OPENSSL(1) General Commands Manual OPENSSL(1) (NAME) openssl - OpenSSL (SYNOPSIS) openssl command [command_opt ...] [command_arg ...] openssl list-standard-commands | list-message-digest-commands | list-cipher-commands | list-cipher-algorithms | list-message-digest-algorithms | list-public-key-algorithms openssl no-command (DESCRIPTION) OpenSSL Transport Layer Security (TLS) . openssl openssl . list-standard-commands list-message-digest-commands list-cipher-commands ( ) (message digest) (cipher) openssl . list-cipher-algorithms list-message-digest-algorithms . : from => to list-public-key-algorithms . no-command . command no-command command . stdout stderr . . openssl . : no-command quit list-...-commands no-command . ASN1PARSE openssl asn1parse [-i] [-dlimit number] [-dump] [-genconf file] [-genstr str] [-in file] [-inform der | pem | txt] [-length number] [-noout] [-offset number] [-oid file] [-out file] [-strparse offset] asn1parse ASN.1 . ASN.1 . : -dlimit number (dump) number . -dump . -genconf file, -genstr str str file ASN1_generate_nconf(3) . file "asn1" . ASN.1 -out . -i "" . -in file . -inform der | pem | txt . -length number . -noout . -offset number . -oid file (OID). OID ( ) openssl ( 1.2.3.4) . : OID . " " . " " . asn1parse . -out file DER ( -strparse ). -strparse offset ASN.1 offset . " " . CA openssl ca [-batch] [-cert file] [-config file] [-create_serial] [-crl_CA_compromise time] [-crl_compromise time] [-crl_hold instruction] [-crl_reason reason] [-crldays days] [-crlexts section] [-crlhours hours] [-crlsec seconds] [-days arg] [-enddate date] [-extensions section] [-extfile file] [-gencrl] [-in file] [-infiles] [-key password] [-keyfile file] [-keyform pem | der] [-md alg] [-multivalue-rdn] [-name section] [-noemailDN] [-notext] [-out file] [-outdir directory] [-passin arg] [-policy arg] [-preserveDN] [-revoke file] [-selfsign] [-sigopt nm:v] [-ss_cert file] [-startdate date] [-status serial] [-subj arg] [-updatedb] [-utf8] [-verbose] ca (CA) . (CRL) . . (CA) : -batch ( Batch). . -cert file CA. -config file . -create_serial . -days arg . -enddate date . [YY]YYMMDDHHMMSSZ . -extensions section ( x509_extensions -extfile ). (V1) . ( ) (V3) . x509v3.cnf(5) . -extfile file file ( -extensions ). -in file file CA. -infiles . -key password password . . -keyfile file . -keyform pem | der . pem . -md alg . md5 sha1 . CRL . -multivalue-rdn -subj RDN "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe". -multivalue-rdn UID "123456+CN=John Doe" . -name section section ( default_ca ca ). -noemailDN EMAIL DN DN altName . EMAIL (subject) ( ) . email_in_dn . -notext . -out file . . PEM . -outdir directory directory . ".pem" . -passin arg . -policy arg " (policy)" CA. policy DN . "match" ( CA ) "supplied" ( ) "optional" ( ) . policy -preserveDN . -preserveDN DN (policy) . . IE DN . Xenroll . -selfsign ( -keyfile ) . . -gencrl -ss_cert -selfsign . -selfsign ( database ) . -sigopt nm:v . . -ss_cert file CA. -startdate date . [YY]YYMMDDHHMMSSZ . -subj arg (subject) . arg : /type0=value0/type1=value1/type2=...; `\' () . -utf8 UTF-8. ASCII . -verbose . (CRL) : -crl_CA_compromise time -crl_compromise CACompromise . -crl_compromise time keyCompromise time. time GeneralizedTime YYYYMMDDHHMMSSZ . -crl_hold instruction CRL certificateHold instruction OID . OID holdInstructionNone ( RFC 2459 ) holdInstructionCallIssuer holdInstructionReject . -crl_reason reason reason : unspecified keyCompromise CACompromise affiliationChanged superseded cessationOfOperation certificateHold removeFromCRL. reason . CRL (v2) . removeFromCRL delta CRL . -crldays days CRL . nextUpdate CRL . -crlexts section section CRL . CRL CRL CRL ( ) CRL . CRL CRL. CRL . x509v3.cnf(5) . -crlhours hours CRL . -crlsec seconds CRL . -gencrl CRL (index). -revoke file file . -status serial serial. -updatedb . ca ( ) default_ca -name . preserve ca . . . ( ) . certificate -cert. CA . . copy_extensions . none . copy . copyall : . copy_extensions . . basicConstraints CA:TRUE copy_extensions copyall CA . copy_extensions copy basicConstraints CA:FALSE . basicConstraints . subjectAltName . crl_extensions -crlexts. crlnumber CRL . CRL CRL . CRL . database . . . default_crl_hours, default_crl_days -crlhours -crldays. . CRL . default_days -days. . default_enddate -enddate. default_days ( ) . default_md -md. . . default_startdate -startdate. . . email_in_dn -noemailDN. EMAIL DN "no" . EMAIL DN . name_opt, cert_opt . -nameopt -certopt x509 no_signame no_sigdump ( ). ca_default . openssl . policy . new_certs_dir -outdir. . . oid_file (OID) . . oid_section . `=' . . policy -policy. . preserve -preserveDN. private_key -keyfile. CA. . serial . . . unique_subject yes (subjects) . no . yes . . . x509_extensions -extensions. CERTHASH openssl certhash [-nv] dir ... certhash ".pem" . SSL_CTX_load_verify_locations(3) . "HHHHHHHH.D" `H' `D' . CRL `r' : "HHHHHHHH.rD". certhash . `D' . SHA256 . . CRL . : -n ( ). -v . dir ... . CIPHERS openssl ciphers [-hsVv] [-tls1_2] [-tls1_3] [control] ciphers control SSL_CTX_set_cipher_list(3) SSL . control DEFAULT . : -h, -? . -s TLS . -tls1_2 | -tls1_3 -s - . -V . MAC. -v -V - . CMS openssl cms [-aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -rc2-40 | -rc2-64 | -rc2-128] [-CAfile file] [-CApath directory] [-CRLfile file] [-binary] [-certfile file] [-certsout file] [-cmsout] [-content file] [-crlfeol] [-data_create] [-data_out] [-debug_decrypt] [-decrypt] [-digest_create] [-digest_verify] [-econtent_type type] [-encrypt] [-EncryptedData_decrypt] [-EncryptedData_encrypt] [-from addr] [-in file] [-inform der | pem | smime] [-inkey file] [-keyform der | pem] [-keyid] [-keyopt nm:v] [-md digest] [-no_attr_verify] [-no_content_verify] [-no_signer_cert_verify] [-noattr] [-nocerts] [-nodetach] [-nointern] [-nooldmime] [-noout] [-nosigs] [-nosmimecap] [-noverify] [-out file] [-outform der | pem | smime] [-passin src] [-print] [-pwri_password arg] [-rctform der | pem | smime] [-receipt_request_all | -receipt_request_first] [-receipt_request_from addr] [-receipt_request_print] [-receipt_request_to addr] [-recip file] [-resign] [-secretkey key] [-secretkeyid id] [-sign] [-sign_receipt] [-signer file] [-stream | -indef | -noindef] [-subject s] [-text] [-to addr] [-verify] [-verify_receipt file] [-verify_retcode] [cert.pem ...] cms S/MIME . . S/MIME . MIME (headers) . . (pipe) sendmail . MIME S/MIME ( ). -text . " " . . . . -encrypt . . MIME . CMS EnvelopedData . . -decrypt . MIME . . -sign . . MIME . -verify . . (clear text) (opaque) . -cmsout CMS PEM . -resign . . . . -data_create CMS Data. -data_out CMS Data. -digest_create CMS DigestedData. -digest_verify CMS DigestedData . -EncryptedData_encrypt CMS EncryptedData. -EncryptedData_decrypt CMS EncryptedData . -sign_receipt . . -sign . -verify_receipt file . . -verify . : -aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -rc2-40 | -rc2-64 | -rc2-128 . AES CAMELLIA DES ( ) Triple DES ( ) RC2 AES . -encrypt -EncryptedData_encrypt . -binary S/MIME "" (canonical) CR/LF . . MIME . -CAfile file CA -verify -verify_receipt. -CApath directory CA -verify -verify_receipt. : ( x509 -hash) . -CRLfile file (CRL) . CRL PEM . cert.pem ... : . -certfile file . . . PEM . -certsout file . -check_ss_sig, -crl_check, -crl_check_all, -extended_crl, -ignore_critical, -issuer_checks, -policy, -policy_check, -purpose, -x509_strict . verify . -content file (detached content). -verify . CMS . S/MIME MIME multipart/signed . -crlfeol S/MIME CR/LF. -debug_decrypt CMS_DEBUG_DECRYPT . MMA . CMS_decrypt(3) . -from addr, -subject s, -to addr (headers) . . S/MIME From: . -econtent_type type -sign. Data . type OID . -in file . -inform der | pem | smime CMS. smime S/MIME . pem der CMS PEM DER . CMS CMS ( -encrypt -sign) . -inkey file . . -recip -signer . . -keyform der | pem . pem . -keyid (subject key identifier) . . -sign -encrypt . -keyopt nm:v . RSA-PSS RSA- OAEP ECDH . . -md digest . ( SHA1). -no_attr_verify . -no_content_verify . -no_signer_cert_verify . -noattr . . . -nocerts . ( -certfile ). -nodetach (opaque signing) . (mail relays) S/MIME . MIME multipart/signed . -nointern -certfile . ( ) . CA . -nooldmime S/MIME "application/x-pkcs7-". -noout CMS -cmsout . -print CMS . -nosigs . -nosmimecap . -noverify . -out file MIME . -outform der | pem | smime CMS . smime S/MIME . pem der CMS PEM DER . CMS CMS ( -verify -decrypt) . -passin src . -print CMS -cmsout. . -pwri_password arg PasswordRecipientInfo (PWRI) . -encrypt -decrypt . -rctform der | pem | smime -receipt_verify. smime . -receipt_request_all | -receipt_request_first ( ) -sign . -receipt_request_from . -receipt_request_from addr . -receipt_request_print -verify. -receipt_request_to addr . . -recip file . . . ( RSA-OAEP) . RSA Diffie-Hellman EC . -secretkey key . . -EncryptedData_encrypt - -EncryptedData_decrypt - -encrypt -decrypt . -encrypt -decrypt - AES KEKRecipientInfo . -secretkeyid id KEKRecipientInfo. -secretkey -encrypt . -decrypt KEKRecipientInfo . -signer file . . -stream | -indef | -noindef -stream -indef / (streaming I/O) . . S/MIME smime . -noindef / . . -text MIME (text/plain) . : MIME text/plain . -verify_retcode . -verify . . verify . cms : 0 . 1 . 2 . 3 CMS MIME . 4 . 5 . 6 . 32+ -verify_retcode . CRL openssl crl [-CAfile file] [-CApath dir] [-crlnumber] [-fingerprint] [-hash] [-hash_old] [-in file] [-inform der | pem] [-issuer] [-lastupdate] [-nameopt option] [-nextupdate] [-noout] [-out file] [-outform der | pem] [-text] [-verify] crl (CRL) DER PEM . : -CAfile file CRL file. -CApath directory CRL dir. ( x509 -hash) . -crlnumber CRL. -fingerprint CRL. -hash . CRL . -hash_old (MD5) . -in file . -inform der | pem . -issuer . -lastupdate thisUpdate . . -nameopt option . -nextupdate nextUpdate . -noout CRL . -out file . -outform der | pem . -text CRL . -verify CRL. CRL2PKCS7 openssl crl2pkcs7 [-certfile file] [-in file] [-inform der | pem] [-nocrl] [-out file] [-outform der | pem] crl2pkcs7 CRL (degenerate) " (certificates only)" PKCS#7 . : -certfile file file PEM PKCS#7. . -in file CRL file . -inform der | pem . -nocrl CRL . CRL CRL . -out file PKCS#7 file . -outform der | pem . DGST openssl dgst [-cdr] [-binary] [-digest] [-hex] [-hmac key] [-keyform pem] [-mac algorithm] [-macopt nm:v] [-out file] [-passin arg] [-prverify file] [-sign file] [-signature file] [-sigopt nm:v] [-verify file] [file ...] (digest) file files . . : -binary (). -c . -d BIO. -digest digest. SHA256 . openssl list-message-digest-commands . : openssl dgst -sha256 openssl sha256. -hex (hex dump) . "" . -hmac key (HMAC) key. -keyform pem . -mac algorithm (MAC). MAC HMAC ( ) MAC . MAC -macopt . -macopt nm:v MAC -mac . HMAC : key:string MAC - ( ). MAC . hexkey:string MAC ( ). MAC . -out file . -passin arg . -prverify file file. "Verification OK" "Verification Failure" . -r (coreutils). -sign file file. -signature file . -sigopt nm:v . . -verify file file. "Verification OK" "Verification Failure" . file ... . . DHPARAM openssl dhparam [-2 | -5] [-check] [-dsaparam] [-in file] [-inform der | pem] [-noout] [-out file] [-outform der | pem] [-text] [numbits] dhparam - (DH) . PKCS#3 DH X9.42 DH. : -2, -5 (generator) . . -check DH. -dsaparam DSA DH . "" ( (p-1)/2 ) DH . DH -dsaparam DH . DH DSA DH (small-subgroup) . -in file . -inform der | pem . -noout . -out file . -outform der | pem . -text DH . numbits numbits. . . . DSA openssl dsa [-aes128 | -aes192 | -aes256 | -des | -des3] [-in file] [-inform der | pem | pvk] [-modulus] [-noout] [-out file] [-outform der | pem | pvk] [-passin arg] [-passout arg] [-pubin] [-pubout] [-pvk-none | -pvk-strong | -pvk-weak] [-text] dsa DSA . . : SSLeay : PKCS#8 pkcs8 . : -aes128 | -aes192 | -aes256 | -des | -des3 AES DES Triple DES . (passphrase) . . dsa . PEM . -in file . . -inform der | pem | pvk . -modulus . -noout . -out file . . -outform der | pem | pvk . -passin arg . -passout arg . -pubin . -pubout . . -pvk-none | -pvk-strong | -pvk-weak PVK. -pvk-strong . -text / . DSAPARAM openssl dsaparam [-genkey] [-in file] [-inform der | pem] [-noout] [-out file] [-outform der | pem] [-text] [numbits] dsaparam DSA . : -genkey DSA . -in file . numbits . -inform der | pem . -noout . -out file . -outform der | pem . -text DSA . numbits numbits. . EC openssl ec [-conv_form arg] [-des] [-des3] [-in file] [-inform der | pem] [-noout] [-out file] [-outform der | pem] [-param_enc arg] [-param_out] [-passin arg] [-passout arg] [-pubin] [-pubout] [-text] ec (EC) . . openssl "SEC 1: Elliptic Curve Cryptography" (https://www.secg.org). . EC PKCS#8 pkcs8 . : -conv_form arg . : compressed uncompressed () hybrid. X9.62 . -des | -des3 DES Triple DES openssl . . . ec . PEM . -in file . . -inform der | pem . -noout . -out file . . -outform der | pem . -param_enc arg . : named_curve EC OID explicit EC ( EC RFC 3279 ). named_curve . : implicitlyCA RFC 3279 . -param_out . -passin arg . -passout arg . -pubin . -pubout . . -text / . ECPARAM openssl ecparam [-check] [-conv_form arg] [-genkey] [-in file] [-inform der | pem] [-list_curves] [-name arg] [-no_seed] [-noout] [-out file] [-outform der | pem] [-param_enc arg] [-text] ecparam EC . openssl ecparam EC () . : -check . -conv_form arg . : compressed uncompressed () hybrid. X9.62 . -genkey EC . -in file . -inform der | pem . -list_curves EC . -name arg EC " " . -no_seed (seed) ECParameters ( RFC 3279 ). -noout . -out file . -outform der | pem . -param_enc arg . : named_curve EC OID explicit EC ( EC RFC 3279 ). named_curve . : implicitlyCA RFC 3279 . -text EC . ENC openssl enc -ciphername [-AadePpv] [-base64] [-bufsize number] [-debug] [-in file] [-iter iterations] [-iv IV] [-K key] [-k password] [-kfile file] [-md digest] [-none] [-nopad] [-nosalt] [-out file] [-pass arg] [-pbkdf2] [-S salt] [-salt] . Base64 . openssl ciphername openssl enc -ciphername . . PKCS#5 ( ) . . : -A -a Base64 . -a, -base64 Base64. Base64 . Base64 . -bufsize number /. -d . -debug BIO /. -e . . -in file . -iter iterations PBKDF2 iterations (iteration). -iv IV IV ( Initialization Vector) : . key -K IV . IV . -K key key : . IV -iv . key password key -K IV . key password . -k password password . -pass . -kfile file file. -pass . -md digest digest . sha256 . -none NULL ( ). -nopad . -nosalt (salt) . (dictionary attacks) . -out file . -P salt key IV . -p salt key IV . -pass arg . -pbkdf2 PBKDF2 , . -S salt (salt) salt : . -salt (). : . -v . ERRSTR openssl errstr errno ... errstr errno . ERR_error_string_n(3) : error:[error code]:[library name]:[function name]:[reason string] [error code] . [library name ] [function name] [reason string] ASCII . GENDSA openssl gendsa [-aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -idea] [-out file] [-passout arg] paramfile gendsa DSA DSA ( openssl dsaparam ). DSA RSA . : -aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -idea AES CAMELLIA DES Triple DES IDEA . . . -out file . -passout arg . paramfile DSA . . GENPKEY openssl genpkey [-algorithm alg] [cipher] [-genparam] [-out file] [-outform der | pem] [-paramfile file] [-pass arg] [-pkeyopt opt:value] [-text] genpkey . . : -algorithm alg RSA DSA DH. -pkeyopt . -paramfile -algorithm () . cipher . EVP_get_cipherbyname(3) . -genparam . -algorithm - -paramfile -pkeyopt . -out file . -outform der | pem . -paramfile file . . -pkeyopt . -paramfile -algorithm . -pass arg . -pkeyopt opt:value opt value : rsa_keygen_bits:numbits (RSA) . . rsa_keygen_pubexp:value (RSA) RSA. 0x . . dsa_paramgen_bits:numbits (DSA) . . dh_paramgen_prime_len:numbits (DH) p. dh_paramgen_generator:value (DH) g. ec_paramgen_curve:curve (EC) . -text / . GENRSA openssl genrsa [-3 | -f4] [-aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -idea] [-out file] [-passout arg] [numbits] genrsa RSA . . `.' `+' - (Miller-Rabin) `*' . ( ). : -3 | -f4 . . -aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -idea AES CAMELLIA DES Triple DES IDEA . . -passout . -out file . -passout arg . numbits . . . OCSP openssl ocsp [-CA file] [-CAfile file] [-CApath directory] [-cert file] [-dgst alg] [-header name value] [-host hostname:port] [-ignore_err] [-index indexfile] [-issuer file] [-ndays days] [-nmin minutes] [-no_cert_checks] [-no_cert_verify] [-no_certs] [-no_chain] [-no_explicit] [-no_intern] [-no_nonce] [-no_signature_verify] [-nonce] [-noverify] [-nrequest number] [-out file] [-path path] [-port portnum] [-req_text] [-reqin file] [-reqout file] [-resp_key_id] [-resp_no_certs] [-resp_text] [-respin file] [-respout file] [-rkey file] [-rother file] [-rsigner file] [-serial num] [-sign_other file] [-signer file] [-signkey file] [-status_age age] [-text] [-timeout seconds] [-trust_other] [-url responder_url] [-VAfile file] [-validity_period nsec] [-verify_other file] Online Certificate Status Protocol (OCSP) () (RFC 2560). ocsp OCSP . OCSP OCSP . : -CAfile file, -CApath directory CA OCSP. -cert file file . -issuer . -dgst alg alg OCSP. SHA1 . -host hostname:port, -path path OCSP hostname port. -path HTTP / . -header name value OCSP . . -issuer file PEM. -cert . -no_cert_checks OCSP . . -no_cert_verify OCSP . OCSP . -no_certs . -no_chain CA . -no_explicit OCSP CA . -no_intern OCSP . -verify_other -VAfile . -no_signature_verify OCSP . OCSP . -nonce, -no_nonce (nonce) OCSP OCSP. OCSP -respin -nonce . OCSP ( -cert -serial -) -no_nonce . -noverify OCSP . . -out file . -req_text, -resp_text, -text OCSP OCSP . -reqin file, -respin file OCSP file. OCSP ( -serial - -cert -host -) . -reqout file, -respout file DER file. -serial num -cert num . `0x' . . -sign_other file . -signer file, -signkey file OCSP -signer -signkey. -signkey . OCSP . -timeout seconds (timeout) OCSP . -trust_other -verify_other . CA . -url responder_url URL . HTTP HTTPS (SSL/TLS) . -VAfile file . -verify_other -trust_other. -validity_period nsec, -status_age age ( ) OCSP . notBefore notAfter . . OCSP . -validity_period . notAfter . notBefore age . . -verify_other file OCSP. . OCSP : -CA file CA indexfile. -ignore_err . -index indexfile indexfile ca . ocsp (responder) . ( -issuer -serial -) ( -respin -) OCSP ( port url ). -CA -rsigner . -nmin minutes, -ndays days minutes days : nextUpdate . nextUpdate . -nrequest number number ( ). -port portnum OCSP . -url . -resp_key_id (key ID) . -resp_no_certs OCSP . -rkey file OCSP -rsigner . -rother file OCSP. -rsigner file OCSP. OCSP OCSP . OCSP . -CAfile -CApath openssl . OCSP . CA OCSP : OCSP . CA OCSP CA . OCSPSigning OCSP OCSP . CA CA OCSP OCSP . OCSP . OCSP . OCSP CA ( ) . OCSP (global responder) CA CA OCSP . -VAfile . PASSWD openssl passwd [-1 | -apr1 | -crypt] [-in file] [-noverify] [-quiet] [-reverse] [-salt string] [-stdin] [-table] [password] passwd . : -1 BSD MD5 "1". -apr1 "apr1" ( BSD). -crypt "crypt" (). -in file file. -noverify . -quiet . -reverse . -table . -salt string (salt) string. -noverify . -stdin . -table TAB . PKCS7 openssl pkcs7 [-in file] [-inform der | pem] [-noout] [-out file] [-outform der | pem] [-print] [-print_certs] [-text] pkcs7 PKCS#7 DER PEM . PKCS#7 . PKCS#7 RFC 2315 . : -in file . -inform der | pem . -noout PKCS#7 ( -print_certs ). -out file . -outform der | pem . -print ASN.1 PKCS#7. -print_certs CRL . -text . PKCS8 openssl pkcs8 [-in file] [-inform der | pem] [-nocrypt] [-noiter] [-out file] [-outform der | pem] [-passin arg] [-passout arg] [-topk8] [-v1 alg] [-v2 alg] pkcs8 ( ) PKCS#8 PKCS#5 ( . .) PKCS#12 . : -in file . . -inform der | pem . -nocrypt PrivateKeyInfo . . -noiter (iteration). PKCS12 . -out file . . -outform der | pem . -passin arg . -passout arg . -topk8 PKCS#8. -v1 alg PKCS#5 v1.5 PKCS#12 . PBE-MD5-DES DES . PBE-SHA1-RC2-64 | PBE-MD5-RC2-64 | PBE-SHA1-DES RC2 DES . PBE-SHA1-RC4-128 | PBE-SHA1-RC4-40 | PBE-SHA1-3DES PBE-SHA1-2DES | PBE-SHA1-RC2-128 | PBE-SHA1-RC2-40 PKCS#12 Triple DES RC2 . -v2 alg PKCS#5 v2.0. CBC . AES-256-CBC . AES RFC 8018 . des des3 rc2 (rc5 ). PKCS12 openssl pkcs12 [-aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -idea] [-cacerts] [-CAfile file] [-caname name] [-CApath directory] [-certfile file] [-certpbe alg] [-chain] [-clcerts] [-descert] [-export] [-in file] [-info] [-inkey file] [-keyex] [-keypbe alg] [-keysig] [-macalg alg] [-maciter] [-name name] [-nocerts] [-nodes] [-noiter] [-nokeys] [-nomac] [-nomaciter] [-nomacver] [-noout] [-out file] [-passin arg] [-passout arg] [-password arg] [-twopass] pkcs12 PKCS#12 ( PFX ) . PKCS#12 PKCS#12 -export . PKCS12 : -aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -des | -des3 | -idea AES CAMELLIA DES Triple DES IDEA. Triple DES . -cacerts CA ( ). -clcerts ( CA ). -in file . -info PKCS#12 . -nocerts . -nodes . -nokeys . -nomacver MAC . -noout . -out file The output file to write to, or standard output if not specified. -passin arg . -passout arg . -twopass : PKCS#12 . PKCS12 : -CAfile file CA . -CApath directory CA . : ( x509 -hash) . -caname name " (friendly name)" . . -certfile file . -certpbe alg, -keypbe alg . PKCS#5 v1.5 PKCS#12 PBE . ( list-cipher-algorithms) PKCS#5 v2.0 . PKCS#12 . -chain . CA . . -descert Triple DES PKCS#12 " (export grade)" . Triple DES RC2 . -export PKCS#12 ( ). -in file . The order doesn't matter but one private key and its corresponding certificate should be present. If additional certificates are present, they will also be included in the PKCS#12 file. -inkey file . . -keyex | -keysig . " " RSA . -keysig . S/MIME Authenticode ( ) SSL . -macalg alg MAC. SHA1 . -maciter : MAC . -name name " " . . -nomac MAC . -nomaciter, -noiter MAC . : . MAC . MAC MAC . . MAC . -out file The output file to write to, or standard output if not specified. -passin arg . -passout arg . -password arg -export - -password -passout . -password -passin . PKEY openssl pkey [cipher] [-in file] [-inform der | pem] [-noout] [-out file] [-outform der | pem] [-passin arg] [-passout arg] [-pubin] [-pubout] [-text] [-text_pub] pkey . . : cipher . EVP_get_cipherbyname(3) des3. -in file . . -inform der | pem . -noout Do not output the encoded version of the key. -out file The output file to write to, or standard output if not specified. . -outform der | pem . -passin arg . -passout arg . -pubin Read in a public key, not a private key. -pubout Output a public key, not a private key. Automatically set if the input is a public key. -text Print the public/private key in plain text. -text_pub . PKEYPARAM openssl pkeyparam [-in file] [-noout] [-out file] [-text] pkeyparam . PEM . : -in file . -noout Do not output the encoded version of the parameters. -out file The output file to write to, or standard output if not specified. -text . PKEYUTL openssl pkeyutl [-asn1parse] [-certin] [-decrypt] [-derive] [-encrypt] [-hexdump] [-in file] [-inkey file] [-keyform der | pem] [-out file] [-passin arg] [-peerform der | pem] [-peerkey file] [-pkeyopt opt:value] [-pubin] [-rev] [-sigfile file] [-sign] [-verify] [-verifyrecover] pkeyutl . : -asn1parse ASN.1 . -verifyrecover ASN.1 . -certin . -decrypt . -derive (peer key). -encrypt . -hexdump (hex dump) . -in file . -inkey file . . -keyform der | pem . -out file The output file to write to, or standard output if not specified. -passin arg . -peerform der | pem . -peerkey file ( ). -pkeyopt opt:value opt value. digest:alg sign verify verifyrecover . alg EVP_get_digestbyname(3) . RSA encrypt decrypt sign verify verifyrecover . . rsa_padding_mode:mode RSA . mode : pkcs1 PKCS#1 none oaep OAEP x931 X9.31 pss PSS. PKCS#1 DigestInfo . DigestInfo . oeap . x931 X9.31 . sign verify verifyrecover . pss sign verify . rsa_pss_saltlen:len pss (salt) . : - . - . - PSS . DSA sign verify . digest . SHA1 . DH derive . EC sign verify derive . sign verify ECDSA derive ECDH . digest . SHA1 . -pubin The input file is a public key. -rev . -sigfile file ( verify). -sign . . -verify . -verifyrecover . PRIME openssl prime [-bits n] [-checks n] [-generate] [-hex] [-safe] p prime . : . : -bits n . -generate . -checks n - n . . -generate . -bits . -hex . -safe "" ( p (p-1)/2 ). p p . RAND openssl rand [-base64] [-hex] [-out file] num rand num . : -base64 Base64 . -hex . -out file The output file to write to, or standard output if not specified. REQ openssl req [-addext ext] [-batch] [-config file] [-days n] [-extensions section] [-in file] [-inform der | pem] [-key keyfile] [-keyform der | pem] [-keyout file] [-md4 | -md5 | -sha1] [-modulus] [-multivalue-rdn] [-nameopt option] [-new] [-newhdr] [-newkey arg] [-nodes] [-noout] [-out file] [-outform der | pem] [-passin arg] [-passout arg] [-pkeyopt opt:value] [-pubkey] [-reqexts section] [-reqopt option] [-set_serial n] [-sigopt nm:v] [-subj arg] [-subject] [-text] [-utf8] [-verbose] [-verify] [-x509] req PKCS#10 . CA . : -addext ext ( -x509 ) . key=value . . -batch (batch). -config file . -days n . . -x509 . -extensions section, -reqexts section ( -x509) . -in file . -new -newkey . -inform der | pem . -key keyfile . PKCS#8 PEM . -keyform der | pem -key. pem . -keyout file . . -md5 | -sha1 | -sha256 . . . DSA SHA1 . -modulus (modulus) . -multivalue-rdn -subj RDN "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe". -multivalue-rdn UID "123456+CN=John Doe" . -nameopt option, -reqopt option . option . . X509 . -new . . . -key RSA . -newhdr NEW PEM . CA . -newkey arg . : rsa:nbits RSA nbits . nbits . dsa:file DSA file . param:file file . algorithm:file file genpkey -genparam X.509 . file -pkeyopt . -nodes . -noout . -out file . -outform der | pem . -passin arg . -passout arg . -pkeyopt opt:value opt value. -pubkey . -reqopt option -text. option . -certopt x509 . -set_serial n . `0x' . . -sigopt nm:v . . -subj arg . arg /type0=value0/type1=value1/type2=... `\' () . -subject ( -x509 ). -text . -utf8 UTF-8 ASCII. -verbose . -verify . -x509 . CA . ( ) . -set_serial . "req" . : attributes : distinguished_name . challengePassword unstructuredName . openssl CA . default_bits . . -new -newkey . default_keyfile . -keyout . default_md . md5 sha1 sha256 () . . distinguished_name (distinguished name) . . encrypt_key "no" . -nodes . encrypt_rsa_key . input_password | output_password ( ) ( ). -passin -passout . oid_file (OBJECT IDENTIFIER) . . oid_section . `=' . . prompt "no" . distinguished_name attributes . req_extensions . -reqexts . string_mask . : utf8only UTF8String. PKIX RFC 2459 . default PrintableString IA5String T61String BMPString UTF8String. pkix PrintableString IA5String BMPString UTF8String. PKIX RFC 2459 IA5String . nombstr PrintableString IA5String T61String UniversalString. BMPString UTF8String . MASK:number number C OR B_ASN1_* . utf8 "yes" UTF-8 . x509_extensions -x509 . -extensions . distinguished name attribute . -prompt "no" . -prompt "no" : fieldName="prompt" fieldName_default="default field value" fieldName_min= 2 fieldName_max= 4 "fieldName" commonName ( CN). "prompt" . . `.' . fieldName_min fieldName_max : ( countryName PrintableString ). ( organizationName) DN . . fieldName . organizationName "1.organizationName" . (OID) . openssl commonName countryName localityName organizationName organizationalUnitName stateOrProvinceName . emailAddress name surname givenName initials dnQualifier . oid_file oid_section . DirectoryString . RSA openssl rsa [-aes128 | -aes192 | -aes256 | -des | -des3] [-check] [-in file] [-inform der | net | pem | pvk] [-modulus] [-noout] [-out file] [-outform der | net | pem | pvk] [-passin arg] [-passout arg] [-pubin] [-pubout] [-pvk-none | -pvk-strong | -pvk-weak] [-RSAPublicKey_in] [-RSAPublicKey_out] [-text] rsa RSA . . rsa SSLeay : PKCS#8 pkcs8 . : -aes128 | -aes192 | -aes256 | -des | -des3 AES DES Triple DES . . . rsa . PEM . -check RSA. -in file The input file to read from, or standard input if not specified. If the key is encrypted, a pass phrase will be prompted for. -inform der | net | pem | pvk . -noout Do not output the encoded version of the key. -modulus (modulus) . -out file . -outform der | net | pem | pvk . -passin arg . -passout arg . -pubin . -pubout . . -pvk-none | -pvk-strong | -pvk-weak Enable or disable PVK encoding. The default is -pvk-strong. -RSAPublicKey_in, -RSAPublicKey_out -pubin -pubout RSAPublicKey . -text / . RSAUTL openssl rsautl [-asn1parse] [-certin] [-decrypt] [-encrypt] [-hexdump] [-in file] [-inkey file] [-keyform der | pem] [-oaep | -pkcs | -raw | -x931] [-out file] [-passin arg] [-pubin] [-rev] [-sign] [-verify] rsautl RSA . : -asn1parse asn1parse -verify . -certin RSA . -decrypt RSA. -encrypt RSA. -hexdump Hex dump the output data. -in file The input to read from, or standard input if not specified. -inkey file RSA . -keyform der | pem . pem . -oaep | -pkcs | -raw | -x931 : PKCS#1 OAEP PKCS#1 v1.5 () ANSI X9.31. -pkcs -raw . -out file . -passin arg . -pubin RSA . -rev Reverse the order of the input buffer. -sign . RSA . -verify Verify the input data and output the recovered data. S_CLIENT openssl s_client [-4 | -6] [-alpn protocols] [-bugs] [-CAfile file] [-CApath directory] [-cert file] [-certform der | pem] [-check_ss_sig] [-cipher cipherlist] [-connect host[:port]] [-crl_check] [-crl_check_all] [-crlf] [-debug] [-dtls] [-dtls1_2] [-extended_crl] [-groups list] [-host host] [-ign_eof] [-ignore_critical] [-issuer_checks] [-key keyfile] [-keyform der | pem] [-keymatexport label] [-keymatexportlen len] [-legacy_server_connect] [-msg] [-mtu mtu] [-nbio] [-nbio_test] [-no_comp] [-no_ign_eof] [-no_legacy_server_connect] [-no_ticket] [-no_tls1_2] [-no_tls1_3] [-pass arg] [-policy_check] [-port port] [-prexit] [-proxy host:port] [-quiet] [-reconnect] [-servername name] [-serverpref] [-sess_in file] [-sess_out file] [-showcerts] [-starttls protocol] [-state] [-status] [-timeout] [-tls1_2] [-tls1_3] [-tlsextdebug] [-use_srtp profiles] [-verify depth] [-verify_return_error] [-x509_strict] [-xmpphost host] s_client SSL/TLS SSL/TLS . SSL . ( -quiet -ign_eof ) R Q . : -4 IPv4. -6 IPv6. -alpn protocols Application-Layer Protocol Negotiation (ALPN). protocols . -bugs . -CAfile file file . -CApath directory directory . " " -verify . . -cert file . . -certform der | pem . pem . -check_ss_sig, -crl_check, -crl_check_all, -extended_crl, -ignore_critical, -issuer_checks, -policy_check, -x509_strict Set various certificate chain validation options. See the verify command for details. -cipher cipherlist . . ciphers . -connect host[:port] host port . (localhost) . (/) IPv6 . -crlf (Line Feed) CR+LF . -debug (hex dump) . -dtls DTLS. -dtls1_2 . DTLS. -groups list list NID SSL_CTX_set1_groups_list(3) . -host host host . localhost . -ign_eof (EOF) . -key keyfile . . -keyform der | pem The private key format. The default is pem. -keymatexport label (keying material) . -keymatexportlen len len ( ). -legacy_server_connect, -no_legacy_server_connect (RI) . -msg . -mtu mtu MTU . -nbio / (non-blocking I/O). -nbio_test / . -no_ign_eof . -ign_eof -quiet . -no_tls1_2 | -no_tls1_3 TLS1.2 TLS1.3. -no_ticket RFC 4507. -pass arg The private key password source. -port port port . . -prexit . . . URL . . -proxy host:port HTTP host port. -connect . localhost . TLS . -quiet . -ign_eof . -reconnect . -servername name Server Name Indication (SNI) ClientHello name. -showcerts : . -serverpref . -sess_in file TLS . . -sess_out file TLS . -starttls protocol TLS (STARTTLS). protocol . : "ftp " "imap " "sieve " "smtp " "pop3" "xmpp". -state SSL. -status (OCSP stapling). ( ) . -timeout (timeout) / DTLS. -tls1_2 | -tls1_3 TLS1.2 TLS1.3. -tlsextdebug TLS . -use_srtp profiles SRTP . -verify depth depth. . . -verify_return_error . -xmpphost hostname -starttls xmpp "to" stream . -connect . S_SERVER openssl s_server [-accept port] [-alpn protocols] [-bugs] [-CAfile file] [-CApath directory] [-cert file] [-cert2 file] [-certform der | pem] [-cipher cipherlist] [-context id] [-crl_check] [-crl_check_all] [-crlf] [-dcert file] [-dcertform der | pem] [-debug] [-dhparam file] [-dkey file] [-dkeyform der | pem] [-dpass arg] [-dtls] [-dtls1] [-dtls1_2] [-groups list] [-HTTP] [-id_prefix arg] [-key keyfile] [-key2 keyfile] [-keyform der | pem] [-keymatexport label] [-keymatexportlen len] [-msg] [-mtu mtu] [-naccept num] [-named_curve arg] [-nbio] [-nbio_test] [-no_cache] [-no_dhe] [-no_ecdhe] [-no_ticket] [-no_tls1_2] [-no_tls1_3] [-no_tmp_rsa] [-nocert] [-pass arg] [-quiet] [-servername name] [-servername_fatal] [-serverpref] [-state] [-status] [-status_timeout nsec] [-status_url url] [-status_verbose] [-timeout] [-tls1_2] [-tls1_3] [-tlsextdebug] [-use_srtp profiles] [-Verify depth] [-verify depth] [-verify_return_error] [-WWW] [-www] s_server SSL/TLS SSL/TLS . -www -WWW . : P . Q SSL . q SSL . R SSL . r SSL. S . : -accept port TCP port . . -alpn protocols (ALPN). protocols . -bugs . -CAfile file file . CA . -CApath directory directory . " " -verify . . -cert file : . DSS DSS (DSA) . server.pem . -cert2 file servername. -certform der | pem . pem . -cipher cipherlist . . . . See the ciphers command for more information. -context id (context ID) SSL. . -crl_check, -crl_check_all CA . CRL . -crl_check_all CRL CA . -crlf CR+LF. -dcert file, -dkey file -cert -key ( ). RSA DSS RSA DSS . -dcertform der | pem, -dkeyform der | pem, -dpass arg . -debug (hex dump) . -dhparam file DH . (ephemeral) - DH . . s_server . -dtls DTLS. -dtls1_2 . DTLS. -groups list list NID SSL_CTX_set1_groups_list(3) . -HTTP . . https://myhost/page.html ./page.html . HTTP ( HTTP CRLF ). -id_prefix arg SSL/TLS arg. SSL/TLS . -key keyfile . . -key2 keyfile servername. -keyform der | pem The private key format. The default is pem. -keymatexport label (keying material) . -keymatexportlen len len ( ). -msg . -mtu mtu MTU . -naccept num num . -named_curve arg ECDH. -groups . -nbio / (non-blocking I/O). -nbio_test / . -no_cache . -no_dhe (ephemeral) -. -no_ecdhe ECDH. -no_ticket RFC 4507. -no_tls1_2 | -no_tls1_3 TLS1.2 TLS1.3. -no_tmp_rsa RSA. -nocert . ( DH ) . -pass arg The private key password source. -quiet Inhibit printing of session and certificate information. -servername name Server Name Indication (SNI) name. -servername_fatal (fatal alert) servername. (warning alert) . -serverpref . -state SSL. -status (OCSP stapling). -status_timeout nsec OCSP . -status_url url URL . . -status_verbose (OCSP stapling) OCSP . -timeout (timeout) / DTLS. -tls1_2 | -tls1_3 TLS1.2 TLS1.3. -tlsextdebug TLS . -use_srtp profiles SRTP . -verify_return_error . -WWW Emulate a simple web server. Pages are resolved relative to the current directory. For example if the URL https://myhost/page.html is requested, the file ./page.html will be loaded. -www . HTML . -Verify depth, -verify depth depth. -Verify - -verify - . S_TIME openssl s_time [-bugs] [-CAfile file] [-CApath directory] [-cert file] [-cipher cipherlist] [-connect host[:port]] [-key keyfile] [-nbio] [-new] [-no_shutdown] [-reuse] [-time seconds] [-verify depth] [-www page] s_time SSL/TLS SSL/TLS . (payload) . ( ) . : -bugs . -CAfile file file . -CApath directory The directory to use for server certificate verification. This directory must be in "hash format"; see verify for more information. These are also used when building the client certificate chain. -cert file . . -cipher cipherlist Modify the cipher list sent by the client. Although the server determines which cipher suite is used, it should take the first supported cipher in the list sent by the client. See the ciphers command for more information. -connect host[:port] . -key keyfile . . -nbio / (non-blocking I/O). -new . -new -reuse . -no_shutdown "close notify" . -reuse . -new -reuse . -time seconds s_time seconds . . -verify depth depth. . . -www page GET . `/' index.htm[l] . s_time (handshake) SSL (payload) . SESS_ID openssl sess_id [-cert] [-context ID] [-in file] [-inform der | pem] [-noout] [-out file] [-outform der | pem] [-text] sess_id SSL SSL ( master key SSL) . : -cert -text . -context ID ID. . -in file . -inform der | pem . der ASN.1 DER . . pem : DER Base64 . -noout . -out file . -outform der | pem . -text . sess_id : Protocol . Cipher SSL TLS. Session-ID SSL . Session-ID-ctx . Master-Key (master key) SSL. Key-Arg SSL v2 . Start Time UNIX. Timeout . Verify return code . SSL . "" . . SMIME openssl smime [-aes128 | -aes192 | -aes256 | -des | -des3 | -rc2-40 | -rc2-64 | -rc2-128] [-binary] [-CAfile file] [-CApath directory] [-certfile file] [-check_ss_sig] [-content file] [-crl_check] [-crl_check_all] [-decrypt] [-encrypt] [-extended_crl] [-from addr] [-ignore_critical] [-in file] [-indef] [-inform der | pem | smime] [-inkey file] [-issuer_checks] [-keyform der | pem] [-md digest] [-noattr] [-nocerts] [-nochain] [-nodetach] [-noindef] [-nointern] [-nosigs] [-nosmimecap] [-noverify] [-out file] [-outform der | pem | smime] [-passin arg] [-pk7out] [-policy_check] [-recip file] [-resign] [-sign] [-signer file] [-stream] [-subject s] [-text] [-to addr] [-verify] [-x509_strict] [cert.pem ...] smime S/MIME . S/MIME . MIME . . MTA . MIME S/MIME ( ). -text . " " . . : -decrypt . MIME . . -encrypt . . MIME . -pk7out PKCS#7 PEM . -resign : . -sign . . MIME . -verify . . . : -aes128 | -aes192 | -aes256 | -des | -des3 | -rc2-40 | -rc2-64 | -rc2-128 . AES DES ( ) Triple DES ( ) RC2 AES . -encrypt . -binary " (canonical)" CR/LF S/MIME . . MIME . -CAfile file file CA -verify . -CApath directory directory CA -verify . : ( x509 -hash) . cert.pem ... : . -certfile file . . . PEM . -check_ss_sig, -crl_check, -crl_check_all, -extended_crl, -ignore_critical, -issuer_checks, -policy_check, -x509_strict . verify . -content file . -verify PKCS#7 . S/MIME MIME multipart/signed . -from addr, -subject s, -to addr . . S/MIME From: . -in file . -indef / . . S/MIME SMIME . -inform der | pem | smime . -inkey file . -recip -signer . . -keyform der | pem . pem . -md digest . ( SHA1). -noattr . -nocerts . ( -certfile ). -nochain : CA . -nodetach (opaque) : S/MIME . MIME multipart/signed . -noindef / ( ). -nointern -certfile . CA . -nosigs . -nosmimecap . -noverify . -out file . -outform der | pem | smime . smime S/MIME . pem der PKCS#7 PEM DER . PKCS#7 PKCS#7 ( -verify -decrypt) . -passin arg . -recip file . . -signer file . . -stream -indef. -text MIME (text/plain) . : MIME text/plain . smime : 0 . 1 . 2 . 3 . 4 . 5 . SPEED openssl speed [algorithm] [-decrypt] [-elapsed] [-evp algorithm] [-mr] [-multi number] [-unaligned number] speed . algorithm algorithm. . -decrypt -evp . -elapsed (real time) (CPU time). -evp algorithm EVP_get_cipherbyname(3). -mr (machine-readable). -multi number number . -unaligned number number malloc(3). number . TS openssl ts -query [-md4 | -md5 | -ripemd160 | -sha1] [-cert] [-config configfile] [-data file_to_hash] [-digest digest_bytes] [-in request.tsq] [-no_nonce] [-out request.tsq] [-policy object_id] [-text] openssl ts -reply [-chain certs_file.pem] [-config configfile] [-in response.tsr] [-inkey private.pem] [-out response.tsr] [-passin arg] [-policy object_id] [-queryfile request.tsq] [-section tsa_section] [-signer tsa_cert.pem] [-text] [-token_in] [-token_out] openssl ts -verify [-CAfile trusted_certs.pem] [-CApath trusted_cert_path] [-data file_to_hash] [-digest digest_bytes] [-in response.tsr] [-queryfile request.tsq] [-token_in] [-untrusted cert_file.pem] ts Time Stamping Authority (TSA) RFC 3161 ( TSP) . TSA (PKI) . : 1. TSA TSA . 2. TSA . TSA . 3. TSA . TSA . (PDU) DER TSA . ts : . / HTTP TCP RFC 3161 . FTP . -query : -cert TSA . -config configfile . OID . -data file_to_hash . . -digest digest_bytes (imprint) . . . -in request.tsq DER . . -md4 | -md5 | -ripemd160 | -sha | -sha1 . dgst . SHA1 . -no_nonce (nonce) . () (replay attacks) . -out request.tsq . -policy object_id (policy) TSA . OID OID . TSA . -text DER. (TimeStampResp) (ContentInfo) . -reply / . -token_out (TimeStampResp) (ContentInfo) . -chain certs_file.pem PEM -cert . . -reply . -config configfile . -in response.tsr ( -token_in ) DER . . " (granted)" . -inkey private.pem TSA PEM. signer_key . -out response.tsr . ( -text -token_out ). . -passin arg . -policy object_id . OID OID . TSA . -queryfile request.tsq DER. -section tsa_section . -signer tsa_cert.pem PEM TSA. TSA : timeStamping. (critical) . signer_cert . -text DER. -token_in DER (ContentInfo) (TimeStampResp). -token_out (ContentInfo) (TimeStampResp). -verify . -verify . -CAfile trusted_certs.pem PEM CA. verify . -CApath . -CApath trusted_cert_path CA . verify . -CAfile . -data file_to_hash file_to_hash . . -digest -queryfile . -digest digest_bytes . . -data -queryfile . -in response.tsr DER. . -queryfile request.tsq DER. -data -digest . -token_in DER (ContentInfo) (TimeStampResp). -untrusted cert_file.pem PEM TSA . TSA CA . : tsa section, default_tsa -reply . -section . oid_file ca . oid_section ca . serial . . . . signer_cert TSA PEM. -signer. certs PEM . -chain. signer_key TSA PEM. -inkey. default_policy . -policy. other_policies TSA . digests TSA . . . accuracy TSA . secs:1, millisecs:500, microsecs:100. . clock_precision_digits . . . ordering yes TSA . no . tsa_name TSA TSA yes . no . ess_cert_id_chain SignedData TSA (RFC 2634 ). yes certs -chain SigningCertificate . no . no . VERIFY openssl verify [-CAfile file] [-CApath directory] [-check_ss_sig] [-CRLfile file] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-help] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-issuer_checks] [-legacy_verify] [-policy_check] [-purpose purpose] [-trusted file] [-untrusted file] [-verbose] [-x509_strict] [certificates] verify . : -CAfile file file . file PEM . -CApath directory directory . hash.0 hash ( -hash x509 ). -check_ss_sig CA . . -CRLfile file file CRL PEM . -crl_check CRL . CRL . -crl_check_all CRL . -explicit_policy require- explicit-policy ( RFC 3280). -extended_crl CRL CRL CRL. -help . -ignore_critical . -inhibit_any inhibit-any- policy ( RFC 3280). -inhibit_map inhibit- policy-mapping ( RFC 3280). -issuer_checks . : . -legacy_verify X.509. -policy_check . -purpose purpose . . : sslclient sslserver nssslserver smimesign smimeencrypt crlsign any ocsphelper. -trusted file file . file . -untrusted file file . file . -verbose . -x509_strict X.509 . certificates certificates PEM . . . verify SSL S/MIME : . . . CA . . . CA . . (authority key identifier) ( ) ( ) keyUsage ( ) . . (Root CA) : . . -purpose . " (leaf)" CA . X509 . CA . CA . . . notBefore notAfter . . . . . : server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024-bit) error 24 at 1 depth lookup:invalid CA certificate . X509_V_ERR_* X509_STORE_CTX_get_error(3) . (depth) CA . (VERSION) openssl version [-abdfpv] version openssl . : -a : . -b openssl . -d OPENSSLDIR. -f . -p . -v openssl. X509 openssl x509 [-addreject arg] [-addtrust arg] [-alias] [-CA file] [-CAcreateserial] [-CAform der | pem] [-CAkey file] [-CAkeyform der | pem] [-CAserial file] [-certopt option] [-checkend arg] [-clrext] [-clrreject] [-clrtrust] [-dates] [-days arg] [-email] [-enddate] [-extensions section] [-extfile file] [-fingerprint] [-force_pubkey key] [-hash] [-in file] [-inform der | net | pem] [-issuer] [-issuer_hash] [-issuer_hash_old] [-keyform der | pem] [-md5 | -sha1] [-modulus] [-multivalue-rdn] [-nameopt option] [-new] [-next_serial] [-noout] [-ocsp_uri] [-ocspid] [-out file] [-outform der | net | pem] [-passin arg] [-pubkey] [-purpose] [-req] [-serial] [-set_issuer name] [-set_serial n] [-set_subject name] [-setalias arg] [-signkey file] [-sigopt nm:v] [-startdate] [-subject] [-subject_hash] [-subject_hash_old] [-text] [-trustout] [-utf8] [-x509toreq] x509 . "CA " . x509 : -in file . -new . -inform der | net | pem . X.509 -in -req . -md5 | -sha1 . -fingerprint - -signkey -CA. MD5 . DSA SHA1 . -out file . -outform der | net | pem . -passin arg . x509 : -certopt option -text - -certopt. . : ca_default no_issuer no_pubkey no_header no_version no_sigdump no_signame. compatible . ext_default . ext_dump . ext_error . ext_parse ASN.1 . no_aux . no_extensions X509V3. no_header (Certificate Data). no_issuer . no_pubkey . no_serial . no_sigdump . no_signame . no_subject (subject). no_validity notBefore notAfter. no_version . -dates . -email . -enddate notAfter. -fingerprint (digest) DER . -hash -subject_hash. -issuer (issuer). -issuer_hash . -issuer_hash_old openssl 1.0.0 . -modulus (modulus) . -multivalue-rdn -subj RDN "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe". -multivalue-rdn UID "123456+CN=John Doe" . -nameopt option -nameopt. compat . : align . sep_multiline . compat . dn_rev DN RFC 2253. AVA . dump_all . dump_der DER . dump_der DER . . RFC 2253 #XXXX... . dump_nostr ( OCTET STRING) . dump_unknown OID openssl . esc_2253 "" RFC 2253 " ,+"<>;". `#' . esc_ctrl 0x20 () (0x7f). RFC 2253 \XX ( XX ). esc_msb (MSB) . multiline . esc_ctrl esc_msb sep_multiline space_eq lname align. no_type . . . nofname, sname, lname, oid : nofname sname ( CN commonName ) lname . oid OID . oneline RFC2253 . esc_2253 esc_ctrl esc_msb utf8 dump_nostr dump_der use_quote sep_comma_plus_space space_eq sname. RFC2253 RFC 2253. esc_2253 esc_ctrl esc_msb utf8 dump_nostr dump_unknown dump_der sep_comma_plus dn_rev sname. sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline : RDN AVA ( AVA ). "space" . sep_multiline RDN `+' AVA . sep_comma_plus_space . show_type ASN.1. . "BMPSTRING: Hello World". space_eq `=' . use_quote `"'. `\' . utf8 UTF8 RFC 2253. UTF8 ( esc_msb) . 0xff \UXXXX \WXXXXXXXX UTF8String . -next_serial . -noout . -ocsp_uri OCSP . -ocspid OCSP . -pubkey . -serial . -sigopt nm:v . . -startdate notBefore. -subject (subject). -subject_hash . openssl . -subject_hash_old openssl 1.0.0 . -text . . . (root CA) . x509 : -addreject arg . -addtrust . -addtrust arg . clientAuth ( SSL) serverAuth ( SSL) emailProtection ( S/MIME) . -alias . -clrreject . -clrtrust . -purpose . . CA basicConstraints CA . CA true CA CA false CA . CA CA true . basicConstraints CA . CA . CA . V1 ( ) CA . Verisign V1 . keyUsage . keyUsage CA keyCertSign . (extended key usage) . . . basicConstraints keyUsage V1 CA . SSL Client extended key usage OID . keyUsage digitalSignature . Netscape SSL client . SSL Client CA extended key usage OID . Netscape SSL CA : basicConstraints . SSL Server extended key usage / OID SGC . keyUsage digitalSignature keyEncipherment . Netscape SSL server . SSL Server CA extended key usage / OID SGC . Netscape SSL CA : basicConstraints . Netscape SSL Server Netscape SSL SSL keyUsage keyEncipherment . . SSL . Common S/MIME Client Tests extended key usage OID . Netscape S/MIME . S/MIME Netscape SSL client : Verisign S/MIME . S/MIME Signing S/MIME keyUsage digitalSignature . S/MIME Encryption S/MIME keyUsage keyEncipherment . S/MIME CA extended key usage OID . Netscape S/MIME CA : basicConstraints . CRL Signing keyUsage CRL . CRL Signing CA CA basicConstraints . -setalias arg "Steve's Certificate" . -trustout ( ). . x509 : CA . x509 : -CA file CA . x509 CA . CA CA CA . -req . -req - . -CAcreateserial CA . `02' `1' . -CAform der | pem CA. pem . -CAkey file CA . CA CA . -CAkeyform der | pem CA. pem . -CAserial file file . . . CA .srl . CA mycacert.pem mycacert.srl . -checkend arg arg . 1 0 . -clrext . ( -signkey -CA -). . -days arg . . -extensions section . () "extensions" . -extfile file . . -force_pubkey key key. -keyform der | pem -force_pubkey -signkey. -new -set_subject -signkey. -force_pubkey . -in -req . -req . -new . -set_issuer name . name /type0=value0/type1=value1/type2=... `\' () . -set_serial n . -signkey -CA . -CA ( -CAserial -CAcreateserial ) . ( `0x') . . -set_subject name . name /type0=value0/type1=value1/type2=... `\' () . -signkey file file . ( ) . -days . -clrext . . -utf8 UTF-8. ASCII . -x509toreq . -signkey . (COMMON NOTATION) . -passin -passout . . : (echo) . pass:password password . . env:var var. . file:path path . path -passin -passout . path : (named pipe) . fd:number (file descriptor) number. . stdin . / -inform -outform . . der (DER) . net . pem (PEM) base64 . pvk (Private Key). smime SMIME. txt (ASCII). (ENVIRONMENT) openssl : OPENSSL_CONF . (FILES) /etc/ssl/ openssl. /etc/ssl/lib/ . /etc/ssl/private/ . /etc/ssl/openssl.cnf openssl. /etc/ssl/x509v3.cnf x509. (SEE ALSO) acme-client(1), nc(1), openssl.cnf(5), x509v3.cnf(5), ssl(8), starttls(8) (STANDARDS) T. Dierks and C. Allen, The TLS Protocol Version 1.0, RFC 2246, January 1999. M. Wahl, S. Killie, and T. Howes, Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names, RFC 2253, December 1997. B. Kaliski, PKCS #7: Cryptographic Message Syntax Version 1.5, RFC 2315, March 1998. R. Housley, W. Ford, W. Polk, and D. Solo, Internet X.509 Public Key Infrastructure Certificate and CRL Profile, RFC 2459, January 1999. M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP, RFC 2560, June 1999. R. Housley, Cryptographic Message Syntax, RFC 2630, June 1999. P. Chown, Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS), RFC 3268, June 2002. Linux 6.12.107+deb13-amd64 March 14, 2026 Linux 6.12.107+deb13-amd64