-----
|
||||
-----END PRIVATE KEY-----</code></pre>
|
||||
|
||||
<p>Private keys encrypted using PKCS#5 v2.0 algorithms and high iteration counts are more secure that those encrypted using the traditional SSLeay compatible formats. So if additional security is considered important the keys should be converted.</p>
|
||||
|
||||
<p>It is possible to write out DER encoded encrypted private keys in PKCS#8 format because the encryption details are included at an ASN1 level whereas the traditional format includes them at a PEM level.</p>
|
||||
|
||||
<h1 id="PKCS-5-v1.5-and-PKCS-12-algorithms">PKCS#5 v1.5 and PKCS#12 algorithms.</h1>
|
||||
|
||||
<p>Various algorithms can be used with the <b>-v1</b> command line option, including PKCS#5 v1.5 and PKCS#12. These are described in more detail below.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="PBE-MD2-DES-PBE-MD5-DES"><b>PBE-MD2-DES PBE-MD5-DES</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These algorithms were included in the original PKCS#5 v1.5 specification. They only offer 56 bits of protection since they both use DES.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="PBE-SHA1-RC2-64-PBE-MD2-RC2-64-PBE-MD5-RC2-64-PBE-SHA1-DES"><b>PBE-SHA1-RC2-64</b>, <b>PBE-MD2-RC2-64</b>, <b>PBE-MD5-RC2-64</b>, <b>PBE-SHA1-DES</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These algorithms are not mentioned in the original PKCS#5 v1.5 specification but they use the same key derivation algorithm and are supported by some software. They are mentioned in PKCS#5 v2.0. They use either 64 bit RC2 or 56 bit DES.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="PBE-SHA1-RC4-128-PBE-SHA1-RC4-40-PBE-SHA1-3DES-PBE-SHA1-2DES-PBE-SHA1-RC2-128-PBE-SHA1-RC2-40"><b>PBE-SHA1-RC4-128</b>, <b>PBE-SHA1-RC4-40</b>, <b>PBE-SHA1-3DES</b>, <b>PBE-SHA1-2DES</b>, <b>PBE-SHA1-RC2-128</b>, <b>PBE-SHA1-RC2-40</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These algorithms use the PKCS#12 password based encryption algorithm and allow strong encryption algorithms like triple DES or 128 bit RC2 to be used.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Convert a private key to PKCS#8 format using default parameters (AES with 256 bit key and <b>hmacWithSHA256</b>):</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in key.pem -topk8 -out enckey.pem</code></pre>
|
||||
|
||||
<p>Convert a private key to PKCS#8 unencrypted format:</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in key.pem -topk8 -nocrypt -out enckey.pem</code></pre>
|
||||
|
||||
<p>Convert a private key to PKCS#5 v2.0 format using triple DES:</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in key.pem -topk8 -v2 des3 -out enckey.pem</code></pre>
|
||||
|
||||
<p>Convert a private key to PKCS#5 v2.0 format using AES with 256 bits in CBC mode and <b>hmacWithSHA512</b> PRF:</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in key.pem -topk8 -v2 aes-256-cbc -v2prf hmacWithSHA512 -out enckey.pem</code></pre>
|
||||
|
||||
<p>Convert a private key to PKCS#8 using a PKCS#5 1.5 compatible algorithm (DES):</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in key.pem -topk8 -v1 PBE-MD5-DES -out enckey.pem</code></pre>
|
||||
|
||||
<p>Convert a private key to PKCS#8 using a PKCS#12 compatible algorithm (3DES):</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in key.pem -topk8 -out enckey.pem -v1 PBE-SHA1-3DES</code></pre>
|
||||
|
||||
<p>Read a DER unencrypted PKCS#8 format private key:</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -inform DER -nocrypt -in key.der -out key.pem</code></pre>
|
||||
|
||||
<p>Convert a private key from any PKCS#8 encrypted format to traditional format:</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in pk8.pem -traditional -out key.pem</code></pre>
|
||||
|
||||
<p>Convert a private key to PKCS#8 format, encrypting with AES-256 and with one million iterations of the password:</p>
|
||||
|
||||
<pre><code>openssl pkcs8 -in key.pem -topk8 -v2 aes-256-cbc -iter 1000000 -out pk8.pem</code></pre>
|
||||
|
||||
<h1 id="STANDARDS">STANDARDS</h1>
|
||||
|
||||
<p>Test vectors from this PKCS#5 v2.0 implementation were posted to the pkcs-tng mailing list using triple DES, DES and RC2 with high iteration counts, several people confirmed that they could decrypt the private keys produced and Therefore it can be assumed that the PKCS#5 v2.0 implementation is reasonably accurate at least as far as these algorithms are concerned.</p>
|
||||
|
||||
<p>The format of PKCS#8 DSA (and other) private keys is not well documented: it is hidden away in PKCS#11 v2.01, section 11.9. OpenSSL's default DSA PKCS#8 private key format complies with this standard.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>There should be an option that prints out the encryption algorithm in use and other details such as the iteration count.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The <b>-iter</b> option was added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
185
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkey.html
vendored
Normal file
185
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkey.html
vendored
Normal file
@ -0,0 +1,185 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>pkey</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-pkey, pkey - public or private key processing tool</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>pkey</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-traditional</b>] [<b>-<i>cipher</i></b>] [<b>-text</b>] [<b>-text_pub</b>] [<b>-noout</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-engine id</b>] [<b>-check</b>] [<b>-pubcheck</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>pkey</b> command processes public or private keys. They can be converted between various forms and their components printed out.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format DER or PEM. The default format is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write a key to or standard output if this option is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-password"><b>-passout password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="traditional"><b>-traditional</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally a private key is written using standard format: this is PKCS#8 form with the appropriate encryption algorithm (if any). If the <b>-traditional</b> option is specified then the older "traditional" format is used instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher"><b>-<i>cipher</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options encrypt the private key with the supplied cipher. Any algorithm name accepted by EVP_get_cipherbyname() is acceptable such as <b>des3</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the various public or private key components in plain text in addition to the encoded version.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text_pub"><b>-text_pub</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out only public key components even if a private key is being processed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not output the encoded version of the key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubin"><b>-pubin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default a private key is read from the input file: with this option a public key is read instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubout"><b>-pubout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default a private key is output: with this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkey</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="check"><b>-check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option checks the consistency of a key pair for both public and private components.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubcheck"><b>-pubcheck</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option checks the correctness of either a public key or the public component of a key pair.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>To remove the pass phrase on an RSA private key:</p>
|
||||
|
||||
<pre><code>openssl pkey -in key.pem -out keyout.pem</code></pre>
|
||||
|
||||
<p>To encrypt a private key using triple DES:</p>
|
||||
|
||||
<pre><code>openssl pkey -in key.pem -des3 -out keyout.pem</code></pre>
|
||||
|
||||
<p>To convert a private key from PEM to DER format:</p>
|
||||
|
||||
<pre><code>openssl pkey -in key.pem -outform DER -out keyout.der</code></pre>
|
||||
|
||||
<p>To print out the components of a private key to standard output:</p>
|
||||
|
||||
<pre><code>openssl pkey -in key.pem -text -noout</code></pre>
|
||||
|
||||
<p>To print out the public components of a private key to standard output:</p>
|
||||
|
||||
<pre><code>openssl pkey -in key.pem -text_pub -noout</code></pre>
|
||||
|
||||
<p>To just output the public part of a private key:</p>
|
||||
|
||||
<pre><code>openssl pkey -in key.pem -pubout -out pubkey.pem</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
110
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkeyparam.html
vendored
Normal file
110
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkeyparam.html
vendored
Normal file
@ -0,0 +1,110 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>pkeyparam</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-pkeyparam, pkeyparam - public key algorithm parameter processing tool</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>pkeyparam</b> [<b>-help</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-engine id</b>] [<b>-check</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>pkeyparam</b> command processes public key algorithm parameters. They can be checked for correctness and their components printed out.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read parameters from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write parameters to or standard output if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the parameters in plain text in addition to the encoded version.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not output the encoded version of the parameters.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkeyparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="check"><b>-check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option checks the correctness of parameters.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Print out text version of parameters:</p>
|
||||
|
||||
<pre><code>openssl pkeyparam -in param.pem -text</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>There are no <b>-inform</b> or <b>-outform</b> options for this command because only PEM format is supported because the key type is determined by the PEM headers.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
331
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkeyutl.html
vendored
Normal file
331
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/pkeyutl.html
vendored
Normal file
@ -0,0 +1,331 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>pkeyutl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RSA-ALGORITHM">RSA ALGORITHM</a></li>
|
||||
<li><a href="#RSA-PSS-ALGORITHM">RSA-PSS ALGORITHM</a></li>
|
||||
<li><a href="#DSA-ALGORITHM">DSA ALGORITHM</a></li>
|
||||
<li><a href="#DH-ALGORITHM">DH ALGORITHM</a></li>
|
||||
<li><a href="#EC-ALGORITHM">EC ALGORITHM</a></li>
|
||||
<li><a href="#X25519-and-X448-ALGORITHMS">X25519 and X448 ALGORITHMS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-pkeyutl, pkeyutl - public key algorithm utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>pkeyutl</b> [<b>-help</b>] [<b>-in file</b>] [<b>-out file</b>] [<b>-sigfile file</b>] [<b>-inkey file</b>] [<b>-keyform PEM|DER|ENGINE</b>] [<b>-passin arg</b>] [<b>-peerkey file</b>] [<b>-peerform PEM|DER|ENGINE</b>] [<b>-pubin</b>] [<b>-certin</b>] [<b>-rev</b>] [<b>-sign</b>] [<b>-verify</b>] [<b>-verifyrecover</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-derive</b>] [<b>-kdf algorithm</b>] [<b>-kdflen length</b>] [<b>-pkeyopt opt:value</b>] [<b>-hexdump</b>] [<b>-asn1parse</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>-engine_impl</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>pkeyutl</b> command can be used to perform low level public key operations using any supported algorithm.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read data from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sigfile-file"><b>-sigfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Signature file, required for <b>verify</b> operations only</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inkey-file"><b>-inkey file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input key file, by default it should be a private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The key format PEM, DER or ENGINE. Default is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="peerkey-file"><b>-peerkey file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The peer key file, used by key derivation (agreement) operations.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="peerform-PEM-DER-ENGINE"><b>-peerform PEM|DER|ENGINE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The peer key format PEM, DER or ENGINE. Default is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubin"><b>-pubin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file is a public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certin"><b>-certin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input is a certificate containing a public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rev"><b>-rev</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Reverse the order of the input buffer. This is useful for some libraries (such as CryptoAPI) which represent the buffer in little endian format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign"><b>-sign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sign the input data (which must be a hash) and output the signed result. This requires a private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>-verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the input data (which must be a hash) against the signature file and indicate if the verification succeeded or failed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verifyrecover"><b>-verifyrecover</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the input data (which must be a hash) and output the recovered data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="encrypt"><b>-encrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encrypt the input data using a public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="decrypt"><b>-decrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Decrypt the input data using a private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="derive"><b>-derive</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Derive a shared secret using the peer key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kdf-algorithm"><b>-kdf algorithm</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use key derivation function <b>algorithm</b>. The supported algorithms are at present <b>TLS1-PRF</b> and <b>HKDF</b>. Note: additional parameters and the KDF output length will normally have to be set for this to work. See <a href="../man3/EVP_PKEY_CTX_set_hkdf_md.html">EVP_PKEY_CTX_set_hkdf_md(3)</a> and <a href="../man3/EVP_PKEY_CTX_set_tls1_prf_md.html">EVP_PKEY_CTX_set_tls1_prf_md(3)</a> for the supported string parameters of each algorithm.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="kdflen-length"><b>-kdflen length</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the output length for KDF.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkeyopt-opt:value"><b>-pkeyopt opt:value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Public key options specified as opt:value. See NOTES below for more details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hexdump"><b>-hexdump</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>hex dump the output data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="asn1parse"><b>-asn1parse</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Parse the ASN.1 output data, this is useful when combined with the <b>-verifyrecover</b> option when an ASN1 structure is signed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkeyutl</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine_impl"><b>-engine_impl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When used with the <b>-engine</b> option, it specifies to also use engine <b>id</b> for crypto operations.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The operations and options supported vary according to the key algorithm and its implementation. The OpenSSL operations and options are indicated below.</p>
|
||||
|
||||
<p>Unless otherwise mentioned all algorithms support the <b>digest:alg</b> option which specifies the digest in use for sign, verify and verifyrecover operations. The value <b>alg</b> should represent a digest name as used in the EVP_get_digestbyname() function for example <b>sha1</b>. This value is not used to hash the input data. It is used (by some algorithms) for sanity-checking the lengths of data passed in to the <b>pkeyutl</b> and for creating the structures that make up the signature (e.g. <b>DigestInfo</b> in RSASSA PKCS#1 v1.5 signatures).</p>
|
||||
|
||||
<p>This utility does not hash the input data but rather it will use the data directly as input to the signature algorithm. Depending on the key type, signature type, and mode of padding, the maximum acceptable lengths of input data differ. The signed data can't be longer than the key modulus with RSA. In case of ECDSA and DSA the data shouldn't be longer than the field size, otherwise it will be silently truncated to the field size. In any event the input size must not be larger than the largest supported digest size.</p>
|
||||
|
||||
<p>In other words, if the value of digest is <b>sha1</b> the input should be the 20 bytes long binary encoding of the SHA-1 hash function output.</p>
|
||||
|
||||
<p>The Ed25519 and Ed448 signature algorithms are not supported by this utility. They accept non-hashed input, but this utility can only be used to sign hashed input.</p>
|
||||
|
||||
<h1 id="RSA-ALGORITHM">RSA ALGORITHM</h1>
|
||||
|
||||
<p>The RSA algorithm generally supports the encrypt, decrypt, sign, verify and verifyrecover operations. However, some padding modes support only a subset of these operations. The following additional <b>pkeyopt</b> values are supported:</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="rsa_padding_mode:mode"><b>rsa_padding_mode:mode</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This sets the RSA padding mode. Acceptable values for <b>mode</b> are <b>pkcs1</b> for PKCS#1 padding, <b>sslv23</b> for SSLv23 padding, <b>none</b> for no padding, <b>oaep</b> for <b>OAEP</b> mode, <b>x931</b> for X9.31 mode and <b>pss</b> for PSS.</p>
|
||||
|
||||
<p>In PKCS#1 padding if the message digest is not set then the supplied data is signed or verified directly instead of using a <b>DigestInfo</b> structure. If a digest is set then the a <b>DigestInfo</b> structure is used and its the length must correspond to the digest type.</p>
|
||||
|
||||
<p>For <b>oaep</b> mode only encryption and decryption is supported.</p>
|
||||
|
||||
<p>For <b>x931</b> if the digest type is set it is used to format the block data otherwise the first byte is used to specify the X9.31 digest ID. Sign, verify and verifyrecover are can be performed in this mode.</p>
|
||||
|
||||
<p>For <b>pss</b> mode only sign and verify are supported and the digest type must be specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa_pss_saltlen:len"><b>rsa_pss_saltlen:len</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For <b>pss</b> mode only this option specifies the salt length. Three special values are supported: "digest" sets the salt length to the digest length, "max" sets the salt length to the maximum permissible value. When verifying "auto" causes the salt length to be automatically determined based on the <b>PSS</b> block structure.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rsa_mgf1_md:digest"><b>rsa_mgf1_md:digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For PSS and OAEP padding sets the MGF1 digest. If the MGF1 digest is not explicitly set in PSS mode then the signing digest is used.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="RSA-PSS-ALGORITHM">RSA-PSS ALGORITHM</h1>
|
||||
|
||||
<p>The RSA-PSS algorithm is a restricted version of the RSA algorithm which only supports the sign and verify operations with PSS padding. The following additional <b>pkeyopt</b> values are supported:</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="rsa_padding_mode:mode-rsa_pss_saltlen:len-rsa_mgf1_md:digest"><b>rsa_padding_mode:mode</b>, <b>rsa_pss_saltlen:len</b>, <b>rsa_mgf1_md:digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These have the same meaning as the <b>RSA</b> algorithm with some additional restrictions. The padding mode can only be set to <b>pss</b> which is the default value.</p>
|
||||
|
||||
<p>If the key has parameter restrictions than the digest, MGF1 digest and salt length are set to the values specified in the parameters. The digest and MG cannot be changed and the salt length cannot be set to a value less than the minimum restriction.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="DSA-ALGORITHM">DSA ALGORITHM</h1>
|
||||
|
||||
<p>The DSA algorithm supports signing and verification operations only. Currently there are no additional <b>-pkeyopt</b> options other than <b>digest</b>. The SHA1 digest is assumed by default.</p>
|
||||
|
||||
<h1 id="DH-ALGORITHM">DH ALGORITHM</h1>
|
||||
|
||||
<p>The DH algorithm only supports the derivation operation and no additional <b>-pkeyopt</b> options.</p>
|
||||
|
||||
<h1 id="EC-ALGORITHM">EC ALGORITHM</h1>
|
||||
|
||||
<p>The EC algorithm supports sign, verify and derive operations. The sign and verify operations use ECDSA and derive uses ECDH. SHA1 is assumed by default for the <b>-pkeyopt</b> <b>digest</b> option.</p>
|
||||
|
||||
<h1 id="X25519-and-X448-ALGORITHMS">X25519 and X448 ALGORITHMS</h1>
|
||||
|
||||
<p>The X25519 and X448 algorithms support key derivation only. Currently there are no additional options.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Sign some data using a private key:</p>
|
||||
|
||||
<pre><code>openssl pkeyutl -sign -in file -inkey key.pem -out sig</code></pre>
|
||||
|
||||
<p>Recover the signed data (e.g. if an RSA key is used):</p>
|
||||
|
||||
<pre><code>openssl pkeyutl -verifyrecover -in sig -inkey key.pem</code></pre>
|
||||
|
||||
<p>Verify the signature (e.g. a DSA key):</p>
|
||||
|
||||
<pre><code>openssl pkeyutl -verify -in file -sigfile sig -inkey key.pem</code></pre>
|
||||
|
||||
<p>Sign data using a message digest value (this is currently only valid for RSA):</p>
|
||||
|
||||
<pre><code>openssl pkeyutl -sign -in file -inkey key.pem -out sig -pkeyopt digest:sha256</code></pre>
|
||||
|
||||
<p>Derive a shared secret value:</p>
|
||||
|
||||
<pre><code>openssl pkeyutl -derive -inkey key.pem -peerkey pubkey.pem -out secret</code></pre>
|
||||
|
||||
<p>Hexdump 48 bytes of TLS1 PRF using digest <b>SHA256</b> and shared secret and seed consisting of the single byte 0xFF:</p>
|
||||
|
||||
<pre><code>openssl pkeyutl -kdf TLS1-PRF -kdflen 48 -pkeyopt md:SHA256 \
|
||||
-pkeyopt hexsecret:ff -pkeyopt hexseed:ff -hexdump</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/pkey.html">pkey(1)</a>, <a href="../man1/rsautl.html">rsautl(1)</a> <a href="../man1/dgst.html">dgst(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man3/EVP_PKEY_CTX_set_hkdf_md.html">EVP_PKEY_CTX_set_hkdf_md(3)</a>, <a href="../man3/EVP_PKEY_CTX_set_tls1_prf_md.html">EVP_PKEY_CTX_set_tls1_prf_md(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
89
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/prime.html
vendored
Normal file
89
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/prime.html
vendored
Normal file
@ -0,0 +1,89 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>prime</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-prime, prime - compute prime numbers</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl prime</b> [<b>-help</b>] [<b>-hex</b>] [<b>-generate</b>] [<b>-bits</b>] [<b>-safe</b>] [<b>-checks</b>] [<i>number...</i>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>prime</b> command checks if the specified numbers are prime.</p>
|
||||
|
||||
<p>If no numbers are given on the command line, the <b>-generate</b> flag should be used to generate primes according to the requirements specified by the rest of the flags.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help">[<b>-help</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Display an option summary.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hex">[<b>-hex</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate hex output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="generate">[<b>-generate</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate a prime number.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bits-num">[<b>-bits num</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate a prime with <b>num</b> bits.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="safe">[<b>-safe</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>When used with <b>-generate</b>, generates a "safe" prime. If the number generated is <b>n</b>, then check that <b>(n-1)/2</b> is also prime.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="checks-num">[<b>-checks num</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Perform the checks <b>num</b> times to see that the generated number is prime. The default is 20.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
101
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rand.html
vendored
Normal file
101
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rand.html
vendored
Normal file
@ -0,0 +1,101 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>rand</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-rand, rand - generate pseudo-random bytes</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl rand</b> [<b>-help</b>] [<b>-out</b> <i>file</i>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-base64</b>] [<b>-hex</b>] <i>num</i></p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This command generates <i>num</i> random bytes using a cryptographically secure pseudo random number generator (CSPRNG).</p>
|
||||
|
||||
<p>The random bytes are generated using the <a href="../man3/RAND_bytes.html">RAND_bytes(3)</a> function, which provides a security level of 256 bits, provided it managed to seed itself successfully from a trusted operating system entropy source. Otherwise, the command will fail with a nonzero error code. For more details, see <a href="../man3/RAND_bytes.html">RAND_bytes(3)</a>, <a href="../man7/RAND.html">RAND(7)</a>, and <a href="../man7/RAND_DRBG.html">RAND_DRBG(7)</a>.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-file"><b>-out file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Write to <i>file</i> instead of standard output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others. Explicitly specifying a seed file is in general not necessary, see the <a href="#NOTES">"NOTES"</a> section for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="base64"><b>-base64</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Perform base64 encoding on the output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hex"><b>-hex</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Show the output as a hex string.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Prior to OpenSSL 1.1.1, it was common for applications to store information about the state of the random-number generator in a file that was loaded at startup and rewritten upon exit. On modern operating systems, this is generally no longer necessary as OpenSSL will seed itself from a trusted entropy source provided by the operating system. The <b>-rand</b> and <b>-writerand</b> flags are still supported for special platforms or circumstances that might require them.</p>
|
||||
|
||||
<p>It is generally an error to use the same seed file more than once and every use of <b>-rand</b> should be paired with <b>-writerand</b>.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/RAND_bytes.html">RAND_bytes(3)</a>, <a href="../man7/RAND.html">RAND(7)</a>, <a href="../man7/RAND_DRBG.html">RAND_DRBG(7)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
132
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rehash.html
vendored
Normal file
132
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rehash.html
vendored
Normal file
@ -0,0 +1,132 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>rehash</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a>
|
||||
<ul>
|
||||
<li><a href="#Script-Configuration">Script Configuration</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#ENVIRONMENT">ENVIRONMENT</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-c_rehash, openssl-rehash, c_rehash, rehash - Create symbolic links to files named by the hash values</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>rehash</b> <b>[-h]</b> <b>[-help]</b> <b>[-old]</b> <b>[-n]</b> <b>[-v]</b> [ <i>directory</i>...]</p>
|
||||
|
||||
<p><b>c_rehash</b> <i>flags...</i></p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>On some platforms, the OpenSSL <b>rehash</b> command is available as an external script called <b>c_rehash</b>. They are functionally equivalent, except for minor differences noted below.</p>
|
||||
|
||||
<p><b>rehash</b> scans directories and calculates a hash value of each <code>.pem</code>, <code>.crt</code>, <code>.cer</code>, or <code>.crl</code> file in the specified directory list and creates symbolic links for each file, where the name of the link is the hash value. (If the platform does not support symbolic links, a copy is made.) This utility is useful as many programs that use OpenSSL require directories to be set up like this in order to find certificates.</p>
|
||||
|
||||
<p>If any directories are named on the command line, then those are processed in turn. If not, then the <b>SSL_CERT_DIR</b> environment variable is consulted; this should be a colon-separated list of directories, like the Unix <b>PATH</b> variable. If that is not set then the default directory (installation-specific but often <b>/usr/local/ssl/certs</b>) is processed.</p>
|
||||
|
||||
<p>In order for a directory to be processed, the user must have write permissions on that directory, otherwise an error will be generated.</p>
|
||||
|
||||
<p>The links created are of the form <code>HHHHHHHH.D</code>, where each <b>H</b> is a hexadecimal character and <b>D</b> is a single decimal digit. When processing a directory, <b>rehash</b> will first remove all links that have a name in that syntax, even if they are being used for some other purpose. To skip the removal step, use the <b>-n</b> flag. Hashes for CRL's look similar except the letter <b>r</b> appears after the period, like this: <code>HHHHHHHH.rD</code>.</p>
|
||||
|
||||
<p>Multiple objects may have the same hash; they will be indicated by incrementing the <b>D</b> value. Duplicates are found by comparing the full SHA-1 fingerprint. A warning will be displayed if a duplicate is found.</p>
|
||||
|
||||
<p>A warning will also be displayed if there are files that cannot be parsed as either a certificate or a CRL or if more than one such object appears in the file.</p>
|
||||
|
||||
<h2 id="Script-Configuration">Script Configuration</h2>
|
||||
|
||||
<p>The <b>c_rehash</b> script uses the <b>openssl</b> program to compute the hashes and fingerprints. If not found in the user's <b>PATH</b>, then set the <b>OPENSSL</b> environment variable to the full pathname. Any program can be used, it will be invoked as follows for either a certificate or CRL:</p>
|
||||
|
||||
<pre><code>$OPENSSL x509 -hash -fingerprint -noout -in FILENAME
|
||||
$OPENSSL crl -hash -fingerprint -noout -in FILENAME</code></pre>
|
||||
|
||||
<p>where <b>FILENAME</b> is the filename. It must output the hash of the file on the first line, and the fingerprint on the second, optionally prefixed with some text and an equals sign.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help--h"><b>-help</b> <b>-h</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display a brief usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="old"><b>-old</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use old-style hashing (MD5, as opposed to SHA-1) for generating links to be used for releases before 1.0.0. Note that current versions will not use the old style.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="n"><b>-n</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not remove existing links. This is needed when keeping new and old-style links in the same directory.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="compat"><b>-compat</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate links for both old-style (MD5) and new-style (SHA1) hashing. This allows releases before 1.0.0 to use these links along-side newer releases.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="v"><b>-v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print messages about old links removed and new links created. By default, <b>rehash</b> only lists each directory as it is processed.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="ENVIRONMENT">ENVIRONMENT</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="OPENSSL"><b>OPENSSL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The path to an executable to use to generate hashes and fingerprints (see above).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SSL_CERT_DIR"><b>SSL_CERT_DIR</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Colon separated list of directories to operate on. Ignored if directories are listed on the command line.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/openssl.html">openssl(1)</a>, <a href="../man1/crl.html">crl(1)</a>. <a href="../man1/x509.html">x509(1)</a>.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
612
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/req.html
vendored
Normal file
612
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/req.html
vendored
Normal file
@ -0,0 +1,612 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>req</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#CONFIGURATION-FILE-FORMAT">CONFIGURATION FILE FORMAT</a></li>
|
||||
<li><a href="#DISTINGUISHED-NAME-AND-ATTRIBUTE-SECTION-FORMAT">DISTINGUISHED NAME AND ATTRIBUTE SECTION FORMAT</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#DIAGNOSTICS">DIAGNOSTICS</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-req, req - PKCS#10 certificate request and certificate generating utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>req</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-text</b>] [<b>-pubkey</b>] [<b>-noout</b>] [<b>-verify</b>] [<b>-modulus</b>] [<b>-new</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-newkey rsa:bits</b>] [<b>-newkey alg:file</b>] [<b>-nodes</b>] [<b>-key filename</b>] [<b>-keyform PEM|DER</b>] [<b>-keyout filename</b>] [<b>-keygen_engine id</b>] [<b>-<i>digest</i></b>] [<b>-config filename</b>] [<b>-multivalue-rdn</b>] [<b>-x509</b>] [<b>-days n</b>] [<b>-set_serial n</b>] [<b>-newhdr</b>] [<b>-addext ext</b>] [<b>-extensions section</b>] [<b>-reqexts section</b>] [<b>-precert</b>] [<b>-utf8</b>] [<b>-nameopt</b>] [<b>-reqopt</b>] [<b>-subject</b>] [<b>-subj arg</b>] [<b>-sigopt nm:v</b>] [<b>-batch</b>] [<b>-verbose</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>req</b> command primarily creates and processes certificate requests in PKCS#10 format. It can additionally create self signed certificates for use as root CAs for example.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with the PKCS#10. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a request from or standard input if this option is not specified. A request is only read if the creation options (<b>-new</b> and <b>-newkey</b>) are not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-arg"><b>-passout arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the certificate request in text form.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="subject"><b>-subject</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the request subject (or certificate subject if <b>-x509</b> is specified)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubkey"><b>-pubkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prevents output of the encoded version of the request.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="modulus"><b>-modulus</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prints out the value of the modulus of the public key contained in the request.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>-verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verifies the signature on the request.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="new"><b>-new</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option generates a new certificate request. It will prompt the user for the relevant field values. The actual fields prompted for and their maximum and minimum sizes are specified in the configuration file and any requested extensions.</p>
|
||||
|
||||
<p>If the <b>-key</b> option is not used it will generate a new RSA private key using information specified in the configuration file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="newkey-arg"><b>-newkey arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option creates a new certificate request and a new private key. The argument takes one of several forms. <b>rsa:nbits</b>, where <b>nbits</b> is the number of bits, generates an RSA key <b>nbits</b> in size. If <b>nbits</b> is omitted, i.e. <b>-newkey rsa</b> specified, the default key size, specified in the configuration file is used.</p>
|
||||
|
||||
<p>All other algorithms support the <b>-newkey alg:file</b> form, where file may be an algorithm parameter file, created by the <b>genpkey -genparam</b> command or and X.509 certificate for a key with appropriate algorithm.</p>
|
||||
|
||||
<p><b>param:file</b> generates a key using the parameter file or certificate <b>file</b>, the algorithm is determined by the parameters. <b>algname:file</b> use algorithm <b>algname</b> and parameter file <b>file</b>: the two algorithms must match or an error occurs. <b>algname</b> just uses algorithm <b>algname</b>, and parameters, if necessary should be specified via <b>-pkeyopt</b> parameter.</p>
|
||||
|
||||
<p><b>dsa:filename</b> generates a DSA key using the parameters in the file <b>filename</b>. <b>ec:filename</b> generates EC key (usable both with ECDSA or ECDH algorithms), <b>gost2001:filename</b> generates GOST R 34.10-2001 key (requires <b>ccgost</b> engine configured in the configuration file). If just <b>gost2001</b> is specified a parameter set should be specified by <b>-pkeyopt paramset:X</b></p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkeyopt-opt:value"><b>-pkeyopt opt:value</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the public key algorithm option <b>opt</b> to <b>value</b>. The precise set of options supported depends on the public key algorithm used and its implementation. See <b>KEY GENERATION OPTIONS</b> in the <b>genpkey</b> manual page for more details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="key-filename"><b>-key filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the file to read the private key from. It also accepts PKCS#8 format private keys for PEM format files.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-PEM-DER"><b>-keyform PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The format of the private key file specified in the <b>-key</b> argument. PEM is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyout-filename"><b>-keyout filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This gives the filename to write the newly created private key to. If this option is not specified then the filename present in the configuration file is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nodes"><b>-nodes</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is specified then if a private key is created it will not be encrypted.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest"><b>-<i>digest</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the message digest to sign the request. Any digest supported by the OpenSSL <b>dgst</b> command can be used. This overrides the digest algorithm specified in the configuration file.</p>
|
||||
|
||||
<p>Some public key algorithms may override this choice. For instance, DSA signatures always use SHA1, GOST R 34.10 signatures always use GOST R 34.11-94 (<b>-md_gost94</b>), Ed25519 and Ed448 never use any digest.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="config-filename"><b>-config filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows an alternative configuration file to be specified. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="subj-arg"><b>-subj arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets subject name for new request or supersedes the subject name when processing a request. The arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>. Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted, but the corresponding type will not be included in the request.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="multivalue-rdn"><b>-multivalue-rdn</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option causes the -subj argument to be interpreted with full support for multivalued RDNs. Example:</p>
|
||||
|
||||
<p><i>/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe</i></p>
|
||||
|
||||
<p>If -multi-rdn is not used then the UID value is <i>123456+CN=John Doe</i>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="x509"><b>-x509</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option outputs a self signed certificate instead of a certificate request. This is typically used to generate a test certificate or a self signed root CA. The extensions added to the certificate (if any) are specified in the configuration file. Unless specified using the <b>set_serial</b> option, a large random number will be used for the serial number.</p>
|
||||
|
||||
<p>If existing request is specified with the <b>-in</b> option, it is converted to the self signed certificate otherwise new request is created.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="days-n"><b>-days n</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When the <b>-x509</b> option is being used this specifies the number of days to certify the certificate for, otherwise it is ignored. <b>n</b> should be a positive integer. The default is 30 days.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="set_serial-n"><b>-set_serial n</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Serial number to use when outputting a self signed certificate. This may be specified as a decimal value or a hex value if preceded by <b>0x</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="addext-ext"><b>-addext ext</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Add a specific extension to the certificate (if the <b>-x509</b> option is present) or certificate request. The argument must have the form of a key=value pair as it would appear in a config file.</p>
|
||||
|
||||
<p>This option can be given multiple times.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="extensions-section"><b>-extensions section</b></dt>
|
||||
<dd>
|
||||
|
||||
</dd>
|
||||
<dt id="reqexts-section"><b>-reqexts section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options specify alternative sections to include certificate extensions (if the <b>-x509</b> option is present) or certificate request extensions. This allows several different sections to be used in the same configuration file to specify requests for a variety of purposes.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="precert"><b>-precert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A poison extension will be added to the certificate, making it a "pre-certificate" (see RFC6962). This can be submitted to Certificate Transparency logs in order to obtain signed certificate timestamps (SCTs). These SCTs can then be embedded into the pre-certificate as an extension, before removing the poison and signing the certificate.</p>
|
||||
|
||||
<p>This implies the <b>-new</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="utf8"><b>-utf8</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nameopt-option"><b>-nameopt option</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="reqopt"><b>-reqopt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Customise the output format used with <b>-text</b>. The <b>option</b> argument can be a single option or multiple options separated by commas.</p>
|
||||
|
||||
<p>See discussion of the <b>-certopt</b> parameter in the <a href="../man1/x509.html">x509(1)</a> command.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="newhdr"><b>-newhdr</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Adds the word <b>NEW</b> to the PEM file header and footer lines on the outputted request. Some software (Netscape certificate server) and some CAs need this.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="batch"><b>-batch</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Non-interactive mode.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verbose"><b>-verbose</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print extra details about the operations being performed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>req</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keygen_engine-id"><b>-keygen_engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies an engine (by its unique <b>id</b> string) which would be used for key generation operations.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CONFIGURATION-FILE-FORMAT">CONFIGURATION FILE FORMAT</h1>
|
||||
|
||||
<p>The configuration options are specified in the <b>req</b> section of the configuration file. As with all configuration files if no value is specified in the specific section (i.e. <b>req</b>) then the initial unnamed or <b>default</b> section is searched too.</p>
|
||||
|
||||
<p>The options available are described in detail below.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="input_password-output_password"><b>input_password output_password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The passwords for the input private key file (if present) and the output private key file (if one will be created). The command line options <b>passin</b> and <b>passout</b> override the configuration file values.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_bits"><b>default_bits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the default key size in bits.</p>
|
||||
|
||||
<p>This option is used in conjunction with the <b>-new</b> option to generate a new key. It can be overridden by specifying an explicit key size in the <b>-newkey</b> option. The smallest accepted key size is 512 bits. If no key size is specified then 2048 bits is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_keyfile"><b>default_keyfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the default filename to write a private key to. If not specified the key is written to standard output. This can be overridden by the <b>-keyout</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oid_file"><b>oid_file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies a file containing additional <b>OBJECT IDENTIFIERS</b>. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed by white space and finally the long name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oid_section"><b>oid_section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies a section in the configuration file containing extra object identifiers. Each line should consist of the short name of the object identifier followed by <b>=</b> and the numerical form. The short and long names are the same when this option is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="RANDFILE"><b>RANDFILE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>At startup the specified file is loaded into the random number generator, and at exit 256 bytes will be written to it. It is used for private key generation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="encrypt_key"><b>encrypt_key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this is set to <b>no</b> then if a private key is generated it is <b>not</b> encrypted. This is equivalent to the <b>-nodes</b> command line option. For compatibility <b>encrypt_rsa_key</b> is an equivalent option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_md"><b>default_md</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option specifies the digest algorithm to use. Any digest supported by the OpenSSL <b>dgst</b> command can be used. This option can be overridden on the command line. Certain signing algorithms (i.e. Ed25519 and Ed448) will ignore any digest that has been set.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="string_mask"><b>string_mask</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option masks out the use of certain string types in certain fields. Most users will not need to change this option.</p>
|
||||
|
||||
<p>It can be set to several values <b>default</b> which is also the default option uses PrintableStrings, T61Strings and BMPStrings if the <b>pkix</b> value is used then only PrintableStrings and BMPStrings will be used. This follows the PKIX recommendation in RFC2459. If the <b>utf8only</b> option is used then only UTF8Strings will be used: this is the PKIX recommendation in RFC2459 after 2003. Finally the <b>nombstr</b> option just uses PrintableStrings and T61Strings: certain software has problems with BMPStrings and UTF8Strings: in particular Netscape.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="req_extensions"><b>req_extensions</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the configuration file section containing a list of extensions to add to the certificate request. It can be overridden by the <b>-reqexts</b> command line switch. See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="x509_extensions"><b>x509_extensions</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the configuration file section containing a list of extensions to add to certificate generated when the <b>-x509</b> switch is used. It can be overridden by the <b>-extensions</b> command line switch.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="prompt"><b>prompt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If set to the value <b>no</b> this disables prompting of certificate fields and just takes values from the config file directly. It also changes the expected format of the <b>distinguished_name</b> and <b>attributes</b> sections.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="utf81"><b>utf8</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If set to the value <b>yes</b> then field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="attributes"><b>attributes</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the section containing any request attributes: its format is the same as <b>distinguished_name</b>. Typically these may contain the challengePassword or unstructuredName types. They are currently ignored by OpenSSL's request signing utilities but some CAs might want them.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="distinguished_name"><b>distinguished_name</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the section containing the distinguished name fields to prompt for when generating a certificate or certificate request. The format is described in the next section.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="DISTINGUISHED-NAME-AND-ATTRIBUTE-SECTION-FORMAT">DISTINGUISHED NAME AND ATTRIBUTE SECTION FORMAT</h1>
|
||||
|
||||
<p>There are two separate formats for the distinguished name and attribute sections. If the <b>prompt</b> option is set to <b>no</b> then these sections just consist of field names and values: for example,</p>
|
||||
|
||||
<pre><code>CN=My Name
|
||||
OU=My Organization
|
||||
emailAddress=someone@somewhere.org</code></pre>
|
||||
|
||||
<p>This allows external programs (e.g. GUI based) to generate a template file with all the field names and values and just pass it to <b>req</b>. An example of this kind of configuration file is contained in the <b>EXAMPLES</b> section.</p>
|
||||
|
||||
<p>Alternatively if the <b>prompt</b> option is absent or not set to <b>no</b> then the file contains field prompting information. It consists of lines of the form:</p>
|
||||
|
||||
<pre><code>fieldName="prompt"
|
||||
fieldName_default="default field value"
|
||||
fieldName_min= 2
|
||||
fieldName_max= 4</code></pre>
|
||||
|
||||
<p>"fieldName" is the field name being used, for example commonName (or CN). The "prompt" string is used to ask the user to enter the relevant details. If the user enters nothing then the default value is used if no default value is present then the field is omitted. A field can still be omitted if a default value is present if the user just enters the '.' character.</p>
|
||||
|
||||
<p>The number of characters entered must be between the fieldName_min and fieldName_max limits: there may be additional restrictions based on the field being used (for example countryName can only ever be two characters long and must fit in a PrintableString).</p>
|
||||
|
||||
<p>Some fields (such as organizationName) can be used more than once in a DN. This presents a problem because configuration files will not recognize the same name occurring twice. To avoid this problem if the fieldName contains some characters followed by a full stop they will be ignored. So for example a second organizationName can be input by calling it "1.organizationName".</p>
|
||||
|
||||
<p>The actual permitted field names are any object identifier short or long names. These are compiled into OpenSSL and include the usual values such as commonName, countryName, localityName, organizationName, organizationalUnitName, stateOrProvinceName. Additionally emailAddress is included as well as name, surname, givenName, initials, and dnQualifier.</p>
|
||||
|
||||
<p>Additional object identifiers can be defined with the <b>oid_file</b> or <b>oid_section</b> options in the configuration file. Any additional fields will be treated as though they were a DirectoryString.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Examine and verify certificate request:</p>
|
||||
|
||||
<pre><code>openssl req -in req.pem -text -verify -noout</code></pre>
|
||||
|
||||
<p>Create a private key and then generate a certificate request from it:</p>
|
||||
|
||||
<pre><code>openssl genrsa -out key.pem 2048
|
||||
openssl req -new -key key.pem -out req.pem</code></pre>
|
||||
|
||||
<p>The same but just using req:</p>
|
||||
|
||||
<pre><code>openssl req -newkey rsa:2048 -keyout key.pem -out req.pem</code></pre>
|
||||
|
||||
<p>Generate a self signed root certificate:</p>
|
||||
|
||||
<pre><code>openssl req -x509 -newkey rsa:2048 -keyout key.pem -out req.pem</code></pre>
|
||||
|
||||
<p>Example of a file pointed to by the <b>oid_file</b> option:</p>
|
||||
|
||||
<pre><code>1.2.3.4 shortName A longer Name
|
||||
1.2.3.6 otherName Other longer Name</code></pre>
|
||||
|
||||
<p>Example of a section pointed to by <b>oid_section</b> making use of variable expansion:</p>
|
||||
|
||||
<pre><code>testoid1=1.2.3.5
|
||||
testoid2=${testoid1}.6</code></pre>
|
||||
|
||||
<p>Sample configuration file prompting for field values:</p>
|
||||
|
||||
<pre><code>[ req ]
|
||||
default_bits = 2048
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
req_extensions = v3_ca
|
||||
|
||||
dirstring_type = nobmp
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = AU
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 40
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
basicConstraints = critical, CA:true</code></pre>
|
||||
|
||||
<p>Sample configuration containing all field values:</p>
|
||||
|
||||
<pre><code>RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_keyfile = keyfile.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
prompt = no
|
||||
output_password = mypass
|
||||
|
||||
[ req_distinguished_name ]
|
||||
C = GB
|
||||
ST = Test State or Province
|
||||
L = Test Locality
|
||||
O = Organization Name
|
||||
OU = Organizational Unit Name
|
||||
CN = Common Name
|
||||
emailAddress = test@email.address
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password</code></pre>
|
||||
|
||||
<p>Example of giving the most common attributes (subject and extensions) on the command line:</p>
|
||||
|
||||
<pre><code>openssl req -new -subj "/C=GB/CN=foo" \
|
||||
-addext "subjectAltName = DNS:foo.co.uk" \
|
||||
-addext "certificatePolicies = 1.2.3.4" \
|
||||
-newkey rsa:2048 -keyout key.pem -out req.pem</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The header and footer lines in the <b>PEM</b> format are normally:</p>
|
||||
|
||||
<pre><code>-----BEGIN CERTIFICATE REQUEST-----
|
||||
-----END CERTIFICATE REQUEST-----</code></pre>
|
||||
|
||||
<p>some software (some versions of Netscape certificate server) instead needs:</p>
|
||||
|
||||
<pre><code>-----BEGIN NEW CERTIFICATE REQUEST-----
|
||||
-----END NEW CERTIFICATE REQUEST-----</code></pre>
|
||||
|
||||
<p>which is produced with the <b>-newhdr</b> option but is otherwise compatible. Either form is accepted transparently on input.</p>
|
||||
|
||||
<p>The certificate requests generated by <b>Xenroll</b> with MSIE have extensions added. It includes the <b>keyUsage</b> extension which determines the type of key (signature only or general purpose) and any additional OIDs entered by the script in an extendedKeyUsage extension.</p>
|
||||
|
||||
<h1 id="DIAGNOSTICS">DIAGNOSTICS</h1>
|
||||
|
||||
<p>The following messages are frequently asked about:</p>
|
||||
|
||||
<pre><code>Using configuration from /some/path/openssl.cnf
|
||||
Unable to load config info</code></pre>
|
||||
|
||||
<p>This is followed some time later by...</p>
|
||||
|
||||
<pre><code>unable to find 'distinguished_name' in config
|
||||
problems making Certificate Request</code></pre>
|
||||
|
||||
<p>The first error message is the clue: it can't find the configuration file! Certain operations (like examining a certificate request) don't need a configuration file so its use isn't enforced. Generation of certificates or requests however does need a configuration file. This could be regarded as a bug.</p>
|
||||
|
||||
<p>Another puzzling message is this:</p>
|
||||
|
||||
<pre><code>Attributes:
|
||||
a0:00</code></pre>
|
||||
|
||||
<p>this is displayed when no attributes are present and the request includes the correct empty <b>SET OF</b> structure (the DER encoding of which is 0xa0 0x00). If you just see:</p>
|
||||
|
||||
<pre><code>Attributes:</code></pre>
|
||||
|
||||
<p>then the <b>SET OF</b> is missing and the encoding is technically invalid (but it is tolerated). See the description of the command line option <b>-asn1-kludge</b> for more information.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>OpenSSL's handling of T61Strings (aka TeletexStrings) is broken: it effectively treats them as ISO-8859-1 (Latin 1), Netscape and MSIE have similar behaviour. This can cause problems if you need characters that aren't available in PrintableStrings and you don't want to or can't use BMPStrings.</p>
|
||||
|
||||
<p>As a consequence of the T61String handling the only correct way to represent accented characters in OpenSSL is to use a BMPString: unfortunately Netscape currently chokes on these. If you have to use accented characters with Netscape and MSIE then you currently need to use the invalid T61String form.</p>
|
||||
|
||||
<p>The current prompting is not very friendly. It doesn't allow you to confirm what you've just entered. Other things like extensions in certificate requests are statically defined in the configuration file. Some of these: like an email address in subjectAltName should be input by the user.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/x509.html">x509(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man5/config.html">config(5)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
202
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rsa.html
vendored
Normal file
202
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rsa.html
vendored
Normal file
@ -0,0 +1,202 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>rsa</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-rsa, rsa - RSA key processing tool</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>rsa</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-modulus</b>] [<b>-check</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-RSAPublicKey_in</b>] [<b>-RSAPublicKey_out</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>rsa</b> command processes RSA keys. They can be converted between various forms and their components printed out. <b>Note</b> this command uses the traditional SSLeay compatible format for private key encryption: newer applications should use the more secure PKCS#8 format using the <b>pkcs8</b> utility.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with the PKCS#1 RSAPrivateKey or SubjectPublicKeyInfo format. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines. On input PKCS#8 format private keys are also accepted.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write a key to or standard output if this option is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passout-password"><b>-passout password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options encrypt the private key with the specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the <b>rsa</b> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the various public or private key components in plain text in addition to the encoded version.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prevents output of the encoded version of the key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="modulus"><b>-modulus</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prints out the value of the modulus of the key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="check"><b>-check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option checks the consistency of an RSA private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubin"><b>-pubin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default a private key is read from the input file: with this option a public key is read instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubout"><b>-pubout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default a private key is output: with this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="RSAPublicKey_in--RSAPublicKey_out"><b>-RSAPublicKey_in</b>, <b>-RSAPublicKey_out</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Like <b>-pubin</b> and <b>-pubout</b> except <b>RSAPublicKey</b> format is used instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>rsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The PEM private key format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN RSA PRIVATE KEY-----
|
||||
-----END RSA PRIVATE KEY-----</code></pre>
|
||||
|
||||
<p>The PEM public key format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN PUBLIC KEY-----
|
||||
-----END PUBLIC KEY-----</code></pre>
|
||||
|
||||
<p>The PEM <b>RSAPublicKey</b> format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN RSA PUBLIC KEY-----
|
||||
-----END RSA PUBLIC KEY-----</code></pre>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>To remove the pass phrase on an RSA private key:</p>
|
||||
|
||||
<pre><code>openssl rsa -in key.pem -out keyout.pem</code></pre>
|
||||
|
||||
<p>To encrypt a private key using triple DES:</p>
|
||||
|
||||
<pre><code>openssl rsa -in key.pem -des3 -out keyout.pem</code></pre>
|
||||
|
||||
<p>To convert a private key from PEM to DER format:</p>
|
||||
|
||||
<pre><code>openssl rsa -in key.pem -outform DER -out keyout.der</code></pre>
|
||||
|
||||
<p>To print out the components of a private key to standard output:</p>
|
||||
|
||||
<pre><code>openssl rsa -in key.pem -text -noout</code></pre>
|
||||
|
||||
<p>To just output the public part of a private key:</p>
|
||||
|
||||
<pre><code>openssl rsa -in key.pem -pubout -out pubkey.pem</code></pre>
|
||||
|
||||
<p>Output the public part of a private key in <b>RSAPublicKey</b> format:</p>
|
||||
|
||||
<pre><code>openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>There should be an option that automatically handles .key files, without having to manually edit them.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
236
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rsautl.html
vendored
Normal file
236
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/rsautl.html
vendored
Normal file
@ -0,0 +1,236 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>rsautl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-rsautl, rsautl - RSA utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>rsautl</b> [<b>-help</b>] [<b>-in file</b>] [<b>-out file</b>] [<b>-inkey file</b>] [<b>-keyform PEM|DER|ENGINE</b>] [<b>-pubin</b>] [<b>-certin</b>] [<b>-sign</b>] [<b>-verify</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-pkcs</b>] [<b>-ssl</b>] [<b>-raw</b>] [<b>-hexdump</b>] [<b>-asn1parse</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>rsautl</b> command can be used to sign, verify, encrypt and decrypt data using the RSA algorithm.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read data from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inkey-file"><b>-inkey file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input key file, by default it should be an RSA private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The key format PEM, DER or ENGINE.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubin"><b>-pubin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file is an RSA public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certin"><b>-certin</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input is a certificate containing an RSA public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign"><b>-sign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sign the input data and output the signed result. This requires an RSA private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>-verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the input data and output the recovered data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="encrypt"><b>-encrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encrypt the input data using an RSA public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="decrypt"><b>-decrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Decrypt the input data using an RSA private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pkcs--oaep--ssl--raw"><b>-pkcs, -oaep, -ssl, -raw</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The padding to use: PKCS#1 v1.5 (the default), PKCS#1 OAEP, special padding used in SSL v2 backwards compatible handshakes, or no padding, respectively. For signatures, only <b>-pkcs</b> and <b>-raw</b> can be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hexdump"><b>-hexdump</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Hex dump the output data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="asn1parse"><b>-asn1parse</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Parse the ASN.1 output data, this is useful when combined with the <b>-verify</b> option.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p><b>rsautl</b> because it uses the RSA algorithm directly can only be used to sign or verify small pieces of data.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Sign some data using a private key:</p>
|
||||
|
||||
<pre><code>openssl rsautl -sign -in file -inkey key.pem -out sig</code></pre>
|
||||
|
||||
<p>Recover the signed data</p>
|
||||
|
||||
<pre><code>openssl rsautl -verify -in sig -inkey key.pem</code></pre>
|
||||
|
||||
<p>Examine the raw signed data:</p>
|
||||
|
||||
<pre><code>openssl rsautl -verify -in sig -inkey key.pem -raw -hexdump
|
||||
|
||||
0000 - 00 01 ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
|
||||
0010 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
|
||||
0020 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
|
||||
0030 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
|
||||
0040 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
|
||||
0050 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
|
||||
0060 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
|
||||
0070 - ff ff ff ff 00 68 65 6c-6c 6f 20 77 6f 72 6c 64 .....hello world</code></pre>
|
||||
|
||||
<p>The PKCS#1 block formatting is evident from this. If this was done using encrypt and decrypt the block would have been of type 2 (the second byte) and random padding data visible instead of the 0xff bytes.</p>
|
||||
|
||||
<p>It is possible to analyse the signature of certificates using this utility in conjunction with <b>asn1parse</b>. Consider the self signed example in certs/pca-cert.pem . Running <b>asn1parse</b> as follows yields:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -in pca-cert.pem
|
||||
|
||||
0:d=0 hl=4 l= 742 cons: SEQUENCE
|
||||
4:d=1 hl=4 l= 591 cons: SEQUENCE
|
||||
8:d=2 hl=2 l= 3 cons: cont [ 0 ]
|
||||
10:d=3 hl=2 l= 1 prim: INTEGER :02
|
||||
13:d=2 hl=2 l= 1 prim: INTEGER :00
|
||||
16:d=2 hl=2 l= 13 cons: SEQUENCE
|
||||
18:d=3 hl=2 l= 9 prim: OBJECT :md5WithRSAEncryption
|
||||
29:d=3 hl=2 l= 0 prim: NULL
|
||||
31:d=2 hl=2 l= 92 cons: SEQUENCE
|
||||
33:d=3 hl=2 l= 11 cons: SET
|
||||
35:d=4 hl=2 l= 9 cons: SEQUENCE
|
||||
37:d=5 hl=2 l= 3 prim: OBJECT :countryName
|
||||
42:d=5 hl=2 l= 2 prim: PRINTABLESTRING :AU
|
||||
....
|
||||
599:d=1 hl=2 l= 13 cons: SEQUENCE
|
||||
601:d=2 hl=2 l= 9 prim: OBJECT :md5WithRSAEncryption
|
||||
612:d=2 hl=2 l= 0 prim: NULL
|
||||
614:d=1 hl=3 l= 129 prim: BIT STRING</code></pre>
|
||||
|
||||
<p>The final BIT STRING contains the actual signature. It can be extracted with:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -in pca-cert.pem -out sig -noout -strparse 614</code></pre>
|
||||
|
||||
<p>The certificate public key can be extracted with:</p>
|
||||
|
||||
<pre><code>openssl x509 -in test/testx509.pem -pubkey -noout >pubkey.pem</code></pre>
|
||||
|
||||
<p>The signature can be analysed with:</p>
|
||||
|
||||
<pre><code>openssl rsautl -in sig -verify -asn1parse -inkey pubkey.pem -pubin
|
||||
|
||||
0:d=0 hl=2 l= 32 cons: SEQUENCE
|
||||
2:d=1 hl=2 l= 12 cons: SEQUENCE
|
||||
4:d=2 hl=2 l= 8 prim: OBJECT :md5
|
||||
14:d=2 hl=2 l= 0 prim: NULL
|
||||
16:d=1 hl=2 l= 16 prim: OCTET STRING
|
||||
0000 - f3 46 9e aa 1a 4a 73 c9-37 ea 93 00 48 25 08 b5 .F...Js.7...H%..</code></pre>
|
||||
|
||||
<p>This is the parsed version of an ASN1 DigestInfo structure. It can be seen that the digest used was md5. The actual part of the certificate that was signed can be extracted with:</p>
|
||||
|
||||
<pre><code>openssl asn1parse -in pca-cert.pem -out tbs -noout -strparse 4</code></pre>
|
||||
|
||||
<p>and its digest computed with:</p>
|
||||
|
||||
<pre><code>openssl md5 -c tbs
|
||||
MD5(tbs)= f3:46:9e:aa:1a:4a:73:c9:37:ea:93:00:48:25:08:b5</code></pre>
|
||||
|
||||
<p>which it can be seen agrees with the recovered value above.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/dgst.html">dgst(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
681
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/s_client.html
vendored
Normal file
681
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/s_client.html
vendored
Normal file
@ -0,0 +1,681 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>s_client</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#CONNECTED-COMMANDS">CONNECTED COMMANDS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-s_client, s_client - SSL/TLS client program</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>s_client</b> [<b>-help</b>] [<b>-connect host:port</b>] [<b>-bind host:port</b>] [<b>-proxy host:port</b>] [<b>-unix path</b>] [<b>-4</b>] [<b>-6</b>] [<b>-servername name</b>] [<b>-noservername</b>] [<b>-verify depth</b>] [<b>-verify_return_error</b>] [<b>-cert filename</b>] [<b>-certform DER|PEM</b>] [<b>-key filename</b>] [<b>-keyform DER|PEM</b>] [<b>-cert_chain filename</b>] [<b>-build_chain</b>] [<b>-xkey</b>] [<b>-xcert</b>] [<b>-xchain</b>] [<b>-xchain_build</b>] [<b>-xcertform PEM|DER</b>] [<b>-xkeyform PEM|DER</b>] [<b>-pass arg</b>] [<b>-CApath directory</b>] [<b>-CAfile filename</b>] [<b>-chainCApath directory</b>] [<b>-chainCAfile filename</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-requestCAfile filename</b>] [<b>-dane_tlsa_domain domain</b>] [<b>-dane_tlsa_rrdata rrdata</b>] [<b>-dane_ee_no_namechecks</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-nameopt option</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-build_chain</b>] [<b>-x509_strict</b>] [<b>-reconnect</b>] [<b>-showcerts</b>] [<b>-debug</b>] [<b>-msg</b>] [<b>-nbio_test</b>] [<b>-state</b>] [<b>-nbio</b>] [<b>-crlf</b>] [<b>-ign_eof</b>] [<b>-no_ign_eof</b>] [<b>-psk_identity identity</b>] [<b>-psk key</b>] [<b>-psk_session file</b>] [<b>-quiet</b>] [<b>-ssl3</b>] [<b>-tls1</b>] [<b>-tls1_1</b>] [<b>-tls1_2</b>] [<b>-tls1_3</b>] [<b>-no_ssl3</b>] [<b>-no_tls1</b>] [<b>-no_tls1_1</b>] [<b>-no_tls1_2</b>] [<b>-no_tls1_3</b>] [<b>-dtls</b>] [<b>-dtls1</b>] [<b>-dtls1_2</b>] [<b>-sctp</b>] [<b>-sctp_label_bug</b>] [<b>-fallback_scsv</b>] [<b>-async</b>] [<b>-max_send_frag</b>] [<b>-split_send_frag</b>] [<b>-max_pipelines</b>] [<b>-read_buf</b>] [<b>-bugs</b>] [<b>-comp</b>] [<b>-no_comp</b>] [<b>-allow_no_dhe_kex</b>] [<b>-sigalgs sigalglist</b>] [<b>-curves curvelist</b>] [<b>-cipher cipherlist</b>] [<b>-ciphersuites val</b>] [<b>-serverpref</b>] [<b>-starttls protocol</b>] [<b>-xmpphost hostname</b>] [<b>-name hostname</b>] [<b>-engine id</b>] [<b>-tlsextdebug</b>] [<b>-no_ticket</b>] [<b>-sess_out filename</b>] [<b>-sess_in filename</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-serverinfo types</b>] [<b>-status</b>] [<b>-alpn protocols</b>] [<b>-nextprotoneg protocols</b>] [<b>-ct</b>] [<b>-noct</b>] [<b>-ctlogfile</b>] [<b>-keylogfile file</b>] [<b>-early_data file</b>] [<b>-enable_pha</b>] [<b>target</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>s_client</b> command implements a generic SSL/TLS client which connects to a remote host using SSL/TLS. It is a <i>very</i> useful diagnostic tool for SSL servers.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>In addition to the options below the <b>s_client</b> utility also supports the common and client only options documented in the "Supported Command Line Commands" section of the <a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a> manual page.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="connect-host:port"><b>-connect host:port</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the host and optional port to connect to. It is possible to select the host and port using the optional target positional argument instead. If neither this nor the target positional argument are specified then an attempt is made to connect to the local host on port 4433.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bind-host:port"><b>-bind host:port</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the host address and or port to bind as the source for the connection. For Unix-domain sockets the port is ignored and the host is used as the source socket address.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="proxy-host:port"><b>-proxy host:port</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When used with the <b>-connect</b> flag, the program uses the host and port specified with this flag and issues an HTTP CONNECT command to connect to the desired server.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="unix-path"><b>-unix path</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Connect over the specified Unix-domain socket.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-4"><b>-4</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use IPv4 only.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-6"><b>-6</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use IPv6 only.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="servername-name"><b>-servername name</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the TLS SNI (Server Name Indication) extension in the ClientHello message to the given value. If <b>-servername</b> is not provided, the TLS SNI extension will be populated with the name given to <b>-connect</b> if it follows a DNS name format. If <b>-connect</b> is not provided either, the SNI is set to "localhost". This is the default since OpenSSL 1.1.1.</p>
|
||||
|
||||
<p>Even though SNI should normally be a DNS name and not an IP address, if <b>-servername</b> is provided then that name will be sent, regardless of whether it is a DNS name or not.</p>
|
||||
|
||||
<p>This option cannot be used in conjunction with <b>-noservername</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noservername"><b>-noservername</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Suppresses sending of the SNI (Server Name Indication) extension in the ClientHello message. Cannot be used in conjunction with the <b>-servername</b> or <-dane_tlsa_domain> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert-certname"><b>-cert certname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate to use, if one is requested by the server. The default is not to use a certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certform-format"><b>-certform format</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate format to use: DER or PEM. PEM is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="key-keyfile"><b>-key keyfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key to use. If not specified then the certificate file will be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-format"><b>-keyform format</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private format to use: DER or PEM. PEM is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert_chain"><b>-cert_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use when attempting to build the client/server certificate chain related to the certificate specified via the <b>-cert</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="build_chain"><b>-build_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify whether the application should build the certificate chain to be provided to the server.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="xkey-infile--xcert-infile--xchain"><b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify an extra certificate, private key and certificate chain. These behave in the same manner as the <b>-cert</b>, <b>-key</b> and <b>-cert_chain</b> options. When specified, the callback returning the first valid chain will be in use by the client.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="xchain_build"><b>-xchain_build</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify whether the application should build the certificate chain to be provided to the server for the extra certificates provided via <b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="xcertform-PEM-DER--xkeyform-PEM-DER"><b>-xcertform PEM|DER</b>, <b>-xkeyform PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Extra certificate and private key format respectively.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pass-arg"><b>-pass arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>the private key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify-depth"><b>-verify depth</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The verify depth to use. This specifies the maximum length of the server certificate chain and turns on server certificate verification. Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_return_error"><b>-verify_return_error</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Return verification errors instead of continuing. This will typically abort the handshake with a fatal error.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nameopt-option"><b>-nameopt option</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-directory"><b>-CApath directory</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The directory to use for server certificate verification. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information. These are also used when building the client certificate chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file"><b>-CAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use during server authentication and to use when attempting to build the client certificate chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="chainCApath-directory"><b>-chainCApath directory</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The directory to use for building the chain provided to the server. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="chainCAfile-file"><b>-chainCAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use when attempting to build the client certificate chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="requestCAfile-file"><b>-requestCAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing a list of certificates whose subject names will be sent to the server in the <b>certificate_authorities</b> extension. Only supported for TLS 1.3</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dane_tlsa_domain-domain"><b>-dane_tlsa_domain domain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enable RFC6698/RFC7671 DANE TLSA authentication and specify the TLSA base domain which becomes the default SNI hint and the primary reference identifier for hostname checks. This must be used in combination with at least one instance of the <b>-dane_tlsa_rrdata</b> option below.</p>
|
||||
|
||||
<p>When DANE authentication succeeds, the diagnostic output will include the lowest (closest to 0) depth at which a TLSA record authenticated a chain certificate. When that TLSA record is a "2 1 0" trust anchor public key that signed (rather than matched) the top-most certificate of the chain, the result is reported as "TA public key verified". Otherwise, either the TLSA record "matched TA certificate" at a positive depth or else "matched EE certificate" at depth 0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dane_tlsa_rrdata-rrdata"><b>-dane_tlsa_rrdata rrdata</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use one or more times to specify the RRDATA fields of the DANE TLSA RRset associated with the target service. The <b>rrdata</b> value is specified in "presentation form", that is four whitespace separated fields that specify the usage, selector, matching type and associated data, with the last of these encoded in hexadecimal. Optional whitespace is ignored in the associated data field. For example:</p>
|
||||
|
||||
<pre><code>$ openssl s_client -brief -starttls smtp \
|
||||
-connect smtp.example.com:25 \
|
||||
-dane_tlsa_domain smtp.example.com \
|
||||
-dane_tlsa_rrdata "2 1 1
|
||||
B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B" \
|
||||
-dane_tlsa_rrdata "2 1 1
|
||||
60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18"
|
||||
...
|
||||
Verification: OK
|
||||
Verified peername: smtp.example.com
|
||||
DANE TLSA 2 1 1 ...ee12d2cc90180517616e8a18 matched TA certificate at depth 1
|
||||
...</code></pre>
|
||||
|
||||
</dd>
|
||||
<dt id="dane_ee_no_namechecks"><b>-dane_ee_no_namechecks</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This disables server name checks when authenticating via DANE-EE(3) TLSA records. For some applications, primarily web browsers, it is not safe to disable name checks due to "unknown key share" attacks, in which a malicious server can convince a client that a connection to a victim server is instead a secure connection to the malicious server. The malicious server may then be able to violate cross-origin scripting restrictions. Thus, despite the text of RFC7671, name checks are by default enabled for DANE-EE(3) TLSA records, and can be disabled in applications where it is safe to do so. In particular, SMTP and XMPP clients should set this option as SRV and MX records already make it possible for a remote domain to redirect client connections to any server of its choice, and in any case SMTP and XMPP clients do not execute scripts downloaded from remote servers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set various certificate chain validation options. See the <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="reconnect"><b>-reconnect</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Reconnects to the same server 5 times using the same session ID, this can be used as a test that session caching is working.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="showcerts"><b>-showcerts</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Displays the server certificate list as sent by the server: it only consists of certificates the server has sent (in the order the server has sent them). It is <b>not</b> a verified chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="prexit"><b>-prexit</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print session information when the program exits. This will always attempt to print out information even if the connection fails. Normally information will only be printed out once if the connection succeeds. This option is useful because the cipher in use may be renegotiated or the connection may fail because a client certificate is required or is requested only after an attempt is made to access a certain URL. Note: the output produced by this option is not always accurate because a connection might never have been established.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="state"><b>-state</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the SSL session states.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="debug"><b>-debug</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print extensive debugging information including a hex dump of all traffic.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="msg"><b>-msg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Show all protocol messages with hex dump.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="trace"><b>-trace</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Show verbose trace output of protocol messages. OpenSSL needs to be compiled with <b>enable-ssl-trace</b> for this option to work.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="msgfile"><b>-msgfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File to send output of <b>-msg</b> or <b>-trace</b> to, default standard output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nbio_test"><b>-nbio_test</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Tests non-blocking I/O</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nbio"><b>-nbio</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Turns on non-blocking I/O</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crlf"><b>-crlf</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option translated a line feed from the terminal into CR+LF as required by some servers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ign_eof"><b>-ign_eof</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Inhibit shutting down the connection when end of file is reached in the input.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="quiet"><b>-quiet</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Inhibit printing of session and certificate information. This implicitly turns on <b>-ign_eof</b> as well.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_ign_eof"><b>-no_ign_eof</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Shut down the connection when end of file is reached in the input. Can be used to override the implicit <b>-ign_eof</b> after <b>-quiet</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk_identity-identity"><b>-psk_identity identity</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the PSK identity <b>identity</b> when using a PSK cipher suite. The default value is "Client_identity" (without the quotes).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk-key"><b>-psk key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the PSK key <b>key</b> when using a PSK cipher suite. The key is given as a hexadecimal number without leading 0x, for example -psk 1a2b3c4d. This option must be provided in order to use a PSK cipher.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk_session-file"><b>-psk_session file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the pem encoded SSL_SESSION data stored in <b>file</b> as the basis of a PSK. Note that this will only work if TLSv1.3 is negotiated.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ssl3--tls1--tls1_1--tls1_2--tls1_3--no_ssl3--no_tls1--no_tls1_1--no_tls1_2--no_tls1_3"><b>-ssl3</b>, <b>-tls1</b>, <b>-tls1_1</b>, <b>-tls1_2</b>, <b>-tls1_3</b>, <b>-no_ssl3</b>, <b>-no_tls1</b>, <b>-no_tls1_1</b>, <b>-no_tls1_2</b>, <b>-no_tls1_3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options require or disable the use of the specified SSL or TLS protocols. By default <b>s_client</b> will negotiate the highest mutually supported protocol version. When a specific TLS version is required, only that version will be offered to and accepted from the server. Note that not all protocols and flags may be available, depending on how OpenSSL was built.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dtls--dtls1--dtls1_2"><b>-dtls</b>, <b>-dtls1</b>, <b>-dtls1_2</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options make <b>s_client</b> use DTLS protocols instead of TLS. With <b>-dtls</b>, <b>s_client</b> will negotiate any supported DTLS protocol version, whilst <b>-dtls1</b> and <b>-dtls1_2</b> will only support DTLS1.0 and DTLS1.2 respectively.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sctp"><b>-sctp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in conjunction with <b>-dtls</b>, <b>-dtls1</b> or <b>-dtls1_2</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sctp_label_bug"><b>-sctp_label_bug</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the incorrect behaviour of older OpenSSL implementations when computing endpoint-pair shared secrets for DTLS/SCTP. This allows communication with older broken implementations but breaks interoperability with correct implementations. Must be used in conjunction with <b>-sctp</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="fallback_scsv"><b>-fallback_scsv</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send TLS_FALLBACK_SCSV in the ClientHello.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="async"><b>-async</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Switch on asynchronous mode. Cryptographic operations will be performed asynchronously. This will only have an effect if an asynchronous capable engine is also used via the <b>-engine</b> option. For test purposes the dummy async engine (dasync) can be used (if available).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="max_send_frag-int"><b>-max_send_frag int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The maximum size of data fragment to send. See <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a> for further information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="split_send_frag-int"><b>-split_send_frag int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The size used to split data for encrypt pipelines. If more data is written in one go than this value then it will be split into multiple pipelines, up to the maximum number of pipelines defined by max_pipelines. This only has an effect if a suitable cipher suite has been negotiated, an engine that supports pipelining has been loaded, and max_pipelines is greater than 1. See <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a> for further information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="max_pipelines-int"><b>-max_pipelines int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The maximum number of encrypt/decrypt pipelines to be used. This will only have an effect if an engine has been loaded that supports pipelining (e.g. the dasync engine) and a suitable cipher suite has been negotiated. The default value is 1. See <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a> for further information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="read_buf-int"><b>-read_buf int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The default read buffer size to be used for connections. This will only have an effect if the buffer size is larger than the size that would otherwise be used and pipelining is in use (see <a href="../man3/SSL_CTX_set_default_read_buffer_len.html">SSL_CTX_set_default_read_buffer_len(3)</a> for further information).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bugs"><b>-bugs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="comp"><b>-comp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enables support for SSL/TLS compression. This option was introduced in OpenSSL 1.1.0. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_comp"><b>-no_comp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Disables support for SSL/TLS compression. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="brief"><b>-brief</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Only provide a brief summary of connection parameters instead of the normal verbose output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sigalgs-sigalglist"><b>-sigalgs sigalglist</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the list of signature algorithms that are sent by the client. The server selects one entry in the list based on its preferences. For example strings, see <a href="../man3/SSL_CTX_set1_sigalgs.html">SSL_CTX_set1_sigalgs(3)</a></p>
|
||||
|
||||
</dd>
|
||||
<dt id="curves-curvelist"><b>-curves curvelist</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the list of supported curves to be sent by the client. The curve is ultimately selected by the server. For a list of all curves, use:</p>
|
||||
|
||||
<pre><code>$ openssl ecparam -list_curves</code></pre>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher-cipherlist"><b>-cipher cipherlist</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the TLSv1.2 and below cipher list sent by the client to be modified. This list will be combined with any TLSv1.3 ciphersuites that have been configured. Although the server determines which ciphersuite is used it should take the first supported cipher in the list sent by the client. See the <b>ciphers</b> command for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the TLSv1.3 ciphersuites sent by the client to be modified. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See the <b>ciphers</b> command for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="starttls-protocol"><b>-starttls protocol</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send the protocol-specific message(s) to switch to TLS for communication. <b>protocol</b> is a keyword for the intended protocol. Currently, the only supported keywords are "smtp", "pop3", "imap", "ftp", "xmpp", "xmpp-server", "irc", "postgres", "mysql", "lmtp", "nntp", "sieve" and "ldap".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="xmpphost-hostname"><b>-xmpphost hostname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option, when used with "-starttls xmpp" or "-starttls xmpp-server", specifies the host for the "to" attribute of the stream element. If this option is not specified, then the host specified with "-connect" will be used.</p>
|
||||
|
||||
<p>This option is an alias of the <b>-name</b> option for "xmpp" and "xmpp-server".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="name-hostname"><b>-name hostname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option is used to specify hostname information for various protocols used with <b>-starttls</b> option. Currently only "xmpp", "xmpp-server", "smtp" and "lmtp" can utilize this <b>-name</b> option.</p>
|
||||
|
||||
<p>If this option is used with "-starttls xmpp" or "-starttls xmpp-server", if specifies the host for the "to" attribute of the stream element. If this option is not specified, then the host specified with "-connect" will be used.</p>
|
||||
|
||||
<p>If this option is used with "-starttls lmtp" or "-starttls smtp", it specifies the name to use in the "LMTP LHLO" or "SMTP EHLO" message, respectively. If this option is not specified, then "mail.example.com" will be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="tlsextdebug"><b>-tlsextdebug</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a hex dump of any TLS extensions received from the server.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_ticket"><b>-no_ticket</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Disable RFC4507bis session ticket support.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sess_out-filename"><b>-sess_out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output SSL session to <b>filename</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sess_in-sess.pem"><b>-sess_in sess.pem</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Load SSL session from <b>filename</b>. The client will attempt to resume a connection from this session.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>s_client</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="serverinfo-types"><b>-serverinfo types</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A list of comma-separated TLS Extension Types (numbers between 0 and 65535). Each type will be sent as an empty ClientHello TLS Extension. The server's response (if any) will be encoded and displayed as a PEM file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="status"><b>-status</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sends a certificate status request to the server (OCSP stapling). The server response (if any) is printed out.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="alpn-protocols--nextprotoneg-protocols"><b>-alpn protocols</b>, <b>-nextprotoneg protocols</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These flags enable the Enable the Application-Layer Protocol Negotiation or Next Protocol Negotiation (NPN) extension, respectively. ALPN is the IETF standard and replaces NPN. The <b>protocols</b> list is a comma-separated list of protocol names that the client should advertise support for. The list should contain the most desirable protocols first. Protocol names are printable ASCII strings, for example "http/1.1" or "spdy/3". An empty list of protocols is treated specially and will cause the client to advertise support for the TLS extension but disconnect just after receiving ServerHello with a list of server supported protocols. The flag <b>-nextprotoneg</b> cannot be specified if <b>-tls1_3</b> is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ct--noct"><b>-ct</b>, <b>-noct</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use one of these two options to control whether Certificate Transparency (CT) is enabled (<b>-ct</b>) or disabled (<b>-noct</b>). If CT is enabled, signed certificate timestamps (SCTs) will be requested from the server and reported at handshake completion.</p>
|
||||
|
||||
<p>Enabling CT also enables OCSP stapling, as this is one possible delivery method for SCTs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ctlogfile"><b>-ctlogfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing a list of known Certificate Transparency logs. See <a href="../man3/SSL_CTX_set_ctlog_list_file.html">SSL_CTX_set_ctlog_list_file(3)</a> for the expected file format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keylogfile-file"><b>-keylogfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Appends TLS secrets to the specified keylog file such that external programs (like Wireshark) can decrypt TLS connections.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="early_data-file"><b>-early_data file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Reads the contents of the specified file and attempts to send it as early data to the server. This will only work with resumed sessions that support early data and when the server accepts the early data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="enable_pha"><b>-enable_pha</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For TLSv1.3 only, send the Post-Handshake Authentication extension. This will happen whether or not a certificate has been provided via <b>-cert</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="target"><b>[target]</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Rather than providing <b>-connect</b>, the target hostname and optional port may be provided as a single positional argument after all options. If neither this nor <b>-connect</b> are provided, falls back to attempting to connect to localhost on port 4433.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CONNECTED-COMMANDS">CONNECTED COMMANDS</h1>
|
||||
|
||||
<p>If a connection is established with an SSL server then any data received from the server is displayed and any key presses will be sent to the server. If end of file is reached then the connection will be closed down. When used interactively (which means neither <b>-quiet</b> nor <b>-ign_eof</b> have been given), then certain commands are also recognized which perform special operations. These commands are a letter which must appear at the start of a line. They are listed below.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="Q"><b>Q</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>End the current SSL connection and exit.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="R"><b>R</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Renegotiate the SSL session (TLSv1.2 and below only).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="B"><b>B</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send a heartbeat message to the server (DTLS only)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="k"><b>k</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send a key update message to the server (TLSv1.3 only)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="K"><b>K</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send a key update message to the server and request one back (TLSv1.3 only)</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p><b>s_client</b> can be used to debug SSL servers. To connect to an SSL HTTP server the command:</p>
|
||||
|
||||
<pre><code>openssl s_client -connect servername:443</code></pre>
|
||||
|
||||
<p>would typically be used (https uses port 443). If the connection succeeds then an HTTP command can be given such as "GET /" to retrieve a web page.</p>
|
||||
|
||||
<p>If the handshake fails then there are several possible causes, if it is nothing obvious like no client certificate then the <b>-bugs</b>, <b>-ssl3</b>, <b>-tls1</b>, <b>-no_ssl3</b>, <b>-no_tls1</b> options can be tried in case it is a buggy server. In particular you should play with these options <b>before</b> submitting a bug report to an OpenSSL mailing list.</p>
|
||||
|
||||
<p>A frequent problem when attempting to get client certificates working is that a web client complains it has no certificates or gives an empty list to choose from. This is normally because the server is not sending the clients certificate authority in its "acceptable CA list" when it requests a certificate. By using <b>s_client</b> the CA list can be viewed and checked. However some servers only request client authentication after a specific URL is requested. To obtain the list in this case it is necessary to use the <b>-prexit</b> option and send an HTTP request for an appropriate page.</p>
|
||||
|
||||
<p>If a certificate is specified on the command line using the <b>-cert</b> option it will not be used unless the server specifically requests a client certificate. Therefor merely including a client certificate on the command line is no guarantee that the certificate works.</p>
|
||||
|
||||
<p>If there are problems verifying a server certificate then the <b>-showcerts</b> option can be used to show all the certificates sent by the server.</p>
|
||||
|
||||
<p>The <b>s_client</b> utility is a test tool and is designed to continue the handshake after any certificate verification errors. As a result it will accept any certificate chain (trusted or not) sent by the peer. None test applications should <b>not</b> do this as it makes them vulnerable to a MITM attack. This behaviour can be changed by with the <b>-verify_return_error</b> option: any verify errors are then returned aborting the handshake.</p>
|
||||
|
||||
<p>The <b>-bind</b> option may be useful if the server or a firewall requires connections to come from some particular address and or port.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>Because this program has a lot of options and also because some of the techniques used are rather old, the C source of <b>s_client</b> is rather hard to read and not a model of how things should be done. A typical SSL client program would be much simpler.</p>
|
||||
|
||||
<p>The <b>-prexit</b> option is a bit of a hack. We should really report information whenever a session is renegotiated.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a>, <a href="../man1/sess_id.html">sess_id(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a>, <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The <b>-no_alt_chains</b> option was added in OpenSSL 1.1.0. The <b>-name</b> option was added in OpenSSL 1.1.1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
714
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/s_server.html
vendored
Normal file
714
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/s_server.html
vendored
Normal file
@ -0,0 +1,714 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>s_server</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#CONNECTED-COMMANDS">CONNECTED COMMANDS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-s_server, s_server - SSL/TLS server program</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>s_server</b> [<b>-help</b>] [<b>-port +int</b>] [<b>-accept val</b>] [<b>-unix val</b>] [<b>-4</b>] [<b>-6</b>] [<b>-unlink</b>] [<b>-context val</b>] [<b>-verify int</b>] [<b>-Verify int</b>] [<b>-cert infile</b>] [<b>-nameopt val</b>] [<b>-naccept +int</b>] [<b>-serverinfo val</b>] [<b>-certform PEM|DER</b>] [<b>-key infile</b>] [<b>-keyform format</b>] [<b>-pass val</b>] [<b>-dcert infile</b>] [<b>-dcertform PEM|DER</b>] [<b>-dkey infile</b>] [<b>-dkeyform PEM|DER</b>] [<b>-dpass val</b>] [<b>-nbio_test</b>] [<b>-crlf</b>] [<b>-debug</b>] [<b>-msg</b>] [<b>-msgfile outfile</b>] [<b>-state</b>] [<b>-CAfile infile</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-nocert</b>] [<b>-quiet</b>] [<b>-no_resume_ephemeral</b>] [<b>-www</b>] [<b>-WWW</b>] [<b>-servername</b>] [<b>-servername_fatal</b>] [<b>-cert2 infile</b>] [<b>-key2 infile</b>] [<b>-tlsextdebug</b>] [<b>-HTTP</b>] [<b>-id_prefix val</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-keymatexport val</b>] [<b>-keymatexportlen +int</b>] [<b>-CRL infile</b>] [<b>-crl_download</b>] [<b>-cert_chain infile</b>] [<b>-dcert_chain infile</b>] [<b>-chainCApath dir</b>] [<b>-verifyCApath dir</b>] [<b>-no_cache</b>] [<b>-ext_cache</b>] [<b>-CRLform PEM|DER</b>] [<b>-verify_return_error</b>] [<b>-verify_quiet</b>] [<b>-build_chain</b>] [<b>-chainCAfile infile</b>] [<b>-verifyCAfile infile</b>] [<b>-ign_eof</b>] [<b>-no_ign_eof</b>] [<b>-status</b>] [<b>-status_verbose</b>] [<b>-status_timeout int</b>] [<b>-status_url val</b>] [<b>-status_file infile</b>] [<b>-trace</b>] [<b>-security_debug</b>] [<b>-security_debug_verbose</b>] [<b>-brief</b>] [<b>-rev</b>] [<b>-async</b>] [<b>-ssl_config val</b>] [<b>-max_send_frag +int</b>] [<b>-split_send_frag +int</b>] [<b>-max_pipelines +int</b>] [<b>-read_buf +int</b>] [<b>-no_ssl3</b>] [<b>-no_tls1</b>] [<b>-no_tls1_1</b>] [<b>-no_tls1_2</b>] [<b>-no_tls1_3</b>] [<b>-bugs</b>] [<b>-no_comp</b>] [<b>-comp</b>] [<b>-no_ticket</b>] [<b>-num_tickets</b>] [<b>-serverpref</b>] [<b>-legacy_renegotiation</b>] [<b>-no_renegotiation</b>] [<b>-legacy_server_connect</b>] [<b>-no_resumption_on_reneg</b>] [<b>-no_legacy_server_connect</b>] [<b>-allow_no_dhe_kex</b>] [<b>-prioritize_chacha</b>] [<b>-strict</b>] [<b>-sigalgs val</b>] [<b>-client_sigalgs val</b>] [<b>-groups val</b>] [<b>-curves val</b>] [<b>-named_curve val</b>] [<b>-cipher val</b>] [<b>-ciphersuites val</b>] [<b>-dhparam infile</b>] [<b>-record_padding val</b>] [<b>-debug_broken_protocol</b>] [<b>-policy val</b>] [<b>-purpose val</b>] [<b>-verify_name val</b>] [<b>-verify_depth int</b>] [<b>-auth_level int</b>] [<b>-attime intmax</b>] [<b>-verify_hostname val</b>] [<b>-verify_email val</b>] [<b>-verify_ip</b>] [<b>-ignore_critical</b>] [<b>-issuer_checks</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-policy_check</b>] [<b>-explicit_policy</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-x509_strict</b>] [<b>-extended_crl</b>] [<b>-use_deltas</b>] [<b>-policy_print</b>] [<b>-check_ss_sig</b>] [<b>-trusted_first</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_128</b>] [<b>-suiteB_192</b>] [<b>-partial_chain</b>] [<b>-no_alt_chains</b>] [<b>-no_check_time</b>] [<b>-allow_proxy_certs</b>] [<b>-xkey</b>] [<b>-xcert</b>] [<b>-xchain</b>] [<b>-xchain_build</b>] [<b>-xcertform PEM|DER</b>] [<b>-xkeyform PEM|DER</b>] [<b>-nbio</b>] [<b>-psk_identity val</b>] [<b>-psk_hint val</b>] [<b>-psk val</b>] [<b>-psk_session file</b>] [<b>-srpvfile infile</b>] [<b>-srpuserseed val</b>] [<b>-ssl3</b>] [<b>-tls1</b>] [<b>-tls1_1</b>] [<b>-tls1_2</b>] [<b>-tls1_3</b>] [<b>-dtls</b>] [<b>-timeout</b>] [<b>-mtu +int</b>] [<b>-listen</b>] [<b>-dtls1</b>] [<b>-dtls1_2</b>] [<b>-sctp</b>] [<b>-sctp_label_bug</b>] [<b>-no_dhe</b>] [<b>-nextprotoneg val</b>] [<b>-use_srtp val</b>] [<b>-alpn val</b>] [<b>-engine val</b>] [<b>-keylogfile outfile</b>] [<b>-max_early_data int</b>] [<b>-early_data</b>] [<b>-anti_replay</b>] [<b>-no_anti_replay</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>s_server</b> command implements a generic SSL/TLS server which listens for connections on a given port using SSL/TLS.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>In addition to the options below the <b>s_server</b> utility also supports the common and server only options documented in the "Supported Command Line Commands" section of the <a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a> manual page.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="port-int"><b>-port +int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The TCP port to listen on for connections. If not specified 4433 is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="accept-val"><b>-accept val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The optional TCP host and port to listen on for connections. If not specified, *:4433 is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="unix-val"><b>-unix val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unix domain socket to accept on.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-4"><b>-4</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use IPv4 only.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod-6"><b>-6</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use IPv6 only.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="unlink"><b>-unlink</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For -unix, unlink any existing socket first.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="context-val"><b>-context val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the SSL context id. It can be given any string value. If this option is not present a default value will be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify-int--Verify-int"><b>-verify int</b>, <b>-Verify int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The verify depth to use. This specifies the maximum length of the client certificate chain and makes the server request a certificate from the client. With the <b>-verify</b> option a certificate is requested but the client does not have to send one, with the <b>-Verify</b> option the client must supply a certificate or an error occurs.</p>
|
||||
|
||||
<p>If the cipher suite cannot request a client certificate (for example an anonymous cipher suite or PSK) this option has no effect.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert-infile"><b>-cert infile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate to use, most servers cipher suites require the use of a certificate and some require a certificate with a certain public key type: for example the DSS cipher suites require a certificate containing a DSS (DSA) key. If not specified then the filename "server.pem" will be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert_chain"><b>-cert_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use when attempting to build the client/server certificate chain related to the certificate specified via the <b>-cert</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="build_chain"><b>-build_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify whether the application should build the certificate chain to be provided to the client.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nameopt-val"><b>-nameopt val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option which determines how the subject or issuer names are displayed. The <b>val</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="naccept-int"><b>-naccept +int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The server will exit after receiving the specified number of connections, default unlimited.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="serverinfo-val"><b>-serverinfo val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing one or more blocks of PEM data. Each PEM block must encode a TLS ServerHello extension (2 bytes type, 2 bytes length, followed by "length" bytes of extension data). If the client sends an empty TLS ClientHello extension matching the type, the corresponding ServerHello extension will be returned.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certform-PEM-DER"><b>-certform PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate format to use: DER or PEM. PEM is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="key-infile"><b>-key infile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key to use. If not specified then the certificate file will be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-format"><b>-keyform format</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private format to use: DER or PEM. PEM is the default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pass-val"><b>-pass val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key password source. For more information about the format of <b>val</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dcert-infile--dkey-infile"><b>-dcert infile</b>, <b>-dkey infile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify an additional certificate and private key, these behave in the same manner as the <b>-cert</b> and <b>-key</b> options except there is no default if they are not specified (no additional certificate and key is used). As noted above some cipher suites require a certificate containing a key of a certain type. Some cipher suites need a certificate carrying an RSA key and some a DSS (DSA) key. By using RSA and DSS certificates and keys a server can support clients which only support RSA or DSS cipher suites by using an appropriate certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dcert_chain"><b>-dcert_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use when attempting to build the server certificate chain when a certificate specified via the <b>-dcert</b> option is in use.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dcertform-PEM-DER--dkeyform-PEM-DER--dpass-val"><b>-dcertform PEM|DER</b>, <b>-dkeyform PEM|DER</b>, <b>-dpass val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Additional certificate and private key format and passphrase respectively.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="xkey-infile--xcert-infile--xchain"><b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify an extra certificate, private key and certificate chain. These behave in the same manner as the <b>-cert</b>, <b>-key</b> and <b>-cert_chain</b> options. When specified, the callback returning the first valid chain will be in use by the server.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="xchain_build"><b>-xchain_build</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specify whether the application should build the certificate chain to be provided to the client for the extra certificates provided via <b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="xcertform-PEM-DER--xkeyform-PEM-DER"><b>-xcertform PEM|DER</b>, <b>-xkeyform PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Extra certificate and private key format respectively.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nbio_test"><b>-nbio_test</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Tests non blocking I/O.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crlf"><b>-crlf</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option translated a line feed from the terminal into CR+LF.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="debug"><b>-debug</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print extensive debugging information including a hex dump of all traffic.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="msg"><b>-msg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Show all protocol messages with hex dump.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="msgfile-outfile"><b>-msgfile outfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File to send output of <b>-msg</b> or <b>-trace</b> to, default standard output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="state"><b>-state</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints the SSL session states.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-infile"><b>-CAfile infile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use during client authentication and to use when attempting to build the server certificate chain. The list is also used in the list of acceptable client CAs passed to the client when a certificate is requested.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-dir"><b>-CApath dir</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The directory to use for client certificate verification. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information. These are also used when building the server certificate chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="chainCApath-dir"><b>-chainCApath dir</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The directory to use for building the chain provided to the client. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="chainCAfile-file"><b>-chainCAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use when attempting to build the server certificate chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nocert"><b>-nocert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is set then no certificate is used. This restricts the cipher suites available to the anonymous ones (currently just anonymous DH).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="quiet"><b>-quiet</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Inhibit printing of session and certificate information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="www"><b>-www</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sends a status message back to the client when it connects. This includes information about the ciphers used and various session parameters. The output is in HTML format so this option will normally be used with a web browser. Cannot be used in conjunction with <b>-early_data</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="WWW"><b>-WWW</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be loaded. Cannot be used in conjunction with <b>-early_data</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="tlsextdebug"><b>-tlsextdebug</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print a hex dump of any TLS extensions received from the server.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="HTTP"><b>-HTTP</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be loaded. The files loaded are assumed to contain a complete and correct HTTP response (lines that are part of the HTTP response line and headers must end with CRLF). Cannot be used in conjunction with <b>-early_data</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="id_prefix-val"><b>-id_prefix val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate SSL/TLS session IDs prefixed by <b>val</b>. This is mostly useful for testing any SSL/TLS code (eg. proxies) that wish to deal with multiple servers, when each of which might be generating a unique range of session IDs (eg. with a certain prefix).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_return_error"><b>-verify_return_error</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verification errors normally just print a message but allow the connection to continue, for debugging purposes. If this option is used, then verification errors close the connection.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="status"><b>-status</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enables certificate status request support (aka OCSP stapling).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="status_verbose"><b>-status_verbose</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enables certificate status request support (aka OCSP stapling) and gives a verbose printout of the OCSP response.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="status_timeout-int"><b>-status_timeout int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the timeout for OCSP response to <b>int</b> seconds.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="status_url-val"><b>-status_url val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets a fallback responder URL to use if no responder URL is present in the server certificate. Without this option an error is returned if the server certificate does not contain a responder address.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="status_file-infile"><b>-status_file infile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Overrides any OCSP responder URLs from the certificate and always provides the OCSP Response stored in the file. The file must be in DER format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="trace"><b>-trace</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Show verbose trace output of protocol messages. OpenSSL needs to be compiled with <b>enable-ssl-trace</b> for this option to work.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="brief"><b>-brief</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Provide a brief summary of connection parameters instead of the normal verbose output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rev"><b>-rev</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Simple test server which just reverses the text received from the client and sends it back to the server. Also sets <b>-brief</b>. Cannot be used in conjunction with <b>-early_data</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="async"><b>-async</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Switch on asynchronous mode. Cryptographic operations will be performed asynchronously. This will only have an effect if an asynchronous capable engine is also used via the <b>-engine</b> option. For test purposes the dummy async engine (dasync) can be used (if available).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="max_send_frag-int"><b>-max_send_frag +int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The maximum size of data fragment to send. See <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a> for further information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="split_send_frag-int"><b>-split_send_frag +int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The size used to split data for encrypt pipelines. If more data is written in one go than this value then it will be split into multiple pipelines, up to the maximum number of pipelines defined by max_pipelines. This only has an effect if a suitable cipher suite has been negotiated, an engine that supports pipelining has been loaded, and max_pipelines is greater than 1. See <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a> for further information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="max_pipelines-int"><b>-max_pipelines +int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The maximum number of encrypt/decrypt pipelines to be used. This will only have an effect if an engine has been loaded that supports pipelining (e.g. the dasync engine) and a suitable cipher suite has been negotiated. The default value is 1. See <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a> for further information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="read_buf-int"><b>-read_buf +int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The default read buffer size to be used for connections. This will only have an effect if the buffer size is larger than the size that would otherwise be used and pipelining is in use (see <a href="../man3/SSL_CTX_set_default_read_buffer_len.html">SSL_CTX_set_default_read_buffer_len(3)</a> for further information).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ssl2--ssl3--tls1--tls1_1--tls1_2--tls1_3--no_ssl2--no_ssl3--no_tls1--no_tls1_1--no_tls1_2--no_tls1_3"><b>-ssl2</b>, <b>-ssl3</b>, <b>-tls1</b>, <b>-tls1_1</b>, <b>-tls1_2</b>, <b>-tls1_3</b>, <b>-no_ssl2</b>, <b>-no_ssl3</b>, <b>-no_tls1</b>, <b>-no_tls1_1</b>, <b>-no_tls1_2</b>, <b>-no_tls1_3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options require or disable the use of the specified SSL or TLS protocols. By default <b>s_server</b> will negotiate the highest mutually supported protocol version. When a specific TLS version is required, only that version will be accepted from the client. Note that not all protocols and flags may be available, depending on how OpenSSL was built.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bugs"><b>-bugs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_comp"><b>-no_comp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Disable negotiation of TLS compression. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="comp"><b>-comp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enable negotiation of TLS compression. This option was introduced in OpenSSL 1.1.0. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_ticket"><b>-no_ticket</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Disable RFC4507bis session ticket support. This option has no effect if TLSv1.3 is negotiated. See <b>-num_tickets</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="num_tickets"><b>-num_tickets</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Control the number of tickets that will be sent to the client after a full handshake in TLSv1.3. The default number of tickets is 2. This option does not affect the number of tickets sent after a resumption handshake.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="serverpref"><b>-serverpref</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the server's cipher preferences, rather than the client's preferences.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="prioritize_chacha"><b>-prioritize_chacha</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prioritize ChaCha ciphers when preferred by clients. Requires <b>-serverpref</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_resumption_on_reneg"><b>-no_resumption_on_reneg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the <b>SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="client_sigalgs-val"><b>-client_sigalgs val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Signature algorithms to support for client certificate authentication (colon-separated list).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="named_curve-val"><b>-named_curve val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the elliptic curve to use. NOTE: this is single curve, not a list. For a list of all possible curves, use:</p>
|
||||
|
||||
<pre><code>$ openssl ecparam -list_curves</code></pre>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher-val"><b>-cipher val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the list of TLSv1.2 and below ciphersuites used by the server to be modified. This list is combined with any TLSv1.3 ciphersuites that have been configured. When the client sends a list of supported ciphers the first client cipher also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist is irrelevant. See the <b>ciphers</b> command for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the list of TLSv1.3 ciphersuites used by the server to be modified. This list is combined with any TLSv1.2 and below ciphersuites that have been configured. When the client sends a list of supported ciphers the first client cipher also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist is irrelevant. See the <b>ciphers</b> command for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dhparam-infile"><b>-dhparam infile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The DH parameter file to use. The ephemeral DH cipher suites generate keys using a set of DH parameters. If not specified then an attempt is made to load the parameters from the server certificate file. If this fails then a static set of parameters hard coded into the <b>s_server</b> program will be used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set different peer certificate verification options. See the <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_check--crl_check_all"><b>-crl_check</b>, <b>-crl_check_all</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Check the peer certificate has not been revoked by its CA. The CRL(s) are appended to the certificate file. With the <b>-crl_check_all</b> option all CRLs of all CAs in the chain are checked.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nbio"><b>-nbio</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Turns on non blocking I/O.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk_identity-val"><b>-psk_identity val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Expect the client to send PSK identity <b>val</b> when using a PSK cipher suite, and warn if they do not. By default, the expected PSK identity is the string "Client_identity".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk_hint-val"><b>-psk_hint val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the PSK identity hint <b>val</b> when using a PSK cipher suite.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk-val"><b>-psk val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the PSK key <b>val</b> when using a PSK cipher suite. The key is given as a hexadecimal number without leading 0x, for example -psk 1a2b3c4d. This option must be provided in order to use a PSK cipher.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="psk_session-file"><b>-psk_session file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the pem encoded SSL_SESSION data stored in <b>file</b> as the basis of a PSK. Note that this will only work if TLSv1.3 is negotiated.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="listen"><b>-listen</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option can only be used in conjunction with one of the DTLS options above. With this option <b>s_server</b> will listen on a UDP port for incoming connections. Any ClientHellos that arrive will be checked to see if they have a cookie in them or not. Any without a cookie will be responded to with a HelloVerifyRequest. If a ClientHello with a cookie is received then <b>s_server</b> will connect to that peer and complete the handshake.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dtls--dtls1--dtls1_2"><b>-dtls</b>, <b>-dtls1</b>, <b>-dtls1_2</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options make <b>s_server</b> use DTLS protocols instead of TLS. With <b>-dtls</b>, <b>s_server</b> will negotiate any supported DTLS protocol version, whilst <b>-dtls1</b> and <b>-dtls1_2</b> will only support DTLSv1.0 and DTLSv1.2 respectively.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sctp"><b>-sctp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in conjunction with <b>-dtls</b>, <b>-dtls1</b> or <b>-dtls1_2</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sctp_label_bug"><b>-sctp_label_bug</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the incorrect behaviour of older OpenSSL implementations when computing endpoint-pair shared secrets for DTLS/SCTP. This allows communication with older broken implementations but breaks interoperability with correct implementations. Must be used in conjunction with <b>-sctp</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_dhe"><b>-no_dhe</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is set then no DH parameters will be loaded effectively disabling the ephemeral DH cipher suites.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="alpn-val--nextprotoneg-val"><b>-alpn val</b>, <b>-nextprotoneg val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These flags enable the Enable the Application-Layer Protocol Negotiation or Next Protocol Negotiation (NPN) extension, respectively. ALPN is the IETF standard and replaces NPN. The <b>val</b> list is a comma-separated list of supported protocol names. The list should contain the most desirable protocols first. Protocol names are printable ASCII strings, for example "http/1.1" or "spdy/3". The flag <b>-nextprotoneg</b> cannot be specified if <b>-tls1_3</b> is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-val"><b>-engine val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique id string in <b>val</b>) will cause <b>s_server</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keylogfile-outfile"><b>-keylogfile outfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Appends TLS secrets to the specified keylog file such that external programs (like Wireshark) can decrypt TLS connections.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="max_early_data-int"><b>-max_early_data int</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Change the default maximum early data bytes that are specified for new sessions and any incoming early data (when used in conjunction with the <b>-early_data</b> flag). The default value is approximately 16k. The argument must be an integer greater than or equal to 0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="early_data"><b>-early_data</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Accept early data where possible. Cannot be used in conjunction with <b>-www</b>, <b>-WWW</b>, <b>-HTTP</b> or <b>-rev</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="anti_replay--no_anti_replay"><b>-anti_replay</b>, <b>-no_anti_replay</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Switches replay protection on or off, respectively. Replay protection is on by default unless overridden by a configuration file. When it is on, OpenSSL will automatically detect if a session ticket has been used more than once, TLSv1.3 has been negotiated, and early data is enabled on the server. A full handshake is forced if a session ticket is used a second or subsequent time. Any early data that was sent will be rejected.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CONNECTED-COMMANDS">CONNECTED COMMANDS</h1>
|
||||
|
||||
<p>If a connection request is established with an SSL client and neither the <b>-www</b> nor the <b>-WWW</b> option has been used then normally any data received from the client is displayed and any key presses will be sent to the client.</p>
|
||||
|
||||
<p>Certain commands are also recognized which perform special operations. These commands are a letter which must appear at the start of a line. They are listed below.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="q"><b>q</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>End the current SSL connection but still accept new connections.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Q"><b>Q</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>End the current SSL connection and exit.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="r"><b>r</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Renegotiate the SSL session (TLSv1.2 and below only).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="R"><b>R</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Renegotiate the SSL session and request a client certificate (TLSv1.2 and below only).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="P"><b>P</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send some plain text down the underlying TCP connection: this should cause the client to disconnect due to a protocol violation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="S"><b>S</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out some session cache status information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="B"><b>B</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send a heartbeat message to the client (DTLS only)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="k"><b>k</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send a key update message to the client (TLSv1.3 only)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="K"><b>K</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send a key update message to the client and request one back (TLSv1.3 only)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="c"><b>c</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Send a certificate request to the client (TLSv1.3 only)</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p><b>s_server</b> can be used to debug SSL clients. To accept connections from a web browser the command:</p>
|
||||
|
||||
<pre><code>openssl s_server -accept 443 -www</code></pre>
|
||||
|
||||
<p>can be used for example.</p>
|
||||
|
||||
<p>Although specifying an empty list of CAs when requesting a client certificate is strictly speaking a protocol violation, some SSL clients interpret this to mean any CA is acceptable. This is useful for debugging purposes.</p>
|
||||
|
||||
<p>The session parameters can printed out using the <b>sess_id</b> program.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>Because this program has a lot of options and also because some of the techniques used are rather old, the C source of <b>s_server</b> is rather hard to read and not a model of how things should be done. A typical SSL server program would be much simpler.</p>
|
||||
|
||||
<p>The output of common ciphers is wrong: it just gives the list of ciphers that OpenSSL recognizes and the client supports.</p>
|
||||
|
||||
<p>There should be a way for the <b>s_server</b> program to print out details of any unknown cipher suites a client says it supports.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a>, <a href="../man1/sess_id.html">sess_id(1)</a>, <a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a> <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The -no_alt_chains option was added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<p>The -allow-no-dhe-kex and -prioritize_chacha options were added in OpenSSL 1.1.1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
190
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/s_time.html
vendored
Normal file
190
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/s_time.html
vendored
Normal file
@ -0,0 +1,190 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>s_time</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-s_time, s_time - SSL/TLS performance timing program</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>s_time</b> [<b>-help</b>] [<b>-connect host:port</b>] [<b>-www page</b>] [<b>-cert filename</b>] [<b>-key filename</b>] [<b>-CApath directory</b>] [<b>-CAfile filename</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-reuse</b>] [<b>-new</b>] [<b>-verify depth</b>] [<b>-nameopt option</b>] [<b>-time seconds</b>] [<b>-ssl3</b>] [<b>-bugs</b>] [<b>-cipher cipherlist</b>] [<b>-ciphersuites val</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>s_time</b> command implements a generic SSL/TLS client which connects to a remote host using SSL/TLS. It can request a page from the server and includes the time to transfer the payload data in its timing measurements. It measures the number of connections within a given timeframe, the amount of data transferred (if any), and calculates the average time spent for one connection.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="connect-host:port"><b>-connect host:port</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the host and optional port to connect to.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="www-page"><b>-www page</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the page to GET from the server. A value of '/' gets the index.htm[l] page. If this parameter is not specified, then <b>s_time</b> will only perform the handshake to establish SSL connections but not transfer any payload data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert-certname"><b>-cert certname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate to use, if one is requested by the server. The default is not to use a certificate. The file is in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="key-keyfile"><b>-key keyfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key to use. If not specified then the certificate file will be used. The file is in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify-depth"><b>-verify depth</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The verify depth to use. This specifies the maximum length of the server certificate chain and turns on server certificate verification. Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nameopt-option"><b>-nameopt option</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-directory"><b>-CApath directory</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The directory to use for server certificate verification. This directory must be in "hash format", see <b>verify</b> for more information. These are also used when building the client certificate chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file"><b>-CAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted certificates to use during server authentication and to use when attempting to build the client certificate chain.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location</p>
|
||||
|
||||
</dd>
|
||||
<dt id="new"><b>-new</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Performs the timing test using a new session ID for each connection. If neither <b>-new</b> nor <b>-reuse</b> are specified, they are both on by default and executed in sequence.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="reuse"><b>-reuse</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Performs the timing test using the same session ID; this can be used as a test that session caching is working. If neither <b>-new</b> nor <b>-reuse</b> are specified, they are both on by default and executed in sequence.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ssl3"><b>-ssl3</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option disables the use of SSL version 3. By default the initial handshake uses a method which should be compatible with all servers and permit them to use SSL v3 or TLS as appropriate.</p>
|
||||
|
||||
<p>The timing program is not as rich in options to turn protocols on and off as the <a href="../man1/s_client.html">s_client(1)</a> program and may not connect to all servers. Unfortunately there are a lot of ancient and broken servers in use which cannot handle this technique and will fail to connect. Some servers only work if TLS is turned off with the <b>-ssl3</b> option.</p>
|
||||
|
||||
<p>Note that this option may not be available, depending on how OpenSSL was built.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bugs"><b>-bugs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher-cipherlist"><b>-cipher cipherlist</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the TLSv1.2 and below cipher list sent by the client to be modified. This list will be combined with any TLSv1.3 ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See <a href="../man1/ciphers.html">ciphers(1)</a> for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This allows the TLSv1.3 ciphersuites sent by the client to be modified. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See <a href="../man1/ciphers.html">ciphers(1)</a> for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="time-length"><b>-time length</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies how long (in seconds) <b>s_time</b> should establish connections and optionally transfer payload data from a server. Server and client performance and the link speed determine how many connections <b>s_time</b> can establish.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p><b>s_time</b> can be used to measure the performance of an SSL connection. To connect to an SSL HTTP server and get the default page the command</p>
|
||||
|
||||
<pre><code>openssl s_time -connect servername:443 -www / -CApath yourdir -CAfile yourfile.pem -cipher commoncipher [-ssl3]</code></pre>
|
||||
|
||||
<p>would typically be used (https uses port 443). 'commoncipher' is a cipher to which both client and server can agree, see the <a href="../man1/ciphers.html">ciphers(1)</a> command for details.</p>
|
||||
|
||||
<p>If the handshake fails then there are several possible causes, if it is nothing obvious like no client certificate then the <b>-bugs</b> and <b>-ssl3</b> options can be tried in case it is a buggy server. In particular you should play with these options <b>before</b> submitting a bug report to an OpenSSL mailing list.</p>
|
||||
|
||||
<p>A frequent problem when attempting to get client certificates working is that a web client complains it has no certificates or gives an empty list to choose from. This is normally because the server is not sending the clients certificate authority in its "acceptable CA list" when it requests a certificate. By using <a href="../man1/s_client.html">s_client(1)</a> the CA list can be viewed and checked. However some servers only request client authentication after a specific URL is requested. To obtain the list in this case it is necessary to use the <b>-prexit</b> option of <a href="../man1/s_client.html">s_client(1)</a> and send an HTTP request for an appropriate page.</p>
|
||||
|
||||
<p>If a certificate is specified on the command line using the <b>-cert</b> option it will not be used unless the server specifically requests a client certificate. Therefor merely including a client certificate on the command line is no guarantee that the certificate works.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>Because this program does not have all the options of the <a href="../man1/s_client.html">s_client(1)</a> program to turn protocols on and off, you may not be able to measure the performance of all protocols with all servers.</p>
|
||||
|
||||
<p>The <b>-verify</b> option should really exit if the server verification fails.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
195
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/sess_id.html
vendored
Normal file
195
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/sess_id.html
vendored
Normal file
@ -0,0 +1,195 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>sess_id</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#OUTPUT">OUTPUT</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-sess_id, sess_id - SSL/TLS session handling utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>sess_id</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER|NSS</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-context ID</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>sess_id</b> process the encoded version of the SSL session structure and optionally prints out SSL session details (for example the SSL session master key) in human readable format. Since this is a diagnostic tool that needs some knowledge of the SSL protocol to use properly, most users will not need to use it.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded format containing session details. The precise format can vary from one version to the next. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM-NSS"><b>-outform DER|PEM|NSS</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format. The <b>PEM</b> and <b>DER</b> options have the same meaning and default as the <b>-inform</b> option. The <b>NSS</b> option outputs the session id and the master key in NSS keylog format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read session information from or standard input by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write session information to or standard output if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the various public or private key components in plain text in addition to the encoded version.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert"><b>-cert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If a certificate is present in the session it will be output using this option, if the <b>-text</b> option is also present then it will be printed out in text form.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prevents output of the encoded version of the session.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="context-ID"><b>-context ID</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option can set the session id so the output session information uses the supplied ID. The ID can be any string of characters. This option won't normally be used.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="OUTPUT">OUTPUT</h1>
|
||||
|
||||
<p>Typical output:</p>
|
||||
|
||||
<pre><code>SSL-Session:
|
||||
Protocol : TLSv1
|
||||
Cipher : 0016
|
||||
Session-ID: 871E62626C554CE95488823752CBD5F3673A3EF3DCE9C67BD916C809914B40ED
|
||||
Session-ID-ctx: 01000000
|
||||
Master-Key: A7CEFC571974BE02CAC305269DC59F76EA9F0B180CB6642697A68251F2D2BB57E51DBBB4C7885573192AE9AEE220FACD
|
||||
Key-Arg : None
|
||||
Start Time: 948459261
|
||||
Timeout : 300 (sec)
|
||||
Verify return code 0 (ok)</code></pre>
|
||||
|
||||
<p>These are described below in more detail.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="Protocol"><b>Protocol</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the protocol in use TLSv1.3, TLSv1.2, TLSv1.1, TLSv1 or SSLv3.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Cipher"><b>Cipher</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The cipher used this is the actual raw SSL or TLS cipher code, see the SSL or TLS specifications for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Session-ID"><b>Session-ID</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The SSL session ID in hex format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Session-ID-ctx"><b>Session-ID-ctx</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The session ID context in hex format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Master-Key"><b>Master-Key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the SSL session master key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Start-Time"><b>Start Time</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the session start time represented as an integer in standard Unix format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Timeout"><b>Timeout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The timeout in seconds.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Verify-return-code"><b>Verify return code</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the return code when an SSL client certificate is verified.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The PEM encoded session format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN SSL SESSION PARAMETERS-----
|
||||
-----END SSL SESSION PARAMETERS-----</code></pre>
|
||||
|
||||
<p>Since the SSL session output contains the master key it is possible to read the contents of an encrypted session using this information. Therefore appropriate security precautions should be taken if the information is being output by a "real" application. This is however strongly discouraged and should only be used for debugging purposes.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The cipher and start time should be printed out in human readable form.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/ciphers.html">ciphers(1)</a>, <a href="../man1/s_server.html">s_server(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
454
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/smime.html
vendored
Normal file
454
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/smime.html
vendored
Normal file
@ -0,0 +1,454 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>smime</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXIT-CODES">EXIT CODES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-smime, smime - S/MIME utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>smime</b> [<b>-help</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-sign</b>] [<b>-resign</b>] [<b>-verify</b>] [<b>-pk7out</b>] [<b>-binary</b>] [<b>-crlfeol</b>] [<b>-<i>cipher</i></b>] [<b>-in file</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-certfile file</b>] [<b>-signer file</b>] [<b>-recip file</b>] [<b>-inform SMIME|PEM|DER</b>] [<b>-passin arg</b>] [<b>-inkey file_or_id</b>] [<b>-out file</b>] [<b>-outform SMIME|PEM|DER</b>] [<b>-content file</b>] [<b>-to addr</b>] [<b>-from ad</b>] [<b>-subject s</b>] [<b>-text</b>] [<b>-indef</b>] [<b>-noindef</b>] [<b>-stream</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-md digest</b>] [cert.pem]...</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>smime</b> command handles S/MIME mail. It can encrypt, decrypt, sign and verify S/MIME messages.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<p>There are six operation options that set the type of operation to be performed. The meaning of the other options varies according to the operation type.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="encrypt"><b>-encrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encrypt mail for the given recipient certificates. Input file is the message to be encrypted. The output file is the encrypted mail in MIME format.</p>
|
||||
|
||||
<p>Note that no revocation check is done for the recipient cert, so if that key has been compromised, others may be able to decrypt the text.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="decrypt"><b>-decrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Decrypt mail using the supplied certificate and private key. Expects an encrypted mail message in MIME format for the input file. The decrypted mail is written to the output file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sign"><b>-sign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sign mail using the supplied certificate and private key. Input file is the message to be signed. The signed message in MIME format is written to the output file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>-verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify signed mail. Expects a signed mail message on input and outputs the signed data. Both clear text and opaque signing is supported.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pk7out"><b>-pk7out</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Takes an input message and writes out a PEM encoded PKCS#7 structure.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="resign"><b>-resign</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Resign a message: take an existing message and one or more new signers.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input message to be encrypted or signed or the MIME message to be decrypted or verified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-SMIME-PEM-DER"><b>-inform SMIME|PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format for the PKCS#7 structure. The default is <b>SMIME</b> which reads an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to expect PEM and DER format PKCS#7 structures instead. This currently only affects the input format of the PKCS#7 structure, if no PKCS#7 structure is being input (for example with <b>-encrypt</b> or <b>-sign</b>) this option has no effect.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The message text that has been decrypted or verified or the output MIME format message that has been signed or verified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-SMIME-PEM-DER"><b>-outform SMIME|PEM|DER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format for the PKCS#7 structure. The default is <b>SMIME</b> which write an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to write PEM and DER format PKCS#7 structures instead. This currently only affects the output format of the PKCS#7 structure, if no PKCS#7 structure is being output (for example with <b>-verify</b> or <b>-decrypt</b>) this option has no effect.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="stream--indef--noindef"><b>-stream -indef -noindef</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The <b>-stream</b> and <b>-indef</b> options are equivalent and enable streaming I/O for encoding operations. This permits single pass processing of data without the need to hold the entire contents in memory, potentially supporting very large files. Streaming is automatically set for S/MIME signing with detached data if the output format is <b>SMIME</b> it is currently off by default for all other operations.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noindef"><b>-noindef</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Disable streaming I/O where it would produce and indefinite length constructed encoding. This option currently has no effect. In future streaming will be enabled by default on all relevant operations and this option will disable it.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="content-filename"><b>-content filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies a file containing the detached content, this is only useful with the <b>-verify</b> command. This is only usable if the PKCS#7 structure is using the detached signature form where the content is not included. This option will override any content if the input format is S/MIME and it uses the multipart/signed MIME content type.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file"><b>-CAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing trusted CA certificates, only used with <b>-verify</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-dir"><b>-CApath dir</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A directory containing trusted CA certificates, only used with <b>-verify</b>. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="md-digest"><b>-md digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Digest algorithm to use when signing or resigning. If not present then the default digest algorithm for the signing key will be used (usually SHA1).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cipher"><b>-<i>cipher</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The encryption algorithm to use. For example DES (56 bits) - <b>-des</b>, triple DES (168 bits) - <b>-des3</b>, EVP_get_cipherbyname() function) can also be used preceded by a dash, for example <b>-aes-128-cbc</b>. See <a href="../man1/enc.html"><b>enc</b></a> for list of ciphers supported by your version of OpenSSL.</p>
|
||||
|
||||
<p>If not specified triple DES is used. Only used with <b>-encrypt</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nointern"><b>-nointern</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When verifying a message normally certificates (if any) included in the message are searched for the signing certificate. With this option only the certificates specified in the <b>-certfile</b> option are used. The supplied certificates can still be used as untrusted CAs however.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noverify"><b>-noverify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not verify the signers certificate of a signed message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nochain"><b>-nochain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not do chain verification of signers certificates: that is don't use the certificates in the signed message as untrusted CAs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nosigs"><b>-nosigs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't try to verify the signatures on the message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nocerts"><b>-nocerts</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When signing a message the signer's certificate is normally included with this option it is excluded. This will reduce the size of the signed message but the verifier must have a copy of the signers certificate available locally (passed using the <b>-certfile</b> option for example).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noattr"><b>-noattr</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally when a message is signed a set of attributes are included which include the signing time and supported symmetric algorithms. With this option they are not included.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="binary"><b>-binary</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally the input message is converted to "canonical" format which is effectively using CR and LF as end of line: as required by the S/MIME specification. When this option is present no translation occurs. This is useful when handling binary data which may not be in MIME format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crlfeol"><b>-crlfeol</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally the output file uses a single <b>LF</b> as end of line. When this option is present <b>CRLF</b> is used instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nodetach"><b>-nodetach</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When signing a message use opaque signing: this form is more resistant to translation by mail relays but it cannot be read by mail agents that do not support S/MIME. Without this option cleartext signing with the MIME type multipart/signed is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certfile-file"><b>-certfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Allows additional certificates to be specified. When signing these will be included with the message. When verifying these will be searched for the signers certificates. The certificates should be in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signer-file"><b>-signer file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A signing certificate when signing or resigning a message, this option can be used multiple times if more than one signer is required. If a message is being verified then the signers certificates will be written to this file if the verification was successful.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="recip-file"><b>-recip file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The recipients certificate when decrypting a message. This certificate must match one of the recipients of the message or an error occurs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inkey-file_or_id"><b>-inkey file_or_id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key to use when signing or decrypting. This must match the corresponding certificate. If this option is not specified then the private key must be included in the certificate file specified with the <b>-recip</b> or <b>-signer</b> file. When signing this option can be used multiple times to specify successive keys. If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert.pem"><b>cert.pem...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>One or more certificates of message recipients: used when encrypting a message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="to--from--subject"><b>-to, -from, -subject</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The relevant mail headers. These are included outside the signed portion of a message so they may be included manually. If signing then many S/MIME mail clients check the signers certificate's email address matches that specified in the From: address.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set various options of certificate chain verification. See <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The MIME message must be sent without any blank lines between the headers and the output. Some mail programs will automatically add a blank line. Piping the mail directly to sendmail is one way to achieve the correct format.</p>
|
||||
|
||||
<p>The supplied message to be signed or encrypted must include the necessary MIME headers or many S/MIME clients won't display it properly (if at all). You can use the <b>-text</b> option to automatically add plain text headers.</p>
|
||||
|
||||
<p>A "signed and encrypted" message is one where a signed message is then encrypted. This can be produced by encrypting an already signed message: see the examples section.</p>
|
||||
|
||||
<p>This version of the program only allows one signer per message but it will verify multiple signers on received messages. Some S/MIME clients choke if a message contains multiple signers. It is possible to sign messages "in parallel" by signing an already signed message.</p>
|
||||
|
||||
<p>The options <b>-encrypt</b> and <b>-decrypt</b> reflect common usage in S/MIME clients. Strictly speaking these process PKCS#7 enveloped data: PKCS#7 encrypted data is used for other purposes.</p>
|
||||
|
||||
<p>The <b>-resign</b> option uses an existing message digest when adding a new signer. This means that attributes must be present in at least one existing signer using the same message digest or this operation will fail.</p>
|
||||
|
||||
<p>The <b>-stream</b> and <b>-indef</b> options enable streaming I/O support. As a result the encoding is BER using indefinite length constructed encoding and no longer DER. Streaming is supported for the <b>-encrypt</b> operation and the <b>-sign</b> operation if the content is not detached.</p>
|
||||
|
||||
<p>Streaming is always used for the <b>-sign</b> operation with detached data but since the content is no longer part of the PKCS#7 structure the encoding remains DER.</p>
|
||||
|
||||
<h1 id="EXIT-CODES">EXIT CODES</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="pod0">0</dt>
|
||||
<dd>
|
||||
|
||||
<p>The operation was completely successfully.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod1">1</dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred parsing the command options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod2">2</dt>
|
||||
<dd>
|
||||
|
||||
<p>One of the input files could not be read.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod3">3</dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred creating the PKCS#7 file or when reading the MIME message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod4">4</dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred decrypting or verifying the message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod5">5</dt>
|
||||
<dd>
|
||||
|
||||
<p>The message was verified correctly but an error occurred writing out the signers certificates.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Create a cleartext signed message:</p>
|
||||
|
||||
<pre><code>openssl smime -sign -in message.txt -text -out mail.msg \
|
||||
-signer mycert.pem</code></pre>
|
||||
|
||||
<p>Create an opaque signed message:</p>
|
||||
|
||||
<pre><code>openssl smime -sign -in message.txt -text -out mail.msg -nodetach \
|
||||
-signer mycert.pem</code></pre>
|
||||
|
||||
<p>Create a signed message, include some additional certificates and read the private key from another file:</p>
|
||||
|
||||
<pre><code>openssl smime -sign -in in.txt -text -out mail.msg \
|
||||
-signer mycert.pem -inkey mykey.pem -certfile mycerts.pem</code></pre>
|
||||
|
||||
<p>Create a signed message with two signers:</p>
|
||||
|
||||
<pre><code>openssl smime -sign -in message.txt -text -out mail.msg \
|
||||
-signer mycert.pem -signer othercert.pem</code></pre>
|
||||
|
||||
<p>Send a signed message under Unix directly to sendmail, including headers:</p>
|
||||
|
||||
<pre><code>openssl smime -sign -in in.txt -text -signer mycert.pem \
|
||||
-from steve@openssl.org -to someone@somewhere \
|
||||
-subject "Signed message" | sendmail someone@somewhere</code></pre>
|
||||
|
||||
<p>Verify a message and extract the signer's certificate if successful:</p>
|
||||
|
||||
<pre><code>openssl smime -verify -in mail.msg -signer user.pem -out signedtext.txt</code></pre>
|
||||
|
||||
<p>Send encrypted mail using triple DES:</p>
|
||||
|
||||
<pre><code>openssl smime -encrypt -in in.txt -from steve@openssl.org \
|
||||
-to someone@somewhere -subject "Encrypted message" \
|
||||
-des3 user.pem -out mail.msg</code></pre>
|
||||
|
||||
<p>Sign and encrypt mail:</p>
|
||||
|
||||
<pre><code>openssl smime -sign -in ml.txt -signer my.pem -text \
|
||||
| openssl smime -encrypt -out mail.msg \
|
||||
-from steve@openssl.org -to someone@somewhere \
|
||||
-subject "Signed and Encrypted message" -des3 user.pem</code></pre>
|
||||
|
||||
<p>Note: the encryption command does not include the <b>-text</b> option because the message being encrypted already has MIME headers.</p>
|
||||
|
||||
<p>Decrypt mail:</p>
|
||||
|
||||
<pre><code>openssl smime -decrypt -in mail.msg -recip mycert.pem -inkey key.pem</code></pre>
|
||||
|
||||
<p>The output from Netscape form signing is a PKCS#7 structure with the detached signature format. You can use this program to verify the signature by line wrapping the base64 encoded structure and surrounding it with:</p>
|
||||
|
||||
<pre><code>-----BEGIN PKCS7-----
|
||||
-----END PKCS7-----</code></pre>
|
||||
|
||||
<p>and using the command:</p>
|
||||
|
||||
<pre><code>openssl smime -verify -inform PEM -in signature.pem -content content.txt</code></pre>
|
||||
|
||||
<p>Alternatively you can base64 decode the signature and use:</p>
|
||||
|
||||
<pre><code>openssl smime -verify -inform DER -in signature.der -content content.txt</code></pre>
|
||||
|
||||
<p>Create an encrypted message using 128 bit Camellia:</p>
|
||||
|
||||
<pre><code>openssl smime -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem</code></pre>
|
||||
|
||||
<p>Add a signer to an existing message:</p>
|
||||
|
||||
<pre><code>openssl smime -resign -in mail.msg -signer newsign.pem -out mail2.msg</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The MIME parser isn't very clever: it seems to handle most messages that I've thrown at it but it may choke on others.</p>
|
||||
|
||||
<p>The code currently will only write out the signer's certificate to a file: if the signer has a separate encryption certificate this must be manually extracted. There should be some heuristic that determines the correct encryption certificate.</p>
|
||||
|
||||
<p>Ideally a database should be maintained of a certificates for each email address.</p>
|
||||
|
||||
<p>The code doesn't currently take note of the permitted symmetric encryption algorithms as supplied in the SMIMECapabilities signed attribute. This means the user has to manually include the correct encryption algorithm. It should store the list of permitted ciphers in a database and only use those.</p>
|
||||
|
||||
<p>No revocation checking is done on the signer's certificate.</p>
|
||||
|
||||
<p>The current code can only handle S/MIME v2 messages, the more complex S/MIME v3 structures may cause parsing errors.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The use of multiple <b>-signer</b> options and the <b>-resign</b> command were first added in OpenSSL 1.0.0</p>
|
||||
|
||||
<p>The -no_alt_chains option was added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
117
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/speed.html
vendored
Normal file
117
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/speed.html
vendored
Normal file
@ -0,0 +1,117 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>speed</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-speed, speed - test library performance</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl speed</b> [<b>-help</b>] [<b>-engine id</b>] [<b>-elapsed</b>] [<b>-evp algo</b>] [<b>-decrypt</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-primes num</b>] [<b>-seconds num</b>] [<b>-bytes num</b>] [<b>algorithm...</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This command is used to test the performance of cryptographic algorithms. To see the list of supported algorithms, use the <i>list --digest-commands</i> or <i>list --cipher-commands</i> command. The global CSPRNG is denoted by the <i>rand</i> algorithm name.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>speed</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="elapsed"><b>-elapsed</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When calculating operations- or bytes-per-second, use wall-clock time instead of CPU user time as divisor. It can be useful when testing speed of hardware engines.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="evp-algo"><b>-evp algo</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the specified cipher or message digest algorithm via the EVP interface. If <b>algo</b> is an AEAD cipher, then you can pass <-aead> to benchmark a TLS-like sequence. And if <b>algo</b> is a multi-buffer capable cipher, e.g. aes-128-cbc-hmac-sha1, then <b>-mb</b> will time multi-buffer operation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="decrypt"><b>-decrypt</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Time the decryption instead of encryption. Affects only the EVP testing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="primes-num"><b>-primes num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate a <b>num</b>-prime RSA key and use it to run the benchmarks. This option is only effective if RSA algorithm is specified to test.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="seconds-num"><b>-seconds num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Run benchmarks for <b>num</b> seconds.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="bytes-num"><b>-bytes num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Run benchmarks on <b>num</b>-byte buffers. Affects ciphers, digests and the CSPRNG.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="zero-or-more-test-algorithms"><b>[zero or more test algorithms]</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If any options are given, <b>speed</b> tests those algorithms, otherwise a pre-compiled grand selection is tested.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
167
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/spkac.html
vendored
Normal file
167
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/spkac.html
vendored
Normal file
@ -0,0 +1,167 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>spkac</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-spkac, spkac - SPKAC printing and generating utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>spkac</b> [<b>-help</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-key keyfile</b>] [<b>-keyform PEM|DER|ENGINE</b>] [<b>-passin arg</b>] [<b>-challenge string</b>] [<b>-pubkey</b>] [<b>-spkac spkacname</b>] [<b>-spksect section</b>] [<b>-noout</b>] [<b>-verify</b>] [<b>-engine id</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>spkac</b> command processes Netscape signed public key and challenge (SPKAC) files. It can print out their contents, verify the signature and produce its own SPKACs from a supplied private key.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read from or standard input if this option is not specified. Ignored if the <b>-key</b> option is used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="key-keyfile"><b>-key keyfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Create an SPKAC file using the private key in <b>keyfile</b>. The <b>-in</b>, <b>-noout</b>, <b>-spksect</b> and <b>-verify</b> options are ignored if present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Whether the key format is PEM, DER, or an engine-backed key. The default is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-password"><b>-passin password</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The input file password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="challenge-string"><b>-challenge string</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the challenge string if an SPKAC is being created.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="spkac-spkacname"><b>-spkac spkacname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Allows an alternative name form the variable containing the SPKAC. The default is "SPKAC". This option affects both generated and input SPKAC files.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="spksect-section"><b>-spksect section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Allows an alternative name form the section containing the SPKAC. The default is the default section.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't output the text version of the SPKAC (not used if an SPKAC is being created).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubkey"><b>-pubkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Output the public key of an SPKAC (not used if an SPKAC is being created).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify"><b>-verify</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verifies the digital signature on the supplied SPKAC.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>spkac</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Print out the contents of an SPKAC:</p>
|
||||
|
||||
<pre><code>openssl spkac -in spkac.cnf</code></pre>
|
||||
|
||||
<p>Verify the signature of an SPKAC:</p>
|
||||
|
||||
<pre><code>openssl spkac -in spkac.cnf -noout -verify</code></pre>
|
||||
|
||||
<p>Create an SPKAC using the challenge string "hello":</p>
|
||||
|
||||
<pre><code>openssl spkac -key key.pem -challenge hello -out spkac.cnf</code></pre>
|
||||
|
||||
<p>Example of an SPKAC, (long lines split up for clarity):</p>
|
||||
|
||||
<pre><code>SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA\
|
||||
1cCoq2Wa3Ixs47uI7FPVwHVIPDx5yso105Y6zpozam135a\
|
||||
8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03uPFoQIDAQAB\
|
||||
FgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJ\
|
||||
h1bEIYuc2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnD\
|
||||
dq+NQ3F+X4deMx9AaEglZtULwV4=</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>A created SPKAC with suitable DN components appended can be fed into the <b>ca</b> utility.</p>
|
||||
|
||||
<p>SPKACs are typically generated by Netscape when a form is submitted containing the <b>KEYGEN</b> tag as part of the certificate enrollment process.</p>
|
||||
|
||||
<p>The challenge string permits a primitive form of proof of possession of private key. By checking the SPKAC signature and a random challenge string some guarantee is given that the user knows the private key corresponding to the public key being certified. This is important in some applications. Without this it is possible for a previous SPKAC to be used in a "replay attack".</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/ca.html">ca(1)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
71
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/srp.html
vendored
Normal file
71
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/srp.html
vendored
Normal file
@ -0,0 +1,71 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>srp</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-srp, srp - maintain SRP password file</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl srp</b> [<b>-help</b>] [<b>-verbose</b>] [<b>-add</b>] [<b>-modify</b>] [<b>-delete</b>] [<b>-list</b>] [<b>-name section</b>] [<b>-config file</b>] [<b>-srpvfile file</b>] [<b>-gn identifier</b>] [<b>-userinfo text...</b>] [<b>-passin arg</b>] [<b>-passout arg</b>] [<i>user...</i>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>srp</b> command is user to maintain an SRP (secure remote password) file. At most one of the <b>-add</b>, <b>-modify</b>, <b>-delete</b>, and <b>-list</b> options can be specified. These options take zero or more usernames as parameters and perform the appropriate operation on the SRP file. For <b>-list</b>, if no <b>user</b> is given then all users are displayed.</p>
|
||||
|
||||
<p>The configuration file to use, and the section within the file, can be specified with the <b>-config</b> and <b>-name</b> flags, respectively. If the config file is not specified, the <b>-srpvfile</b> can be used to just specify the file to operate on.</p>
|
||||
|
||||
<p>The <b>-userinfo</b> option specifies additional information to add when adding or modifying a user.</p>
|
||||
|
||||
<p>The <b>-gn</b> flag specifies the <b>g</b> and <b>N</b> values, using one of the strengths defined in IETF RFC 5054.</p>
|
||||
|
||||
<p>The <b>-passin</b> and <b>-passout</b> arguments are parsed as described in the <a href="../man1/openssl.html">openssl(1)</a> command.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help">[<b>-help</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Display an option summary.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verbose">[<b>-verbose</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Generate verbose output while processing.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
151
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/storeutl.html
vendored
Normal file
151
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/storeutl.html
vendored
Normal file
@ -0,0 +1,151 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>storeutl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-storeutl, storeutl - STORE utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>storeutl</b> [<b>-help</b>] [<b>-out file</b>] [<b>-noout</b>] [<b>-passin arg</b>] [<b>-text arg</b>] [<b>-engine id</b>] [<b>-r</b>] [<b>-certs</b>] [<b>-keys</b>] [<b>-crls</b>] [<b>-subject arg</b>] [<b>-issuer arg</b>] [<b>-serial arg</b>] [<b>-alias arg</b>] [<b>-fingerprint arg</b>] [<b>-<i>digest</i></b>] <b>uri</b> ...</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>storeutl</b> command can be used to display the contents (after decryption as the case may be) fetched from the given URIs.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>this option prevents output of the PEM data.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>the key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the objects in text form, similarly to the <b>-text</b> output from <b>openssl x509</b>, <b>openssl pkey</b>, etc.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>specifying an engine (by its unique <b>id</b> string) will cause <b>storeutl</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="r"><b>-r</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Fetch objects recursively when possible.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certs"><b>-certs</b></dt>
|
||||
<dd>
|
||||
|
||||
</dd>
|
||||
<dt id="keys"><b>-keys</b></dt>
|
||||
<dd>
|
||||
|
||||
</dd>
|
||||
<dt id="crls"><b>-crls</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Only select the certificates, keys or CRLs from the given URI. However, if this URI would return a set of names (URIs), those are always returned.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="subject-arg"><b>-subject arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Search for an object having the subject name <b>arg</b>. The arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>. Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted but are ignored for the search. That is, a search with an empty value will have the same effect as not specifying the type at all.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="issuer-arg"><b>-issuer arg</b></dt>
|
||||
<dd>
|
||||
|
||||
</dd>
|
||||
<dt id="serial-arg"><b>-serial arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Search for an object having the given issuer name and serial number. These two options <i>must</i> be used together. The issuer arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>, characters may be escaped by \ (backslash), no spaces are skipped. The serial arg may be specified as a decimal value or a hex value if preceded by <b>0x</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="alias-arg"><b>-alias arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Search for an object having the given alias.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="fingerprint-arg"><b>-fingerprint arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Search for an object having the given fingerprint.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest"><b>-<i>digest</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The digest that was used to compute the fingerprint given with <b>-fingerprint</b>.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/openssl.html">openssl(1)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The <b>openssl</b> <b>storeutl</b> app was added in OpenSSL 1.1.1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
555
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ts.html
vendored
Normal file
555
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/ts.html
vendored
Normal file
@ -0,0 +1,555 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ts</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a>
|
||||
<ul>
|
||||
<li><a href="#Time-Stamp-Request-generation">Time Stamp Request generation</a></li>
|
||||
<li><a href="#Time-Stamp-Response-generation">Time Stamp Response generation</a></li>
|
||||
<li><a href="#Time-Stamp-Response-verification">Time Stamp Response verification</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a>
|
||||
<ul>
|
||||
<li><a href="#Time-Stamp-Request">Time Stamp Request</a></li>
|
||||
<li><a href="#Time-Stamp-Response">Time Stamp Response</a></li>
|
||||
<li><a href="#Time-Stamp-Verification">Time Stamp Verification</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-ts, ts - Time Stamping Authority tool (client/server)</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>ts</b> <b>-query</b> [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-config</b> configfile] [<b>-data</b> file_to_hash] [<b>-digest</b> digest_bytes] [<b>-<i>digest</i></b>] [<b>-tspolicy</b> object_id] [<b>-no_nonce</b>] [<b>-cert</b>] [<b>-in</b> request.tsq] [<b>-out</b> request.tsq] [<b>-text</b>]</p>
|
||||
|
||||
<p><b>openssl</b> <b>ts</b> <b>-reply</b> [<b>-config</b> configfile] [<b>-section</b> tsa_section] [<b>-queryfile</b> request.tsq] [<b>-passin</b> password_src] [<b>-signer</b> tsa_cert.pem] [<b>-inkey</b> file_or_id] [<b>-<i>digest</i></b>] [<b>-chain</b> certs_file.pem] [<b>-tspolicy</b> object_id] [<b>-in</b> response.tsr] [<b>-token_in</b>] [<b>-out</b> response.tsr] [<b>-token_out</b>] [<b>-text</b>] [<b>-engine</b> id]</p>
|
||||
|
||||
<p><b>openssl</b> <b>ts</b> <b>-verify</b> [<b>-data</b> file_to_hash] [<b>-digest</b> digest_bytes] [<b>-queryfile</b> request.tsq] [<b>-in</b> response.tsr] [<b>-token_in</b>] [<b>-CApath</b> trusted_cert_path] [<b>-CAfile</b> trusted_certs.pem] [<b>-untrusted</b> cert_file.pem] [<i>verify options</i>]</p>
|
||||
|
||||
<p><i>verify options:</i> [-attime timestamp] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-issuer_checks] [-no_alt_chains] [-no_check_time] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>ts</b> command is a basic Time Stamping Authority (TSA) client and server application as specified in RFC 3161 (Time-Stamp Protocol, TSP). A TSA can be part of a PKI deployment and its role is to provide long term proof of the existence of a certain datum before a particular time. Here is a brief description of the protocol:</p>
|
||||
|
||||
<ol>
|
||||
|
||||
<li><p>The TSA client computes a one-way hash value for a data file and sends the hash to the TSA.</p>
|
||||
|
||||
</li>
|
||||
<li><p>The TSA attaches the current date and time to the received hash value, signs them and sends the time stamp token back to the client. By creating this token the TSA certifies the existence of the original data file at the time of response generation.</p>
|
||||
|
||||
</li>
|
||||
<li><p>The TSA client receives the time stamp token and verifies the signature on it. It also checks if the token contains the same hash value that it had sent to the TSA.</p>
|
||||
|
||||
</li>
|
||||
</ol>
|
||||
|
||||
<p>There is one DER encoded protocol data unit defined for transporting a time stamp request to the TSA and one for sending the time stamp response back to the client. The <b>ts</b> command has three main functions: creating a time stamp request based on a data file, creating a time stamp response based on a request, verifying if a response corresponds to a particular request or a data file.</p>
|
||||
|
||||
<p>There is no support for sending the requests/responses automatically over HTTP or TCP yet as suggested in RFC 3161. The users must send the requests either by ftp or e-mail.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<h2 id="Time-Stamp-Request-generation">Time Stamp Request generation</h2>
|
||||
|
||||
<p>The <b>-query</b> switch can be used for creating and printing a time stamp request with the following options:</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="config-configfile"><b>-config</b> configfile</dt>
|
||||
<dd>
|
||||
|
||||
<p>The configuration file to use. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="data-file_to_hash"><b>-data</b> file_to_hash</dt>
|
||||
<dd>
|
||||
|
||||
<p>The data file for which the time stamp request needs to be created. stdin is the default if neither the <b>-data</b> nor the <b>-digest</b> parameter is specified. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest-digest_bytes"><b>-digest</b> digest_bytes</dt>
|
||||
<dd>
|
||||
|
||||
<p>It is possible to specify the message imprint explicitly without the data file. The imprint must be specified in a hexadecimal format, two characters per byte, the bytes optionally separated by colons (e.g. 1A:F6:01:... or 1AF601...). The number of bytes must match the message digest algorithm in use. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest"><b>-<i>digest</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The message digest to apply to the data file. Any digest supported by the OpenSSL <b>dgst</b> command can be used. The default is SHA-1. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="tspolicy-object_id"><b>-tspolicy</b> object_id</dt>
|
||||
<dd>
|
||||
|
||||
<p>The policy that the client expects the TSA to use for creating the time stamp token. Either the dotted OID notation or OID names defined in the config file can be used. If no policy is requested the TSA will use its own default policy. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_nonce"><b>-no_nonce</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>No nonce is specified in the request if this option is given. Otherwise a 64 bit long pseudo-random none is included in the request. It is recommended to use nonce to protect against replay-attacks. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="cert"><b>-cert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The TSA is expected to include its signing certificate in the response. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-request.tsq"><b>-in</b> request.tsq</dt>
|
||||
<dd>
|
||||
|
||||
<p>This option specifies a previously created time stamp request in DER format that will be printed into the output file. Useful when you need to examine the content of a request in human-readable format. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-request.tsq"><b>-out</b> request.tsq</dt>
|
||||
<dd>
|
||||
|
||||
<p>Name of the output file to which the request will be written. Default is stdout. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is specified the output is human-readable text format instead of DER. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Time-Stamp-Response-generation">Time Stamp Response generation</h2>
|
||||
|
||||
<p>A time stamp response (TimeStampResp) consists of a response status and the time stamp token itself (ContentInfo), if the token generation was successful. The <b>-reply</b> command is for creating a time stamp response or time stamp token based on a request and printing the response/token in human-readable format. If <b>-token_out</b> is not specified the output is always a time stamp response (TimeStampResp), otherwise it is a time stamp token (ContentInfo).</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="config-configfile1"><b>-config</b> configfile</dt>
|
||||
<dd>
|
||||
|
||||
<p>The configuration file to use. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>. See <b>CONFIGURATION FILE OPTIONS</b> for configurable variables.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="section-tsa_section"><b>-section</b> tsa_section</dt>
|
||||
<dd>
|
||||
|
||||
<p>The name of the config file section containing the settings for the response generation. If not specified the default TSA section is used, see <b>CONFIGURATION FILE OPTIONS</b> for details. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="queryfile-request.tsq"><b>-queryfile</b> request.tsq</dt>
|
||||
<dd>
|
||||
|
||||
<p>The name of the file containing a DER encoded time stamp request. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-password_src"><b>-passin</b> password_src</dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the password source for the private key of the TSA. See <b>PASS PHRASE ARGUMENTS</b> in <a href="../man1/openssl.html">openssl(1)</a>. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signer-tsa_cert.pem"><b>-signer</b> tsa_cert.pem</dt>
|
||||
<dd>
|
||||
|
||||
<p>The signer certificate of the TSA in PEM format. The TSA signing certificate must have exactly one extended key usage assigned to it: timeStamping. The extended key usage must also be critical, otherwise the certificate is going to be refused. Overrides the <b>signer_cert</b> variable of the config file. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inkey-file_or_id"><b>-inkey</b> file_or_id</dt>
|
||||
<dd>
|
||||
|
||||
<p>The signer private key of the TSA in PEM format. Overrides the <b>signer_key</b> config file option. (Optional) If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest1"><b>-<i>digest</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Signing digest to use. Overrides the <b>signer_digest</b> config file option. (Mandatory unless specified in the config file)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="chain-certs_file.pem"><b>-chain</b> certs_file.pem</dt>
|
||||
<dd>
|
||||
|
||||
<p>The collection of certificates in PEM format that will all be included in the response in addition to the signer certificate if the <b>-cert</b> option was used for the request. This file is supposed to contain the certificate chain for the signer certificate from its issuer upwards. The <b>-reply</b> command does not build a certificate chain automatically. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="tspolicy-object_id1"><b>-tspolicy</b> object_id</dt>
|
||||
<dd>
|
||||
|
||||
<p>The default policy to use for the response unless the client explicitly requires a particular TSA policy. The OID can be specified either in dotted notation or with its name. Overrides the <b>default_policy</b> config file option. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-response.tsr"><b>-in</b> response.tsr</dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies a previously created time stamp response or time stamp token (if <b>-token_in</b> is also specified) in DER format that will be written to the output file. This option does not require a request, it is useful e.g. when you need to examine the content of a response or token or you want to extract the time stamp token from a response. If the input is a token and the output is a time stamp response a default 'granted' status info is added to the token. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="token_in"><b>-token_in</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This flag can be used together with the <b>-in</b> option and indicates that the input is a DER encoded time stamp token (ContentInfo) instead of a time stamp response (TimeStampResp). (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-response.tsr"><b>-out</b> response.tsr</dt>
|
||||
<dd>
|
||||
|
||||
<p>The response is written to this file. The format and content of the file depends on other options (see <b>-text</b>, <b>-token_out</b>). The default is stdout. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="token_out"><b>-token_out</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The output is a time stamp token (ContentInfo) instead of time stamp response (TimeStampResp). (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="text1"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is specified the output is human-readable text format instead of DER. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine</b> id</dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ts</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. Default is builtin. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Time-Stamp-Response-verification">Time Stamp Response verification</h2>
|
||||
|
||||
<p>The <b>-verify</b> command is for verifying if a time stamp response or time stamp token is valid and matches a particular time stamp request or data file. The <b>-verify</b> command does not use the configuration file.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="data-file_to_hash1"><b>-data</b> file_to_hash</dt>
|
||||
<dd>
|
||||
|
||||
<p>The response or token must be verified against file_to_hash. The file is hashed with the message digest algorithm specified in the token. The <b>-digest</b> and <b>-queryfile</b> options must not be specified with this one. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest-digest_bytes1"><b>-digest</b> digest_bytes</dt>
|
||||
<dd>
|
||||
|
||||
<p>The response or token must be verified against the message digest specified with this option. The number of bytes must match the message digest algorithm specified in the token. The <b>-data</b> and <b>-queryfile</b> options must not be specified with this one. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="queryfile-request.tsq1"><b>-queryfile</b> request.tsq</dt>
|
||||
<dd>
|
||||
|
||||
<p>The original time stamp request in DER format. The <b>-data</b> and <b>-digest</b> options must not be specified with this one. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-response.tsr1"><b>-in</b> response.tsr</dt>
|
||||
<dd>
|
||||
|
||||
<p>The time stamp response that needs to be verified in DER format. (Mandatory)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="token_in1"><b>-token_in</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This flag can be used together with the <b>-in</b> option and indicates that the input is a DER encoded time stamp token (ContentInfo) instead of a time stamp response (TimeStampResp). (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-trusted_cert_path"><b>-CApath</b> trusted_cert_path</dt>
|
||||
<dd>
|
||||
|
||||
<p>The name of the directory containing the trusted CA certificates of the client. See the similar option of <a href="../man1/verify.html">verify(1)</a> for additional details. Either this option or <b>-CAfile</b> must be specified. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-trusted_certs.pem"><b>-CAfile</b> trusted_certs.pem</dt>
|
||||
<dd>
|
||||
|
||||
<p>The name of the file containing a set of trusted self-signed CA certificates in PEM format. See the similar option of <a href="../man1/verify.html">verify(1)</a> for additional details. Either this option or <b>-CApath</b> must be specified. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="untrusted-cert_file.pem"><b>-untrusted</b> cert_file.pem</dt>
|
||||
<dd>
|
||||
|
||||
<p>Set of additional untrusted certificates in PEM format which may be needed when building the certificate chain for the TSA's signing certificate. This file must contain the TSA signing certificate and all intermediate CA certificates unless the response includes them. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify-options"><i>verify options</i></dt>
|
||||
<dd>
|
||||
|
||||
<p>The options <b>-attime timestamp</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-issuer_checks</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, and <b>-x509_strict</b> can be used to control timestamp verification. See <a href="../man1/verify.html">verify(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</h1>
|
||||
|
||||
<p>The <b>-query</b> and <b>-reply</b> commands make use of a configuration file. See <a href="../man5/config.html">config(5)</a> for a general description of the syntax of the config file. The <b>-query</b> command uses only the symbolic OID names section and it can work without it. However, the <b>-reply</b> command needs the config file for its operation.</p>
|
||||
|
||||
<p>When there is a command line switch equivalent of a variable the switch always overrides the settings in the config file.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="tsa-section-default_tsa"><b>tsa</b> section, <b>default_tsa</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the main section and it specifies the name of another section that contains all the options for the <b>-reply</b> command. This default section can be overridden with the <b>-section</b> command line switch. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oid_file"><b>oid_file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>See <a href="../man1/ca.html">ca(1)</a> for description. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oid_section"><b>oid_section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>See <a href="../man1/ca.html">ca(1)</a> for description. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="RANDFILE"><b>RANDFILE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>See <a href="../man1/ca.html">ca(1)</a> for description. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="serial"><b>serial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The name of the file containing the hexadecimal serial number of the last time stamp response created. This number is incremented by 1 for each response. If the file does not exist at the time of response generation a new file is created with serial number 1. (Mandatory)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crypto_device"><b>crypto_device</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the OpenSSL engine that will be set as the default for all available algorithms. The default value is builtin, you can specify any other engines supported by OpenSSL (e.g. use chil for the NCipher HSM). (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signer_cert"><b>signer_cert</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>TSA signing certificate in PEM format. The same as the <b>-signer</b> command line option. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certs"><b>certs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file containing a set of PEM encoded certificates that need to be included in the response. The same as the <b>-chain</b> command line option. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signer_key"><b>signer_key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The private key of the TSA in PEM format. The same as the <b>-inkey</b> command line option. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="signer_digest"><b>signer_digest</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Signing digest to use. The same as the <b>-<i>digest</i></b> command line option. (Mandatory unless specified on the command line)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="default_policy"><b>default_policy</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The default policy to use when the request does not mandate any policy. The same as the <b>-tspolicy</b> command line option. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="other_policies"><b>other_policies</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Comma separated list of policies that are also acceptable by the TSA and used only if the request explicitly specifies one of them. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digests"><b>digests</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The list of message digest algorithms that the TSA accepts. At least one algorithm must be specified. (Mandatory)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="accuracy"><b>accuracy</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The accuracy of the time source of the TSA in seconds, milliseconds and microseconds. E.g. secs:1, millisecs:500, microsecs:100. If any of the components is missing zero is assumed for that field. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="clock_precision_digits"><b>clock_precision_digits</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the maximum number of digits, which represent the fraction of seconds, that need to be included in the time field. The trailing zeroes must be removed from the time, so there might actually be fewer digits, or no fraction of seconds at all. Supported only on UNIX platforms. The maximum value is 6, default is 0. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ordering"><b>ordering</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>If this option is yes the responses generated by this TSA can always be ordered, even if the time difference between two responses is less than the sum of their accuracies. Default is no. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="tsa_name"><b>tsa_name</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set this option to yes if the subject name of the TSA must be included in the TSA name field of the response. Default is no. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ess_cert_id_chain"><b>ess_cert_id_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The SignedData objects created by the TSA always contain the certificate identifier of the signing certificate in a signed attribute (see RFC 2634, Enhanced Security Services). If this option is set to yes and either the <b>certs</b> variable or the <b>-chain</b> option is specified then the certificate identifiers of the chain will also be included in the SigningCertificate signed attribute. If this variable is set to no, only the signing certificate identifier is included. Default is no. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ess_cert_id_alg"><b>ess_cert_id_alg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option specifies the hash function to be used to calculate the TSA's public key certificate identifier. Default is sha1. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>All the examples below presume that <b>OPENSSL_CONF</b> is set to a proper configuration file, e.g. the example configuration file openssl/apps/openssl.cnf will do.</p>
|
||||
|
||||
<h2 id="Time-Stamp-Request">Time Stamp Request</h2>
|
||||
|
||||
<p>To create a time stamp request for design1.txt with SHA-1 without nonce and policy and no certificate is required in the response:</p>
|
||||
|
||||
<pre><code>openssl ts -query -data design1.txt -no_nonce \
|
||||
-out design1.tsq</code></pre>
|
||||
|
||||
<p>To create a similar time stamp request with specifying the message imprint explicitly:</p>
|
||||
|
||||
<pre><code>openssl ts -query -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
|
||||
-no_nonce -out design1.tsq</code></pre>
|
||||
|
||||
<p>To print the content of the previous request in human readable format:</p>
|
||||
|
||||
<pre><code>openssl ts -query -in design1.tsq -text</code></pre>
|
||||
|
||||
<p>To create a time stamp request which includes the MD-5 digest of design2.txt, requests the signer certificate and nonce, specifies a policy id (assuming the tsa_policy1 name is defined in the OID section of the config file):</p>
|
||||
|
||||
<pre><code>openssl ts -query -data design2.txt -md5 \
|
||||
-tspolicy tsa_policy1 -cert -out design2.tsq</code></pre>
|
||||
|
||||
<h2 id="Time-Stamp-Response">Time Stamp Response</h2>
|
||||
|
||||
<p>Before generating a response a signing certificate must be created for the TSA that contains the <b>timeStamping</b> critical extended key usage extension without any other key usage extensions. You can add this line to the user certificate section of the config file to generate a proper certificate;</p>
|
||||
|
||||
<pre><code>extendedKeyUsage = critical,timeStamping</code></pre>
|
||||
|
||||
<p>See <a href="../man1/req.html">req(1)</a>, <a href="../man1/ca.html">ca(1)</a>, and <a href="../man1/x509.html">x509(1)</a> for instructions. The examples below assume that cacert.pem contains the certificate of the CA, tsacert.pem is the signing certificate issued by cacert.pem and tsakey.pem is the private key of the TSA.</p>
|
||||
|
||||
<p>To create a time stamp response for a request:</p>
|
||||
|
||||
<pre><code>openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \
|
||||
-signer tsacert.pem -out design1.tsr</code></pre>
|
||||
|
||||
<p>If you want to use the settings in the config file you could just write:</p>
|
||||
|
||||
<pre><code>openssl ts -reply -queryfile design1.tsq -out design1.tsr</code></pre>
|
||||
|
||||
<p>To print a time stamp reply to stdout in human readable format:</p>
|
||||
|
||||
<pre><code>openssl ts -reply -in design1.tsr -text</code></pre>
|
||||
|
||||
<p>To create a time stamp token instead of time stamp response:</p>
|
||||
|
||||
<pre><code>openssl ts -reply -queryfile design1.tsq -out design1_token.der -token_out</code></pre>
|
||||
|
||||
<p>To print a time stamp token to stdout in human readable format:</p>
|
||||
|
||||
<pre><code>openssl ts -reply -in design1_token.der -token_in -text -token_out</code></pre>
|
||||
|
||||
<p>To extract the time stamp token from a response:</p>
|
||||
|
||||
<pre><code>openssl ts -reply -in design1.tsr -out design1_token.der -token_out</code></pre>
|
||||
|
||||
<p>To add 'granted' status info to a time stamp token thereby creating a valid response:</p>
|
||||
|
||||
<pre><code>openssl ts -reply -in design1_token.der -token_in -out design1.tsr</code></pre>
|
||||
|
||||
<h2 id="Time-Stamp-Verification">Time Stamp Verification</h2>
|
||||
|
||||
<p>To verify a time stamp reply against a request:</p>
|
||||
|
||||
<pre><code>openssl ts -verify -queryfile design1.tsq -in design1.tsr \
|
||||
-CAfile cacert.pem -untrusted tsacert.pem</code></pre>
|
||||
|
||||
<p>To verify a time stamp reply that includes the certificate chain:</p>
|
||||
|
||||
<pre><code>openssl ts -verify -queryfile design2.tsq -in design2.tsr \
|
||||
-CAfile cacert.pem</code></pre>
|
||||
|
||||
<p>To verify a time stamp token against the original data file: openssl ts -verify -data design2.txt -in design2.tsr \ -CAfile cacert.pem</p>
|
||||
|
||||
<p>To verify a time stamp token against a message imprint: openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \ -in design2.tsr -CAfile cacert.pem</p>
|
||||
|
||||
<p>You could also look at the 'test' directory for more examples.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<ul>
|
||||
|
||||
<li><p>No support for time stamps over SMTP, though it is quite easy to implement an automatic e-mail based TSA with <a href="../man1/procmail.html">procmail(1)</a> and <a href="../man1/perl.html">perl(1)</a>. HTTP server support is provided in the form of a separate apache module. HTTP client support is provided by <a href="../man1/tsget.html">tsget(1)</a>. Pure TCP/IP protocol is not supported.</p>
|
||||
|
||||
</li>
|
||||
<li><p>The file containing the last serial number of the TSA is not locked when being read or written. This is a problem if more than one instance of <a href="../man1/openssl.html">openssl(1)</a> is trying to create a time stamp response at the same time. This is not an issue when using the apache server module, it does proper locking.</p>
|
||||
|
||||
</li>
|
||||
<li><p>Look for the FIXME word in the source files.</p>
|
||||
|
||||
</li>
|
||||
<li><p>The source code should really be reviewed by somebody else, too.</p>
|
||||
|
||||
</li>
|
||||
<li><p>More testing is needed, I have done only some basic tests (see test/testtsa).</p>
|
||||
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/tsget.html">tsget(1)</a>, <a href="../man1/openssl.html">openssl(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/x509.html">x509(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man5/config.html">config(5)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
190
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/tsget.html
vendored
Normal file
190
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/tsget.html
vendored
Normal file
@ -0,0 +1,190 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>tsget</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#ENVIRONMENT-VARIABLES">ENVIRONMENT VARIABLES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-tsget, tsget - Time Stamping HTTP/HTTPS client</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>tsget</b> <b>-h</b> server_url [<b>-e</b> extension] [<b>-o</b> output] [<b>-v</b>] [<b>-d</b>] [<b>-k</b> private_key.pem] [<b>-p</b> key_password] [<b>-c</b> client_cert.pem] [<b>-C</b> CA_certs.pem] [<b>-P</b> CA_path] [<b>-r</b> file:file...] [<b>-g</b> EGD_socket] [request]...</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>tsget</b> command can be used for sending a time stamp request, as specified in <b>RFC 3161</b>, to a time stamp server over HTTP or HTTPS and storing the time stamp response in a file. This tool cannot be used for creating the requests and verifying responses, you can use the OpenSSL <b>ts(1)</b> command to do that. <b>tsget</b> can send several requests to the server without closing the TCP connection if more than one requests are specified on the command line.</p>
|
||||
|
||||
<p>The tool sends the following HTTP request for each time stamp request:</p>
|
||||
|
||||
<pre><code>POST url HTTP/1.1
|
||||
User-Agent: OpenTSA tsget.pl/<version>
|
||||
Host: <host>:<port>
|
||||
Pragma: no-cache
|
||||
Content-Type: application/timestamp-query
|
||||
Accept: application/timestamp-reply
|
||||
Content-Length: length of body
|
||||
|
||||
...binary request specified by the user...</code></pre>
|
||||
|
||||
<p><b>tsget</b> expects a response of type application/timestamp-reply, which is written to a file without any interpretation.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="h-server_url"><b>-h</b> server_url</dt>
|
||||
<dd>
|
||||
|
||||
<p>The URL of the HTTP/HTTPS server listening for time stamp requests.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="e-extension"><b>-e</b> extension</dt>
|
||||
<dd>
|
||||
|
||||
<p>If the <b>-o</b> option is not given this argument specifies the extension of the output files. The base name of the output file will be the same as those of the input files. Default extension is '.tsr'. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="o-output"><b>-o</b> output</dt>
|
||||
<dd>
|
||||
|
||||
<p>This option can be specified only when just one request is sent to the server. The time stamp response will be written to the given output file. '-' means standard output. In case of multiple time stamp requests or the absence of this argument the names of the output files will be derived from the names of the input files and the default or specified extension argument. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="v"><b>-v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The name of the currently processed request is printed on standard error. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="d"><b>-d</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Switches on verbose mode for the underlying <b>curl</b> library. You can see detailed debug messages for the connection. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="k-private_key.pem"><b>-k</b> private_key.pem</dt>
|
||||
<dd>
|
||||
|
||||
<p>(HTTPS) In case of certificate-based client authentication over HTTPS <private_key.pem> must contain the private key of the user. The private key file can optionally be protected by a passphrase. The <b>-c</b> option must also be specified. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="p-key_password"><b>-p</b> key_password</dt>
|
||||
<dd>
|
||||
|
||||
<p>(HTTPS) Specifies the passphrase for the private key specified by the <b>-k</b> argument. If this option is omitted and the key is passphrase protected <b>tsget</b> will ask for it. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="c-client_cert.pem"><b>-c</b> client_cert.pem</dt>
|
||||
<dd>
|
||||
|
||||
<p>(HTTPS) In case of certificate-based client authentication over HTTPS <client_cert.pem> must contain the X.509 certificate of the user. The <b>-k</b> option must also be specified. If this option is not specified no certificate-based client authentication will take place. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="C-CA_certs.pem"><b>-C</b> CA_certs.pem</dt>
|
||||
<dd>
|
||||
|
||||
<p>(HTTPS) The trusted CA certificate store. The certificate chain of the peer's certificate must include one of the CA certificates specified in this file. Either option <b>-C</b> or option <b>-P</b> must be given in case of HTTPS. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="P-CA_path"><b>-P</b> CA_path</dt>
|
||||
<dd>
|
||||
|
||||
<p>(HTTPS) The path containing the trusted CA certificates to verify the peer's certificate. The directory must be prepared with the <b>c_rehash</b> OpenSSL utility. Either option <b>-C</b> or option <b>-P</b> must be given in case of HTTPS. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file:file"><b>-rand</b> file:file...</dt>
|
||||
<dd>
|
||||
|
||||
<p>The files containing random data for seeding the random number generator. Multiple files can be specified, the separator is <b>;</b> for MS-Windows, <b>,</b> for VMS and <b>:</b> for all other platforms. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="g-EGD_socket"><b>-g</b> EGD_socket</dt>
|
||||
<dd>
|
||||
|
||||
<p>The name of an EGD socket to get random data from. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
<dt id="request">[request]...</dt>
|
||||
<dd>
|
||||
|
||||
<p>List of files containing <b>RFC 3161</b> DER-encoded time stamp requests. If no requests are specified only one request will be sent to the server and it will be read from the standard input. (Optional)</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="ENVIRONMENT-VARIABLES">ENVIRONMENT VARIABLES</h1>
|
||||
|
||||
<p>The <b>TSGET</b> environment variable can optionally contain default arguments. The content of this variable is added to the list of command line arguments.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>The examples below presume that <b>file1.tsq</b> and <b>file2.tsq</b> contain valid time stamp requests, tsa.opentsa.org listens at port 8080 for HTTP requests and at port 8443 for HTTPS requests, the TSA service is available at the /tsa absolute path.</p>
|
||||
|
||||
<p>Get a time stamp response for file1.tsq over HTTP, output is written to file1.tsr:</p>
|
||||
|
||||
<pre><code>tsget -h http://tsa.opentsa.org:8080/tsa file1.tsq</code></pre>
|
||||
|
||||
<p>Get a time stamp response for file1.tsq and file2.tsq over HTTP showing progress, output is written to file1.reply and file2.reply respectively:</p>
|
||||
|
||||
<pre><code>tsget -h http://tsa.opentsa.org:8080/tsa -v -e .reply \
|
||||
file1.tsq file2.tsq</code></pre>
|
||||
|
||||
<p>Create a time stamp request, write it to file3.tsq, send it to the server and write the response to file3.tsr:</p>
|
||||
|
||||
<pre><code>openssl ts -query -data file3.txt -cert | tee file3.tsq \
|
||||
| tsget -h http://tsa.opentsa.org:8080/tsa \
|
||||
-o file3.tsr</code></pre>
|
||||
|
||||
<p>Get a time stamp response for file1.tsq over HTTPS without client authentication:</p>
|
||||
|
||||
<pre><code>tsget -h https://tsa.opentsa.org:8443/tsa \
|
||||
-C cacerts.pem file1.tsq</code></pre>
|
||||
|
||||
<p>Get a time stamp response for file1.tsq over HTTPS with certificate-based client authentication (it will ask for the passphrase if client_key.pem is protected):</p>
|
||||
|
||||
<pre><code>tsget -h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
|
||||
-k client_key.pem -c client_cert.pem file1.tsq</code></pre>
|
||||
|
||||
<p>You can shorten the previous command line if you make use of the <b>TSGET</b> environment variable. The following commands do the same as the previous example:</p>
|
||||
|
||||
<pre><code>TSGET='-h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
|
||||
-k client_key.pem -c client_cert.pem'
|
||||
export TSGET
|
||||
tsget file1.tsq</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/openssl.html">openssl(1)</a>, <a href="../man1/ts.html">ts(1)</a>, <a href="../man1/curl.html">curl(1)</a>, <b>RFC 3161</b></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
825
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/verify.html
vendored
Normal file
825
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/verify.html
vendored
Normal file
@ -0,0 +1,825 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>verify</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#VERIFY-OPERATION">VERIFY OPERATION</a></li>
|
||||
<li><a href="#DIAGNOSTICS">DIAGNOSTICS</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-verify, verify - Utility to verify certificates</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>verify</b> [<b>-help</b>] [<b>-CAfile file</b>] [<b>-CApath directory</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-allow_proxy_certs</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-CRLfile file</b>] [<b>-crl_download</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-engine id</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-nameopt option</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-untrusted file</b>] [<b>-trusted file</b>] [<b>-use_deltas</b>] [<b>-verbose</b>] [<b>-auth_level level</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-show_chain</b>] [<b>-</b>] [certificates]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>verify</b> command verifies certificate chains.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAfile-file"><b>-CAfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A <b>file</b> of trusted certificates. The file should contain one or more certificates in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CApath-directory"><b>-CApath directory</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A directory of trusted certificates. The certificates should have names of the form: hash.0 or have symbolic links to them of this form ("hash" is the hashed certificate subject name: see the <b>-hash</b> option of the <b>x509</b> utility). Under Unix the <b>c_rehash</b> script will automatically create symbolic links to a directory of certificates.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default file location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no-CApath"><b>-no-CApath</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Do not load the trusted CA certificates from the default directory location.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="allow_proxy_certs"><b>-allow_proxy_certs</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Allow the verification of proxy certificates.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="attime-timestamp"><b>-attime timestamp</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Perform validation checks using time specified by <b>timestamp</b> and not current system time. <b>timestamp</b> is the number of seconds since 01.01.1970 (UNIX time).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="check_ss_sig"><b>-check_ss_sig</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify the signature on the self-signed root CA. This is disabled by default because it doesn't add any security.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CRLfile-file"><b>-CRLfile file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The <b>file</b> should contain one or more CRLs in PEM format. This option can be specified more than once to include CRLs from multiple <b>files</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_download"><b>-crl_download</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Attempt to download CRL information for this certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_check"><b>-crl_check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Checks end entity certificate validity by attempting to look up a valid CRL. If a valid CRL cannot be found an error occurs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="crl_check_all"><b>-crl_check_all</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Checks the validity of <b>all</b> certificates in the chain by attempting to look up valid CRLs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine <b>id</b> will cause <a href="../man1/verify.html">verify(1)</a> to attempt to load the specified engine. The engine will then be set as the default for all its supported algorithms. If you want to load certificates or CRLs that require engine support via any of the <b>-trusted</b>, <b>-untrusted</b> or <b>-CRLfile</b> options, the <b>-engine</b> option must be specified before those options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="explicit_policy"><b>-explicit_policy</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set policy variable require-explicit-policy (see RFC5280).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="extended_crl"><b>-extended_crl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enable extended CRL features such as indirect CRLs and alternate CRL signing keys.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ignore_critical"><b>-ignore_critical</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Normally if an unhandled critical extension is present which is not supported by OpenSSL the certificate is rejected (as required by RFC5280). If this option is set critical extensions are ignored.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inhibit_any"><b>-inhibit_any</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set policy variable inhibit-any-policy (see RFC5280).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inhibit_map"><b>-inhibit_map</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set policy variable inhibit-policy-mapping (see RFC5280).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nameopt-option"><b>-nameopt option</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_check_time"><b>-no_check_time</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option suppresses checking the validity period of certificates and CRLs against the current time. If option <b>-attime timestamp</b> is used to specify a verification time, the check is not suppressed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="partial_chain"><b>-partial_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Allow verification to succeed even if a <i>complete</i> chain cannot be built to a self-signed trust-anchor, provided it is possible to construct a chain to a trusted certificate that might not be self-signed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="policy-arg"><b>-policy arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enable policy processing and add <b>arg</b> to the user-initial-policy-set (see RFC5280). The policy <b>arg</b> can be an object name an OID in numeric form. This argument can appear more than once.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="policy_check"><b>-policy_check</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enables certificate policy processing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="policy_print"><b>-policy_print</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out diagnostics related to policy processing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="purpose-purpose"><b>-purpose purpose</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The intended use for the certificate. If this option is not specified, <b>verify</b> will not consider certificate purpose during chain verification. Currently accepted uses are <b>sslclient</b>, <b>sslserver</b>, <b>nssslserver</b>, <b>smimesign</b>, <b>smimeencrypt</b>. See the <b>VERIFY OPERATION</b> section for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="suiteB_128_only--suiteB_128--suiteB_192"><b>-suiteB_128_only</b>, <b>-suiteB_128</b>, <b>-suiteB_192</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enable the Suite B mode operation at 128 bit Level of Security, 128 bit or 192 bit, or only 192 bit Level of Security respectively. See RFC6460 for details. In particular the supported signature algorithms are reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves P-256 and P-384.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="trusted_first"><b>-trusted_first</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When constructing the certificate chain, use the trusted certificates specified via <b>-CAfile</b>, <b>-CApath</b> or <b>-trusted</b> before any certificates specified via <b>-untrusted</b>. This can be useful in environments with Bridge or Cross-Certified CAs. As of OpenSSL 1.1.0 this option is on by default and cannot be disabled.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_alt_chains"><b>-no_alt_chains</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default, unless <b>-trusted_first</b> is specified, when building a certificate chain, if the first certificate chain found is not trusted, then OpenSSL will attempt to replace untrusted issuer certificates with certificates from the trust store to see if an alternative chain can be found that is trusted. As of OpenSSL 1.1.0, with <b>-trusted_first</b> always on, this option has no effect.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="untrusted-file"><b>-untrusted file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A <b>file</b> of additional untrusted certificates (intermediate issuer CAs) used to construct a certificate chain from the subject certificate to a trust-anchor. The <b>file</b> should contain one or more certificates in PEM format. This option can be specified more than once to include untrusted certificates from multiple <b>files</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="trusted-file"><b>-trusted file</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A <b>file</b> of trusted certificates, which must be self-signed, unless the <b>-partial_chain</b> option is specified. The <b>file</b> contains one or more certificates in PEM format. With this option, no additional (e.g., default) certificate lists are consulted. That is, the only trust-anchors are those listed in <b>file</b>. This option can be specified more than once to include trusted certificates from multiple <b>files</b>. This option implies the <b>-no-CAfile</b> and <b>-no-CApath</b> options. This option cannot be used in combination with either of the <b>-CAfile</b> or <b>-CApath</b> options.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="use_deltas"><b>-use_deltas</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Enable support for delta CRLs.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verbose"><b>-verbose</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print extra information about the operations being performed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="auth_level-level"><b>-auth_level level</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Set the certificate chain authentication security level to <b>level</b>. The authentication security level determines the acceptable signature and public key strength when verifying certificate chains. For a certificate chain to validate, the public keys of all the certificates must meet the specified security <b>level</b>. The signature algorithm security level is enforced for all the certificates in the chain except for the chain's <i>trust anchor</i>, which is either directly trusted or validated by means other than its signature. See <a href="../man3/SSL_CTX_set_security_level.html">SSL_CTX_set_security_level(3)</a> for the definitions of the available levels. The default security level is -1, or "not set". At security level 0 or lower all algorithms are acceptable. Security level 1 requires at least 80-bit-equivalent security and is broadly interoperable, though it will, for example, reject MD5 signatures or RSA keys shorter than 1024 bits.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_depth-num"><b>-verify_depth num</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Limit the certificate chain to <b>num</b> intermediate CA certificates. A maximal depth chain can have up to <b>num+2</b> certificates, since neither the end-entity certificate nor the trust-anchor certificate count against the <b>-verify_depth</b> limit.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_email-email"><b>-verify_email email</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify if the <b>email</b> matches the email address in Subject Alternative Name or the email in the subject Distinguished Name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_hostname-hostname"><b>-verify_hostname hostname</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify if the <b>hostname</b> matches DNS name in Subject Alternative Name or Common Name in the subject certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_ip-ip"><b>-verify_ip ip</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Verify if the <b>ip</b> matches the IP address in Subject Alternative Name of the subject certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="verify_name-name"><b>-verify_name name</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use default verification policies like trust model and required certificate policies identified by <b>name</b>. The trust model determines which auxiliary trust or reject OIDs are applicable to verifying the given certificate chain. See the <b>-addtrust</b> and <b>-addreject</b> options of the <a href="../man1/x509.html">x509(1)</a> command-line utility. Supported policy names include: <b>default</b>, <b>pkcs7</b>, <b>smime_sign</b>, <b>ssl_client</b>, <b>ssl_server</b>. These mimics the combinations of purpose and trust settings used in SSL, CMS and S/MIME. As of OpenSSL 1.1.0, the trust model is inferred from the purpose when not specified, so the <b>-verify_name</b> options are functionally equivalent to the corresponding <b>-purpose</b> settings.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="x509_strict"><b>-x509_strict</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For strict X.509 compliance, disable non-compliant workarounds for broken certificates.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="show_chain"><b>-show_chain</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Display information about the certificate chain that has been built (if successful). Certificates in the chain that came from the untrusted list will be flagged as "untrusted".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pod"><b>-</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Indicates the last option. All arguments following this are assumed to be certificate files. This is useful if the first certificate filename begins with a <b>-</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certificates"><b>certificates</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>One or more certificates to verify. If no certificates are given, <b>verify</b> will attempt to read a certificate from standard input. Certificates must be in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="VERIFY-OPERATION">VERIFY OPERATION</h1>
|
||||
|
||||
<p>The <b>verify</b> program uses the same functions as the internal SSL and S/MIME verification, therefore this description applies to these verify operations too.</p>
|
||||
|
||||
<p>There is one crucial difference between the verify operations performed by the <b>verify</b> program: wherever possible an attempt is made to continue after an error whereas normally the verify operation would halt on the first error. This allows all the problems with a certificate chain to be determined.</p>
|
||||
|
||||
<p>The verify operation consists of a number of separate steps.</p>
|
||||
|
||||
<p>Firstly a certificate chain is built up starting from the supplied certificate and ending in the root CA. It is an error if the whole chain cannot be built up. The chain is built up by looking up the issuers certificate of the current certificate. If a certificate is found which is its own issuer it is assumed to be the root CA.</p>
|
||||
|
||||
<p>The process of 'looking up the issuers certificate' itself involves a number of steps. After all certificates whose subject name matches the issuer name of the current certificate are subject to further tests. The relevant authority key identifier components of the current certificate (if present) must match the subject key identifier (if present) and issuer and serial number of the candidate issuer, in addition the keyUsage extension of the candidate issuer (if present) must permit certificate signing.</p>
|
||||
|
||||
<p>The lookup first looks in the list of untrusted certificates and if no match is found the remaining lookups are from the trusted certificates. The root CA is always looked up in the trusted certificate list: if the certificate to verify is a root certificate then an exact match must be found in the trusted list.</p>
|
||||
|
||||
<p>The second operation is to check every untrusted certificate's extensions for consistency with the supplied purpose. If the <b>-purpose</b> option is not included then no checks are done. The supplied or "leaf" certificate must have extensions compatible with the supplied purpose and all other certificates must also be valid CA certificates. The precise extensions required are described in more detail in the <b>CERTIFICATE EXTENSIONS</b> section of the <b>x509</b> utility.</p>
|
||||
|
||||
<p>The third operation is to check the trust settings on the root CA. The root CA should be trusted for the supplied purpose. For compatibility with previous versions of OpenSSL, a certificate with no trust settings is considered to be valid for all purposes.</p>
|
||||
|
||||
<p>The final operation is to check the validity of the certificate chain. The validity period is checked against the current system time and the notBefore and notAfter dates in the certificate. The certificate signatures are also checked at this point.</p>
|
||||
|
||||
<p>If all operations complete successfully then certificate is considered valid. If any operation fails then the certificate is not valid.</p>
|
||||
|
||||
<h1 id="DIAGNOSTICS">DIAGNOSTICS</h1>
|
||||
|
||||
<p>When a verify operation fails the output messages can be somewhat cryptic. The general form of the error message is:</p>
|
||||
|
||||
<pre><code>server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
|
||||
error 24 at 1 depth lookup:invalid CA certificate</code></pre>
|
||||
|
||||
<p>The first line contains the name of the certificate being verified followed by the subject name of the certificate. The second line contains the error number and the depth. The depth is number of the certificate being verified when a problem was detected starting with zero for the certificate being verified itself then 1 for the CA that signed the certificate and so on. Finally a text version of the error number is presented.</p>
|
||||
|
||||
<p>A partial list of the error codes and messages is shown below, this also includes the name of the error code as defined in the header file x509_vfy.h Some of the error codes are defined but never returned: these are described as "unused".</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="X509_V_OK"><b>X509_V_OK</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The operation was successful.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNSPECIFIED"><b>X509_V_ERR_UNSPECIFIED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unspecified error; should not happen.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT"><b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The issuer certificate of a looked up certificate could not be found. This normally means the list of trusted certificates is not complete.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_GET_CRL"><b>X509_V_ERR_UNABLE_TO_GET_CRL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The CRL of a certificate could not be found.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE"><b>X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate signature could not be decrypted. This means that the actual signature value could not be determined rather than it not matching the expected value, this is only meaningful for RSA keys.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE"><b>X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The CRL signature could not be decrypted: this means that the actual signature value could not be determined rather than it not matching the expected value. Unused.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY"><b>X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The public key in the certificate SubjectPublicKeyInfo could not be read.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CERT_SIGNATURE_FAILURE"><b>X509_V_ERR_CERT_SIGNATURE_FAILURE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The signature of the certificate is invalid.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CRL_SIGNATURE_FAILURE"><b>X509_V_ERR_CRL_SIGNATURE_FAILURE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The signature of the certificate is invalid.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CERT_NOT_YET_VALID"><b>X509_V_ERR_CERT_NOT_YET_VALID</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate is not yet valid: the notBefore date is after the current time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CERT_HAS_EXPIRED"><b>X509_V_ERR_CERT_HAS_EXPIRED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate has expired: that is the notAfter date is before the current time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CRL_NOT_YET_VALID"><b>X509_V_ERR_CRL_NOT_YET_VALID</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The CRL is not yet valid.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CRL_HAS_EXPIRED"><b>X509_V_ERR_CRL_HAS_EXPIRED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The CRL has expired.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD"><b>X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate notBefore field contains an invalid time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD"><b>X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate notAfter field contains an invalid time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD"><b>X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The CRL lastUpdate field contains an invalid time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD"><b>X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The CRL nextUpdate field contains an invalid time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_OUT_OF_MEM"><b>X509_V_ERR_OUT_OF_MEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred trying to allocate memory. This should never happen.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT"><b>X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The passed certificate is self-signed and the same certificate cannot be found in the list of trusted certificates.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN"><b>X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate chain could be built up using the untrusted certificates but the root could not be found locally.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY"><b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The issuer certificate could not be found: this occurs if the issuer certificate of an untrusted certificate cannot be found.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE"><b>X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>No signatures could be verified because the chain contains only one certificate and it is not self signed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CERT_CHAIN_TOO_LONG"><b>X509_V_ERR_CERT_CHAIN_TOO_LONG</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate chain length is greater than the supplied maximum depth. Unused.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CERT_REVOKED"><b>X509_V_ERR_CERT_REVOKED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The certificate has been revoked.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_INVALID_CA"><b>X509_V_ERR_INVALID_CA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A CA certificate is invalid. Either it is not a CA or its extensions are not consistent with the supplied purpose.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_PATH_LENGTH_EXCEEDED"><b>X509_V_ERR_PATH_LENGTH_EXCEEDED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The basicConstraints pathlength parameter has been exceeded.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_INVALID_PURPOSE"><b>X509_V_ERR_INVALID_PURPOSE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The supplied certificate cannot be used for the specified purpose.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CERT_UNTRUSTED"><b>X509_V_ERR_CERT_UNTRUSTED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The root CA is not marked as trusted for the specified purpose.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CERT_REJECTED"><b>X509_V_ERR_CERT_REJECTED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The root CA is marked to reject the specified purpose.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUBJECT_ISSUER_MISMATCH"><b>X509_V_ERR_SUBJECT_ISSUER_MISMATCH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_AKID_SKID_MISMATCH"><b>X509_V_ERR_AKID_SKID_MISMATCH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH"><b>X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_KEYUSAGE_NO_CERTSIGN"><b>X509_V_ERR_KEYUSAGE_NO_CERTSIGN</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER"><b>X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unable to get CRL issuer certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION"><b>X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unhandled critical extension.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_KEYUSAGE_NO_CRL_SIGN"><b>X509_V_ERR_KEYUSAGE_NO_CRL_SIGN</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Key usage does not include CRL signing.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION"><b>X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unhandled critical CRL extension.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_INVALID_NON_CA"><b>X509_V_ERR_INVALID_NON_CA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Invalid non-CA certificate has CA markings.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED"><b>X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Proxy path length constraint exceeded.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_PROXY_SUBJECT_INVALID"><b>X509_V_ERR_PROXY_SUBJECT_INVALID</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Proxy certificate subject is invalid. It MUST be the same as the issuer with a single CN component added.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE"><b>X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Key usage does not include digital signature.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED"><b>X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Proxy certificates not allowed, please use <b>-allow_proxy_certs</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_INVALID_EXTENSION"><b>X509_V_ERR_INVALID_EXTENSION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Invalid or inconsistent certificate extension.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_INVALID_POLICY_EXTENSION"><b>X509_V_ERR_INVALID_POLICY_EXTENSION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Invalid or inconsistent certificate policy extension.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_NO_EXPLICIT_POLICY"><b>X509_V_ERR_NO_EXPLICIT_POLICY</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>No explicit policy.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_DIFFERENT_CRL_SCOPE"><b>X509_V_ERR_DIFFERENT_CRL_SCOPE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Different CRL scope.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE"><b>X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unsupported extension feature.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNNESTED_RESOURCE"><b>X509_V_ERR_UNNESTED_RESOURCE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>RFC 3779 resource not subset of parent's resources.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_PERMITTED_VIOLATION"><b>X509_V_ERR_PERMITTED_VIOLATION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Permitted subtree violation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_EXCLUDED_VIOLATION"><b>X509_V_ERR_EXCLUDED_VIOLATION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Excluded subtree violation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUBTREE_MINMAX"><b>X509_V_ERR_SUBTREE_MINMAX</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Name constraints minimum and maximum not supported.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_APPLICATION_VERIFICATION"><b>X509_V_ERR_APPLICATION_VERIFICATION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Application verification failure. Unused.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE"><b>X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unsupported name constraint type.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX"><b>X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unsupported or invalid name constraint syntax.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_UNSUPPORTED_NAME_SYNTAX"><b>X509_V_ERR_UNSUPPORTED_NAME_SYNTAX</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Unsupported or invalid name syntax.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_CRL_PATH_VALIDATION_ERROR"><b>X509_V_ERR_CRL_PATH_VALIDATION_ERROR</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CRL path validation error.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_PATH_LOOP"><b>X509_V_ERR_PATH_LOOP</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Path loop.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUITE_B_INVALID_VERSION"><b>X509_V_ERR_SUITE_B_INVALID_VERSION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Suite B: certificate version invalid.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUITE_B_INVALID_ALGORITHM"><b>X509_V_ERR_SUITE_B_INVALID_ALGORITHM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Suite B: invalid public key algorithm.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUITE_B_INVALID_CURVE"><b>X509_V_ERR_SUITE_B_INVALID_CURVE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Suite B: invalid ECC curve.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM"><b>X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Suite B: invalid signature algorithm.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED"><b>X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Suite B: curve not allowed for this LOS.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256"><b>X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Suite B: cannot sign P-384 with P-256.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_HOSTNAME_MISMATCH"><b>X509_V_ERR_HOSTNAME_MISMATCH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Hostname mismatch.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_EMAIL_MISMATCH"><b>X509_V_ERR_EMAIL_MISMATCH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Email address mismatch.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_IP_ADDRESS_MISMATCH"><b>X509_V_ERR_IP_ADDRESS_MISMATCH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>IP address mismatch.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_DANE_NO_MATCH"><b>X509_V_ERR_DANE_NO_MATCH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>DANE TLSA authentication is enabled, but no TLSA records matched the certificate chain. This error is only possible in <a href="../man1/s_client.html">s_client(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_EE_KEY_TOO_SMALL"><b>X509_V_ERR_EE_KEY_TOO_SMALL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>EE certificate key too weak.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_ERR_CA_KEY_TOO_SMALL"><b>X509_ERR_CA_KEY_TOO_SMALL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CA certificate key too weak.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_ERR_CA_MD_TOO_WEAK"><b>X509_ERR_CA_MD_TOO_WEAK</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>CA signature digest algorithm too weak.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_INVALID_CALL"><b>X509_V_ERR_INVALID_CALL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>nvalid certificate verification context.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_STORE_LOOKUP"><b>X509_V_ERR_STORE_LOOKUP</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Issuer certificate lookup error.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_NO_VALID_SCTS"><b>X509_V_ERR_NO_VALID_SCTS</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Certificate Transparency required, but no valid SCTs found.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION"><b>X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Proxy subject name violation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_OCSP_VERIFY_NEEDED"><b>X509_V_ERR_OCSP_VERIFY_NEEDED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Returned by the verify callback to indicate an OCSP verification is needed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_OCSP_VERIFY_FAILED"><b>X509_V_ERR_OCSP_VERIFY_FAILED</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Returned by the verify callback to indicate OCSP verification failed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="X509_V_ERR_OCSP_CERT_UNKNOWN"><b>X509_V_ERR_OCSP_CERT_UNKNOWN</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Returned by the verify callback to indicate that the certificate is not recognized by the OCSP responder.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>Although the issuer checks are a considerable improvement over the old technique they still suffer from limitations in the underlying X509_LOOKUP API. One consequence of this is that trusted certificates with matching subject name must either appear in a file (as specified by the <b>-CAfile</b> option) or a directory (as specified by <b>-CApath</b>). If they occur in both then only the certificates in the file will be recognised.</p>
|
||||
|
||||
<p>Previous versions of OpenSSL assume certificates with matching subject name are identical and mishandled them.</p>
|
||||
|
||||
<p>Previous versions of this documentation swapped the meaning of the <b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT</b> and <b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY</b> error codes.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/x509.html">x509(1)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The <b>-show_chain</b> option was added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<p>The <b>-issuer_checks</b> option is deprecated as of OpenSSL 1.1.0 and is silently ignored.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
110
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/version.html
vendored
Normal file
110
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/version.html
vendored
Normal file
@ -0,0 +1,110 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>version</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-version, version - print OpenSSL version information</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl version</b> [<b>-help</b>] [<b>-a</b>] [<b>-v</b>] [<b>-b</b>] [<b>-o</b>] [<b>-f</b>] [<b>-p</b>] [<b>-d</b>] [<b>-e</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This command is used to print out version information about OpenSSL.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="a"><b>-a</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>All information, this is the same as setting all the other flags.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="v"><b>-v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The current OpenSSL version.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="b"><b>-b</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The date the current version of OpenSSL was built.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="o"><b>-o</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option information: various options set when the library was built.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="f"><b>-f</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Compilation flags.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="p"><b>-p</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Platform setting.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="d"><b>-d</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>OPENSSLDIR setting.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="e"><b>-e</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>ENGINESDIR setting.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The output of <b>openssl version -a</b> would typically be used when sending in a bug report.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
892
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/x509.html
vendored
Normal file
892
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man1/x509.html
vendored
Normal file
@ -0,0 +1,892 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>x509</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#OPTIONS">OPTIONS</a>
|
||||
<ul>
|
||||
<li><a href="#Input-Output-and-General-Purpose-Options">Input, Output, and General Purpose Options</a></li>
|
||||
<li><a href="#Display-Options">Display Options</a></li>
|
||||
<li><a href="#Trust-Settings">Trust Settings</a></li>
|
||||
<li><a href="#Signing-Options">Signing Options</a></li>
|
||||
<li><a href="#Name-Options">Name Options</a></li>
|
||||
<li><a href="#Text-Options">Text Options</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#CERTIFICATE-EXTENSIONS">CERTIFICATE EXTENSIONS</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>openssl-x509, x509 - Certificate display and signing utility</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<p><b>openssl</b> <b>x509</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-keyform DER|PEM|ENGINE</b>] [<b>-CAform DER|PEM</b>] [<b>-CAkeyform DER|PEM</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-serial</b>] [<b>-hash</b>] [<b>-subject_hash</b>] [<b>-issuer_hash</b>] [<b>-ocspid</b>] [<b>-subject</b>] [<b>-issuer</b>] [<b>-nameopt option</b>] [<b>-email</b>] [<b>-ocsp_uri</b>] [<b>-startdate</b>] [<b>-enddate</b>] [<b>-purpose</b>] [<b>-dates</b>] [<b>-checkend num</b>] [<b>-modulus</b>] [<b>-pubkey</b>] [<b>-fingerprint</b>] [<b>-alias</b>] [<b>-noout</b>] [<b>-trustout</b>] [<b>-clrtrust</b>] [<b>-clrreject</b>] [<b>-addtrust arg</b>] [<b>-addreject arg</b>] [<b>-setalias arg</b>] [<b>-days arg</b>] [<b>-set_serial n</b>] [<b>-signkey arg</b>] [<b>-passin arg</b>] [<b>-x509toreq</b>] [<b>-req</b>] [<b>-CA filename</b>] [<b>-CAkey filename</b>] [<b>-CAcreateserial</b>] [<b>-CAserial filename</b>] [<b>-force_pubkey key</b>] [<b>-text</b>] [<b>-ext extensions</b>] [<b>-certopt option</b>] [<b>-C</b>] [<b>-<i>digest</i></b>] [<b>-clrext</b>] [<b>-extfile filename</b>] [<b>-extensions section</b>] [<b>-sigopt nm:v</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>-preserve_dates</b>]</p>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>x509</b> command is a multi purpose certificate utility. It can be used to display certificate information, convert certificates to various forms, sign certificate requests like a "mini CA" or edit certificate trust settings.</p>
|
||||
|
||||
<p>Since there are a large number of options they will split up into various sections.</p>
|
||||
|
||||
<h1 id="OPTIONS">OPTIONS</h1>
|
||||
|
||||
<h2 id="Input-Output-and-General-Purpose-Options">Input, Output, and General Purpose Options</h2>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="help"><b>-help</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print out a usage message.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input format normally the command will expect an X509 certificate but this can change if other options such as <b>-req</b> are present. The DER format is the DER encoding of the certificate and PEM is the base64 encoding of the DER encoding with header and footer lines added. The default format is PEM.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="in-filename"><b>-in filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the input filename to read a certificate from or standard input if this option is not specified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="out-filename"><b>-out filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the output filename to write to or standard output by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="digest"><b>-<i>digest</i></b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The digest to use. This affects any signing or display option that uses a message digest, such as the <b>-fingerprint</b>, <b>-signkey</b> and <b>-CA</b> options. Any digest supported by the OpenSSL <b>dgst</b> command can be used. If not specified then SHA1 is used with <b>-fingerprint</b> or the default digest for the signing algorithm is used, typically SHA256.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="rand-file"><b>-rand file...</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
|
||||
<dd>
|
||||
|
||||
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="engine-id"><b>-engine id</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>x509</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="preserve_dates"><b>-preserve_dates</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When signing a certificate, preserve the "notBefore" and "notAfter" dates instead of adjusting them to current time and duration. Cannot be used with the <b>-days</b> option.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Display-Options">Display Options</h2>
|
||||
|
||||
<p>Note: the <b>-alias</b> and <b>-purpose</b> options are also display options but are described in the <b>TRUST SETTINGS</b> section.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="text"><b>-text</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the certificate in text form. Full details are output including the public key, signature algorithms, issuer and subject names, serial number any extensions present and any trust settings.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ext-extensions"><b>-ext extensions</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the certificate extensions in text form. Extensions are specified with a comma separated string, e.g., "subjectAltName,subjectKeyIdentifier". See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for the extension names.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="certopt-option"><b>-certopt option</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Customise the output format used with <b>-text</b>. The <b>option</b> argument can be a single option or multiple options separated by commas. The <b>-certopt</b> switch may be also be used more than once to set multiple options. See the <b>TEXT OPTIONS</b> section for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="noout"><b>-noout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prevents output of the encoded version of the certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="pubkey"><b>-pubkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the certificate's SubjectPublicKeyInfo block in PEM format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="modulus"><b>-modulus</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option prints out the value of the modulus of the public key contained in the certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="serial"><b>-serial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the certificate serial number.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="subject_hash"><b>-subject_hash</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the "hash" of the certificate subject name. This is used in OpenSSL to form an index to allow certificates in a directory to be looked up by subject name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="issuer_hash"><b>-issuer_hash</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the "hash" of the certificate issuer name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ocspid"><b>-ocspid</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the OCSP hash values for the subject name and public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="hash"><b>-hash</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Synonym for "-subject_hash" for backward compatibility reasons.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="subject_hash_old"><b>-subject_hash_old</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the "hash" of the certificate subject name using the older algorithm as used by OpenSSL before version 1.0.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="issuer_hash_old"><b>-issuer_hash_old</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the "hash" of the certificate issuer name using the older algorithm as used by OpenSSL before version 1.0.0.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="subject"><b>-subject</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the subject name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="issuer"><b>-issuer</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the issuer name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nameopt-option"><b>-nameopt option</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <b>NAME OPTIONS</b> section for more information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="email"><b>-email</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the email address(es) if any.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ocsp_uri"><b>-ocsp_uri</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the OCSP responder address(es) if any.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="startdate"><b>-startdate</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the start date of the certificate, that is the notBefore date.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="enddate"><b>-enddate</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the expiry date of the certificate, that is the notAfter date.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dates"><b>-dates</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Prints out the start and expiry dates of a certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="checkend-arg"><b>-checkend arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Checks if the certificate expires within the next <b>arg</b> seconds and exits non-zero if yes it will expire or zero if not.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="fingerprint"><b>-fingerprint</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Calculates and outputs the digest of the DER encoded version of the entire certificate (see digest options). This is commonly called a "fingerprint". Because of the nature of message digests, the fingerprint of a certificate is unique to that certificate and two certificates with the same fingerprint can be considered to be the same.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="C"><b>-C</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This outputs the certificate in the form of a C source file.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Trust-Settings">Trust Settings</h2>
|
||||
|
||||
<p>A <b>trusted certificate</b> is an ordinary certificate which has several additional pieces of information attached to it such as the permitted and prohibited uses of the certificate and an "alias".</p>
|
||||
|
||||
<p>Normally when a certificate is being verified at least one certificate must be "trusted". By default a trusted certificate must be stored locally and must be a root CA: any certificate chain ending in this CA is then usable for any purpose.</p>
|
||||
|
||||
<p>Trust settings currently are only used with a root CA. They allow a finer control over the purposes the root CA can be used for. For example a CA may be trusted for SSL client but not SSL server use.</p>
|
||||
|
||||
<p>See the description of the <b>verify</b> utility for more information on the meaning of trust settings.</p>
|
||||
|
||||
<p>Future versions of OpenSSL will recognize trust settings on any certificate: not just root CAs.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="trustout"><b>-trustout</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This causes <b>x509</b> to output a <b>trusted</b> certificate. An ordinary or trusted certificate can be input but by default an ordinary certificate is output and any trust settings are discarded. With the <b>-trustout</b> option a trusted certificate is output. A trusted certificate is automatically output if any trust settings are modified.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="setalias-arg"><b>-setalias arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the alias of the certificate. This will allow the certificate to be referred to using a nickname for example "Steve's Certificate".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="alias"><b>-alias</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Outputs the certificate alias, if any.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="clrtrust"><b>-clrtrust</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Clears all the permitted or trusted uses of the certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="clrreject"><b>-clrreject</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Clears all the prohibited or rejected uses of the certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="addtrust-arg"><b>-addtrust arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Adds a trusted certificate use. Any object name can be used here but currently only <b>clientAuth</b> (SSL client use), <b>serverAuth</b> (SSL server use), <b>emailProtection</b> (S/MIME email) and <b>anyExtendedKeyUsage</b> are used. As of OpenSSL 1.1.0, the last of these blocks all purposes when rejected or enables all purposes when trusted. Other OpenSSL applications may define additional uses.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="addreject-arg"><b>-addreject arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Adds a prohibited use. It accepts the same values as the <b>-addtrust</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="purpose"><b>-purpose</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option performs tests on the certificate extensions and outputs the results. For a more complete description see the <b>CERTIFICATE EXTENSIONS</b> section.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Signing-Options">Signing Options</h2>
|
||||
|
||||
<p>The <b>x509</b> utility can be used to sign certificates and requests: it can thus behave like a "mini CA".</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="signkey-arg"><b>-signkey arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option causes the input file to be self signed using the supplied private key or engine. The private key's format is specified with the <b>-keyform</b> option.</p>
|
||||
|
||||
<p>If the input file is a certificate it sets the issuer name to the subject name (i.e. makes it self signed) changes the public key to the supplied value and changes the start and end dates. The start date is set to the current time and the end date is set to a value determined by the <b>-days</b> option. Any certificate extensions are retained unless the <b>-clrext</b> option is supplied; this includes, for example, any existing key identifier extensions.</p>
|
||||
|
||||
<p>If the input is a certificate request then a self signed certificate is created using the supplied private key using the subject name in the request.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="passin-arg"><b>-passin arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The key password source. For more information about the format of <b>arg</b> see the <b>PASS PHRASE ARGUMENTS</b> section in <a href="../man1/openssl.html">openssl(1)</a>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="clrext"><b>-clrext</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Delete any extensions from a certificate. This option is used when a certificate is being created from another certificate (for example with the <b>-signkey</b> or the <b>-CA</b> options). Normally all extensions are retained.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the format (DER or PEM) of the private key file used in the <b>-signkey</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="days-arg"><b>-days arg</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the number of days to make a certificate valid for. The default is 30 days. Cannot be used with the <b>-preserve_dates</b> option.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="x509toreq"><b>-x509toreq</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Converts a certificate into a certificate request. The <b>-signkey</b> option is used to pass the required private key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="req"><b>-req</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>By default a certificate is expected on input. With this option a certificate request is expected instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="set_serial-n"><b>-set_serial n</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the serial number to use. This option can be used with either the <b>-signkey</b> or <b>-CA</b> options. If used in conjunction with the <b>-CA</b> option the serial number file (as specified by the <b>-CAserial</b> or <b>-CAcreateserial</b> options) is not used.</p>
|
||||
|
||||
<p>The serial number can be decimal or hex (if preceded by <b>0x</b>).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CA-filename"><b>-CA filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Specifies the CA certificate to be used for signing. When this option is present <b>x509</b> behaves like a "mini CA". The input file is signed by this CA using this option: that is its issuer name is set to the subject name of the CA and it is digitally signed using the CAs private key.</p>
|
||||
|
||||
<p>This option is normally combined with the <b>-req</b> option. Without the <b>-req</b> option the input is a certificate which must be self signed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAkey-filename"><b>-CAkey filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the CA private key to sign a certificate with. If this option is not specified then it is assumed that the CA private key is present in the CA certificate file.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAserial-filename"><b>-CAserial filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the CA serial number file to use.</p>
|
||||
|
||||
<p>When the <b>-CA</b> option is used to sign a certificate it uses a serial number specified in a file. This file consists of one line containing an even number of hex digits with the serial number to use. After each use the serial number is incremented and written out to the file again.</p>
|
||||
|
||||
<p>The default filename consists of the CA certificate file base name with ".srl" appended. For example if the CA certificate file is called "mycacert.pem" it expects to find a serial number file called "mycacert.srl".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CAcreateserial"><b>-CAcreateserial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>With this option the CA serial number file is created if it does not exist: it will contain the serial number "02" and the certificate being signed will have the 1 as its serial number. If the <b>-CA</b> option is specified and the serial number file does not exist a random number is generated; this is the recommended practice.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="extfile-filename"><b>-extfile filename</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>File containing certificate extensions to use. If not specified then no extensions are added to the certificate.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="extensions-section"><b>-extensions section</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The section to add certificate extensions from. If this option is not specified then the extensions should either be contained in the unnamed (default) section or the default section should contain a variable called "extensions" which contains the section to use. See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="force_pubkey-key"><b>-force_pubkey key</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When a certificate is created set its public key to <b>key</b> instead of the key in the certificate or certificate request. This option is useful for creating certificates where the algorithm can't normally sign requests, for example DH.</p>
|
||||
|
||||
<p>The format or <b>key</b> can be specified using the <b>-keyform</b> option.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Name-Options">Name Options</h2>
|
||||
|
||||
<p>The <b>nameopt</b> command line switch determines how the subject and issuer names are displayed. If no <b>nameopt</b> switch is present the default "oneline" format is used which is compatible with previous versions of OpenSSL. Each option is described in detail below, all options can be preceded by a <b>-</b> to turn the option off. Only the first four will normally be used.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="compat"><b>compat</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the old format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="RFC2253"><b>RFC2253</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Displays names compatible with RFC2253 equivalent to <b>esc_2253</b>, <b>esc_ctrl</b>, <b>esc_msb</b>, <b>utf8</b>, <b>dump_nostr</b>, <b>dump_unknown</b>, <b>dump_der</b>, <b>sep_comma_plus</b>, <b>dn_rev</b> and <b>sname</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oneline"><b>oneline</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A oneline format which is more readable than RFC2253. It is equivalent to specifying the <b>esc_2253</b>, <b>esc_ctrl</b>, <b>esc_msb</b>, <b>utf8</b>, <b>dump_nostr</b>, <b>dump_der</b>, <b>use_quote</b>, <b>sep_comma_plus_space</b>, <b>space_eq</b> and <b>sname</b> options. This is the <i>default</i> of no name options are given explicitly.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="multiline"><b>multiline</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>A multiline format. It is equivalent <b>esc_ctrl</b>, <b>esc_msb</b>, <b>sep_multiline</b>, <b>space_eq</b>, <b>lname</b> and <b>align</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="esc_2253"><b>esc_2253</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Escape the "special" characters required by RFC2253 in a field. That is <b>,+"<>;</b>. Additionally <b>#</b> is escaped at the beginning of a string and a space character at the beginning or end of a string.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="esc_2254"><b>esc_2254</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Escape the "special" characters required by RFC2254 in a field. That is the <b>NUL</b> character as well as and <b>()*</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="esc_ctrl"><b>esc_ctrl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Escape control characters. That is those with ASCII values less than 0x20 (space) and the delete (0x7f) character. They are escaped using the RFC2253 \XX notation (where XX are two hex digits representing the character value).</p>
|
||||
|
||||
</dd>
|
||||
<dt id="esc_msb"><b>esc_msb</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Escape characters with the MSB set, that is with ASCII values larger than 127.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="use_quote"><b>use_quote</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Escapes some characters by surrounding the whole string with <b>"</b> characters, without the option all escaping is done with the <b>\</b> character.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="utf8"><b>utf8</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Convert all strings to UTF8 format first. This is required by RFC2253. If you are lucky enough to have a UTF8 compatible terminal then the use of this option (and <b>not</b> setting <b>esc_msb</b>) may result in the correct display of multibyte (international) characters. Is this option is not present then multibyte characters larger than 0xff will be represented using the format \UXXXX for 16 bits and \WXXXXXXXX for 32 bits. Also if this option is off any UTF8Strings will be converted to their character form first.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ignore_type"><b>ignore_type</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This option does not attempt to interpret multibyte characters in any way. That is their content octets are merely dumped as though one octet represents each character. This is useful for diagnostic purposes but will result in rather odd looking output.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="show_type"><b>show_type</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Show the type of the ASN1 character string. The type precedes the field contents. For example "BMPSTRING: Hello World".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dump_der"><b>dump_der</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>When this option is set any fields that need to be hexdumped will be dumped using the DER encoding of the field. Otherwise just the content octets will be displayed. Both options use the RFC2253 <b>#XXXX...</b> format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dump_nostr"><b>dump_nostr</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Dump non character string types (for example OCTET STRING) if this option is not set then non character string types will be displayed as though each content octet represents a single character.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dump_all"><b>dump_all</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Dump all fields. This option when used with <b>dump_der</b> allows the DER encoding of the structure to be unambiguously determined.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dump_unknown"><b>dump_unknown</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Dump any field whose OID is not recognised by OpenSSL.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="sep_comma_plus-sep_comma_plus_space-sep_semi_plus_space-sep_multiline"><b>sep_comma_plus</b>, <b>sep_comma_plus_space</b>, <b>sep_semi_plus_space</b>, <b>sep_multiline</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options determine the field separators. The first character is between RDNs and the second between multiple AVAs (multiple AVAs are very rare and their use is discouraged). The options ending in "space" additionally place a space after the separator to make it more readable. The <b>sep_multiline</b> uses a linefeed character for the RDN separator and a spaced <b>+</b> for the AVA separator. It also indents the fields by four characters. If no field separator is specified then <b>sep_comma_plus_space</b> is used by default.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="dn_rev"><b>dn_rev</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Reverse the fields of the DN. This is required by RFC2253. As a side effect this also reverses the order of multiple AVAs but this is permissible.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="nofname-sname-lname-oid"><b>nofname</b>, <b>sname</b>, <b>lname</b>, <b>oid</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These options alter how the field name is displayed. <b>nofname</b> does not display the field at all. <b>sname</b> uses the "short name" form (CN for commonName for example). <b>lname</b> uses the long form. <b>oid</b> represents the OID in numerical form and is useful for diagnostic purpose.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="align"><b>align</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Align field values for a more readable output. Only usable with <b>sep_multiline</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="space_eq"><b>space_eq</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Places spaces round the <b>=</b> character which follows the field name.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Text-Options">Text Options</h2>
|
||||
|
||||
<p>As well as customising the name output format, it is also possible to customise the actual fields printed using the <b>certopt</b> options when the <b>text</b> option is present. The default behaviour is to print all fields.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="compatible"><b>compatible</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Use the old format. This is equivalent to specifying no output options at all.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_header"><b>no_header</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print header information: that is the lines saying "Certificate" and "Data".</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_version"><b>no_version</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out the version number.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_serial"><b>no_serial</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out the serial number.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_signame"><b>no_signame</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out the signature algorithm used.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_validity"><b>no_validity</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print the validity, that is the <b>notBefore</b> and <b>notAfter</b> fields.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_subject"><b>no_subject</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out the subject name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_issuer"><b>no_issuer</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out the issuer name.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_pubkey"><b>no_pubkey</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out the public key.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_sigdump"><b>no_sigdump</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't give a hexadecimal dump of the certificate signature.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_aux"><b>no_aux</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out certificate trust information.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="no_extensions"><b>no_extensions</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Don't print out any X509V3 extensions.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ext_default"><b>ext_default</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Retain default extension behaviour: attempt to print out unsupported certificate extensions.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ext_error"><b>ext_error</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Print an error message for unsupported certificate extensions.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ext_parse"><b>ext_parse</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>ASN1 parse unsupported extensions.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ext_dump"><b>ext_dump</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Hex dump unsupported extensions.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ca_default"><b>ca_default</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The value used by the <b>ca</b> utility, equivalent to <b>no_issuer</b>, <b>no_pubkey</b>, <b>no_header</b>, and <b>no_version</b>.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Note: in these examples the '\' means the example should be all on one line.</p>
|
||||
|
||||
<p>Display the contents of a certificate:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -noout -text</code></pre>
|
||||
|
||||
<p>Display the "Subject Alternative Name" extension of a certificate:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -noout -ext subjectAltName</code></pre>
|
||||
|
||||
<p>Display more extensions of a certificate:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType</code></pre>
|
||||
|
||||
<p>Display the certificate serial number:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -noout -serial</code></pre>
|
||||
|
||||
<p>Display the certificate subject name:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -noout -subject</code></pre>
|
||||
|
||||
<p>Display the certificate subject name in RFC2253 form:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -noout -subject -nameopt RFC2253</code></pre>
|
||||
|
||||
<p>Display the certificate subject name in oneline form on a terminal supporting UTF8:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb</code></pre>
|
||||
|
||||
<p>Display the certificate SHA1 fingerprint:</p>
|
||||
|
||||
<pre><code>openssl x509 -sha1 -in cert.pem -noout -fingerprint</code></pre>
|
||||
|
||||
<p>Convert a certificate from PEM to DER format:</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER</code></pre>
|
||||
|
||||
<p>Convert a certificate to a certificate request:</p>
|
||||
|
||||
<pre><code>openssl x509 -x509toreq -in cert.pem -out req.pem -signkey key.pem</code></pre>
|
||||
|
||||
<p>Convert a certificate request into a self signed certificate using extensions for a CA:</p>
|
||||
|
||||
<pre><code>openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca \
|
||||
-signkey key.pem -out cacert.pem</code></pre>
|
||||
|
||||
<p>Sign a certificate request using the CA certificate above and add user certificate extensions:</p>
|
||||
|
||||
<pre><code>openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr \
|
||||
-CA cacert.pem -CAkey key.pem -CAcreateserial</code></pre>
|
||||
|
||||
<p>Set a certificate to be trusted for SSL client use and change set its alias to "Steve's Class 1 CA"</p>
|
||||
|
||||
<pre><code>openssl x509 -in cert.pem -addtrust clientAuth \
|
||||
-setalias "Steve's Class 1 CA" -out trust.pem</code></pre>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The PEM format uses the header and footer lines:</p>
|
||||
|
||||
<pre><code>-----BEGIN CERTIFICATE-----
|
||||
-----END CERTIFICATE-----</code></pre>
|
||||
|
||||
<p>it will also handle files containing:</p>
|
||||
|
||||
<pre><code>-----BEGIN X509 CERTIFICATE-----
|
||||
-----END X509 CERTIFICATE-----</code></pre>
|
||||
|
||||
<p>Trusted certificates have the lines</p>
|
||||
|
||||
<pre><code>-----BEGIN TRUSTED CERTIFICATE-----
|
||||
-----END TRUSTED CERTIFICATE-----</code></pre>
|
||||
|
||||
<p>The conversion to UTF8 format used with the name options assumes that T61Strings use the ISO8859-1 character set. This is wrong but Netscape and MSIE do this as do many certificates. So although this is incorrect it is more likely to display the majority of certificates correctly.</p>
|
||||
|
||||
<p>The <b>-email</b> option searches the subject name and the subject alternative name extension. Only unique email addresses will be printed out: it will not print the same address more than once.</p>
|
||||
|
||||
<h1 id="CERTIFICATE-EXTENSIONS">CERTIFICATE EXTENSIONS</h1>
|
||||
|
||||
<p>The <b>-purpose</b> option checks the certificate extensions and determines what the certificate can be used for. The actual checks done are rather complex and include various hacks and workarounds to handle broken certificates and software.</p>
|
||||
|
||||
<p>The same code is used when verifying untrusted certificates in chains so this section is useful if a chain is rejected by the verify code.</p>
|
||||
|
||||
<p>The basicConstraints extension CA flag is used to determine whether the certificate can be used as a CA. If the CA flag is true then it is a CA, if the CA flag is false then it is not a CA. <b>All</b> CAs should have the CA flag set to true.</p>
|
||||
|
||||
<p>If the basicConstraints extension is absent then the certificate is considered to be a "possible CA" other extensions are checked according to the intended use of the certificate. A warning is given in this case because the certificate should really not be regarded as a CA: however it is allowed to be a CA to work around some broken software.</p>
|
||||
|
||||
<p>If the certificate is a V1 certificate (and thus has no extensions) and it is self signed it is also assumed to be a CA but a warning is again given: this is to work around the problem of Verisign roots which are V1 self signed certificates.</p>
|
||||
|
||||
<p>If the keyUsage extension is present then additional restraints are made on the uses of the certificate. A CA certificate <b>must</b> have the keyCertSign bit set if the keyUsage extension is present.</p>
|
||||
|
||||
<p>The extended key usage extension places additional restrictions on the certificate uses. If this extension is present (whether critical or not) the key can only be used for the purposes specified.</p>
|
||||
|
||||
<p>A complete description of each test is given below. The comments about basicConstraints and keyUsage and V1 certificates above apply to <b>all</b> CA certificates.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="SSL-Client"><b>SSL Client</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The extended key usage extension must be absent or include the "web client authentication" OID. keyUsage must be absent or it must have the digitalSignature bit set. Netscape certificate type must be absent or it must have the SSL client bit set.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SSL-Client-CA"><b>SSL Client CA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The extended key usage extension must be absent or include the "web client authentication" OID. Netscape certificate type must be absent or it must have the SSL CA bit set: this is used as a work around if the basicConstraints extension is absent.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SSL-Server"><b>SSL Server</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. keyUsage must be absent or it must have the digitalSignature, the keyEncipherment set or both bits set. Netscape certificate type must be absent or have the SSL server bit set.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SSL-Server-CA"><b>SSL Server CA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. Netscape certificate type must be absent or the SSL CA bit must be set: this is used as a work around if the basicConstraints extension is absent.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Netscape-SSL-Server"><b>Netscape SSL Server</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>For Netscape SSL clients to connect to an SSL server it must have the keyEncipherment bit set if the keyUsage extension is present. This isn't always valid because some cipher suites use the key for digital signing. Otherwise it is the same as a normal SSL server.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="Common-S-MIME-Client-Tests"><b>Common S/MIME Client Tests</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The extended key usage extension must be absent or include the "email protection" OID. Netscape certificate type must be absent or should have the S/MIME bit set. If the S/MIME bit is not set in Netscape certificate type then the SSL client bit is tolerated as an alternative but a warning is shown: this is because some Verisign certificates don't set the S/MIME bit.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="S-MIME-Signing"><b>S/MIME Signing</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>In addition to the common S/MIME client tests the digitalSignature bit or the nonRepudiation bit must be set if the keyUsage extension is present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="S-MIME-Encryption"><b>S/MIME Encryption</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>In addition to the common S/MIME tests the keyEncipherment bit must be set if the keyUsage extension is present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="S-MIME-CA"><b>S/MIME CA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The extended key usage extension must be absent or include the "email protection" OID. Netscape certificate type must be absent or must have the S/MIME CA bit set: this is used as a work around if the basicConstraints extension is absent.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CRL-Signing"><b>CRL Signing</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The keyUsage extension must be absent or it must have the CRL signing bit set.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="CRL-Signing-CA"><b>CRL Signing CA</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The normal CA tests apply. Except in this case the basicConstraints extension must be present.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>Extensions in certificates are not transferred to certificate requests and vice versa.</p>
|
||||
|
||||
<p>It is possible to produce invalid certificates or requests by specifying the wrong private key or using inconsistent options in some cases: these should be checked.</p>
|
||||
|
||||
<p>There should be options to explicitly set such things as start and end dates rather than an offset from the current time.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man1/req.html">req(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/verify.html">verify(1)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The hash algorithm used in the <b>-subject_hash</b> and <b>-issuer_hash</b> options before OpenSSL 1.0.0 was based on the deprecated MD5 algorithm and the encoding of the distinguished name. In OpenSSL 1.0.0 and later it is based on a canonical version of the DN using SHA1. This means that any directories using the old form must have their links rebuilt using <b>c_rehash</b> or similar.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
120
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ADMISSIONS.html
vendored
Normal file
120
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ADMISSIONS.html
vendored
Normal file
@ -0,0 +1,120 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ADMISSIONS</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ADMISSIONS, ADMISSIONS_get0_admissionAuthority, ADMISSIONS_get0_namingAuthority, ADMISSIONS_get0_professionInfos, ADMISSIONS_set0_admissionAuthority, ADMISSIONS_set0_namingAuthority, ADMISSIONS_set0_professionInfos, ADMISSION_SYNTAX, ADMISSION_SYNTAX_get0_admissionAuthority, ADMISSION_SYNTAX_get0_contentsOfAdmissions, ADMISSION_SYNTAX_set0_admissionAuthority, ADMISSION_SYNTAX_set0_contentsOfAdmissions, NAMING_AUTHORITY, NAMING_AUTHORITY_get0_authorityId, NAMING_AUTHORITY_get0_authorityURL, NAMING_AUTHORITY_get0_authorityText, NAMING_AUTHORITY_set0_authorityId, NAMING_AUTHORITY_set0_authorityURL, NAMING_AUTHORITY_set0_authorityText, PROFESSION_INFO, PROFESSION_INFOS, PROFESSION_INFO_get0_addProfessionInfo, PROFESSION_INFO_get0_namingAuthority, PROFESSION_INFO_get0_professionItems, PROFESSION_INFO_get0_professionOIDs, PROFESSION_INFO_get0_registrationNumber, PROFESSION_INFO_set0_addProfessionInfo, PROFESSION_INFO_set0_namingAuthority, PROFESSION_INFO_set0_professionItems, PROFESSION_INFO_set0_professionOIDs, PROFESSION_INFO_set0_registrationNumber - Accessors and settors for ADMISSION_SYNTAX</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>typedef struct NamingAuthority_st NAMING_AUTHORITY;
|
||||
typedef struct ProfessionInfo_st PROFESSION_INFO;
|
||||
typedef STACK_OF(PROFESSION_INFO) PROFESSION_INFOS;
|
||||
typedef struct Admissions_st ADMISSIONS;
|
||||
typedef struct AdmissionSyntax_st ADMISSION_SYNTAX;
|
||||
|
||||
const ASN1_OBJECT *NAMING_AUTHORITY_get0_authorityId(
|
||||
const NAMING_AUTHORITY *n);
|
||||
void NAMING_AUTHORITY_set0_authorityId(NAMING_AUTHORITY *n,
|
||||
ASN1_OBJECT* namingAuthorityId);
|
||||
const ASN1_IA5STRING *NAMING_AUTHORITY_get0_authorityURL(
|
||||
const NAMING_AUTHORITY *n);
|
||||
void NAMING_AUTHORITY_set0_authorityURL(NAMING_AUTHORITY *n,
|
||||
ASN1_IA5STRING* namingAuthorityUrl);
|
||||
const ASN1_STRING *NAMING_AUTHORITY_get0_authorityText(
|
||||
const NAMING_AUTHORITY *n);
|
||||
void NAMING_AUTHORITY_set0_authorityText(NAMING_AUTHORITY *n,
|
||||
ASN1_STRING* namingAuthorityText);
|
||||
|
||||
const GENERAL_NAME *ADMISSION_SYNTAX_get0_admissionAuthority(
|
||||
const ADMISSION_SYNTAX *as);
|
||||
void ADMISSION_SYNTAX_set0_admissionAuthority(
|
||||
ADMISSION_SYNTAX *as, GENERAL_NAME *aa);
|
||||
const STACK_OF(ADMISSIONS) *ADMISSION_SYNTAX_get0_contentsOfAdmissions(
|
||||
const ADMISSION_SYNTAX *as);
|
||||
void ADMISSION_SYNTAX_set0_contentsOfAdmissions(
|
||||
ADMISSION_SYNTAX *as, STACK_OF(ADMISSIONS) *a);
|
||||
|
||||
const GENERAL_NAME *ADMISSIONS_get0_admissionAuthority(const ADMISSIONS *a);
|
||||
void ADMISSIONS_set0_admissionAuthority(ADMISSIONS *a, GENERAL_NAME *aa);
|
||||
const NAMING_AUTHORITY *ADMISSIONS_get0_namingAuthority(const ADMISSIONS *a);
|
||||
void ADMISSIONS_set0_namingAuthority(ADMISSIONS *a, NAMING_AUTHORITY *na);
|
||||
const PROFESSION_INFOS *ADMISSIONS_get0_professionInfos(const ADMISSIONS *a);
|
||||
void ADMISSIONS_set0_professionInfos(ADMISSIONS *a, PROFESSION_INFOS *pi);
|
||||
|
||||
const ASN1_OCTET_STRING *PROFESSION_INFO_get0_addProfessionInfo(
|
||||
const PROFESSION_INFO *pi);
|
||||
void PROFESSION_INFO_set0_addProfessionInfo(
|
||||
PROFESSION_INFO *pi, ASN1_OCTET_STRING *aos);
|
||||
const NAMING_AUTHORITY *PROFESSION_INFO_get0_namingAuthority(
|
||||
const PROFESSION_INFO *pi);
|
||||
void PROFESSION_INFO_set0_namingAuthority(
|
||||
PROFESSION_INFO *pi, NAMING_AUTHORITY *na);
|
||||
const STACK_OF(ASN1_STRING) *PROFESSION_INFO_get0_professionItems(
|
||||
const PROFESSION_INFO *pi);
|
||||
void PROFESSION_INFO_set0_professionItems(
|
||||
PROFESSION_INFO *pi, STACK_OF(ASN1_STRING) *as);
|
||||
const STACK_OF(ASN1_OBJECT) *PROFESSION_INFO_get0_professionOIDs(
|
||||
const PROFESSION_INFO *pi);
|
||||
void PROFESSION_INFO_set0_professionOIDs(
|
||||
PROFESSION_INFO *pi, STACK_OF(ASN1_OBJECT) *po);
|
||||
const ASN1_PRINTABLESTRING *PROFESSION_INFO_get0_registrationNumber(
|
||||
const PROFESSION_INFO *pi);
|
||||
void PROFESSION_INFO_set0_registrationNumber(
|
||||
PROFESSION_INFO *pi, ASN1_PRINTABLESTRING *rn);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>PROFESSION_INFOS</b>, <b>ADMISSION_SYNTAX</b>, <b>ADMISSIONS</b>, and <b>PROFESSION_INFO</b> types are opaque structures representing the analogous types defined in the Common PKI Specification published by <a href="https://www.t7ev.org">https://www.t7ev.org</a>. Knowledge of those structures and their semantics is assumed.</p>
|
||||
|
||||
<p>The conventional routines to convert between DER and the local format are described in <a href="../man3/d2i_X509.html">d2i_X509(3)</a>. The conventional routines to allocate and free the types are defined in <a href="../man3/X509_dup.html">X509_dup(3)</a>.</p>
|
||||
|
||||
<p>The <b>PROFESSION_INFOS</b> type is a stack of <b>PROFESSION_INFO</b>; see <a href="../man3/DEFINE_STACK_OF.html">DEFINE_STACK_OF(3)</a> for details.</p>
|
||||
|
||||
<p>The <b>NAMING_AUTHORITY</b> type has an authority ID and URL, and text fields. The NAMING_AUTHORITY_get0_authorityId(), NAMING_AUTHORITY_get0_get0_authorityURL(), and NAMING_AUTHORITY_get0_get0_authorityText(), functions return pointers to those values within the object. The NAMING_AUTHORITY_set0_authorityId(), NAMING_AUTHORITY_set0_get0_authorityURL(), and NAMING_AUTHORITY_set0_get0_authorityText(), functions free any existing value and set the pointer to the specified value.</p>
|
||||
|
||||
<p>The <b>ADMISSION_SYNTAX</b> type has an authority name and a stack of <b>ADMISSION</b> objects. The ADMISSION_SYNTAX_get0_admissionAuthority() and ADMISSION_SYNTAX_get0_contentsOfAdmissions() functions return pointers to those values within the object. The ADMISSION_SYNTAX_set0_admissionAuthority() and ADMISSION_SYNTAX_set0_contentsOfAdmissions() functions free any existing value and set the pointer to the specified value.</p>
|
||||
|
||||
<p>The <b>ADMISSION</b> type has an authority name, authority object, and a stack of <b>PROFESSION_INFO</b> items. The ADMISSIONS_get0_admissionAuthority(), ADMISSIONS_get0_namingAuthority(), and ADMISSIONS_get0_professionInfos() functions return pointers to those values within the object. The ADMISSIONS_set0_admissionAuthority(), ADMISSIONS_set0_namingAuthority(), and ADMISSIONS_set0_professionInfos() functions free any existing value and set the pointer to the specified value.</p>
|
||||
|
||||
<p>The <b>PROFESSION_INFO</b> type has a name authority, stacks of profession Items and OIDs, a registration number, and additional profession info. The functions PROFESSION_INFO_get0_addProfessionInfo(), PROFESSION_INFO_get0_namingAuthority(), PROFESSION_INFO_get0_professionItems(), PROFESSION_INFO_get0_professionOIDs(), and PROFESSION_INFO_get0_registrationNumber() functions return pointers to those values within the object. The PROFESSION_INFO_set0_addProfessionInfo(), PROFESSION_INFO_set0_namingAuthority(), PROFESSION_INFO_set0_professionItems(), PROFESSION_INFO_set0_professionOIDs(), and PROFESSION_INFO_set0_registrationNumber() functions free any existing value and set the pointer to the specified value.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>Described above. Note that all of the <i>get0</i> functions return a pointer to the internal data structure and must not be freed.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/X509_dup.html">X509_dup(3)</a>, <a href="../man3/d2i_X509.html">d2i_X509(3)</a>,</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
116
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_INTEGER_get_int64.html
vendored
Normal file
116
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_INTEGER_get_int64.html
vendored
Normal file
@ -0,0 +1,116 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_INTEGER_get_int64</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_INTEGER_get_uint64, ASN1_INTEGER_set_uint64, ASN1_INTEGER_get_int64, ASN1_INTEGER_get, ASN1_INTEGER_set_int64, ASN1_INTEGER_set, BN_to_ASN1_INTEGER, ASN1_INTEGER_to_BN, ASN1_ENUMERATED_get_int64, ASN1_ENUMERATED_get, ASN1_ENUMERATED_set_int64, ASN1_ENUMERATED_set, BN_to_ASN1_ENUMERATED, ASN1_ENUMERATED_to_BN - ASN.1 INTEGER and ENUMERATED utilities</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
int ASN1_INTEGER_get_int64(int64_t *pr, const ASN1_INTEGER *a);
|
||||
long ASN1_INTEGER_get(const ASN1_INTEGER *a);
|
||||
|
||||
int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r);
|
||||
int ASN1_INTEGER_set(const ASN1_INTEGER *a, long v);
|
||||
|
||||
int ASN1_INTEGER_get_uint64(uint64_t *pr, const ASN1_INTEGER *a);
|
||||
int ASN1_INTEGER_set_uint64(ASN1_INTEGER *a, uint64_t r);
|
||||
|
||||
ASN1_INTEGER *BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai);
|
||||
BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn);
|
||||
|
||||
int ASN1_ENUMERATED_get_int64(int64_t *pr, const ASN1_ENUMERATED *a);
|
||||
long ASN1_ENUMERATED_get(const ASN1_ENUMERATED *a);
|
||||
|
||||
int ASN1_ENUMERATED_set_int64(ASN1_ENUMERATED *a, int64_t r);
|
||||
int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v);
|
||||
|
||||
ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai);
|
||||
BIGNUM *ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai, BIGNUM *bn);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions convert to and from <b>ASN1_INTEGER</b> and <b>ASN1_ENUMERATED</b> structures.</p>
|
||||
|
||||
<p>ASN1_INTEGER_get_int64() converts an <b>ASN1_INTEGER</b> into an <b>int64_t</b> type If successful it returns 1 and sets <b>*pr</b> to the value of <b>a</b>. If it fails (due to invalid type or the value being too big to fit into an <b>int64_t</b> type) it returns 0.</p>
|
||||
|
||||
<p>ASN1_INTEGER_get_uint64() is similar to ASN1_INTEGER_get_int64_t() except it converts to a <b>uint64_t</b> type and an error is returned if the passed integer is negative.</p>
|
||||
|
||||
<p>ASN1_INTEGER_get() also returns the value of <b>a</b> but it returns 0 if <b>a</b> is NULL and -1 on error (which is ambiguous because -1 is a legitimate value for an <b>ASN1_INTEGER</b>). New applications should use ASN1_INTEGER_get_int64() instead.</p>
|
||||
|
||||
<p>ASN1_INTEGER_set_int64() sets the value of <b>ASN1_INTEGER</b> <b>a</b> to the <b>int64_t</b> value <b>r</b>.</p>
|
||||
|
||||
<p>ASN1_INTEGER_set_uint64() sets the value of <b>ASN1_INTEGER</b> <b>a</b> to the <b>uint64_t</b> value <b>r</b>.</p>
|
||||
|
||||
<p>ASN1_INTEGER_set() sets the value of <b>ASN1_INTEGER</b> <b>a</b> to the <b>long</b> value <b>v</b>.</p>
|
||||
|
||||
<p>BN_to_ASN1_INTEGER() converts <b>BIGNUM</b> <b>bn</b> to an <b>ASN1_INTEGER</b>. If <b>ai</b> is NULL a new <b>ASN1_INTEGER</b> structure is returned. If <b>ai</b> is not NULL then the existing structure will be used instead.</p>
|
||||
|
||||
<p>ASN1_INTEGER_to_BN() converts ASN1_INTEGER <b>ai</b> into a <b>BIGNUM</b>. If <b>bn</b> is NULL a new <b>BIGNUM</b> structure is returned. If <b>bn</b> is not NULL then the existing structure will be used instead.</p>
|
||||
|
||||
<p>ASN1_ENUMERATED_get_int64(), ASN1_ENUMERATED_set_int64(), ASN1_ENUMERATED_set(), BN_to_ASN1_ENUMERATED() and ASN1_ENUMERATED_to_BN() behave in an identical way to their ASN1_INTEGER counterparts except they operate on an <b>ASN1_ENUMERATED</b> value.</p>
|
||||
|
||||
<p>ASN1_ENUMERATED_get() returns the value of <b>a</b> in a similar way to ASN1_INTEGER_get() but it returns <b>0xffffffffL</b> if the value of <b>a</b> will not fit in a long type. New applications should use ASN1_ENUMERATED_get_int64() instead.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>In general an <b>ASN1_INTEGER</b> or <b>ASN1_ENUMERATED</b> type can contain an integer of almost arbitrary size and so cannot always be represented by a C <b>int64_t</b> type. However in many cases (for example version numbers) they represent small integers which can be more easily manipulated if converted to an appropriate C integer type.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The ambiguous return values of ASN1_INTEGER_get() and ASN1_ENUMERATED_get() mean these functions should be avoided if possible. They are retained for compatibility. Normally the ambiguous return values are not legitimate values for the fields they represent.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_INTEGER_set_int64(), ASN1_INTEGER_set(), ASN1_ENUMERATED_set_int64() and ASN1_ENUMERATED_set() return 1 for success and 0 for failure. They will only fail if a memory allocation error occurs.</p>
|
||||
|
||||
<p>ASN1_INTEGER_get_int64() and ASN1_ENUMERATED_get_int64() return 1 for success and 0 for failure. They will fail if the passed type is incorrect (this will only happen if there is a programming error) or if the value exceeds the range of an <b>int64_t</b> type.</p>
|
||||
|
||||
<p>BN_to_ASN1_INTEGER() and BN_to_ASN1_ENUMERATED() return an <b>ASN1_INTEGER</b> or <b>ASN1_ENUMERATED</b> structure respectively or NULL if an error occurs. They will only fail due to a memory allocation error.</p>
|
||||
|
||||
<p>ASN1_INTEGER_to_BN() and ASN1_ENUMERATED_to_BN() return a <b>BIGNUM</b> structure of NULL if an error occurs. They can fail if the passed type is incorrect (due to programming error) or due to a memory allocation failure.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>ASN1_INTEGER_set_int64(), ASN1_INTEGER_get_int64(), ASN1_ENUMERATED_set_int64() and ASN1_ENUMERATED_get_int64() were added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
59
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_ITEM_lookup.html
vendored
Normal file
59
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_ITEM_lookup.html
vendored
Normal file
@ -0,0 +1,59 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_ITEM_lookup</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_ITEM_lookup, ASN1_ITEM_get - lookup ASN.1 structures</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
const ASN1_ITEM *ASN1_ITEM_lookup(const char *name);
|
||||
const ASN1_ITEM *ASN1_ITEM_get(size_t i);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>ASN1_ITEM_lookup() returns the <b>ASN1_ITEM name</b>.</p>
|
||||
|
||||
<p>ASN1_ITEM_get() returns the <b>ASN1_ITEM</b> with index <b>i</b>. This function returns <b>NULL</b> if the index <b>i</b> is out of range.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_ITEM_lookup() and ASN1_ITEM_get() return a valid <b>ASN1_ITEM</b> structure or <b>NULL</b> if an error occurred.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
68
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_OBJECT_new.html
vendored
Normal file
68
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_OBJECT_new.html
vendored
Normal file
@ -0,0 +1,68 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_OBJECT_new</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_OBJECT_new, ASN1_OBJECT_free - object allocation functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
ASN1_OBJECT *ASN1_OBJECT_new(void);
|
||||
void ASN1_OBJECT_free(ASN1_OBJECT *a);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The ASN1_OBJECT allocation routines, allocate and free an ASN1_OBJECT structure, which represents an ASN1 OBJECT IDENTIFIER.</p>
|
||||
|
||||
<p>ASN1_OBJECT_new() allocates and initializes an ASN1_OBJECT structure.</p>
|
||||
|
||||
<p>ASN1_OBJECT_free() frees up the <b>ASN1_OBJECT</b> structure <b>a</b>. If <b>a</b> is NULL, nothing is done.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Although ASN1_OBJECT_new() allocates a new ASN1_OBJECT structure it is almost never used in applications. The ASN1 object utility functions such as OBJ_nid2obj() are used instead.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>If the allocation fails, ASN1_OBJECT_new() returns <b>NULL</b> and sets an error code that can be obtained by <a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>. Otherwise it returns a pointer to the newly allocated structure.</p>
|
||||
|
||||
<p>ASN1_OBJECT_free() returns no value.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>, <a href="../man3/d2i_ASN1_OBJECT.html">d2i_ASN1_OBJECT(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
82
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_TABLE_add.html
vendored
Normal file
82
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_TABLE_add.html
vendored
Normal file
@ -0,0 +1,82 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_STRING_TABLE_add</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a>
|
||||
<ul>
|
||||
<li><a href="#Types">Types</a></li>
|
||||
<li><a href="#Functions">Functions</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_STRING_TABLE, ASN1_STRING_TABLE_add, ASN1_STRING_TABLE_get, ASN1_STRING_TABLE_cleanup - ASN1_STRING_TABLE manipulation functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
typedef struct asn1_string_table_st ASN1_STRING_TABLE;
|
||||
|
||||
int ASN1_STRING_TABLE_add(int nid, long minsize, long maxsize,
|
||||
unsigned long mask, unsigned long flags);
|
||||
ASN1_STRING_TABLE * ASN1_STRING_TABLE_get(int nid);
|
||||
void ASN1_STRING_TABLE_cleanup(void);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<h2 id="Types">Types</h2>
|
||||
|
||||
<p><b>ASN1_STRING_TABLE</b> is a table which holds string information (basically minimum size, maximum size, type and etc) for a NID object.</p>
|
||||
|
||||
<h2 id="Functions">Functions</h2>
|
||||
|
||||
<p>ASN1_STRING_TABLE_add() adds a new <b>ASN1_STRING_TABLE</b> item into the local ASN1 string table based on the <b>nid</b> along with other parameters.</p>
|
||||
|
||||
<p>If the item is already in the table, fields of <b>ASN1_STRING_TABLE</b> are updated (depending on the values of those parameters, e.g., <b>minsize</b> and <b>maxsize</b> >= 0, <b>mask</b> and <b>flags</b> != 0). If the <b>nid</b> is standard, a copy of the standard <b>ASN1_STRING_TABLE</b> is created and updated with other parameters.</p>
|
||||
|
||||
<p>ASN1_STRING_TABLE_get() searches for an <b>ASN1_STRING_TABLE</b> item based on <b>nid</b>. It will search the local table first, then the standard one.</p>
|
||||
|
||||
<p>ASN1_STRING_TABLE_cleanup() frees all <b>ASN1_STRING_TABLE</b> items added by ASN1_STRING_TABLE_add().</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_STRING_TABLE_add() returns 1 on success, 0 if an error occurred.</p>
|
||||
|
||||
<p>ASN1_STRING_TABLE_get() returns a valid <b>ASN1_STRING_TABLE</b> structure or <b>NULL</b> if nothing is found.</p>
|
||||
|
||||
<p>ASN1_STRING_TABLE_cleanup() does not return a value.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
107
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_length.html
vendored
Normal file
107
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_length.html
vendored
Normal file
@ -0,0 +1,107 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_STRING_length</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_STRING_dup, ASN1_STRING_cmp, ASN1_STRING_set, ASN1_STRING_length, ASN1_STRING_type, ASN1_STRING_get0_data, ASN1_STRING_data, ASN1_STRING_to_UTF8 - ASN1_STRING utility functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
int ASN1_STRING_length(ASN1_STRING *x);
|
||||
const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x);
|
||||
unsigned char * ASN1_STRING_data(ASN1_STRING *x);
|
||||
|
||||
ASN1_STRING * ASN1_STRING_dup(ASN1_STRING *a);
|
||||
|
||||
int ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b);
|
||||
|
||||
int ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
|
||||
|
||||
int ASN1_STRING_type(const ASN1_STRING *x);
|
||||
|
||||
int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions allow an <b>ASN1_STRING</b> structure to be manipulated.</p>
|
||||
|
||||
<p>ASN1_STRING_length() returns the length of the content of <b>x</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_get0_data() returns an internal pointer to the data of <b>x</b>. Since this is an internal pointer it should <b>not</b> be freed or modified in any way.</p>
|
||||
|
||||
<p>ASN1_STRING_data() is similar to ASN1_STRING_get0_data() except the returned value is not constant. This function is deprecated: applications should use ASN1_STRING_get0_data() instead.</p>
|
||||
|
||||
<p>ASN1_STRING_dup() returns a copy of the structure <b>a</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_cmp() compares <b>a</b> and <b>b</b> returning 0 if the two are identical. The string types and content are compared.</p>
|
||||
|
||||
<p>ASN1_STRING_set() sets the data of string <b>str</b> to the buffer <b>data</b> or length <b>len</b>. The supplied data is copied. If <b>len</b> is -1 then the length is determined by strlen(data).</p>
|
||||
|
||||
<p>ASN1_STRING_type() returns the type of <b>x</b>, using standard constants such as <b>V_ASN1_OCTET_STRING</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_to_UTF8() converts the string <b>in</b> to UTF8 format, the converted data is allocated in a buffer in <b>*out</b>. The length of <b>out</b> is returned or a negative error code. The buffer <b>*out</b> should be freed using OPENSSL_free().</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Almost all ASN1 types in OpenSSL are represented as an <b>ASN1_STRING</b> structure. Other types such as <b>ASN1_OCTET_STRING</b> are simply typedef'ed to <b>ASN1_STRING</b> and the functions call the <b>ASN1_STRING</b> equivalents. <b>ASN1_STRING</b> is also used for some <b>CHOICE</b> types which consist entirely of primitive string types such as <b>DirectoryString</b> and <b>Time</b>.</p>
|
||||
|
||||
<p>These functions should <b>not</b> be used to examine or modify <b>ASN1_INTEGER</b> or <b>ASN1_ENUMERATED</b> types: the relevant <b>INTEGER</b> or <b>ENUMERATED</b> utility functions should be used instead.</p>
|
||||
|
||||
<p>In general it cannot be assumed that the data returned by ASN1_STRING_data() is null terminated or does not contain embedded nulls. The actual format of the data will depend on the actual string type itself: for example for an IA5String the data will be ASCII, for a BMPString two bytes per character in big endian format, and for an UTF8String it will be in UTF8 format.</p>
|
||||
|
||||
<p>Similar care should be take to ensure the data is in the correct format when calling ASN1_STRING_set().</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_STRING_length() returns the length of the content of <b>x</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_get0_data() and ASN1_STRING_data() return an internal pointer to the data of <b>x</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_dup() returns a valid <b>ASN1_STRING</b> structure or <b>NULL</b> if an error occurred.</p>
|
||||
|
||||
<p>ASN1_STRING_cmp() returns an integer greater than, equal to, or less than 0, according to whether <b>a</b> is greater than, equal to, or less than <b>b</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_set() returns 1 on success or 0 on error.</p>
|
||||
|
||||
<p>ASN1_STRING_type() returns the type of <b>x</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_to_UTF8() returns the number of bytes in output string <b>out</b> or a negative value if an error occurred.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
69
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_new.html
vendored
Normal file
69
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_new.html
vendored
Normal file
@ -0,0 +1,69 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_STRING_new</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_STRING_new, ASN1_STRING_type_new, ASN1_STRING_free - ASN1_STRING allocation functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
ASN1_STRING * ASN1_STRING_new(void);
|
||||
ASN1_STRING * ASN1_STRING_type_new(int type);
|
||||
void ASN1_STRING_free(ASN1_STRING *a);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>ASN1_STRING_new() returns an allocated <b>ASN1_STRING</b> structure. Its type is undefined.</p>
|
||||
|
||||
<p>ASN1_STRING_type_new() returns an allocated <b>ASN1_STRING</b> structure of type <b>type</b>.</p>
|
||||
|
||||
<p>ASN1_STRING_free() frees up <b>a</b>. If <b>a</b> is NULL nothing is done.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Other string types call the <b>ASN1_STRING</b> functions. For example ASN1_OCTET_STRING_new() calls ASN1_STRING_type(V_ASN1_OCTET_STRING).</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_STRING_new() and ASN1_STRING_type_new() return a valid ASN1_STRING structure or <b>NULL</b> if an error occurred.</p>
|
||||
|
||||
<p>ASN1_STRING_free() does not return a value.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
103
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_print_ex.html
vendored
Normal file
103
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_STRING_print_ex.html
vendored
Normal file
@ -0,0 +1,103 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_STRING_print_ex</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_tag2str, ASN1_STRING_print_ex, ASN1_STRING_print_ex_fp, ASN1_STRING_print - ASN1_STRING output routines</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
int ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str, unsigned long flags);
|
||||
int ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str, unsigned long flags);
|
||||
int ASN1_STRING_print(BIO *out, const ASN1_STRING *str);
|
||||
|
||||
const char *ASN1_tag2str(int tag);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions output an <b>ASN1_STRING</b> structure. <b>ASN1_STRING</b> is used to represent all the ASN1 string types.</p>
|
||||
|
||||
<p>ASN1_STRING_print_ex() outputs <b>str</b> to <b>out</b>, the format is determined by the options <b>flags</b>. ASN1_STRING_print_ex_fp() is identical except it outputs to <b>fp</b> instead.</p>
|
||||
|
||||
<p>ASN1_STRING_print() prints <b>str</b> to <b>out</b> but using a different format to ASN1_STRING_print_ex(). It replaces unprintable characters (other than CR, LF) with '.'.</p>
|
||||
|
||||
<p>ASN1_tag2str() returns a human-readable name of the specified ASN.1 <b>tag</b>.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>ASN1_STRING_print() is a deprecated function which should be avoided; use ASN1_STRING_print_ex() instead.</p>
|
||||
|
||||
<p>Although there are a large number of options frequently <b>ASN1_STRFLGS_RFC2253</b> is suitable, or on UTF8 terminals <b>ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB</b>.</p>
|
||||
|
||||
<p>The complete set of supported options for <b>flags</b> is listed below.</p>
|
||||
|
||||
<p>Various characters can be escaped. If <b>ASN1_STRFLGS_ESC_2253</b> is set the characters determined by RFC2253 are escaped. If <b>ASN1_STRFLGS_ESC_CTRL</b> is set control characters are escaped. If <b>ASN1_STRFLGS_ESC_MSB</b> is set characters with the MSB set are escaped: this option should <b>not</b> be used if the terminal correctly interprets UTF8 sequences.</p>
|
||||
|
||||
<p>Escaping takes several forms.</p>
|
||||
|
||||
<p>If the character being escaped is a 16 bit character then the form "\UXXXX" is used using exactly four characters for the hex representation. If it is 32 bits then "\WXXXXXXXX" is used using eight characters of its hex representation. These forms will only be used if UTF8 conversion is not set (see below).</p>
|
||||
|
||||
<p>Printable characters are normally escaped using the backslash '\' character. If <b>ASN1_STRFLGS_ESC_QUOTE</b> is set then the whole string is instead surrounded by double quote characters: this is arguably more readable than the backslash notation. Other characters use the "\XX" using exactly two characters of the hex representation.</p>
|
||||
|
||||
<p>If <b>ASN1_STRFLGS_UTF8_CONVERT</b> is set then characters are converted to UTF8 format first. If the terminal supports the display of UTF8 sequences then this option will correctly display multi byte characters.</p>
|
||||
|
||||
<p>If <b>ASN1_STRFLGS_IGNORE_TYPE</b> is set then the string type is not interpreted at all: everything is assumed to be one byte per character. This is primarily for debugging purposes and can result in confusing output in multi character strings.</p>
|
||||
|
||||
<p>If <b>ASN1_STRFLGS_SHOW_TYPE</b> is set then the string type itself is printed out before its value (for example "BMPSTRING"), this actually uses ASN1_tag2str().</p>
|
||||
|
||||
<p>The content of a string instead of being interpreted can be "dumped": this just outputs the value of the string using the form #XXXX using hex format for each octet.</p>
|
||||
|
||||
<p>If <b>ASN1_STRFLGS_DUMP_ALL</b> is set then any type is dumped.</p>
|
||||
|
||||
<p>Normally non character string types (such as OCTET STRING) are assumed to be one byte per character, if <b>ASN1_STRFLGS_DUMP_UNKNOWN</b> is set then they will be dumped instead.</p>
|
||||
|
||||
<p>When a type is dumped normally just the content octets are printed, if <b>ASN1_STRFLGS_DUMP_DER</b> is set then the complete encoding is dumped instead (including tag and length octets).</p>
|
||||
|
||||
<p><b>ASN1_STRFLGS_RFC2253</b> includes all the flags required by RFC2253. It is equivalent to: ASN1_STRFLGS_ESC_2253 | ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | ASN1_STRFLGS_UTF8_CONVERT | ASN1_STRFLGS_DUMP_UNKNOWN ASN1_STRFLGS_DUMP_DER</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_STRING_print_ex() and ASN1_STRING_print_ex_fp() return the number of characters written or -1 if an error occurred.</p>
|
||||
|
||||
<p>ASN1_STRING_print() returns 1 on success or 0 on error.</p>
|
||||
|
||||
<p>ASN1_tag2str() returns a human-readable name of the specified ASN.1 <b>tag</b>.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/X509_NAME_print_ex.html">X509_NAME_print_ex(3)</a>, <a href="../man3/ASN1_tag2str.html">ASN1_tag2str(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
190
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_TIME_set.html
vendored
Normal file
190
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_TIME_set.html
vendored
Normal file
@ -0,0 +1,190 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_TIME_set</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_TIME_set, ASN1_UTCTIME_set, ASN1_GENERALIZEDTIME_set, ASN1_TIME_adj, ASN1_UTCTIME_adj, ASN1_GENERALIZEDTIME_adj, ASN1_TIME_check, ASN1_UTCTIME_check, ASN1_GENERALIZEDTIME_check, ASN1_TIME_set_string, ASN1_UTCTIME_set_string, ASN1_GENERALIZEDTIME_set_string, ASN1_TIME_set_string_X509, ASN1_TIME_normalize, ASN1_TIME_to_tm, ASN1_TIME_print, ASN1_UTCTIME_print, ASN1_GENERALIZEDTIME_print, ASN1_TIME_diff, ASN1_TIME_cmp_time_t, ASN1_UTCTIME_cmp_time_t, ASN1_TIME_compare, ASN1_TIME_to_generalizedtime - ASN.1 Time functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t);
|
||||
ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t);
|
||||
ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
|
||||
time_t t);
|
||||
|
||||
ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t, int offset_day,
|
||||
long offset_sec);
|
||||
ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
|
||||
int offset_day, long offset_sec);
|
||||
ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,
|
||||
time_t t, int offset_day,
|
||||
long offset_sec);
|
||||
|
||||
int ASN1_TIME_set_string(ASN1_TIME *s, const char *str);
|
||||
int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str);
|
||||
int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str);
|
||||
int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s,
|
||||
const char *str);
|
||||
|
||||
int ASN1_TIME_normalize(ASN1_TIME *s);
|
||||
|
||||
int ASN1_TIME_check(const ASN1_TIME *t);
|
||||
int ASN1_UTCTIME_check(const ASN1_UTCTIME *t);
|
||||
int ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *t);
|
||||
|
||||
int ASN1_TIME_print(BIO *b, const ASN1_TIME *s);
|
||||
int ASN1_UTCTIME_print(BIO *b, const ASN1_UTCTIME *s);
|
||||
int ASN1_GENERALIZEDTIME_print(BIO *b, const ASN1_GENERALIZEDTIME *s);
|
||||
|
||||
int ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm);
|
||||
int ASN1_TIME_diff(int *pday, int *psec, const ASN1_TIME *from,
|
||||
const ASN1_TIME *to);
|
||||
|
||||
int ASN1_TIME_cmp_time_t(const ASN1_TIME *s, time_t t);
|
||||
int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t);
|
||||
|
||||
int ASN1_TIME_compare(const ASN1_TIME *a, const ASN1_TIME *b);
|
||||
|
||||
ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,
|
||||
ASN1_GENERALIZEDTIME **out);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The ASN1_TIME_set(), ASN1_UTCTIME_set() and ASN1_GENERALIZEDTIME_set() functions set the structure <b>s</b> to the time represented by the time_t value <b>t</b>. If <b>s</b> is NULL a new time structure is allocated and returned.</p>
|
||||
|
||||
<p>The ASN1_TIME_adj(), ASN1_UTCTIME_adj() and ASN1_GENERALIZEDTIME_adj() functions set the time structure <b>s</b> to the time represented by the time <b>offset_day</b> and <b>offset_sec</b> after the time_t value <b>t</b>. The values of <b>offset_day</b> or <b>offset_sec</b> can be negative to set a time before <b>t</b>. The <b>offset_sec</b> value can also exceed the number of seconds in a day. If <b>s</b> is NULL a new structure is allocated and returned.</p>
|
||||
|
||||
<p>The ASN1_TIME_set_string(), ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string() functions set the time structure <b>s</b> to the time represented by string <b>str</b> which must be in appropriate ASN.1 time format (for example YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ). If <b>s</b> is NULL this function performs a format check on <b>str</b> only. The string <b>str</b> is copied into <b>s</b>.</p>
|
||||
|
||||
<p>ASN1_TIME_set_string_X509() sets ASN1_TIME structure <b>s</b> to the time represented by string <b>str</b> which must be in appropriate time format that RFC 5280 requires, which means it only allows YYMMDDHHMMSSZ and YYYYMMDDHHMMSSZ (leap second is rejected), all other ASN.1 time format are not allowed. If <b>s</b> is NULL this function performs a format check on <b>str</b> only.</p>
|
||||
|
||||
<p>The ASN1_TIME_normalize() function converts an ASN1_GENERALIZEDTIME or ASN1_UTCTIME into a time value that can be used in a certificate. It should be used after the ASN1_TIME_set_string() functions and before ASN1_TIME_print() functions to get consistent (i.e. GMT) results.</p>
|
||||
|
||||
<p>The ASN1_TIME_check(), ASN1_UTCTIME_check() and ASN1_GENERALIZEDTIME_check() functions check the syntax of the time structure <b>s</b>.</p>
|
||||
|
||||
<p>The ASN1_TIME_print(), ASN1_UTCTIME_print() and ASN1_GENERALIZEDTIME_print() functions print the time structure <b>s</b> to BIO <b>b</b> in human readable format. It will be of the format MMM DD HH:MM:SS YYYY [GMT], for example "Feb 3 00:55:52 2015 GMT" it does not include a newline. If the time structure has invalid format it prints out "Bad time value" and returns an error. The output for generalized time may include a fractional part following the second.</p>
|
||||
|
||||
<p>ASN1_TIME_to_tm() converts the time <b>s</b> to the standard <b>tm</b> structure. If <b>s</b> is NULL, then the current time is converted. The output time is GMT. The <b>tm_sec</b>, <b>tm_min</b>, <b>tm_hour</b>, <b>tm_mday</b>, <b>tm_wday</b>, <b>tm_yday</b>, <b>tm_mon</b> and <b>tm_year</b> fields of <b>tm</b> structure are set to proper values, whereas all other fields are set to 0. If <b>tm</b> is NULL this function performs a format check on <b>s</b> only. If <b>s</b> is in Generalized format with fractional seconds, e.g. YYYYMMDDHHMMSS.SSSZ, the fractional seconds will be lost while converting <b>s</b> to <b>tm</b> structure.</p>
|
||||
|
||||
<p>ASN1_TIME_diff() sets <b>*pday</b> and <b>*psec</b> to the time difference between <b>from</b> and <b>to</b>. If <b>to</b> represents a time later than <b>from</b> then one or both (depending on the time difference) of <b>*pday</b> and <b>*psec</b> will be positive. If <b>to</b> represents a time earlier than <b>from</b> then one or both of <b>*pday</b> and <b>*psec</b> will be negative. If <b>to</b> and <b>from</b> represent the same time then <b>*pday</b> and <b>*psec</b> will both be zero. If both <b>*pday</b> and <b>*psec</b> are non-zero they will always have the same sign. The value of <b>*psec</b> will always be less than the number of seconds in a day. If <b>from</b> or <b>to</b> is NULL the current time is used.</p>
|
||||
|
||||
<p>The ASN1_TIME_cmp_time_t() and ASN1_UTCTIME_cmp_time_t() functions compare the two times represented by the time structure <b>s</b> and the time_t <b>t</b>.</p>
|
||||
|
||||
<p>The ASN1_TIME_compare() function compares the two times represented by the time structures <b>a</b> and <b>b</b>.</p>
|
||||
|
||||
<p>The ASN1_TIME_to_generalizedtime() function converts an ASN1_TIME to an ASN1_GENERALIZEDTIME, regardless of year. If either <b>out</b> or <b>*out</b> are NULL, then a new object is allocated and must be freed after use.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The ASN1_TIME structure corresponds to the ASN.1 structure <b>Time</b> defined in RFC5280 et al. The time setting functions obey the rules outlined in RFC5280: if the date can be represented by UTCTime it is used, else GeneralizedTime is used.</p>
|
||||
|
||||
<p>The ASN1_TIME, ASN1_UTCTIME and ASN1_GENERALIZEDTIME structures are represented as an ASN1_STRING internally and can be freed up using ASN1_STRING_free().</p>
|
||||
|
||||
<p>The ASN1_TIME structure can represent years from 0000 to 9999 but no attempt is made to correct ancient calendar changes (for example from Julian to Gregorian calendars).</p>
|
||||
|
||||
<p>ASN1_UTCTIME is limited to a year range of 1950 through 2049.</p>
|
||||
|
||||
<p>Some applications add offset times directly to a time_t value and pass the results to ASN1_TIME_set() (or equivalent). This can cause problems as the time_t value can overflow on some systems resulting in unexpected results. New applications should use ASN1_TIME_adj() instead and pass the offset value in the <b>offset_sec</b> and <b>offset_day</b> parameters instead of directly manipulating a time_t value.</p>
|
||||
|
||||
<p>ASN1_TIME_adj() may change the type from ASN1_GENERALIZEDTIME to ASN1_UTCTIME, or vice versa, based on the resulting year. The ASN1_GENERALIZEDTIME_adj() and ASN1_UTCTIME_adj() functions will not modify the type of the return structure.</p>
|
||||
|
||||
<p>It is recommended that functions starting with ASN1_TIME be used instead of those starting with ASN1_UTCTIME or ASN1_GENERALIZEDTIME. The functions starting with ASN1_UTCTIME and ASN1_GENERALIZEDTIME act only on that specific time format. The functions starting with ASN1_TIME will operate on either format.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>ASN1_TIME_print(), ASN1_UTCTIME_print() and ASN1_GENERALIZEDTIME_print() do not print out the time zone: it either prints out "GMT" or nothing. But all certificates complying with RFC5280 et al use GMT anyway.</p>
|
||||
|
||||
<p>Use the ASN1_TIME_normalize() function to normalize the time value before printing to get GMT results.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_TIME_set(), ASN1_UTCTIME_set(), ASN1_GENERALIZEDTIME_set(), ASN1_TIME_adj(), ASN1_UTCTIME_adj and ASN1_GENERALIZEDTIME_set return a pointer to a time structure or NULL if an error occurred.</p>
|
||||
|
||||
<p>ASN1_TIME_set_string(), ASN1_UTCTIME_set_string(), ASN1_GENERALIZEDTIME_set_string() ASN1_TIME_set_string_X509() return 1 if the time value is successfully set and 0 otherwise.</p>
|
||||
|
||||
<p>ASN1_TIME_normalize() returns 1 on success, and 0 on error.</p>
|
||||
|
||||
<p>ASN1_TIME_check(), ASN1_UTCTIME_check and ASN1_GENERALIZEDTIME_check() return 1 if the structure is syntactically correct and 0 otherwise.</p>
|
||||
|
||||
<p>ASN1_TIME_print(), ASN1_UTCTIME_print() and ASN1_GENERALIZEDTIME_print() return 1 if the time is successfully printed out and 0 if an error occurred (I/O error or invalid time format).</p>
|
||||
|
||||
<p>ASN1_TIME_to_tm() returns 1 if the time is successfully parsed and 0 if an error occurred (invalid time format).</p>
|
||||
|
||||
<p>ASN1_TIME_diff() returns 1 for success and 0 for failure. It can fail if the passed-in time structure has invalid syntax, for example.</p>
|
||||
|
||||
<p>ASN1_TIME_cmp_time_t() and ASN1_UTCTIME_cmp_time_t() return -1 if <b>s</b> is before <b>t</b>, 0 if <b>s</b> equals <b>t</b>, or 1 if <b>s</b> is after <b>t</b>. -2 is returned on error.</p>
|
||||
|
||||
<p>ASN1_TIME_compare() returns -1 if <b>a</b> is before <b>b</b>, 0 if <b>a</b> equals <b>b</b>, or 1 if <b>a</b> is after <b>b</b>. -2 is returned on error.</p>
|
||||
|
||||
<p>ASN1_TIME_to_generalizedtime() returns a pointer to the appropriate time structure on success or NULL if an error occurred.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Set a time structure to one hour after the current time and print it out:</p>
|
||||
|
||||
<pre><code>#include <time.h>
|
||||
#include <openssl/asn1.h>
|
||||
|
||||
ASN1_TIME *tm;
|
||||
time_t t;
|
||||
BIO *b;
|
||||
|
||||
t = time(NULL);
|
||||
tm = ASN1_TIME_adj(NULL, t, 0, 60 * 60);
|
||||
b = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
ASN1_TIME_print(b, tm);
|
||||
ASN1_STRING_free(tm);
|
||||
BIO_free(b);</code></pre>
|
||||
|
||||
<p>Determine if one time is later or sooner than the current time:</p>
|
||||
|
||||
<pre><code>int day, sec;
|
||||
|
||||
if (!ASN1_TIME_diff(&day, &sec, NULL, to))
|
||||
/* Invalid time format */
|
||||
|
||||
if (day > 0 || sec > 0)
|
||||
printf("Later\n");
|
||||
else if (day < 0 || sec < 0)
|
||||
printf("Sooner\n");
|
||||
else
|
||||
printf("Same\n");</code></pre>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The ASN1_TIME_to_tm() function was added in OpenSSL 1.1.1. The ASN1_TIME_set_string_X509() function was added in OpenSSL 1.1.1. The ASN1_TIME_normalize() function was added in OpenSSL 1.1.1. The ASN1_TIME_cmp_time_t() function was added in OpenSSL 1.1.1. The ASN1_TIME_compare() function was added in OpenSSL 1.1.1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
89
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_TYPE_get.html
vendored
Normal file
89
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_TYPE_get.html
vendored
Normal file
@ -0,0 +1,89 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_TYPE_get</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_TYPE_get, ASN1_TYPE_set, ASN1_TYPE_set1, ASN1_TYPE_cmp, ASN1_TYPE_unpack_sequence, ASN1_TYPE_pack_sequence - ASN1_TYPE utility functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
int ASN1_TYPE_get(const ASN1_TYPE *a);
|
||||
void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
|
||||
int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value);
|
||||
int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b);
|
||||
|
||||
void *ASN1_TYPE_unpack_sequence(const ASN1_ITEM *it, const ASN1_TYPE *t);
|
||||
ASN1_TYPE *ASN1_TYPE_pack_sequence(const ASN1_ITEM *it, void *s,
|
||||
ASN1_TYPE **t);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions allow an ASN1_TYPE structure to be manipulated. The ASN1_TYPE structure can contain any ASN.1 type or constructed type such as a SEQUENCE: it is effectively equivalent to the ASN.1 ANY type.</p>
|
||||
|
||||
<p>ASN1_TYPE_get() returns the type of <b>a</b>.</p>
|
||||
|
||||
<p>ASN1_TYPE_set() sets the value of <b>a</b> to <b>type</b> and <b>value</b>. This function uses the pointer <b>value</b> internally so it must <b>not</b> be freed up after the call.</p>
|
||||
|
||||
<p>ASN1_TYPE_set1() sets the value of <b>a</b> to <b>type</b> a copy of <b>value</b>.</p>
|
||||
|
||||
<p>ASN1_TYPE_cmp() compares ASN.1 types <b>a</b> and <b>b</b> and returns 0 if they are identical and non-zero otherwise.</p>
|
||||
|
||||
<p>ASN1_TYPE_unpack_sequence() attempts to parse the SEQUENCE present in <b>t</b> using the ASN.1 structure <b>it</b>. If successful it returns a pointer to the ASN.1 structure corresponding to <b>it</b> which must be freed by the caller. If it fails it return NULL.</p>
|
||||
|
||||
<p>ASN1_TYPE_pack_sequence() attempts to encode the ASN.1 structure <b>s</b> corresponding to <b>it</b> into an ASN1_TYPE. If successful the encoded ASN1_TYPE is returned. If <b>t</b> and <b>*t</b> are not NULL the encoded type is written to <b>t</b> overwriting any existing data. If <b>t</b> is not NULL but <b>*t</b> is NULL the returned ASN1_TYPE is written to <b>*t</b>.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The type and meaning of the <b>value</b> parameter for ASN1_TYPE_set() and ASN1_TYPE_set1() is determined by the <b>type</b> parameter. If <b>type</b> is V_ASN1_NULL <b>value</b> is ignored. If <b>type</b> is V_ASN1_BOOLEAN then the boolean is set to TRUE if <b>value</b> is not NULL. If <b>type</b> is V_ASN1_OBJECT then value is an ASN1_OBJECT structure. Otherwise <b>type</b> is and ASN1_STRING structure. If <b>type</b> corresponds to a primitive type (or a string type) then the contents of the ASN1_STRING contain the content octets of the type. If <b>type</b> corresponds to a constructed type or a tagged type (V_ASN1_SEQUENCE, V_ASN1_SET or V_ASN1_OTHER) then the ASN1_STRING contains the entire ASN.1 encoding verbatim (including tag and length octets).</p>
|
||||
|
||||
<p>ASN1_TYPE_cmp() may not return zero if two types are equivalent but have different encodings. For example the single content octet of the boolean TRUE value under BER can have any non-zero encoding but ASN1_TYPE_cmp() will only return zero if the values are the same.</p>
|
||||
|
||||
<p>If either or both of the parameters passed to ASN1_TYPE_cmp() is NULL the return value is non-zero. Technically if both parameters are NULL the two types could be absent OPTIONAL fields and so should match, however passing NULL values could also indicate a programming error (for example an unparsable type which returns NULL) for types which do <b>not</b> match. So applications should handle the case of two absent values separately.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_TYPE_get() returns the type of the ASN1_TYPE argument.</p>
|
||||
|
||||
<p>ASN1_TYPE_set() does not return a value.</p>
|
||||
|
||||
<p>ASN1_TYPE_set1() returns 1 for success and 0 for failure.</p>
|
||||
|
||||
<p>ASN1_TYPE_cmp() returns 0 if the types are identical and non-zero otherwise.</p>
|
||||
|
||||
<p>ASN1_TYPE_unpack_sequence() returns a pointer to an ASN.1 structure or NULL on failure.</p>
|
||||
|
||||
<p>ASN1_TYPE_pack_sequence() return an ASN1_TYPE structure if it succeeds or NULL on failure.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
274
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_generate_nconf.html
vendored
Normal file
274
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASN1_generate_nconf.html
vendored
Normal file
@ -0,0 +1,274 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASN1_generate_nconf</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#GENERATION-STRING-FORMAT">GENERATION STRING FORMAT</a>
|
||||
<ul>
|
||||
<li><a href="#Supported-Types">Supported Types</a></li>
|
||||
<li><a href="#Modifiers">Modifiers</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASN1_generate_nconf, ASN1_generate_v3 - ASN1 generation functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/asn1.h>
|
||||
|
||||
ASN1_TYPE *ASN1_generate_nconf(const char *str, CONF *nconf);
|
||||
ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions generate the ASN1 encoding of a string in an <b>ASN1_TYPE</b> structure.</p>
|
||||
|
||||
<p><b>str</b> contains the string to encode <b>nconf</b> or <b>cnf</b> contains the optional configuration information where additional strings will be read from. <b>nconf</b> will typically come from a config file whereas <b>cnf</b> is obtained from an <b>X509V3_CTX</b> structure which will typically be used by X509 v3 certificate extension functions. <b>cnf</b> or <b>nconf</b> can be set to <b>NULL</b> if no additional configuration will be used.</p>
|
||||
|
||||
<h1 id="GENERATION-STRING-FORMAT">GENERATION STRING FORMAT</h1>
|
||||
|
||||
<p>The actual data encoded is determined by the string <b>str</b> and the configuration information. The general format of the string is:</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="modifier-type-:value"><b>[modifier,]type[:value]</b></dt>
|
||||
<dd>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<p>That is zero or more comma separated modifiers followed by a type followed by an optional colon and a value. The formats of <b>type</b>, <b>value</b> and <b>modifier</b> are explained below.</p>
|
||||
|
||||
<h2 id="Supported-Types">Supported Types</h2>
|
||||
|
||||
<p>The supported types are listed below. Unless otherwise specified only the <b>ASCII</b> format is permissible.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="BOOLEAN-BOOL"><b>BOOLEAN</b>, <b>BOOL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This encodes a boolean type. The <b>value</b> string is mandatory and should be <b>TRUE</b> or <b>FALSE</b>. Additionally <b>TRUE</b>, <b>true</b>, <b>Y</b>, <b>y</b>, <b>YES</b>, <b>yes</b>, <b>FALSE</b>, <b>false</b>, <b>N</b>, <b>n</b>, <b>NO</b> and <b>no</b> are acceptable.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="NULL"><b>NULL</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encode the <b>NULL</b> type, the <b>value</b> string must not be present.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="INTEGER-INT"><b>INTEGER</b>, <b>INT</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encodes an ASN1 <b>INTEGER</b> type. The <b>value</b> string represents the value of the integer, it can be prefaced by a minus sign and is normally interpreted as a decimal value unless the prefix <b>0x</b> is included.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ENUMERATED-ENUM"><b>ENUMERATED</b>, <b>ENUM</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encodes the ASN1 <b>ENUMERATED</b> type, it is otherwise identical to <b>INTEGER</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="OBJECT-OID"><b>OBJECT</b>, <b>OID</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encodes an ASN1 <b>OBJECT IDENTIFIER</b>, the <b>value</b> string can be a short name, a long name or numerical format.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="UTCTIME-UTC"><b>UTCTIME</b>, <b>UTC</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encodes an ASN1 <b>UTCTime</b> structure, the value should be in the format <b>YYMMDDHHMMSSZ</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="GENERALIZEDTIME-GENTIME"><b>GENERALIZEDTIME</b>, <b>GENTIME</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encodes an ASN1 <b>GeneralizedTime</b> structure, the value should be in the format <b>YYYYMMDDHHMMSSZ</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="OCTETSTRING-OCT"><b>OCTETSTRING</b>, <b>OCT</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encodes an ASN1 <b>OCTET STRING</b>. <b>value</b> represents the contents of this structure, the format strings <b>ASCII</b> and <b>HEX</b> can be used to specify the format of <b>value</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BITSTRING-BITSTR"><b>BITSTRING</b>, <b>BITSTR</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Encodes an ASN1 <b>BIT STRING</b>. <b>value</b> represents the contents of this structure, the format strings <b>ASCII</b>, <b>HEX</b> and <b>BITLIST</b> can be used to specify the format of <b>value</b>.</p>
|
||||
|
||||
<p>If the format is anything other than <b>BITLIST</b> the number of unused bits is set to zero.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="UNIVERSALSTRING-UNIV-IA5-IA5STRING-UTF8-UTF8String-BMP-BMPSTRING-VISIBLESTRING-VISIBLE-PRINTABLESTRING-PRINTABLE-T61-T61STRING-TELETEXSTRING-GeneralString-NUMERICSTRING-NUMERIC"><b>UNIVERSALSTRING</b>, <b>UNIV</b>, <b>IA5</b>, <b>IA5STRING</b>, <b>UTF8</b>, <b>UTF8String</b>, <b>BMP</b>, <b>BMPSTRING</b>, <b>VISIBLESTRING</b>, <b>VISIBLE</b>, <b>PRINTABLESTRING</b>, <b>PRINTABLE</b>, <b>T61</b>, <b>T61STRING</b>, <b>TELETEXSTRING</b>, <b>GeneralString</b>, <b>NUMERICSTRING</b>, <b>NUMERIC</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>These encode the corresponding string types. <b>value</b> represents the contents of this structure. The format can be <b>ASCII</b> or <b>UTF8</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="SEQUENCE-SEQ-SET"><b>SEQUENCE</b>, <b>SEQ</b>, <b>SET</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Formats the result as an ASN1 <b>SEQUENCE</b> or <b>SET</b> type. <b>value</b> should be a section name which will contain the contents. The field names in the section are ignored and the values are in the generated string format. If <b>value</b> is absent then an empty SEQUENCE will be encoded.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="Modifiers">Modifiers</h2>
|
||||
|
||||
<p>Modifiers affect the following structure, they can be used to add EXPLICIT or IMPLICIT tagging, add wrappers or to change the string format of the final type and value. The supported formats are documented below.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="EXPLICIT-EXP"><b>EXPLICIT</b>, <b>EXP</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>Add an explicit tag to the following structure. This string should be followed by a colon and the tag value to use as a decimal value.</p>
|
||||
|
||||
<p>By following the number with <b>U</b>, <b>A</b>, <b>P</b> or <b>C</b> UNIVERSAL, APPLICATION, PRIVATE or CONTEXT SPECIFIC tagging can be used, the default is CONTEXT SPECIFIC.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="IMPLICIT-IMP"><b>IMPLICIT</b>, <b>IMP</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This is the same as <b>EXPLICIT</b> except IMPLICIT tagging is used instead.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="OCTWRAP-SEQWRAP-SETWRAP-BITWRAP"><b>OCTWRAP</b>, <b>SEQWRAP</b>, <b>SETWRAP</b>, <b>BITWRAP</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The following structure is surrounded by an OCTET STRING, a SEQUENCE, a SET or a BIT STRING respectively. For a BIT STRING the number of unused bits is set to zero.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="FORMAT"><b>FORMAT</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>This specifies the format of the ultimate value. It should be followed by a colon and one of the strings <b>ASCII</b>, <b>UTF8</b>, <b>HEX</b> or <b>BITLIST</b>.</p>
|
||||
|
||||
<p>If no format specifier is included then <b>ASCII</b> is used. If <b>UTF8</b> is specified then the value string must be a valid <b>UTF8</b> string. For <b>HEX</b> the output must be a set of hex digits. <b>BITLIST</b> (which is only valid for a BIT STRING) is a comma separated list of the indices of the set bits, all other bits are zero.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASN1_generate_nconf() and ASN1_generate_v3() return the encoded data as an <b>ASN1_TYPE</b> structure or <b>NULL</b> if an error occurred.</p>
|
||||
|
||||
<p>The error codes that can be obtained by <a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>A simple IA5String:</p>
|
||||
|
||||
<pre><code>IA5STRING:Hello World</code></pre>
|
||||
|
||||
<p>An IA5String explicitly tagged:</p>
|
||||
|
||||
<pre><code>EXPLICIT:0,IA5STRING:Hello World</code></pre>
|
||||
|
||||
<p>An IA5String explicitly tagged using APPLICATION tagging:</p>
|
||||
|
||||
<pre><code>EXPLICIT:0A,IA5STRING:Hello World</code></pre>
|
||||
|
||||
<p>A BITSTRING with bits 1 and 5 set and all others zero:</p>
|
||||
|
||||
<pre><code>FORMAT:BITLIST,BITSTRING:1,5</code></pre>
|
||||
|
||||
<p>A more complex example using a config file to produce a SEQUENCE consisting of a BOOL an OID and a UTF8String:</p>
|
||||
|
||||
<pre><code>asn1 = SEQUENCE:seq_section
|
||||
|
||||
[seq_section]
|
||||
|
||||
field1 = BOOLEAN:TRUE
|
||||
field2 = OID:commonName
|
||||
field3 = UTF8:Third field</code></pre>
|
||||
|
||||
<p>This example produces an RSAPrivateKey structure, this is the key contained in the file client.pem in all OpenSSL distributions (note: the field names such as 'coeff' are ignored and are present just for clarity):</p>
|
||||
|
||||
<pre><code>asn1=SEQUENCE:private_key
|
||||
[private_key]
|
||||
version=INTEGER:0
|
||||
|
||||
n=INTEGER:0xBB6FE79432CC6EA2D8F970675A5A87BFBE1AFF0BE63E879F2AFFB93644\
|
||||
D4D2C6D000430DEC66ABF47829E74B8C5108623A1C0EE8BE217B3AD8D36D5EB4FCA1D9
|
||||
|
||||
e=INTEGER:0x010001
|
||||
|
||||
d=INTEGER:0x6F05EAD2F27FFAEC84BEC360C4B928FD5F3A9865D0FCAAD291E2A52F4A\
|
||||
F810DC6373278C006A0ABBA27DC8C63BF97F7E666E27C5284D7D3B1FFFE16B7A87B51D
|
||||
|
||||
p=INTEGER:0xF3929B9435608F8A22C208D86795271D54EBDFB09DDEF539AB083DA912\
|
||||
D4BD57
|
||||
|
||||
q=INTEGER:0xC50016F89DFF2561347ED1186A46E150E28BF2D0F539A1594BBD7FE467\
|
||||
46EC4F
|
||||
|
||||
exp1=INTEGER:0x9E7D4326C924AFC1DEA40B45650134966D6F9DFA3A7F9D698CD4ABEA\
|
||||
9C0A39B9
|
||||
|
||||
exp2=INTEGER:0xBA84003BB95355AFB7C50DF140C60513D0BA51D637272E355E397779\
|
||||
E7B2458F
|
||||
|
||||
coeff=INTEGER:0x30B9E4F2AFA5AC679F920FC83F1F2DF1BAF1779CF989447FABC2F5\
|
||||
628657053A</code></pre>
|
||||
|
||||
<p>This example is the corresponding public key in a SubjectPublicKeyInfo structure:</p>
|
||||
|
||||
<pre><code># Start with a SEQUENCE
|
||||
asn1=SEQUENCE:pubkeyinfo
|
||||
|
||||
# pubkeyinfo contains an algorithm identifier and the public key wrapped
|
||||
# in a BIT STRING
|
||||
[pubkeyinfo]
|
||||
algorithm=SEQUENCE:rsa_alg
|
||||
pubkey=BITWRAP,SEQUENCE:rsapubkey
|
||||
|
||||
# algorithm ID for RSA is just an OID and a NULL
|
||||
[rsa_alg]
|
||||
algorithm=OID:rsaEncryption
|
||||
parameter=NULL
|
||||
|
||||
# Actual public key: modulus and exponent
|
||||
[rsapubkey]
|
||||
n=INTEGER:0xBB6FE79432CC6EA2D8F970675A5A87BFBE1AFF0BE63E879F2AFFB93644\
|
||||
D4D2C6D000430DEC66ABF47829E74B8C5108623A1C0EE8BE217B3AD8D36D5EB4FCA1D9
|
||||
|
||||
e=INTEGER:0x010001</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2002-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
96
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASYNC_WAIT_CTX_new.html
vendored
Normal file
96
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASYNC_WAIT_CTX_new.html
vendored
Normal file
@ -0,0 +1,96 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASYNC_WAIT_CTX_new</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASYNC_WAIT_CTX_new, ASYNC_WAIT_CTX_free, ASYNC_WAIT_CTX_set_wait_fd, ASYNC_WAIT_CTX_get_fd, ASYNC_WAIT_CTX_get_all_fds, ASYNC_WAIT_CTX_get_changed_fds, ASYNC_WAIT_CTX_clear_fd - functions to manage waiting for asynchronous jobs to complete</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/async.h>
|
||||
|
||||
ASYNC_WAIT_CTX *ASYNC_WAIT_CTX_new(void);
|
||||
void ASYNC_WAIT_CTX_free(ASYNC_WAIT_CTX *ctx);
|
||||
int ASYNC_WAIT_CTX_set_wait_fd(ASYNC_WAIT_CTX *ctx, const void *key,
|
||||
OSSL_ASYNC_FD fd,
|
||||
void *custom_data,
|
||||
void (*cleanup)(ASYNC_WAIT_CTX *, const void *,
|
||||
OSSL_ASYNC_FD, void *));
|
||||
int ASYNC_WAIT_CTX_get_fd(ASYNC_WAIT_CTX *ctx, const void *key,
|
||||
OSSL_ASYNC_FD *fd, void **custom_data);
|
||||
int ASYNC_WAIT_CTX_get_all_fds(ASYNC_WAIT_CTX *ctx, OSSL_ASYNC_FD *fd,
|
||||
size_t *numfds);
|
||||
int ASYNC_WAIT_CTX_get_changed_fds(ASYNC_WAIT_CTX *ctx, OSSL_ASYNC_FD *addfd,
|
||||
size_t *numaddfds, OSSL_ASYNC_FD *delfd,
|
||||
size_t *numdelfds);
|
||||
int ASYNC_WAIT_CTX_clear_fd(ASYNC_WAIT_CTX *ctx, const void *key);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>For an overview of how asynchronous operations are implemented in OpenSSL see <a href="../man3/ASYNC_start_job.html">ASYNC_start_job(3)</a>. An ASYNC_WAIT_CTX object represents an asynchronous "session", i.e. a related set of crypto operations. For example in SSL terms this would have a one-to-one correspondence with an SSL connection.</p>
|
||||
|
||||
<p>Application code must create an ASYNC_WAIT_CTX using the ASYNC_WAIT_CTX_new() function prior to calling ASYNC_start_job() (see <a href="../man3/ASYNC_start_job.html">ASYNC_start_job(3)</a>). When the job is started it is associated with the ASYNC_WAIT_CTX for the duration of that job. An ASYNC_WAIT_CTX should only be used for one ASYNC_JOB at any one time, but can be reused after an ASYNC_JOB has finished for a subsequent ASYNC_JOB. When the session is complete (e.g. the SSL connection is closed), application code cleans up with ASYNC_WAIT_CTX_free().</p>
|
||||
|
||||
<p>ASYNC_WAIT_CTXs can have "wait" file descriptors associated with them. Calling ASYNC_WAIT_CTX_get_all_fds() and passing in a pointer to an ASYNC_WAIT_CTX in the <b>ctx</b> parameter will return the wait file descriptors associated with that job in <b>*fd</b>. The number of file descriptors returned will be stored in <b>*numfds</b>. It is the caller's responsibility to ensure that sufficient memory has been allocated in <b>*fd</b> to receive all the file descriptors. Calling ASYNC_WAIT_CTX_get_all_fds() with a NULL <b>fd</b> value will return no file descriptors but will still populate <b>*numfds</b>. Therefore application code is typically expected to call this function twice: once to get the number of fds, and then again when sufficient memory has been allocated. If only one asynchronous engine is being used then normally this call will only ever return one fd. If multiple asynchronous engines are being used then more could be returned.</p>
|
||||
|
||||
<p>The function ASYNC_WAIT_CTX_get_changed_fds() can be used to detect if any fds have changed since the last call time ASYNC_start_job() returned an ASYNC_PAUSE result (or since the ASYNC_WAIT_CTX was created if no ASYNC_PAUSE result has been received). The <b>numaddfds</b> and <b>numdelfds</b> parameters will be populated with the number of fds added or deleted respectively. <b>*addfd</b> and <b>*delfd</b> will be populated with the list of added and deleted fds respectively. Similarly to ASYNC_WAIT_CTX_get_all_fds() either of these can be NULL, but if they are not NULL then the caller is responsible for ensuring sufficient memory is allocated.</p>
|
||||
|
||||
<p>Implementors of async aware code (e.g. engines) are encouraged to return a stable fd for the lifetime of the ASYNC_WAIT_CTX in order to reduce the "churn" of regularly changing fds - although no guarantees of this are provided to applications.</p>
|
||||
|
||||
<p>Applications can wait for the file descriptor to be ready for "read" using a system function call such as select or poll (being ready for "read" indicates that the job should be resumed). If no file descriptor is made available then an application will have to periodically "poll" the job by attempting to restart it to see if it is ready to continue.</p>
|
||||
|
||||
<p>Async aware code (e.g. engines) can get the current ASYNC_WAIT_CTX from the job via <a href="../man3/ASYNC_get_wait_ctx.html">ASYNC_get_wait_ctx(3)</a> and provide a file descriptor to use for waiting on by calling ASYNC_WAIT_CTX_set_wait_fd(). Typically this would be done by an engine immediately prior to calling ASYNC_pause_job() and not by end user code. An existing association with a file descriptor can be obtained using ASYNC_WAIT_CTX_get_fd() and cleared using ASYNC_WAIT_CTX_clear_fd(). Both of these functions requires a <b>key</b> value which is unique to the async aware code. This could be any unique value but a good candidate might be the <b>ENGINE *</b> for the engine. The <b>custom_data</b> parameter can be any value, and will be returned in a subsequent call to ASYNC_WAIT_CTX_get_fd(). The ASYNC_WAIT_CTX_set_wait_fd() function also expects a pointer to a "cleanup" routine. This can be NULL but if provided will automatically get called when the ASYNC_WAIT_CTX is freed, and gives the engine the opportunity to close the fd or any other resources. Note: The "cleanup" routine does not get called if the fd is cleared directly via a call to ASYNC_WAIT_CTX_clear_fd().</p>
|
||||
|
||||
<p>An example of typical usage might be an async capable engine. User code would initiate cryptographic operations. The engine would initiate those operations asynchronously and then call ASYNC_WAIT_CTX_set_wait_fd() followed by ASYNC_pause_job() to return control to the user code. The user code can then perform other tasks or wait for the job to be ready by calling "select" or other similar function on the wait file descriptor. The engine can signal to the user code that the job should be resumed by making the wait file descriptor "readable". Once resumed the engine should clear the wake signal on the wait file descriptor.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASYNC_WAIT_CTX_new() returns a pointer to the newly allocated ASYNC_WAIT_CTX or NULL on error.</p>
|
||||
|
||||
<p>ASYNC_WAIT_CTX_set_wait_fd, ASYNC_WAIT_CTX_get_fd, ASYNC_WAIT_CTX_get_all_fds, ASYNC_WAIT_CTX_get_changed_fds and ASYNC_WAIT_CTX_clear_fd all return 1 on success or 0 on error.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>On Windows platforms the openssl/async.h header is dependent on some of the types customarily made available by including windows.h. The application developer is likely to require control over when the latter is included, commonly as one of the first included headers. Therefore it is defined as an application developer's responsibility to include windows.h prior to async.h.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man7/crypto.html">crypto(7)</a>, <a href="../man3/ASYNC_start_job.html">ASYNC_start_job(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>ASYNC_WAIT_CTX_new(), ASYNC_WAIT_CTX_free(), ASYNC_WAIT_CTX_set_wait_fd(), ASYNC_WAIT_CTX_get_fd(), ASYNC_WAIT_CTX_get_all_fds(), ASYNC_WAIT_CTX_get_changed_fds() and ASYNC_WAIT_CTX_clear_fd() were added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
273
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASYNC_start_job.html
vendored
Normal file
273
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/ASYNC_start_job.html
vendored
Normal file
@ -0,0 +1,273 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>ASYNC_start_job</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>ASYNC_get_wait_ctx, ASYNC_init_thread, ASYNC_cleanup_thread, ASYNC_start_job, ASYNC_pause_job, ASYNC_get_current_job, ASYNC_block_pause, ASYNC_unblock_pause, ASYNC_is_capable - asynchronous job management functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/async.h>
|
||||
|
||||
int ASYNC_init_thread(size_t max_size, size_t init_size);
|
||||
void ASYNC_cleanup_thread(void);
|
||||
|
||||
int ASYNC_start_job(ASYNC_JOB **job, ASYNC_WAIT_CTX *ctx, int *ret,
|
||||
int (*func)(void *), void *args, size_t size);
|
||||
int ASYNC_pause_job(void);
|
||||
|
||||
ASYNC_JOB *ASYNC_get_current_job(void);
|
||||
ASYNC_WAIT_CTX *ASYNC_get_wait_ctx(ASYNC_JOB *job);
|
||||
void ASYNC_block_pause(void);
|
||||
void ASYNC_unblock_pause(void);
|
||||
|
||||
int ASYNC_is_capable(void);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>OpenSSL implements asynchronous capabilities through an ASYNC_JOB. This represents code that can be started and executes until some event occurs. At that point the code can be paused and control returns to user code until some subsequent event indicates that the job can be resumed.</p>
|
||||
|
||||
<p>The creation of an ASYNC_JOB is a relatively expensive operation. Therefore, for efficiency reasons, jobs can be created up front and reused many times. They are held in a pool until they are needed, at which point they are removed from the pool, used, and then returned to the pool when the job completes. If the user application is multi-threaded, then ASYNC_init_thread() may be called for each thread that will initiate asynchronous jobs. Before user code exits per-thread resources need to be cleaned up. This will normally occur automatically (see <a href="../man3/OPENSSL_init_crypto.html">OPENSSL_init_crypto(3)</a>) but may be explicitly initiated by using ASYNC_cleanup_thread(). No asynchronous jobs must be outstanding for the thread when ASYNC_cleanup_thread() is called. Failing to ensure this will result in memory leaks.</p>
|
||||
|
||||
<p>The <b>max_size</b> argument limits the number of ASYNC_JOBs that will be held in the pool. If <b>max_size</b> is set to 0 then no upper limit is set. When an ASYNC_JOB is needed but there are none available in the pool already then one will be automatically created, as long as the total of ASYNC_JOBs managed by the pool does not exceed <b>max_size</b>. When the pool is first initialised <b>init_size</b> ASYNC_JOBs will be created immediately. If ASYNC_init_thread() is not called before the pool is first used then it will be called automatically with a <b>max_size</b> of 0 (no upper limit) and an <b>init_size</b> of 0 (no ASYNC_JOBs created up front).</p>
|
||||
|
||||
<p>An asynchronous job is started by calling the ASYNC_start_job() function. Initially <b>*job</b> should be NULL. <b>ctx</b> should point to an ASYNC_WAIT_CTX object created through the <a href="../man3/ASYNC_WAIT_CTX_new.html">ASYNC_WAIT_CTX_new(3)</a> function. <b>ret</b> should point to a location where the return value of the asynchronous function should be stored on completion of the job. <b>func</b> represents the function that should be started asynchronously. The data pointed to by <b>args</b> and of size <b>size</b> will be copied and then passed as an argument to <b>func</b> when the job starts. ASYNC_start_job will return one of the following values:</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="ASYNC_ERR"><b>ASYNC_ERR</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>An error occurred trying to start the job. Check the OpenSSL error queue (e.g. see <a href="../man3/ERR_print_errors.html">ERR_print_errors(3)</a>) for more details.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ASYNC_NO_JOBS"><b>ASYNC_NO_JOBS</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>There are no jobs currently available in the pool. This call can be retried again at a later time.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ASYNC_PAUSE"><b>ASYNC_PAUSE</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The job was successfully started but was "paused" before it completed (see ASYNC_pause_job() below). A handle to the job is placed in <b>*job</b>. Other work can be performed (if desired) and the job restarted at a later time. To restart a job call ASYNC_start_job() again passing the job handle in <b>*job</b>. The <b>func</b>, <b>args</b> and <b>size</b> parameters will be ignored when restarting a job. When restarting a job ASYNC_start_job() <b>must</b> be called from the same thread that the job was originally started from.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ASYNC_FINISH"><b>ASYNC_FINISH</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The job completed. <b>*job</b> will be NULL and the return value from <b>func</b> will be placed in <b>*ret</b>.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<p>At any one time there can be a maximum of one job actively running per thread (you can have many that are paused). ASYNC_get_current_job() can be used to get a pointer to the currently executing ASYNC_JOB. If no job is currently executing then this will return NULL.</p>
|
||||
|
||||
<p>If executing within the context of a job (i.e. having been called directly or indirectly by the function "func" passed as an argument to ASYNC_start_job()) then ASYNC_pause_job() will immediately return control to the calling application with ASYNC_PAUSE returned from the ASYNC_start_job() call. A subsequent call to ASYNC_start_job passing in the relevant ASYNC_JOB in the <b>*job</b> parameter will resume execution from the ASYNC_pause_job() call. If ASYNC_pause_job() is called whilst not within the context of a job then no action is taken and ASYNC_pause_job() returns immediately.</p>
|
||||
|
||||
<p>ASYNC_get_wait_ctx() can be used to get a pointer to the ASYNC_WAIT_CTX for the <b>job</b>. ASYNC_WAIT_CTXs can have a "wait" file descriptor associated with them. Applications can wait for the file descriptor to be ready for "read" using a system function call such as select or poll (being ready for "read" indicates that the job should be resumed). If no file descriptor is made available then an application will have to periodically "poll" the job by attempting to restart it to see if it is ready to continue.</p>
|
||||
|
||||
<p>An example of typical usage might be an async capable engine. User code would initiate cryptographic operations. The engine would initiate those operations asynchronously and then call <a href="../man3/ASYNC_WAIT_CTX_set_wait_fd.html">ASYNC_WAIT_CTX_set_wait_fd(3)</a> followed by ASYNC_pause_job() to return control to the user code. The user code can then perform other tasks or wait for the job to be ready by calling "select" or other similar function on the wait file descriptor. The engine can signal to the user code that the job should be resumed by making the wait file descriptor "readable". Once resumed the engine should clear the wake signal on the wait file descriptor.</p>
|
||||
|
||||
<p>The ASYNC_block_pause() function will prevent the currently active job from pausing. The block will remain in place until a subsequent call to ASYNC_unblock_pause(). These functions can be nested, e.g. if you call ASYNC_block_pause() twice then you must call ASYNC_unblock_pause() twice in order to re-enable pausing. If these functions are called while there is no currently active job then they have no effect. This functionality can be useful to avoid deadlock scenarios. For example during the execution of an ASYNC_JOB an application acquires a lock. It then calls some cryptographic function which invokes ASYNC_pause_job(). This returns control back to the code that created the ASYNC_JOB. If that code then attempts to acquire the same lock before resuming the original job then a deadlock can occur. By calling ASYNC_block_pause() immediately after acquiring the lock and ASYNC_unblock_pause() immediately before releasing it then this situation cannot occur.</p>
|
||||
|
||||
<p>Some platforms cannot support async operations. The ASYNC_is_capable() function can be used to detect whether the current platform is async capable or not.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>ASYNC_init_thread returns 1 on success or 0 otherwise.</p>
|
||||
|
||||
<p>ASYNC_start_job returns one of ASYNC_ERR, ASYNC_NO_JOBS, ASYNC_PAUSE or ASYNC_FINISH as described above.</p>
|
||||
|
||||
<p>ASYNC_pause_job returns 0 if an error occurred or 1 on success. If called when not within the context of an ASYNC_JOB then this is counted as success so 1 is returned.</p>
|
||||
|
||||
<p>ASYNC_get_current_job returns a pointer to the currently executing ASYNC_JOB or NULL if not within the context of a job.</p>
|
||||
|
||||
<p>ASYNC_get_wait_ctx() returns a pointer to the ASYNC_WAIT_CTX for the job.</p>
|
||||
|
||||
<p>ASYNC_is_capable() returns 1 if the current platform is async capable or 0 otherwise.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>On Windows platforms the openssl/async.h header is dependent on some of the types customarily made available by including windows.h. The application developer is likely to require control over when the latter is included, commonly as one of the first included headers. Therefore it is defined as an application developer's responsibility to include windows.h prior to async.h.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>The following example demonstrates how to use most of the core async APIs:</p>
|
||||
|
||||
<pre><code>#ifdef _WIN32
|
||||
# include <windows.h>
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <openssl/async.h>
|
||||
#include <openssl/crypto.h>
|
||||
|
||||
int unique = 0;
|
||||
|
||||
void cleanup(ASYNC_WAIT_CTX *ctx, const void *key, OSSL_ASYNC_FD r, void *vw)
|
||||
{
|
||||
OSSL_ASYNC_FD *w = (OSSL_ASYNC_FD *)vw;
|
||||
|
||||
close(r);
|
||||
close(*w);
|
||||
OPENSSL_free(w);
|
||||
}
|
||||
|
||||
int jobfunc(void *arg)
|
||||
{
|
||||
ASYNC_JOB *currjob;
|
||||
unsigned char *msg;
|
||||
int pipefds[2] = {0, 0};
|
||||
OSSL_ASYNC_FD *wptr;
|
||||
char buf = 'X';
|
||||
|
||||
currjob = ASYNC_get_current_job();
|
||||
if (currjob != NULL) {
|
||||
printf("Executing within a job\n");
|
||||
} else {
|
||||
printf("Not executing within a job - should not happen\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
msg = (unsigned char *)arg;
|
||||
printf("Passed in message is: %s\n", msg);
|
||||
|
||||
if (pipe(pipefds) != 0) {
|
||||
printf("Failed to create pipe\n");
|
||||
return 0;
|
||||
}
|
||||
wptr = OPENSSL_malloc(sizeof(OSSL_ASYNC_FD));
|
||||
if (wptr == NULL) {
|
||||
printf("Failed to malloc\n");
|
||||
return 0;
|
||||
}
|
||||
*wptr = pipefds[1];
|
||||
ASYNC_WAIT_CTX_set_wait_fd(ASYNC_get_wait_ctx(currjob), &unique,
|
||||
pipefds[0], wptr, cleanup);
|
||||
|
||||
/*
|
||||
* Normally some external event would cause this to happen at some
|
||||
* later point - but we do it here for demo purposes, i.e.
|
||||
* immediately signalling that the job is ready to be woken up after
|
||||
* we return to main via ASYNC_pause_job().
|
||||
*/
|
||||
write(pipefds[1], &buf, 1);
|
||||
|
||||
/* Return control back to main */
|
||||
ASYNC_pause_job();
|
||||
|
||||
/* Clear the wake signal */
|
||||
read(pipefds[0], &buf, 1);
|
||||
|
||||
printf ("Resumed the job after a pause\n");
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
ASYNC_JOB *job = NULL;
|
||||
ASYNC_WAIT_CTX *ctx = NULL;
|
||||
int ret;
|
||||
OSSL_ASYNC_FD waitfd;
|
||||
fd_set waitfdset;
|
||||
size_t numfds;
|
||||
unsigned char msg[13] = "Hello world!";
|
||||
|
||||
printf("Starting...\n");
|
||||
|
||||
ctx = ASYNC_WAIT_CTX_new();
|
||||
if (ctx == NULL) {
|
||||
printf("Failed to create ASYNC_WAIT_CTX\n");
|
||||
abort();
|
||||
}
|
||||
|
||||
for (;;) {
|
||||
switch (ASYNC_start_job(&job, ctx, &ret, jobfunc, msg, sizeof(msg))) {
|
||||
case ASYNC_ERR:
|
||||
case ASYNC_NO_JOBS:
|
||||
printf("An error occurred\n");
|
||||
goto end;
|
||||
case ASYNC_PAUSE:
|
||||
printf("Job was paused\n");
|
||||
break;
|
||||
case ASYNC_FINISH:
|
||||
printf("Job finished with return value %d\n", ret);
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* Wait for the job to be woken */
|
||||
printf("Waiting for the job to be woken up\n");
|
||||
|
||||
if (!ASYNC_WAIT_CTX_get_all_fds(ctx, NULL, &numfds)
|
||||
|| numfds > 1) {
|
||||
printf("Unexpected number of fds\n");
|
||||
abort();
|
||||
}
|
||||
ASYNC_WAIT_CTX_get_all_fds(ctx, &waitfd, &numfds);
|
||||
FD_ZERO(&waitfdset);
|
||||
FD_SET(waitfd, &waitfdset);
|
||||
select(waitfd + 1, &waitfdset, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
end:
|
||||
ASYNC_WAIT_CTX_free(ctx);
|
||||
printf("Finishing\n");
|
||||
|
||||
return 0;
|
||||
}</code></pre>
|
||||
|
||||
<p>The expected output from executing the above example program is:</p>
|
||||
|
||||
<pre><code>Starting...
|
||||
Executing within a job
|
||||
Passed in message is: Hello world!
|
||||
Job was paused
|
||||
Waiting for the job to be woken up
|
||||
Resumed the job after a pause
|
||||
Job finished with return value 1
|
||||
Finishing</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man7/crypto.html">crypto(7)</a>, <a href="../man3/ERR_print_errors.html">ERR_print_errors(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>ASYNC_init_thread, ASYNC_cleanup_thread, ASYNC_start_job, ASYNC_pause_job, ASYNC_get_current_job, ASYNC_get_wait_ctx(), ASYNC_block_pause(), ASYNC_unblock_pause() and ASYNC_is_capable() were first added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
95
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BF_encrypt.html
vendored
Normal file
95
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BF_encrypt.html
vendored
Normal file
@ -0,0 +1,95 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BF_encrypt</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#NOTE">NOTE</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BF_set_key, BF_encrypt, BF_decrypt, BF_ecb_encrypt, BF_cbc_encrypt, BF_cfb64_encrypt, BF_ofb64_encrypt, BF_options - Blowfish encryption</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/blowfish.h>
|
||||
|
||||
void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
|
||||
|
||||
void BF_ecb_encrypt(const unsigned char *in, unsigned char *out,
|
||||
BF_KEY *key, int enc);
|
||||
void BF_cbc_encrypt(const unsigned char *in, unsigned char *out,
|
||||
long length, BF_KEY *schedule,
|
||||
unsigned char *ivec, int enc);
|
||||
void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out,
|
||||
long length, BF_KEY *schedule,
|
||||
unsigned char *ivec, int *num, int enc);
|
||||
void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out,
|
||||
long length, BF_KEY *schedule,
|
||||
unsigned char *ivec, int *num);
|
||||
const char *BF_options(void);
|
||||
|
||||
void BF_encrypt(BF_LONG *data, const BF_KEY *key);
|
||||
void BF_decrypt(BF_LONG *data, const BF_KEY *key);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>This library implements the Blowfish cipher, which was invented and described by Counterpane (see http://www.counterpane.com/blowfish.html ).</p>
|
||||
|
||||
<p>Blowfish is a block cipher that operates on 64 bit (8 byte) blocks of data. It uses a variable size key, but typically, 128 bit (16 byte) keys are considered good for strong encryption. Blowfish can be used in the same modes as DES (see <a href="../man7/des_modes.html">des_modes(7)</a>). Blowfish is currently one of the faster block ciphers. It is quite a bit faster than DES, and much faster than IDEA or RC2.</p>
|
||||
|
||||
<p>Blowfish consists of a key setup phase and the actual encryption or decryption phase.</p>
|
||||
|
||||
<p>BF_set_key() sets up the <b>BF_KEY</b> <b>key</b> using the <b>len</b> bytes long key at <b>data</b>.</p>
|
||||
|
||||
<p>BF_ecb_encrypt() is the basic Blowfish encryption and decryption function. It encrypts or decrypts the first 64 bits of <b>in</b> using the key <b>key</b>, putting the result in <b>out</b>. <b>enc</b> decides if encryption (<b>BF_ENCRYPT</b>) or decryption (<b>BF_DECRYPT</b>) shall be performed. The vector pointed at by <b>in</b> and <b>out</b> must be 64 bits in length, no less. If they are larger, everything after the first 64 bits is ignored.</p>
|
||||
|
||||
<p>The mode functions BF_cbc_encrypt(), BF_cfb64_encrypt() and BF_ofb64_encrypt() all operate on variable length data. They all take an initialization vector <b>ivec</b> which needs to be passed along into the next call of the same function for the same message. <b>ivec</b> may be initialized with anything, but the recipient needs to know what it was initialized with, or it won't be able to decrypt. Some programs and protocols simplify this, like SSH, where <b>ivec</b> is simply initialized to zero. BF_cbc_encrypt() operates on data that is a multiple of 8 bytes long, while BF_cfb64_encrypt() and BF_ofb64_encrypt() are used to encrypt an variable number of bytes (the amount does not have to be an exact multiple of 8). The purpose of the latter two is to simulate stream ciphers, and therefore, they need the parameter <b>num</b>, which is a pointer to an integer where the current offset in <b>ivec</b> is stored between calls. This integer must be initialized to zero when <b>ivec</b> is initialized.</p>
|
||||
|
||||
<p>BF_cbc_encrypt() is the Cipher Block Chaining function for Blowfish. It encrypts or decrypts the 64 bits chunks of <b>in</b> using the key <b>schedule</b>, putting the result in <b>out</b>. <b>enc</b> decides if encryption (BF_ENCRYPT) or decryption (BF_DECRYPT) shall be performed. <b>ivec</b> must point at an 8 byte long initialization vector.</p>
|
||||
|
||||
<p>BF_cfb64_encrypt() is the CFB mode for Blowfish with 64 bit feedback. It encrypts or decrypts the bytes in <b>in</b> using the key <b>schedule</b>, putting the result in <b>out</b>. <b>enc</b> decides if encryption (<b>BF_ENCRYPT</b>) or decryption (<b>BF_DECRYPT</b>) shall be performed. <b>ivec</b> must point at an 8 byte long initialization vector. <b>num</b> must point at an integer which must be initially zero.</p>
|
||||
|
||||
<p>BF_ofb64_encrypt() is the OFB mode for Blowfish with 64 bit feedback. It uses the same parameters as BF_cfb64_encrypt(), which must be initialized the same way.</p>
|
||||
|
||||
<p>BF_encrypt() and BF_decrypt() are the lowest level functions for Blowfish encryption. They encrypt/decrypt the first 64 bits of the vector pointed by <b>data</b>, using the key <b>key</b>. These functions should not be used unless you implement 'modes' of Blowfish. The alternative is to use BF_ecb_encrypt(). If you still want to use these functions, you should be aware that they take each 32-bit chunk in host-byte order, which is little-endian on little-endian platforms and big-endian on big-endian ones.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>None of the functions presented here return any value.</p>
|
||||
|
||||
<h1 id="NOTE">NOTE</h1>
|
||||
|
||||
<p>Applications should use the higher level functions <a href="../man3/EVP_EncryptInit.html">EVP_EncryptInit(3)</a> etc. instead of calling these functions directly.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/EVP_EncryptInit.html">EVP_EncryptInit(3)</a>, <a href="../man7/des_modes.html">des_modes(7)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
96
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_ADDR.html
vendored
Normal file
96
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_ADDR.html
vendored
Normal file
@ -0,0 +1,96 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_ADDR</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RAW-ADDRESSES">RAW ADDRESSES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_ADDR, BIO_ADDR_new, BIO_ADDR_clear, BIO_ADDR_free, BIO_ADDR_rawmake, BIO_ADDR_family, BIO_ADDR_rawaddress, BIO_ADDR_rawport, BIO_ADDR_hostname_string, BIO_ADDR_service_string, BIO_ADDR_path_string - BIO_ADDR routines</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <sys/types.h>
|
||||
#include <openssl/bio.h>
|
||||
|
||||
typedef union bio_addr_st BIO_ADDR;
|
||||
|
||||
BIO_ADDR *BIO_ADDR_new(void);
|
||||
void BIO_ADDR_free(BIO_ADDR *);
|
||||
void BIO_ADDR_clear(BIO_ADDR *ap);
|
||||
int BIO_ADDR_rawmake(BIO_ADDR *ap, int family,
|
||||
const void *where, size_t wherelen, unsigned short port);
|
||||
int BIO_ADDR_family(const BIO_ADDR *ap);
|
||||
int BIO_ADDR_rawaddress(const BIO_ADDR *ap, void *p, size_t *l);
|
||||
unsigned short BIO_ADDR_rawport(const BIO_ADDR *ap);
|
||||
char *BIO_ADDR_hostname_string(const BIO_ADDR *ap, int numeric);
|
||||
char *BIO_ADDR_service_string(const BIO_ADDR *ap, int numeric);
|
||||
char *BIO_ADDR_path_string(const BIO_ADDR *ap);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>BIO_ADDR</b> type is a wrapper around all types of socket addresses that OpenSSL deals with, currently transparently supporting AF_INET, AF_INET6 and AF_UNIX according to what's available on the platform at hand.</p>
|
||||
|
||||
<p>BIO_ADDR_new() creates a new unfilled <b>BIO_ADDR</b>, to be used with routines that will fill it with information, such as BIO_accept_ex().</p>
|
||||
|
||||
<p>BIO_ADDR_free() frees a <b>BIO_ADDR</b> created with BIO_ADDR_new().</p>
|
||||
|
||||
<p>BIO_ADDR_clear() clears any data held within the provided <b>BIO_ADDR</b> and sets it back to an uninitialised state.</p>
|
||||
|
||||
<p>BIO_ADDR_rawmake() takes a protocol <b>family</b>, an byte array of size <b>wherelen</b> with an address in network byte order pointed at by <b>where</b> and a port number in network byte order in <b>port</b> (except for the <b>AF_UNIX</b> protocol family, where <b>port</b> is meaningless and therefore ignored) and populates the given <b>BIO_ADDR</b> with them. In case this creates a <b>AF_UNIX</b> <b>BIO_ADDR</b>, <b>wherelen</b> is expected to be the length of the path string (not including the terminating NUL, such as the result of a call to strlen()). <i>Read on about the addresses in <a href="#RAW-ADDRESSES">"RAW ADDRESSES"</a> below</i>.</p>
|
||||
|
||||
<p>BIO_ADDR_family() returns the protocol family of the given <b>BIO_ADDR</b>. The possible non-error results are one of the constants AF_INET, AF_INET6 and AF_UNIX. It will also return AF_UNSPEC if the BIO_ADDR has not been initialised.</p>
|
||||
|
||||
<p>BIO_ADDR_rawaddress() will write the raw address of the given <b>BIO_ADDR</b> in the area pointed at by <b>p</b> if <b>p</b> is non-NULL, and will set <b>*l</b> to be the amount of bytes the raw address takes up if <b>l</b> is non-NULL. A technique to only find out the size of the address is a call with <b>p</b> set to <b>NULL</b>. The raw address will be in network byte order, most significant byte first. In case this is a <b>AF_UNIX</b> <b>BIO_ADDR</b>, <b>l</b> gets the length of the path string (not including the terminating NUL, such as the result of a call to strlen()). <i>Read on about the addresses in <a href="#RAW-ADDRESSES">"RAW ADDRESSES"</a> below</i>.</p>
|
||||
|
||||
<p>BIO_ADDR_rawport() returns the raw port of the given <b>BIO_ADDR</b>. The raw port will be in network byte order.</p>
|
||||
|
||||
<p>BIO_ADDR_hostname_string() returns a character string with the hostname of the given <b>BIO_ADDR</b>. If <b>numeric</b> is 1, the string will contain the numerical form of the address. This only works for <b>BIO_ADDR</b> of the protocol families AF_INET and AF_INET6. The returned string has been allocated on the heap and must be freed with OPENSSL_free().</p>
|
||||
|
||||
<p>BIO_ADDR_service_string() returns a character string with the service name of the port of the given <b>BIO_ADDR</b>. If <b>numeric</b> is 1, the string will contain the port number. This only works for <b>BIO_ADDR</b> of the protocol families AF_INET and AF_INET6. The returned string has been allocated on the heap and must be freed with OPENSSL_free().</p>
|
||||
|
||||
<p>BIO_ADDR_path_string() returns a character string with the path of the given <b>BIO_ADDR</b>. This only works for <b>BIO_ADDR</b> of the protocol family AF_UNIX. The returned string has been allocated on the heap and must be freed with OPENSSL_free().</p>
|
||||
|
||||
<h1 id="RAW-ADDRESSES">RAW ADDRESSES</h1>
|
||||
|
||||
<p>Both BIO_ADDR_rawmake() and BIO_ADDR_rawaddress() take a pointer to a network byte order address of a specific site. Internally, those are treated as a pointer to <b>struct in_addr</b> (for <b>AF_INET</b>), <b>struct in6_addr</b> (for <b>AF_INET6</b>) or <b>char *</b> (for <b>AF_UNIX</b>), all depending on the protocol family the address is for.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>The string producing functions BIO_ADDR_hostname_string(), BIO_ADDR_service_string() and BIO_ADDR_path_string() will return <b>NULL</b> on error and leave an error indication on the OpenSSL error stack.</p>
|
||||
|
||||
<p>All other functions described here return 0 or <b>NULL</b> when the information they should return isn't available.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BIO_connect.html">BIO_connect(3)</a>, <a href="../man3/BIO_s_connect.html">BIO_s_connect(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
101
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_ADDRINFO.html
vendored
Normal file
101
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_ADDRINFO.html
vendored
Normal file
@ -0,0 +1,101 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_ADDRINFO</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_lookup_type, BIO_ADDRINFO, BIO_ADDRINFO_next, BIO_ADDRINFO_free, BIO_ADDRINFO_family, BIO_ADDRINFO_socktype, BIO_ADDRINFO_protocol, BIO_ADDRINFO_address, BIO_lookup_ex, BIO_lookup - BIO_ADDRINFO type and routines</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <sys/types.h>
|
||||
#include <openssl/bio.h>
|
||||
|
||||
typedef union bio_addrinfo_st BIO_ADDRINFO;
|
||||
|
||||
enum BIO_lookup_type {
|
||||
BIO_LOOKUP_CLIENT, BIO_LOOKUP_SERVER
|
||||
};
|
||||
|
||||
int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
|
||||
int family, int socktype, int protocol, BIO_ADDRINFO **res);
|
||||
int BIO_lookup(const char *node, const char *service,
|
||||
enum BIO_lookup_type lookup_type,
|
||||
int family, int socktype, BIO_ADDRINFO **res);
|
||||
|
||||
const BIO_ADDRINFO *BIO_ADDRINFO_next(const BIO_ADDRINFO *bai);
|
||||
int BIO_ADDRINFO_family(const BIO_ADDRINFO *bai);
|
||||
int BIO_ADDRINFO_socktype(const BIO_ADDRINFO *bai);
|
||||
int BIO_ADDRINFO_protocol(const BIO_ADDRINFO *bai);
|
||||
const BIO_ADDR *BIO_ADDRINFO_address(const BIO_ADDRINFO *bai);
|
||||
void BIO_ADDRINFO_free(BIO_ADDRINFO *bai);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>BIO_ADDRINFO</b> type is a wrapper for address information types provided on your platform.</p>
|
||||
|
||||
<p><b>BIO_ADDRINFO</b> normally forms a chain of several that can be picked at one by one.</p>
|
||||
|
||||
<p>BIO_lookup_ex() looks up a specified <b>host</b> and <b>service</b>, and uses <b>lookup_type</b> to determine what the default address should be if <b>host</b> is <b>NULL</b>. <b>family</b>, <b>socktype</b> and <b>protocol</b> are used to determine what protocol family, socket type and protocol should be used for the lookup. <b>family</b> can be any of AF_INET, AF_INET6, AF_UNIX and AF_UNSPEC. <b>socktype</b> can be SOCK_STREAM, SOCK_DGRAM or 0. Specifying 0 indicates that any type can be used. <b>protocol</b> specifies a protocol such as IPPROTO_TCP, IPPROTO_UDP or IPPORTO_SCTP. If set to 0 than any protocol can be used. <b>res</b> points at a pointer to hold the start of a <b>BIO_ADDRINFO</b> chain.</p>
|
||||
|
||||
<p>For the family <b>AF_UNIX</b>, BIO_lookup_ex() will ignore the <b>service</b> parameter and expects the <b>node</b> parameter to hold the path to the socket file.</p>
|
||||
|
||||
<p>BIO_lookup() does the same as BIO_lookup_ex() but does not provide the ability to select based on the protocol (any protocol may be returned).</p>
|
||||
|
||||
<p>BIO_ADDRINFO_family() returns the family of the given <b>BIO_ADDRINFO</b>. The result will be one of the constants AF_INET, AF_INET6 and AF_UNIX.</p>
|
||||
|
||||
<p>BIO_ADDRINFO_socktype() returns the socket type of the given <b>BIO_ADDRINFO</b>. The result will be one of the constants SOCK_STREAM and SOCK_DGRAM.</p>
|
||||
|
||||
<p>BIO_ADDRINFO_protocol() returns the protocol id of the given <b>BIO_ADDRINFO</b>. The result will be one of the constants IPPROTO_TCP and IPPROTO_UDP.</p>
|
||||
|
||||
<p>BIO_ADDRINFO_address() returns the underlying <b>BIO_ADDR</b> of the given <b>BIO_ADDRINFO</b>.</p>
|
||||
|
||||
<p>BIO_ADDRINFO_next() returns the next <b>BIO_ADDRINFO</b> in the chain from the given one.</p>
|
||||
|
||||
<p>BIO_ADDRINFO_free() frees the chain of <b>BIO_ADDRINFO</b> starting with the given one.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_lookup_ex() and BIO_lookup() return 1 on success and 0 when an error occurred, and will leave an error indication on the OpenSSL error stack in that case.</p>
|
||||
|
||||
<p>All other functions described here return 0 or <b>NULL</b> when the information they should return isn't available.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The BIO_lookup_ex() implementation uses the platform provided getaddrinfo() function. On Linux it is known that specifying 0 for the protocol will not return any SCTP based addresses when calling getaddrinfo(). Therefore if an SCTP address is required then the <b>protocol</b> parameter to BIO_lookup_ex() should be explicitly set to IPPROTO_SCTP. The same may be true on other platforms.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The BIO_lookup_ex() function was added in OpenSSL 1.1.1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
121
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_connect.html
vendored
Normal file
121
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_connect.html
vendored
Normal file
@ -0,0 +1,121 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_connect</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#FLAGS">FLAGS</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_socket, BIO_bind, BIO_connect, BIO_listen, BIO_accept_ex, BIO_closesocket - BIO socket communication setup routines</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
int BIO_socket(int domain, int socktype, int protocol, int options);
|
||||
int BIO_bind(int sock, const BIO_ADDR *addr, int options);
|
||||
int BIO_connect(int sock, const BIO_ADDR *addr, int options);
|
||||
int BIO_listen(int sock, const BIO_ADDR *addr, int options);
|
||||
int BIO_accept_ex(int accept_sock, BIO_ADDR *peer, int options);
|
||||
int BIO_closesocket(int sock);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_socket() creates a socket in the domain <b>domain</b>, of type <b>socktype</b> and <b>protocol</b>. Socket <b>options</b> are currently unused, but is present for future use.</p>
|
||||
|
||||
<p>BIO_bind() binds the source address and service to a socket and may be useful before calling BIO_connect(). The options may include <b>BIO_SOCK_REUSEADDR</b>, which is described in <a href="#FLAGS">"FLAGS"</a> below.</p>
|
||||
|
||||
<p>BIO_connect() connects <b>sock</b> to the address and service given by <b>addr</b>. Connection <b>options</b> may be zero or any combination of <b>BIO_SOCK_KEEPALIVE</b>, <b>BIO_SOCK_NONBLOCK</b> and <b>BIO_SOCK_NODELAY</b>. The flags are described in <a href="#FLAGS">"FLAGS"</a> below.</p>
|
||||
|
||||
<p>BIO_listen() has <b>sock</b> start listening on the address and service given by <b>addr</b>. Connection <b>options</b> may be zero or any combination of <b>BIO_SOCK_KEEPALIVE</b>, <b>BIO_SOCK_NONBLOCK</b>, <b>BIO_SOCK_NODELAY</b>, <b>BIO_SOCK_REUSEADDR</b> and <b>BIO_SOCK_V6_ONLY</b>. The flags are described in <a href="#FLAGS">"FLAGS"</a> below.</p>
|
||||
|
||||
<p>BIO_accept_ex() waits for an incoming connections on the given socket <b>accept_sock</b>. When it gets a connection, the address and port of the peer gets stored in <b>peer</b> if that one is non-NULL. Accept <b>options</b> may be zero or <b>BIO_SOCK_NONBLOCK</b>, and is applied on the accepted socket. The flags are described in <a href="#FLAGS">"FLAGS"</a> below.</p>
|
||||
|
||||
<p>BIO_closesocket() closes <b>sock</b>.</p>
|
||||
|
||||
<h1 id="FLAGS">FLAGS</h1>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="BIO_SOCK_KEEPALIVE">BIO_SOCK_KEEPALIVE</dt>
|
||||
<dd>
|
||||
|
||||
<p>Enables regular sending of keep-alive messages.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_SOCK_NONBLOCK">BIO_SOCK_NONBLOCK</dt>
|
||||
<dd>
|
||||
|
||||
<p>Sets the socket to non-blocking mode.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_SOCK_NODELAY">BIO_SOCK_NODELAY</dt>
|
||||
<dd>
|
||||
|
||||
<p>Corresponds to <b>TCP_NODELAY</b>, and disables the Nagle algorithm. With this set, any data will be sent as soon as possible instead of being buffered until there's enough for the socket to send out in one go.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_SOCK_REUSEADDR">BIO_SOCK_REUSEADDR</dt>
|
||||
<dd>
|
||||
|
||||
<p>Try to reuse the address and port combination for a recently closed port.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_SOCK_V6_ONLY">BIO_SOCK_V6_ONLY</dt>
|
||||
<dd>
|
||||
|
||||
<p>When creating an IPv6 socket, make it only listen for IPv6 addresses and not IPv4 addresses mapped to IPv6.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<p>These flags are bit flags, so they are to be combined with the <code>|</code> operator, for example:</p>
|
||||
|
||||
<pre><code>BIO_connect(sock, addr, BIO_SOCK_KEEPALIVE | BIO_SOCK_NONBLOCK);</code></pre>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_socket() returns the socket number on success or <b>INVALID_SOCKET</b> (-1) on error. When an error has occurred, the OpenSSL error stack will hold the error data and errno has the system error.</p>
|
||||
|
||||
<p>BIO_bind(), BIO_connect() and BIO_listen() return 1 on success or 0 on error. When an error has occurred, the OpenSSL error stack will hold the error data and errno has the system error.</p>
|
||||
|
||||
<p>BIO_accept_ex() returns the accepted socket on success or <b>INVALID_SOCKET</b> (-1) on error. When an error has occurred, the OpenSSL error stack will hold the error data and errno has the system error.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BIO_ADDR.html">BIO_ADDR(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>BIO_gethostname(), BIO_get_port(), BIO_get_host_ip(), BIO_get_accept_socket() and BIO_accept() were deprecated in OpenSSL 1.1.0. Use the functions described above instead.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
115
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_ctrl.html
vendored
Normal file
115
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_ctrl.html
vendored
Normal file
@ -0,0 +1,115 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_ctrl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_ctrl, BIO_callback_ctrl, BIO_ptr_ctrl, BIO_int_ctrl, BIO_reset, BIO_seek, BIO_tell, BIO_flush, BIO_eof, BIO_set_close, BIO_get_close, BIO_pending, BIO_wpending, BIO_ctrl_pending, BIO_ctrl_wpending, BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb - BIO control operations</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
typedef int BIO_info_cb(BIO *b, int state, int res);
|
||||
|
||||
long BIO_ctrl(BIO *bp, int cmd, long larg, void *parg);
|
||||
long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *cb);
|
||||
char *BIO_ptr_ctrl(BIO *bp, int cmd, long larg);
|
||||
long BIO_int_ctrl(BIO *bp, int cmd, long larg, int iarg);
|
||||
|
||||
int BIO_reset(BIO *b);
|
||||
int BIO_seek(BIO *b, int ofs);
|
||||
int BIO_tell(BIO *b);
|
||||
int BIO_flush(BIO *b);
|
||||
int BIO_eof(BIO *b);
|
||||
int BIO_set_close(BIO *b, long flag);
|
||||
int BIO_get_close(BIO *b);
|
||||
int BIO_pending(BIO *b);
|
||||
int BIO_wpending(BIO *b);
|
||||
size_t BIO_ctrl_pending(BIO *b);
|
||||
size_t BIO_ctrl_wpending(BIO *b);
|
||||
|
||||
int BIO_get_info_callback(BIO *b, BIO_info_cb **cbp);
|
||||
int BIO_set_info_callback(BIO *b, BIO_info_cb *cb);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_ctrl(), BIO_callback_ctrl(), BIO_ptr_ctrl() and BIO_int_ctrl() are BIO "control" operations taking arguments of various types. These functions are not normally called directly, various macros are used instead. The standard macros are described below, macros specific to a particular type of BIO are described in the specific BIOs manual page as well as any special features of the standard calls.</p>
|
||||
|
||||
<p>BIO_reset() typically resets a BIO to some initial state, in the case of file related BIOs for example it rewinds the file pointer to the start of the file.</p>
|
||||
|
||||
<p>BIO_seek() resets a file related BIO's (that is file descriptor and FILE BIOs) file position pointer to <b>ofs</b> bytes from start of file.</p>
|
||||
|
||||
<p>BIO_tell() returns the current file position of a file related BIO.</p>
|
||||
|
||||
<p>BIO_flush() normally writes out any internally buffered data, in some cases it is used to signal EOF and that no more data will be written.</p>
|
||||
|
||||
<p>BIO_eof() returns 1 if the BIO has read EOF, the precise meaning of "EOF" varies according to the BIO type.</p>
|
||||
|
||||
<p>BIO_set_close() sets the BIO <b>b</b> close flag to <b>flag</b>. <b>flag</b> can take the value BIO_CLOSE or BIO_NOCLOSE. Typically BIO_CLOSE is used in a source/sink BIO to indicate that the underlying I/O stream should be closed when the BIO is freed.</p>
|
||||
|
||||
<p>BIO_get_close() returns the BIOs close flag.</p>
|
||||
|
||||
<p>BIO_pending(), BIO_ctrl_pending(), BIO_wpending() and BIO_ctrl_wpending() return the number of pending characters in the BIOs read and write buffers. Not all BIOs support these calls. BIO_ctrl_pending() and BIO_ctrl_wpending() return a size_t type and are functions, BIO_pending() and BIO_wpending() are macros which call BIO_ctrl().</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_reset() normally returns 1 for success and 0 or -1 for failure. File BIOs are an exception, they return 0 for success and -1 for failure.</p>
|
||||
|
||||
<p>BIO_seek() and BIO_tell() both return the current file position on success and -1 for failure, except file BIOs which for BIO_seek() always return 0 for success and -1 for failure.</p>
|
||||
|
||||
<p>BIO_flush() returns 1 for success and 0 or -1 for failure.</p>
|
||||
|
||||
<p>BIO_eof() returns 1 if EOF has been reached 0 otherwise.</p>
|
||||
|
||||
<p>BIO_set_close() always returns 1.</p>
|
||||
|
||||
<p>BIO_get_close() returns the close flag value: BIO_CLOSE or BIO_NOCLOSE.</p>
|
||||
|
||||
<p>BIO_pending(), BIO_ctrl_pending(), BIO_wpending() and BIO_ctrl_wpending() return the amount of pending data.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>BIO_flush(), because it can write data may return 0 or -1 indicating that the call should be retried later in a similar manner to BIO_write_ex(). The BIO_should_retry() call should be used and appropriate action taken is the call fails.</p>
|
||||
|
||||
<p>The return values of BIO_pending() and BIO_wpending() may not reliably determine the amount of pending data in all cases. For example in the case of a file BIO some data may be available in the FILE structures internal buffers but it is not possible to determine this in a portably way. For other types of BIO they may not be supported.</p>
|
||||
|
||||
<p>Filter BIOs if they do not internally handle a particular BIO_ctrl() operation usually pass the operation to the next BIO in the chain. This often means there is no need to locate the required BIO for a particular operation, it can be called on a chain and it will be automatically passed to the relevant BIO. However this can cause unexpected results: for example no current filter BIOs implement BIO_seek(), but this may still succeed if the chain ends in a FILE or file descriptor BIO.</p>
|
||||
|
||||
<p>Source/sink BIOs return an 0 if they do not recognize the BIO_ctrl() operation.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>Some of the return values are ambiguous and care should be taken. In particular a return value of 0 can be returned if an operation is not supported, if an error occurred, if EOF has not been reached and in the case of BIO_seek() on a file BIO for a successful operation.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
102
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_base64.html
vendored
Normal file
102
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_base64.html
vendored
Normal file
@ -0,0 +1,102 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_f_base64</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_f_base64 - base64 BIO filter</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
#include <openssl/evp.h>
|
||||
|
||||
const BIO_METHOD *BIO_f_base64(void);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_f_base64() returns the base64 BIO method. This is a filter BIO that base64 encodes any data written through it and decodes any data read through it.</p>
|
||||
|
||||
<p>Base64 BIOs do not support BIO_gets() or BIO_puts().</p>
|
||||
|
||||
<p>BIO_flush() on a base64 BIO that is being written through is used to signal that no more data is to be encoded: this is used to flush the final block through the BIO.</p>
|
||||
|
||||
<p>The flag BIO_FLAGS_BASE64_NO_NL can be set with BIO_set_flags() to encode the data all on one line or expect the data to be all on one line.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Because of the format of base64 encoding the end of the encoded block cannot always be reliably determined.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_f_base64() returns the base64 BIO method.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Base64 encode the string "Hello World\n" and write the result to standard output:</p>
|
||||
|
||||
<pre><code>BIO *bio, *b64;
|
||||
char message[] = "Hello World \n";
|
||||
|
||||
b64 = BIO_new(BIO_f_base64());
|
||||
bio = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
BIO_push(b64, bio);
|
||||
BIO_write(b64, message, strlen(message));
|
||||
BIO_flush(b64);
|
||||
|
||||
BIO_free_all(b64);</code></pre>
|
||||
|
||||
<p>Read Base64 encoded data from standard input and write the decoded data to standard output:</p>
|
||||
|
||||
<pre><code>BIO *bio, *b64, *bio_out;
|
||||
char inbuf[512];
|
||||
int inlen;
|
||||
|
||||
b64 = BIO_new(BIO_f_base64());
|
||||
bio = BIO_new_fp(stdin, BIO_NOCLOSE);
|
||||
bio_out = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
BIO_push(b64, bio);
|
||||
while ((inlen = BIO_read(b64, inbuf, 512)) > 0)
|
||||
BIO_write(bio_out, inbuf, inlen);
|
||||
|
||||
BIO_flush(bio_out);
|
||||
BIO_free_all(b64);</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The ambiguity of EOF in base64 encoded data can cause additional data following the base64 encoded block to be misinterpreted.</p>
|
||||
|
||||
<p>There should be some way of specifying a test that the BIO can perform to reliably determine EOF (for example a MIME boundary).</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
89
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_buffer.html
vendored
Normal file
89
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_buffer.html
vendored
Normal file
@ -0,0 +1,89 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_f_buffer</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_get_buffer_num_lines, BIO_set_read_buffer_size, BIO_set_write_buffer_size, BIO_set_buffer_size, BIO_set_buffer_read_data, BIO_f_buffer - buffering BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_f_buffer(void);
|
||||
|
||||
long BIO_get_buffer_num_lines(BIO *b);
|
||||
long BIO_set_read_buffer_size(BIO *b, long size);
|
||||
long BIO_set_write_buffer_size(BIO *b, long size);
|
||||
long BIO_set_buffer_size(BIO *b, long size);
|
||||
long BIO_set_buffer_read_data(BIO *b, void *buf, long num);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_f_buffer() returns the buffering BIO method.</p>
|
||||
|
||||
<p>Data written to a buffering BIO is buffered and periodically written to the next BIO in the chain. Data read from a buffering BIO comes from an internal buffer which is filled from the next BIO in the chain. Both BIO_gets() and BIO_puts() are supported.</p>
|
||||
|
||||
<p>Calling BIO_reset() on a buffering BIO clears any buffered data.</p>
|
||||
|
||||
<p>BIO_get_buffer_num_lines() returns the number of lines currently buffered.</p>
|
||||
|
||||
<p>BIO_set_read_buffer_size(), BIO_set_write_buffer_size() and BIO_set_buffer_size() set the read, write or both read and write buffer sizes to <b>size</b>. The initial buffer size is DEFAULT_BUFFER_SIZE, currently 4096. Any attempt to reduce the buffer size below DEFAULT_BUFFER_SIZE is ignored. Any buffered data is cleared when the buffer is resized.</p>
|
||||
|
||||
<p>BIO_set_buffer_read_data() clears the read buffer and fills it with <b>num</b> bytes of <b>buf</b>. If <b>num</b> is larger than the current buffer size the buffer is expanded.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>These functions, other than BIO_f_buffer(), are implemented as macros.</p>
|
||||
|
||||
<p>Buffering BIOs implement BIO_read_ex() and BIO_gets() by using BIO_read_ex() operations on the next BIO in the chain and storing the result in an internal buffer, from which bytes are given back to the caller as appropriate for the call; a BIO_gets() is guaranteed to give the caller a whole line, and BIO_read_ex() is guaranteed to give the caller the number of bytes it asks for, unless there's an error or end of communication is reached in the next BIO. By prepending a buffering BIO to a chain it is therefore possible to provide BIO_gets() or exact size BIO_read_ex() functionality if the following BIOs do not support it.</p>
|
||||
|
||||
<p>Do not add more than one BIO_f_buffer() to a BIO chain. The result of doing so will force a full read of the size of the internal buffer of the top BIO_f_buffer(), which is 4 KiB at a minimum.</p>
|
||||
|
||||
<p>Data is only written to the next BIO in the chain when the write buffer fills or when BIO_flush() is called. It is therefore important to call BIO_flush() whenever any pending data should be written such as when removing a buffering BIO using BIO_pop(). BIO_flush() may need to be retried if the ultimate source/sink BIO is non blocking.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_f_buffer() returns the buffering BIO method.</p>
|
||||
|
||||
<p>BIO_get_buffer_num_lines() returns the number of lines buffered (may be 0).</p>
|
||||
|
||||
<p>BIO_set_read_buffer_size(), BIO_set_write_buffer_size() and BIO_set_buffer_size() return 1 if the buffer was successfully resized or 0 for failure.</p>
|
||||
|
||||
<p>BIO_set_buffer_read_data() returns 1 if the data was set correctly or 0 if there was an error.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man7/bio.html">bio(7)</a>, <a href="../man3/BIO_reset.html">BIO_reset(3)</a>, <a href="../man3/BIO_flush.html">BIO_flush(3)</a>, <a href="../man3/BIO_pop.html">BIO_pop(3)</a>, <a href="../man3/BIO_ctrl.html">BIO_ctrl(3)</a>.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
81
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_cipher.html
vendored
Normal file
81
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_cipher.html
vendored
Normal file
@ -0,0 +1,81 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_f_cipher</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_f_cipher, BIO_set_cipher, BIO_get_cipher_status, BIO_get_cipher_ctx - cipher BIO filter</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
#include <openssl/evp.h>
|
||||
|
||||
const BIO_METHOD *BIO_f_cipher(void);
|
||||
void BIO_set_cipher(BIO *b, const EVP_CIPHER *cipher,
|
||||
unsigned char *key, unsigned char *iv, int enc);
|
||||
int BIO_get_cipher_status(BIO *b)
|
||||
int BIO_get_cipher_ctx(BIO *b, EVP_CIPHER_CTX **pctx)</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_f_cipher() returns the cipher BIO method. This is a filter BIO that encrypts any data written through it, and decrypts any data read from it. It is a BIO wrapper for the cipher routines EVP_CipherInit(), EVP_CipherUpdate() and EVP_CipherFinal().</p>
|
||||
|
||||
<p>Cipher BIOs do not support BIO_gets() or BIO_puts().</p>
|
||||
|
||||
<p>BIO_flush() on an encryption BIO that is being written through is used to signal that no more data is to be encrypted: this is used to flush and possibly pad the final block through the BIO.</p>
|
||||
|
||||
<p>BIO_set_cipher() sets the cipher of BIO <b>b</b> to <b>cipher</b> using key <b>key</b> and IV <b>iv</b>. <b>enc</b> should be set to 1 for encryption and zero for decryption.</p>
|
||||
|
||||
<p>When reading from an encryption BIO the final block is automatically decrypted and checked when EOF is detected. BIO_get_cipher_status() is a BIO_ctrl() macro which can be called to determine whether the decryption operation was successful.</p>
|
||||
|
||||
<p>BIO_get_cipher_ctx() is a BIO_ctrl() macro which retrieves the internal BIO cipher context. The retrieved context can be used in conjunction with the standard cipher routines to set it up. This is useful when BIO_set_cipher() is not flexible enough for the applications needs.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>When encrypting BIO_flush() <b>must</b> be called to flush the final block through the BIO. If it is not then the final block will fail a subsequent decrypt.</p>
|
||||
|
||||
<p>When decrypting an error on the final block is signaled by a zero return value from the read operation. A successful decrypt followed by EOF will also return zero for the final read. BIO_get_cipher_status() should be called to determine if the decrypt was successful.</p>
|
||||
|
||||
<p>As always, if BIO_gets() or BIO_puts() support is needed then it can be achieved by preceding the cipher BIO with a buffering BIO.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_f_cipher() returns the cipher BIO method.</p>
|
||||
|
||||
<p>BIO_set_cipher() does not return a value.</p>
|
||||
|
||||
<p>BIO_get_cipher_status() returns 1 for a successful decrypt and 0 for failure.</p>
|
||||
|
||||
<p>BIO_get_cipher_ctx() currently always returns 1.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
156
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_md.html
vendored
Normal file
156
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_md.html
vendored
Normal file
@ -0,0 +1,156 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_f_md</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_f_md, BIO_set_md, BIO_get_md, BIO_get_md_ctx - message digest BIO filter</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
#include <openssl/evp.h>
|
||||
|
||||
const BIO_METHOD *BIO_f_md(void);
|
||||
int BIO_set_md(BIO *b, EVP_MD *md);
|
||||
int BIO_get_md(BIO *b, EVP_MD **mdp);
|
||||
int BIO_get_md_ctx(BIO *b, EVP_MD_CTX **mdcp);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_f_md() returns the message digest BIO method. This is a filter BIO that digests any data passed through it, it is a BIO wrapper for the digest routines EVP_DigestInit(), EVP_DigestUpdate() and EVP_DigestFinal().</p>
|
||||
|
||||
<p>Any data written or read through a digest BIO using BIO_read_ex() and BIO_write_ex() is digested.</p>
|
||||
|
||||
<p>BIO_gets(), if its <b>size</b> parameter is large enough finishes the digest calculation and returns the digest value. BIO_puts() is not supported.</p>
|
||||
|
||||
<p>BIO_reset() reinitialises a digest BIO.</p>
|
||||
|
||||
<p>BIO_set_md() sets the message digest of BIO <b>b</b> to <b>md</b>: this must be called to initialize a digest BIO before any data is passed through it. It is a BIO_ctrl() macro.</p>
|
||||
|
||||
<p>BIO_get_md() places the a pointer to the digest BIOs digest method in <b>mdp</b>, it is a BIO_ctrl() macro.</p>
|
||||
|
||||
<p>BIO_get_md_ctx() returns the digest BIOs context into <b>mdcp</b>.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The context returned by BIO_get_md_ctx() can be used in calls to EVP_DigestFinal() and also the signature routines EVP_SignFinal() and EVP_VerifyFinal().</p>
|
||||
|
||||
<p>The context returned by BIO_get_md_ctx() is an internal context structure. Changes made to this context will affect the digest BIO itself and the context pointer will become invalid when the digest BIO is freed.</p>
|
||||
|
||||
<p>After the digest has been retrieved from a digest BIO it must be reinitialized by calling BIO_reset(), or BIO_set_md() before any more data is passed through it.</p>
|
||||
|
||||
<p>If an application needs to call BIO_gets() or BIO_puts() through a chain containing digest BIOs then this can be done by prepending a buffering BIO.</p>
|
||||
|
||||
<p>Calling BIO_get_md_ctx() will return the context and initialize the BIO state. This allows applications to initialize the context externally if the standard calls such as BIO_set_md() are not sufficiently flexible.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_f_md() returns the digest BIO method.</p>
|
||||
|
||||
<p>BIO_set_md(), BIO_get_md() and BIO_md_ctx() return 1 for success and 0 for failure.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>The following example creates a BIO chain containing an SHA1 and MD5 digest BIO and passes the string "Hello World" through it. Error checking has been omitted for clarity.</p>
|
||||
|
||||
<pre><code>BIO *bio, *mdtmp;
|
||||
char message[] = "Hello World";
|
||||
|
||||
bio = BIO_new(BIO_s_null());
|
||||
mdtmp = BIO_new(BIO_f_md());
|
||||
BIO_set_md(mdtmp, EVP_sha1());
|
||||
/*
|
||||
* For BIO_push() we want to append the sink BIO and keep a note of
|
||||
* the start of the chain.
|
||||
*/
|
||||
bio = BIO_push(mdtmp, bio);
|
||||
mdtmp = BIO_new(BIO_f_md());
|
||||
BIO_set_md(mdtmp, EVP_md5());
|
||||
bio = BIO_push(mdtmp, bio);
|
||||
/* Note: mdtmp can now be discarded */
|
||||
BIO_write(bio, message, strlen(message));</code></pre>
|
||||
|
||||
<p>The next example digests data by reading through a chain instead:</p>
|
||||
|
||||
<pre><code>BIO *bio, *mdtmp;
|
||||
char buf[1024];
|
||||
int rdlen;
|
||||
|
||||
bio = BIO_new_file(file, "rb");
|
||||
mdtmp = BIO_new(BIO_f_md());
|
||||
BIO_set_md(mdtmp, EVP_sha1());
|
||||
bio = BIO_push(mdtmp, bio);
|
||||
mdtmp = BIO_new(BIO_f_md());
|
||||
BIO_set_md(mdtmp, EVP_md5());
|
||||
bio = BIO_push(mdtmp, bio);
|
||||
do {
|
||||
rdlen = BIO_read(bio, buf, sizeof(buf));
|
||||
/* Might want to do something with the data here */
|
||||
} while (rdlen > 0);</code></pre>
|
||||
|
||||
<p>This next example retrieves the message digests from a BIO chain and outputs them. This could be used with the examples above.</p>
|
||||
|
||||
<pre><code>BIO *mdtmp;
|
||||
unsigned char mdbuf[EVP_MAX_MD_SIZE];
|
||||
int mdlen;
|
||||
int i;
|
||||
|
||||
mdtmp = bio; /* Assume bio has previously been set up */
|
||||
do {
|
||||
EVP_MD *md;
|
||||
|
||||
mdtmp = BIO_find_type(mdtmp, BIO_TYPE_MD);
|
||||
if (!mdtmp)
|
||||
break;
|
||||
BIO_get_md(mdtmp, &md);
|
||||
printf("%s digest", OBJ_nid2sn(EVP_MD_type(md)));
|
||||
mdlen = BIO_gets(mdtmp, mdbuf, EVP_MAX_MD_SIZE);
|
||||
for (i = 0; i < mdlen; i++) printf(":%02X", mdbuf[i]);
|
||||
printf("\n");
|
||||
mdtmp = BIO_next(mdtmp);
|
||||
} while (mdtmp);
|
||||
|
||||
BIO_free_all(bio);</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The lack of support for BIO_puts() and the non standard behaviour of BIO_gets() could be regarded as anomalous. It could be argued that BIO_gets() and BIO_puts() should be passed to the next BIO in the chain and digest the data passed through and that digests should be retrieved using a separate BIO_ctrl() call.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>Before OpenSSL 1.0.0., the call to BIO_get_md_ctx() would only work if the BIO was initialized first.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
58
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_null.html
vendored
Normal file
58
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_null.html
vendored
Normal file
@ -0,0 +1,58 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_f_null</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_f_null - null filter</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_f_null(void);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_f_null() returns the null filter BIO method. This is a filter BIO that does nothing.</p>
|
||||
|
||||
<p>All requests to a null filter BIO are passed through to the next BIO in the chain: this means that a BIO chain containing a null filter BIO behaves just as though the BIO was not there.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>As may be apparent a null filter BIO is not particularly useful.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_f_null() returns the null filter BIO method.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
263
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_ssl.html
vendored
Normal file
263
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_f_ssl.html
vendored
Normal file
@ -0,0 +1,263 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_f_ssl</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_do_handshake, BIO_f_ssl, BIO_set_ssl, BIO_get_ssl, BIO_set_ssl_mode, BIO_set_ssl_renegotiate_bytes, BIO_get_num_renegotiates, BIO_set_ssl_renegotiate_timeout, BIO_new_ssl, BIO_new_ssl_connect, BIO_new_buffer_ssl_connect, BIO_ssl_copy_session_id, BIO_ssl_shutdown - SSL BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
const BIO_METHOD *BIO_f_ssl(void);
|
||||
|
||||
long BIO_set_ssl(BIO *b, SSL *ssl, long c);
|
||||
long BIO_get_ssl(BIO *b, SSL **sslp);
|
||||
long BIO_set_ssl_mode(BIO *b, long client);
|
||||
long BIO_set_ssl_renegotiate_bytes(BIO *b, long num);
|
||||
long BIO_set_ssl_renegotiate_timeout(BIO *b, long seconds);
|
||||
long BIO_get_num_renegotiates(BIO *b);
|
||||
|
||||
BIO *BIO_new_ssl(SSL_CTX *ctx, int client);
|
||||
BIO *BIO_new_ssl_connect(SSL_CTX *ctx);
|
||||
BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx);
|
||||
int BIO_ssl_copy_session_id(BIO *to, BIO *from);
|
||||
void BIO_ssl_shutdown(BIO *bio);
|
||||
|
||||
long BIO_do_handshake(BIO *b);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_f_ssl() returns the SSL BIO method. This is a filter BIO which is a wrapper round the OpenSSL SSL routines adding a BIO "flavour" to SSL I/O.</p>
|
||||
|
||||
<p>I/O performed on an SSL BIO communicates using the SSL protocol with the SSLs read and write BIOs. If an SSL connection is not established then an attempt is made to establish one on the first I/O call.</p>
|
||||
|
||||
<p>If a BIO is appended to an SSL BIO using BIO_push() it is automatically used as the SSL BIOs read and write BIOs.</p>
|
||||
|
||||
<p>Calling BIO_reset() on an SSL BIO closes down any current SSL connection by calling SSL_shutdown(). BIO_reset() is then sent to the next BIO in the chain: this will typically disconnect the underlying transport. The SSL BIO is then reset to the initial accept or connect state.</p>
|
||||
|
||||
<p>If the close flag is set when an SSL BIO is freed then the internal SSL structure is also freed using SSL_free().</p>
|
||||
|
||||
<p>BIO_set_ssl() sets the internal SSL pointer of BIO <b>b</b> to <b>ssl</b> using the close flag <b>c</b>.</p>
|
||||
|
||||
<p>BIO_get_ssl() retrieves the SSL pointer of BIO <b>b</b>, it can then be manipulated using the standard SSL library functions.</p>
|
||||
|
||||
<p>BIO_set_ssl_mode() sets the SSL BIO mode to <b>client</b>. If <b>client</b> is 1 client mode is set. If <b>client</b> is 0 server mode is set.</p>
|
||||
|
||||
<p>BIO_set_ssl_renegotiate_bytes() sets the renegotiate byte count to <b>num</b>. When set after every <b>num</b> bytes of I/O (read and write) the SSL session is automatically renegotiated. <b>num</b> must be at least 512 bytes.</p>
|
||||
|
||||
<p>BIO_set_ssl_renegotiate_timeout() sets the renegotiate timeout to <b>seconds</b>. When the renegotiate timeout elapses the session is automatically renegotiated.</p>
|
||||
|
||||
<p>BIO_get_num_renegotiates() returns the total number of session renegotiations due to I/O or timeout.</p>
|
||||
|
||||
<p>BIO_new_ssl() allocates an SSL BIO using SSL_CTX <b>ctx</b> and using client mode if <b>client</b> is non zero.</p>
|
||||
|
||||
<p>BIO_new_ssl_connect() creates a new BIO chain consisting of an SSL BIO (using <b>ctx</b>) followed by a connect BIO.</p>
|
||||
|
||||
<p>BIO_new_buffer_ssl_connect() creates a new BIO chain consisting of a buffering BIO, an SSL BIO (using <b>ctx</b>) and a connect BIO.</p>
|
||||
|
||||
<p>BIO_ssl_copy_session_id() copies an SSL session id between BIO chains <b>from</b> and <b>to</b>. It does this by locating the SSL BIOs in each chain and calling SSL_copy_session_id() on the internal SSL pointer.</p>
|
||||
|
||||
<p>BIO_ssl_shutdown() closes down an SSL connection on BIO chain <b>bio</b>. It does this by locating the SSL BIO in the chain and calling SSL_shutdown() on its internal SSL pointer.</p>
|
||||
|
||||
<p>BIO_do_handshake() attempts to complete an SSL handshake on the supplied BIO and establish the SSL connection. It returns 1 if the connection was established successfully. A zero or negative value is returned if the connection could not be established, the call BIO_should_retry() should be used for non blocking connect BIOs to determine if the call should be retried. If an SSL connection has already been established this call has no effect.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>SSL BIOs are exceptional in that if the underlying transport is non blocking they can still request a retry in exceptional circumstances. Specifically this will happen if a session renegotiation takes place during a BIO_read_ex() operation, one case where this happens is when step up occurs.</p>
|
||||
|
||||
<p>The SSL flag SSL_AUTO_RETRY can be set to disable this behaviour. That is when this flag is set an SSL BIO using a blocking transport will never request a retry.</p>
|
||||
|
||||
<p>Since unknown BIO_ctrl() operations are sent through filter BIOs the servers name and port can be set using BIO_set_host() on the BIO returned by BIO_new_ssl_connect() without having to locate the connect BIO first.</p>
|
||||
|
||||
<p>Applications do not have to call BIO_do_handshake() but may wish to do so to separate the handshake process from other I/O processing.</p>
|
||||
|
||||
<p>BIO_set_ssl(), BIO_get_ssl(), BIO_set_ssl_mode(), BIO_set_ssl_renegotiate_bytes(), BIO_set_ssl_renegotiate_timeout(), BIO_get_num_renegotiates(), and BIO_do_handshake() are implemented as macros.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_f_ssl() returns the SSL <b>BIO_METHOD</b> structure.</p>
|
||||
|
||||
<p>BIO_set_ssl(), BIO_get_ssl(), BIO_set_ssl_mode(), BIO_set_ssl_renegotiate_bytes(), BIO_set_ssl_renegotiate_timeout() and BIO_get_num_renegotiates() return 1 on success or a value which is less than or equal to 0 if an error occurred.</p>
|
||||
|
||||
<p>BIO_new_ssl(), BIO_new_ssl_connect() and BIO_new_buffer_ssl_connect() return a valid <b>BIO</b> structure on success or <b>NULL</b> if an error occurred.</p>
|
||||
|
||||
<p>BIO_ssl_copy_session_id() returns 1 on success or 0 on error.</p>
|
||||
|
||||
<p>BIO_do_handshake() returns 1 if the connection was established successfully. A zero or negative value is returned if the connection could not be established.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>This SSL/TLS client example attempts to retrieve a page from an SSL/TLS web server. The I/O routines are identical to those of the unencrypted example in <a href="../man3/BIO_s_connect.html">BIO_s_connect(3)</a>.</p>
|
||||
|
||||
<pre><code>BIO *sbio, *out;
|
||||
int len;
|
||||
char tmpbuf[1024];
|
||||
SSL_CTX *ctx;
|
||||
SSL *ssl;
|
||||
|
||||
/* XXX Seed the PRNG if needed. */
|
||||
|
||||
ctx = SSL_CTX_new(TLS_client_method());
|
||||
|
||||
/* XXX Set verify paths and mode here. */
|
||||
|
||||
sbio = BIO_new_ssl_connect(ctx);
|
||||
BIO_get_ssl(sbio, &ssl);
|
||||
if (ssl == NULL) {
|
||||
fprintf(stderr, "Can't locate SSL pointer\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* Don't want any retries */
|
||||
SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
|
||||
|
||||
/* XXX We might want to do other things with ssl here */
|
||||
|
||||
/* An empty host part means the loopback address */
|
||||
BIO_set_conn_hostname(sbio, ":https");
|
||||
|
||||
out = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
if (BIO_do_connect(sbio) <= 0) {
|
||||
fprintf(stderr, "Error connecting to server\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
if (BIO_do_handshake(sbio) <= 0) {
|
||||
fprintf(stderr, "Error establishing SSL connection\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* XXX Could examine ssl here to get connection info */
|
||||
|
||||
BIO_puts(sbio, "GET / HTTP/1.0\n\n");
|
||||
for (;;) {
|
||||
len = BIO_read(sbio, tmpbuf, 1024);
|
||||
if (len <= 0)
|
||||
break;
|
||||
BIO_write(out, tmpbuf, len);
|
||||
}
|
||||
BIO_free_all(sbio);
|
||||
BIO_free(out);</code></pre>
|
||||
|
||||
<p>Here is a simple server example. It makes use of a buffering BIO to allow lines to be read from the SSL BIO using BIO_gets. It creates a pseudo web page containing the actual request from a client and also echoes the request to standard output.</p>
|
||||
|
||||
<pre><code>BIO *sbio, *bbio, *acpt, *out;
|
||||
int len;
|
||||
char tmpbuf[1024];
|
||||
SSL_CTX *ctx;
|
||||
SSL *ssl;
|
||||
|
||||
/* XXX Seed the PRNG if needed. */
|
||||
|
||||
ctx = SSL_CTX_new(TLS_server_method());
|
||||
if (!SSL_CTX_use_certificate_file(ctx, "server.pem", SSL_FILETYPE_PEM)
|
||||
|| !SSL_CTX_use_PrivateKey_file(ctx, "server.pem", SSL_FILETYPE_PEM)
|
||||
|| !SSL_CTX_check_private_key(ctx)) {
|
||||
fprintf(stderr, "Error setting up SSL_CTX\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* XXX Other things like set verify locations, EDH temp callbacks. */
|
||||
|
||||
/* New SSL BIO setup as server */
|
||||
sbio = BIO_new_ssl(ctx, 0);
|
||||
BIO_get_ssl(sbio, &ssl);
|
||||
if (ssl == NULL) {
|
||||
fprintf(stderr, "Can't locate SSL pointer\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
|
||||
bbio = BIO_new(BIO_f_buffer());
|
||||
sbio = BIO_push(bbio, sbio);
|
||||
acpt = BIO_new_accept("4433");
|
||||
|
||||
/*
|
||||
* By doing this when a new connection is established
|
||||
* we automatically have sbio inserted into it. The
|
||||
* BIO chain is now 'swallowed' by the accept BIO and
|
||||
* will be freed when the accept BIO is freed.
|
||||
*/
|
||||
BIO_set_accept_bios(acpt, sbio);
|
||||
out = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
|
||||
/* Setup accept BIO */
|
||||
if (BIO_do_accept(acpt) <= 0) {
|
||||
fprintf(stderr, "Error setting up accept BIO\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* We only want one connection so remove and free accept BIO */
|
||||
sbio = BIO_pop(acpt);
|
||||
BIO_free_all(acpt);
|
||||
|
||||
if (BIO_do_handshake(sbio) <= 0) {
|
||||
fprintf(stderr, "Error in SSL handshake\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
BIO_puts(sbio, "HTTP/1.0 200 OK\r\nContent-type: text/plain\r\n\r\n");
|
||||
BIO_puts(sbio, "\r\nConnection Established\r\nRequest headers:\r\n");
|
||||
BIO_puts(sbio, "--------------------------------------------------\r\n");
|
||||
|
||||
for (;;) {
|
||||
len = BIO_gets(sbio, tmpbuf, 1024);
|
||||
if (len <= 0)
|
||||
break;
|
||||
BIO_write(sbio, tmpbuf, len);
|
||||
BIO_write(out, tmpbuf, len);
|
||||
/* Look for blank line signifying end of headers*/
|
||||
if (tmpbuf[0] == '\r' || tmpbuf[0] == '\n')
|
||||
break;
|
||||
}
|
||||
|
||||
BIO_puts(sbio, "--------------------------------------------------\r\n");
|
||||
BIO_puts(sbio, "\r\n");
|
||||
BIO_flush(sbio);
|
||||
BIO_free_all(sbio);</code></pre>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>In OpenSSL before 1.0.0 the BIO_pop() call was handled incorrectly, the I/O BIO reference count was incorrectly incremented (instead of decremented) and dissociated with the SSL BIO even if the SSL BIO was not explicitly being popped (e.g. a pop higher up the chain). Applications which included workarounds for this bug (e.g. freeing BIOs more than once) should be modified to handle this fix or they may free up an already freed BIO.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
83
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_find_type.html
vendored
Normal file
83
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_find_type.html
vendored
Normal file
@ -0,0 +1,83 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_find_type</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_find_type, BIO_next, BIO_method_type - BIO chain traversal</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
BIO *BIO_find_type(BIO *b, int bio_type);
|
||||
BIO *BIO_next(BIO *b);
|
||||
int BIO_method_type(const BIO *b);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The BIO_find_type() searches for a BIO of a given type in a chain, starting at BIO <b>b</b>. If <b>type</b> is a specific type (such as <b>BIO_TYPE_MEM</b>) then a search is made for a BIO of that type. If <b>type</b> is a general type (such as <b>BIO_TYPE_SOURCE_SINK</b>) then the next matching BIO of the given general type is searched for. BIO_find_type() returns the next matching BIO or NULL if none is found.</p>
|
||||
|
||||
<p>The following general types are defined: <b>BIO_TYPE_DESCRIPTOR</b>, <b>BIO_TYPE_FILTER</b>, and <b>BIO_TYPE_SOURCE_SINK</b>.</p>
|
||||
|
||||
<p>For a list of the specific types, see the <b>openssl/bio.h</b> header file.</p>
|
||||
|
||||
<p>BIO_next() returns the next BIO in a chain. It can be used to traverse all BIOs in a chain or used in conjunction with BIO_find_type() to find all BIOs of a certain type.</p>
|
||||
|
||||
<p>BIO_method_type() returns the type of a BIO.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_find_type() returns a matching BIO or NULL for no match.</p>
|
||||
|
||||
<p>BIO_next() returns the next BIO in a chain.</p>
|
||||
|
||||
<p>BIO_method_type() returns the type of the BIO <b>b</b>.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Traverse a chain looking for digest BIOs:</p>
|
||||
|
||||
<pre><code>BIO *btmp;
|
||||
|
||||
btmp = in_bio; /* in_bio is chain to search through */
|
||||
do {
|
||||
btmp = BIO_find_type(btmp, BIO_TYPE_MD);
|
||||
if (btmp == NULL)
|
||||
break; /* Not found */
|
||||
/* btmp is a digest BIO, do something with it ...*/
|
||||
...
|
||||
|
||||
btmp = BIO_next(btmp);
|
||||
} while (btmp);</code></pre>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
76
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_get_data.html
vendored
Normal file
76
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_get_data.html
vendored
Normal file
@ -0,0 +1,76 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_get_data</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_set_data, BIO_get_data, BIO_set_init, BIO_get_init, BIO_set_shutdown, BIO_get_shutdown - functions for managing BIO state information</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
void BIO_set_data(BIO *a, void *ptr);
|
||||
void *BIO_get_data(BIO *a);
|
||||
void BIO_set_init(BIO *a, int init);
|
||||
int BIO_get_init(BIO *a);
|
||||
void BIO_set_shutdown(BIO *a, int shut);
|
||||
int BIO_get_shutdown(BIO *a);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions are mainly useful when implementing a custom BIO.</p>
|
||||
|
||||
<p>The BIO_set_data() function associates the custom data pointed to by <b>ptr</b> with the BIO. This data can subsequently be retrieved via a call to BIO_get_data(). This can be used by custom BIOs for storing implementation specific information.</p>
|
||||
|
||||
<p>The BIO_set_init() function sets the value of the BIO's "init" flag to indicate whether initialisation has been completed for this BIO or not. A non-zero value indicates that initialisation is complete, whilst zero indicates that it is not. Often initialisation will complete during initial construction of the BIO. For some BIOs however, initialisation may not complete until after additional steps have occurred (for example through calling custom ctrls). The BIO_get_init() function returns the value of the "init" flag.</p>
|
||||
|
||||
<p>The BIO_set_shutdown() and BIO_get_shutdown() functions set and get the state of this BIO's shutdown (i.e. BIO_CLOSE) flag. If set then the underlying resource is also closed when the BIO is freed.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_get_data() returns a pointer to the implementation specific custom data associated with this BIO, or NULL if none has been set.</p>
|
||||
|
||||
<p>BIO_get_init() returns the state of the BIO's init flag.</p>
|
||||
|
||||
<p>BIO_get_shutdown() returns the stat of the BIO's shutdown (i.e. BIO_CLOSE) flag.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="/../man7/bio.html">bio</a>, <a href="/../man3/BIO_meth_new.html">BIO_meth_new</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The functions described here were added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
75
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_get_ex_new_index.html
vendored
Normal file
75
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_get_ex_new_index.html
vendored
Normal file
@ -0,0 +1,75 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_get_ex_new_index</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_get_ex_new_index, BIO_set_ex_data, BIO_get_ex_data, ENGINE_get_ex_new_index, ENGINE_set_ex_data, ENGINE_get_ex_data, UI_get_ex_new_index, UI_set_ex_data, UI_get_ex_data, X509_get_ex_new_index, X509_set_ex_data, X509_get_ex_data, X509_STORE_get_ex_new_index, X509_STORE_set_ex_data, X509_STORE_get_ex_data, X509_STORE_CTX_get_ex_new_index, X509_STORE_CTX_set_ex_data, X509_STORE_CTX_get_ex_data, DH_get_ex_new_index, DH_set_ex_data, DH_get_ex_data, DSA_get_ex_new_index, DSA_set_ex_data, DSA_get_ex_data, ECDH_get_ex_new_index, ECDH_set_ex_data, ECDH_get_ex_data, EC_KEY_get_ex_new_index, EC_KEY_set_ex_data, EC_KEY_get_ex_data, RSA_get_ex_new_index, RSA_set_ex_data, RSA_get_ex_data - application-specific data</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/x509.h>
|
||||
|
||||
int TYPE_get_ex_new_index(long argl, void *argp,
|
||||
CRYPTO_EX_new *new_func,
|
||||
CRYPTO_EX_dup *dup_func,
|
||||
CRYPTO_EX_free *free_func);
|
||||
|
||||
int TYPE_set_ex_data(TYPE *d, int idx, void *arg);
|
||||
|
||||
void *TYPE_get_ex_data(TYPE *d, int idx);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>In the description here, <i>TYPE</i> is used a placeholder for any of the OpenSSL datatypes listed in <a href="../man3/CRYPTO_get_ex_new_index.html">CRYPTO_get_ex_new_index(3)</a>.</p>
|
||||
|
||||
<p>These functions handle application-specific data for OpenSSL data structures.</p>
|
||||
|
||||
<p>TYPE_get_ex_new_index() is a macro that calls CRYPTO_get_ex_new_index() with the correct <b>index</b> value.</p>
|
||||
|
||||
<p>TYPE_set_ex_data() is a function that calls CRYPTO_set_ex_data() with an offset into the opaque exdata part of the TYPE object.</p>
|
||||
|
||||
<p>TYPE_get_ex_data() is a function that calls CRYPTO_get_ex_data() with an offset into the opaque exdata part of the TYPE object.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>TYPE_get_ex_new_index() returns a new index on success or -1 on error.</p>
|
||||
|
||||
<p>TYPE_set_ex_data() returns 1 on success or 0 on error.</p>
|
||||
|
||||
<p>TYPE_get_ex_data() returns the application data or NULL if an error occurred.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/CRYPTO_get_ex_new_index.html">CRYPTO_get_ex_new_index(3)</a>.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
128
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_meth_new.html
vendored
Normal file
128
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_meth_new.html
vendored
Normal file
@ -0,0 +1,128 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_meth_new</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_get_new_index, BIO_meth_new, BIO_meth_free, BIO_meth_get_read_ex, BIO_meth_set_read_ex, BIO_meth_get_write_ex, BIO_meth_set_write_ex, BIO_meth_get_write, BIO_meth_set_write, BIO_meth_get_read, BIO_meth_set_read, BIO_meth_get_puts, BIO_meth_set_puts, BIO_meth_get_gets, BIO_meth_set_gets, BIO_meth_get_ctrl, BIO_meth_set_ctrl, BIO_meth_get_create, BIO_meth_set_create, BIO_meth_get_destroy, BIO_meth_set_destroy, BIO_meth_get_callback_ctrl, BIO_meth_set_callback_ctrl - Routines to build up BIO methods</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
int BIO_get_new_index(void);
|
||||
|
||||
BIO_METHOD *BIO_meth_new(int type, const char *name);
|
||||
|
||||
void BIO_meth_free(BIO_METHOD *biom);
|
||||
|
||||
int (*BIO_meth_get_write_ex(const BIO_METHOD *biom))(BIO *, const char *, size_t,
|
||||
size_t *);
|
||||
int (*BIO_meth_get_write(const BIO_METHOD *biom))(BIO *, const char *, int);
|
||||
int BIO_meth_set_write_ex(BIO_METHOD *biom,
|
||||
int (*bwrite)(BIO *, const char *, size_t, size_t *));
|
||||
int BIO_meth_set_write(BIO_METHOD *biom,
|
||||
int (*write)(BIO *, const char *, int));
|
||||
|
||||
int (*BIO_meth_get_read_ex(const BIO_METHOD *biom))(BIO *, char *, size_t, size_t *);
|
||||
int (*BIO_meth_get_read(const BIO_METHOD *biom))(BIO *, char *, int);
|
||||
int BIO_meth_set_read_ex(BIO_METHOD *biom,
|
||||
int (*bread)(BIO *, char *, size_t, size_t *));
|
||||
int BIO_meth_set_read(BIO_METHOD *biom, int (*read)(BIO *, char *, int));
|
||||
|
||||
int (*BIO_meth_get_puts(const BIO_METHOD *biom))(BIO *, const char *);
|
||||
int BIO_meth_set_puts(BIO_METHOD *biom, int (*puts)(BIO *, const char *));
|
||||
|
||||
int (*BIO_meth_get_gets(const BIO_METHOD *biom))(BIO *, char *, int);
|
||||
int BIO_meth_set_gets(BIO_METHOD *biom,
|
||||
int (*gets)(BIO *, char *, int));
|
||||
|
||||
long (*BIO_meth_get_ctrl(const BIO_METHOD *biom))(BIO *, int, long, void *);
|
||||
int BIO_meth_set_ctrl(BIO_METHOD *biom,
|
||||
long (*ctrl)(BIO *, int, long, void *));
|
||||
|
||||
int (*BIO_meth_get_create(const BIO_METHOD *bion))(BIO *);
|
||||
int BIO_meth_set_create(BIO_METHOD *biom, int (*create)(BIO *));
|
||||
|
||||
int (*BIO_meth_get_destroy(const BIO_METHOD *biom))(BIO *);
|
||||
int BIO_meth_set_destroy(BIO_METHOD *biom, int (*destroy)(BIO *));
|
||||
|
||||
long (*BIO_meth_get_callback_ctrl(const BIO_METHOD *biom))(BIO *, int, BIO_info_cb *);
|
||||
int BIO_meth_set_callback_ctrl(BIO_METHOD *biom,
|
||||
long (*callback_ctrl)(BIO *, int, BIO_info_cb *));</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The <b>BIO_METHOD</b> type is a structure used for the implementation of new BIO types. It provides a set of functions used by OpenSSL for the implementation of the various BIO capabilities. See the <a href="/../man7/bio.html">bio</a> page for more information.</p>
|
||||
|
||||
<p>BIO_meth_new() creates a new <b>BIO_METHOD</b> structure. It should be given a unique integer <b>type</b> and a string that represents its <b>name</b>. Use BIO_get_new_index() to get the value for <b>type</b>.</p>
|
||||
|
||||
<p>The set of standard OpenSSL provided BIO types is provided in <b>bio.h</b>. Some examples include <b>BIO_TYPE_BUFFER</b> and <b>BIO_TYPE_CIPHER</b>. Filter BIOs should have a type which have the "filter" bit set (<b>BIO_TYPE_FILTER</b>). Source/sink BIOs should have the "source/sink" bit set (<b>BIO_TYPE_SOURCE_SINK</b>). File descriptor based BIOs (e.g. socket, fd, connect, accept etc) should additionally have the "descriptor" bit set (<b>BIO_TYPE_DESCRIPTOR</b>). See the <a href="/../man3/BIO_find_type.html">BIO_find_type</a> page for more information.</p>
|
||||
|
||||
<p>BIO_meth_free() destroys a <b>BIO_METHOD</b> structure and frees up any memory associated with it.</p>
|
||||
|
||||
<p>BIO_meth_get_write_ex() and BIO_meth_set_write_ex() get and set the function used for writing arbitrary length data to the BIO respectively. This function will be called in response to the application calling BIO_write_ex() or BIO_write(). The parameters for the function have the same meaning as for BIO_write_ex(). Older code may call BIO_meth_get_write() and BIO_meth_set_write() instead. Applications should not call both BIO_meth_set_write_ex() and BIO_meth_set_write() or call BIO_meth_get_write() when the function was set with BIO_meth_set_write_ex().</p>
|
||||
|
||||
<p>BIO_meth_get_read_ex() and BIO_meth_set_read_ex() get and set the function used for reading arbitrary length data from the BIO respectively. This function will be called in response to the application calling BIO_read_ex() or BIO_read(). The parameters for the function have the same meaning as for BIO_read_ex(). Older code may call BIO_meth_get_read() and BIO_meth_set_read() instead. Applications should not call both BIO_meth_set_read_ex() and BIO_meth_set_read() or call BIO_meth_get_read() when the function was set with BIO_meth_set_read_ex().</p>
|
||||
|
||||
<p>BIO_meth_get_puts() and BIO_meth_set_puts() get and set the function used for writing a NULL terminated string to the BIO respectively. This function will be called in response to the application calling BIO_puts(). The parameters for the function have the same meaning as for BIO_puts().</p>
|
||||
|
||||
<p>BIO_meth_get_gets() and BIO_meth_set_gets() get and set the function typically used for reading a line of data from the BIO respectively (see the <a href="../man3/BIO_gets.html">BIO_gets(3)</a> page for more information). This function will be called in response to the application calling BIO_gets(). The parameters for the function have the same meaning as for BIO_gets().</p>
|
||||
|
||||
<p>BIO_meth_get_ctrl() and BIO_meth_set_ctrl() get and set the function used for processing ctrl messages in the BIO respectively. See the <a href="/../man3/BIO_ctrl.html">BIO_ctrl</a> page for more information. This function will be called in response to the application calling BIO_ctrl(). The parameters for the function have the same meaning as for BIO_ctrl().</p>
|
||||
|
||||
<p>BIO_meth_get_create() and BIO_meth_set_create() get and set the function used for creating a new instance of the BIO respectively. This function will be called in response to the application calling BIO_new() and passing in a pointer to the current BIO_METHOD. The BIO_new() function will allocate the memory for the new BIO, and a pointer to this newly allocated structure will be passed as a parameter to the function.</p>
|
||||
|
||||
<p>BIO_meth_get_destroy() and BIO_meth_set_destroy() get and set the function used for destroying an instance of a BIO respectively. This function will be called in response to the application calling BIO_free(). A pointer to the BIO to be destroyed is passed as a parameter. The destroy function should be used for BIO specific clean up. The memory for the BIO itself should not be freed by this function.</p>
|
||||
|
||||
<p>BIO_meth_get_callback_ctrl() and BIO_meth_set_callback_ctrl() get and set the function used for processing callback ctrl messages in the BIO respectively. See the <a href="../man3/BIO_callback_ctrl.html">BIO_callback_ctrl(3)</a> page for more information. This function will be called in response to the application calling BIO_callback_ctrl(). The parameters for the function have the same meaning as for BIO_callback_ctrl().</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_get_new_index() returns the new BIO type value or -1 if an error occurred.</p>
|
||||
|
||||
<p>BIO_meth_new(int type, const char *name) returns a valid <b>BIO_METHOD</b> or NULL if an error occurred.</p>
|
||||
|
||||
<p>The <b>BIO_meth_set</b> functions return 1 on success or 0 on error.</p>
|
||||
|
||||
<p>The <b>BIO_meth_get</b> functions return the corresponding function pointers.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="/../man7/bio.html">bio</a>, <a href="/../man3/BIO_find_type.html">BIO_find_type</a>, <a href="/../man3/BIO_ctrl.html">BIO_ctrl</a>, <a>BIO_read_ex</a>, <a href="/../man3/BIO_new.html">BIO_new</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The functions described here were added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
84
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_new.html
vendored
Normal file
84
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_new.html
vendored
Normal file
@ -0,0 +1,84 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_new</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_new, BIO_up_ref, BIO_free, BIO_vfree, BIO_free_all - BIO allocation and freeing functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
BIO * BIO_new(const BIO_METHOD *type);
|
||||
int BIO_up_ref(BIO *a);
|
||||
int BIO_free(BIO *a);
|
||||
void BIO_vfree(BIO *a);
|
||||
void BIO_free_all(BIO *a);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The BIO_new() function returns a new BIO using method <b>type</b>.</p>
|
||||
|
||||
<p>BIO_up_ref() increments the reference count associated with the BIO object.</p>
|
||||
|
||||
<p>BIO_free() frees up a single BIO, BIO_vfree() also frees up a single BIO but it does not return a value. If <b>a</b> is NULL nothing is done. Calling BIO_free() may also have some effect on the underlying I/O structure, for example it may close the file being referred to under certain circumstances. For more details see the individual BIO_METHOD descriptions.</p>
|
||||
|
||||
<p>BIO_free_all() frees up an entire BIO chain, it does not halt if an error occurs freeing up an individual BIO in the chain. If <b>a</b> is NULL nothing is done.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_new() returns a newly created BIO or NULL if the call fails.</p>
|
||||
|
||||
<p>BIO_up_ref() and BIO_free() return 1 for success and 0 for failure.</p>
|
||||
|
||||
<p>BIO_free_all() and BIO_vfree() do not return values.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>If BIO_free() is called on a BIO chain it will only free one BIO resulting in a memory leak.</p>
|
||||
|
||||
<p>Calling BIO_free_all() on a single BIO has the same effect as calling BIO_free() on it other than the discarded return value.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>BIO_set() was removed in OpenSSL 1.1.0 as BIO type is now opaque.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Create a memory BIO:</p>
|
||||
|
||||
<pre><code>BIO *mem = BIO_new(BIO_s_mem());</code></pre>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
81
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_new_CMS.html
vendored
Normal file
81
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_new_CMS.html
vendored
Normal file
@ -0,0 +1,81 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_new_CMS</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_new_CMS - CMS streaming filter BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/cms.h>
|
||||
|
||||
BIO *BIO_new_CMS(BIO *out, CMS_ContentInfo *cms);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_new_CMS() returns a streaming filter BIO chain based on <b>cms</b>. The output of the filter is written to <b>out</b>. Any data written to the chain is automatically translated to a BER format CMS structure of the appropriate type.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The chain returned by this function behaves like a standard filter BIO. It supports non blocking I/O. Content is processed and streamed on the fly and not all held in memory at once: so it is possible to encode very large structures. After all content has been written through the chain BIO_flush() must be called to finalise the structure.</p>
|
||||
|
||||
<p>The <b>CMS_STREAM</b> flag must be included in the corresponding <b>flags</b> parameter of the <b>cms</b> creation function.</p>
|
||||
|
||||
<p>If an application wishes to write additional data to <b>out</b> BIOs should be removed from the chain using BIO_pop() and freed with BIO_free() until <b>out</b> is reached. If no additional data needs to be written BIO_free_all() can be called to free up the whole chain.</p>
|
||||
|
||||
<p>Any content written through the filter is used verbatim: no canonical translation is performed.</p>
|
||||
|
||||
<p>It is possible to chain multiple BIOs to, for example, create a triple wrapped signed, enveloped, signed structure. In this case it is the applications responsibility to set the inner content type of any outer CMS_ContentInfo structures.</p>
|
||||
|
||||
<p>Large numbers of small writes through the chain should be avoided as this will produce an output consisting of lots of OCTET STRING structures. Prepending a BIO_f_buffer() buffering BIO will prevent this.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>There is currently no corresponding inverse BIO: i.e. one which can decode a CMS structure on the fly.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_new_CMS() returns a BIO chain when successful or NULL if an error occurred. The error can be obtained from ERR_get_error(3).</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>, <a href="../man3/CMS_sign.html">CMS_sign(3)</a>, <a href="../man3/CMS_encrypt.html">CMS_encrypt(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The BIO_new_CMS() function was added in OpenSSL 1.0.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
91
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_parse_hostserv.html
vendored
Normal file
91
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_parse_hostserv.html
vendored
Normal file
@ -0,0 +1,91 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_parse_hostserv</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_hostserv_priorities, BIO_parse_hostserv - utility routines to parse a standard host and service string</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
enum BIO_hostserv_priorities {
|
||||
BIO_PARSE_PRIO_HOST, BIO_PARSE_PRIO_SERV
|
||||
};
|
||||
int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
|
||||
enum BIO_hostserv_priorities hostserv_prio);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_parse_hostserv() will parse the information given in <b>hostserv</b>, create strings with the host name and service name and give those back via <b>host</b> and <b>service</b>. Those will need to be freed after they are used. <b>hostserv_prio</b> helps determine if <b>hostserv</b> shall be interpreted primarily as a host name or a service name in ambiguous cases.</p>
|
||||
|
||||
<p>The syntax the BIO_parse_hostserv() recognises is:</p>
|
||||
|
||||
<pre><code>host + ':' + service
|
||||
host + ':' + '*'
|
||||
host + ':'
|
||||
':' + service
|
||||
'*' + ':' + service
|
||||
host
|
||||
service</code></pre>
|
||||
|
||||
<p>The host part can be a name or an IP address. If it's a IPv6 address, it MUST be enclosed in brackets, such as '[::1]'.</p>
|
||||
|
||||
<p>The service part can be a service name or its port number.</p>
|
||||
|
||||
<p>The returned values will depend on the given <b>hostserv</b> string and <b>hostserv_prio</b>, as follows:</p>
|
||||
|
||||
<pre><code>host + ':' + service => *host = "host", *service = "service"
|
||||
host + ':' + '*' => *host = "host", *service = NULL
|
||||
host + ':' => *host = "host", *service = NULL
|
||||
':' + service => *host = NULL, *service = "service"
|
||||
'*' + ':' + service => *host = NULL, *service = "service"
|
||||
|
||||
in case no ':' is present in the string, the result depends on
|
||||
hostserv_prio, as follows:
|
||||
|
||||
when hostserv_prio == BIO_PARSE_PRIO_HOST
|
||||
host => *host = "host", *service untouched
|
||||
|
||||
when hostserv_prio == BIO_PARSE_PRIO_SERV
|
||||
service => *host untouched, *service = "service"</code></pre>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_parse_hostserv() returns 1 on success or 0 on error.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BIO_ADDRINFO.html">BIO_ADDRINFO(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
61
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_printf.html
vendored
Normal file
61
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_printf.html
vendored
Normal file
@ -0,0 +1,61 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_printf</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_printf, BIO_vprintf, BIO_snprintf, BIO_vsnprintf - formatted output to a BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
int BIO_printf(BIO *bio, const char *format, ...)
|
||||
int BIO_vprintf(BIO *bio, const char *format, va_list args)
|
||||
|
||||
int BIO_snprintf(char *buf, size_t n, const char *format, ...)
|
||||
int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_printf() is similar to the standard C printf() function, except that the output is sent to the specified BIO, <b>bio</b>, rather than standard output. All common format specifiers are supported.</p>
|
||||
|
||||
<p>BIO_vprintf() is similar to the vprintf() function found on many platforms, the output is sent to the specified BIO, <b>bio</b>, rather than standard output. All common format specifiers are supported. The argument list <b>args</b> is a stdarg argument list.</p>
|
||||
|
||||
<p>BIO_snprintf() is for platforms that do not have the common snprintf() function. It is like sprintf() except that the size parameter, <b>n</b>, specifies the size of the output buffer.</p>
|
||||
|
||||
<p>BIO_vsnprintf() is to BIO_snprintf() as BIO_vprintf() is to BIO_printf().</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>All functions return the number of bytes written, or -1 on error. For BIO_snprintf() and BIO_vsnprintf() this includes when the output buffer is too small.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
98
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_push.html
vendored
Normal file
98
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_push.html
vendored
Normal file
@ -0,0 +1,98 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_push</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_push, BIO_pop, BIO_set_next - add and remove BIOs from a chain</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
BIO *BIO_push(BIO *b, BIO *append);
|
||||
BIO *BIO_pop(BIO *b);
|
||||
void BIO_set_next(BIO *b, BIO *next);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>The BIO_push() function appends the BIO <b>append</b> to <b>b</b>, it returns <b>b</b>.</p>
|
||||
|
||||
<p>BIO_pop() removes the BIO <b>b</b> from a chain and returns the next BIO in the chain, or NULL if there is no next BIO. The removed BIO then becomes a single BIO with no association with the original chain, it can thus be freed or attached to a different chain.</p>
|
||||
|
||||
<p>BIO_set_next() replaces the existing next BIO in a chain with the BIO pointed to by <b>next</b>. The new chain may include some of the same BIOs from the old chain or it may be completely different.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The names of these functions are perhaps a little misleading. BIO_push() joins two BIO chains whereas BIO_pop() deletes a single BIO from a chain, the deleted BIO does not need to be at the end of a chain.</p>
|
||||
|
||||
<p>The process of calling BIO_push() and BIO_pop() on a BIO may have additional consequences (a control call is made to the affected BIOs) any effects will be noted in the descriptions of individual BIOs.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_push() returns the end of the chain, <b>b</b>.</p>
|
||||
|
||||
<p>BIO_pop() returns the next BIO in the chain, or NULL if there is no next BIO.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>For these examples suppose <b>md1</b> and <b>md2</b> are digest BIOs, <b>b64</b> is a base64 BIO and <b>f</b> is a file BIO.</p>
|
||||
|
||||
<p>If the call:</p>
|
||||
|
||||
<pre><code>BIO_push(b64, f);</code></pre>
|
||||
|
||||
<p>is made then the new chain will be <b>b64-f</b>. After making the calls</p>
|
||||
|
||||
<pre><code>BIO_push(md2, b64);
|
||||
BIO_push(md1, md2);</code></pre>
|
||||
|
||||
<p>the new chain is <b>md1-md2-b64-f</b>. Data written to <b>md1</b> will be digested by <b>md1</b> and <b>md2</b>, <b>base64</b> encoded and written to <b>f</b>.</p>
|
||||
|
||||
<p>It should be noted that reading causes data to pass in the reverse direction, that is data is read from <b>f</b>, base64 <b>decoded</b> and digested by <b>md1</b> and <b>md2</b>. If the call:</p>
|
||||
|
||||
<pre><code>BIO_pop(md2);</code></pre>
|
||||
|
||||
<p>The call will return <b>b64</b> and the new chain will be <b>md1-b64-f</b> data can be written to <b>md1</b> as before.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="/../man7/bio.html">bio</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The BIO_set_next() function was added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
90
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_read.html
vendored
Normal file
90
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_read.html
vendored
Normal file
@ -0,0 +1,90 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_read</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_read_ex, BIO_write_ex, BIO_read, BIO_write, BIO_gets, BIO_puts - BIO I/O functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
int BIO_read_ex(BIO *b, void *data, size_t dlen, size_t *readbytes);
|
||||
int BIO_write_ex(BIO *b, const void *data, size_t dlen, size_t *written);
|
||||
|
||||
int BIO_read(BIO *b, void *data, int dlen);
|
||||
int BIO_gets(BIO *b, char *buf, int size);
|
||||
int BIO_write(BIO *b, const void *data, int dlen);
|
||||
int BIO_puts(BIO *b, const char *buf);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_read_ex() attempts to read <b>dlen</b> bytes from BIO <b>b</b> and places the data in <b>data</b>. If any bytes were successfully read then the number of bytes read is stored in <b>*readbytes</b>.</p>
|
||||
|
||||
<p>BIO_write_ex() attempts to write <b>dlen</b> bytes from <b>data</b> to BIO <b>b</b>. If successful then the number of bytes written is stored in <b>*written</b>.</p>
|
||||
|
||||
<p>BIO_read() attempts to read <b>len</b> bytes from BIO <b>b</b> and places the data in <b>buf</b>.</p>
|
||||
|
||||
<p>BIO_gets() performs the BIOs "gets" operation and places the data in <b>buf</b>. Usually this operation will attempt to read a line of data from the BIO of maximum length <b>size-1</b>. There are exceptions to this, however; for example, BIO_gets() on a digest BIO will calculate and return the digest and other BIOs may not support BIO_gets() at all. The returned string is always NUL-terminated and the '\n' is preserved if present in the input data.</p>
|
||||
|
||||
<p>BIO_write() attempts to write <b>len</b> bytes from <b>buf</b> to BIO <b>b</b>.</p>
|
||||
|
||||
<p>BIO_puts() attempts to write a NUL-terminated string <b>buf</b> to BIO <b>b</b>.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_read_ex() and BIO_write_ex() return 1 if data was successfully read or written, and 0 otherwise.</p>
|
||||
|
||||
<p>All other functions return either the amount of data successfully read or written (if the return value is positive) or that no data was successfully read or written if the result is 0 or -1. If the return value is -2 then the operation is not implemented in the specific BIO type. The trailing NUL is not included in the length returned by BIO_gets().</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>A 0 or -1 return is not necessarily an indication of an error. In particular when the source/sink is non-blocking or of a certain type it may merely be an indication that no data is currently available and that the application should retry the operation later.</p>
|
||||
|
||||
<p>One technique sometimes used with blocking sockets is to use a system call (such as select(), poll() or equivalent) to determine when data is available and then call read() to read the data. The equivalent with BIOs (that is call select() on the underlying I/O structure and then call BIO_read() to read the data) should <b>not</b> be used because a single call to BIO_read() can cause several reads (and writes in the case of SSL BIOs) on the underlying I/O structure and may block as a result. Instead select() (or equivalent) should be combined with non blocking I/O so successive reads will request a retry instead of blocking.</p>
|
||||
|
||||
<p>See <a href="../man3/BIO_should_retry.html">BIO_should_retry(3)</a> for details of how to determine the cause of a retry and other I/O issues.</p>
|
||||
|
||||
<p>If the BIO_gets() function is not supported by a BIO then it possible to work around this by adding a buffering BIO <a href="../man3/BIO_f_buffer.html">BIO_f_buffer(3)</a> to the chain.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BIO_should_retry.html">BIO_should_retry(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>BIO_gets() on 1.1.0 and older when called on BIO_fd() based BIO does not keep the '\n' at the end of the line in the buffer.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
175
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_accept.html
vendored
Normal file
175
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_accept.html
vendored
Normal file
@ -0,0 +1,175 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_accept</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_s_accept, BIO_set_accept_name, BIO_set_accept_port, BIO_get_accept_name, BIO_get_accept_port, BIO_new_accept, BIO_set_nbio_accept, BIO_set_accept_bios, BIO_get_peer_name, BIO_get_peer_port, BIO_get_accept_ip_family, BIO_set_accept_ip_family, BIO_set_bind_mode, BIO_get_bind_mode, BIO_do_accept - accept BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_s_accept(void);
|
||||
|
||||
long BIO_set_accept_name(BIO *b, char *name);
|
||||
char *BIO_get_accept_name(BIO *b);
|
||||
|
||||
long BIO_set_accept_port(BIO *b, char *port);
|
||||
char *BIO_get_accept_port(BIO *b);
|
||||
|
||||
BIO *BIO_new_accept(char *host_port);
|
||||
|
||||
long BIO_set_nbio_accept(BIO *b, int n);
|
||||
long BIO_set_accept_bios(BIO *b, char *bio);
|
||||
|
||||
char *BIO_get_peer_name(BIO *b);
|
||||
char *BIO_get_peer_port(BIO *b);
|
||||
long BIO_get_accept_ip_family(BIO *b);
|
||||
long BIO_set_accept_ip_family(BIO *b, long family);
|
||||
|
||||
long BIO_set_bind_mode(BIO *b, long mode);
|
||||
long BIO_get_bind_mode(BIO *b);
|
||||
|
||||
int BIO_do_accept(BIO *b);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_accept() returns the accept BIO method. This is a wrapper round the platform's TCP/IP socket accept routines.</p>
|
||||
|
||||
<p>Using accept BIOs, TCP/IP connections can be accepted and data transferred using only BIO routines. In this way any platform specific operations are hidden by the BIO abstraction.</p>
|
||||
|
||||
<p>Read and write operations on an accept BIO will perform I/O on the underlying connection. If no connection is established and the port (see below) is set up properly then the BIO waits for an incoming connection.</p>
|
||||
|
||||
<p>Accept BIOs support BIO_puts() but not BIO_gets().</p>
|
||||
|
||||
<p>If the close flag is set on an accept BIO then any active connection on that chain is shutdown and the socket closed when the BIO is freed.</p>
|
||||
|
||||
<p>Calling BIO_reset() on an accept BIO will close any active connection and reset the BIO into a state where it awaits another incoming connection.</p>
|
||||
|
||||
<p>BIO_get_fd() and BIO_set_fd() can be called to retrieve or set the accept socket. See <a href="../man3/BIO_s_fd.html">BIO_s_fd(3)</a></p>
|
||||
|
||||
<p>BIO_set_accept_name() uses the string <b>name</b> to set the accept name. The name is represented as a string of the form "host:port", where "host" is the interface to use and "port" is the port. The host can be "*" or empty which is interpreted as meaning any interface. If the host is an IPv6 address, it has to be enclosed in brackets, for example "[::1]:https". "port" has the same syntax as the port specified in BIO_set_conn_port() for connect BIOs, that is it can be a numerical port string or a string to lookup using getservbyname() and a string table.</p>
|
||||
|
||||
<p>BIO_set_accept_port() uses the string <b>port</b> to set the accept port. "port" has the same syntax as the port specified in BIO_set_conn_port() for connect BIOs, that is it can be a numerical port string or a string to lookup using getservbyname() and a string table.</p>
|
||||
|
||||
<p>BIO_new_accept() combines BIO_new() and BIO_set_accept_name() into a single call: that is it creates a new accept BIO with port <b>host_port</b>.</p>
|
||||
|
||||
<p>BIO_set_nbio_accept() sets the accept socket to blocking mode (the default) if <b>n</b> is 0 or non blocking mode if <b>n</b> is 1.</p>
|
||||
|
||||
<p>BIO_set_accept_bios() can be used to set a chain of BIOs which will be duplicated and prepended to the chain when an incoming connection is received. This is useful if, for example, a buffering or SSL BIO is required for each connection. The chain of BIOs must not be freed after this call, they will be automatically freed when the accept BIO is freed.</p>
|
||||
|
||||
<p>BIO_set_bind_mode() and BIO_get_bind_mode() set and retrieve the current bind mode. If <b>BIO_BIND_NORMAL</b> (the default) is set then another socket cannot be bound to the same port. If <b>BIO_BIND_REUSEADDR</b> is set then other sockets can bind to the same port. If <b>BIO_BIND_REUSEADDR_IF_UNUSED</b> is set then and attempt is first made to use BIO_BIN_NORMAL, if this fails and the port is not in use then a second attempt is made using <b>BIO_BIND_REUSEADDR</b>.</p>
|
||||
|
||||
<p>BIO_do_accept() serves two functions. When it is first called, after the accept BIO has been setup, it will attempt to create the accept socket and bind an address to it. Second and subsequent calls to BIO_do_accept() will await an incoming connection, or request a retry in non blocking mode.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>When an accept BIO is at the end of a chain it will await an incoming connection before processing I/O calls. When an accept BIO is not at then end of a chain it passes I/O calls to the next BIO in the chain.</p>
|
||||
|
||||
<p>When a connection is established a new socket BIO is created for the connection and appended to the chain. That is the chain is now accept->socket. This effectively means that attempting I/O on an initial accept socket will await an incoming connection then perform I/O on it.</p>
|
||||
|
||||
<p>If any additional BIOs have been set using BIO_set_accept_bios() then they are placed between the socket and the accept BIO, that is the chain will be accept->otherbios->socket.</p>
|
||||
|
||||
<p>If a server wishes to process multiple connections (as is normally the case) then the accept BIO must be made available for further incoming connections. This can be done by waiting for a connection and then calling:</p>
|
||||
|
||||
<pre><code>connection = BIO_pop(accept);</code></pre>
|
||||
|
||||
<p>After this call <b>connection</b> will contain a BIO for the recently established connection and <b>accept</b> will now be a single BIO again which can be used to await further incoming connections. If no further connections will be accepted the <b>accept</b> can be freed using BIO_free().</p>
|
||||
|
||||
<p>If only a single connection will be processed it is possible to perform I/O using the accept BIO itself. This is often undesirable however because the accept BIO will still accept additional incoming connections. This can be resolved by using BIO_pop() (see above) and freeing up the accept BIO after the initial connection.</p>
|
||||
|
||||
<p>If the underlying accept socket is non-blocking and BIO_do_accept() is called to await an incoming connection it is possible for BIO_should_io_special() with the reason BIO_RR_ACCEPT. If this happens then it is an indication that an accept attempt would block: the application should take appropriate action to wait until the underlying socket has accepted a connection and retry the call.</p>
|
||||
|
||||
<p>BIO_set_accept_name(), BIO_get_accept_name(), BIO_set_accept_port(), BIO_get_accept_port(), BIO_set_nbio_accept(), BIO_set_accept_bios(), BIO_get_peer_name(), BIO_get_peer_port(), BIO_get_accept_ip_family(), BIO_set_accept_ip_family(), BIO_set_bind_mode(), BIO_get_bind_mode() and BIO_do_accept() are macros.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_do_accept(), BIO_set_accept_name(), BIO_set_accept_port(), BIO_set_nbio_accept(), BIO_set_accept_bios(), BIO_set_accept_ip_family(), and BIO_set_bind_mode() return 1 for success and 0 or -1 for failure.</p>
|
||||
|
||||
<p>BIO_get_accept_name() returns the accept name or NULL on error. BIO_get_peer_name() returns the peer name or NULL on error.</p>
|
||||
|
||||
<p>BIO_get_accept_port() returns the accept port as a string or NULL on error. BIO_get_peer_port() returns the peer port as a string or NULL on error. BIO_get_accept_ip_family() returns the IP family or -1 on error.</p>
|
||||
|
||||
<p>BIO_get_bind_mode() returns the set of <b>BIO_BIND</b> flags, or -1 on failure.</p>
|
||||
|
||||
<p>BIO_new_accept() returns a BIO or NULL on error.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>This example accepts two connections on port 4444, sends messages down each and finally closes both down.</p>
|
||||
|
||||
<pre><code>BIO *abio, *cbio, *cbio2;
|
||||
|
||||
/* First call to BIO_accept() sets up accept BIO */
|
||||
abio = BIO_new_accept("4444");
|
||||
if (BIO_do_accept(abio) <= 0) {
|
||||
fprintf(stderr, "Error setting up accept\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* Wait for incoming connection */
|
||||
if (BIO_do_accept(abio) <= 0) {
|
||||
fprintf(stderr, "Error accepting connection\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
fprintf(stderr, "Connection 1 established\n");
|
||||
|
||||
/* Retrieve BIO for connection */
|
||||
cbio = BIO_pop(abio);
|
||||
BIO_puts(cbio, "Connection 1: Sending out Data on initial connection\n");
|
||||
fprintf(stderr, "Sent out data on connection 1\n");
|
||||
|
||||
/* Wait for another connection */
|
||||
if (BIO_do_accept(abio) <= 0) {
|
||||
fprintf(stderr, "Error accepting connection\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
fprintf(stderr, "Connection 2 established\n");
|
||||
|
||||
/* Close accept BIO to refuse further connections */
|
||||
cbio2 = BIO_pop(abio);
|
||||
BIO_free(abio);
|
||||
BIO_puts(cbio2, "Connection 2: Sending out Data on second\n");
|
||||
fprintf(stderr, "Sent out data on connection 2\n");
|
||||
|
||||
BIO_puts(cbio, "Connection 1: Second connection established\n");
|
||||
|
||||
/* Close the two established connections */
|
||||
BIO_free(cbio);
|
||||
BIO_free(cbio2);</code></pre>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
157
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_bio.html
vendored
Normal file
157
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_bio.html
vendored
Normal file
@ -0,0 +1,157 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_bio</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#WARNINGS">WARNINGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_s_bio, BIO_make_bio_pair, BIO_destroy_bio_pair, BIO_shutdown_wr, BIO_set_write_buf_size, BIO_get_write_buf_size, BIO_new_bio_pair, BIO_get_write_guarantee, BIO_ctrl_get_write_guarantee, BIO_get_read_request, BIO_ctrl_get_read_request, BIO_ctrl_reset_read_request - BIO pair BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_s_bio(void);
|
||||
|
||||
int BIO_make_bio_pair(BIO *b1, BIO *b2);
|
||||
int BIO_destroy_bio_pair(BIO *b);
|
||||
int BIO_shutdown_wr(BIO *b);
|
||||
|
||||
int BIO_set_write_buf_size(BIO *b, long size);
|
||||
size_t BIO_get_write_buf_size(BIO *b, long size);
|
||||
|
||||
int BIO_new_bio_pair(BIO **bio1, size_t writebuf1, BIO **bio2, size_t writebuf2);
|
||||
|
||||
int BIO_get_write_guarantee(BIO *b);
|
||||
size_t BIO_ctrl_get_write_guarantee(BIO *b);
|
||||
int BIO_get_read_request(BIO *b);
|
||||
size_t BIO_ctrl_get_read_request(BIO *b);
|
||||
int BIO_ctrl_reset_read_request(BIO *b);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_bio() returns the method for a BIO pair. A BIO pair is a pair of source/sink BIOs where data written to either half of the pair is buffered and can be read from the other half. Both halves must usually by handled by the same application thread since no locking is done on the internal data structures.</p>
|
||||
|
||||
<p>Since BIO chains typically end in a source/sink BIO it is possible to make this one half of a BIO pair and have all the data processed by the chain under application control.</p>
|
||||
|
||||
<p>One typical use of BIO pairs is to place TLS/SSL I/O under application control, this can be used when the application wishes to use a non standard transport for TLS/SSL or the normal socket routines are inappropriate.</p>
|
||||
|
||||
<p>Calls to BIO_read_ex() will read data from the buffer or request a retry if no data is available.</p>
|
||||
|
||||
<p>Calls to BIO_write_ex() will place data in the buffer or request a retry if the buffer is full.</p>
|
||||
|
||||
<p>The standard calls BIO_ctrl_pending() and BIO_ctrl_wpending() can be used to determine the amount of pending data in the read or write buffer.</p>
|
||||
|
||||
<p>BIO_reset() clears any data in the write buffer.</p>
|
||||
|
||||
<p>BIO_make_bio_pair() joins two separate BIOs into a connected pair.</p>
|
||||
|
||||
<p>BIO_destroy_pair() destroys the association between two connected BIOs. Freeing up any half of the pair will automatically destroy the association.</p>
|
||||
|
||||
<p>BIO_shutdown_wr() is used to close down a BIO <b>b</b>. After this call no further writes on BIO <b>b</b> are allowed (they will return an error). Reads on the other half of the pair will return any pending data or EOF when all pending data has been read.</p>
|
||||
|
||||
<p>BIO_set_write_buf_size() sets the write buffer size of BIO <b>b</b> to <b>size</b>. If the size is not initialized a default value is used. This is currently 17K, sufficient for a maximum size TLS record.</p>
|
||||
|
||||
<p>BIO_get_write_buf_size() returns the size of the write buffer.</p>
|
||||
|
||||
<p>BIO_new_bio_pair() combines the calls to BIO_new(), BIO_make_bio_pair() and BIO_set_write_buf_size() to create a connected pair of BIOs <b>bio1</b>, <b>bio2</b> with write buffer sizes <b>writebuf1</b> and <b>writebuf2</b>. If either size is zero then the default size is used. BIO_new_bio_pair() does not check whether <b>bio1</b> or <b>bio2</b> do point to some other BIO, the values are overwritten, BIO_free() is not called.</p>
|
||||
|
||||
<p>BIO_get_write_guarantee() and BIO_ctrl_get_write_guarantee() return the maximum length of data that can be currently written to the BIO. Writes larger than this value will return a value from BIO_write_ex() less than the amount requested or if the buffer is full request a retry. BIO_ctrl_get_write_guarantee() is a function whereas BIO_get_write_guarantee() is a macro.</p>
|
||||
|
||||
<p>BIO_get_read_request() and BIO_ctrl_get_read_request() return the amount of data requested, or the buffer size if it is less, if the last read attempt at the other half of the BIO pair failed due to an empty buffer. This can be used to determine how much data should be written to the BIO so the next read will succeed: this is most useful in TLS/SSL applications where the amount of data read is usually meaningful rather than just a buffer size. After a successful read this call will return zero. It also will return zero once new data has been written satisfying the read request or part of it. Note that BIO_get_read_request() never returns an amount larger than that returned by BIO_get_write_guarantee().</p>
|
||||
|
||||
<p>BIO_ctrl_reset_read_request() can also be used to reset the value returned by BIO_get_read_request() to zero.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Both halves of a BIO pair should be freed. That is even if one half is implicit freed due to a BIO_free_all() or SSL_free() call the other half needs to be freed.</p>
|
||||
|
||||
<p>When used in bidirectional applications (such as TLS/SSL) care should be taken to flush any data in the write buffer. This can be done by calling BIO_pending() on the other half of the pair and, if any data is pending, reading it and sending it to the underlying transport. This must be done before any normal processing (such as calling select() ) due to a request and BIO_should_read() being true.</p>
|
||||
|
||||
<p>To see why this is important consider a case where a request is sent using BIO_write_ex() and a response read with BIO_read_ex(), this can occur during an TLS/SSL handshake for example. BIO_write_ex() will succeed and place data in the write buffer. BIO_read_ex() will initially fail and BIO_should_read() will be true. If the application then waits for data to be available on the underlying transport before flushing the write buffer it will never succeed because the request was never sent!</p>
|
||||
|
||||
<p>BIO_eof() is true if no data is in the peer BIO and the peer BIO has been shutdown.</p>
|
||||
|
||||
<p>BIO_make_bio_pair(), BIO_destroy_bio_pair(), BIO_shutdown_wr(), BIO_set_write_buf_size(), BIO_get_write_buf_size(), BIO_get_write_guarantee(), and BIO_get_read_request() are implemented as macros.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_new_bio_pair() returns 1 on success, with the new BIOs available in <b>bio1</b> and <b>bio2</b>, or 0 on failure, with NULL pointers stored into the locations for <b>bio1</b> and <b>bio2</b>. Check the error stack for more information.</p>
|
||||
|
||||
<p>[XXXXX: More return values need to be added here]</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>The BIO pair can be used to have full control over the network access of an application. The application can call select() on the socket as required without having to go through the SSL-interface.</p>
|
||||
|
||||
<pre><code>BIO *internal_bio, *network_bio;
|
||||
|
||||
...
|
||||
BIO_new_bio_pair(&internal_bio, 0, &network_bio, 0);
|
||||
SSL_set_bio(ssl, internal_bio, internal_bio);
|
||||
SSL_operations(); /* e.g SSL_read and SSL_write */
|
||||
...
|
||||
|
||||
application | TLS-engine
|
||||
| |
|
||||
+----------> SSL_operations()
|
||||
| /\ ||
|
||||
| || \/
|
||||
| BIO-pair (internal_bio)
|
||||
| BIO-pair (network_bio)
|
||||
| || /\
|
||||
| \/ ||
|
||||
+-----------< BIO_operations()
|
||||
| |
|
||||
| |
|
||||
socket
|
||||
|
||||
...
|
||||
SSL_free(ssl); /* implicitly frees internal_bio */
|
||||
BIO_free(network_bio);
|
||||
...</code></pre>
|
||||
|
||||
<p>As the BIO pair will only buffer the data and never directly access the connection, it behaves non-blocking and will return as soon as the write buffer is full or the read buffer is drained. Then the application has to flush the write buffer and/or fill the read buffer.</p>
|
||||
|
||||
<p>Use the BIO_ctrl_pending(), to find out whether data is buffered in the BIO and must be transferred to the network. Use BIO_ctrl_get_read_request() to find out, how many bytes must be written into the buffer before the SSL_operation() can successfully be continued.</p>
|
||||
|
||||
<h1 id="WARNINGS">WARNINGS</h1>
|
||||
|
||||
<p>As the data is buffered, SSL_operation() may return with an ERROR_SSL_WANT_READ condition, but there is still data in the write buffer. An application must not rely on the error value of SSL_operation() but must assure that the write buffer is always flushed first. Otherwise a deadlock may occur as the peer might be waiting for the data before being able to continue.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/SSL_set_bio.html">SSL_set_bio(3)</a>, <a href="../man7/ssl.html">ssl(7)</a>, <a href="../man7/bio.html">bio(7)</a>, <a href="../man3/BIO_should_retry.html">BIO_should_retry(3)</a>, <a href="../man3/BIO_read_ex.html">BIO_read_ex(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
171
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_connect.html
vendored
Normal file
171
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_connect.html
vendored
Normal file
@ -0,0 +1,171 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_connect</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_set_conn_address, BIO_get_conn_address, BIO_s_connect, BIO_new_connect, BIO_set_conn_hostname, BIO_set_conn_port, BIO_set_conn_ip_family, BIO_get_conn_ip_family, BIO_get_conn_hostname, BIO_get_conn_port, BIO_set_nbio, BIO_do_connect - connect BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD * BIO_s_connect(void);
|
||||
|
||||
BIO *BIO_new_connect(char *name);
|
||||
|
||||
long BIO_set_conn_hostname(BIO *b, char *name);
|
||||
long BIO_set_conn_port(BIO *b, char *port);
|
||||
long BIO_set_conn_address(BIO *b, BIO_ADDR *addr);
|
||||
long BIO_set_conn_ip_family(BIO *b, long family);
|
||||
const char *BIO_get_conn_hostname(BIO *b);
|
||||
const char *BIO_get_conn_port(BIO *b);
|
||||
const BIO_ADDR *BIO_get_conn_address(BIO *b);
|
||||
const long BIO_get_conn_ip_family(BIO *b);
|
||||
|
||||
long BIO_set_nbio(BIO *b, long n);
|
||||
|
||||
int BIO_do_connect(BIO *b);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_connect() returns the connect BIO method. This is a wrapper round the platform's TCP/IP socket connection routines.</p>
|
||||
|
||||
<p>Using connect BIOs, TCP/IP connections can be made and data transferred using only BIO routines. In this way any platform specific operations are hidden by the BIO abstraction.</p>
|
||||
|
||||
<p>Read and write operations on a connect BIO will perform I/O on the underlying connection. If no connection is established and the port and hostname (see below) is set up properly then a connection is established first.</p>
|
||||
|
||||
<p>Connect BIOs support BIO_puts() but not BIO_gets().</p>
|
||||
|
||||
<p>If the close flag is set on a connect BIO then any active connection is shutdown and the socket closed when the BIO is freed.</p>
|
||||
|
||||
<p>Calling BIO_reset() on a connect BIO will close any active connection and reset the BIO into a state where it can connect to the same host again.</p>
|
||||
|
||||
<p>BIO_get_fd() places the underlying socket in <b>c</b> if it is not NULL, it also returns the socket . If <b>c</b> is not NULL it should be of type (int *).</p>
|
||||
|
||||
<p>BIO_set_conn_hostname() uses the string <b>name</b> to set the hostname. The hostname can be an IP address; if the address is an IPv6 one, it must be enclosed with brackets. The hostname can also include the port in the form hostname:port.</p>
|
||||
|
||||
<p>BIO_set_conn_port() sets the port to <b>port</b>. <b>port</b> can be the numerical form or a string such as "http". A string will be looked up first using getservbyname() on the host platform but if that fails a standard table of port names will be used. This internal list is http, telnet, socks, https, ssl, ftp, and gopher.</p>
|
||||
|
||||
<p>BIO_set_conn_address() sets the address and port information using a BIO_ADDR(3ssl).</p>
|
||||
|
||||
<p>BIO_set_conn_ip_family() sets the IP family.</p>
|
||||
|
||||
<p>BIO_get_conn_hostname() returns the hostname of the connect BIO or NULL if the BIO is initialized but no hostname is set. This return value is an internal pointer which should not be modified.</p>
|
||||
|
||||
<p>BIO_get_conn_port() returns the port as a string. This return value is an internal pointer which should not be modified.</p>
|
||||
|
||||
<p>BIO_get_conn_address() returns the address information as a BIO_ADDR. This return value is an internal pointer which should not be modified.</p>
|
||||
|
||||
<p>BIO_get_conn_ip_family() returns the IP family of the connect BIO.</p>
|
||||
|
||||
<p>BIO_set_nbio() sets the non blocking I/O flag to <b>n</b>. If <b>n</b> is zero then blocking I/O is set. If <b>n</b> is 1 then non blocking I/O is set. Blocking I/O is the default. The call to BIO_set_nbio() should be made before the connection is established because non blocking I/O is set during the connect process.</p>
|
||||
|
||||
<p>BIO_new_connect() combines BIO_new() and BIO_set_conn_hostname() into a single call: that is it creates a new connect BIO with <b>name</b>.</p>
|
||||
|
||||
<p>BIO_do_connect() attempts to connect the supplied BIO. It returns 1 if the connection was established successfully. A zero or negative value is returned if the connection could not be established, the call BIO_should_retry() should be used for non blocking connect BIOs to determine if the call should be retried.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>If blocking I/O is set then a non positive return value from any I/O call is caused by an error condition, although a zero return will normally mean that the connection was closed.</p>
|
||||
|
||||
<p>If the port name is supplied as part of the host name then this will override any value set with BIO_set_conn_port(). This may be undesirable if the application does not wish to allow connection to arbitrary ports. This can be avoided by checking for the presence of the ':' character in the passed hostname and either indicating an error or truncating the string at that point.</p>
|
||||
|
||||
<p>The values returned by BIO_get_conn_hostname(), BIO_get_conn_address(), and BIO_get_conn_port() are updated when a connection attempt is made. Before any connection attempt the values returned are those set by the application itself.</p>
|
||||
|
||||
<p>Applications do not have to call BIO_do_connect() but may wish to do so to separate the connection process from other I/O processing.</p>
|
||||
|
||||
<p>If non blocking I/O is set then retries will be requested as appropriate.</p>
|
||||
|
||||
<p>It addition to BIO_should_read() and BIO_should_write() it is also possible for BIO_should_io_special() to be true during the initial connection process with the reason BIO_RR_CONNECT. If this is returned then this is an indication that a connection attempt would block, the application should then take appropriate action to wait until the underlying socket has connected and retry the call.</p>
|
||||
|
||||
<p>BIO_set_conn_hostname(), BIO_set_conn_port(), BIO_get_conn_hostname(), BIO_set_conn_address(), BIO_get_conn_port(), BIO_get_conn_address(), BIO_set_conn_ip_family(), BIO_get_conn_ip_family(), BIO_set_nbio(), and BIO_do_connect() are macros.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_s_connect() returns the connect BIO method.</p>
|
||||
|
||||
<p>BIO_get_fd() returns the socket or -1 if the BIO has not been initialized.</p>
|
||||
|
||||
<p>BIO_set_conn_address(), BIO_set_conn_port(), and BIO_set_conn_ip_family() always return 1.</p>
|
||||
|
||||
<p>BIO_set_conn_hostname() returns 1 on success and 0 on failure.</p>
|
||||
|
||||
<p>BIO_get_conn_address() returns the address information or NULL if none was set.</p>
|
||||
|
||||
<p>BIO_get_conn_hostname() returns the connected hostname or NULL if none was set.</p>
|
||||
|
||||
<p>BIO_get_conn_ip_family() returns the address family or -1 if none was set.</p>
|
||||
|
||||
<p>BIO_get_conn_port() returns a string representing the connected port or NULL if not set.</p>
|
||||
|
||||
<p>BIO_set_nbio() always returns 1.</p>
|
||||
|
||||
<p>BIO_do_connect() returns 1 if the connection was successfully established and 0 or -1 if the connection failed.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>This is example connects to a webserver on the local host and attempts to retrieve a page and copy the result to standard output.</p>
|
||||
|
||||
<pre><code>BIO *cbio, *out;
|
||||
int len;
|
||||
char tmpbuf[1024];
|
||||
|
||||
cbio = BIO_new_connect("localhost:http");
|
||||
out = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
if (BIO_do_connect(cbio) <= 0) {
|
||||
fprintf(stderr, "Error connecting to server\n");
|
||||
ERR_print_errors_fp(stderr);
|
||||
exit(1);
|
||||
}
|
||||
BIO_puts(cbio, "GET / HTTP/1.0\n\n");
|
||||
for (;;) {
|
||||
len = BIO_read(cbio, tmpbuf, 1024);
|
||||
if (len <= 0)
|
||||
break;
|
||||
BIO_write(out, tmpbuf, len);
|
||||
}
|
||||
BIO_free(cbio);
|
||||
BIO_free(out);</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BIO_ADDR.html">BIO_ADDR(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>BIO_set_conn_int_port(), BIO_get_conn_int_port(), BIO_set_conn_ip(), and BIO_get_conn_ip() were removed in OpenSSL 1.1.0. Use BIO_set_conn_address() and BIO_get_conn_address() instead.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
103
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_fd.html
vendored
Normal file
103
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_fd.html
vendored
Normal file
@ -0,0 +1,103 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_fd</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_s_fd, BIO_set_fd, BIO_get_fd, BIO_new_fd - file descriptor BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_s_fd(void);
|
||||
|
||||
int BIO_set_fd(BIO *b, int fd, int c);
|
||||
int BIO_get_fd(BIO *b, int *c);
|
||||
|
||||
BIO *BIO_new_fd(int fd, int close_flag);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_fd() returns the file descriptor BIO method. This is a wrapper round the platforms file descriptor routines such as read() and write().</p>
|
||||
|
||||
<p>BIO_read_ex() and BIO_write_ex() read or write the underlying descriptor. BIO_puts() is supported but BIO_gets() is not.</p>
|
||||
|
||||
<p>If the close flag is set then close() is called on the underlying file descriptor when the BIO is freed.</p>
|
||||
|
||||
<p>BIO_reset() attempts to change the file pointer to the start of file such as by using <b>lseek(fd, 0, 0)</b>.</p>
|
||||
|
||||
<p>BIO_seek() sets the file pointer to position <b>ofs</b> from start of file such as by using <b>lseek(fd, ofs, 0)</b>.</p>
|
||||
|
||||
<p>BIO_tell() returns the current file position such as by calling <b>lseek(fd, 0, 1)</b>.</p>
|
||||
|
||||
<p>BIO_set_fd() sets the file descriptor of BIO <b>b</b> to <b>fd</b> and the close flag to <b>c</b>.</p>
|
||||
|
||||
<p>BIO_get_fd() places the file descriptor in <b>c</b> if it is not NULL, it also returns the file descriptor.</p>
|
||||
|
||||
<p>BIO_new_fd() returns a file descriptor BIO using <b>fd</b> and <b>close_flag</b>.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>The behaviour of BIO_read_ex() and BIO_write_ex() depends on the behavior of the platforms read() and write() calls on the descriptor. If the underlying file descriptor is in a non blocking mode then the BIO will behave in the manner described in the <a href="../man3/BIO_read_ex.html">BIO_read_ex(3)</a> and <a href="../man3/BIO_should_retry.html">BIO_should_retry(3)</a> manual pages.</p>
|
||||
|
||||
<p>File descriptor BIOs should not be used for socket I/O. Use socket BIOs instead.</p>
|
||||
|
||||
<p>BIO_set_fd() and BIO_get_fd() are implemented as macros.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_s_fd() returns the file descriptor BIO method.</p>
|
||||
|
||||
<p>BIO_set_fd() always returns 1.</p>
|
||||
|
||||
<p>BIO_get_fd() returns the file descriptor or -1 if the BIO has not been initialized.</p>
|
||||
|
||||
<p>BIO_new_fd() returns the newly allocated BIO or NULL is an error occurred.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>This is a file descriptor BIO version of "Hello World":</p>
|
||||
|
||||
<pre><code>BIO *out;
|
||||
|
||||
out = BIO_new_fd(fileno(stdout), BIO_NOCLOSE);
|
||||
BIO_printf(out, "Hello World\n");
|
||||
BIO_free(out);</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BIO_seek.html">BIO_seek(3)</a>, <a href="../man3/BIO_tell.html">BIO_tell(3)</a>, <a href="../man3/BIO_reset.html">BIO_reset(3)</a>, <a href="../man3/BIO_read_ex.html">BIO_read_ex(3)</a>, <a href="../man3/BIO_write_ex.html">BIO_write_ex(3)</a>, <a href="../man3/BIO_puts.html">BIO_puts(3)</a>, <a href="../man3/BIO_gets.html">BIO_gets(3)</a>, <a href="../man3/BIO_printf.html">BIO_printf(3)</a>, <a href="../man3/BIO_set_close.html">BIO_set_close(3)</a>, <a href="../man3/BIO_get_close.html">BIO_get_close(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
159
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_file.html
vendored
Normal file
159
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_file.html
vendored
Normal file
@ -0,0 +1,159 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_file</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_s_file, BIO_new_file, BIO_new_fp, BIO_set_fp, BIO_get_fp, BIO_read_filename, BIO_write_filename, BIO_append_filename, BIO_rw_filename - FILE bio</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_s_file(void);
|
||||
BIO *BIO_new_file(const char *filename, const char *mode);
|
||||
BIO *BIO_new_fp(FILE *stream, int flags);
|
||||
|
||||
BIO_set_fp(BIO *b, FILE *fp, int flags);
|
||||
BIO_get_fp(BIO *b, FILE **fpp);
|
||||
|
||||
int BIO_read_filename(BIO *b, char *name)
|
||||
int BIO_write_filename(BIO *b, char *name)
|
||||
int BIO_append_filename(BIO *b, char *name)
|
||||
int BIO_rw_filename(BIO *b, char *name)</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_file() returns the BIO file method. As its name implies it is a wrapper round the stdio FILE structure and it is a source/sink BIO.</p>
|
||||
|
||||
<p>Calls to BIO_read_ex() and BIO_write_ex() read and write data to the underlying stream. BIO_gets() and BIO_puts() are supported on file BIOs.</p>
|
||||
|
||||
<p>BIO_flush() on a file BIO calls the fflush() function on the wrapped stream.</p>
|
||||
|
||||
<p>BIO_reset() attempts to change the file pointer to the start of file using fseek(stream, 0, 0).</p>
|
||||
|
||||
<p>BIO_seek() sets the file pointer to position <b>ofs</b> from start of file using fseek(stream, ofs, 0).</p>
|
||||
|
||||
<p>BIO_eof() calls feof().</p>
|
||||
|
||||
<p>Setting the BIO_CLOSE flag calls fclose() on the stream when the BIO is freed.</p>
|
||||
|
||||
<p>BIO_new_file() creates a new file BIO with mode <b>mode</b> the meaning of <b>mode</b> is the same as the stdio function fopen(). The BIO_CLOSE flag is set on the returned BIO.</p>
|
||||
|
||||
<p>BIO_new_fp() creates a file BIO wrapping <b>stream</b>. Flags can be: BIO_CLOSE, BIO_NOCLOSE (the close flag) BIO_FP_TEXT (sets the underlying stream to text mode, default is binary: this only has any effect under Win32).</p>
|
||||
|
||||
<p>BIO_set_fp() sets the fp of a file BIO to <b>fp</b>. <b>flags</b> has the same meaning as in BIO_new_fp(), it is a macro.</p>
|
||||
|
||||
<p>BIO_get_fp() retrieves the fp of a file BIO, it is a macro.</p>
|
||||
|
||||
<p>BIO_seek() is a macro that sets the position pointer to <b>offset</b> bytes from the start of file.</p>
|
||||
|
||||
<p>BIO_tell() returns the value of the position pointer.</p>
|
||||
|
||||
<p>BIO_read_filename(), BIO_write_filename(), BIO_append_filename() and BIO_rw_filename() set the file BIO <b>b</b> to use file <b>name</b> for reading, writing, append or read write respectively.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>When wrapping stdout, stdin or stderr the underlying stream should not normally be closed so the BIO_NOCLOSE flag should be set.</p>
|
||||
|
||||
<p>Because the file BIO calls the underlying stdio functions any quirks in stdio behaviour will be mirrored by the corresponding BIO.</p>
|
||||
|
||||
<p>On Windows BIO_new_files reserves for the filename argument to be UTF-8 encoded. In other words if you have to make it work in multi- lingual environment, encode file names in UTF-8.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_s_file() returns the file BIO method.</p>
|
||||
|
||||
<p>BIO_new_file() and BIO_new_fp() return a file BIO or NULL if an error occurred.</p>
|
||||
|
||||
<p>BIO_set_fp() and BIO_get_fp() return 1 for success or 0 for failure (although the current implementation never return 0).</p>
|
||||
|
||||
<p>BIO_seek() returns the same value as the underlying fseek() function: 0 for success or -1 for failure.</p>
|
||||
|
||||
<p>BIO_tell() returns the current file position.</p>
|
||||
|
||||
<p>BIO_read_filename(), BIO_write_filename(), BIO_append_filename() and BIO_rw_filename() return 1 for success or 0 for failure.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>File BIO "hello world":</p>
|
||||
|
||||
<pre><code>BIO *bio_out;
|
||||
|
||||
bio_out = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
BIO_printf(bio_out, "Hello World\n");</code></pre>
|
||||
|
||||
<p>Alternative technique:</p>
|
||||
|
||||
<pre><code>BIO *bio_out;
|
||||
|
||||
bio_out = BIO_new(BIO_s_file());
|
||||
if (bio_out == NULL)
|
||||
/* Error */
|
||||
if (!BIO_set_fp(bio_out, stdout, BIO_NOCLOSE))
|
||||
/* Error */
|
||||
BIO_printf(bio_out, "Hello World\n");</code></pre>
|
||||
|
||||
<p>Write to a file:</p>
|
||||
|
||||
<pre><code>BIO *out;
|
||||
|
||||
out = BIO_new_file("filename.txt", "w");
|
||||
if (!out)
|
||||
/* Error */
|
||||
BIO_printf(out, "Hello World\n");
|
||||
BIO_free(out);</code></pre>
|
||||
|
||||
<p>Alternative technique:</p>
|
||||
|
||||
<pre><code>BIO *out;
|
||||
|
||||
out = BIO_new(BIO_s_file());
|
||||
if (out == NULL)
|
||||
/* Error */
|
||||
if (!BIO_write_filename(out, "filename.txt"))
|
||||
/* Error */
|
||||
BIO_printf(out, "Hello World\n");
|
||||
BIO_free(out);</code></pre>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>BIO_reset() and BIO_seek() are implemented using fseek() on the underlying stream. The return value for fseek() is 0 for success or -1 if an error occurred this differs from other types of BIO which will typically return 1 for success and a non positive value if an error occurred.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BIO_seek.html">BIO_seek(3)</a>, <a href="../man3/BIO_tell.html">BIO_tell(3)</a>, <a href="../man3/BIO_reset.html">BIO_reset(3)</a>, <a href="../man3/BIO_flush.html">BIO_flush(3)</a>, <a href="../man3/BIO_read_ex.html">BIO_read_ex(3)</a>, <a href="../man3/BIO_write_ex.html">BIO_write_ex(3)</a>, <a href="../man3/BIO_puts.html">BIO_puts(3)</a>, <a href="../man3/BIO_gets.html">BIO_gets(3)</a>, <a href="../man3/BIO_printf.html">BIO_printf(3)</a>, <a href="../man3/BIO_set_close.html">BIO_set_close(3)</a>, <a href="../man3/BIO_get_close.html">BIO_get_close(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
137
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_mem.html
vendored
Normal file
137
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_mem.html
vendored
Normal file
@ -0,0 +1,137 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_mem</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_s_secmem, BIO_s_mem, BIO_set_mem_eof_return, BIO_get_mem_data, BIO_set_mem_buf, BIO_get_mem_ptr, BIO_new_mem_buf - memory BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_s_mem(void);
|
||||
const BIO_METHOD *BIO_s_secmem(void);
|
||||
|
||||
BIO_set_mem_eof_return(BIO *b, int v)
|
||||
long BIO_get_mem_data(BIO *b, char **pp)
|
||||
BIO_set_mem_buf(BIO *b, BUF_MEM *bm, int c)
|
||||
BIO_get_mem_ptr(BIO *b, BUF_MEM **pp)
|
||||
|
||||
BIO *BIO_new_mem_buf(const void *buf, int len);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_mem() returns the memory BIO method function.</p>
|
||||
|
||||
<p>A memory BIO is a source/sink BIO which uses memory for its I/O. Data written to a memory BIO is stored in a BUF_MEM structure which is extended as appropriate to accommodate the stored data.</p>
|
||||
|
||||
<p>BIO_s_secmem() is like BIO_s_mem() except that the secure heap is used for buffer storage.</p>
|
||||
|
||||
<p>Any data written to a memory BIO can be recalled by reading from it. Unless the memory BIO is read only any data read from it is deleted from the BIO.</p>
|
||||
|
||||
<p>Memory BIOs support BIO_gets() and BIO_puts().</p>
|
||||
|
||||
<p>If the BIO_CLOSE flag is set when a memory BIO is freed then the underlying BUF_MEM structure is also freed.</p>
|
||||
|
||||
<p>Calling BIO_reset() on a read write memory BIO clears any data in it if the flag BIO_FLAGS_NONCLEAR_RST is not set, otherwise it just restores the read pointer to the state it was just after the last write was performed and the data can be read again. On a read only BIO it similarly restores the BIO to its original state and the read only data can be read again.</p>
|
||||
|
||||
<p>BIO_eof() is true if no data is in the BIO.</p>
|
||||
|
||||
<p>BIO_ctrl_pending() returns the number of bytes currently stored.</p>
|
||||
|
||||
<p>BIO_set_mem_eof_return() sets the behaviour of memory BIO <b>b</b> when it is empty. If the <b>v</b> is zero then an empty memory BIO will return EOF (that is it will return zero and BIO_should_retry(b) will be false. If <b>v</b> is non zero then it will return <b>v</b> when it is empty and it will set the read retry flag (that is BIO_read_retry(b) is true). To avoid ambiguity with a normal positive return value <b>v</b> should be set to a negative value, typically -1.</p>
|
||||
|
||||
<p>BIO_get_mem_data() sets *<b>pp</b> to a pointer to the start of the memory BIOs data and returns the total amount of data available. It is implemented as a macro.</p>
|
||||
|
||||
<p>BIO_set_mem_buf() sets the internal BUF_MEM structure to <b>bm</b> and sets the close flag to <b>c</b>, that is <b>c</b> should be either BIO_CLOSE or BIO_NOCLOSE. It is a macro.</p>
|
||||
|
||||
<p>BIO_get_mem_ptr() places the underlying BUF_MEM structure in *<b>pp</b>. It is a macro.</p>
|
||||
|
||||
<p>BIO_new_mem_buf() creates a memory BIO using <b>len</b> bytes of data at <b>buf</b>, if <b>len</b> is -1 then the <b>buf</b> is assumed to be nul terminated and its length is determined by <b>strlen</b>. The BIO is set to a read only state and as a result cannot be written to. This is useful when some data needs to be made available from a static area of memory in the form of a BIO. The supplied data is read directly from the supplied buffer: it is <b>not</b> copied first, so the supplied area of memory must be unchanged until the BIO is freed.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Writes to memory BIOs will always succeed if memory is available: that is their size can grow indefinitely.</p>
|
||||
|
||||
<p>Every write after partial read (not all data in the memory buffer was read) to a read write memory BIO will have to move the unread data with an internal copy operation, if a BIO contains a lot of data and it is read in small chunks intertwined with writes the operation can be very slow. Adding a buffering BIO to the chain can speed up the process.</p>
|
||||
|
||||
<p>Calling BIO_set_mem_buf() on a BIO created with BIO_new_secmem() will give undefined results, including perhaps a program crash.</p>
|
||||
|
||||
<p>Switching the memory BIO from read write to read only is not supported and can give undefined results including a program crash. There are two notable exceptions to the rule. The first one is to assign a static memory buffer immediately after BIO creation and set the BIO as read only.</p>
|
||||
|
||||
<p>The other supported sequence is to start with read write BIO then temporarily switch it to read only and call BIO_reset() on the read only BIO immediately before switching it back to read write. Before the BIO is freed it must be switched back to the read write mode.</p>
|
||||
|
||||
<p>Calling BIO_get_mem_ptr() on read only BIO will return a BUF_MEM that contains only the remaining data to be read. If the close status of the BIO is set to BIO_NOCLOSE, before freeing the BUF_MEM the data pointer in it must be set to NULL as the data pointer does not point to an allocated memory.</p>
|
||||
|
||||
<p>Calling BIO_reset() on a read write memory BIO with BIO_FLAGS_NONCLEAR_RST flag set can have unexpected outcome when the reads and writes to the BIO are intertwined. As documented above the BIO will be reset to the state after the last completed write operation. The effects of reads preceding that write operation cannot be undone.</p>
|
||||
|
||||
<p>Calling BIO_get_mem_ptr() prior to a BIO_reset() call with BIO_FLAGS_NONCLEAR_RST set has the same effect as a write operation.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>There should be an option to set the maximum size of a memory BIO.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_s_mem() and BIO_s_secmem() return a valid memory <b>BIO_METHOD</b> structure.</p>
|
||||
|
||||
<p>BIO_set_mem_eof_return(), BIO_set_mem_buf() and BIO_get_mem_ptr() return 1 on success or a value which is less than or equal to 0 if an error occurred.</p>
|
||||
|
||||
<p>BIO_get_mem_data() returns the total number of bytes available on success, 0 if b is NULL, or a negative value in case of other errors.</p>
|
||||
|
||||
<p>BIO_new_mem_buf() returns a valid <b>BIO</b> structure on success or NULL on error.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>Create a memory BIO and write some data to it:</p>
|
||||
|
||||
<pre><code>BIO *mem = BIO_new(BIO_s_mem());
|
||||
|
||||
BIO_puts(mem, "Hello World\n");</code></pre>
|
||||
|
||||
<p>Create a read only memory BIO:</p>
|
||||
|
||||
<pre><code>char data[] = "Hello World";
|
||||
BIO *mem = BIO_new_mem_buf(data, -1);</code></pre>
|
||||
|
||||
<p>Extract the BUF_MEM structure from a memory BIO and then free up the BIO:</p>
|
||||
|
||||
<pre><code>BUF_MEM *bptr;
|
||||
|
||||
BIO_get_mem_ptr(mem, &bptr);
|
||||
BIO_set_close(mem, BIO_NOCLOSE); /* So BIO_free() leaves BUF_MEM alone */
|
||||
BIO_free(mem);</code></pre>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
60
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_null.html
vendored
Normal file
60
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_null.html
vendored
Normal file
@ -0,0 +1,60 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_null</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_s_null - null data sink</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_s_null(void);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_null() returns the null sink BIO method. Data written to the null sink is discarded, reads return EOF.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>A null sink BIO behaves in a similar manner to the Unix /dev/null device.</p>
|
||||
|
||||
<p>A null bio can be placed on the end of a chain to discard any data passed through it.</p>
|
||||
|
||||
<p>A null sink is useful if, for example, an application wishes to digest some data by writing through a digest bio but not send the digested data anywhere. Since a BIO chain must normally include a source/sink BIO this can be achieved by adding a null sink BIO to the end of the chain</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_s_null() returns the null sink BIO method.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
68
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_socket.html
vendored
Normal file
68
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_s_socket.html
vendored
Normal file
@ -0,0 +1,68 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_s_socket</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_s_socket, BIO_new_socket - socket BIO</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
const BIO_METHOD *BIO_s_socket(void);
|
||||
|
||||
BIO *BIO_new_socket(int sock, int close_flag);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_s_socket() returns the socket BIO method. This is a wrapper round the platform's socket routines.</p>
|
||||
|
||||
<p>BIO_read_ex() and BIO_write_ex() read or write the underlying socket. BIO_puts() is supported but BIO_gets() is not.</p>
|
||||
|
||||
<p>If the close flag is set then the socket is shut down and closed when the BIO is freed.</p>
|
||||
|
||||
<p>BIO_new_socket() returns a socket BIO using <b>sock</b> and <b>close_flag</b>.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>Socket BIOs also support any relevant functionality of file descriptor BIOs.</p>
|
||||
|
||||
<p>The reason for having separate file descriptor and socket BIOs is that on some platforms sockets are not file descriptors and use distinct I/O routines, Windows is one such platform. Any code mixing the two will not work on all platforms.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_s_socket() returns the socket BIO method.</p>
|
||||
|
||||
<p>BIO_new_socket() returns the newly allocated BIO or NULL is an error occurred.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
251
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_set_callback.html
vendored
Normal file
251
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_set_callback.html
vendored
Normal file
@ -0,0 +1,251 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_set_callback</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#CALLBACK-OPERATIONS">CALLBACK OPERATIONS</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#EXAMPLES">EXAMPLES</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_set_callback_ex, BIO_get_callback_ex, BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg, BIO_debug_callback, BIO_callback_fn_ex, BIO_callback_fn - BIO callback functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
typedef long (*BIO_callback_fn_ex)(BIO *b, int oper, const char *argp,
|
||||
size_t len, int argi,
|
||||
long argl, int ret, size_t *processed);
|
||||
typedef long (*BIO_callback_fn)(BIO *b, int oper, const char *argp, int argi,
|
||||
long argl, long ret);
|
||||
|
||||
void BIO_set_callback_ex(BIO *b, BIO_callback_fn_ex callback);
|
||||
BIO_callback_fn_ex BIO_get_callback_ex(const BIO *b);
|
||||
|
||||
void BIO_set_callback(BIO *b, BIO_callback_fn cb);
|
||||
BIO_callback_fn BIO_get_callback(BIO *b);
|
||||
void BIO_set_callback_arg(BIO *b, char *arg);
|
||||
char *BIO_get_callback_arg(const BIO *b);
|
||||
|
||||
long BIO_debug_callback(BIO *bio, int cmd, const char *argp, int argi,
|
||||
long argl, long ret);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BIO_set_callback_ex() and BIO_get_callback_ex() set and retrieve the BIO callback. The callback is called during most high level BIO operations. It can be used for debugging purposes to trace operations on a BIO or to modify its operation.</p>
|
||||
|
||||
<p>BIO_set_callback() and BIO_get_callback() set and retrieve the old format BIO callback. New code should not use these functions, but they are retained for backwards compatibility. Any callback set via BIO_set_callback_ex() will get called in preference to any set by BIO_set_callback().</p>
|
||||
|
||||
<p>BIO_set_callback_arg() and BIO_get_callback_arg() are macros which can be used to set and retrieve an argument for use in the callback.</p>
|
||||
|
||||
<p>BIO_debug_callback() is a standard debugging callback which prints out information relating to each BIO operation. If the callback argument is set it is interpreted as a BIO to send the information to, otherwise stderr is used.</p>
|
||||
|
||||
<p>BIO_callback_fn_ex() is the type of the callback function and BIO_callback_fn() is the type of the old format callback function. The meaning of each argument is described below:</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="b"><b>b</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The BIO the callback is attached to is passed in <b>b</b>.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="oper"><b>oper</b></dt>
|
||||
<dd>
|
||||
|
||||
<p><b>oper</b> is set to the operation being performed. For some operations the callback is called twice, once before and once after the actual operation, the latter case has <b>oper</b> or'ed with BIO_CB_RETURN.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="len"><b>len</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The length of the data requested to be read or written. This is only useful if <b>oper</b> is BIO_CB_READ, BIO_CB_WRITE or BIO_CB_GETS.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="argp-argi-argl"><b>argp</b> <b>argi</b> <b>argl</b></dt>
|
||||
<dd>
|
||||
|
||||
<p>The meaning of the arguments <b>argp</b>, <b>argi</b> and <b>argl</b> depends on the value of <b>oper</b>, that is the operation being performed.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="processed"><b>processed</b></dt>
|
||||
<dd>
|
||||
|
||||
<p><b>processed</b> is a pointer to a location which will be updated with the amount of data that was actually read or written. Only used for BIO_CB_READ, BIO_CB_WRITE, BIO_CB_GETS and BIO_CB_PUTS.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="ret"><b>ret</b></dt>
|
||||
<dd>
|
||||
|
||||
<p><b>ret</b> is the return value that would be returned to the application if no callback were present. The actual value returned is the return value of the callback itself. In the case of callbacks called before the actual BIO operation 1 is placed in <b>ret</b>, if the return value is not positive it will be immediately returned to the application and the BIO operation will not be performed.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<p>The callback should normally simply return <b>ret</b> when it has finished processing, unless it specifically wishes to modify the value returned to the application.</p>
|
||||
|
||||
<h1 id="CALLBACK-OPERATIONS">CALLBACK OPERATIONS</h1>
|
||||
|
||||
<p>In the notes below, <b>callback</b> defers to the actual callback function that is called.</p>
|
||||
|
||||
<dl>
|
||||
|
||||
<dt id="BIO_free-b"><b>BIO_free(b)</b></dt>
|
||||
<dd>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_FREE, NULL, 0, 0, 0L, 1L, NULL)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_FREE, NULL, 0L, 0L, 1L)</code></pre>
|
||||
|
||||
<p>is called before the free operation.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_read_ex-b-data-dlen-readbytes"><b>BIO_read_ex(b, data, dlen, readbytes)</b></dt>
|
||||
<dd>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_READ, data, dlen, 0, 0L, 1L, NULL)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_READ, data, dlen, 0L, 1L)</code></pre>
|
||||
|
||||
<p>is called before the read and</p>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_READ | BIO_CB_RETURN, data, dlen, 0, 0L, retvalue,
|
||||
&readbytes)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_READ|BIO_CB_RETURN, data, dlen, 0L, retvalue)</code></pre>
|
||||
|
||||
<p>after.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_write-b-data-dlen-written"><b>BIO_write(b, data, dlen, written)</b></dt>
|
||||
<dd>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_WRITE, data, dlen, 0, 0L, 1L, NULL)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_WRITE, datat, dlen, 0L, 1L)</code></pre>
|
||||
|
||||
<p>is called before the write and</p>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_WRITE | BIO_CB_RETURN, data, dlen, 0, 0L, retvalue,
|
||||
&written)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_WRITE|BIO_CB_RETURN, data, dlen, 0L, retvalue)</code></pre>
|
||||
|
||||
<p>after.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_gets-b-buf-size"><b>BIO_gets(b, buf, size)</b></dt>
|
||||
<dd>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_GETS, buf, size, 0, 0L, 1, NULL, NULL)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_GETS, buf, size, 0L, 1L)</code></pre>
|
||||
|
||||
<p>is called before the operation and</p>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_GETS | BIO_CB_RETURN, buf, size, 0, 0L, retvalue,
|
||||
&readbytes)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_GETS|BIO_CB_RETURN, buf, size, 0L, retvalue)</code></pre>
|
||||
|
||||
<p>after.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_puts-b-buf"><b>BIO_puts(b, buf)</b></dt>
|
||||
<dd>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_PUTS, buf, 0, 0, 0L, 1L, NULL);</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_PUTS, buf, 0, 0L, 1L)</code></pre>
|
||||
|
||||
<p>is called before the operation and</p>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_PUTS | BIO_CB_RETURN, buf, 0, 0, 0L, retvalue, &written)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_PUTS|BIO_CB_RETURN, buf, 0, 0L, retvalue)</code></pre>
|
||||
|
||||
<p>after.</p>
|
||||
|
||||
</dd>
|
||||
<dt id="BIO_ctrl-BIO-b-int-cmd-long-larg-void-parg"><b>BIO_ctrl(BIO *b, int cmd, long larg, void *parg)</b></dt>
|
||||
<dd>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_CTRL, parg, 0, cmd, larg, 1L, NULL)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_CTRL, parg, cmd, larg, 1L)</code></pre>
|
||||
|
||||
<p>is called before the call and</p>
|
||||
|
||||
<pre><code>callback_ex(b, BIO_CB_CTRL | BIO_CB_RETURN, parg, 0, cmd, larg, ret, NULL)</code></pre>
|
||||
|
||||
<p>or</p>
|
||||
|
||||
<pre><code>callback(b, BIO_CB_CTRL|BIO_CB_RETURN, parg, cmd, larg, ret)</code></pre>
|
||||
|
||||
<p>after.</p>
|
||||
|
||||
<p>Note: <b>cmd</b> == <b>BIO_CTRL_SET_CALLBACK</b> is special, because <b>parg</b> is not the argument of type <b>BIO_info_cb</b> itself. In this case <b>parg</b> is a pointer to the actual call parameter, see <b>BIO_callback_ctrl</b>.</p>
|
||||
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_get_callback_ex() and BIO_get_callback() return the callback function previously set by a call to BIO_set_callback_ex() and BIO_set_callback() respectively.</p>
|
||||
|
||||
<p>BIO_get_callback_arg() returns a <b>char</b> pointer to the value previously set via a call to BIO_set_callback_arg().</p>
|
||||
|
||||
<p>BIO_debug_callback() returns 1 or <b>ret</b> if it's called after specific BIO operations.</p>
|
||||
|
||||
<h1 id="EXAMPLES">EXAMPLES</h1>
|
||||
|
||||
<p>The BIO_debug_callback() function is a good example, its source is in crypto/bio/bio_cb.c</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
115
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_should_retry.html
vendored
Normal file
115
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BIO_should_retry.html
vendored
Normal file
@ -0,0 +1,115 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BIO_should_retry</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#NOTES">NOTES</a></li>
|
||||
<li><a href="#BUGS">BUGS</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BIO_should_read, BIO_should_write, BIO_should_io_special, BIO_retry_type, BIO_should_retry, BIO_get_retry_BIO, BIO_get_retry_reason, BIO_set_retry_reason - BIO retry functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bio.h>
|
||||
|
||||
int BIO_should_read(BIO *b);
|
||||
int BIO_should_write(BIO *b);
|
||||
int BIO_should_io_special(iBIO *b);
|
||||
int BIO_retry_type(BIO *b);
|
||||
int BIO_should_retry(BIO *b);
|
||||
|
||||
BIO *BIO_get_retry_BIO(BIO *bio, int *reason);
|
||||
int BIO_get_retry_reason(BIO *bio);
|
||||
void BIO_set_retry_reason(BIO *bio, int reason);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions determine why a BIO is not able to read or write data. They will typically be called after a failed BIO_read_ex() or BIO_write_ex() call.</p>
|
||||
|
||||
<p>BIO_should_retry() is true if the call that produced this condition should then be retried at a later time.</p>
|
||||
|
||||
<p>If BIO_should_retry() is false then the cause is an error condition.</p>
|
||||
|
||||
<p>BIO_should_read() is true if the cause of the condition is that the BIO has insufficient data to return. Check for readability and/or retry the last operation.</p>
|
||||
|
||||
<p>BIO_should_write() is true if the cause of the condition is that the BIO has pending data to write. Check for writability and/or retry the last operation.</p>
|
||||
|
||||
<p>BIO_should_io_special() is true if some "special" condition, that is a reason other than reading or writing is the cause of the condition.</p>
|
||||
|
||||
<p>BIO_retry_type() returns a mask of the cause of a retry condition consisting of the values <b>BIO_FLAGS_READ</b>, <b>BIO_FLAGS_WRITE</b>, <b>BIO_FLAGS_IO_SPECIAL</b> though current BIO types will only set one of these.</p>
|
||||
|
||||
<p>BIO_get_retry_BIO() determines the precise reason for the special condition, it returns the BIO that caused this condition and if <b>reason</b> is not NULL it contains the reason code. The meaning of the reason code and the action that should be taken depends on the type of BIO that resulted in this condition.</p>
|
||||
|
||||
<p>BIO_get_retry_reason() returns the reason for a special condition if passed the relevant BIO, for example as returned by BIO_get_retry_BIO().</p>
|
||||
|
||||
<p>BIO_set_retry_reason() sets the retry reason for a special condition for a given BIO. This would usually only be called by BIO implementations.</p>
|
||||
|
||||
<h1 id="NOTES">NOTES</h1>
|
||||
|
||||
<p>BIO_should_read(), BIO_should_write(), BIO_should_io_special(), BIO_retry_type(), and BIO_should_retry(), are implemented as macros.</p>
|
||||
|
||||
<p>If BIO_should_retry() returns false then the precise "error condition" depends on the BIO type that caused it and the return code of the BIO operation. For example if a call to BIO_read_ex() on a socket BIO returns 0 and BIO_should_retry() is false then the cause will be that the connection closed. A similar condition on a file BIO will mean that it has reached EOF. Some BIO types may place additional information on the error queue. For more details see the individual BIO type manual pages.</p>
|
||||
|
||||
<p>If the underlying I/O structure is in a blocking mode almost all current BIO types will not request a retry, because the underlying I/O calls will not. If the application knows that the BIO type will never signal a retry then it need not call BIO_should_retry() after a failed BIO I/O call. This is typically done with file BIOs.</p>
|
||||
|
||||
<p>SSL BIOs are the only current exception to this rule: they can request a retry even if the underlying I/O structure is blocking, if a handshake occurs during a call to BIO_read(). An application can retry the failed call immediately or avoid this situation by setting SSL_MODE_AUTO_RETRY on the underlying SSL structure.</p>
|
||||
|
||||
<p>While an application may retry a failed non blocking call immediately this is likely to be very inefficient because the call will fail repeatedly until data can be processed or is available. An application will normally wait until the necessary condition is satisfied. How this is done depends on the underlying I/O structure.</p>
|
||||
|
||||
<p>For example if the cause is ultimately a socket and BIO_should_read() is true then a call to select() may be made to wait until data is available and then retry the BIO operation. By combining the retry conditions of several non blocking BIOs in a single select() call it is possible to service several BIOs in a single thread, though the performance may be poor if SSL BIOs are present because long delays can occur during the initial handshake process.</p>
|
||||
|
||||
<p>It is possible for a BIO to block indefinitely if the underlying I/O structure cannot process or return any data. This depends on the behaviour of the platforms I/O functions. This is often not desirable: one solution is to use non blocking I/O and use a timeout on the select() (or equivalent) call.</p>
|
||||
|
||||
<h1 id="BUGS">BUGS</h1>
|
||||
|
||||
<p>The OpenSSL ASN1 functions cannot gracefully deal with non blocking I/O: that is they cannot retry after a partial read or write. This is usually worked around by only passing the relevant data to ASN1 functions when the entire structure can be read or written.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BIO_should_read(), BIO_should_write(), BIO_should_io_special(), and BIO_should_retry() return either 1 or 0 based on the actual conditions of the <b>BIO</b>.</p>
|
||||
|
||||
<p>BIO_retry_type() returns a flag combination presenting the cause of a retry condition or false if there is no retry condition.</p>
|
||||
|
||||
<p>BIO_get_retry_BIO() returns a valid <b>BIO</b> structure.</p>
|
||||
|
||||
<p>BIO_get_retry_reason() returns the reason for a special condition.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="/../man7/bio.html">bio</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>The BIO_get_retry_reason() and BIO_set_retry_reason() functions were added in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
112
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_BLINDING_new.html
vendored
Normal file
112
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_BLINDING_new.html
vendored
Normal file
@ -0,0 +1,112 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BN_BLINDING_new</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BN_BLINDING_new, BN_BLINDING_free, BN_BLINDING_update, BN_BLINDING_convert, BN_BLINDING_invert, BN_BLINDING_convert_ex, BN_BLINDING_invert_ex, BN_BLINDING_is_current_thread, BN_BLINDING_set_current_thread, BN_BLINDING_lock, BN_BLINDING_unlock, BN_BLINDING_get_flags, BN_BLINDING_set_flags, BN_BLINDING_create_param - blinding related BIGNUM functions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bn.h>
|
||||
|
||||
BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai,
|
||||
BIGNUM *mod);
|
||||
void BN_BLINDING_free(BN_BLINDING *b);
|
||||
int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx);
|
||||
int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
|
||||
int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
|
||||
int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b,
|
||||
BN_CTX *ctx);
|
||||
int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,
|
||||
BN_CTX *ctx);
|
||||
int BN_BLINDING_is_current_thread(BN_BLINDING *b);
|
||||
void BN_BLINDING_set_current_thread(BN_BLINDING *b);
|
||||
int BN_BLINDING_lock(BN_BLINDING *b);
|
||||
int BN_BLINDING_unlock(BN_BLINDING *b);
|
||||
unsigned long BN_BLINDING_get_flags(const BN_BLINDING *);
|
||||
void BN_BLINDING_set_flags(BN_BLINDING *, unsigned long);
|
||||
BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
|
||||
const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
|
||||
int (*bn_mod_exp)(BIGNUM *r,
|
||||
const BIGNUM *a,
|
||||
const BIGNUM *p,
|
||||
const BIGNUM *m,
|
||||
BN_CTX *ctx,
|
||||
BN_MONT_CTX *m_ctx),
|
||||
BN_MONT_CTX *m_ctx);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BN_BLINDING_new() allocates a new <b>BN_BLINDING</b> structure and copies the <b>A</b> and <b>Ai</b> values into the newly created <b>BN_BLINDING</b> object.</p>
|
||||
|
||||
<p>BN_BLINDING_free() frees the <b>BN_BLINDING</b> structure. If <b>b</b> is NULL, nothing is done.</p>
|
||||
|
||||
<p>BN_BLINDING_update() updates the <b>BN_BLINDING</b> parameters by squaring the <b>A</b> and <b>Ai</b> or, after specific number of uses and if the necessary parameters are set, by re-creating the blinding parameters.</p>
|
||||
|
||||
<p>BN_BLINDING_convert_ex() multiplies <b>n</b> with the blinding factor <b>A</b>. If <b>r</b> is not NULL a copy the inverse blinding factor <b>Ai</b> will be returned in <b>r</b> (this is useful if a <b>RSA</b> object is shared among several threads). BN_BLINDING_invert_ex() multiplies <b>n</b> with the inverse blinding factor <b>Ai</b>. If <b>r</b> is not NULL it will be used as the inverse blinding.</p>
|
||||
|
||||
<p>BN_BLINDING_convert() and BN_BLINDING_invert() are wrapper functions for BN_BLINDING_convert_ex() and BN_BLINDING_invert_ex() with <b>r</b> set to NULL.</p>
|
||||
|
||||
<p>BN_BLINDING_is_current_thread() returns whether the <b>BN_BLINDING</b> structure is owned by the current thread. This is to help users provide proper locking if needed for multi-threaded use.</p>
|
||||
|
||||
<p>BN_BLINDING_set_current_thread() sets the current thread as the owner of the <b>BN_BLINDING</b> structure.</p>
|
||||
|
||||
<p>BN_BLINDING_lock() locks the <b>BN_BLINDING</b> structure.</p>
|
||||
|
||||
<p>BN_BLINDING_unlock() unlocks the <b>BN_BLINDING</b> structure.</p>
|
||||
|
||||
<p>BN_BLINDING_get_flags() returns the BN_BLINDING flags. Currently there are two supported flags: <b>BN_BLINDING_NO_UPDATE</b> and <b>BN_BLINDING_NO_RECREATE</b>. <b>BN_BLINDING_NO_UPDATE</b> inhibits the automatic update of the <b>BN_BLINDING</b> parameters after each use and <b>BN_BLINDING_NO_RECREATE</b> inhibits the automatic re-creation of the <b>BN_BLINDING</b> parameters after a fixed number of uses (currently 32). In newly allocated <b>BN_BLINDING</b> objects no flags are set. BN_BLINDING_set_flags() sets the <b>BN_BLINDING</b> parameters flags.</p>
|
||||
|
||||
<p>BN_BLINDING_create_param() creates new <b>BN_BLINDING</b> parameters using the exponent <b>e</b> and the modulus <b>m</b>. <b>bn_mod_exp</b> and <b>m_ctx</b> can be used to pass special functions for exponentiation (normally BN_mod_exp_mont() and <b>BN_MONT_CTX</b>).</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BN_BLINDING_new() returns the newly allocated <b>BN_BLINDING</b> structure or NULL in case of an error.</p>
|
||||
|
||||
<p>BN_BLINDING_update(), BN_BLINDING_convert(), BN_BLINDING_invert(), BN_BLINDING_convert_ex() and BN_BLINDING_invert_ex() return 1 on success and 0 if an error occurred.</p>
|
||||
|
||||
<p>BN_BLINDING_is_current_thread() returns 1 if the current thread owns the <b>BN_BLINDING</b> object, 0 otherwise.</p>
|
||||
|
||||
<p>BN_BLINDING_set_current_thread() doesn't return anything.</p>
|
||||
|
||||
<p>BN_BLINDING_lock(), BN_BLINDING_unlock() return 1 if the operation succeeded or 0 on error.</p>
|
||||
|
||||
<p>BN_BLINDING_get_flags() returns the currently set <b>BN_BLINDING</b> flags (a <b>unsigned long</b> value).</p>
|
||||
|
||||
<p>BN_BLINDING_create_param() returns the newly created <b>BN_BLINDING</b> parameters or NULL on error.</p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>BN_BLINDING_thread_id() was first introduced in OpenSSL 1.0.0, and it deprecates BN_BLINDING_set_thread_id() and BN_BLINDING_get_thread_id().</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2005-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
87
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_CTX_new.html
vendored
Normal file
87
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_CTX_new.html
vendored
Normal file
@ -0,0 +1,87 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BN_CTX_new</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#REMOVED-FUNCTIONALITY">REMOVED FUNCTIONALITY</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#HISTORY">HISTORY</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BN_CTX_new, BN_CTX_secure_new, BN_CTX_free - allocate and free BN_CTX structures</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bn.h>
|
||||
|
||||
BN_CTX *BN_CTX_new(void);
|
||||
|
||||
BN_CTX *BN_CTX_secure_new(void);
|
||||
|
||||
void BN_CTX_free(BN_CTX *c);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>A <b>BN_CTX</b> is a structure that holds <b>BIGNUM</b> temporary variables used by library functions. Since dynamic memory allocation to create <b>BIGNUM</b>s is rather expensive when used in conjunction with repeated subroutine calls, the <b>BN_CTX</b> structure is used.</p>
|
||||
|
||||
<p>BN_CTX_new() allocates and initializes a <b>BN_CTX</b> structure. BN_CTX_secure_new() allocates and initializes a <b>BN_CTX</b> structure but uses the secure heap (see <a href="../man3/CRYPTO_secure_malloc.html">CRYPTO_secure_malloc(3)</a>) to hold the <b>BIGNUM</b>s.</p>
|
||||
|
||||
<p>BN_CTX_free() frees the components of the <b>BN_CTX</b> and the structure itself. Since BN_CTX_start() is required in order to obtain <b>BIGNUM</b>s from the <b>BN_CTX</b>, in most cases BN_CTX_end() must be called before the <b>BN_CTX</b> may be freed by BN_CTX_free(). If <b>c</b> is NULL, nothing is done.</p>
|
||||
|
||||
<p>A given <b>BN_CTX</b> must only be used by a single thread of execution. No locking is performed, and the internal pool allocator will not properly handle multiple threads of execution.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BN_CTX_new() and BN_CTX_secure_new() return a pointer to the <b>BN_CTX</b>. If the allocation fails, they return <b>NULL</b> and sets an error code that can be obtained by <a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>.</p>
|
||||
|
||||
<p>BN_CTX_free() has no return values.</p>
|
||||
|
||||
<h1 id="REMOVED-FUNCTIONALITY">REMOVED FUNCTIONALITY</h1>
|
||||
|
||||
<pre><code>void BN_CTX_init(BN_CTX *c);</code></pre>
|
||||
|
||||
<p>BN_CTX_init() is no longer available as of OpenSSL 1.1.0. Applications should replace use of BN_CTX_init with BN_CTX_new instead:</p>
|
||||
|
||||
<pre><code>BN_CTX *ctx;
|
||||
ctx = BN_CTX_new();
|
||||
if (!ctx)
|
||||
/* error */
|
||||
...
|
||||
BN_CTX_free(ctx);</code></pre>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>, <a href="../man3/BN_add.html">BN_add(3)</a>, <a href="../man3/BN_CTX_start.html">BN_CTX_start(3)</a></p>
|
||||
|
||||
<h1 id="HISTORY">HISTORY</h1>
|
||||
|
||||
<p>BN_CTX_init() was removed in OpenSSL 1.1.0.</p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
66
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_CTX_start.html
vendored
Normal file
66
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_CTX_start.html
vendored
Normal file
@ -0,0 +1,66 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BN_CTX_start</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BN_CTX_start, BN_CTX_get, BN_CTX_end - use temporary BIGNUM variables</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bn.h>
|
||||
|
||||
void BN_CTX_start(BN_CTX *ctx);
|
||||
|
||||
BIGNUM *BN_CTX_get(BN_CTX *ctx);
|
||||
|
||||
void BN_CTX_end(BN_CTX *ctx);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions are used to obtain temporary <b>BIGNUM</b> variables from a <b>BN_CTX</b> (which can been created by using <a href="../man3/BN_CTX_new.html">BN_CTX_new(3)</a>) in order to save the overhead of repeatedly creating and freeing <b>BIGNUM</b>s in functions that are called from inside a loop.</p>
|
||||
|
||||
<p>A function must call BN_CTX_start() first. Then, BN_CTX_get() may be called repeatedly to obtain temporary <b>BIGNUM</b>s. All BN_CTX_get() calls must be made before calling any other functions that use the <b>ctx</b> as an argument.</p>
|
||||
|
||||
<p>Finally, BN_CTX_end() must be called before returning from the function. If <b>ctx</b> is NULL, nothing is done. When BN_CTX_end() is called, the <b>BIGNUM</b> pointers obtained from BN_CTX_get() become invalid.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BN_CTX_start() and BN_CTX_end() return no values.</p>
|
||||
|
||||
<p>BN_CTX_get() returns a pointer to the <b>BIGNUM</b>, or <b>NULL</b> on error. Once BN_CTX_get() has failed, the subsequent calls will return <b>NULL</b> as well, so it is sufficient to check the return value of the last BN_CTX_get() call. In case of an error, an error code is set, which can be obtained by <a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/BN_CTX_new.html">BN_CTX_new(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
117
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_add.html
vendored
Normal file
117
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_add.html
vendored
Normal file
@ -0,0 +1,117 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BN_add</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BN_add, BN_sub, BN_mul, BN_sqr, BN_div, BN_mod, BN_nnmod, BN_mod_add, BN_mod_sub, BN_mod_mul, BN_mod_sqr, BN_exp, BN_mod_exp, BN_gcd - arithmetic operations on BIGNUMs</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bn.h>
|
||||
|
||||
int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
|
||||
|
||||
int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
|
||||
|
||||
int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
|
||||
|
||||
int BN_sqr(BIGNUM *r, BIGNUM *a, BN_CTX *ctx);
|
||||
|
||||
int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *a, const BIGNUM *d,
|
||||
BN_CTX *ctx);
|
||||
|
||||
int BN_mod(BIGNUM *rem, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
|
||||
|
||||
int BN_nnmod(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
|
||||
|
||||
int BN_mod_add(BIGNUM *r, BIGNUM *a, BIGNUM *b, const BIGNUM *m,
|
||||
BN_CTX *ctx);
|
||||
|
||||
int BN_mod_sub(BIGNUM *r, BIGNUM *a, BIGNUM *b, const BIGNUM *m,
|
||||
BN_CTX *ctx);
|
||||
|
||||
int BN_mod_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, const BIGNUM *m,
|
||||
BN_CTX *ctx);
|
||||
|
||||
int BN_mod_sqr(BIGNUM *r, BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
|
||||
|
||||
int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx);
|
||||
|
||||
int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
|
||||
const BIGNUM *m, BN_CTX *ctx);
|
||||
|
||||
int BN_gcd(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BN_add() adds <i>a</i> and <i>b</i> and places the result in <i>r</i> (<code>r=a+b</code>). <i>r</i> may be the same <b>BIGNUM</b> as <i>a</i> or <i>b</i>.</p>
|
||||
|
||||
<p>BN_sub() subtracts <i>b</i> from <i>a</i> and places the result in <i>r</i> (<code>r=a-b</code>). <i>r</i> may be the same <b>BIGNUM</b> as <i>a</i> or <i>b</i>.</p>
|
||||
|
||||
<p>BN_mul() multiplies <i>a</i> and <i>b</i> and places the result in <i>r</i> (<code>r=a*b</code>). <i>r</i> may be the same <b>BIGNUM</b> as <i>a</i> or <i>b</i>. For multiplication by powers of 2, use <a href="../man3/BN_lshift.html">BN_lshift(3)</a>.</p>
|
||||
|
||||
<p>BN_sqr() takes the square of <i>a</i> and places the result in <i>r</i> (<code>r=a^2</code>). <i>r</i> and <i>a</i> may be the same <b>BIGNUM</b>. This function is faster than BN_mul(r,a,a).</p>
|
||||
|
||||
<p>BN_div() divides <i>a</i> by <i>d</i> and places the result in <i>dv</i> and the remainder in <i>rem</i> (<code>dv=a/d, rem=a%d</code>). Either of <i>dv</i> and <i>rem</i> may be <b>NULL</b>, in which case the respective value is not returned. The result is rounded towards zero; thus if <i>a</i> is negative, the remainder will be zero or negative. For division by powers of 2, use BN_rshift(3).</p>
|
||||
|
||||
<p>BN_mod() corresponds to BN_div() with <i>dv</i> set to <b>NULL</b>.</p>
|
||||
|
||||
<p>BN_nnmod() reduces <i>a</i> modulo <i>m</i> and places the non-negative remainder in <i>r</i>.</p>
|
||||
|
||||
<p>BN_mod_add() adds <i>a</i> to <i>b</i> modulo <i>m</i> and places the non-negative result in <i>r</i>.</p>
|
||||
|
||||
<p>BN_mod_sub() subtracts <i>b</i> from <i>a</i> modulo <i>m</i> and places the non-negative result in <i>r</i>.</p>
|
||||
|
||||
<p>BN_mod_mul() multiplies <i>a</i> by <i>b</i> and finds the non-negative remainder respective to modulus <i>m</i> (<code>r=(a*b) mod m</code>). <i>r</i> may be the same <b>BIGNUM</b> as <i>a</i> or <i>b</i>. For more efficient algorithms for repeated computations using the same modulus, see <a href="../man3/BN_mod_mul_montgomery.html">BN_mod_mul_montgomery(3)</a> and <a href="../man3/BN_mod_mul_reciprocal.html">BN_mod_mul_reciprocal(3)</a>.</p>
|
||||
|
||||
<p>BN_mod_sqr() takes the square of <i>a</i> modulo <b>m</b> and places the result in <i>r</i>.</p>
|
||||
|
||||
<p>BN_exp() raises <i>a</i> to the <i>p</i>-th power and places the result in <i>r</i> (<code>r=a^p</code>). This function is faster than repeated applications of BN_mul().</p>
|
||||
|
||||
<p>BN_mod_exp() computes <i>a</i> to the <i>p</i>-th power modulo <i>m</i> (<code>r=a^p % m</code>). This function uses less time and space than BN_exp(). Do not call this function when <b>m</b> is even and any of the parameters have the <b>BN_FLG_CONSTTIME</b> flag set.</p>
|
||||
|
||||
<p>BN_gcd() computes the greatest common divisor of <i>a</i> and <i>b</i> and places the result in <i>r</i>. <i>r</i> may be the same <b>BIGNUM</b> as <i>a</i> or <i>b</i>.</p>
|
||||
|
||||
<p>For all functions, <i>ctx</i> is a previously allocated <b>BN_CTX</b> used for temporary variables; see <a href="../man3/BN_CTX_new.html">BN_CTX_new(3)</a>.</p>
|
||||
|
||||
<p>Unless noted otherwise, the result <b>BIGNUM</b> must be different from the arguments.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>For all functions, 1 is returned for success, 0 on error. The return value should always be checked (e.g., <code>if (!BN_add(r,a,b)) goto err;</code>). The error codes can be obtained by <a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>, <a href="../man3/BN_CTX_new.html">BN_CTX_new(3)</a>, <a href="../man3/BN_add_word.html">BN_add_word(3)</a>, <a href="../man3/BN_set_bit.html">BN_set_bit(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
78
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_add_word.html
vendored
Normal file
78
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_add_word.html
vendored
Normal file
@ -0,0 +1,78 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BN_add_word</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BN_add_word, BN_sub_word, BN_mul_word, BN_div_word, BN_mod_word - arithmetic functions on BIGNUMs with integers</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bn.h>
|
||||
|
||||
int BN_add_word(BIGNUM *a, BN_ULONG w);
|
||||
|
||||
int BN_sub_word(BIGNUM *a, BN_ULONG w);
|
||||
|
||||
int BN_mul_word(BIGNUM *a, BN_ULONG w);
|
||||
|
||||
BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w);
|
||||
|
||||
BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>These functions perform arithmetic operations on BIGNUMs with unsigned integers. They are much more efficient than the normal BIGNUM arithmetic operations.</p>
|
||||
|
||||
<p>BN_add_word() adds <b>w</b> to <b>a</b> (<code>a+=w</code>).</p>
|
||||
|
||||
<p>BN_sub_word() subtracts <b>w</b> from <b>a</b> (<code>a-=w</code>).</p>
|
||||
|
||||
<p>BN_mul_word() multiplies <b>a</b> and <b>w</b> (<code>a*=w</code>).</p>
|
||||
|
||||
<p>BN_div_word() divides <b>a</b> by <b>w</b> (<code>a/=w</code>) and returns the remainder.</p>
|
||||
|
||||
<p>BN_mod_word() returns the remainder of <b>a</b> divided by <b>w</b> (<code>a%w</code>).</p>
|
||||
|
||||
<p>For BN_div_word() and BN_mod_word(), <b>w</b> must not be 0.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BN_add_word(), BN_sub_word() and BN_mul_word() return 1 for success, 0 on error. The error codes can be obtained by <a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>.</p>
|
||||
|
||||
<p>BN_mod_word() and BN_div_word() return <b>a</b>%<b>w</b> on success and <b>(BN_ULONG)-1</b> if an error occurred.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>, <a href="../man3/BN_add.html">BN_add(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
100
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_bn2bin.html
vendored
Normal file
100
deps/openssl/android/arm64-v8a/usr/local/share/doc/openssl/html/man3/BN_bn2bin.html
vendored
Normal file
@ -0,0 +1,100 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>BN_bn2bin</title>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<link rev="made" href="mailto:root@localhost" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<ul id="index">
|
||||
<li><a href="#NAME">NAME</a></li>
|
||||
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
|
||||
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
|
||||
<li><a href="#RETURN-VALUES">RETURN VALUES</a></li>
|
||||
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
|
||||
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
|
||||
</ul>
|
||||
|
||||
<h1 id="NAME">NAME</h1>
|
||||
|
||||
<p>BN_bn2binpad, BN_bn2bin, BN_bin2bn, BN_bn2lebinpad, BN_lebin2bn, BN_bn2hex, BN_bn2dec, BN_hex2bn, BN_dec2bn, BN_print, BN_print_fp, BN_bn2mpi, BN_mpi2bn - format conversions</p>
|
||||
|
||||
<h1 id="SYNOPSIS">SYNOPSIS</h1>
|
||||
|
||||
<pre><code>#include <openssl/bn.h>
|
||||
|
||||
int BN_bn2bin(const BIGNUM *a, unsigned char *to);
|
||||
int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen);
|
||||
BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret);
|
||||
|
||||
int BN_bn2lebinpad(const BIGNUM *a, unsigned char *to, int tolen);
|
||||
BIGNUM *BN_lebin2bn(const unsigned char *s, int len, BIGNUM *ret);
|
||||
|
||||
char *BN_bn2hex(const BIGNUM *a);
|
||||
char *BN_bn2dec(const BIGNUM *a);
|
||||
int BN_hex2bn(BIGNUM **a, const char *str);
|
||||
int BN_dec2bn(BIGNUM **a, const char *str);
|
||||
|
||||
int BN_print(BIO *fp, const BIGNUM *a);
|
||||
int BN_print_fp(FILE *fp, const BIGNUM *a);
|
||||
|
||||
int BN_bn2mpi(const BIGNUM *a, unsigned char *to);
|
||||
BIGNUM *BN_mpi2bn(unsigned char *s, int len, BIGNUM *ret);</code></pre>
|
||||
|
||||
<h1 id="DESCRIPTION">DESCRIPTION</h1>
|
||||
|
||||
<p>BN_bn2bin() converts the absolute value of <b>a</b> into big-endian form and stores it at <b>to</b>. <b>to</b> must point to BN_num_bytes(<b>a</b>) bytes of memory.</p>
|
||||
|
||||
<p>BN_bn2binpad() also converts the absolute value of <b>a</b> into big-endian form and stores it at <b>to</b>. <b>tolen</b> indicates the length of the output buffer <b>to</b>. The result is padded with zeroes if necessary. If <b>tolen</b> is less than BN_num_bytes(<b>a</b>) an error is returned.</p>
|
||||
|
||||
<p>BN_bin2bn() converts the positive integer in big-endian form of length <b>len</b> at <b>s</b> into a <b>BIGNUM</b> and places it in <b>ret</b>. If <b>ret</b> is NULL, a new <b>BIGNUM</b> is created.</p>
|
||||
|
||||
<p>BN_bn2lebinpad() and BN_lebin2bn() are identical to BN_bn2binpad() and BN_bin2bn() except the buffer is in little-endian format.</p>
|
||||
|
||||
<p>BN_bn2hex() and BN_bn2dec() return printable strings containing the hexadecimal and decimal encoding of <b>a</b> respectively. For negative numbers, the string is prefaced with a leading '-'. The string must be freed later using OPENSSL_free().</p>
|
||||
|
||||
<p>BN_hex2bn() takes as many characters as possible from the string <b>str</b>, including the leading character '-' which means negative, to form a valid hexadecimal number representation and converts them to a <b>BIGNUM</b> and stores it in **<b>a</b>. If *<b>a</b> is NULL, a new <b>BIGNUM</b> is created. If <b>a</b> is NULL, it only computes the length of valid representation. A "negative zero" is converted to zero. BN_dec2bn() is the same using the decimal system.</p>
|
||||
|
||||
<p>BN_print() and BN_print_fp() write the hexadecimal encoding of <b>a</b>, with a leading '-' for negative numbers, to the <b>BIO</b> or <b>FILE</b> <b>fp</b>.</p>
|
||||
|
||||
<p>BN_bn2mpi() and BN_mpi2bn() convert <b>BIGNUM</b>s from and to a format that consists of the number's length in bytes represented as a 4-byte big-endian number, and the number itself in big-endian format, where the most significant bit signals a negative number (the representation of numbers with the MSB set is prefixed with null byte).</p>
|
||||
|
||||
<p>BN_bn2mpi() stores the representation of <b>a</b> at <b>to</b>, where <b>to</b> must be large enough to hold the result. The size can be determined by calling BN_bn2mpi(<b>a</b>, NULL).</p>
|
||||
|
||||
<p>BN_mpi2bn() converts the <b>len</b> bytes long representation at <b>s</b> to a <b>BIGNUM</b> and stores it at <b>ret</b>, or in a newly allocated <b>BIGNUM</b> if <b>ret</b> is NULL.</p>
|
||||
|
||||
<h1 id="RETURN-VALUES">RETURN VALUES</h1>
|
||||
|
||||
<p>BN_bn2bin() returns the length of the big-endian number placed at <b>to</b>. BN_bin2bn() returns the <b>BIGNUM</b>, NULL on error.</p>
|
||||
|
||||
<p>BN_bn2binpad() returns the number of bytes written or -1 if the supplied buffer is too small.</p>
|
||||
|
||||
<p>BN_bn2hex() and BN_bn2dec() return a null-terminated string, or NULL on error. BN_hex2bn() and BN_dec2bn() return the number of characters used in parsing, or 0 on error, in which case no new <b>BIGNUM</b> will be created.</p>
|
||||
|
||||
<p>BN_print_fp() and BN_print() return 1 on success, 0 on write errors.</p>
|
||||
|
||||
<p>BN_bn2mpi() returns the length of the representation. BN_mpi2bn() returns the <b>BIGNUM</b>, and NULL on error.</p>
|
||||
|
||||
<p>The error codes can be obtained by <a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>.</p>
|
||||
|
||||
<h1 id="SEE-ALSO">SEE ALSO</h1>
|
||||
|
||||
<p><a href="../man3/ERR_get_error.html">ERR_get_error(3)</a>, <a href="../man3/BN_zero.html">BN_zero(3)</a>, <a href="../man3/ASN1_INTEGER_to_BN.html">ASN1_INTEGER_to_BN(3)</a>, <a href="../man3/BN_num_bytes.html">BN_num_bytes(3)</a></p>
|
||||
|
||||
<h1 id="COPYRIGHT">COPYRIGHT</h1>
|
||||
|
||||
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||||
|
||||
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user