1 .\" Automatically generated by Pod::Man 2.12 (Pod::Simple 3.05)
4 .\" ========================================================================
5 .de Sh \" Subsection heading
13 .de Sp \" Vertical space (when we can't use .PP)
17 .de Vb \" Begin verbatim text
22 .de Ve \" End verbatim text
26 .\" Set up some character translations and predefined strings. \*(-- will
27 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
28 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
29 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
30 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
31 .\" nothing in troff, for use with C<>.
33 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
37 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
38 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
51 .\" If the F register is turned on, we'll generate index entries on stderr for
52 .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
53 .\" entries marked with X<> in POD. Of course, you'll have to process the
54 .\" output yourself in some meaningful fashion.
57 . tm Index:\\$1\t\\n%\t"\\$2"
63 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
64 .\" Fear. Run. Save yourself. No user-serviceable parts.
65 . \" fudge factors for nroff and troff
74 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
80 . \" simple accents for nroff and troff
90 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
91 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
92 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
93 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
94 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
95 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
97 . \" troff and (daisy-wheel) nroff accents
98 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
99 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
100 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
101 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
102 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
103 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
104 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
105 .ds ae a\h'-(\w'a'u*4/10)'e
106 .ds Ae A\h'-(\w'A'u*4/10)'E
107 . \" corrections for vroff
108 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
109 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
110 . \" for low resolution devices (crt and lpr)
111 .if \n(.H>23 .if \n(.V>19 \
124 .\" ========================================================================
127 .TH CA 1 "2007-10-24" "0.9.8g" "OpenSSL"
128 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
129 .\" way too many mistakes in technical documents.
133 ca \- sample minimal CA application
135 .IX Header "SYNOPSIS"
136 \&\fBopenssl\fR \fBca\fR
138 [\fB\-config filename\fR]
139 [\fB\-name section\fR]
141 [\fB\-revoke file\fR]
142 [\fB\-crl_reason reason\fR]
143 [\fB\-crl_hold instruction\fR]
144 [\fB\-crl_compromise time\fR]
145 [\fB\-crl_CA_compromise time\fR]
146 [\fB\-crldays days\fR]
147 [\fB\-crlhours hours\fR]
148 [\fB\-crlexts section\fR]
149 [\fB\-startdate date\fR]
150 [\fB\-enddate date\fR]
154 [\fB\-keyfile arg\fR]
165 [\fB\-ss_cert file\fR]
170 [\fB\-extensions section\fR]
171 [\fB\-extfile section\fR]
175 [\fB\-multivalue\-rdn\fR]
177 .IX Header "DESCRIPTION"
178 The \fBca\fR command is a minimal \s-1CA\s0 application. It can be used
179 to sign certificate requests in a variety of forms and generate
180 CRLs it also maintains a text database of issued certificates
183 The options descriptions will be divided into each purpose.
185 .IX Header "CA OPTIONS"
186 .IP "\fB\-config filename\fR" 4
187 .IX Item "-config filename"
188 specifies the configuration file to use.
189 .IP "\fB\-name section\fR" 4
190 .IX Item "-name section"
191 specifies the configuration file section to use (overrides
192 \&\fBdefault_ca\fR in the \fBca\fR section).
193 .IP "\fB\-in filename\fR" 4
194 .IX Item "-in filename"
195 an input filename containing a single certificate request to be
196 signed by the \s-1CA\s0.
197 .IP "\fB\-ss_cert filename\fR" 4
198 .IX Item "-ss_cert filename"
199 a single self signed certificate to be signed by the \s-1CA\s0.
200 .IP "\fB\-spkac filename\fR" 4
201 .IX Item "-spkac filename"
202 a file containing a single Netscape signed public key and challenge
203 and additional field values to be signed by the \s-1CA\s0. See the \fB\s-1SPKAC\s0 \s-1FORMAT\s0\fR
204 section for information on the required format.
205 .IP "\fB\-infiles\fR" 4
207 if present this should be the last option, all subsequent arguments
208 are assumed to the the names of files containing certificate requests.
209 .IP "\fB\-out filename\fR" 4
210 .IX Item "-out filename"
211 the output file to output certificates to. The default is standard
212 output. The certificate details will also be printed out to this
214 .IP "\fB\-outdir directory\fR" 4
215 .IX Item "-outdir directory"
216 the directory to output certificates to. The certificate will be
217 written to a filename consisting of the serial number in hex with
218 \&\*(L".pem\*(R" appended.
221 the \s-1CA\s0 certificate file.
222 .IP "\fB\-keyfile filename\fR" 4
223 .IX Item "-keyfile filename"
224 the private key to sign requests with.
225 .IP "\fB\-key password\fR" 4
226 .IX Item "-key password"
227 the password used to encrypt the private key. Since on some
228 systems the command line arguments are visible (e.g. Unix with
229 the 'ps' utility) this option should be used with caution.
230 .IP "\fB\-selfsign\fR" 4
232 indicates the issued certificates are to be signed with the key
233 the certificate requests were signed with (given with \fB\-keyfile\fR).
234 Cerificate requests signed with a different key are ignored. If
235 \&\fB\-spkac\fR, \fB\-ss_cert\fR or \fB\-gencrl\fR are given, \fB\-selfsign\fR is
238 A consequence of using \fB\-selfsign\fR is that the self-signed
239 certificate appears among the entries in the certificate database
240 (see the configuration option \fBdatabase\fR), and uses the same
241 serial number counter as all other certificates sign with the
242 self-signed certificate.
243 .IP "\fB\-passin arg\fR" 4
244 .IX Item "-passin arg"
245 the key password source. For more information about the format of \fBarg\fR
246 see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1).
247 .IP "\fB\-verbose\fR" 4
249 this prints extra details about the operations being performed.
250 .IP "\fB\-notext\fR" 4
252 don't output the text form of a certificate to the output file.
253 .IP "\fB\-startdate date\fR" 4
254 .IX Item "-startdate date"
255 this allows the start date to be explicitly set. The format of the
256 date is \s-1YYMMDDHHMMSSZ\s0 (the same as an \s-1ASN1\s0 UTCTime structure).
257 .IP "\fB\-enddate date\fR" 4
258 .IX Item "-enddate date"
259 this allows the expiry date to be explicitly set. The format of the
260 date is \s-1YYMMDDHHMMSSZ\s0 (the same as an \s-1ASN1\s0 UTCTime structure).
261 .IP "\fB\-days arg\fR" 4
263 the number of days to certify the certificate for.
264 .IP "\fB\-md alg\fR" 4
266 the message digest to use. Possible values include md5, sha1 and mdc2.
267 This option also applies to CRLs.
268 .IP "\fB\-policy arg\fR" 4
269 .IX Item "-policy arg"
270 this option defines the \s-1CA\s0 \*(L"policy\*(R" to use. This is a section in
271 the configuration file which decides which fields should be mandatory
272 or match the \s-1CA\s0 certificate. Check out the \fB\s-1POLICY\s0 \s-1FORMAT\s0\fR section
273 for more information.
274 .IP "\fB\-msie_hack\fR" 4
275 .IX Item "-msie_hack"
276 this is a legacy option to make \fBca\fR work with very old versions of
277 the \s-1IE\s0 certificate enrollment control \*(L"certenr3\*(R". It used UniversalStrings
278 for almost everything. Since the old control has various security bugs
279 its use is strongly discouraged. The newer control \*(L"Xenroll\*(R" does not
281 .IP "\fB\-preserveDN\fR" 4
282 .IX Item "-preserveDN"
283 Normally the \s-1DN\s0 order of a certificate is the same as the order of the
284 fields in the relevant policy section. When this option is set the order
285 is the same as the request. This is largely for compatibility with the
286 older \s-1IE\s0 enrollment control which would only accept certificates if their
287 DNs match the order of the request. This is not needed for Xenroll.
288 .IP "\fB\-noemailDN\fR" 4
289 .IX Item "-noemailDN"
290 The \s-1DN\s0 of a certificate can contain the \s-1EMAIL\s0 field if present in the
291 request \s-1DN\s0, however it is good policy just having the e\-mail set into
292 the altName extension of the certificate. When this option is set the
293 \&\s-1EMAIL\s0 field is removed from the certificate' subject and set only in
294 the, eventually present, extensions. The \fBemail_in_dn\fR keyword can be
295 used in the configuration file to enable this behaviour.
296 .IP "\fB\-batch\fR" 4
298 this sets the batch mode. In this mode no questions will be asked
299 and all certificates will be certified automatically.
300 .IP "\fB\-extensions section\fR" 4
301 .IX Item "-extensions section"
302 the section of the configuration file containing certificate extensions
303 to be added when a certificate is issued (defaults to \fBx509_extensions\fR
304 unless the \fB\-extfile\fR option is used). If no extension section is
305 present then, a V1 certificate is created. If the extension section
306 is present (even if it is empty), then a V3 certificate is created.
307 .IP "\fB\-extfile file\fR" 4
308 .IX Item "-extfile file"
309 an additional configuration file to read certificate extensions from
310 (using the default section unless the \fB\-extensions\fR option is also
312 .IP "\fB\-engine id\fR" 4
313 .IX Item "-engine id"
314 specifying an engine (by it's unique \fBid\fR string) will cause \fBreq\fR
315 to attempt to obtain a functional reference to the specified engine,
316 thus initialising it if needed. The engine will then be set as the default
317 for all available algorithms.
318 .IP "\fB\-subj arg\fR" 4
320 supersedes subject name given in the request.
321 The arg must be formatted as \fI/type0=value0/type1=value1/type2=...\fR,
322 characters may be escaped by \e (backslash), no spaces are skipped.
325 this option causes field values to be interpreted as \s-1UTF8\s0 strings, by
326 default they are interpreted as \s-1ASCII\s0. This means that the field
327 values, whether prompted from a terminal or obtained from a
328 configuration file, must be valid \s-1UTF8\s0 strings.
329 .IP "\fB\-multivalue\-rdn\fR" 4
330 .IX Item "-multivalue-rdn"
331 this option causes the \-subj argument to be interpretedt with full
332 support for multivalued RDNs. Example:
334 \&\fI/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe\fR
336 If \-multi\-rdn is not used then the \s-1UID\s0 value is \fI123456+CN=John Doe\fR.
338 .IX Header "CRL OPTIONS"
339 .IP "\fB\-gencrl\fR" 4
341 this option generates a \s-1CRL\s0 based on information in the index file.
342 .IP "\fB\-crldays num\fR" 4
343 .IX Item "-crldays num"
344 the number of days before the next \s-1CRL\s0 is due. That is the days from
345 now to place in the \s-1CRL\s0 nextUpdate field.
346 .IP "\fB\-crlhours num\fR" 4
347 .IX Item "-crlhours num"
348 the number of hours before the next \s-1CRL\s0 is due.
349 .IP "\fB\-revoke filename\fR" 4
350 .IX Item "-revoke filename"
351 a filename containing a certificate to revoke.
352 .IP "\fB\-crl_reason reason\fR" 4
353 .IX Item "-crl_reason reason"
354 revocation reason, where \fBreason\fR is one of: \fBunspecified\fR, \fBkeyCompromise\fR,
355 \&\fBCACompromise\fR, \fBaffiliationChanged\fR, \fBsuperseded\fR, \fBcessationOfOperation\fR,
356 \&\fBcertificateHold\fR or \fBremoveFromCRL\fR. The matching of \fBreason\fR is case
357 insensitive. Setting any revocation reason will make the \s-1CRL\s0 v2.
359 In practive \fBremoveFromCRL\fR is not particularly useful because it is only used
360 in delta CRLs which are not currently implemented.
361 .IP "\fB\-crl_hold instruction\fR" 4
362 .IX Item "-crl_hold instruction"
363 This sets the \s-1CRL\s0 revocation reason code to \fBcertificateHold\fR and the hold
364 instruction to \fBinstruction\fR which must be an \s-1OID\s0. Although any \s-1OID\s0 can be
365 used only \fBholdInstructionNone\fR (the use of which is discouraged by \s-1RFC2459\s0)
366 \&\fBholdInstructionCallIssuer\fR or \fBholdInstructionReject\fR will normally be used.
367 .IP "\fB\-crl_compromise time\fR" 4
368 .IX Item "-crl_compromise time"
369 This sets the revocation reason to \fBkeyCompromise\fR and the compromise time to
370 \&\fBtime\fR. \fBtime\fR should be in GeneralizedTime format that is \fB\s-1YYYYMMDDHHMMSSZ\s0\fR.
371 .IP "\fB\-crl_CA_compromise time\fR" 4
372 .IX Item "-crl_CA_compromise time"
373 This is the same as \fBcrl_compromise\fR except the revocation reason is set to
374 \&\fBCACompromise\fR.
375 .IP "\fB\-crlexts section\fR" 4
376 .IX Item "-crlexts section"
377 the section of the configuration file containing \s-1CRL\s0 extensions to
378 include. If no \s-1CRL\s0 extension section is present then a V1 \s-1CRL\s0 is
379 created, if the \s-1CRL\s0 extension section is present (even if it is
380 empty) then a V2 \s-1CRL\s0 is created. The \s-1CRL\s0 extensions specified are
381 \&\s-1CRL\s0 extensions and \fBnot\fR \s-1CRL\s0 entry extensions. It should be noted
382 that some software (for example Netscape) can't handle V2 CRLs.
383 .SH "CONFIGURATION FILE OPTIONS"
384 .IX Header "CONFIGURATION FILE OPTIONS"
385 The section of the configuration file containing options for \fBca\fR
386 is found as follows: If the \fB\-name\fR command line option is used,
387 then it names the section to be used. Otherwise the section to
388 be used must be named in the \fBdefault_ca\fR option of the \fBca\fR section
389 of the configuration file (or in the default section of the
390 configuration file). Besides \fBdefault_ca\fR, the following options are
391 read directly from the \fBca\fR section:
395 With the exception of \fB\s-1RANDFILE\s0\fR, this is probably a bug and may
396 change in future releases.
398 Many of the configuration file options are identical to command line
399 options. Where the option is present in the configuration file
400 and the command line the command line value is used. Where an
401 option is described as mandatory then it must be present in
402 the configuration file or the command line equivalent (if
404 .IP "\fBoid_file\fR" 4
406 This specifies a file containing additional \fB\s-1OBJECT\s0 \s-1IDENTIFIERS\s0\fR.
407 Each line of the file should consist of the numerical form of the
408 object identifier followed by white space then the short name followed
409 by white space and finally the long name.
410 .IP "\fBoid_section\fR" 4
411 .IX Item "oid_section"
412 This specifies a section in the configuration file containing extra
413 object identifiers. Each line should consist of the short name of the
414 object identifier followed by \fB=\fR and the numerical form. The short
415 and long names are the same when this option is used.
416 .IP "\fBnew_certs_dir\fR" 4
417 .IX Item "new_certs_dir"
418 the same as the \fB\-outdir\fR command line option. It specifies
419 the directory where new certificates will be placed. Mandatory.
420 .IP "\fBcertificate\fR" 4
421 .IX Item "certificate"
422 the same as \fB\-cert\fR. It gives the file containing the \s-1CA\s0
423 certificate. Mandatory.
424 .IP "\fBprivate_key\fR" 4
425 .IX Item "private_key"
426 same as the \fB\-keyfile\fR option. The file containing the
427 \&\s-1CA\s0 private key. Mandatory.
428 .IP "\fB\s-1RANDFILE\s0\fR" 4
430 a file used to read and write random number seed information, or
431 an \s-1EGD\s0 socket (see \fIRAND_egd\fR\|(3)).
432 .IP "\fBdefault_days\fR" 4
433 .IX Item "default_days"
434 the same as the \fB\-days\fR option. The number of days to certify
436 .IP "\fBdefault_startdate\fR" 4
437 .IX Item "default_startdate"
438 the same as the \fB\-startdate\fR option. The start date to certify
439 a certificate for. If not set the current time is used.
440 .IP "\fBdefault_enddate\fR" 4
441 .IX Item "default_enddate"
442 the same as the \fB\-enddate\fR option. Either this option or
443 \&\fBdefault_days\fR (or the command line equivalents) must be
445 .IP "\fBdefault_crl_hours default_crl_days\fR" 4
446 .IX Item "default_crl_hours default_crl_days"
447 the same as the \fB\-crlhours\fR and the \fB\-crldays\fR options. These
448 will only be used if neither command line option is present. At
449 least one of these must be present to generate a \s-1CRL\s0.
450 .IP "\fBdefault_md\fR" 4
451 .IX Item "default_md"
452 the same as the \fB\-md\fR option. The message digest to use. Mandatory.
453 .IP "\fBdatabase\fR" 4
455 the text database file to use. Mandatory. This file must be present
456 though initially it will be empty.
457 .IP "\fBunique_subject\fR" 4
458 .IX Item "unique_subject"
459 if the value \fByes\fR is given, the valid certificate entries in the
460 database must have unique subjects. if the value \fBno\fR is given,
461 several valid certificate entries may have the exact same subject.
462 The default value is \fByes\fR, to be compatible with older (pre 0.9.8)
463 versions of OpenSSL. However, to make \s-1CA\s0 certificate roll-over easier,
464 it's recommended to use the value \fBno\fR, especially if combined with
465 the \fB\-selfsign\fR command line option.
468 a text file containing the next serial number to use in hex. Mandatory.
469 This file must be present and contain a valid serial number.
470 .IP "\fBcrlnumber\fR" 4
472 a text file containing the next \s-1CRL\s0 number to use in hex. The crl number
473 will be inserted in the CRLs only if this file exists. If this file is
474 present, it must contain a valid \s-1CRL\s0 number.
475 .IP "\fBx509_extensions\fR" 4
476 .IX Item "x509_extensions"
477 the same as \fB\-extensions\fR.
478 .IP "\fBcrl_extensions\fR" 4
479 .IX Item "crl_extensions"
480 the same as \fB\-crlexts\fR.
481 .IP "\fBpreserve\fR" 4
483 the same as \fB\-preserveDN\fR
484 .IP "\fBemail_in_dn\fR" 4
485 .IX Item "email_in_dn"
486 the same as \fB\-noemailDN\fR. If you want the \s-1EMAIL\s0 field to be removed
487 from the \s-1DN\s0 of the certificate simply set this to 'no'. If not present
488 the default is to allow for the \s-1EMAIL\s0 filed in the certificate's \s-1DN\s0.
489 .IP "\fBmsie_hack\fR" 4
491 the same as \fB\-msie_hack\fR
494 the same as \fB\-policy\fR. Mandatory. See the \fB\s-1POLICY\s0 \s-1FORMAT\s0\fR section
495 for more information.
496 .IP "\fBname_opt\fR, \fBcert_opt\fR" 4
497 .IX Item "name_opt, cert_opt"
498 these options allow the format used to display the certificate details
499 when asking the user to confirm signing. All the options supported by
500 the \fBx509\fR utilities \fB\-nameopt\fR and \fB\-certopt\fR switches can be used
501 here, except the \fBno_signame\fR and \fBno_sigdump\fR are permanently set
502 and cannot be disabled (this is because the certificate signature cannot
503 be displayed because the certificate has not been signed at this point).
505 For convenience the values \fBca_default\fR are accepted by both to produce
508 If neither option is present the format used in earlier versions of
509 OpenSSL is used. Use of the old format is \fBstrongly\fR discouraged because
510 it only displays fields mentioned in the \fBpolicy\fR section, mishandles
511 multicharacter string types and does not display extensions.
512 .IP "\fBcopy_extensions\fR" 4
513 .IX Item "copy_extensions"
514 determines how extensions in certificate requests should be handled.
515 If set to \fBnone\fR or this option is not present then extensions are
516 ignored and not copied to the certificate. If set to \fBcopy\fR then any
517 extensions present in the request that are not already present are copied
518 to the certificate. If set to \fBcopyall\fR then all extensions in the
519 request are copied to the certificate: if the extension is already present
520 in the certificate it is deleted first. See the \fB\s-1WARNINGS\s0\fR section before
523 The main use of this option is to allow a certificate request to supply
524 values for certain extensions such as subjectAltName.
526 .IX Header "POLICY FORMAT"
527 The policy section consists of a set of variables corresponding to
528 certificate \s-1DN\s0 fields. If the value is \*(L"match\*(R" then the field value
529 must match the same field in the \s-1CA\s0 certificate. If the value is
530 \&\*(L"supplied\*(R" then it must be present. If the value is \*(L"optional\*(R" then
531 it may be present. Any fields not mentioned in the policy section
532 are silently deleted, unless the \fB\-preserveDN\fR option is set but
533 this can be regarded more of a quirk than intended behaviour.
535 .IX Header "SPKAC FORMAT"
536 The input to the \fB\-spkac\fR command line option is a Netscape
537 signed public key and challenge. This will usually come from
538 the \fB\s-1KEYGEN\s0\fR tag in an \s-1HTML\s0 form to create a new private key.
539 It is however possible to create SPKACs using the \fBspkac\fR utility.
541 The file should contain the variable \s-1SPKAC\s0 set to the value of
542 the \s-1SPKAC\s0 and also the required \s-1DN\s0 components as name value pairs.
543 If you need to include the same component twice then it can be
544 preceded by a number and a '.'.
546 .IX Header "EXAMPLES"
547 Note: these examples assume that the \fBca\fR directory structure is
548 already set up and the relevant files already exist. This usually
549 involves creating a \s-1CA\s0 certificate and private key with \fBreq\fR, a
550 serial number file and an empty index file and placing them in
551 the relevant directories.
553 To use the sample configuration file below the directories demoCA,
554 demoCA/private and demoCA/newcerts would be created. The \s-1CA\s0
555 certificate would be copied to demoCA/cacert.pem and its private
556 key to demoCA/private/cakey.pem. A file demoCA/serial would be
557 created containing for example \*(L"01\*(R" and the empty index file
560 Sign a certificate request:
563 \& openssl ca \-in req.pem \-out newcert.pem
566 Sign a certificate request, using \s-1CA\s0 extensions:
569 \& openssl ca \-in req.pem \-extensions v3_ca \-out newcert.pem
572 Generate a \s-1CRL\s0
575 \& openssl ca \-gencrl \-out crl.pem
578 Sign several requests:
581 \& openssl ca \-infiles req1.pem req2.pem req3.pem
584 Certify a Netscape \s-1SPKAC:\s0
587 \& openssl ca \-spkac spkac.txt
590 A sample \s-1SPKAC\s0 file (the \s-1SPKAC\s0 line has been truncated for clarity):
593 \& SPKAC=MIG0MGAwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAn7PDhCeV/xIxUg8V70YRxK2A5
595 \& emailAddress=steve@openssl.org
596 \& 0.OU=OpenSSL Group
597 \& 1.OU=Another Group
600 A sample configuration file with the relevant sections for \fBca\fR:
604 \& default_ca = CA_default # The default ca section
608 \& dir = ./demoCA # top dir
609 \& database = $dir/index.txt # index file.
610 \& new_certs_dir = $dir/newcerts # new certs dir
612 \& certificate = $dir/cacert.pem # The CA cert
613 \& serial = $dir/serial # serial no file
614 \& private_key = $dir/private/cakey.pem# CA private key
615 \& RANDFILE = $dir/private/.rand # random number file
617 \& default_days = 365 # how long to certify for
618 \& default_crl_days= 30 # how long before next CRL
619 \& default_md = md5 # md to use
621 \& policy = policy_any # default policy
622 \& email_in_dn = no # Don't add the email into cert DN
624 \& name_opt = ca_default # Subject name display option
625 \& cert_opt = ca_default # Certificate display option
626 \& copy_extensions = none # Don't copy extensions from request
629 \& countryName = supplied
630 \& stateOrProvinceName = optional
631 \& organizationName = optional
632 \& organizationalUnitName = optional
633 \& commonName = supplied
634 \& emailAddress = optional
638 Note: the location of all files can change either by compile time options,
639 configuration file entries, environment variables or command line options.
640 The values below reflect the default values.
643 \& /usr/local/ssl/lib/openssl.cnf \- master configuration file
644 \& ./demoCA \- main CA directory
645 \& ./demoCA/cacert.pem \- CA certificate
646 \& ./demoCA/private/cakey.pem \- CA private key
647 \& ./demoCA/serial \- CA serial number file
648 \& ./demoCA/serial.old \- CA serial number backup file
649 \& ./demoCA/index.txt \- CA text database file
650 \& ./demoCA/index.txt.old \- CA text database backup file
651 \& ./demoCA/certs \- certificate output file
652 \& ./demoCA/.rnd \- CA random seed information
654 .SH "ENVIRONMENT VARIABLES"
655 .IX Header "ENVIRONMENT VARIABLES"
656 \&\fB\s-1OPENSSL_CONF\s0\fR reflects the location of master configuration file it can
657 be overridden by the \fB\-config\fR command line option.
659 .IX Header "RESTRICTIONS"
660 The text database index file is a critical part of the process and
661 if corrupted it can be difficult to fix. It is theoretically possible
662 to rebuild the index file from all the issued certificates and a current
663 \&\s-1CRL:\s0 however there is no option to do this.
665 V2 \s-1CRL\s0 features like delta CRLs are not currently supported.
667 Although several requests can be input and handled at once it is only
668 possible to include one \s-1SPKAC\s0 or self signed certificate.
671 The use of an in memory text database can cause problems when large
672 numbers of certificates are present because, as the name implies
673 the database has to be kept in memory.
675 The \fBca\fR command really needs rewriting or the required functionality
676 exposed at either a command or interface level so a more friendly utility
677 (perl script or \s-1GUI\s0) can handle things properly. The scripts \fB\s-1CA\s0.sh\fR and
678 \&\fB\s-1CA\s0.pl\fR help a little but not very much.
680 Any fields in a request that are not present in a policy are silently
681 deleted. This does not happen if the \fB\-preserveDN\fR option is used. To
682 enforce the absence of the \s-1EMAIL\s0 field within the \s-1DN\s0, as suggested by
683 RFCs, regardless the contents of the request' subject the \fB\-noemailDN\fR
684 option can be used. The behaviour should be more friendly and
687 Cancelling some commands by refusing to certify a certificate can
688 create an empty file.
690 .IX Header "WARNINGS"
691 The \fBca\fR command is quirky and at times downright unfriendly.
693 The \fBca\fR utility was originally meant as an example of how to do things
694 in a \s-1CA\s0. It was not supposed to be used as a full blown \s-1CA\s0 itself:
695 nevertheless some people are using it for this purpose.
697 The \fBca\fR command is effectively a single user command: no locking is
698 done on the various files and attempts to run more than one \fBca\fR command
699 on the same database can have unpredictable results.
701 The \fBcopy_extensions\fR option should be used with caution. If care is
702 not taken then it can be a security risk. For example if a certificate
703 request contains a basicConstraints extension with \s-1CA:TRUE\s0 and the
704 \&\fBcopy_extensions\fR value is set to \fBcopyall\fR and the user does not spot
705 this when the certificate is displayed then this will hand the requestor
706 a valid \s-1CA\s0 certificate.
708 This situation can be avoided by setting \fBcopy_extensions\fR to \fBcopy\fR
709 and including basicConstraints with \s-1CA:FALSE\s0 in the configuration file.
710 Then if the request contains a basicConstraints extension it will be
713 It is advisable to also include values for other extensions such
714 as \fBkeyUsage\fR to prevent a request supplying its own values.
716 Additional restrictions can be placed on the \s-1CA\s0 certificate itself.
717 For example if the \s-1CA\s0 certificate has:
720 \& basicConstraints = CA:TRUE, pathlen:0
723 then even if a certificate is issued with \s-1CA:TRUE\s0 it will not be valid.
725 .IX Header "SEE ALSO"
726 \&\fIreq\fR\|(1), \fIspkac\fR\|(1), \fIx509\fR\|(1), \s-1\fICA\s0.pl\fR\|(1),
projects / dragonfly.git / blob