--- src/secure/usr.bin/openssl/man/pkcs12.1 2004/09/02 09:35:38 1.2 +++ src/secure/usr.bin/openssl/man/pkcs12.1 2004/12/18 21:34:12 1.3 @@ -1,12 +1,8 @@ -.rn '' }` -''' $RCSfile: pkcs12.1,v $$Revision: 1.2 $$Date: 2004/09/02 09:35:38 $ -''' -''' $Log: pkcs12.1,v $ -''' Revision 1.2 2004/09/02 09:35:38 asmodai -''' Update per latest manual pages after 'man-update'. -''' -''' -.de Sh +.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.14 +.\" +.\" Standard preamble: +.\" ======================================================================== +.de Sh \" Subsection heading .br .if t .Sp .ne 5 @@ -14,150 +10,98 @@ \fB\\$1\fR .PP .. -.de Sp +.de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. -.de Ip -.br -.ie \\n(.$>=3 .ne \\$3 -.el .ne 3 -.IP "\\$1" \\$2 -.. -.de Vb +.de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. -.de Ve +.de Ve \" End verbatim text .ft R - .fi .. -''' -''' -''' Set up \*(-- to give an unbreakable dash; -''' string Tr holds user defined translation string. -''' Bell System Logo is used as a dummy character. -''' +.\" Set up some character translations and predefined strings. \*(-- will +.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left +.\" double quote, and \*(R" will give a right double quote. | will give a +.\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to +.\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C' +.\" expand to `' in nroff, nothing in troff, for use with C<>. .tr \(*W-|\(bv\*(Tr +.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ -.ds -- \(*W- -.ds PI pi -.if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch -.if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch -.ds L" "" -.ds R" "" -''' \*(M", \*(S", \*(N" and \*(T" are the equivalent of -''' \*(L" and \*(R", except that they are used on ".xx" lines, -''' such as .IP and .SH, which do another additional levels of -''' double-quote interpretation -.ds M" """ -.ds S" """ -.ds N" """"" -.ds T" """"" -.ds L' ' -.ds R' ' -.ds M' ' -.ds S' ' -.ds N' ' -.ds T' ' +. ds -- \(*W- +. ds PI pi +. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch +. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch +. ds L" "" +. ds R" "" +. ds C` "" +. ds C' "" 'br\} .el\{\ -.ds -- \(em\| -.tr \*(Tr -.ds L" `` -.ds R" '' -.ds M" `` -.ds S" '' -.ds N" `` -.ds T" '' -.ds L' ` -.ds R' ' -.ds M' ` -.ds S' ' -.ds N' ` -.ds T' ' -.ds PI \(*p +. ds -- \|\(em\| +. ds PI \(*p +. ds L" `` +. ds R" '' 'br\} -.\" If the F register is turned on, we'll generate -.\" index entries out stderr for the following things: -.\" TH Title -.\" SH Header -.\" Sh Subsection -.\" Ip Item -.\" X<> Xref (embedded -.\" Of course, you have to process the output yourself -.\" in some meaninful fashion. -.if \nF \{ -.de IX -.tm Index:\\$1\t\\n%\t"\\$2" +.\" +.\" If the F register is turned on, we'll generate index entries on stderr for +.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index +.\" entries marked with X<> in POD. Of course, you'll have to process the +.\" output yourself in some meaningful fashion. +.if \nF \{\ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" .. -.nr % 0 -.rr F +. nr % 0 +. rr F .\} -.TH PKCS12 1 "0.9.7d" "2/Sep/2004" "OpenSSL" -.UC -.if n .hy 0 +.\" +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. +.hy 0 .if n .na -.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' -.de CQ \" put $1 in typewriter font -.ft CW -'if n "\c -'if t \\&\\$1\c -'if n \\&\\$1\c -'if n \&" -\\&\\$2 \\$3 \\$4 \\$5 \\$6 \\$7 -'.ft R -.. -.\" @(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2 -. \" AM - accent mark definitions -.bd B 3 -. \" fudge factors for nroff and troff +.\" +.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). +.\" Fear. Run. Save yourself. No user-serviceable parts. +. \" fudge factors for nroff and troff .if n \{\ -. ds #H 0 -. ds #V .8m -. ds #F .3m -. ds #[ \f1 -. ds #] \fP +. ds #H 0 +. ds #V .8m +. ds #F .3m +. ds #[ \f1 +. ds #] \fP .\} .if t \{\ -. ds #H ((1u-(\\\\n(.fu%2u))*.13m) -. ds #V .6m -. ds #F 0 -. ds #[ \& -. ds #] \& +. ds #H ((1u-(\\\\n(.fu%2u))*.13m) +. ds #V .6m +. ds #F 0 +. ds #[ \& +. ds #] \& .\} -. \" simple accents for nroff and troff +. \" simple accents for nroff and troff .if n \{\ -. ds ' \& -. ds ` \& -. ds ^ \& -. ds , \& -. ds ~ ~ -. ds ? ? -. ds ! ! -. ds / -. ds q +. ds ' \& +. ds ` \& +. ds ^ \& +. ds , \& +. ds ~ ~ +. ds / .\} .if t \{\ -. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" -. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' -. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' -. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' -. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' -. ds ? \s-2c\h'-\w'c'u*7/10'\u\h'\*(#H'\zi\d\s+2\h'\w'c'u*8/10' -. ds ! \s-2\(or\s+2\h'-\w'\(or'u'\v'-.8m'.\v'.8m' -. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' -. ds q o\h'-\w'o'u*8/10'\s-4\v'.4m'\z\(*i\v'-.4m'\s+4\h'\w'o'u*8/10' +. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" +. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' +. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' +. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' +. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' +. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} -. \" troff and (daisy-wheel) nroff accents +. \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' -.ds v \\k:\h'-(\\n(.wu*9/10-\*(#H)'\v'-\*(#V'\*(#[\s-4v\s0\v'\*(#V'\h'|\\n:u'\*(#] -.ds _ \\k:\h'-(\\n(.wu*9/10-\*(#H+(\*(#F*2/3))'\v'-.4m'\z\(hy\v'.4m'\h'|\\n:u' -.ds . \\k:\h'-(\\n(.wu*8/10)'\v'\*(#V*4/10'\z.\v'-\*(#V*4/10'\h'|\\n:u' -.ds 3 \*(#[\v'.2m'\s-2\&3\s0\v'-.2m'\*(#] .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' @@ -165,35 +109,32 @@ .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E -.ds oe o\h'-(\w'o'u*4/10)'e -.ds Oe O\h'-(\w'O'u*4/10)'E -. \" corrections for vroff +. \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' -. \" for low resolution devices (crt and lpr) +. \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ -. ds : e -. ds 8 ss -. ds v \h'-1'\o'\(aa\(ga' -. ds _ \h'-1'^ -. ds . \h'-1'. -. ds 3 3 -. ds o a -. ds d- d\h'-1'\(ga -. ds D- D\h'-1'\(hy -. ds th \o'bp' -. ds Th \o'LP' -. ds ae ae -. ds Ae AE -. ds oe oe -. ds Oe OE +. ds : e +. ds 8 ss +. ds o a +. ds d- d\h'-1'\(ga +. ds D- D\h'-1'\(hy +. ds th \o'bp' +. ds Th \o'LP' +. ds ae ae +. ds Ae AE .\} .rm #[ #] #H #V #F C +.\" ======================================================================== +.\" +.IX Title "PKCS12 1" +.TH PKCS12 1 "2004-12-18" "0.9.7e" "OpenSSL" .SH "NAME" pkcs12 \- PKCS#12 file utility .SH "SYNOPSIS" -\fBopenssl\fR \fBpkcs12\fR +.IX Header "SYNOPSIS" +\&\fBopenssl\fR \fBpkcs12\fR [\fB\-export\fR] [\fB\-chain\fR] [\fB\-inkey filename\fR] @@ -226,112 +167,146 @@ pkcs12 \- PKCS#12 file utility [\fB\-passout arg\fR] [\fB\-rand file(s)\fR] .SH "DESCRIPTION" +.IX Header "DESCRIPTION" The \fBpkcs12\fR command allows PKCS#12 files (sometimes referred to as -PFX files) to be created and parsed. PKCS#12 files are used by several -programs including Netscape, MSIE and MS Outlook. +\&\s-1PFX\s0 files) to be created and parsed. PKCS#12 files are used by several +programs including Netscape, \s-1MSIE\s0 and \s-1MS\s0 Outlook. .SH "COMMAND OPTIONS" +.IX Header "COMMAND OPTIONS" There are a lot of options the meaning of some depends of whether a PKCS#12 file is being created or parsed. By default a PKCS#12 file is parsed a PKCS#12 file can be created by using the \fB\-export\fR option (see below). .SH "PARSING OPTIONS" -.Ip "\fB\-in filename\fR" 4 -This specifies filename of the \s-1PKCS\s0#12 file to be parsed. Standard input is used +.IX Header "PARSING OPTIONS" +.IP "\fB\-in filename\fR" 4 +.IX Item "-in filename" +This specifies filename of the PKCS#12 file to be parsed. Standard input is used by default. -.Ip "\fB\-out filename\fR" 4 +.IP "\fB\-out filename\fR" 4 +.IX Item "-out filename" The filename to write certificates and private keys to, standard output by default. They are all written in \s-1PEM\s0 format. -.Ip "\fB\-pass arg\fR, \fB\-passin arg\fR" 4 -the \s-1PKCS\s0#12 file (i.e. input file) password source. For more information about the +.IP "\fB\-pass arg\fR, \fB\-passin arg\fR" 4 +.IX Item "-pass arg, -passin arg" +the PKCS#12 file (i.e. input file) password source. For more information about the format of \fBarg\fR see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in -openssl(1). -.Ip "\fB\-passout arg\fR" 4 +\&\fIopenssl\fR\|(1). +.IP "\fB\-passout arg\fR" 4 +.IX Item "-passout arg" pass phrase source to encrypt any outputed private keys with. For more information about the format of \fBarg\fR see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in -openssl(1). -.Ip "\fB\-noout\fR" 4 +\&\fIopenssl\fR\|(1). +.IP "\fB\-noout\fR" 4 +.IX Item "-noout" this option inhibits output of the keys and certificates to the output file version -of the \s-1PKCS\s0#12 file. -.Ip "\fB\-clcerts\fR" 4 +of the PKCS#12 file. +.IP "\fB\-clcerts\fR" 4 +.IX Item "-clcerts" only output client certificates (not \s-1CA\s0 certificates). -.Ip "\fB\-cacerts\fR" 4 +.IP "\fB\-cacerts\fR" 4 +.IX Item "-cacerts" only output \s-1CA\s0 certificates (not client certificates). -.Ip "\fB\-nocerts\fR" 4 +.IP "\fB\-nocerts\fR" 4 +.IX Item "-nocerts" no certificates at all will be output. -.Ip "\fB\-nokeys\fR" 4 +.IP "\fB\-nokeys\fR" 4 +.IX Item "-nokeys" no private keys will be output. -.Ip "\fB\-info\fR" 4 -output additional information about the \s-1PKCS\s0#12 file structure, algorithms used and +.IP "\fB\-info\fR" 4 +.IX Item "-info" +output additional information about the PKCS#12 file structure, algorithms used and iteration counts. -.Ip "\fB\-des\fR" 4 +.IP "\fB\-des\fR" 4 +.IX Item "-des" use \s-1DES\s0 to encrypt private keys before outputting. -.Ip "\fB\-des3\fR" 4 +.IP "\fB\-des3\fR" 4 +.IX Item "-des3" use triple \s-1DES\s0 to encrypt private keys before outputting, this is the default. -.Ip "\fB\-idea\fR" 4 +.IP "\fB\-idea\fR" 4 +.IX Item "-idea" use \s-1IDEA\s0 to encrypt private keys before outputting. -.Ip "\fB\-nodes\fR" 4 +.IP "\fB\-nodes\fR" 4 +.IX Item "-nodes" don't encrypt the private keys at all. -.Ip "\fB\-nomacver\fR" 4 +.IP "\fB\-nomacver\fR" 4 +.IX Item "-nomacver" don't attempt to verify the integrity \s-1MAC\s0 before reading the file. -.Ip "\fB\-twopass\fR" 4 +.IP "\fB\-twopass\fR" 4 +.IX Item "-twopass" prompt for separate integrity and encryption passwords: most software always assumes these are the same so this option will render such -\s-1PKCS\s0#12 files unreadable. +PKCS#12 files unreadable. .SH "FILE CREATION OPTIONS" -.Ip "\fB\-export\fR" 4 -This option specifies that a \s-1PKCS\s0#12 file will be created rather than +.IX Header "FILE CREATION OPTIONS" +.IP "\fB\-export\fR" 4 +.IX Item "-export" +This option specifies that a PKCS#12 file will be created rather than parsed. -.Ip "\fB\-out filename\fR" 4 -This specifies filename to write the \s-1PKCS\s0#12 file to. Standard output is used +.IP "\fB\-out filename\fR" 4 +.IX Item "-out filename" +This specifies filename to write the PKCS#12 file to. Standard output is used by default. -.Ip "\fB\-in filename\fR" 4 +.IP "\fB\-in filename\fR" 4 +.IX Item "-in filename" The filename to read certificates and private keys from, standard input by default. They must all be in \s-1PEM\s0 format. The order doesn't matter but one private key and its corresponding certificate should be present. If additional certificates are -present they will also be included in the \s-1PKCS\s0#12 file. -.Ip "\fB\-inkey filename\fR" 4 +present they will also be included in the PKCS#12 file. +.IP "\fB\-inkey filename\fR" 4 +.IX Item "-inkey filename" file to read private key from. If not present then a private key must be present in the input file. -.Ip "\fB\-name friendlyname\fR" 4 +.IP "\fB\-name friendlyname\fR" 4 +.IX Item "-name friendlyname" This specifies the \*(L"friendly name\*(R" for the certificate and private key. This name is typically displayed in list boxes by software importing the file. -.Ip "\fB\-certfile filename\fR" 4 +.IP "\fB\-certfile filename\fR" 4 +.IX Item "-certfile filename" A filename to read additional certificates from. -.Ip "\fB\-caname friendlyname\fR" 4 +.IP "\fB\-caname friendlyname\fR" 4 +.IX Item "-caname friendlyname" This specifies the \*(L"friendly name\*(R" for other certificates. This option may be used multiple times to specify names for all certificates in the order they appear. Netscape ignores friendly names on other certificates whereas \s-1MSIE\s0 displays them. -.Ip "\fB\-pass arg\fR, \fB\-passout arg\fR" 4 -the \s-1PKCS\s0#12 file (i.e. output file) password source. For more information about +.IP "\fB\-pass arg\fR, \fB\-passout arg\fR" 4 +.IX Item "-pass arg, -passout arg" +the PKCS#12 file (i.e. output file) password source. For more information about the format of \fBarg\fR see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in -openssl(1). -.Ip "\fB\-passin password\fR" 4 +\&\fIopenssl\fR\|(1). +.IP "\fB\-passin password\fR" 4 +.IX Item "-passin password" pass phrase source to decrypt any input private keys with. For more information about the format of \fBarg\fR see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in -openssl(1). -.Ip "\fB\-chain\fR" 4 +\&\fIopenssl\fR\|(1). +.IP "\fB\-chain\fR" 4 +.IX Item "-chain" if this option is present then an attempt is made to include the entire certificate chain of the user certificate. The standard \s-1CA\s0 store is used for this search. If the search fails it is considered a fatal error. -.Ip "\fB\-descert\fR" 4 -encrypt the certificate using triple \s-1DES\s0, this may render the \s-1PKCS\s0#12 +.IP "\fB\-descert\fR" 4 +.IX Item "-descert" +encrypt the certificate using triple \s-1DES\s0, this may render the PKCS#12 file unreadable by some \*(L"export grade\*(R" software. By default the private key is encrypted using triple \s-1DES\s0 and the certificate using 40 bit \s-1RC2\s0. -.Ip "\fB\-keypbe alg\fR, \fB\-certpbe alg\fR" 4 +.IP "\fB\-keypbe alg\fR, \fB\-certpbe alg\fR" 4 +.IX Item "-keypbe alg, -certpbe alg" these options allow the algorithm used to encrypt the private key and -certificates to be selected. Although any \s-1PKCS\s0#5 v1.5 or \s-1PKCS\s0#12 algorithms -can be selected it is advisable only to use \s-1PKCS\s0#12 algorithms. See the list +certificates to be selected. Although any PKCS#5 v1.5 or PKCS#12 algorithms +can be selected it is advisable only to use PKCS#12 algorithms. See the list in the \fB\s-1NOTES\s0\fR section for more information. -.Ip "\fB\-keyex|\-keysig\fR" 4 +.IP "\fB\-keyex|\-keysig\fR" 4 +.IX Item "-keyex|-keysig" specifies that the private key is to be used for key exchange or just signing. This option is only interpreted by \s-1MSIE\s0 and similar \s-1MS\s0 software. Normally -\*(L"export grade\*(R" software will only allow 512 bit \s-1RSA\s0 keys to be used for +\&\*(L"export grade\*(R" software will only allow 512 bit \s-1RSA\s0 keys to be used for encryption purposes but arbitrary length keys for signing. The \fB\-keysig\fR option marks the key for signing only. Signing only keys can be used for -S/\s-1MIME\s0 signing, authenticode (ActiveX control signing) and \s-1SSL\s0 client +S/MIME signing, authenticode (ActiveX control signing) and \s-1SSL\s0 client authentication, however due to a bug only \s-1MSIE\s0 5.0 and later support the use of signing only keys for \s-1SSL\s0 client authentication. -.Ip "\fB\-nomaciter\fR, \fB\-noiter\fR" 4 +.IP "\fB\-nomaciter\fR, \fB\-noiter\fR" 4 +.IX Item "-nomaciter, -noiter" these options affect the iteration counts on the \s-1MAC\s0 and key algorithms. Unless you wish to produce files compatible with \s-1MSIE\s0 4.0 you should leave these options alone. @@ -345,18 +320,21 @@ By default both \s-1MAC\s0 and encryptio these options the \s-1MAC\s0 and encryption iteration counts can be set to 1, since this reduces the file security you should not use these options unless you really have to. Most software supports both \s-1MAC\s0 and key iteration counts. -\s-1MSIE\s0 4.0 doesn't support \s-1MAC\s0 iteration counts so it needs the \fB\-nomaciter\fR +\&\s-1MSIE\s0 4.0 doesn't support \s-1MAC\s0 iteration counts so it needs the \fB\-nomaciter\fR option. -.Ip "\fB\-maciter\fR" 4 +.IP "\fB\-maciter\fR" 4 +.IX Item "-maciter" This option is included for compatibility with previous versions, it used to be needed to use \s-1MAC\s0 iterations counts but they are now used by default. -.Ip "\fB\-rand file(s)\fR" 4 +.IP "\fB\-rand file(s)\fR" 4 +.IX Item "-rand file(s)" a file or files containing random data used to seed the random number -generator, or an \s-1EGD\s0 socket (see RAND_egd(3)). -Multiple files can be specified separated by a \s-1OS\s0\-dependent character. -The separator is \fB;\fR for \s-1MS\s0\-Windows, \fB,\fR for OpenVMS, and \fB:\fR for +generator, or an \s-1EGD\s0 socket (see \fIRAND_egd\fR\|(3)). +Multiple files can be specified separated by a OS-dependent character. +The separator is \fB;\fR for MS\-Windows, \fB,\fR for OpenVMS, and \fB:\fR for all others. .SH "NOTES" +.IX Header "NOTES" Although there are a large number of options most of them are very rarely used. For PKCS#12 file parsing only \fB\-in\fR and \fB\-out\fR need to be used for PKCS#12 file creation \fB\-export\fR and \fB\-name\fR are also used. @@ -368,41 +346,48 @@ the one corresponding to the private key a private key and certificate and assumes the first certificate in the file is the one corresponding to the private key: this may not always be the case. Using the \fB\-clcerts\fR option will solve this problem by only -outputting the certificate corresponding to the private key. If the CA +outputting the certificate corresponding to the private key. If the \s-1CA\s0 certificates are required then they can be output to a separate file using -the \fB\-nokeys \-cacerts\fR options to just output CA certificates. +the \fB\-nokeys \-cacerts\fR options to just output \s-1CA\s0 certificates. .PP The \fB\-keypbe\fR and \fB\-certpbe\fR algorithms allow the precise encryption algorithms for private keys and certificates to be specified. Normally -the defaults are fine but occasionally software can't handle triple DES -encrypted private keys, then the option \fB\-keypbe PBE\-SHA1-RC2-40\fR can -be used to reduce the private key encryption to 40 bit RC2. A complete +the defaults are fine but occasionally software can't handle triple \s-1DES\s0 +encrypted private keys, then the option \fB\-keypbe \s-1PBE\-SHA1\-RC2\-40\s0\fR can +be used to reduce the private key encryption to 40 bit \s-1RC2\s0. A complete description of all algorithms is contained in the \fBpkcs8\fR manual page. .SH "EXAMPLES" +.IX Header "EXAMPLES" Parse a PKCS#12 file and output it to a file: .PP .Vb 1 \& openssl pkcs12 -in file.p12 -out file.pem .Ve +.PP Output only client certificates to a file: .PP .Vb 1 \& openssl pkcs12 -in file.p12 -clcerts -out file.pem .Ve +.PP Don't encrypt the private key: - - openssl pkcs12 \-in file.p12 \-out file.pem \-nodes +.PP +.Vb 1 +\& openssl pkcs12 -in file.p12 -out file.pem -nodes +.Ve .PP Print some info about a PKCS#12 file: .PP .Vb 1 \& openssl pkcs12 -in file.p12 -info -noout .Ve +.PP Create a PKCS#12 file: .PP .Vb 1 \& openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate" .Ve +.PP Include some extra certificates: .PP .Vb 2 @@ -410,19 +395,20 @@ Include some extra certificates: \& -certfile othercerts.pem .Ve .SH "BUGS" +.IX Header "BUGS" Some would argue that the PKCS#12 standard is one big bug :\-) .PP Versions of OpenSSL before 0.9.6a had a bug in the PKCS#12 key generation routines. Under rare circumstances this could produce a PKCS#12 file encrypted with an invalid key. As a result some PKCS#12 files which triggered this bug -from other implementations (MSIE or Netscape) could not be decrypted +from other implementations (\s-1MSIE\s0 or Netscape) could not be decrypted by OpenSSL and similarly OpenSSL could produce PKCS#12 files which could not be decrypted by other implementations. The chances of producing such a file are relatively small: less than 1 in 256. .PP A side effect of fixing this bug is that any old invalidly encrypted PKCS#12 files cannot no longer be parsed by the fixed version. Under such circumstances -the \fBpkcs12\fR utility will report that the MAC is OK but fail with a decryption +the \fBpkcs12\fR utility will report that the \s-1MAC\s0 is \s-1OK\s0 but fail with a decryption error when extracting private keys. .PP This problem can be resolved by extracting the private keys and certificates @@ -434,93 +420,5 @@ file from the keys and certificates usin \& openssl -in keycerts.pem -export -name "My PKCS#12 file" -out fixed.p12 .Ve .SH "SEE ALSO" -pkcs8(1) - -.rn }` '' -.IX Title "PKCS12 1" -.IX Name "pkcs12 - PKCS#12 file utility" - -.IX Header "NAME" - -.IX Header "SYNOPSIS" - -.IX Header "DESCRIPTION" - -.IX Header "COMMAND OPTIONS" - -.IX Header "PARSING OPTIONS" - -.IX Item "\fB\-in filename\fR" - -.IX Item "\fB\-out filename\fR" - -.IX Item "\fB\-pass arg\fR, \fB\-passin arg\fR" - -.IX Item "\fB\-passout arg\fR" - -.IX Item "\fB\-noout\fR" - -.IX Item "\fB\-clcerts\fR" - -.IX Item "\fB\-cacerts\fR" - -.IX Item "\fB\-nocerts\fR" - -.IX Item "\fB\-nokeys\fR" - -.IX Item "\fB\-info\fR" - -.IX Item "\fB\-des\fR" - -.IX Item "\fB\-des3\fR" - -.IX Item "\fB\-idea\fR" - -.IX Item "\fB\-nodes\fR" - -.IX Item "\fB\-nomacver\fR" - -.IX Item "\fB\-twopass\fR" - -.IX Header "FILE CREATION OPTIONS" - -.IX Item "\fB\-export\fR" - -.IX Item "\fB\-out filename\fR" - -.IX Item "\fB\-in filename\fR" - -.IX Item "\fB\-inkey filename\fR" - -.IX Item "\fB\-name friendlyname\fR" - -.IX Item "\fB\-certfile filename\fR" - -.IX Item "\fB\-caname friendlyname\fR" - -.IX Item "\fB\-pass arg\fR, \fB\-passout arg\fR" - -.IX Item "\fB\-passin password\fR" - -.IX Item "\fB\-chain\fR" - -.IX Item "\fB\-descert\fR" - -.IX Item "\fB\-keypbe alg\fR, \fB\-certpbe alg\fR" - -.IX Item "\fB\-keyex|\-keysig\fR" - -.IX Item "\fB\-nomaciter\fR, \fB\-noiter\fR" - -.IX Item "\fB\-maciter\fR" - -.IX Item "\fB\-rand file(s)\fR" - -.IX Header "NOTES" - -.IX Header "EXAMPLES" - -.IX Header "BUGS" - .IX Header "SEE ALSO" - +\&\fIpkcs8\fR\|(1)