| 1 | =pod
|
|---|
| 2 |
|
|---|
| 3 | =head1 NAME
|
|---|
| 4 |
|
|---|
| 5 | openssl-format-options - OpenSSL command input and output format options
|
|---|
| 6 |
|
|---|
| 7 | =head1 SYNOPSIS
|
|---|
| 8 |
|
|---|
| 9 | B<openssl>
|
|---|
| 10 | I<command>
|
|---|
| 11 | [ I<options> ... ]
|
|---|
| 12 | [ I<parameters> ... ]
|
|---|
| 13 |
|
|---|
| 14 | =head1 DESCRIPTION
|
|---|
| 15 |
|
|---|
| 16 | Several OpenSSL commands can take input or generate output in a variety
|
|---|
| 17 | of formats.
|
|---|
| 18 |
|
|---|
| 19 | Since OpenSSL 3.0 keys, single certificates, and CRLs can be read from
|
|---|
| 20 | files in any of the B<DER>, B<PEM> or B<P12> formats. Specifying their input
|
|---|
| 21 | format is no more needed and the openssl commands will automatically try all
|
|---|
| 22 | the possible formats. However if the B<DER> or B<PEM> input format is specified
|
|---|
| 23 | it will be enforced.
|
|---|
| 24 |
|
|---|
| 25 | In order to access a key via an engine the input format B<ENGINE> may be used;
|
|---|
| 26 | alternatively the key identifier in the <uri> argument of the respective key
|
|---|
| 27 | option may be preceded by C<org.openssl.engine:>.
|
|---|
| 28 | See L<openssl(1)/Engine Options> for an example usage of the latter.
|
|---|
| 29 |
|
|---|
| 30 | =head1 OPTIONS
|
|---|
| 31 |
|
|---|
| 32 | =head2 Format Options
|
|---|
| 33 |
|
|---|
| 34 | The options to specify the format are as follows.
|
|---|
| 35 | Refer to the individual man page to see which options are accepted.
|
|---|
| 36 |
|
|---|
| 37 | =over 4
|
|---|
| 38 |
|
|---|
| 39 | =item B<-inform> I<format>, B<-outform> I<format>
|
|---|
| 40 |
|
|---|
| 41 | The format of the input or output streams.
|
|---|
| 42 |
|
|---|
| 43 | =item B<-keyform> I<format>
|
|---|
| 44 |
|
|---|
| 45 | Format of a private key input source.
|
|---|
| 46 |
|
|---|
| 47 | =item B<-CRLform> I<format>
|
|---|
| 48 |
|
|---|
| 49 | Format of a CRL input source.
|
|---|
| 50 |
|
|---|
| 51 | =back
|
|---|
| 52 |
|
|---|
| 53 | =head2 Format Option Arguments
|
|---|
| 54 |
|
|---|
| 55 | The possible format arguments are described below.
|
|---|
| 56 | Both uppercase and lowercase are accepted.
|
|---|
| 57 |
|
|---|
| 58 | The list of acceptable format arguments, and the default,
|
|---|
| 59 | is described in each command documentation.
|
|---|
| 60 |
|
|---|
| 61 | =over 4
|
|---|
| 62 |
|
|---|
| 63 | =item B<DER>
|
|---|
| 64 |
|
|---|
| 65 | A binary format, encoded or parsed according to Distinguished Encoding Rules
|
|---|
| 66 | (DER) of the ASN.1 data language.
|
|---|
| 67 |
|
|---|
| 68 | =item B<ENGINE>
|
|---|
| 69 |
|
|---|
| 70 | Used to specify that the cryptographic material is in an OpenSSL B<engine>.
|
|---|
| 71 | An engine must be configured or specified using the B<-engine> option.
|
|---|
| 72 | A password or PIN may be supplied to the engine using the B<-passin> option.
|
|---|
| 73 |
|
|---|
| 74 | =item B<P12>
|
|---|
| 75 |
|
|---|
| 76 | A DER-encoded file containing a PKCS#12 object.
|
|---|
| 77 | It might be necessary to provide a decryption password to retrieve
|
|---|
| 78 | the private key.
|
|---|
| 79 |
|
|---|
| 80 | =item B<PEM>
|
|---|
| 81 |
|
|---|
| 82 | A text format defined in IETF RFC 1421 and IETF RFC 7468. Briefly, this is
|
|---|
| 83 | a block of base-64 encoding (defined in IETF RFC 4648), with specific
|
|---|
| 84 | lines used to mark the start and end:
|
|---|
| 85 |
|
|---|
| 86 | Text before the BEGIN line is ignored.
|
|---|
| 87 | ----- BEGIN object-type -----
|
|---|
| 88 | OT43gQKBgQC/2OHZoko6iRlNOAQ/tMVFNq7fL81GivoQ9F1U0Qr+DH3ZfaH8eIkX
|
|---|
| 89 | xT0ToMPJUzWAn8pZv0snA0um6SIgvkCuxO84OkANCVbttzXImIsL7pFzfcwV/ERK
|
|---|
| 90 | UM6j0ZuSMFOCr/lGPAoOQU0fskidGEHi1/kW+suSr28TqsyYZpwBDQ==
|
|---|
| 91 | ----- END object-type -----
|
|---|
| 92 | Text after the END line is also ignored
|
|---|
| 93 |
|
|---|
| 94 | The I<object-type> must match the type of object that is expected.
|
|---|
| 95 | For example a C<BEGIN X509 CERTIFICATE> will not match if the command
|
|---|
| 96 | is trying to read a private key. The types supported include:
|
|---|
| 97 |
|
|---|
| 98 | ANY PRIVATE KEY
|
|---|
| 99 | CERTIFICATE
|
|---|
| 100 | CERTIFICATE REQUEST
|
|---|
| 101 | CMS
|
|---|
| 102 | DH PARAMETERS
|
|---|
| 103 | DSA PARAMETERS
|
|---|
| 104 | DSA PUBLIC KEY
|
|---|
| 105 | EC PARAMETERS
|
|---|
| 106 | EC PRIVATE KEY
|
|---|
| 107 | ECDSA PUBLIC KEY
|
|---|
| 108 | ENCRYPTED PRIVATE KEY
|
|---|
| 109 | PARAMETERS
|
|---|
| 110 | PKCS #7 SIGNED DATA
|
|---|
| 111 | PKCS7
|
|---|
| 112 | PRIVATE KEY
|
|---|
| 113 | PUBLIC KEY
|
|---|
| 114 | RSA PRIVATE KEY
|
|---|
| 115 | SSL SESSION PARAMETERS
|
|---|
| 116 | TRUSTED CERTIFICATE
|
|---|
| 117 | X509 CRL
|
|---|
| 118 | X9.42 DH PARAMETERS
|
|---|
| 119 |
|
|---|
| 120 | The following legacy I<object-type>'s are also supported for compatibility
|
|---|
| 121 | with earlier releases:
|
|---|
| 122 |
|
|---|
| 123 | DSA PRIVATE KEY
|
|---|
| 124 | NEW CERTIFICATE REQUEST
|
|---|
| 125 | RSA PUBLIC KEY
|
|---|
| 126 | X509 CERTIFICATE
|
|---|
| 127 |
|
|---|
| 128 | =item B<SMIME>
|
|---|
| 129 |
|
|---|
| 130 | An S/MIME object as described in IETF RFC 8551.
|
|---|
| 131 | Earlier versions were known as CMS and are compatible.
|
|---|
| 132 | Note that the parsing is simple and might fail to parse some legal data.
|
|---|
| 133 |
|
|---|
| 134 | =back
|
|---|
| 135 |
|
|---|
| 136 | =head1 COPYRIGHT
|
|---|
| 137 |
|
|---|
| 138 | Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 139 |
|
|---|
| 140 | Licensed under the Apache License 2.0 (the "License"). You may not use
|
|---|
| 141 | this file except in compliance with the License. You can obtain a copy
|
|---|
| 142 | in the file LICENSE in the source distribution or at
|
|---|
| 143 | L<https://www.openssl.org/source/license.html>.
|
|---|
| 144 |
|
|---|
| 145 | =cut
|
|---|
