File: /home/boxelikax/public_html/demoltec.com/doc.zip
PK )]�y���% �% openssl/html/man1/s_time.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>s_time</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-s_time, s_time - SSL/TLS performance timing program</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>s_time</b> [<b>-help</b>] [<b>-connect host:port</b>] [<b>-www page</b>] [<b>-cert filename</b>] [<b>-key filename</b>] [<b>-CApath directory</b>] [<b>-CAfile filename</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-reuse</b>] [<b>-new</b>] [<b>-verify depth</b>] [<b>-nameopt option</b>] [<b>-time seconds</b>] [<b>-ssl3</b>] [<b>-bugs</b>] [<b>-cipher cipherlist</b>] [<b>-ciphersuites val</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>s_time</b> command implements a generic SSL/TLS client which connects to a remote host using SSL/TLS. It can request a page from the server and includes the time to transfer the payload data in its timing measurements. It measures the number of connections within a given timeframe, the amount of data transferred (if any), and calculates the average time spent for one connection.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="connect-host:port"><b>-connect host:port</b></dt>
<dd>
<p>This specifies the host and optional port to connect to.</p>
</dd>
<dt id="www-page"><b>-www page</b></dt>
<dd>
<p>This specifies the page to GET from the server. A value of '/' gets the index.htm[l] page. If this parameter is not specified, then <b>s_time</b> will only perform the handshake to establish SSL connections but not transfer any payload data.</p>
</dd>
<dt id="cert-certname"><b>-cert certname</b></dt>
<dd>
<p>The certificate to use, if one is requested by the server. The default is not to use a certificate. The file is in PEM format.</p>
</dd>
<dt id="key-keyfile"><b>-key keyfile</b></dt>
<dd>
<p>The private key to use. If not specified then the certificate file will be used. The file is in PEM format.</p>
</dd>
<dt id="verify-depth"><b>-verify depth</b></dt>
<dd>
<p>The verify depth to use. This specifies the maximum length of the server certificate chain and turns on server certificate verification. Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure.</p>
</dd>
<dt id="nameopt-option"><b>-nameopt option</b></dt>
<dd>
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
</dd>
<dt id="CApath-directory"><b>-CApath directory</b></dt>
<dd>
<p>The directory to use for server certificate verification. This directory must be in "hash format", see <b>verify</b> for more information. These are also used when building the client certificate chain.</p>
</dd>
<dt id="CAfile-file"><b>-CAfile file</b></dt>
<dd>
<p>A file containing trusted certificates to use during server authentication and to use when attempting to build the client certificate chain.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location</p>
</dd>
<dt id="new"><b>-new</b></dt>
<dd>
<p>Performs the timing test using a new session ID for each connection. If neither <b>-new</b> nor <b>-reuse</b> are specified, they are both on by default and executed in sequence.</p>
</dd>
<dt id="reuse"><b>-reuse</b></dt>
<dd>
<p>Performs the timing test using the same session ID; this can be used as a test that session caching is working. If neither <b>-new</b> nor <b>-reuse</b> are specified, they are both on by default and executed in sequence.</p>
</dd>
<dt id="ssl3"><b>-ssl3</b></dt>
<dd>
<p>This option disables the use of SSL version 3. By default the initial handshake uses a method which should be compatible with all servers and permit them to use SSL v3 or TLS as appropriate.</p>
<p>The timing program is not as rich in options to turn protocols on and off as the <a href="../man1/s_client.html">s_client(1)</a> program and may not connect to all servers. Unfortunately there are a lot of ancient and broken servers in use which cannot handle this technique and will fail to connect. Some servers only work if TLS is turned off with the <b>-ssl3</b> option.</p>
<p>Note that this option may not be available, depending on how OpenSSL was built.</p>
</dd>
<dt id="bugs"><b>-bugs</b></dt>
<dd>
<p>There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.</p>
</dd>
<dt id="cipher-cipherlist"><b>-cipher cipherlist</b></dt>
<dd>
<p>This allows the TLSv1.2 and below cipher list sent by the client to be modified. This list will be combined with any TLSv1.3 ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See <a href="../man1/ciphers.html">ciphers(1)</a> for more information.</p>
</dd>
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
<dd>
<p>This allows the TLSv1.3 ciphersuites sent by the client to be modified. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See <a href="../man1/ciphers.html">ciphers(1)</a> for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.</p>
</dd>
<dt id="time-length"><b>-time length</b></dt>
<dd>
<p>Specifies how long (in seconds) <b>s_time</b> should establish connections and optionally transfer payload data from a server. Server and client performance and the link speed determine how many connections <b>s_time</b> can establish.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p><b>s_time</b> can be used to measure the performance of an SSL connection. To connect to an SSL HTTP server and get the default page the command</p>
<pre><code>openssl s_time -connect servername:443 -www / -CApath yourdir -CAfile yourfile.pem -cipher commoncipher [-ssl3]</code></pre>
<p>would typically be used (https uses port 443). 'commoncipher' is a cipher to which both client and server can agree, see the <a href="../man1/ciphers.html">ciphers(1)</a> command for details.</p>
<p>If the handshake fails then there are several possible causes, if it is nothing obvious like no client certificate then the <b>-bugs</b> and <b>-ssl3</b> options can be tried in case it is a buggy server. In particular you should play with these options <b>before</b> submitting a bug report to an OpenSSL mailing list.</p>
<p>A frequent problem when attempting to get client certificates working is that a web client complains it has no certificates or gives an empty list to choose from. This is normally because the server is not sending the clients certificate authority in its "acceptable CA list" when it requests a certificate. By using <a href="../man1/s_client.html">s_client(1)</a> the CA list can be viewed and checked. However, some servers only request client authentication after a specific URL is requested. To obtain the list in this case it is necessary to use the <b>-prexit</b> option of <a href="../man1/s_client.html">s_client(1)</a> and send an HTTP request for an appropriate page.</p>
<p>If a certificate is specified on the command line using the <b>-cert</b> option it will not be used unless the server specifically requests a client certificate. Therefore, merely including a client certificate on the command line is no guarantee that the certificate works.</p>
<h1 id="BUGS">BUGS</h1>
<p>Because this program does not have all the options of the <a href="../man1/s_client.html">s_client(1)</a> program to turn protocols on and off, you may not be able to measure the performance of all protocols with all servers.</p>
<p>The <b>-verify</b> option should really exit if the server verification fails.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]+V�y openssl/html/man1/gendsa.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>gendsa</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-gendsa, gendsa - generate a DSA private key from a set of parameters</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>gendsa</b> [<b>-help</b>] [<b>-out filename</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>paramfile</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>gendsa</b> command generates a DSA private key from a DSA parameter file (which will be typically generated by the <b>openssl dsaparam</b> command).</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Output the key to the specified file. If this argument is not specified then standard output is used.</p>
</dd>
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
<dd>
<p>These options encrypt the private key with specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified no encryption is used.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>gendsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="paramfile"><b>paramfile</b></dt>
<dd>
<p>This option specifies the DSA parameter file to use. The parameters in this file determine the size of the private key. DSA parameters can be generated and examined using the <b>openssl dsaparam</b> command.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>DSA key generation is little more than random number generation so it is much quicker that RSA key generation for example.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/dsaparam.html">dsaparam(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )])��� �� openssl/html/man1/s_server.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>s_server</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#CONNECTED-COMMANDS">CONNECTED COMMANDS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-s_server, s_server - SSL/TLS server program</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>s_server</b> [<b>-help</b>] [<b>-port +int</b>] [<b>-accept val</b>] [<b>-unix val</b>] [<b>-4</b>] [<b>-6</b>] [<b>-unlink</b>] [<b>-context val</b>] [<b>-verify int</b>] [<b>-Verify int</b>] [<b>-cert infile</b>] [<b>-nameopt val</b>] [<b>-naccept +int</b>] [<b>-serverinfo val</b>] [<b>-certform PEM|DER</b>] [<b>-key infile</b>] [<b>-keyform format</b>] [<b>-pass val</b>] [<b>-dcert infile</b>] [<b>-dcertform PEM|DER</b>] [<b>-dkey infile</b>] [<b>-dkeyform PEM|DER</b>] [<b>-dpass val</b>] [<b>-nbio_test</b>] [<b>-crlf</b>] [<b>-debug</b>] [<b>-msg</b>] [<b>-msgfile outfile</b>] [<b>-state</b>] [<b>-CAfile infile</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-nocert</b>] [<b>-quiet</b>] [<b>-no_resume_ephemeral</b>] [<b>-www</b>] [<b>-WWW</b>] [<b>-servername</b>] [<b>-servername_fatal</b>] [<b>-cert2 infile</b>] [<b>-key2 infile</b>] [<b>-tlsextdebug</b>] [<b>-HTTP</b>] [<b>-id_prefix val</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-keymatexport val</b>] [<b>-keymatexportlen +int</b>] [<b>-CRL infile</b>] [<b>-crl_download</b>] [<b>-cert_chain infile</b>] [<b>-dcert_chain infile</b>] [<b>-chainCApath dir</b>] [<b>-verifyCApath dir</b>] [<b>-no_cache</b>] [<b>-ext_cache</b>] [<b>-CRLform PEM|DER</b>] [<b>-verify_return_error</b>] [<b>-verify_quiet</b>] [<b>-build_chain</b>] [<b>-chainCAfile infile</b>] [<b>-verifyCAfile infile</b>] [<b>-ign_eof</b>] [<b>-no_ign_eof</b>] [<b>-status</b>] [<b>-status_verbose</b>] [<b>-status_timeout int</b>] [<b>-status_url val</b>] [<b>-status_file infile</b>] [<b>-trace</b>] [<b>-security_debug</b>] [<b>-security_debug_verbose</b>] [<b>-brief</b>] [<b>-rev</b>] [<b>-async</b>] [<b>-ssl_config val</b>] [<b>-max_send_frag +int</b>] [<b>-split_send_frag +int</b>] [<b>-max_pipelines +int</b>] [<b>-read_buf +int</b>] [<b>-no_ssl3</b>] [<b>-no_tls1</b>] [<b>-no_tls1_1</b>] [<b>-no_tls1_2</b>] [<b>-no_tls1_3</b>] [<b>-bugs</b>] [<b>-no_comp</b>] [<b>-comp</b>] [<b>-no_ticket</b>] [<b>-num_tickets</b>] [<b>-serverpref</b>] [<b>-legacy_renegotiation</b>] [<b>-no_renegotiation</b>] [<b>-legacy_server_connect</b>] [<b>-no_resumption_on_reneg</b>] [<b>-no_legacy_server_connect</b>] [<b>-allow_no_dhe_kex</b>] [<b>-prioritize_chacha</b>] [<b>-strict</b>] [<b>-sigalgs val</b>] [<b>-client_sigalgs val</b>] [<b>-groups val</b>] [<b>-curves val</b>] [<b>-named_curve val</b>] [<b>-cipher val</b>] [<b>-ciphersuites val</b>] [<b>-dhparam infile</b>] [<b>-record_padding val</b>] [<b>-debug_broken_protocol</b>] [<b>-policy val</b>] [<b>-purpose val</b>] [<b>-verify_name val</b>] [<b>-verify_depth int</b>] [<b>-auth_level int</b>] [<b>-attime intmax</b>] [<b>-verify_hostname val</b>] [<b>-verify_email val</b>] [<b>-verify_ip</b>] [<b>-ignore_critical</b>] [<b>-issuer_checks</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-policy_check</b>] [<b>-explicit_policy</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-x509_strict</b>] [<b>-extended_crl</b>] [<b>-use_deltas</b>] [<b>-policy_print</b>] [<b>-check_ss_sig</b>] [<b>-trusted_first</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_128</b>] [<b>-suiteB_192</b>] [<b>-partial_chain</b>] [<b>-no_alt_chains</b>] [<b>-no_check_time</b>] [<b>-allow_proxy_certs</b>] [<b>-xkey</b>] [<b>-xcert</b>] [<b>-xchain</b>] [<b>-xchain_build</b>] [<b>-xcertform PEM|DER</b>] [<b>-xkeyform PEM|DER</b>] [<b>-nbio</b>] [<b>-psk_identity val</b>] [<b>-psk_hint val</b>] [<b>-psk val</b>] [<b>-psk_session file</b>] [<b>-srpvfile infile</b>] [<b>-srpuserseed val</b>] [<b>-ssl3</b>] [<b>-tls1</b>] [<b>-tls1_1</b>] [<b>-tls1_2</b>] [<b>-tls1_3</b>] [<b>-dtls</b>] [<b>-timeout</b>] [<b>-mtu +int</b>] [<b>-listen</b>] [<b>-dtls1</b>] [<b>-dtls1_2</b>] [<b>-sctp</b>] [<b>-sctp_label_bug</b>] [<b>-no_dhe</b>] [<b>-nextprotoneg val</b>] [<b>-use_srtp val</b>] [<b>-alpn val</b>] [<b>-engine val</b>] [<b>-keylogfile outfile</b>] [<b>-max_early_data int</b>] [<b>-early_data</b>] [<b>-anti_replay</b>] [<b>-no_anti_replay</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>s_server</b> command implements a generic SSL/TLS server which listens for connections on a given port using SSL/TLS.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<p>In addition to the options below the <b>s_server</b> utility also supports the common and server only options documented in the "Supported Command Line Commands" section of the <a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a> manual page.</p>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="port-int"><b>-port +int</b></dt>
<dd>
<p>The TCP port to listen on for connections. If not specified 4433 is used.</p>
</dd>
<dt id="accept-val"><b>-accept val</b></dt>
<dd>
<p>The optional TCP host and port to listen on for connections. If not specified, *:4433 is used.</p>
</dd>
<dt id="unix-val"><b>-unix val</b></dt>
<dd>
<p>Unix domain socket to accept on.</p>
</dd>
<dt id="pod-4"><b>-4</b></dt>
<dd>
<p>Use IPv4 only.</p>
</dd>
<dt id="pod-6"><b>-6</b></dt>
<dd>
<p>Use IPv6 only.</p>
</dd>
<dt id="unlink"><b>-unlink</b></dt>
<dd>
<p>For -unix, unlink any existing socket first.</p>
</dd>
<dt id="context-val"><b>-context val</b></dt>
<dd>
<p>Sets the SSL context id. It can be given any string value. If this option is not present a default value will be used.</p>
</dd>
<dt id="verify-int--Verify-int"><b>-verify int</b>, <b>-Verify int</b></dt>
<dd>
<p>The verify depth to use. This specifies the maximum length of the client certificate chain and makes the server request a certificate from the client. With the <b>-verify</b> option a certificate is requested but the client does not have to send one, with the <b>-Verify</b> option the client must supply a certificate or an error occurs.</p>
<p>If the cipher suite cannot request a client certificate (for example an anonymous cipher suite or PSK) this option has no effect.</p>
</dd>
<dt id="cert-infile"><b>-cert infile</b></dt>
<dd>
<p>The certificate to use, most servers cipher suites require the use of a certificate and some require a certificate with a certain public key type: for example the DSS cipher suites require a certificate containing a DSS (DSA) key. If not specified then the filename "server.pem" will be used.</p>
</dd>
<dt id="cert_chain"><b>-cert_chain</b></dt>
<dd>
<p>A file containing trusted certificates to use when attempting to build the client/server certificate chain related to the certificate specified via the <b>-cert</b> option.</p>
</dd>
<dt id="build_chain"><b>-build_chain</b></dt>
<dd>
<p>Specify whether the application should build the certificate chain to be provided to the client.</p>
</dd>
<dt id="nameopt-val"><b>-nameopt val</b></dt>
<dd>
<p>Option which determines how the subject or issuer names are displayed. The <b>val</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
</dd>
<dt id="naccept-int"><b>-naccept +int</b></dt>
<dd>
<p>The server will exit after receiving the specified number of connections, default unlimited.</p>
</dd>
<dt id="serverinfo-val"><b>-serverinfo val</b></dt>
<dd>
<p>A file containing one or more blocks of PEM data. Each PEM block must encode a TLS ServerHello extension (2 bytes type, 2 bytes length, followed by "length" bytes of extension data). If the client sends an empty TLS ClientHello extension matching the type, the corresponding ServerHello extension will be returned.</p>
</dd>
<dt id="certform-PEM-DER"><b>-certform PEM|DER</b></dt>
<dd>
<p>The certificate format to use: DER or PEM. PEM is the default.</p>
</dd>
<dt id="key-infile"><b>-key infile</b></dt>
<dd>
<p>The private key to use. If not specified then the certificate file will be used.</p>
</dd>
<dt id="keyform-format"><b>-keyform format</b></dt>
<dd>
<p>The private format to use: DER or PEM. PEM is the default.</p>
</dd>
<dt id="pass-val"><b>-pass val</b></dt>
<dd>
<p>The private key password source. For more information about the format of <b>val</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="dcert-infile--dkey-infile"><b>-dcert infile</b>, <b>-dkey infile</b></dt>
<dd>
<p>Specify an additional certificate and private key, these behave in the same manner as the <b>-cert</b> and <b>-key</b> options except there is no default if they are not specified (no additional certificate and key is used). As noted above some cipher suites require a certificate containing a key of a certain type. Some cipher suites need a certificate carrying an RSA key and some a DSS (DSA) key. By using RSA and DSS certificates and keys a server can support clients which only support RSA or DSS cipher suites by using an appropriate certificate.</p>
</dd>
<dt id="dcert_chain"><b>-dcert_chain</b></dt>
<dd>
<p>A file containing trusted certificates to use when attempting to build the server certificate chain when a certificate specified via the <b>-dcert</b> option is in use.</p>
</dd>
<dt id="dcertform-PEM-DER--dkeyform-PEM-DER--dpass-val"><b>-dcertform PEM|DER</b>, <b>-dkeyform PEM|DER</b>, <b>-dpass val</b></dt>
<dd>
<p>Additional certificate and private key format and passphrase respectively.</p>
</dd>
<dt id="xkey-infile--xcert-infile--xchain"><b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b></dt>
<dd>
<p>Specify an extra certificate, private key and certificate chain. These behave in the same manner as the <b>-cert</b>, <b>-key</b> and <b>-cert_chain</b> options. When specified, the callback returning the first valid chain will be in use by the server.</p>
</dd>
<dt id="xchain_build"><b>-xchain_build</b></dt>
<dd>
<p>Specify whether the application should build the certificate chain to be provided to the client for the extra certificates provided via <b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b> options.</p>
</dd>
<dt id="xcertform-PEM-DER--xkeyform-PEM-DER"><b>-xcertform PEM|DER</b>, <b>-xkeyform PEM|DER</b></dt>
<dd>
<p>Extra certificate and private key format respectively.</p>
</dd>
<dt id="nbio_test"><b>-nbio_test</b></dt>
<dd>
<p>Tests non blocking I/O.</p>
</dd>
<dt id="crlf"><b>-crlf</b></dt>
<dd>
<p>This option translated a line feed from the terminal into CR+LF.</p>
</dd>
<dt id="debug"><b>-debug</b></dt>
<dd>
<p>Print extensive debugging information including a hex dump of all traffic.</p>
</dd>
<dt id="msg"><b>-msg</b></dt>
<dd>
<p>Show all protocol messages with hex dump.</p>
</dd>
<dt id="msgfile-outfile"><b>-msgfile outfile</b></dt>
<dd>
<p>File to send output of <b>-msg</b> or <b>-trace</b> to, default standard output.</p>
</dd>
<dt id="state"><b>-state</b></dt>
<dd>
<p>Prints the SSL session states.</p>
</dd>
<dt id="CAfile-infile"><b>-CAfile infile</b></dt>
<dd>
<p>A file containing trusted certificates to use during client authentication and to use when attempting to build the server certificate chain. The list is also used in the list of acceptable client CAs passed to the client when a certificate is requested.</p>
</dd>
<dt id="CApath-dir"><b>-CApath dir</b></dt>
<dd>
<p>The directory to use for client certificate verification. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information. These are also used when building the server certificate chain.</p>
</dd>
<dt id="chainCApath-dir"><b>-chainCApath dir</b></dt>
<dd>
<p>The directory to use for building the chain provided to the client. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information.</p>
</dd>
<dt id="chainCAfile-file"><b>-chainCAfile file</b></dt>
<dd>
<p>A file containing trusted certificates to use when attempting to build the server certificate chain.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location.</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location.</p>
</dd>
<dt id="nocert"><b>-nocert</b></dt>
<dd>
<p>If this option is set then no certificate is used. This restricts the cipher suites available to the anonymous ones (currently just anonymous DH).</p>
</dd>
<dt id="quiet"><b>-quiet</b></dt>
<dd>
<p>Inhibit printing of session and certificate information.</p>
</dd>
<dt id="www"><b>-www</b></dt>
<dd>
<p>Sends a status message back to the client when it connects. This includes information about the ciphers used and various session parameters. The output is in HTML format so this option will normally be used with a web browser. Cannot be used in conjunction with <b>-early_data</b>.</p>
</dd>
<dt id="WWW"><b>-WWW</b></dt>
<dd>
<p>Emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be loaded. Cannot be used in conjunction with <b>-early_data</b>.</p>
</dd>
<dt id="tlsextdebug"><b>-tlsextdebug</b></dt>
<dd>
<p>Print a hex dump of any TLS extensions received from the server.</p>
</dd>
<dt id="HTTP"><b>-HTTP</b></dt>
<dd>
<p>Emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be loaded. The files loaded are assumed to contain a complete and correct HTTP response (lines that are part of the HTTP response line and headers must end with CRLF). Cannot be used in conjunction with <b>-early_data</b>.</p>
</dd>
<dt id="id_prefix-val"><b>-id_prefix val</b></dt>
<dd>
<p>Generate SSL/TLS session IDs prefixed by <b>val</b>. This is mostly useful for testing any SSL/TLS code (e.g. proxies) that wish to deal with multiple servers, when each of which might be generating a unique range of session IDs (e.g. with a certain prefix).</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="verify_return_error"><b>-verify_return_error</b></dt>
<dd>
<p>Verification errors normally just print a message but allow the connection to continue, for debugging purposes. If this option is used, then verification errors close the connection.</p>
</dd>
<dt id="status"><b>-status</b></dt>
<dd>
<p>Enables certificate status request support (aka OCSP stapling).</p>
</dd>
<dt id="status_verbose"><b>-status_verbose</b></dt>
<dd>
<p>Enables certificate status request support (aka OCSP stapling) and gives a verbose printout of the OCSP response.</p>
</dd>
<dt id="status_timeout-int"><b>-status_timeout int</b></dt>
<dd>
<p>Sets the timeout for OCSP response to <b>int</b> seconds.</p>
</dd>
<dt id="status_url-val"><b>-status_url val</b></dt>
<dd>
<p>Sets a fallback responder URL to use if no responder URL is present in the server certificate. Without this option an error is returned if the server certificate does not contain a responder address.</p>
</dd>
<dt id="status_file-infile"><b>-status_file infile</b></dt>
<dd>
<p>Overrides any OCSP responder URLs from the certificate and always provides the OCSP Response stored in the file. The file must be in DER format.</p>
</dd>
<dt id="trace"><b>-trace</b></dt>
<dd>
<p>Show verbose trace output of protocol messages. OpenSSL needs to be compiled with <b>enable-ssl-trace</b> for this option to work.</p>
</dd>
<dt id="brief"><b>-brief</b></dt>
<dd>
<p>Provide a brief summary of connection parameters instead of the normal verbose output.</p>
</dd>
<dt id="rev"><b>-rev</b></dt>
<dd>
<p>Simple test server which just reverses the text received from the client and sends it back to the server. Also sets <b>-brief</b>. Cannot be used in conjunction with <b>-early_data</b>.</p>
</dd>
<dt id="async"><b>-async</b></dt>
<dd>
<p>Switch on asynchronous mode. Cryptographic operations will be performed asynchronously. This will only have an effect if an asynchronous capable engine is also used via the <b>-engine</b> option. For test purposes the dummy async engine (dasync) can be used (if available).</p>
</dd>
<dt id="max_send_frag-int"><b>-max_send_frag +int</b></dt>
<dd>
<p>The maximum size of data fragment to send. See <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a> for further information.</p>
</dd>
<dt id="split_send_frag-int"><b>-split_send_frag +int</b></dt>
<dd>
<p>The size used to split data for encrypt pipelines. If more data is written in one go than this value then it will be split into multiple pipelines, up to the maximum number of pipelines defined by max_pipelines. This only has an effect if a suitable cipher suite has been negotiated, an engine that supports pipelining has been loaded, and max_pipelines is greater than 1. See <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a> for further information.</p>
</dd>
<dt id="max_pipelines-int"><b>-max_pipelines +int</b></dt>
<dd>
<p>The maximum number of encrypt/decrypt pipelines to be used. This will only have an effect if an engine has been loaded that supports pipelining (e.g. the dasync engine) and a suitable cipher suite has been negotiated. The default value is 1. See <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a> for further information.</p>
</dd>
<dt id="read_buf-int"><b>-read_buf +int</b></dt>
<dd>
<p>The default read buffer size to be used for connections. This will only have an effect if the buffer size is larger than the size that would otherwise be used and pipelining is in use (see <a href="../man3/SSL_CTX_set_default_read_buffer_len.html">SSL_CTX_set_default_read_buffer_len(3)</a> for further information).</p>
</dd>
<dt id="ssl2--ssl3--tls1--tls1_1--tls1_2--tls1_3--no_ssl2--no_ssl3--no_tls1--no_tls1_1--no_tls1_2--no_tls1_3"><b>-ssl2</b>, <b>-ssl3</b>, <b>-tls1</b>, <b>-tls1_1</b>, <b>-tls1_2</b>, <b>-tls1_3</b>, <b>-no_ssl2</b>, <b>-no_ssl3</b>, <b>-no_tls1</b>, <b>-no_tls1_1</b>, <b>-no_tls1_2</b>, <b>-no_tls1_3</b></dt>
<dd>
<p>These options require or disable the use of the specified SSL or TLS protocols. By default <b>s_server</b> will negotiate the highest mutually supported protocol version. When a specific TLS version is required, only that version will be accepted from the client. Note that not all protocols and flags may be available, depending on how OpenSSL was built.</p>
</dd>
<dt id="bugs"><b>-bugs</b></dt>
<dd>
<p>There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.</p>
</dd>
<dt id="no_comp"><b>-no_comp</b></dt>
<dd>
<p>Disable negotiation of TLS compression. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
</dd>
<dt id="comp"><b>-comp</b></dt>
<dd>
<p>Enable negotiation of TLS compression. This option was introduced in OpenSSL 1.1.0. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
</dd>
<dt id="no_ticket"><b>-no_ticket</b></dt>
<dd>
<p>Disable RFC4507bis session ticket support. This option has no effect if TLSv1.3 is negotiated. See <b>-num_tickets</b>.</p>
</dd>
<dt id="num_tickets"><b>-num_tickets</b></dt>
<dd>
<p>Control the number of tickets that will be sent to the client after a full handshake in TLSv1.3. The default number of tickets is 2. This option does not affect the number of tickets sent after a resumption handshake.</p>
</dd>
<dt id="serverpref"><b>-serverpref</b></dt>
<dd>
<p>Use the server's cipher preferences, rather than the client's preferences.</p>
</dd>
<dt id="prioritize_chacha"><b>-prioritize_chacha</b></dt>
<dd>
<p>Prioritize ChaCha ciphers when preferred by clients. Requires <b>-serverpref</b>.</p>
</dd>
<dt id="no_resumption_on_reneg"><b>-no_resumption_on_reneg</b></dt>
<dd>
<p>Set the <b>SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION</b> option.</p>
</dd>
<dt id="client_sigalgs-val"><b>-client_sigalgs val</b></dt>
<dd>
<p>Signature algorithms to support for client certificate authentication (colon-separated list).</p>
</dd>
<dt id="named_curve-val"><b>-named_curve val</b></dt>
<dd>
<p>Specifies the elliptic curve to use. NOTE: this is single curve, not a list. For a list of all possible curves, use:</p>
<pre><code>$ openssl ecparam -list_curves</code></pre>
</dd>
<dt id="cipher-val"><b>-cipher val</b></dt>
<dd>
<p>This allows the list of TLSv1.2 and below ciphersuites used by the server to be modified. This list is combined with any TLSv1.3 ciphersuites that have been configured. When the client sends a list of supported ciphers the first client cipher also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist is irrelevant. See the <b>ciphers</b> command for more information.</p>
</dd>
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
<dd>
<p>This allows the list of TLSv1.3 ciphersuites used by the server to be modified. This list is combined with any TLSv1.2 and below ciphersuites that have been configured. When the client sends a list of supported ciphers the first client cipher also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist is irrelevant. See the <b>ciphers</b> command for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.</p>
</dd>
<dt id="dhparam-infile"><b>-dhparam infile</b></dt>
<dd>
<p>The DH parameter file to use. The ephemeral DH cipher suites generate keys using a set of DH parameters. If not specified then an attempt is made to load the parameters from the server certificate file. If this fails then a static set of parameters hard coded into the <b>s_server</b> program will be used.</p>
</dd>
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
<dd>
<p>Set different peer certificate verification options. See the <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
</dd>
<dt id="crl_check--crl_check_all"><b>-crl_check</b>, <b>-crl_check_all</b></dt>
<dd>
<p>Check the peer certificate has not been revoked by its CA. The CRL(s) are appended to the certificate file. With the <b>-crl_check_all</b> option all CRLs of all CAs in the chain are checked.</p>
</dd>
<dt id="nbio"><b>-nbio</b></dt>
<dd>
<p>Turns on non blocking I/O.</p>
</dd>
<dt id="psk_identity-val"><b>-psk_identity val</b></dt>
<dd>
<p>Expect the client to send PSK identity <b>val</b> when using a PSK cipher suite, and warn if they do not. By default, the expected PSK identity is the string "Client_identity".</p>
</dd>
<dt id="psk_hint-val"><b>-psk_hint val</b></dt>
<dd>
<p>Use the PSK identity hint <b>val</b> when using a PSK cipher suite.</p>
</dd>
<dt id="psk-val"><b>-psk val</b></dt>
<dd>
<p>Use the PSK key <b>val</b> when using a PSK cipher suite. The key is given as a hexadecimal number without leading 0x, for example -psk 1a2b3c4d. This option must be provided in order to use a PSK cipher.</p>
</dd>
<dt id="psk_session-file"><b>-psk_session file</b></dt>
<dd>
<p>Use the pem encoded SSL_SESSION data stored in <b>file</b> as the basis of a PSK. Note that this will only work if TLSv1.3 is negotiated.</p>
</dd>
<dt id="listen"><b>-listen</b></dt>
<dd>
<p>This option can only be used in conjunction with one of the DTLS options above. With this option <b>s_server</b> will listen on a UDP port for incoming connections. Any ClientHellos that arrive will be checked to see if they have a cookie in them or not. Any without a cookie will be responded to with a HelloVerifyRequest. If a ClientHello with a cookie is received then <b>s_server</b> will connect to that peer and complete the handshake.</p>
</dd>
<dt id="dtls--dtls1--dtls1_2"><b>-dtls</b>, <b>-dtls1</b>, <b>-dtls1_2</b></dt>
<dd>
<p>These options make <b>s_server</b> use DTLS protocols instead of TLS. With <b>-dtls</b>, <b>s_server</b> will negotiate any supported DTLS protocol version, whilst <b>-dtls1</b> and <b>-dtls1_2</b> will only support DTLSv1.0 and DTLSv1.2 respectively.</p>
</dd>
<dt id="sctp"><b>-sctp</b></dt>
<dd>
<p>Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in conjunction with <b>-dtls</b>, <b>-dtls1</b> or <b>-dtls1_2</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
</dd>
<dt id="sctp_label_bug"><b>-sctp_label_bug</b></dt>
<dd>
<p>Use the incorrect behaviour of older OpenSSL implementations when computing endpoint-pair shared secrets for DTLS/SCTP. This allows communication with older broken implementations but breaks interoperability with correct implementations. Must be used in conjunction with <b>-sctp</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
</dd>
<dt id="no_dhe"><b>-no_dhe</b></dt>
<dd>
<p>If this option is set then no DH parameters will be loaded effectively disabling the ephemeral DH cipher suites.</p>
</dd>
<dt id="alpn-val--nextprotoneg-val"><b>-alpn val</b>, <b>-nextprotoneg val</b></dt>
<dd>
<p>These flags enable the Application-Layer Protocol Negotiation or Next Protocol Negotiation (NPN) extension, respectively. ALPN is the IETF standard and replaces NPN. The <b>val</b> list is a comma-separated list of supported protocol names. The list should contain the most desirable protocols first. Protocol names are printable ASCII strings, for example "http/1.1" or "spdy/3". The flag <b>-nextprotoneg</b> cannot be specified if <b>-tls1_3</b> is used.</p>
</dd>
<dt id="engine-val"><b>-engine val</b></dt>
<dd>
<p>Specifying an engine (by its unique id string in <b>val</b>) will cause <b>s_server</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="keylogfile-outfile"><b>-keylogfile outfile</b></dt>
<dd>
<p>Appends TLS secrets to the specified keylog file such that external programs (like Wireshark) can decrypt TLS connections.</p>
</dd>
<dt id="max_early_data-int"><b>-max_early_data int</b></dt>
<dd>
<p>Change the default maximum early data bytes that are specified for new sessions and any incoming early data (when used in conjunction with the <b>-early_data</b> flag). The default value is approximately 16k. The argument must be an integer greater than or equal to 0.</p>
</dd>
<dt id="early_data"><b>-early_data</b></dt>
<dd>
<p>Accept early data where possible. Cannot be used in conjunction with <b>-www</b>, <b>-WWW</b>, <b>-HTTP</b> or <b>-rev</b>.</p>
</dd>
<dt id="anti_replay--no_anti_replay"><b>-anti_replay</b>, <b>-no_anti_replay</b></dt>
<dd>
<p>Switches replay protection on or off, respectively. Replay protection is on by default unless overridden by a configuration file. When it is on, OpenSSL will automatically detect if a session ticket has been used more than once, TLSv1.3 has been negotiated, and early data is enabled on the server. A full handshake is forced if a session ticket is used a second or subsequent time. Any early data that was sent will be rejected.</p>
</dd>
</dl>
<h1 id="CONNECTED-COMMANDS">CONNECTED COMMANDS</h1>
<p>If a connection request is established with an SSL client and neither the <b>-www</b> nor the <b>-WWW</b> option has been used then normally any data received from the client is displayed and any key presses will be sent to the client.</p>
<p>Certain commands are also recognized which perform special operations. These commands are a letter which must appear at the start of a line. They are listed below.</p>
<dl>
<dt id="q"><b>q</b></dt>
<dd>
<p>End the current SSL connection but still accept new connections.</p>
</dd>
<dt id="Q"><b>Q</b></dt>
<dd>
<p>End the current SSL connection and exit.</p>
</dd>
<dt id="r"><b>r</b></dt>
<dd>
<p>Renegotiate the SSL session (TLSv1.2 and below only).</p>
</dd>
<dt id="R"><b>R</b></dt>
<dd>
<p>Renegotiate the SSL session and request a client certificate (TLSv1.2 and below only).</p>
</dd>
<dt id="P"><b>P</b></dt>
<dd>
<p>Send some plain text down the underlying TCP connection: this should cause the client to disconnect due to a protocol violation.</p>
</dd>
<dt id="S"><b>S</b></dt>
<dd>
<p>Print out some session cache status information.</p>
</dd>
<dt id="B"><b>B</b></dt>
<dd>
<p>Send a heartbeat message to the client (DTLS only)</p>
</dd>
<dt id="k"><b>k</b></dt>
<dd>
<p>Send a key update message to the client (TLSv1.3 only)</p>
</dd>
<dt id="K"><b>K</b></dt>
<dd>
<p>Send a key update message to the client and request one back (TLSv1.3 only)</p>
</dd>
<dt id="c"><b>c</b></dt>
<dd>
<p>Send a certificate request to the client (TLSv1.3 only)</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p><b>s_server</b> can be used to debug SSL clients. To accept connections from a web browser the command:</p>
<pre><code>openssl s_server -accept 443 -www</code></pre>
<p>can be used for example.</p>
<p>Although specifying an empty list of CAs when requesting a client certificate is strictly speaking a protocol violation, some SSL clients interpret this to mean any CA is acceptable. This is useful for debugging purposes.</p>
<p>The session parameters can printed out using the <b>sess_id</b> program.</p>
<h1 id="BUGS">BUGS</h1>
<p>Because this program has a lot of options and also because some of the techniques used are rather old, the C source of <b>s_server</b> is rather hard to read and not a model of how things should be done. A typical SSL server program would be much simpler.</p>
<p>The output of common ciphers is wrong: it just gives the list of ciphers that OpenSSL recognizes and the client supports.</p>
<p>There should be a way for the <b>s_server</b> program to print out details of any unknown cipher suites a client says it supports.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a>, <a href="../man1/sess_id.html">sess_id(1)</a>, <a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a> <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The -no_alt_chains option was added in OpenSSL 1.1.0.</p>
<p>The -allow-no-dhe-kex and -prioritize_chacha options were added in OpenSSL 1.1.1.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]��m� m� openssl/html/man1/ciphers.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>ciphers</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#CIPHER-LIST-FORMAT">CIPHER LIST FORMAT</a></li>
<li><a href="#CIPHER-STRINGS">CIPHER STRINGS</a></li>
<li><a href="#CIPHER-SUITE-NAMES">CIPHER SUITE NAMES</a>
<ul>
<li><a href="#SSL-v3.0-cipher-suites">SSL v3.0 cipher suites</a></li>
<li><a href="#TLS-v1.0-cipher-suites">TLS v1.0 cipher suites</a></li>
<li><a href="#AES-cipher-suites-from-RFC3268-extending-TLS-v1.0">AES cipher suites from RFC3268, extending TLS v1.0</a></li>
<li><a href="#Camellia-cipher-suites-from-RFC4132-extending-TLS-v1.0">Camellia cipher suites from RFC4132, extending TLS v1.0</a></li>
<li><a href="#SEED-cipher-suites-from-RFC4162-extending-TLS-v1.0">SEED cipher suites from RFC4162, extending TLS v1.0</a></li>
<li><a href="#GOST-cipher-suites-from-draft-chudov-cryptopro-cptls-extending-TLS-v1.0">GOST cipher suites from draft-chudov-cryptopro-cptls, extending TLS v1.0</a></li>
<li><a href="#Additional-Export-1024-and-other-cipher-suites">Additional Export 1024 and other cipher suites</a></li>
<li><a href="#Elliptic-curve-cipher-suites">Elliptic curve cipher suites.</a></li>
<li><a href="#TLS-v1.2-cipher-suites">TLS v1.2 cipher suites</a></li>
<li><a href="#ARIA-cipher-suites-from-RFC6209-extending-TLS-v1.2">ARIA cipher suites from RFC6209, extending TLS v1.2</a></li>
<li><a href="#Camellia-HMAC-Based-cipher-suites-from-RFC6367-extending-TLS-v1.2">Camellia HMAC-Based cipher suites from RFC6367, extending TLS v1.2</a></li>
<li><a href="#Pre-shared-keying-PSK-cipher-suites">Pre-shared keying (PSK) cipher suites</a></li>
<li><a href="#ChaCha20-Poly1305-cipher-suites-extending-TLS-v1.2">ChaCha20-Poly1305 cipher suites, extending TLS v1.2</a></li>
<li><a href="#TLS-v1.3-cipher-suites">TLS v1.3 cipher suites</a></li>
<li><a href="#Older-names-used-by-OpenSSL">Older names used by OpenSSL</a></li>
</ul>
</li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-ciphers, ciphers - SSL cipher display and cipher list tool</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>ciphers</b> [<b>-help</b>] [<b>-s</b>] [<b>-v</b>] [<b>-V</b>] [<b>-ssl3</b>] [<b>-tls1</b>] [<b>-tls1_1</b>] [<b>-tls1_2</b>] [<b>-tls1_3</b>] [<b>-s</b>] [<b>-psk</b>] [<b>-srp</b>] [<b>-stdname</b>] [<b>-convert name</b>] [<b>-ciphersuites val</b>] [<b>cipherlist</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>ciphers</b> command converts textual OpenSSL cipher lists into ordered SSL cipher preference lists. It can be used as a test tool to determine the appropriate cipherlist.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print a usage message.</p>
</dd>
<dt id="s"><b>-s</b></dt>
<dd>
<p>Only list supported ciphers: those consistent with the security level, and minimum and maximum protocol version. This is closer to the actual cipher list an application will support.</p>
<p>PSK and SRP ciphers are not enabled by default: they require <b>-psk</b> or <b>-srp</b> to enable them.</p>
<p>It also does not change the default list of supported signature algorithms.</p>
<p>On a server the list of supported ciphers might also exclude other ciphers depending on the configured certificates and presence of DH parameters.</p>
<p>If this option is not used then all ciphers that match the cipherlist will be listed.</p>
</dd>
<dt id="psk"><b>-psk</b></dt>
<dd>
<p>When combined with <b>-s</b> includes cipher suites which require PSK.</p>
</dd>
<dt id="srp"><b>-srp</b></dt>
<dd>
<p>When combined with <b>-s</b> includes cipher suites which require SRP.</p>
</dd>
<dt id="v"><b>-v</b></dt>
<dd>
<p>Verbose output: For each cipher suite, list details as provided by <a href="../man3/SSL_CIPHER_description.html">SSL_CIPHER_description(3)</a>.</p>
</dd>
<dt id="V"><b>-V</b></dt>
<dd>
<p>Like <b>-v</b>, but include the official cipher suite values in hex.</p>
</dd>
<dt id="tls1_3--tls1_2--tls1_1--tls1--ssl3"><b>-tls1_3</b>, <b>-tls1_2</b>, <b>-tls1_1</b>, <b>-tls1</b>, <b>-ssl3</b></dt>
<dd>
<p>In combination with the <b>-s</b> option, list the ciphers which could be used if the specified protocol were negotiated. Note that not all protocols and flags may be available, depending on how OpenSSL was built.</p>
</dd>
<dt id="stdname"><b>-stdname</b></dt>
<dd>
<p>Precede each cipher suite by its standard name.</p>
</dd>
<dt id="convert-name"><b>-convert name</b></dt>
<dd>
<p>Convert a standard cipher <b>name</b> to its OpenSSL name.</p>
</dd>
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
<dd>
<p>Sets the list of TLSv1.3 ciphersuites. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names. By default this value is:</p>
<pre><code>TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256</code></pre>
</dd>
<dt id="cipherlist"><b>cipherlist</b></dt>
<dd>
<p>A cipher list of TLSv1.2 and below ciphersuites to convert to a cipher preference list. This list will be combined with any TLSv1.3 ciphersuites that have been configured. If it is not included then the default cipher list will be used. The format is described below.</p>
</dd>
</dl>
<h1 id="CIPHER-LIST-FORMAT">CIPHER LIST FORMAT</h1>
<p>The cipher list consists of one or more <i>cipher strings</i> separated by colons. Commas or spaces are also acceptable separators but colons are normally used.</p>
<p>The actual cipher string can take several different forms.</p>
<p>It can consist of a single cipher suite such as <b>RC4-SHA</b>.</p>
<p>It can represent a list of cipher suites containing a certain algorithm, or cipher suites of a certain type. For example <b>SHA1</b> represents all ciphers suites using the digest algorithm SHA1 and <b>SSLv3</b> represents all SSL v3 algorithms.</p>
<p>Lists of cipher suites can be combined in a single cipher string using the <b>+</b> character. This is used as a logical <b>and</b> operation. For example <b>SHA1+DES</b> represents all cipher suites containing the SHA1 <b>and</b> the DES algorithms.</p>
<p>Each cipher string can be optionally preceded by the characters <b>!</b>, <b>-</b> or <b>+</b>.</p>
<p>If <b>!</b> is used then the ciphers are permanently deleted from the list. The ciphers deleted can never reappear in the list even if they are explicitly stated.</p>
<p>If <b>-</b> is used then the ciphers are deleted from the list, but some or all of the ciphers can be added again by later options.</p>
<p>If <b>+</b> is used then the ciphers are moved to the end of the list. This option doesn't add any new ciphers it just moves matching existing ones.</p>
<p>If none of these characters is present then the string is just interpreted as a list of ciphers to be appended to the current preference list. If the list includes any ciphers already present they will be ignored: that is they will not moved to the end of the list.</p>
<p>The cipher string <b>@STRENGTH</b> can be used at any point to sort the current cipher list in order of encryption algorithm key length.</p>
<p>The cipher string <b>@SECLEVEL=n</b> can be used at any point to set the security level to <b>n</b>, which should be a number between zero and five, inclusive. See <a href="/../man3/SSL_CTX_set_security_level.html">SSL_CTX_set_security_level</a> for a description of what each level means.</p>
<p>The cipher list can be prefixed with the <b>DEFAULT</b> keyword, which enables the default cipher list as defined below. Unlike cipher strings, this prefix may not be combined with other strings using <b>+</b> character. For example, <b>DEFAULT+DES</b> is not valid.</p>
<p>The content of the default list is determined at compile time and normally corresponds to <b>ALL:!COMPLEMENTOFDEFAULT:!eNULL</b>.</p>
<h1 id="CIPHER-STRINGS">CIPHER STRINGS</h1>
<p>The following is a list of all permitted cipher strings and their meanings.</p>
<dl>
<dt id="COMPLEMENTOFDEFAULT"><b>COMPLEMENTOFDEFAULT</b></dt>
<dd>
<p>The ciphers included in <b>ALL</b>, but not enabled by default. Currently this includes all RC4 and anonymous ciphers. Note that this rule does not cover <b>eNULL</b>, which is not included by <b>ALL</b> (use <b>COMPLEMENTOFALL</b> if necessary). Note that RC4 based cipher suites are not built into OpenSSL by default (see the enable-weak-ssl-ciphers option to Configure).</p>
</dd>
<dt id="ALL"><b>ALL</b></dt>
<dd>
<p>All cipher suites except the <b>eNULL</b> ciphers (which must be explicitly enabled if needed). As of OpenSSL 1.0.0, the <b>ALL</b> cipher suites are sensibly ordered by default.</p>
</dd>
<dt id="COMPLEMENTOFALL"><b>COMPLEMENTOFALL</b></dt>
<dd>
<p>The cipher suites not enabled by <b>ALL</b>, currently <b>eNULL</b>.</p>
</dd>
<dt id="HIGH"><b>HIGH</b></dt>
<dd>
<p>"High" encryption cipher suites. This currently means those with key lengths larger than 128 bits, and some cipher suites with 128-bit keys.</p>
</dd>
<dt id="MEDIUM"><b>MEDIUM</b></dt>
<dd>
<p>"Medium" encryption cipher suites, currently some of those using 128 bit encryption.</p>
</dd>
<dt id="LOW"><b>LOW</b></dt>
<dd>
<p>"Low" encryption cipher suites, currently those using 64 or 56 bit encryption algorithms but excluding export cipher suites. All these cipher suites have been removed as of OpenSSL 1.1.0.</p>
</dd>
<dt id="eNULL-NULL"><b>eNULL</b>, <b>NULL</b></dt>
<dd>
<p>The "NULL" ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are not enabled via either the <b>DEFAULT</b> or <b>ALL</b> cipher strings. Be careful when building cipherlists out of lower-level primitives such as <b>kRSA</b> or <b>aECDSA</b> as these do overlap with the <b>eNULL</b> ciphers. When in doubt, include <b>!eNULL</b> in your cipherlist.</p>
</dd>
<dt id="aNULL"><b>aNULL</b></dt>
<dd>
<p>The cipher suites offering no authentication. This is currently the anonymous DH algorithms and anonymous ECDH algorithms. These cipher suites are vulnerable to "man in the middle" attacks and so their use is discouraged. These are excluded from the <b>DEFAULT</b> ciphers, but included in the <b>ALL</b> ciphers. Be careful when building cipherlists out of lower-level primitives such as <b>kDHE</b> or <b>AES</b> as these do overlap with the <b>aNULL</b> ciphers. When in doubt, include <b>!aNULL</b> in your cipherlist.</p>
</dd>
<dt id="kRSA-aRSA-RSA"><b>kRSA</b>, <b>aRSA</b>, <b>RSA</b></dt>
<dd>
<p>Cipher suites using RSA key exchange or authentication. <b>RSA</b> is an alias for <b>kRSA</b>.</p>
</dd>
<dt id="kDHr-kDHd-kDH"><b>kDHr</b>, <b>kDHd</b>, <b>kDH</b></dt>
<dd>
<p>Cipher suites using static DH key agreement and DH certificates signed by CAs with RSA and DSS keys or either respectively. All these cipher suites have been removed in OpenSSL 1.1.0.</p>
</dd>
<dt id="kDHE-kEDH-DH"><b>kDHE</b>, <b>kEDH</b>, <b>DH</b></dt>
<dd>
<p>Cipher suites using ephemeral DH key agreement, including anonymous cipher suites.</p>
</dd>
<dt id="DHE-EDH"><b>DHE</b>, <b>EDH</b></dt>
<dd>
<p>Cipher suites using authenticated ephemeral DH key agreement.</p>
</dd>
<dt id="ADH"><b>ADH</b></dt>
<dd>
<p>Anonymous DH cipher suites, note that this does not include anonymous Elliptic Curve DH (ECDH) cipher suites.</p>
</dd>
<dt id="kEECDH-kECDHE-ECDH"><b>kEECDH</b>, <b>kECDHE</b>, <b>ECDH</b></dt>
<dd>
<p>Cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites.</p>
</dd>
<dt id="ECDHE-EECDH"><b>ECDHE</b>, <b>EECDH</b></dt>
<dd>
<p>Cipher suites using authenticated ephemeral ECDH key agreement.</p>
</dd>
<dt id="AECDH"><b>AECDH</b></dt>
<dd>
<p>Anonymous Elliptic Curve Diffie-Hellman cipher suites.</p>
</dd>
<dt id="aDSS-DSS"><b>aDSS</b>, <b>DSS</b></dt>
<dd>
<p>Cipher suites using DSS authentication, i.e. the certificates carry DSS keys.</p>
</dd>
<dt id="aDH"><b>aDH</b></dt>
<dd>
<p>Cipher suites effectively using DH authentication, i.e. the certificates carry DH keys. All these cipher suites have been removed in OpenSSL 1.1.0.</p>
</dd>
<dt id="aECDSA-ECDSA"><b>aECDSA</b>, <b>ECDSA</b></dt>
<dd>
<p>Cipher suites using ECDSA authentication, i.e. the certificates carry ECDSA keys.</p>
</dd>
<dt id="TLSv1.2-TLSv1.0-SSLv3"><b>TLSv1.2</b>, <b>TLSv1.0</b>, <b>SSLv3</b></dt>
<dd>
<p>Lists cipher suites which are only supported in at least TLS v1.2, TLS v1.0 or SSL v3.0 respectively. Note: there are no cipher suites specific to TLS v1.1. Since this is only the minimum version, if, for example, TLSv1.0 is negotiated then both TLSv1.0 and SSLv3.0 cipher suites are available.</p>
<p>Note: these cipher strings <b>do not</b> change the negotiated version of SSL or TLS, they only affect the list of available cipher suites.</p>
</dd>
<dt id="AES128-AES256-AES"><b>AES128</b>, <b>AES256</b>, <b>AES</b></dt>
<dd>
<p>cipher suites using 128 bit AES, 256 bit AES or either 128 or 256 bit AES.</p>
</dd>
<dt id="AESGCM"><b>AESGCM</b></dt>
<dd>
<p>AES in Galois Counter Mode (GCM): these cipher suites are only supported in TLS v1.2.</p>
</dd>
<dt id="AESCCM-AESCCM8"><b>AESCCM</b>, <b>AESCCM8</b></dt>
<dd>
<p>AES in Cipher Block Chaining - Message Authentication Mode (CCM): these cipher suites are only supported in TLS v1.2. <b>AESCCM</b> references CCM cipher suites using both 16 and 8 octet Integrity Check Value (ICV) while <b>AESCCM8</b> only references 8 octet ICV.</p>
</dd>
<dt id="ARIA128-ARIA256-ARIA"><b>ARIA128</b>, <b>ARIA256</b>, <b>ARIA</b></dt>
<dd>
<p>Cipher suites using 128 bit ARIA, 256 bit ARIA or either 128 or 256 bit ARIA.</p>
</dd>
<dt id="CAMELLIA128-CAMELLIA256-CAMELLIA"><b>CAMELLIA128</b>, <b>CAMELLIA256</b>, <b>CAMELLIA</b></dt>
<dd>
<p>Cipher suites using 128 bit CAMELLIA, 256 bit CAMELLIA or either 128 or 256 bit CAMELLIA.</p>
</dd>
<dt id="CHACHA20"><b>CHACHA20</b></dt>
<dd>
<p>Cipher suites using ChaCha20.</p>
</dd>
<dt id="DES"><b>3DES</b></dt>
<dd>
<p>Cipher suites using triple DES.</p>
</dd>
<dt id="DES1"><b>DES</b></dt>
<dd>
<p>Cipher suites using DES (not triple DES). All these cipher suites have been removed in OpenSSL 1.1.0.</p>
</dd>
<dt id="RC4"><b>RC4</b></dt>
<dd>
<p>Cipher suites using RC4.</p>
</dd>
<dt id="RC2"><b>RC2</b></dt>
<dd>
<p>Cipher suites using RC2.</p>
</dd>
<dt id="IDEA"><b>IDEA</b></dt>
<dd>
<p>Cipher suites using IDEA.</p>
</dd>
<dt id="SEED"><b>SEED</b></dt>
<dd>
<p>Cipher suites using SEED.</p>
</dd>
<dt id="MD5"><b>MD5</b></dt>
<dd>
<p>Cipher suites using MD5.</p>
</dd>
<dt id="SHA1-SHA"><b>SHA1</b>, <b>SHA</b></dt>
<dd>
<p>Cipher suites using SHA1.</p>
</dd>
<dt id="SHA256-SHA384"><b>SHA256</b>, <b>SHA384</b></dt>
<dd>
<p>Cipher suites using SHA256 or SHA384.</p>
</dd>
<dt id="aGOST"><b>aGOST</b></dt>
<dd>
<p>Cipher suites using GOST R 34.10 (either 2001 or 94) for authentication (needs an engine supporting GOST algorithms).</p>
</dd>
<dt id="aGOST01"><b>aGOST01</b></dt>
<dd>
<p>Cipher suites using GOST R 34.10-2001 authentication.</p>
</dd>
<dt id="kGOST"><b>kGOST</b></dt>
<dd>
<p>Cipher suites, using VKO 34.10 key exchange, specified in the RFC 4357.</p>
</dd>
<dt id="GOST94"><b>GOST94</b></dt>
<dd>
<p>Cipher suites, using HMAC based on GOST R 34.11-94.</p>
</dd>
<dt id="GOST89MAC"><b>GOST89MAC</b></dt>
<dd>
<p>Cipher suites using GOST 28147-89 MAC <b>instead of</b> HMAC.</p>
</dd>
<dt id="PSK"><b>PSK</b></dt>
<dd>
<p>All cipher suites using pre-shared keys (PSK).</p>
</dd>
<dt id="kPSK-kECDHEPSK-kDHEPSK-kRSAPSK"><b>kPSK</b>, <b>kECDHEPSK</b>, <b>kDHEPSK</b>, <b>kRSAPSK</b></dt>
<dd>
<p>Cipher suites using PSK key exchange, ECDHE_PSK, DHE_PSK or RSA_PSK.</p>
</dd>
<dt id="aPSK"><b>aPSK</b></dt>
<dd>
<p>Cipher suites using PSK authentication (currently all PSK modes apart from RSA_PSK).</p>
</dd>
<dt id="SUITEB128-SUITEB128ONLY-SUITEB192"><b>SUITEB128</b>, <b>SUITEB128ONLY</b>, <b>SUITEB192</b></dt>
<dd>
<p>Enables suite B mode of operation using 128 (permitting 192 bit mode by peer) 128 bit (not permitting 192 bit by peer) or 192 bit level of security respectively. If used these cipherstrings should appear first in the cipher list and anything after them is ignored. Setting Suite B mode has additional consequences required to comply with RFC6460. In particular the supported signature algorithms is reduced to support only ECDSA and SHA256 or SHA384, only the elliptic curves P-256 and P-384 can be used and only the two suite B compliant cipher suites (ECDHE-ECDSA-AES128-GCM-SHA256 and ECDHE-ECDSA-AES256-GCM-SHA384) are permissible.</p>
</dd>
</dl>
<h1 id="CIPHER-SUITE-NAMES">CIPHER SUITE NAMES</h1>
<p>The following lists give the SSL or TLS cipher suites names from the relevant specification and their OpenSSL equivalents. It should be noted, that several cipher suite names do not include the authentication used, e.g. DES-CBC3-SHA. In these cases, RSA authentication is used.</p>
<h2 id="SSL-v3.0-cipher-suites">SSL v3.0 cipher suites</h2>
<pre><code>SSL_RSA_WITH_NULL_MD5 NULL-MD5
SSL_RSA_WITH_NULL_SHA NULL-SHA
SSL_RSA_WITH_RC4_128_MD5 RC4-MD5
SSL_RSA_WITH_RC4_128_SHA RC4-SHA
SSL_RSA_WITH_IDEA_CBC_SHA IDEA-CBC-SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA DES-CBC3-SHA
SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA DH-DSS-DES-CBC3-SHA
SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA DH-RSA-DES-CBC3-SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE-DSS-DES-CBC3-SHA
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE-RSA-DES-CBC3-SHA
SSL_DH_anon_WITH_RC4_128_MD5 ADH-RC4-MD5
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA ADH-DES-CBC3-SHA
SSL_FORTEZZA_KEA_WITH_NULL_SHA Not implemented.
SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA Not implemented.
SSL_FORTEZZA_KEA_WITH_RC4_128_SHA Not implemented.</code></pre>
<h2 id="TLS-v1.0-cipher-suites">TLS v1.0 cipher suites</h2>
<pre><code>TLS_RSA_WITH_NULL_MD5 NULL-MD5
TLS_RSA_WITH_NULL_SHA NULL-SHA
TLS_RSA_WITH_RC4_128_MD5 RC4-MD5
TLS_RSA_WITH_RC4_128_SHA RC4-SHA
TLS_RSA_WITH_IDEA_CBC_SHA IDEA-CBC-SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA DES-CBC3-SHA
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA Not implemented.
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA Not implemented.
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE-DSS-DES-CBC3-SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE-RSA-DES-CBC3-SHA
TLS_DH_anon_WITH_RC4_128_MD5 ADH-RC4-MD5
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA ADH-DES-CBC3-SHA</code></pre>
<h2 id="AES-cipher-suites-from-RFC3268-extending-TLS-v1.0">AES cipher suites from RFC3268, extending TLS v1.0</h2>
<pre><code>TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA
TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA
TLS_DH_DSS_WITH_AES_128_CBC_SHA DH-DSS-AES128-SHA
TLS_DH_DSS_WITH_AES_256_CBC_SHA DH-DSS-AES256-SHA
TLS_DH_RSA_WITH_AES_128_CBC_SHA DH-RSA-AES128-SHA
TLS_DH_RSA_WITH_AES_256_CBC_SHA DH-RSA-AES256-SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA DHE-DSS-AES128-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA DHE-DSS-AES256-SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA DHE-RSA-AES128-SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA DHE-RSA-AES256-SHA
TLS_DH_anon_WITH_AES_128_CBC_SHA ADH-AES128-SHA
TLS_DH_anon_WITH_AES_256_CBC_SHA ADH-AES256-SHA</code></pre>
<h2 id="Camellia-cipher-suites-from-RFC4132-extending-TLS-v1.0">Camellia cipher suites from RFC4132, extending TLS v1.0</h2>
<pre><code>TLS_RSA_WITH_CAMELLIA_128_CBC_SHA CAMELLIA128-SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA CAMELLIA256-SHA
TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA DH-DSS-CAMELLIA128-SHA
TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA DH-DSS-CAMELLIA256-SHA
TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA DH-RSA-CAMELLIA128-SHA
TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA DH-RSA-CAMELLIA256-SHA
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA DHE-DSS-CAMELLIA128-SHA
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA DHE-DSS-CAMELLIA256-SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA DHE-RSA-CAMELLIA128-SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA DHE-RSA-CAMELLIA256-SHA
TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA ADH-CAMELLIA128-SHA
TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA ADH-CAMELLIA256-SHA</code></pre>
<h2 id="SEED-cipher-suites-from-RFC4162-extending-TLS-v1.0">SEED cipher suites from RFC4162, extending TLS v1.0</h2>
<pre><code>TLS_RSA_WITH_SEED_CBC_SHA SEED-SHA
TLS_DH_DSS_WITH_SEED_CBC_SHA DH-DSS-SEED-SHA
TLS_DH_RSA_WITH_SEED_CBC_SHA DH-RSA-SEED-SHA
TLS_DHE_DSS_WITH_SEED_CBC_SHA DHE-DSS-SEED-SHA
TLS_DHE_RSA_WITH_SEED_CBC_SHA DHE-RSA-SEED-SHA
TLS_DH_anon_WITH_SEED_CBC_SHA ADH-SEED-SHA</code></pre>
<h2 id="GOST-cipher-suites-from-draft-chudov-cryptopro-cptls-extending-TLS-v1.0">GOST cipher suites from draft-chudov-cryptopro-cptls, extending TLS v1.0</h2>
<p>Note: these ciphers require an engine which including GOST cryptographic algorithms, such as the <b>ccgost</b> engine, included in the OpenSSL distribution.</p>
<pre><code>TLS_GOSTR341094_WITH_28147_CNT_IMIT GOST94-GOST89-GOST89
TLS_GOSTR341001_WITH_28147_CNT_IMIT GOST2001-GOST89-GOST89
TLS_GOSTR341094_WITH_NULL_GOSTR3411 GOST94-NULL-GOST94
TLS_GOSTR341001_WITH_NULL_GOSTR3411 GOST2001-NULL-GOST94</code></pre>
<h2 id="Additional-Export-1024-and-other-cipher-suites">Additional Export 1024 and other cipher suites</h2>
<p>Note: these ciphers can also be used in SSL v3.</p>
<pre><code>TLS_DHE_DSS_WITH_RC4_128_SHA DHE-DSS-RC4-SHA</code></pre>
<h2 id="Elliptic-curve-cipher-suites">Elliptic curve cipher suites.</h2>
<pre><code>TLS_ECDHE_RSA_WITH_NULL_SHA ECDHE-RSA-NULL-SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA ECDHE-RSA-RC4-SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ECDHE-RSA-DES-CBC3-SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ECDHE-RSA-AES128-SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ECDHE-RSA-AES256-SHA
TLS_ECDHE_ECDSA_WITH_NULL_SHA ECDHE-ECDSA-NULL-SHA
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ECDHE-ECDSA-RC4-SHA
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA ECDHE-ECDSA-DES-CBC3-SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDHE-ECDSA-AES128-SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDHE-ECDSA-AES256-SHA
TLS_ECDH_anon_WITH_NULL_SHA AECDH-NULL-SHA
TLS_ECDH_anon_WITH_RC4_128_SHA AECDH-RC4-SHA
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA AECDH-DES-CBC3-SHA
TLS_ECDH_anon_WITH_AES_128_CBC_SHA AECDH-AES128-SHA
TLS_ECDH_anon_WITH_AES_256_CBC_SHA AECDH-AES256-SHA</code></pre>
<h2 id="TLS-v1.2-cipher-suites">TLS v1.2 cipher suites</h2>
<pre><code>TLS_RSA_WITH_NULL_SHA256 NULL-SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256 AES128-SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256 AES256-SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256 AES128-GCM-SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384 AES256-GCM-SHA384
TLS_DH_RSA_WITH_AES_128_CBC_SHA256 DH-RSA-AES128-SHA256
TLS_DH_RSA_WITH_AES_256_CBC_SHA256 DH-RSA-AES256-SHA256
TLS_DH_RSA_WITH_AES_128_GCM_SHA256 DH-RSA-AES128-GCM-SHA256
TLS_DH_RSA_WITH_AES_256_GCM_SHA384 DH-RSA-AES256-GCM-SHA384
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 DH-DSS-AES128-SHA256
TLS_DH_DSS_WITH_AES_256_CBC_SHA256 DH-DSS-AES256-SHA256
TLS_DH_DSS_WITH_AES_128_GCM_SHA256 DH-DSS-AES128-GCM-SHA256
TLS_DH_DSS_WITH_AES_256_GCM_SHA384 DH-DSS-AES256-GCM-SHA384
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 DHE-RSA-AES128-SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 DHE-RSA-AES256-SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 DHE-RSA-AES128-GCM-SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DHE-RSA-AES256-GCM-SHA384
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 DHE-DSS-AES128-SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 DHE-DSS-AES256-SHA256
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 DHE-DSS-AES128-GCM-SHA256
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 DHE-DSS-AES256-GCM-SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ECDHE-RSA-AES128-SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 ECDHE-RSA-AES256-SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDHE-RSA-AES256-GCM-SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ECDHE-ECDSA-AES128-SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ECDHE-ECDSA-AES256-SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384
TLS_DH_anon_WITH_AES_128_CBC_SHA256 ADH-AES128-SHA256
TLS_DH_anon_WITH_AES_256_CBC_SHA256 ADH-AES256-SHA256
TLS_DH_anon_WITH_AES_128_GCM_SHA256 ADH-AES128-GCM-SHA256
TLS_DH_anon_WITH_AES_256_GCM_SHA384 ADH-AES256-GCM-SHA384
RSA_WITH_AES_128_CCM AES128-CCM
RSA_WITH_AES_256_CCM AES256-CCM
DHE_RSA_WITH_AES_128_CCM DHE-RSA-AES128-CCM
DHE_RSA_WITH_AES_256_CCM DHE-RSA-AES256-CCM
RSA_WITH_AES_128_CCM_8 AES128-CCM8
RSA_WITH_AES_256_CCM_8 AES256-CCM8
DHE_RSA_WITH_AES_128_CCM_8 DHE-RSA-AES128-CCM8
DHE_RSA_WITH_AES_256_CCM_8 DHE-RSA-AES256-CCM8
ECDHE_ECDSA_WITH_AES_128_CCM ECDHE-ECDSA-AES128-CCM
ECDHE_ECDSA_WITH_AES_256_CCM ECDHE-ECDSA-AES256-CCM
ECDHE_ECDSA_WITH_AES_128_CCM_8 ECDHE-ECDSA-AES128-CCM8
ECDHE_ECDSA_WITH_AES_256_CCM_8 ECDHE-ECDSA-AES256-CCM8</code></pre>
<h2 id="ARIA-cipher-suites-from-RFC6209-extending-TLS-v1.2">ARIA cipher suites from RFC6209, extending TLS v1.2</h2>
<p>Note: the CBC modes mentioned in this RFC are not supported.</p>
<pre><code>TLS_RSA_WITH_ARIA_128_GCM_SHA256 ARIA128-GCM-SHA256
TLS_RSA_WITH_ARIA_256_GCM_SHA384 ARIA256-GCM-SHA384
TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 DHE-RSA-ARIA128-GCM-SHA256
TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 DHE-RSA-ARIA256-GCM-SHA384
TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256 DHE-DSS-ARIA128-GCM-SHA256
TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384 DHE-DSS-ARIA256-GCM-SHA384
TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 ECDHE-ECDSA-ARIA128-GCM-SHA256
TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 ECDHE-ECDSA-ARIA256-GCM-SHA384
TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 ECDHE-ARIA128-GCM-SHA256
TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 ECDHE-ARIA256-GCM-SHA384
TLS_PSK_WITH_ARIA_128_GCM_SHA256 PSK-ARIA128-GCM-SHA256
TLS_PSK_WITH_ARIA_256_GCM_SHA384 PSK-ARIA256-GCM-SHA384
TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 DHE-PSK-ARIA128-GCM-SHA256
TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 DHE-PSK-ARIA256-GCM-SHA384
TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 RSA-PSK-ARIA128-GCM-SHA256
TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 RSA-PSK-ARIA256-GCM-SHA384</code></pre>
<h2 id="Camellia-HMAC-Based-cipher-suites-from-RFC6367-extending-TLS-v1.2">Camellia HMAC-Based cipher suites from RFC6367, extending TLS v1.2</h2>
<pre><code>TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256
TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384
TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-RSA-CAMELLIA128-SHA256
TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-RSA-CAMELLIA256-SHA384</code></pre>
<h2 id="Pre-shared-keying-PSK-cipher-suites">Pre-shared keying (PSK) cipher suites</h2>
<pre><code>PSK_WITH_NULL_SHA PSK-NULL-SHA
DHE_PSK_WITH_NULL_SHA DHE-PSK-NULL-SHA
RSA_PSK_WITH_NULL_SHA RSA-PSK-NULL-SHA
PSK_WITH_RC4_128_SHA PSK-RC4-SHA
PSK_WITH_3DES_EDE_CBC_SHA PSK-3DES-EDE-CBC-SHA
PSK_WITH_AES_128_CBC_SHA PSK-AES128-CBC-SHA
PSK_WITH_AES_256_CBC_SHA PSK-AES256-CBC-SHA
DHE_PSK_WITH_RC4_128_SHA DHE-PSK-RC4-SHA
DHE_PSK_WITH_3DES_EDE_CBC_SHA DHE-PSK-3DES-EDE-CBC-SHA
DHE_PSK_WITH_AES_128_CBC_SHA DHE-PSK-AES128-CBC-SHA
DHE_PSK_WITH_AES_256_CBC_SHA DHE-PSK-AES256-CBC-SHA
RSA_PSK_WITH_RC4_128_SHA RSA-PSK-RC4-SHA
RSA_PSK_WITH_3DES_EDE_CBC_SHA RSA-PSK-3DES-EDE-CBC-SHA
RSA_PSK_WITH_AES_128_CBC_SHA RSA-PSK-AES128-CBC-SHA
RSA_PSK_WITH_AES_256_CBC_SHA RSA-PSK-AES256-CBC-SHA
PSK_WITH_AES_128_GCM_SHA256 PSK-AES128-GCM-SHA256
PSK_WITH_AES_256_GCM_SHA384 PSK-AES256-GCM-SHA384
DHE_PSK_WITH_AES_128_GCM_SHA256 DHE-PSK-AES128-GCM-SHA256
DHE_PSK_WITH_AES_256_GCM_SHA384 DHE-PSK-AES256-GCM-SHA384
RSA_PSK_WITH_AES_128_GCM_SHA256 RSA-PSK-AES128-GCM-SHA256
RSA_PSK_WITH_AES_256_GCM_SHA384 RSA-PSK-AES256-GCM-SHA384
PSK_WITH_AES_128_CBC_SHA256 PSK-AES128-CBC-SHA256
PSK_WITH_AES_256_CBC_SHA384 PSK-AES256-CBC-SHA384
PSK_WITH_NULL_SHA256 PSK-NULL-SHA256
PSK_WITH_NULL_SHA384 PSK-NULL-SHA384
DHE_PSK_WITH_AES_128_CBC_SHA256 DHE-PSK-AES128-CBC-SHA256
DHE_PSK_WITH_AES_256_CBC_SHA384 DHE-PSK-AES256-CBC-SHA384
DHE_PSK_WITH_NULL_SHA256 DHE-PSK-NULL-SHA256
DHE_PSK_WITH_NULL_SHA384 DHE-PSK-NULL-SHA384
RSA_PSK_WITH_AES_128_CBC_SHA256 RSA-PSK-AES128-CBC-SHA256
RSA_PSK_WITH_AES_256_CBC_SHA384 RSA-PSK-AES256-CBC-SHA384
RSA_PSK_WITH_NULL_SHA256 RSA-PSK-NULL-SHA256
RSA_PSK_WITH_NULL_SHA384 RSA-PSK-NULL-SHA384
PSK_WITH_AES_128_GCM_SHA256 PSK-AES128-GCM-SHA256
PSK_WITH_AES_256_GCM_SHA384 PSK-AES256-GCM-SHA384
ECDHE_PSK_WITH_RC4_128_SHA ECDHE-PSK-RC4-SHA
ECDHE_PSK_WITH_3DES_EDE_CBC_SHA ECDHE-PSK-3DES-EDE-CBC-SHA
ECDHE_PSK_WITH_AES_128_CBC_SHA ECDHE-PSK-AES128-CBC-SHA
ECDHE_PSK_WITH_AES_256_CBC_SHA ECDHE-PSK-AES256-CBC-SHA
ECDHE_PSK_WITH_AES_128_CBC_SHA256 ECDHE-PSK-AES128-CBC-SHA256
ECDHE_PSK_WITH_AES_256_CBC_SHA384 ECDHE-PSK-AES256-CBC-SHA384
ECDHE_PSK_WITH_NULL_SHA ECDHE-PSK-NULL-SHA
ECDHE_PSK_WITH_NULL_SHA256 ECDHE-PSK-NULL-SHA256
ECDHE_PSK_WITH_NULL_SHA384 ECDHE-PSK-NULL-SHA384
PSK_WITH_CAMELLIA_128_CBC_SHA256 PSK-CAMELLIA128-SHA256
PSK_WITH_CAMELLIA_256_CBC_SHA384 PSK-CAMELLIA256-SHA384
DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 DHE-PSK-CAMELLIA128-SHA256
DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 DHE-PSK-CAMELLIA256-SHA384
RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 RSA-PSK-CAMELLIA128-SHA256
RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 RSA-PSK-CAMELLIA256-SHA384
ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-PSK-CAMELLIA128-SHA256
ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-PSK-CAMELLIA256-SHA384
PSK_WITH_AES_128_CCM PSK-AES128-CCM
PSK_WITH_AES_256_CCM PSK-AES256-CCM
DHE_PSK_WITH_AES_128_CCM DHE-PSK-AES128-CCM
DHE_PSK_WITH_AES_256_CCM DHE-PSK-AES256-CCM
PSK_WITH_AES_128_CCM_8 PSK-AES128-CCM8
PSK_WITH_AES_256_CCM_8 PSK-AES256-CCM8
DHE_PSK_WITH_AES_128_CCM_8 DHE-PSK-AES128-CCM8
DHE_PSK_WITH_AES_256_CCM_8 DHE-PSK-AES256-CCM8</code></pre>
<h2 id="ChaCha20-Poly1305-cipher-suites-extending-TLS-v1.2">ChaCha20-Poly1305 cipher suites, extending TLS v1.2</h2>
<pre><code>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-RSA-CHACHA20-POLY1305
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-CHACHA20-POLY1305
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 DHE-RSA-CHACHA20-POLY1305
TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 PSK-CHACHA20-POLY1305
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 ECDHE-PSK-CHACHA20-POLY1305
TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 DHE-PSK-CHACHA20-POLY1305
TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 RSA-PSK-CHACHA20-POLY1305</code></pre>
<h2 id="TLS-v1.3-cipher-suites">TLS v1.3 cipher suites</h2>
<pre><code>TLS_AES_128_GCM_SHA256 TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384 TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256 TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_SHA256
TLS_AES_128_CCM_8_SHA256 TLS_AES_128_CCM_8_SHA256</code></pre>
<h2 id="Older-names-used-by-OpenSSL">Older names used by OpenSSL</h2>
<p>The following names are accepted by older releases:</p>
<pre><code>SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA EDH-RSA-DES-CBC3-SHA (DHE-RSA-DES-CBC3-SHA)
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA EDH-DSS-DES-CBC3-SHA (DHE-DSS-DES-CBC3-SHA)</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>Some compiled versions of OpenSSL may not include all the ciphers listed here because some ciphers were excluded at compile time.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Verbose listing of all OpenSSL ciphers including NULL ciphers:</p>
<pre><code>openssl ciphers -v 'ALL:eNULL'</code></pre>
<p>Include all ciphers except NULL and anonymous DH then sort by strength:</p>
<pre><code>openssl ciphers -v 'ALL:!ADH:@STRENGTH'</code></pre>
<p>Include all ciphers except ones with no encryption (eNULL) or no authentication (aNULL):</p>
<pre><code>openssl ciphers -v 'ALL:!aNULL'</code></pre>
<p>Include only 3DES ciphers and then place RSA ciphers last:</p>
<pre><code>openssl ciphers -v '3DES:+RSA'</code></pre>
<p>Include all RC4 ciphers but leave out those without authentication:</p>
<pre><code>openssl ciphers -v 'RC4:!COMPLEMENTOFDEFAULT'</code></pre>
<p>Include all ciphers with RSA authentication but leave out ciphers without encryption.</p>
<pre><code>openssl ciphers -v 'RSA:!COMPLEMENTOFALL'</code></pre>
<p>Set security level to 2 and display all ciphers consistent with level 2:</p>
<pre><code>openssl ciphers -s -v 'ALL:@SECLEVEL=2'</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man7/ssl.html">ssl(7)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The <b>-V</b> option for the <b>ciphers</b> command was added in OpenSSL 1.0.0.</p>
<p>The <b>-stdname</b> is only available if OpenSSL is built with tracing enabled (<b>enable-ssl-trace</b> argument to Configure) before OpenSSL 1.1.1.</p>
<p>The <b>-convert</b> option was added in OpenSSL 1.1.1.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�I��� � openssl/html/man1/rehash.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>rehash</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a>
<ul>
<li><a href="#Script-Configuration">Script Configuration</a></li>
</ul>
</li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#ENVIRONMENT">ENVIRONMENT</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-c_rehash, openssl-rehash, c_rehash, rehash - Create symbolic links to files named by the hash values</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>rehash</b> <b>[-h]</b> <b>[-help]</b> <b>[-old]</b> <b>[-n]</b> <b>[-v]</b> [ <i>directory</i>...]</p>
<p><b>c_rehash</b> <i>flags...</i></p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>On some platforms, the OpenSSL <b>rehash</b> command is available as an external script called <b>c_rehash</b>. They are functionally equivalent, except for minor differences noted below.</p>
<p><b>rehash</b> scans directories and calculates a hash value of each <code>.pem</code>, <code>.crt</code>, <code>.cer</code>, or <code>.crl</code> file in the specified directory list and creates symbolic links for each file, where the name of the link is the hash value. (If the platform does not support symbolic links, a copy is made.) This utility is useful as many programs that use OpenSSL require directories to be set up like this in order to find certificates.</p>
<p>If any directories are named on the command line, then those are processed in turn. If not, then the <b>SSL_CERT_DIR</b> environment variable is consulted; this should be a colon-separated list of directories, like the Unix <b>PATH</b> variable. If that is not set then the default directory (installation-specific but often <b>/usr/local/ssl/certs</b>) is processed.</p>
<p>In order for a directory to be processed, the user must have write permissions on that directory, otherwise an error will be generated.</p>
<p>The links created are of the form <code>HHHHHHHH.D</code>, where each <b>H</b> is a hexadecimal character and <b>D</b> is a single decimal digit. When processing a directory, <b>rehash</b> will first remove all links that have a name in that syntax, even if they are being used for some other purpose. To skip the removal step, use the <b>-n</b> flag. Hashes for CRL's look similar except the letter <b>r</b> appears after the period, like this: <code>HHHHHHHH.rD</code>.</p>
<p>Multiple objects may have the same hash; they will be indicated by incrementing the <b>D</b> value. Duplicates are found by comparing the full SHA-1 fingerprint. A warning will be displayed if a duplicate is found.</p>
<p>A warning will also be displayed if there are files that cannot be parsed as either a certificate or a CRL or if more than one such object appears in the file.</p>
<h2 id="Script-Configuration">Script Configuration</h2>
<p>The <b>c_rehash</b> script uses the <b>openssl</b> program to compute the hashes and fingerprints. If not found in the user's <b>PATH</b>, then set the <b>OPENSSL</b> environment variable to the full pathname. Any program can be used, it will be invoked as follows for either a certificate or CRL:</p>
<pre><code>$OPENSSL x509 -hash -fingerprint -noout -in FILENAME
$OPENSSL crl -hash -fingerprint -noout -in FILENAME</code></pre>
<p>where <b>FILENAME</b> is the filename. It must output the hash of the file on the first line, and the fingerprint on the second, optionally prefixed with some text and an equals sign.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help--h"><b>-help</b> <b>-h</b></dt>
<dd>
<p>Display a brief usage message.</p>
</dd>
<dt id="old"><b>-old</b></dt>
<dd>
<p>Use old-style hashing (MD5, as opposed to SHA-1) for generating links to be used for releases before 1.0.0. Note that current versions will not use the old style.</p>
</dd>
<dt id="n"><b>-n</b></dt>
<dd>
<p>Do not remove existing links. This is needed when keeping new and old-style links in the same directory.</p>
</dd>
<dt id="compat"><b>-compat</b></dt>
<dd>
<p>Generate links for both old-style (MD5) and new-style (SHA1) hashing. This allows releases before 1.0.0 to use these links along-side newer releases.</p>
</dd>
<dt id="v"><b>-v</b></dt>
<dd>
<p>Print messages about old links removed and new links created. By default, <b>rehash</b> only lists each directory as it is processed.</p>
</dd>
</dl>
<h1 id="ENVIRONMENT">ENVIRONMENT</h1>
<dl>
<dt id="OPENSSL"><b>OPENSSL</b></dt>
<dd>
<p>The path to an executable to use to generate hashes and fingerprints (see above).</p>
</dd>
<dt id="SSL_CERT_DIR"><b>SSL_CERT_DIR</b></dt>
<dd>
<p>Colon separated list of directories to operate on. Ignored if directories are listed on the command line.</p>
</dd>
</dl>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/openssl.html">openssl(1)</a>, <a href="../man1/crl.html">crl(1)</a>. <a href="../man1/x509.html">x509(1)</a>.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�` openssl/html/man1/prime.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>prime</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-prime, prime - compute prime numbers</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl prime</b> [<b>-help</b>] [<b>-hex</b>] [<b>-generate</b>] [<b>-bits</b>] [<b>-safe</b>] [<b>-checks</b>] [<i>number...</i>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>prime</b> command checks if the specified numbers are prime.</p>
<p>If no numbers are given on the command line, the <b>-generate</b> flag should be used to generate primes according to the requirements specified by the rest of the flags.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help">[<b>-help</b>]</dt>
<dd>
<p>Display an option summary.</p>
</dd>
<dt id="hex">[<b>-hex</b>]</dt>
<dd>
<p>Generate hex output.</p>
</dd>
<dt id="generate">[<b>-generate</b>]</dt>
<dd>
<p>Generate a prime number.</p>
</dd>
<dt id="bits-num">[<b>-bits num</b>]</dt>
<dd>
<p>Generate a prime with <b>num</b> bits.</p>
</dd>
<dt id="safe">[<b>-safe</b>]</dt>
<dd>
<p>When used with <b>-generate</b>, generates a "safe" prime. If the number generated is <b>n</b>, then check that <b>(n-1)/2</b> is also prime.</p>
</dd>
<dt id="checks-num">[<b>-checks num</b>]</dt>
<dd>
<p>Perform the checks <b>num</b> times to see that the generated number is prime. The default is 20.</p>
</dd>
</dl>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]n%�� � openssl/html/man1/nseq.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>nseq</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-nseq, nseq - create or examine a Netscape certificate sequence</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>nseq</b> [<b>-help</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-toseq</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>nseq</b> command takes a file containing a Netscape certificate sequence and prints out the certificates contained in it or takes a file of certificates and converts it into a Netscape certificate sequence.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Specifies the output filename or standard output by default.</p>
</dd>
<dt id="toseq"><b>-toseq</b></dt>
<dd>
<p>Normally a Netscape certificate sequence will be input and the output is the certificates contained in it. With the <b>-toseq</b> option the situation is reversed: a Netscape certificate sequence is created from a file of certificates.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Output the certificates in a Netscape certificate sequence</p>
<pre><code>openssl nseq -in nseq.pem -out certs.pem</code></pre>
<p>Create a Netscape certificate sequence</p>
<pre><code>openssl nseq -in certs.pem -toseq -out nseq.pem</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>The <b>PEM</b> encoded form uses the same headers and footers as a certificate:</p>
<pre><code>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</code></pre>
<p>A Netscape certificate sequence is a Netscape specific format that can be sent to browsers as an alternative to the standard PKCS#7 format when several certificates are sent to the browser: for example during certificate enrollment. It is used by Netscape certificate server for example.</p>
<h1 id="BUGS">BUGS</h1>
<p>This program needs a few more options: like allowing DER or PEM input and output files and allowing multiple certificate files to be used.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]9�z�o �o openssl/html/man1/req.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>req</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#CONFIGURATION-FILE-FORMAT">CONFIGURATION FILE FORMAT</a></li>
<li><a href="#DISTINGUISHED-NAME-AND-ATTRIBUTE-SECTION-FORMAT">DISTINGUISHED NAME AND ATTRIBUTE SECTION FORMAT</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#DIAGNOSTICS">DIAGNOSTICS</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-req, req - PKCS#10 certificate request and certificate generating utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>req</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-text</b>] [<b>-pubkey</b>] [<b>-noout</b>] [<b>-verify</b>] [<b>-modulus</b>] [<b>-new</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-newkey rsa:bits</b>] [<b>-newkey alg:file</b>] [<b>-nodes</b>] [<b>-key filename</b>] [<b>-keyform PEM|DER</b>] [<b>-keyout filename</b>] [<b>-keygen_engine id</b>] [<b>-<i>digest</i></b>] [<b>-config filename</b>] [<b>-multivalue-rdn</b>] [<b>-x509</b>] [<b>-days n</b>] [<b>-set_serial n</b>] [<b>-newhdr</b>] [<b>-addext ext</b>] [<b>-extensions section</b>] [<b>-reqexts section</b>] [<b>-precert</b>] [<b>-utf8</b>] [<b>-nameopt</b>] [<b>-reqopt</b>] [<b>-subject</b>] [<b>-subj arg</b>] [<b>-sigopt nm:v</b>] [<b>-batch</b>] [<b>-verbose</b>] [<b>-engine id</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>req</b> command primarily creates and processes certificate requests in PKCS#10 format. It can additionally create self signed certificates for use as root CAs for example.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with the PKCS#10. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a request from or standard input if this option is not specified. A request is only read if the creation options (<b>-new</b> and <b>-newkey</b>) are not specified.</p>
</dd>
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
<dd>
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The input file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="passout-arg"><b>-passout arg</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the certificate request in text form.</p>
</dd>
<dt id="subject"><b>-subject</b></dt>
<dd>
<p>Prints out the request subject (or certificate subject if <b>-x509</b> is specified)</p>
</dd>
<dt id="pubkey"><b>-pubkey</b></dt>
<dd>
<p>Outputs the public key.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option prevents output of the encoded version of the request.</p>
</dd>
<dt id="modulus"><b>-modulus</b></dt>
<dd>
<p>This option prints out the value of the modulus of the public key contained in the request.</p>
</dd>
<dt id="verify"><b>-verify</b></dt>
<dd>
<p>Verifies the signature on the request.</p>
</dd>
<dt id="new"><b>-new</b></dt>
<dd>
<p>This option generates a new certificate request. It will prompt the user for the relevant field values. The actual fields prompted for and their maximum and minimum sizes are specified in the configuration file and any requested extensions.</p>
<p>If the <b>-key</b> option is not used it will generate a new RSA private key using information specified in the configuration file.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="newkey-arg"><b>-newkey arg</b></dt>
<dd>
<p>This option creates a new certificate request and a new private key. The argument takes one of several forms. <b>rsa:nbits</b>, where <b>nbits</b> is the number of bits, generates an RSA key <b>nbits</b> in size. If <b>nbits</b> is omitted, i.e. <b>-newkey rsa</b> specified, the default key size, specified in the configuration file is used.</p>
<p>All other algorithms support the <b>-newkey alg:file</b> form, where file may be an algorithm parameter file, created by the <b>genpkey -genparam</b> command or and X.509 certificate for a key with appropriate algorithm.</p>
<p><b>param:file</b> generates a key using the parameter file or certificate <b>file</b>, the algorithm is determined by the parameters. <b>algname:file</b> use algorithm <b>algname</b> and parameter file <b>file</b>: the two algorithms must match or an error occurs. <b>algname</b> just uses algorithm <b>algname</b>, and parameters, if necessary should be specified via <b>-pkeyopt</b> parameter.</p>
<p><b>dsa:filename</b> generates a DSA key using the parameters in the file <b>filename</b>. <b>ec:filename</b> generates EC key (usable both with ECDSA or ECDH algorithms), <b>gost2001:filename</b> generates GOST R 34.10-2001 key (requires <b>ccgost</b> engine configured in the configuration file). If just <b>gost2001</b> is specified a parameter set should be specified by <b>-pkeyopt paramset:X</b></p>
</dd>
<dt id="pkeyopt-opt:value"><b>-pkeyopt opt:value</b></dt>
<dd>
<p>Set the public key algorithm option <b>opt</b> to <b>value</b>. The precise set of options supported depends on the public key algorithm used and its implementation. See <b>KEY GENERATION OPTIONS</b> in the <b>genpkey</b> manual page for more details.</p>
</dd>
<dt id="key-filename"><b>-key filename</b></dt>
<dd>
<p>This specifies the file to read the private key from. It also accepts PKCS#8 format private keys for PEM format files.</p>
</dd>
<dt id="keyform-PEM-DER"><b>-keyform PEM|DER</b></dt>
<dd>
<p>The format of the private key file specified in the <b>-key</b> argument. PEM is the default.</p>
</dd>
<dt id="keyout-filename"><b>-keyout filename</b></dt>
<dd>
<p>This gives the filename to write the newly created private key to. If this option is not specified then the filename present in the configuration file is used.</p>
</dd>
<dt id="nodes"><b>-nodes</b></dt>
<dd>
<p>If this option is specified then if a private key is created it will not be encrypted.</p>
</dd>
<dt id="digest"><b>-<i>digest</i></b></dt>
<dd>
<p>This specifies the message digest to sign the request. Any digest supported by the OpenSSL <b>dgst</b> command can be used. This overrides the digest algorithm specified in the configuration file.</p>
<p>Some public key algorithms may override this choice. For instance, DSA signatures always use SHA1, GOST R 34.10 signatures always use GOST R 34.11-94 (<b>-md_gost94</b>), Ed25519 and Ed448 never use any digest.</p>
</dd>
<dt id="config-filename"><b>-config filename</b></dt>
<dd>
<p>This allows an alternative configuration file to be specified. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>.</p>
</dd>
<dt id="subj-arg"><b>-subj arg</b></dt>
<dd>
<p>Sets subject name for new request or supersedes the subject name when processing a request. The arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>. Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted, but the corresponding type will not be included in the request.</p>
</dd>
<dt id="multivalue-rdn"><b>-multivalue-rdn</b></dt>
<dd>
<p>This option causes the -subj argument to be interpreted with full support for multivalued RDNs. Example:</p>
<p><i>/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe</i></p>
<p>If -multi-rdn is not used then the UID value is <i>123456+CN=John Doe</i>.</p>
</dd>
<dt id="x509"><b>-x509</b></dt>
<dd>
<p>This option outputs a self signed certificate instead of a certificate request. This is typically used to generate a test certificate or a self signed root CA. The extensions added to the certificate (if any) are specified in the configuration file. Unless specified using the <b>set_serial</b> option, a large random number will be used for the serial number.</p>
<p>If existing request is specified with the <b>-in</b> option, it is converted to the self signed certificate otherwise new request is created.</p>
</dd>
<dt id="days-n"><b>-days n</b></dt>
<dd>
<p>When the <b>-x509</b> option is being used this specifies the number of days to certify the certificate for, otherwise it is ignored. <b>n</b> should be a positive integer. The default is 30 days.</p>
</dd>
<dt id="set_serial-n"><b>-set_serial n</b></dt>
<dd>
<p>Serial number to use when outputting a self signed certificate. This may be specified as a decimal value or a hex value if preceded by <b>0x</b>.</p>
</dd>
<dt id="addext-ext"><b>-addext ext</b></dt>
<dd>
<p>Add a specific extension to the certificate (if the <b>-x509</b> option is present) or certificate request. The argument must have the form of a key=value pair as it would appear in a config file.</p>
<p>This option can be given multiple times.</p>
</dd>
<dt id="extensions-section"><b>-extensions section</b></dt>
<dd>
</dd>
<dt id="reqexts-section"><b>-reqexts section</b></dt>
<dd>
<p>These options specify alternative sections to include certificate extensions (if the <b>-x509</b> option is present) or certificate request extensions. This allows several different sections to be used in the same configuration file to specify requests for a variety of purposes.</p>
</dd>
<dt id="precert"><b>-precert</b></dt>
<dd>
<p>A poison extension will be added to the certificate, making it a "pre-certificate" (see RFC6962). This can be submitted to Certificate Transparency logs in order to obtain signed certificate timestamps (SCTs). These SCTs can then be embedded into the pre-certificate as an extension, before removing the poison and signing the certificate.</p>
<p>This implies the <b>-new</b> flag.</p>
</dd>
<dt id="utf8"><b>-utf8</b></dt>
<dd>
<p>This option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings.</p>
</dd>
<dt id="nameopt-option"><b>-nameopt option</b></dt>
<dd>
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
</dd>
<dt id="reqopt"><b>-reqopt</b></dt>
<dd>
<p>Customise the output format used with <b>-text</b>. The <b>option</b> argument can be a single option or multiple options separated by commas.</p>
<p>See discussion of the <b>-certopt</b> parameter in the <a href="../man1/x509.html">x509(1)</a> command.</p>
</dd>
<dt id="newhdr"><b>-newhdr</b></dt>
<dd>
<p>Adds the word <b>NEW</b> to the PEM file header and footer lines on the outputted request. Some software (Netscape certificate server) and some CAs need this.</p>
</dd>
<dt id="batch"><b>-batch</b></dt>
<dd>
<p>Non-interactive mode.</p>
</dd>
<dt id="verbose"><b>-verbose</b></dt>
<dd>
<p>Print extra details about the operations being performed.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>req</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="keygen_engine-id"><b>-keygen_engine id</b></dt>
<dd>
<p>Specifies an engine (by its unique <b>id</b> string) which would be used for key generation operations.</p>
</dd>
</dl>
<h1 id="CONFIGURATION-FILE-FORMAT">CONFIGURATION FILE FORMAT</h1>
<p>The configuration options are specified in the <b>req</b> section of the configuration file. As with all configuration files if no value is specified in the specific section (i.e. <b>req</b>) then the initial unnamed or <b>default</b> section is searched too.</p>
<p>The options available are described in detail below.</p>
<dl>
<dt id="input_password-output_password"><b>input_password output_password</b></dt>
<dd>
<p>The passwords for the input private key file (if present) and the output private key file (if one will be created). The command line options <b>passin</b> and <b>passout</b> override the configuration file values.</p>
</dd>
<dt id="default_bits"><b>default_bits</b></dt>
<dd>
<p>Specifies the default key size in bits.</p>
<p>This option is used in conjunction with the <b>-new</b> option to generate a new key. It can be overridden by specifying an explicit key size in the <b>-newkey</b> option. The smallest accepted key size is 512 bits. If no key size is specified then 2048 bits is used.</p>
</dd>
<dt id="default_keyfile"><b>default_keyfile</b></dt>
<dd>
<p>This is the default filename to write a private key to. If not specified the key is written to standard output. This can be overridden by the <b>-keyout</b> option.</p>
</dd>
<dt id="oid_file"><b>oid_file</b></dt>
<dd>
<p>This specifies a file containing additional <b>OBJECT IDENTIFIERS</b>. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed by white space and finally the long name.</p>
</dd>
<dt id="oid_section"><b>oid_section</b></dt>
<dd>
<p>This specifies a section in the configuration file containing extra object identifiers. Each line should consist of the short name of the object identifier followed by <b>=</b> and the numerical form. The short and long names are the same when this option is used.</p>
</dd>
<dt id="RANDFILE"><b>RANDFILE</b></dt>
<dd>
<p>At startup the specified file is loaded into the random number generator, and at exit 256 bytes will be written to it. It is used for private key generation.</p>
</dd>
<dt id="encrypt_key"><b>encrypt_key</b></dt>
<dd>
<p>If this is set to <b>no</b> then if a private key is generated it is <b>not</b> encrypted. This is equivalent to the <b>-nodes</b> command line option. For compatibility <b>encrypt_rsa_key</b> is an equivalent option.</p>
</dd>
<dt id="default_md"><b>default_md</b></dt>
<dd>
<p>This option specifies the digest algorithm to use. Any digest supported by the OpenSSL <b>dgst</b> command can be used. This option can be overridden on the command line. Certain signing algorithms (i.e. Ed25519 and Ed448) will ignore any digest that has been set.</p>
</dd>
<dt id="string_mask"><b>string_mask</b></dt>
<dd>
<p>This option masks out the use of certain string types in certain fields. Most users will not need to change this option.</p>
<p>It can be set to several values <b>default</b> which is also the default option uses PrintableStrings, T61Strings and BMPStrings if the <b>pkix</b> value is used then only PrintableStrings and BMPStrings will be used. This follows the PKIX recommendation in RFC2459. If the <b>utf8only</b> option is used then only UTF8Strings will be used: this is the PKIX recommendation in RFC2459 after 2003. Finally the <b>nombstr</b> option just uses PrintableStrings and T61Strings: certain software has problems with BMPStrings and UTF8Strings: in particular Netscape.</p>
</dd>
<dt id="req_extensions"><b>req_extensions</b></dt>
<dd>
<p>This specifies the configuration file section containing a list of extensions to add to the certificate request. It can be overridden by the <b>-reqexts</b> command line switch. See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
</dd>
<dt id="x509_extensions"><b>x509_extensions</b></dt>
<dd>
<p>This specifies the configuration file section containing a list of extensions to add to certificate generated when the <b>-x509</b> switch is used. It can be overridden by the <b>-extensions</b> command line switch.</p>
</dd>
<dt id="prompt"><b>prompt</b></dt>
<dd>
<p>If set to the value <b>no</b> this disables prompting of certificate fields and just takes values from the config file directly. It also changes the expected format of the <b>distinguished_name</b> and <b>attributes</b> sections.</p>
</dd>
<dt id="utf81"><b>utf8</b></dt>
<dd>
<p>If set to the value <b>yes</b> then field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings.</p>
</dd>
<dt id="attributes"><b>attributes</b></dt>
<dd>
<p>This specifies the section containing any request attributes: its format is the same as <b>distinguished_name</b>. Typically these may contain the challengePassword or unstructuredName types. They are currently ignored by OpenSSL's request signing utilities but some CAs might want them.</p>
</dd>
<dt id="distinguished_name"><b>distinguished_name</b></dt>
<dd>
<p>This specifies the section containing the distinguished name fields to prompt for when generating a certificate or certificate request. The format is described in the next section.</p>
</dd>
</dl>
<h1 id="DISTINGUISHED-NAME-AND-ATTRIBUTE-SECTION-FORMAT">DISTINGUISHED NAME AND ATTRIBUTE SECTION FORMAT</h1>
<p>There are two separate formats for the distinguished name and attribute sections. If the <b>prompt</b> option is set to <b>no</b> then these sections just consist of field names and values: for example,</p>
<pre><code>CN=My Name
OU=My Organization
emailAddress=someone@somewhere.org</code></pre>
<p>This allows external programs (e.g. GUI based) to generate a template file with all the field names and values and just pass it to <b>req</b>. An example of this kind of configuration file is contained in the <b>EXAMPLES</b> section.</p>
<p>Alternatively if the <b>prompt</b> option is absent or not set to <b>no</b> then the file contains field prompting information. It consists of lines of the form:</p>
<pre><code>fieldName="prompt"
fieldName_default="default field value"
fieldName_min= 2
fieldName_max= 4</code></pre>
<p>"fieldName" is the field name being used, for example commonName (or CN). The "prompt" string is used to ask the user to enter the relevant details. If the user enters nothing then the default value is used if no default value is present then the field is omitted. A field can still be omitted if a default value is present if the user just enters the '.' character.</p>
<p>The number of characters entered must be between the fieldName_min and fieldName_max limits: there may be additional restrictions based on the field being used (for example countryName can only ever be two characters long and must fit in a PrintableString).</p>
<p>Some fields (such as organizationName) can be used more than once in a DN. This presents a problem because configuration files will not recognize the same name occurring twice. To avoid this problem if the fieldName contains some characters followed by a full stop they will be ignored. So for example a second organizationName can be input by calling it "1.organizationName".</p>
<p>The actual permitted field names are any object identifier short or long names. These are compiled into OpenSSL and include the usual values such as commonName, countryName, localityName, organizationName, organizationalUnitName, stateOrProvinceName. Additionally emailAddress is included as well as name, surname, givenName, initials, and dnQualifier.</p>
<p>Additional object identifiers can be defined with the <b>oid_file</b> or <b>oid_section</b> options in the configuration file. Any additional fields will be treated as though they were a DirectoryString.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Examine and verify certificate request:</p>
<pre><code>openssl req -in req.pem -text -verify -noout</code></pre>
<p>Create a private key and then generate a certificate request from it:</p>
<pre><code>openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out req.pem</code></pre>
<p>The same but just using req:</p>
<pre><code>openssl req -newkey rsa:2048 -keyout key.pem -out req.pem</code></pre>
<p>Generate a self signed root certificate:</p>
<pre><code>openssl req -x509 -newkey rsa:2048 -keyout key.pem -out req.pem</code></pre>
<p>Example of a file pointed to by the <b>oid_file</b> option:</p>
<pre><code>1.2.3.4 shortName A longer Name
1.2.3.6 otherName Other longer Name</code></pre>
<p>Example of a section pointed to by <b>oid_section</b> making use of variable expansion:</p>
<pre><code>testoid1=1.2.3.5
testoid2=${testoid1}.6</code></pre>
<p>Sample configuration file prompting for field values:</p>
<pre><code>[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
req_extensions = v3_ca
dirstring_type = nobmp
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = AU
countryName_min = 2
countryName_max = 2
localityName = Locality Name (eg, city)
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (eg, YOUR name)
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 40
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints = critical, CA:true</code></pre>
<p>Sample configuration containing all field values:</p>
<pre><code>RANDFILE = $ENV::HOME/.rnd
[ req ]
default_bits = 2048
default_keyfile = keyfile.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
prompt = no
output_password = mypass
[ req_distinguished_name ]
C = GB
ST = Test State or Province
L = Test Locality
O = Organization Name
OU = Organizational Unit Name
CN = Common Name
emailAddress = test@email.address
[ req_attributes ]
challengePassword = A challenge password</code></pre>
<p>Example of giving the most common attributes (subject and extensions) on the command line:</p>
<pre><code>openssl req -new -subj "/C=GB/CN=foo" \
-addext "subjectAltName = DNS:foo.co.uk" \
-addext "certificatePolicies = 1.2.3.4" \
-newkey rsa:2048 -keyout key.pem -out req.pem</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>The header and footer lines in the <b>PEM</b> format are normally:</p>
<pre><code>-----BEGIN CERTIFICATE REQUEST-----
-----END CERTIFICATE REQUEST-----</code></pre>
<p>some software (some versions of Netscape certificate server) instead needs:</p>
<pre><code>-----BEGIN NEW CERTIFICATE REQUEST-----
-----END NEW CERTIFICATE REQUEST-----</code></pre>
<p>which is produced with the <b>-newhdr</b> option but is otherwise compatible. Either form is accepted transparently on input.</p>
<p>The certificate requests generated by <b>Xenroll</b> with MSIE have extensions added. It includes the <b>keyUsage</b> extension which determines the type of key (signature only or general purpose) and any additional OIDs entered by the script in an extendedKeyUsage extension.</p>
<h1 id="DIAGNOSTICS">DIAGNOSTICS</h1>
<p>The following messages are frequently asked about:</p>
<pre><code>Using configuration from /some/path/openssl.cnf
Unable to load config info</code></pre>
<p>This is followed some time later by...</p>
<pre><code>unable to find 'distinguished_name' in config
problems making Certificate Request</code></pre>
<p>The first error message is the clue: it can't find the configuration file! Certain operations (like examining a certificate request) don't need a configuration file so its use isn't enforced. Generation of certificates or requests however does need a configuration file. This could be regarded as a bug.</p>
<p>Another puzzling message is this:</p>
<pre><code>Attributes:
a0:00</code></pre>
<p>this is displayed when no attributes are present and the request includes the correct empty <b>SET OF</b> structure (the DER encoding of which is 0xa0 0x00). If you just see:</p>
<pre><code>Attributes:</code></pre>
<p>then the <b>SET OF</b> is missing and the encoding is technically invalid (but it is tolerated). See the description of the command line option <b>-asn1-kludge</b> for more information.</p>
<h1 id="BUGS">BUGS</h1>
<p>OpenSSL's handling of T61Strings (aka TeletexStrings) is broken: it effectively treats them as ISO-8859-1 (Latin 1), Netscape and MSIE have similar behaviour. This can cause problems if you need characters that aren't available in PrintableStrings and you don't want to or can't use BMPStrings.</p>
<p>As a consequence of the T61String handling the only correct way to represent accented characters in OpenSSL is to use a BMPString: unfortunately Netscape currently chokes on these. If you have to use accented characters with Netscape and MSIE then you currently need to use the invalid T61String form.</p>
<p>The current prompting is not very friendly. It doesn't allow you to confirm what you've just entered. Other things like extensions in certificate requests are statically defined in the configuration file. Some of these: like an email address in subjectAltName should be input by the user.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/x509.html">x509(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man5/config.html">config(5)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]d=Z��A �A openssl/html/man1/enc.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>enc</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SUPPORTED-CIPHERS">SUPPORTED CIPHERS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-enc, enc - symmetric cipher routines</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl enc -<i>cipher</i></b> [<b>-help</b>] [<b>-list</b>] [<b>-ciphers</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-pass arg</b>] [<b>-e</b>] [<b>-d</b>] [<b>-a</b>] [<b>-base64</b>] [<b>-A</b>] [<b>-k password</b>] [<b>-kfile filename</b>] [<b>-K key</b>] [<b>-iv IV</b>] [<b>-S salt</b>] [<b>-salt</b>] [<b>-nosalt</b>] [<b>-z</b>] [<b>-md digest</b>] [<b>-iter count</b>] [<b>-pbkdf2</b>] [<b>-p</b>] [<b>-P</b>] [<b>-bufsize number</b>] [<b>-nopad</b>] [<b>-debug</b>] [<b>-none</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>]</p>
<p><b>openssl</b> <i>[cipher]</i> [<b>...</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The symmetric cipher commands allow data to be encrypted or decrypted using various block and stream ciphers using keys based on passwords or explicitly provided. Base64 encoding or decoding can also be performed either by itself or in addition to the encryption or decryption.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="list"><b>-list</b></dt>
<dd>
<p>List all supported ciphers.</p>
</dd>
<dt id="ciphers"><b>-ciphers</b></dt>
<dd>
<p>Alias of -list to display all supported ciphers.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>The input filename, standard input by default.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>The output filename, standard output by default.</p>
</dd>
<dt id="pass-arg"><b>-pass arg</b></dt>
<dd>
<p>The password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="e"><b>-e</b></dt>
<dd>
<p>Encrypt the input data: this is the default.</p>
</dd>
<dt id="d"><b>-d</b></dt>
<dd>
<p>Decrypt the input data.</p>
</dd>
<dt id="a"><b>-a</b></dt>
<dd>
<p>Base64 process the data. This means that if encryption is taking place the data is base64 encoded after encryption. If decryption is set then the input data is base64 decoded before being decrypted.</p>
</dd>
<dt id="base64"><b>-base64</b></dt>
<dd>
<p>Same as <b>-a</b></p>
</dd>
<dt id="A"><b>-A</b></dt>
<dd>
<p>If the <b>-a</b> option is set then base64 process the data on one line.</p>
</dd>
<dt id="k-password"><b>-k password</b></dt>
<dd>
<p>The password to derive the key from. This is for compatibility with previous versions of OpenSSL. Superseded by the <b>-pass</b> argument.</p>
</dd>
<dt id="kfile-filename"><b>-kfile filename</b></dt>
<dd>
<p>Read the password to derive the key from the first line of <b>filename</b>. This is for compatibility with previous versions of OpenSSL. Superseded by the <b>-pass</b> argument.</p>
</dd>
<dt id="md-digest"><b>-md digest</b></dt>
<dd>
<p>Use the specified digest to create the key from the passphrase. The default algorithm is sha-256.</p>
</dd>
<dt id="iter-count"><b>-iter count</b></dt>
<dd>
<p>Use a given number of iterations on the password in deriving the encryption key. High values increase the time required to brute-force the resulting file. This option enables the use of PBKDF2 algorithm to derive the key.</p>
</dd>
<dt id="pbkdf2"><b>-pbkdf2</b></dt>
<dd>
<p>Use PBKDF2 algorithm with default iteration count unless otherwise specified.</p>
</dd>
<dt id="nosalt"><b>-nosalt</b></dt>
<dd>
<p>Don't use a salt in the key derivation routines. This option <b>SHOULD NOT</b> be used except for test purposes or compatibility with ancient versions of OpenSSL.</p>
</dd>
<dt id="salt"><b>-salt</b></dt>
<dd>
<p>Use salt (randomly generated or provide with <b>-S</b> option) when encrypting, this is the default.</p>
</dd>
<dt id="S-salt"><b>-S salt</b></dt>
<dd>
<p>The actual salt to use: this must be represented as a string of hex digits.</p>
</dd>
<dt id="K-key"><b>-K key</b></dt>
<dd>
<p>The actual key to use: this must be represented as a string comprised only of hex digits. If only the key is specified, the IV must additionally specified using the <b>-iv</b> option. When both a key and a password are specified, the key given with the <b>-K</b> option will be used and the IV generated from the password will be taken. It does not make much sense to specify both key and password.</p>
</dd>
<dt id="iv-IV"><b>-iv IV</b></dt>
<dd>
<p>The actual IV to use: this must be represented as a string comprised only of hex digits. When only the key is specified using the <b>-K</b> option, the IV must explicitly be defined. When a password is being specified using one of the other options, the IV is generated from this password.</p>
</dd>
<dt id="p"><b>-p</b></dt>
<dd>
<p>Print out the key and IV used.</p>
</dd>
<dt id="P"><b>-P</b></dt>
<dd>
<p>Print out the key and IV used then immediately exit: don't do any encryption or decryption.</p>
</dd>
<dt id="bufsize-number"><b>-bufsize number</b></dt>
<dd>
<p>Set the buffer size for I/O.</p>
</dd>
<dt id="nopad"><b>-nopad</b></dt>
<dd>
<p>Disable standard block padding.</p>
</dd>
<dt id="debug"><b>-debug</b></dt>
<dd>
<p>Debug the BIOs used for I/O.</p>
</dd>
<dt id="z"><b>-z</b></dt>
<dd>
<p>Compress or decompress encrypted data using zlib after encryption or before decryption. This option exists only if OpenSSL was compiled with the zlib or zlib-dynamic option.</p>
</dd>
<dt id="none"><b>-none</b></dt>
<dd>
<p>Use NULL cipher (no encryption or decryption of input).</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The program can be called either as <b>openssl cipher</b> or <b>openssl enc -cipher</b>. The first form doesn't work with engine-provided ciphers, because this form is processed before the configuration file is read and any ENGINEs loaded. Use the <b>list</b> command to get a list of supported ciphers.</p>
<p>Engines which provide entirely new encryption algorithms (such as the ccgost engine which provides gost89 algorithm) should be configured in the configuration file. Engines specified on the command line using -engine options can only be used for hardware-assisted implementations of ciphers which are supported by the OpenSSL core or another engine specified in the configuration file.</p>
<p>When the enc command lists supported ciphers, ciphers provided by engines, specified in the configuration files are listed too.</p>
<p>A password will be prompted for to derive the key and IV if necessary.</p>
<p>The <b>-salt</b> option should <b>ALWAYS</b> be used if the key is being derived from a password unless you want compatibility with previous versions of OpenSSL.</p>
<p>Without the <b>-salt</b> option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data. The reason for this is that without the salt the same password always generates the same encryption key. When the salt is being used the first eight bytes of the encrypted data are reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted.</p>
<p>Some of the ciphers do not have large keys and others have security implications if not used correctly. A beginner is advised to just use a strong block cipher, such as AES, in CBC mode.</p>
<p>All the block ciphers normally use PKCS#5 padding, also known as standard block padding. This allows a rudimentary integrity or password check to be performed. However, since the chance of random data passing the test is better than 1 in 256 it isn't a very good test.</p>
<p>If padding is disabled then the input data must be a multiple of the cipher block length.</p>
<p>All RC2 ciphers have the same key and effective key length.</p>
<p>Blowfish and RC5 algorithms use a 128 bit key.</p>
<h1 id="SUPPORTED-CIPHERS">SUPPORTED CIPHERS</h1>
<p>Note that some of these ciphers can be disabled at compile time and some are available only if an appropriate engine is configured in the configuration file. The output of the <b>enc</b> command run with the <b>-ciphers</b> option (that is <b>openssl enc -ciphers</b>) produces a list of ciphers, supported by your version of OpenSSL, including ones provided by configured engines.</p>
<p>The <b>enc</b> program does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the future. The <b>enc</b> interface by necessity must begin streaming output (e.g., to standard output when <b>-out</b> is not used) before the authentication tag could be validated, leading to the usage of <b>enc</b> in pipelines that begin processing untrusted data and are not capable of rolling back upon authentication failure. The AEAD modes currently in common use also suffer from catastrophic failure of confidentiality and/or integrity upon reuse of key/iv/nonce, and since <b>enc</b> places the entire burden of key/iv/nonce management upon the user, the risk of exposing AEAD modes is too great to allow. These key/iv/nonce management issues also affect other modes currently exposed in <b>enc</b>, but the failure modes are less extreme in these cases, and the functionality cannot be removed with a stable release branch. For bulk encryption of data, whether using authenticated encryption modes or other modes, <a href="../man1/cms.html">cms(1)</a> is recommended, as it provides a standard data format and performs the needed key/iv/nonce management.</p>
<pre><code>base64 Base 64
bf-cbc Blowfish in CBC mode
bf Alias for bf-cbc
blowfish Alias for bf-cbc
bf-cfb Blowfish in CFB mode
bf-ecb Blowfish in ECB mode
bf-ofb Blowfish in OFB mode
cast-cbc CAST in CBC mode
cast Alias for cast-cbc
cast5-cbc CAST5 in CBC mode
cast5-cfb CAST5 in CFB mode
cast5-ecb CAST5 in ECB mode
cast5-ofb CAST5 in OFB mode
chacha20 ChaCha20 algorithm
des-cbc DES in CBC mode
des Alias for des-cbc
des-cfb DES in CFB mode
des-ofb DES in OFB mode
des-ecb DES in ECB mode
des-ede-cbc Two key triple DES EDE in CBC mode
des-ede Two key triple DES EDE in ECB mode
des-ede-cfb Two key triple DES EDE in CFB mode
des-ede-ofb Two key triple DES EDE in OFB mode
des-ede3-cbc Three key triple DES EDE in CBC mode
des-ede3 Three key triple DES EDE in ECB mode
des3 Alias for des-ede3-cbc
des-ede3-cfb Three key triple DES EDE CFB mode
des-ede3-ofb Three key triple DES EDE in OFB mode
desx DESX algorithm.
gost89 GOST 28147-89 in CFB mode (provided by ccgost engine)
gost89-cnt `GOST 28147-89 in CNT mode (provided by ccgost engine)
idea-cbc IDEA algorithm in CBC mode
idea same as idea-cbc
idea-cfb IDEA in CFB mode
idea-ecb IDEA in ECB mode
idea-ofb IDEA in OFB mode
rc2-cbc 128 bit RC2 in CBC mode
rc2 Alias for rc2-cbc
rc2-cfb 128 bit RC2 in CFB mode
rc2-ecb 128 bit RC2 in ECB mode
rc2-ofb 128 bit RC2 in OFB mode
rc2-64-cbc 64 bit RC2 in CBC mode
rc2-40-cbc 40 bit RC2 in CBC mode
rc4 128 bit RC4
rc4-64 64 bit RC4
rc4-40 40 bit RC4
rc5-cbc RC5 cipher in CBC mode
rc5 Alias for rc5-cbc
rc5-cfb RC5 cipher in CFB mode
rc5-ecb RC5 cipher in ECB mode
rc5-ofb RC5 cipher in OFB mode
seed-cbc SEED cipher in CBC mode
seed Alias for seed-cbc
seed-cfb SEED cipher in CFB mode
seed-ecb SEED cipher in ECB mode
seed-ofb SEED cipher in OFB mode
sm4-cbc SM4 cipher in CBC mode
sm4 Alias for sm4-cbc
sm4-cfb SM4 cipher in CFB mode
sm4-ctr SM4 cipher in CTR mode
sm4-ecb SM4 cipher in ECB mode
sm4-ofb SM4 cipher in OFB mode
aes-[128|192|256]-cbc 128/192/256 bit AES in CBC mode
aes[128|192|256] Alias for aes-[128|192|256]-cbc
aes-[128|192|256]-cfb 128/192/256 bit AES in 128 bit CFB mode
aes-[128|192|256]-cfb1 128/192/256 bit AES in 1 bit CFB mode
aes-[128|192|256]-cfb8 128/192/256 bit AES in 8 bit CFB mode
aes-[128|192|256]-ctr 128/192/256 bit AES in CTR mode
aes-[128|192|256]-ecb 128/192/256 bit AES in ECB mode
aes-[128|192|256]-ofb 128/192/256 bit AES in OFB mode
aria-[128|192|256]-cbc 128/192/256 bit ARIA in CBC mode
aria[128|192|256] Alias for aria-[128|192|256]-cbc
aria-[128|192|256]-cfb 128/192/256 bit ARIA in 128 bit CFB mode
aria-[128|192|256]-cfb1 128/192/256 bit ARIA in 1 bit CFB mode
aria-[128|192|256]-cfb8 128/192/256 bit ARIA in 8 bit CFB mode
aria-[128|192|256]-ctr 128/192/256 bit ARIA in CTR mode
aria-[128|192|256]-ecb 128/192/256 bit ARIA in ECB mode
aria-[128|192|256]-ofb 128/192/256 bit ARIA in OFB mode
camellia-[128|192|256]-cbc 128/192/256 bit Camellia in CBC mode
camellia[128|192|256] Alias for camellia-[128|192|256]-cbc
camellia-[128|192|256]-cfb 128/192/256 bit Camellia in 128 bit CFB mode
camellia-[128|192|256]-cfb1 128/192/256 bit Camellia in 1 bit CFB mode
camellia-[128|192|256]-cfb8 128/192/256 bit Camellia in 8 bit CFB mode
camellia-[128|192|256]-ctr 128/192/256 bit Camellia in CTR mode
camellia-[128|192|256]-ecb 128/192/256 bit Camellia in ECB mode
camellia-[128|192|256]-ofb 128/192/256 bit Camellia in OFB mode</code></pre>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Just base64 encode a binary file:</p>
<pre><code>openssl base64 -in file.bin -out file.b64</code></pre>
<p>Decode the same file</p>
<pre><code>openssl base64 -d -in file.b64 -out file.bin</code></pre>
<p>Encrypt a file using AES-128 using a prompted password and PBKDF2 key derivation:</p>
<pre><code>openssl enc -aes128 -pbkdf2 -in file.txt -out file.aes128</code></pre>
<p>Decrypt a file using a supplied password:</p>
<pre><code>openssl enc -aes128 -pbkdf2 -d -in file.aes128 -out file.txt \
-pass pass:<password></code></pre>
<p>Encrypt a file then base64 encode it (so it can be sent via mail for example) using AES-256 in CTR mode and PBKDF2 key derivation:</p>
<pre><code>openssl enc -aes-256-ctr -pbkdf2 -a -in file.txt -out file.aes256</code></pre>
<p>Base64 decode a file then decrypt it using a password supplied in a file:</p>
<pre><code>openssl enc -aes-256-ctr -pbkdf2 -d -a -in file.aes256 -out file.txt \
-pass file:<passfile></code></pre>
<h1 id="BUGS">BUGS</h1>
<p>The <b>-A</b> option when used with large files doesn't work properly.</p>
<p>The <b>enc</b> program only supports a fixed number of algorithms with certain parameters. So if, for example, you want to use RC2 with a 76 bit key or RC4 with an 84 bit key you can't use this program.</p>
<h1 id="HISTORY">HISTORY</h1>
<p>The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0.</p>
<p>The <b>-list</b> option was added in OpenSSL 1.1.1e.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]߮��9 9 openssl/html/man1/verify.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>verify</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#VERIFY-OPERATION">VERIFY OPERATION</a></li>
<li><a href="#DIAGNOSTICS">DIAGNOSTICS</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-verify, verify - Utility to verify certificates</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>verify</b> [<b>-help</b>] [<b>-CAfile file</b>] [<b>-CApath directory</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-allow_proxy_certs</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-CRLfile file</b>] [<b>-crl_download</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-engine id</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-nameopt option</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-untrusted file</b>] [<b>-trusted file</b>] [<b>-use_deltas</b>] [<b>-verbose</b>] [<b>-auth_level level</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-show_chain</b>] [<b>-</b>] [certificates]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>verify</b> command verifies certificate chains.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="CAfile-file"><b>-CAfile file</b></dt>
<dd>
<p>A <b>file</b> of trusted certificates. The file should contain one or more certificates in PEM format.</p>
</dd>
<dt id="CApath-directory"><b>-CApath directory</b></dt>
<dd>
<p>A directory of trusted certificates. The certificates should have names of the form: hash.0 or have symbolic links to them of this form ("hash" is the hashed certificate subject name: see the <b>-hash</b> option of the <b>x509</b> utility). Under Unix the <b>c_rehash</b> script will automatically create symbolic links to a directory of certificates.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location.</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location.</p>
</dd>
<dt id="allow_proxy_certs"><b>-allow_proxy_certs</b></dt>
<dd>
<p>Allow the verification of proxy certificates.</p>
</dd>
<dt id="attime-timestamp"><b>-attime timestamp</b></dt>
<dd>
<p>Perform validation checks using time specified by <b>timestamp</b> and not current system time. <b>timestamp</b> is the number of seconds since 01.01.1970 (UNIX time).</p>
</dd>
<dt id="check_ss_sig"><b>-check_ss_sig</b></dt>
<dd>
<p>Verify the signature of the last certificate in a chain if the certificate is supposedly self-signed. This is prohibited and will result in an error if it is a non-conforming CA certificate with key usage restrictions not including the keyCertSign bit. This verification is disabled by default because it doesn't add any security.</p>
</dd>
<dt id="CRLfile-file"><b>-CRLfile file</b></dt>
<dd>
<p>The <b>file</b> should contain one or more CRLs in PEM format. This option can be specified more than once to include CRLs from multiple <b>files</b>.</p>
</dd>
<dt id="crl_download"><b>-crl_download</b></dt>
<dd>
<p>Attempt to download CRL information for this certificate.</p>
</dd>
<dt id="crl_check"><b>-crl_check</b></dt>
<dd>
<p>Checks end entity certificate validity by attempting to look up a valid CRL. If a valid CRL cannot be found an error occurs.</p>
</dd>
<dt id="crl_check_all"><b>-crl_check_all</b></dt>
<dd>
<p>Checks the validity of <b>all</b> certificates in the chain by attempting to look up valid CRLs.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine <b>id</b> will cause <a href="../man1/verify.html">verify(1)</a> to attempt to load the specified engine. The engine will then be set as the default for all its supported algorithms. If you want to load certificates or CRLs that require engine support via any of the <b>-trusted</b>, <b>-untrusted</b> or <b>-CRLfile</b> options, the <b>-engine</b> option must be specified before those options.</p>
</dd>
<dt id="explicit_policy"><b>-explicit_policy</b></dt>
<dd>
<p>Set policy variable require-explicit-policy (see RFC5280).</p>
</dd>
<dt id="extended_crl"><b>-extended_crl</b></dt>
<dd>
<p>Enable extended CRL features such as indirect CRLs and alternate CRL signing keys.</p>
</dd>
<dt id="ignore_critical"><b>-ignore_critical</b></dt>
<dd>
<p>Normally if an unhandled critical extension is present which is not supported by OpenSSL the certificate is rejected (as required by RFC5280). If this option is set critical extensions are ignored.</p>
</dd>
<dt id="inhibit_any"><b>-inhibit_any</b></dt>
<dd>
<p>Set policy variable inhibit-any-policy (see RFC5280).</p>
</dd>
<dt id="inhibit_map"><b>-inhibit_map</b></dt>
<dd>
<p>Set policy variable inhibit-policy-mapping (see RFC5280).</p>
</dd>
<dt id="nameopt-option"><b>-nameopt option</b></dt>
<dd>
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
</dd>
<dt id="no_check_time"><b>-no_check_time</b></dt>
<dd>
<p>This option suppresses checking the validity period of certificates and CRLs against the current time. If option <b>-attime timestamp</b> is used to specify a verification time, the check is not suppressed.</p>
</dd>
<dt id="partial_chain"><b>-partial_chain</b></dt>
<dd>
<p>Allow verification to succeed even if a <i>complete</i> chain cannot be built to a self-signed trust-anchor, provided it is possible to construct a chain to a trusted certificate that might not be self-signed.</p>
</dd>
<dt id="policy-arg"><b>-policy arg</b></dt>
<dd>
<p>Enable policy processing and add <b>arg</b> to the user-initial-policy-set (see RFC5280). The policy <b>arg</b> can be an object name an OID in numeric form. This argument can appear more than once.</p>
</dd>
<dt id="policy_check"><b>-policy_check</b></dt>
<dd>
<p>Enables certificate policy processing.</p>
</dd>
<dt id="policy_print"><b>-policy_print</b></dt>
<dd>
<p>Print out diagnostics related to policy processing.</p>
</dd>
<dt id="purpose-purpose"><b>-purpose purpose</b></dt>
<dd>
<p>The intended use for the certificate. If this option is not specified, <b>verify</b> will not consider certificate purpose during chain verification. Currently accepted uses are <b>sslclient</b>, <b>sslserver</b>, <b>nssslserver</b>, <b>smimesign</b>, <b>smimeencrypt</b>. See the <b>VERIFY OPERATION</b> section for more information.</p>
</dd>
<dt id="suiteB_128_only--suiteB_128--suiteB_192"><b>-suiteB_128_only</b>, <b>-suiteB_128</b>, <b>-suiteB_192</b></dt>
<dd>
<p>Enable the Suite B mode operation at 128 bit Level of Security, 128 bit or 192 bit, or only 192 bit Level of Security respectively. See RFC6460 for details. In particular the supported signature algorithms are reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves P-256 and P-384.</p>
</dd>
<dt id="trusted_first"><b>-trusted_first</b></dt>
<dd>
<p>When constructing the certificate chain, use the trusted certificates specified via <b>-CAfile</b>, <b>-CApath</b> or <b>-trusted</b> before any certificates specified via <b>-untrusted</b>. This can be useful in environments with Bridge or Cross-Certified CAs. As of OpenSSL 1.1.0 this option is on by default and cannot be disabled.</p>
</dd>
<dt id="no_alt_chains"><b>-no_alt_chains</b></dt>
<dd>
<p>By default, unless <b>-trusted_first</b> is specified, when building a certificate chain, if the first certificate chain found is not trusted, then OpenSSL will attempt to replace untrusted issuer certificates with certificates from the trust store to see if an alternative chain can be found that is trusted. As of OpenSSL 1.1.0, with <b>-trusted_first</b> always on, this option has no effect.</p>
</dd>
<dt id="untrusted-file"><b>-untrusted file</b></dt>
<dd>
<p>A <b>file</b> of additional untrusted certificates (intermediate issuer CAs) used to construct a certificate chain from the subject certificate to a trust-anchor. The <b>file</b> should contain one or more certificates in PEM format. This option can be specified more than once to include untrusted certificates from multiple <b>files</b>.</p>
</dd>
<dt id="trusted-file"><b>-trusted file</b></dt>
<dd>
<p>A <b>file</b> of trusted certificates, which must be self-signed, unless the <b>-partial_chain</b> option is specified. The <b>file</b> contains one or more certificates in PEM format. With this option, no additional (e.g., default) certificate lists are consulted. That is, the only trust-anchors are those listed in <b>file</b>. This option can be specified more than once to include trusted certificates from multiple <b>files</b>. This option implies the <b>-no-CAfile</b> and <b>-no-CApath</b> options. This option cannot be used in combination with either of the <b>-CAfile</b> or <b>-CApath</b> options.</p>
</dd>
<dt id="use_deltas"><b>-use_deltas</b></dt>
<dd>
<p>Enable support for delta CRLs.</p>
</dd>
<dt id="verbose"><b>-verbose</b></dt>
<dd>
<p>Print extra information about the operations being performed.</p>
</dd>
<dt id="auth_level-level"><b>-auth_level level</b></dt>
<dd>
<p>Set the certificate chain authentication security level to <b>level</b>. The authentication security level determines the acceptable signature and public key strength when verifying certificate chains. For a certificate chain to validate, the public keys of all the certificates must meet the specified security <b>level</b>. The signature algorithm security level is enforced for all the certificates in the chain except for the chain's <i>trust anchor</i>, which is either directly trusted or validated by means other than its signature. See <a href="../man3/SSL_CTX_set_security_level.html">SSL_CTX_set_security_level(3)</a> for the definitions of the available levels. The default security level is -1, or "not set". At security level 0 or lower all algorithms are acceptable. Security level 1 requires at least 80-bit-equivalent security and is broadly interoperable, though it will, for example, reject MD5 signatures or RSA keys shorter than 1024 bits.</p>
</dd>
<dt id="verify_depth-num"><b>-verify_depth num</b></dt>
<dd>
<p>Limit the certificate chain to <b>num</b> intermediate CA certificates. A maximal depth chain can have up to <b>num+2</b> certificates, since neither the end-entity certificate nor the trust-anchor certificate count against the <b>-verify_depth</b> limit.</p>
</dd>
<dt id="verify_email-email"><b>-verify_email email</b></dt>
<dd>
<p>Verify if the <b>email</b> matches the email address in Subject Alternative Name or the email in the subject Distinguished Name.</p>
</dd>
<dt id="verify_hostname-hostname"><b>-verify_hostname hostname</b></dt>
<dd>
<p>Verify if the <b>hostname</b> matches DNS name in Subject Alternative Name or Common Name in the subject certificate.</p>
</dd>
<dt id="verify_ip-ip"><b>-verify_ip ip</b></dt>
<dd>
<p>Verify if the <b>ip</b> matches the IP address in Subject Alternative Name of the subject certificate.</p>
</dd>
<dt id="verify_name-name"><b>-verify_name name</b></dt>
<dd>
<p>Use default verification policies like trust model and required certificate policies identified by <b>name</b>. The trust model determines which auxiliary trust or reject OIDs are applicable to verifying the given certificate chain. See the <b>-addtrust</b> and <b>-addreject</b> options of the <a href="../man1/x509.html">x509(1)</a> command-line utility. Supported policy names include: <b>default</b>, <b>pkcs7</b>, <b>smime_sign</b>, <b>ssl_client</b>, <b>ssl_server</b>. These mimics the combinations of purpose and trust settings used in SSL, CMS and S/MIME. As of OpenSSL 1.1.0, the trust model is inferred from the purpose when not specified, so the <b>-verify_name</b> options are functionally equivalent to the corresponding <b>-purpose</b> settings.</p>
</dd>
<dt id="x509_strict"><b>-x509_strict</b></dt>
<dd>
<p>For strict X.509 compliance, disable non-compliant workarounds for broken certificates.</p>
</dd>
<dt id="show_chain"><b>-show_chain</b></dt>
<dd>
<p>Display information about the certificate chain that has been built (if successful). Certificates in the chain that came from the untrusted list will be flagged as "untrusted".</p>
</dd>
<dt id="pod"><b>-</b></dt>
<dd>
<p>Indicates the last option. All arguments following this are assumed to be certificate files. This is useful if the first certificate filename begins with a <b>-</b>.</p>
</dd>
<dt id="certificates"><b>certificates</b></dt>
<dd>
<p>One or more certificates to verify. If no certificates are given, <b>verify</b> will attempt to read a certificate from standard input. Certificates must be in PEM format.</p>
</dd>
</dl>
<h1 id="VERIFY-OPERATION">VERIFY OPERATION</h1>
<p>The <b>verify</b> program uses the same functions as the internal SSL and S/MIME verification, therefore, this description applies to these verify operations too.</p>
<p>There is one crucial difference between the verify operations performed by the <b>verify</b> program: wherever possible an attempt is made to continue after an error whereas normally the verify operation would halt on the first error. This allows all the problems with a certificate chain to be determined.</p>
<p>The verify operation consists of a number of separate steps.</p>
<p>Firstly a certificate chain is built up starting from the supplied certificate and ending in the root CA. It is an error if the whole chain cannot be built up. The chain is built up by looking up the issuers certificate of the current certificate. If a certificate is found which is its own issuer it is assumed to be the root CA.</p>
<p>The process of 'looking up the issuers certificate' itself involves a number of steps. After all certificates whose subject name matches the issuer name of the current certificate are subject to further tests. The relevant authority key identifier components of the current certificate (if present) must match the subject key identifier (if present) and issuer and serial number of the candidate issuer, in addition the keyUsage extension of the candidate issuer (if present) must permit certificate signing.</p>
<p>The lookup first looks in the list of untrusted certificates and if no match is found the remaining lookups are from the trusted certificates. The root CA is always looked up in the trusted certificate list: if the certificate to verify is a root certificate then an exact match must be found in the trusted list.</p>
<p>The second operation is to check every untrusted certificate's extensions for consistency with the supplied purpose. If the <b>-purpose</b> option is not included then no checks are done. The supplied or "leaf" certificate must have extensions compatible with the supplied purpose and all other certificates must also be valid CA certificates. The precise extensions required are described in more detail in the <b>CERTIFICATE EXTENSIONS</b> section of the <b>x509</b> utility.</p>
<p>The third operation is to check the trust settings on the root CA. The root CA should be trusted for the supplied purpose. For compatibility with previous versions of OpenSSL, a certificate with no trust settings is considered to be valid for all purposes.</p>
<p>The final operation is to check the validity of the certificate chain. For each element in the chain, including the root CA certificate, the validity period as specified by the <code>notBefore</code> and <code>notAfter</code> fields is checked against the current system time. The <b>-attime</b> flag may be used to use a reference time other than "now." The certificate signature is checked as well (except for the signature of the typically self-signed root CA certificate, which is verified only if the <b>-check_ss_sig</b> option is given).</p>
<p>If all operations complete successfully then certificate is considered valid. If any operation fails then the certificate is not valid.</p>
<h1 id="DIAGNOSTICS">DIAGNOSTICS</h1>
<p>When a verify operation fails the output messages can be somewhat cryptic. The general form of the error message is:</p>
<pre><code>server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
error 24 at 1 depth lookup:invalid CA certificate</code></pre>
<p>The first line contains the name of the certificate being verified followed by the subject name of the certificate. The second line contains the error number and the depth. The depth is number of the certificate being verified when a problem was detected starting with zero for the certificate being verified itself then 1 for the CA that signed the certificate and so on. Finally a text version of the error number is presented.</p>
<p>A partial list of the error codes and messages is shown below, this also includes the name of the error code as defined in the header file x509_vfy.h Some of the error codes are defined but never returned: these are described as "unused".</p>
<dl>
<dt id="X509_V_OK"><b>X509_V_OK</b></dt>
<dd>
<p>The operation was successful.</p>
</dd>
<dt id="X509_V_ERR_UNSPECIFIED"><b>X509_V_ERR_UNSPECIFIED</b></dt>
<dd>
<p>Unspecified error; should not happen.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT"><b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT</b></dt>
<dd>
<p>The issuer certificate of a looked up certificate could not be found. This normally means the list of trusted certificates is not complete.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_GET_CRL"><b>X509_V_ERR_UNABLE_TO_GET_CRL</b></dt>
<dd>
<p>The CRL of a certificate could not be found.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE"><b>X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE</b></dt>
<dd>
<p>The certificate signature could not be decrypted. This means that the actual signature value could not be determined rather than it not matching the expected value, this is only meaningful for RSA keys.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE"><b>X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE</b></dt>
<dd>
<p>The CRL signature could not be decrypted: this means that the actual signature value could not be determined rather than it not matching the expected value. Unused.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY"><b>X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY</b></dt>
<dd>
<p>The public key in the certificate SubjectPublicKeyInfo could not be read.</p>
</dd>
<dt id="X509_V_ERR_CERT_SIGNATURE_FAILURE"><b>X509_V_ERR_CERT_SIGNATURE_FAILURE</b></dt>
<dd>
<p>The signature of the certificate is invalid.</p>
</dd>
<dt id="X509_V_ERR_CRL_SIGNATURE_FAILURE"><b>X509_V_ERR_CRL_SIGNATURE_FAILURE</b></dt>
<dd>
<p>The signature of the certificate is invalid.</p>
</dd>
<dt id="X509_V_ERR_CERT_NOT_YET_VALID"><b>X509_V_ERR_CERT_NOT_YET_VALID</b></dt>
<dd>
<p>The certificate is not yet valid: the notBefore date is after the current time.</p>
</dd>
<dt id="X509_V_ERR_CERT_HAS_EXPIRED"><b>X509_V_ERR_CERT_HAS_EXPIRED</b></dt>
<dd>
<p>The certificate has expired: that is the notAfter date is before the current time.</p>
</dd>
<dt id="X509_V_ERR_CRL_NOT_YET_VALID"><b>X509_V_ERR_CRL_NOT_YET_VALID</b></dt>
<dd>
<p>The CRL is not yet valid.</p>
</dd>
<dt id="X509_V_ERR_CRL_HAS_EXPIRED"><b>X509_V_ERR_CRL_HAS_EXPIRED</b></dt>
<dd>
<p>The CRL has expired.</p>
</dd>
<dt id="X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD"><b>X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD</b></dt>
<dd>
<p>The certificate notBefore field contains an invalid time.</p>
</dd>
<dt id="X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD"><b>X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD</b></dt>
<dd>
<p>The certificate notAfter field contains an invalid time.</p>
</dd>
<dt id="X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD"><b>X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD</b></dt>
<dd>
<p>The CRL lastUpdate field contains an invalid time.</p>
</dd>
<dt id="X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD"><b>X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD</b></dt>
<dd>
<p>The CRL nextUpdate field contains an invalid time.</p>
</dd>
<dt id="X509_V_ERR_OUT_OF_MEM"><b>X509_V_ERR_OUT_OF_MEM</b></dt>
<dd>
<p>An error occurred trying to allocate memory. This should never happen.</p>
</dd>
<dt id="X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT"><b>X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT</b></dt>
<dd>
<p>The passed certificate is self-signed and the same certificate cannot be found in the list of trusted certificates.</p>
</dd>
<dt id="X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN"><b>X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN</b></dt>
<dd>
<p>The certificate chain could be built up using the untrusted certificates but the root could not be found locally.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY"><b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY</b></dt>
<dd>
<p>The issuer certificate could not be found: this occurs if the issuer certificate of an untrusted certificate cannot be found.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE"><b>X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE</b></dt>
<dd>
<p>No signatures could be verified because the chain contains only one certificate and it is not self signed.</p>
</dd>
<dt id="X509_V_ERR_CERT_CHAIN_TOO_LONG"><b>X509_V_ERR_CERT_CHAIN_TOO_LONG</b></dt>
<dd>
<p>The certificate chain length is greater than the supplied maximum depth. Unused.</p>
</dd>
<dt id="X509_V_ERR_CERT_REVOKED"><b>X509_V_ERR_CERT_REVOKED</b></dt>
<dd>
<p>The certificate has been revoked.</p>
</dd>
<dt id="X509_V_ERR_INVALID_CA"><b>X509_V_ERR_INVALID_CA</b></dt>
<dd>
<p>A CA certificate is invalid. Either it is not a CA or its extensions are not consistent with the supplied purpose.</p>
</dd>
<dt id="X509_V_ERR_PATH_LENGTH_EXCEEDED"><b>X509_V_ERR_PATH_LENGTH_EXCEEDED</b></dt>
<dd>
<p>The basicConstraints pathlength parameter has been exceeded.</p>
</dd>
<dt id="X509_V_ERR_INVALID_PURPOSE"><b>X509_V_ERR_INVALID_PURPOSE</b></dt>
<dd>
<p>The supplied certificate cannot be used for the specified purpose.</p>
</dd>
<dt id="X509_V_ERR_CERT_UNTRUSTED"><b>X509_V_ERR_CERT_UNTRUSTED</b></dt>
<dd>
<p>The root CA is not marked as trusted for the specified purpose.</p>
</dd>
<dt id="X509_V_ERR_CERT_REJECTED"><b>X509_V_ERR_CERT_REJECTED</b></dt>
<dd>
<p>The root CA is marked to reject the specified purpose.</p>
</dd>
<dt id="X509_V_ERR_SUBJECT_ISSUER_MISMATCH"><b>X509_V_ERR_SUBJECT_ISSUER_MISMATCH</b></dt>
<dd>
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
</dd>
<dt id="X509_V_ERR_AKID_SKID_MISMATCH"><b>X509_V_ERR_AKID_SKID_MISMATCH</b></dt>
<dd>
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
</dd>
<dt id="X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH"><b>X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH</b></dt>
<dd>
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
</dd>
<dt id="X509_V_ERR_KEYUSAGE_NO_CERTSIGN"><b>X509_V_ERR_KEYUSAGE_NO_CERTSIGN</b></dt>
<dd>
<p>Not used as of OpenSSL 1.1.0 as a result of the deprecation of the <b>-issuer_checks</b> option.</p>
</dd>
<dt id="X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER"><b>X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER</b></dt>
<dd>
<p>Unable to get CRL issuer certificate.</p>
</dd>
<dt id="X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION"><b>X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION</b></dt>
<dd>
<p>Unhandled critical extension.</p>
</dd>
<dt id="X509_V_ERR_KEYUSAGE_NO_CRL_SIGN"><b>X509_V_ERR_KEYUSAGE_NO_CRL_SIGN</b></dt>
<dd>
<p>Key usage does not include CRL signing.</p>
</dd>
<dt id="X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION"><b>X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION</b></dt>
<dd>
<p>Unhandled critical CRL extension.</p>
</dd>
<dt id="X509_V_ERR_INVALID_NON_CA"><b>X509_V_ERR_INVALID_NON_CA</b></dt>
<dd>
<p>Invalid non-CA certificate has CA markings.</p>
</dd>
<dt id="X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED"><b>X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED</b></dt>
<dd>
<p>Proxy path length constraint exceeded.</p>
</dd>
<dt id="X509_V_ERR_PROXY_SUBJECT_INVALID"><b>X509_V_ERR_PROXY_SUBJECT_INVALID</b></dt>
<dd>
<p>Proxy certificate subject is invalid. It MUST be the same as the issuer with a single CN component added.</p>
</dd>
<dt id="X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE"><b>X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE</b></dt>
<dd>
<p>Key usage does not include digital signature.</p>
</dd>
<dt id="X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED"><b>X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED</b></dt>
<dd>
<p>Proxy certificates not allowed, please use <b>-allow_proxy_certs</b>.</p>
</dd>
<dt id="X509_V_ERR_INVALID_EXTENSION"><b>X509_V_ERR_INVALID_EXTENSION</b></dt>
<dd>
<p>Invalid or inconsistent certificate extension.</p>
</dd>
<dt id="X509_V_ERR_INVALID_POLICY_EXTENSION"><b>X509_V_ERR_INVALID_POLICY_EXTENSION</b></dt>
<dd>
<p>Invalid or inconsistent certificate policy extension.</p>
</dd>
<dt id="X509_V_ERR_NO_EXPLICIT_POLICY"><b>X509_V_ERR_NO_EXPLICIT_POLICY</b></dt>
<dd>
<p>No explicit policy.</p>
</dd>
<dt id="X509_V_ERR_DIFFERENT_CRL_SCOPE"><b>X509_V_ERR_DIFFERENT_CRL_SCOPE</b></dt>
<dd>
<p>Different CRL scope.</p>
</dd>
<dt id="X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE"><b>X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE</b></dt>
<dd>
<p>Unsupported extension feature.</p>
</dd>
<dt id="X509_V_ERR_UNNESTED_RESOURCE"><b>X509_V_ERR_UNNESTED_RESOURCE</b></dt>
<dd>
<p>RFC 3779 resource not subset of parent's resources.</p>
</dd>
<dt id="X509_V_ERR_PERMITTED_VIOLATION"><b>X509_V_ERR_PERMITTED_VIOLATION</b></dt>
<dd>
<p>Permitted subtree violation.</p>
</dd>
<dt id="X509_V_ERR_EXCLUDED_VIOLATION"><b>X509_V_ERR_EXCLUDED_VIOLATION</b></dt>
<dd>
<p>Excluded subtree violation.</p>
</dd>
<dt id="X509_V_ERR_SUBTREE_MINMAX"><b>X509_V_ERR_SUBTREE_MINMAX</b></dt>
<dd>
<p>Name constraints minimum and maximum not supported.</p>
</dd>
<dt id="X509_V_ERR_APPLICATION_VERIFICATION"><b>X509_V_ERR_APPLICATION_VERIFICATION</b></dt>
<dd>
<p>Application verification failure. Unused.</p>
</dd>
<dt id="X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE"><b>X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE</b></dt>
<dd>
<p>Unsupported name constraint type.</p>
</dd>
<dt id="X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX"><b>X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX</b></dt>
<dd>
<p>Unsupported or invalid name constraint syntax.</p>
</dd>
<dt id="X509_V_ERR_UNSUPPORTED_NAME_SYNTAX"><b>X509_V_ERR_UNSUPPORTED_NAME_SYNTAX</b></dt>
<dd>
<p>Unsupported or invalid name syntax.</p>
</dd>
<dt id="X509_V_ERR_CRL_PATH_VALIDATION_ERROR"><b>X509_V_ERR_CRL_PATH_VALIDATION_ERROR</b></dt>
<dd>
<p>CRL path validation error.</p>
</dd>
<dt id="X509_V_ERR_PATH_LOOP"><b>X509_V_ERR_PATH_LOOP</b></dt>
<dd>
<p>Path loop.</p>
</dd>
<dt id="X509_V_ERR_SUITE_B_INVALID_VERSION"><b>X509_V_ERR_SUITE_B_INVALID_VERSION</b></dt>
<dd>
<p>Suite B: certificate version invalid.</p>
</dd>
<dt id="X509_V_ERR_SUITE_B_INVALID_ALGORITHM"><b>X509_V_ERR_SUITE_B_INVALID_ALGORITHM</b></dt>
<dd>
<p>Suite B: invalid public key algorithm.</p>
</dd>
<dt id="X509_V_ERR_SUITE_B_INVALID_CURVE"><b>X509_V_ERR_SUITE_B_INVALID_CURVE</b></dt>
<dd>
<p>Suite B: invalid ECC curve.</p>
</dd>
<dt id="X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM"><b>X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM</b></dt>
<dd>
<p>Suite B: invalid signature algorithm.</p>
</dd>
<dt id="X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED"><b>X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED</b></dt>
<dd>
<p>Suite B: curve not allowed for this LOS.</p>
</dd>
<dt id="X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256"><b>X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256</b></dt>
<dd>
<p>Suite B: cannot sign P-384 with P-256.</p>
</dd>
<dt id="X509_V_ERR_HOSTNAME_MISMATCH"><b>X509_V_ERR_HOSTNAME_MISMATCH</b></dt>
<dd>
<p>Hostname mismatch.</p>
</dd>
<dt id="X509_V_ERR_EMAIL_MISMATCH"><b>X509_V_ERR_EMAIL_MISMATCH</b></dt>
<dd>
<p>Email address mismatch.</p>
</dd>
<dt id="X509_V_ERR_IP_ADDRESS_MISMATCH"><b>X509_V_ERR_IP_ADDRESS_MISMATCH</b></dt>
<dd>
<p>IP address mismatch.</p>
</dd>
<dt id="X509_V_ERR_DANE_NO_MATCH"><b>X509_V_ERR_DANE_NO_MATCH</b></dt>
<dd>
<p>DANE TLSA authentication is enabled, but no TLSA records matched the certificate chain. This error is only possible in <a href="../man1/s_client.html">s_client(1)</a>.</p>
</dd>
<dt id="X509_V_ERR_EE_KEY_TOO_SMALL"><b>X509_V_ERR_EE_KEY_TOO_SMALL</b></dt>
<dd>
<p>EE certificate key too weak.</p>
</dd>
<dt id="X509_ERR_CA_KEY_TOO_SMALL"><b>X509_ERR_CA_KEY_TOO_SMALL</b></dt>
<dd>
<p>CA certificate key too weak.</p>
</dd>
<dt id="X509_ERR_CA_MD_TOO_WEAK"><b>X509_ERR_CA_MD_TOO_WEAK</b></dt>
<dd>
<p>CA signature digest algorithm too weak.</p>
</dd>
<dt id="X509_V_ERR_INVALID_CALL"><b>X509_V_ERR_INVALID_CALL</b></dt>
<dd>
<p>nvalid certificate verification context.</p>
</dd>
<dt id="X509_V_ERR_STORE_LOOKUP"><b>X509_V_ERR_STORE_LOOKUP</b></dt>
<dd>
<p>Issuer certificate lookup error.</p>
</dd>
<dt id="X509_V_ERR_NO_VALID_SCTS"><b>X509_V_ERR_NO_VALID_SCTS</b></dt>
<dd>
<p>Certificate Transparency required, but no valid SCTs found.</p>
</dd>
<dt id="X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION"><b>X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION</b></dt>
<dd>
<p>Proxy subject name violation.</p>
</dd>
<dt id="X509_V_ERR_OCSP_VERIFY_NEEDED"><b>X509_V_ERR_OCSP_VERIFY_NEEDED</b></dt>
<dd>
<p>Returned by the verify callback to indicate an OCSP verification is needed.</p>
</dd>
<dt id="X509_V_ERR_OCSP_VERIFY_FAILED"><b>X509_V_ERR_OCSP_VERIFY_FAILED</b></dt>
<dd>
<p>Returned by the verify callback to indicate OCSP verification failed.</p>
</dd>
<dt id="X509_V_ERR_OCSP_CERT_UNKNOWN"><b>X509_V_ERR_OCSP_CERT_UNKNOWN</b></dt>
<dd>
<p>Returned by the verify callback to indicate that the certificate is not recognized by the OCSP responder.</p>
</dd>
</dl>
<h1 id="BUGS">BUGS</h1>
<p>Although the issuer checks are a considerable improvement over the old technique they still suffer from limitations in the underlying X509_LOOKUP API. One consequence of this is that trusted certificates with matching subject name must either appear in a file (as specified by the <b>-CAfile</b> option) or a directory (as specified by <b>-CApath</b>). If they occur in both then only the certificates in the file will be recognised.</p>
<p>Previous versions of OpenSSL assume certificates with matching subject name are identical and mishandled them.</p>
<p>Previous versions of this documentation swapped the meaning of the <b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT</b> and <b>X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY</b> error codes.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/x509.html">x509(1)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The <b>-show_chain</b> option was added in OpenSSL 1.1.0.</p>
<p>The <b>-issuer_checks</b> option is deprecated as of OpenSSL 1.1.0 and is silently ignored.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]O4�c c openssl/html/man1/storeutl.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>storeutl</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-storeutl, storeutl - STORE utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>storeutl</b> [<b>-help</b>] [<b>-out file</b>] [<b>-noout</b>] [<b>-passin arg</b>] [<b>-text arg</b>] [<b>-engine id</b>] [<b>-r</b>] [<b>-certs</b>] [<b>-keys</b>] [<b>-crls</b>] [<b>-subject arg</b>] [<b>-issuer arg</b>] [<b>-serial arg</b>] [<b>-alias arg</b>] [<b>-fingerprint arg</b>] [<b>-<i>digest</i></b>] <b>uri</b> ...</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>storeutl</b> command can be used to display the contents (after decryption as the case may be) fetched from the given URIs.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>this option prevents output of the PEM data.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>the key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the objects in text form, similarly to the <b>-text</b> output from <b>openssl x509</b>, <b>openssl pkey</b>, etc.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>specifying an engine (by its unique <b>id</b> string) will cause <b>storeutl</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="r"><b>-r</b></dt>
<dd>
<p>Fetch objects recursively when possible.</p>
</dd>
<dt id="certs"><b>-certs</b></dt>
<dd>
</dd>
<dt id="keys"><b>-keys</b></dt>
<dd>
</dd>
<dt id="crls"><b>-crls</b></dt>
<dd>
<p>Only select the certificates, keys or CRLs from the given URI. However, if this URI would return a set of names (URIs), those are always returned.</p>
</dd>
<dt id="subject-arg"><b>-subject arg</b></dt>
<dd>
<p>Search for an object having the subject name <b>arg</b>. The arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>. Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted but are ignored for the search. That is, a search with an empty value will have the same effect as not specifying the type at all.</p>
</dd>
<dt id="issuer-arg"><b>-issuer arg</b></dt>
<dd>
</dd>
<dt id="serial-arg"><b>-serial arg</b></dt>
<dd>
<p>Search for an object having the given issuer name and serial number. These two options <i>must</i> be used together. The issuer arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>, characters may be escaped by \ (backslash), no spaces are skipped. The serial arg may be specified as a decimal value or a hex value if preceded by <b>0x</b>.</p>
</dd>
<dt id="alias-arg"><b>-alias arg</b></dt>
<dd>
<p>Search for an object having the given alias.</p>
</dd>
<dt id="fingerprint-arg"><b>-fingerprint arg</b></dt>
<dd>
<p>Search for an object having the given fingerprint.</p>
</dd>
<dt id="digest"><b>-<i>digest</i></b></dt>
<dd>
<p>The digest that was used to compute the fingerprint given with <b>-fingerprint</b>.</p>
</dd>
</dl>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/openssl.html">openssl(1)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The <b>openssl</b> <b>storeutl</b> app was added in OpenSSL 1.1.1.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]��DE� � openssl/html/man1/speed.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>speed</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-speed, speed - test library performance</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl speed</b> [<b>-help</b>] [<b>-engine id</b>] [<b>-elapsed</b>] [<b>-evp algo</b>] [<b>-decrypt</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-primes num</b>] [<b>-seconds num</b>] [<b>-bytes num</b>] [<b>algorithm...</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>This command is used to test the performance of cryptographic algorithms. To see the list of supported algorithms, use the <i>list --digest-commands</i> or <i>list --cipher-commands</i> command. The global CSPRNG is denoted by the <i>rand</i> algorithm name.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>speed</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="elapsed"><b>-elapsed</b></dt>
<dd>
<p>When calculating operations- or bytes-per-second, use wall-clock time instead of CPU user time as divisor. It can be useful when testing speed of hardware engines.</p>
</dd>
<dt id="evp-algo"><b>-evp algo</b></dt>
<dd>
<p>Use the specified cipher or message digest algorithm via the EVP interface. If <b>algo</b> is an AEAD cipher, then you can pass <-aead> to benchmark a TLS-like sequence. And if <b>algo</b> is a multi-buffer capable cipher, e.g. aes-128-cbc-hmac-sha1, then <b>-mb</b> will time multi-buffer operation.</p>
</dd>
<dt id="decrypt"><b>-decrypt</b></dt>
<dd>
<p>Time the decryption instead of encryption. Affects only the EVP testing.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="primes-num"><b>-primes num</b></dt>
<dd>
<p>Generate a <b>num</b>-prime RSA key and use it to run the benchmarks. This option is only effective if RSA algorithm is specified to test.</p>
</dd>
<dt id="seconds-num"><b>-seconds num</b></dt>
<dd>
<p>Run benchmarks for <b>num</b> seconds.</p>
</dd>
<dt id="bytes-num"><b>-bytes num</b></dt>
<dd>
<p>Run benchmarks on <b>num</b>-byte buffers. Affects ciphers, digests and the CSPRNG.</p>
</dd>
<dt id="zero-or-more-test-algorithms"><b>[zero or more test algorithms]</b></dt>
<dd>
<p>If any options are given, <b>speed</b> tests those algorithms, otherwise a pre-compiled grand selection is tested.</p>
</dd>
</dl>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]uS �h
h
openssl/html/man1/pkeyparam.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>pkeyparam</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-pkeyparam, pkeyparam - public key algorithm parameter processing tool</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>pkeyparam</b> [<b>-help</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-engine id</b>] [<b>-check</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>pkeyparam</b> command processes public key algorithm parameters. They can be checked for correctness and their components printed out.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read parameters from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write parameters to or standard output if this option is not specified.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the parameters in plain text in addition to the encoded version.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>Do not output the encoded version of the parameters.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkeyparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="check"><b>-check</b></dt>
<dd>
<p>This option checks the correctness of parameters.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Print out text version of parameters:</p>
<pre><code>openssl pkeyparam -in param.pem -text</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>There are no <b>-inform</b> or <b>-outform</b> options for this command because only PEM format is supported because the key type is determined by the PEM headers.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]S<�
� � openssl/html/man1/asn1parse.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>asn1parse</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a>
<ul>
<li><a href="#Output">Output</a></li>
</ul>
</li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-asn1parse, asn1parse - ASN.1 parsing tool</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>asn1parse</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-offset number</b>] [<b>-length number</b>] [<b>-i</b>] [<b>-oid filename</b>] [<b>-dump</b>] [<b>-dlimit num</b>] [<b>-strparse offset</b>] [<b>-genstr string</b>] [<b>-genconf file</b>] [<b>-strictpem</b>] [<b>-item name</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>asn1parse</b> command is a diagnostic utility that can parse ASN.1 structures. It can also be used to extract data from ASN.1 formatted data.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform</b> <b>DER|PEM</b></dt>
<dd>
<p>The input format. <b>DER</b> is binary format and <b>PEM</b> (the default) is base64 encoded.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>The input file, default is standard input.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Output file to place the DER encoded data into. If this option is not present then no data will be output. This is most useful when combined with the <b>-strparse</b> option.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>Don't output the parsed version of the input file.</p>
</dd>
<dt id="offset-number"><b>-offset number</b></dt>
<dd>
<p>Starting offset to begin parsing, default is start of file.</p>
</dd>
<dt id="length-number"><b>-length number</b></dt>
<dd>
<p>Number of bytes to parse, default is until end of file.</p>
</dd>
<dt id="i"><b>-i</b></dt>
<dd>
<p>Indents the output according to the "depth" of the structures.</p>
</dd>
<dt id="oid-filename"><b>-oid filename</b></dt>
<dd>
<p>A file containing additional OBJECT IDENTIFIERs (OIDs). The format of this file is described in the NOTES section below.</p>
</dd>
<dt id="dump"><b>-dump</b></dt>
<dd>
<p>Dump unknown data in hex format.</p>
</dd>
<dt id="dlimit-num"><b>-dlimit num</b></dt>
<dd>
<p>Like <b>-dump</b>, but only the first <b>num</b> bytes are output.</p>
</dd>
<dt id="strparse-offset"><b>-strparse offset</b></dt>
<dd>
<p>Parse the contents octets of the ASN.1 object starting at <b>offset</b>. This option can be used multiple times to "drill down" into a nested structure.</p>
</dd>
<dt id="genstr-string--genconf-file"><b>-genstr string</b>, <b>-genconf file</b></dt>
<dd>
<p>Generate encoded data based on <b>string</b>, <b>file</b> or both using <a href="../man3/ASN1_generate_nconf.html">ASN1_generate_nconf(3)</a> format. If <b>file</b> only is present then the string is obtained from the default section using the name <b>asn1</b>. The encoded data is passed through the ASN1 parser and printed out as though it came from a file, the contents can thus be examined and written to a file using the <b>out</b> option.</p>
</dd>
<dt id="strictpem"><b>-strictpem</b></dt>
<dd>
<p>If this option is used then <b>-inform</b> will be ignored. Without this option any data in a PEM format input file will be treated as being base64 encoded and processed whether it has the normal PEM BEGIN and END markers or not. This option will ignore any data prior to the start of the BEGIN marker, or after an END marker in a PEM file.</p>
</dd>
<dt id="item-name"><b>-item name</b></dt>
<dd>
<p>Attempt to decode and print the data as <b>ASN1_ITEM name</b>. This can be used to print out the fields of any supported ASN.1 structure if the type is known.</p>
</dd>
</dl>
<h2 id="Output">Output</h2>
<p>The output will typically contain lines like this:</p>
<pre><code>0:d=0 hl=4 l= 681 cons: SEQUENCE</code></pre>
<p>.....</p>
<pre><code>229:d=3 hl=3 l= 141 prim: BIT STRING
373:d=2 hl=3 l= 162 cons: cont [ 3 ]
376:d=3 hl=3 l= 159 cons: SEQUENCE
379:d=4 hl=2 l= 29 cons: SEQUENCE
381:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
386:d=5 hl=2 l= 22 prim: OCTET STRING
410:d=4 hl=2 l= 112 cons: SEQUENCE
412:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
417:d=5 hl=2 l= 105 prim: OCTET STRING
524:d=4 hl=2 l= 12 cons: SEQUENCE</code></pre>
<p>.....</p>
<p>This example is part of a self-signed certificate. Each line starts with the offset in decimal. <b>d=XX</b> specifies the current depth. The depth is increased within the scope of any SET or SEQUENCE. <b>hl=XX</b> gives the header length (tag and length octets) of the current type. <b>l=XX</b> gives the length of the contents octets.</p>
<p>The <b>-i</b> option can be used to make the output more readable.</p>
<p>Some knowledge of the ASN.1 structure is needed to interpret the output.</p>
<p>In this example the BIT STRING at offset 229 is the certificate public key. The contents octets of this will contain the public key information. This can be examined using the option <b>-strparse 229</b> to yield:</p>
<pre><code> 0:d=0 hl=3 l= 137 cons: SEQUENCE
3:d=1 hl=3 l= 129 prim: INTEGER :E5D21E1F5C8D208EA7A2166C7FAF9F6BDF2059669C60876DDB70840F1A5AAFA59699FE471F379F1DD6A487E7D5409AB6A88D4A9746E24B91D8CF55DB3521015460C8EDE44EE8A4189F7A7BE77D6CD3A9AF2696F486855CF58BF0EDF2B4068058C7A947F52548DDF7E15E96B385F86422BEA9064A3EE9E1158A56E4A6F47E5897
135:d=1 hl=2 l= 3 prim: INTEGER :010001</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>If an OID is not part of OpenSSL's internal table it will be represented in numerical form (for example 1.2.3.4). The file passed to the <b>-oid</b> option allows additional OIDs to be included. Each line consists of three columns, the first column is the OID in numerical format and should be followed by white space. The second column is the "short name" which is a single word followed by white space. The final column is the rest of the line and is the "long name". <b>asn1parse</b> displays the long name. Example:</p>
<p><code>1.2.3.4 shortName A long name</code></p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Parse a file:</p>
<pre><code>openssl asn1parse -in file.pem</code></pre>
<p>Parse a DER file:</p>
<pre><code>openssl asn1parse -inform DER -in file.der</code></pre>
<p>Generate a simple UTF8String:</p>
<pre><code>openssl asn1parse -genstr 'UTF8:Hello World'</code></pre>
<p>Generate and write out a UTF8String, don't print parsed output:</p>
<pre><code>openssl asn1parse -genstr 'UTF8:Hello World' -noout -out utf8.der</code></pre>
<p>Generate using a config file:</p>
<pre><code>openssl asn1parse -genconf asn1.cnf -noout -out asn1.der</code></pre>
<p>Example config file:</p>
<pre><code>asn1=SEQUENCE:seq_sect
[seq_sect]
field1=BOOL:TRUE
field2=EXP:0, UTF8:some random string</code></pre>
<h1 id="BUGS">BUGS</h1>
<p>There should be options to change the format of output lines. The output of some ASN.1 types is not well handled (if at all).</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man3/ASN1_generate_nconf.html">ASN1_generate_nconf(3)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]T�z�4 �4 openssl/html/man1/pkcs8.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>pkcs8</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#KEY-FORMATS">KEY FORMATS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#PKCS-5-v1.5-and-PKCS-12-algorithms">PKCS#5 v1.5 and PKCS#12 algorithms.</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#STANDARDS">STANDARDS</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-pkcs8, pkcs8 - PKCS#8 format private key conversion tool</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>pkcs8</b> [<b>-help</b>] [<b>-topk8</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-iter count</b>] [<b>-noiter</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-nocrypt</b>] [<b>-traditional</b>] [<b>-v2 alg</b>] [<b>-v2prf alg</b>] [<b>-v1 alg</b>] [<b>-engine id</b>] [<b>-scrypt</b>] [<b>-scrypt_N N</b>] [<b>-scrypt_r r</b>] [<b>-scrypt_p p</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>pkcs8</b> command processes private keys in PKCS#8 format. It can handle both unencrypted PKCS#8 PrivateKeyInfo format and EncryptedPrivateKeyInfo format with a variety of PKCS#5 (v1.5 and v2.0) and PKCS#12 algorithms.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="topk8"><b>-topk8</b></dt>
<dd>
<p>Normally a PKCS#8 private key is expected on input and a private key will be written to the output file. With the <b>-topk8</b> option the situation is reversed: it reads a private key and writes a PKCS#8 format key.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format: see <a href="#KEY-FORMATS">"KEY FORMATS"</a> for more details. The default format is PEM.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format: see <a href="#KEY-FORMATS">"KEY FORMATS"</a> for more details. The default format is PEM.</p>
</dd>
<dt id="traditional"><b>-traditional</b></dt>
<dd>
<p>When this option is present and <b>-topk8</b> is not a traditional format private key is written.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The input file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write a key to or standard output by default. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="passout-arg"><b>-passout arg</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="iter-count"><b>-iter count</b></dt>
<dd>
<p>When creating new PKCS#8 containers, use a given number of iterations on the password in deriving the encryption key for the PKCS#8 output. High values increase the time required to brute-force a PKCS#8 container.</p>
</dd>
<dt id="nocrypt"><b>-nocrypt</b></dt>
<dd>
<p>PKCS#8 keys generated or input are normally PKCS#8 EncryptedPrivateKeyInfo structures using an appropriate password based encryption algorithm. With this option an unencrypted PrivateKeyInfo structure is expected or output. This option does not encrypt private keys at all and should only be used when absolutely necessary. Certain software such as some versions of Java code signing software used unencrypted private keys.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="v2-alg"><b>-v2 alg</b></dt>
<dd>
<p>This option sets the PKCS#5 v2.0 algorithm.</p>
<p>The <b>alg</b> argument is the encryption algorithm to use, valid values include <b>aes128</b>, <b>aes256</b> and <b>des3</b>. If this option isn't specified then <b>aes256</b> is used.</p>
</dd>
<dt id="v2prf-alg"><b>-v2prf alg</b></dt>
<dd>
<p>This option sets the PRF algorithm to use with PKCS#5 v2.0. A typical value value would be <b>hmacWithSHA256</b>. If this option isn't set then the default for the cipher is used or <b>hmacWithSHA256</b> if there is no default.</p>
<p>Some implementations may not support custom PRF algorithms and may require the <b>hmacWithSHA1</b> option to work.</p>
</dd>
<dt id="v1-alg"><b>-v1 alg</b></dt>
<dd>
<p>This option indicates a PKCS#5 v1.5 or PKCS#12 algorithm should be used. Some older implementations may not support PKCS#5 v2.0 and may require this option. If not specified PKCS#5 v2.0 form is used.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkcs8</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="scrypt"><b>-scrypt</b></dt>
<dd>
<p>Uses the <b>scrypt</b> algorithm for private key encryption using default parameters: currently N=16384, r=8 and p=1 and AES in CBC mode with a 256 bit key. These parameters can be modified using the <b>-scrypt_N</b>, <b>-scrypt_r</b>, <b>-scrypt_p</b> and <b>-v2</b> options.</p>
</dd>
<dt id="scrypt_N-N--scrypt_r-r--scrypt_p-p"><b>-scrypt_N N</b> <b>-scrypt_r r</b> <b>-scrypt_p p</b></dt>
<dd>
<p>Sets the scrypt <b>N</b>, <b>r</b> or <b>p</b> parameters.</p>
</dd>
</dl>
<h1 id="KEY-FORMATS">KEY FORMATS</h1>
<p>Various different formats are used by the pkcs8 utility. These are detailed below.</p>
<p>If a key is being converted from PKCS#8 form (i.e. the <b>-topk8</b> option is not used) then the input file must be in PKCS#8 format. An encrypted key is expected unless <b>-nocrypt</b> is included.</p>
<p>If <b>-topk8</b> is not used and <b>PEM</b> mode is set the output file will be an unencrypted private key in PKCS#8 format. If the <b>-traditional</b> option is used then a traditional format private key is written instead.</p>
<p>If <b>-topk8</b> is not used and <b>DER</b> mode is set the output file will be an unencrypted private key in traditional DER format.</p>
<p>If <b>-topk8</b> is used then any supported private key can be used for the input file in a format specified by <b>-inform</b>. The output file will be encrypted PKCS#8 format using the specified encryption parameters unless <b>-nocrypt</b> is included.</p>
<h1 id="NOTES">NOTES</h1>
<p>By default, when converting a key to PKCS#8 format, PKCS#5 v2.0 using 256 bit AES with HMAC and SHA256 is used.</p>
<p>Some older implementations do not support PKCS#5 v2.0 format and require the older PKCS#5 v1.5 form instead, possibly also requiring insecure weak encryption algorithms such as 56 bit DES.</p>
<p>The encrypted form of a PEM encode PKCS#8 files uses the following headers and footers:</p>
<pre><code>-----BEGIN ENCRYPTED PRIVATE KEY-----
-----END ENCRYPTED PRIVATE KEY-----</code></pre>
<p>The unencrypted form uses:</p>
<pre><code>-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----</code></pre>
<p>Private keys encrypted using PKCS#5 v2.0 algorithms and high iteration counts are more secure that those encrypted using the traditional SSLeay compatible formats. So if additional security is considered important the keys should be converted.</p>
<p>It is possible to write out DER encoded encrypted private keys in PKCS#8 format because the encryption details are included at an ASN1 level whereas the traditional format includes them at a PEM level.</p>
<h1 id="PKCS-5-v1.5-and-PKCS-12-algorithms">PKCS#5 v1.5 and PKCS#12 algorithms.</h1>
<p>Various algorithms can be used with the <b>-v1</b> command line option, including PKCS#5 v1.5 and PKCS#12. These are described in more detail below.</p>
<dl>
<dt id="PBE-MD2-DES-PBE-MD5-DES"><b>PBE-MD2-DES PBE-MD5-DES</b></dt>
<dd>
<p>These algorithms were included in the original PKCS#5 v1.5 specification. They only offer 56 bits of protection since they both use DES.</p>
</dd>
<dt id="PBE-SHA1-RC2-64-PBE-MD2-RC2-64-PBE-MD5-RC2-64-PBE-SHA1-DES"><b>PBE-SHA1-RC2-64</b>, <b>PBE-MD2-RC2-64</b>, <b>PBE-MD5-RC2-64</b>, <b>PBE-SHA1-DES</b></dt>
<dd>
<p>These algorithms are not mentioned in the original PKCS#5 v1.5 specification but they use the same key derivation algorithm and are supported by some software. They are mentioned in PKCS#5 v2.0. They use either 64 bit RC2 or 56 bit DES.</p>
</dd>
<dt id="PBE-SHA1-RC4-128-PBE-SHA1-RC4-40-PBE-SHA1-3DES-PBE-SHA1-2DES-PBE-SHA1-RC2-128-PBE-SHA1-RC2-40"><b>PBE-SHA1-RC4-128</b>, <b>PBE-SHA1-RC4-40</b>, <b>PBE-SHA1-3DES</b>, <b>PBE-SHA1-2DES</b>, <b>PBE-SHA1-RC2-128</b>, <b>PBE-SHA1-RC2-40</b></dt>
<dd>
<p>These algorithms use the PKCS#12 password based encryption algorithm and allow strong encryption algorithms like triple DES or 128 bit RC2 to be used.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Convert a private key to PKCS#8 format using default parameters (AES with 256 bit key and <b>hmacWithSHA256</b>):</p>
<pre><code>openssl pkcs8 -in key.pem -topk8 -out enckey.pem</code></pre>
<p>Convert a private key to PKCS#8 unencrypted format:</p>
<pre><code>openssl pkcs8 -in key.pem -topk8 -nocrypt -out enckey.pem</code></pre>
<p>Convert a private key to PKCS#5 v2.0 format using triple DES:</p>
<pre><code>openssl pkcs8 -in key.pem -topk8 -v2 des3 -out enckey.pem</code></pre>
<p>Convert a private key to PKCS#5 v2.0 format using AES with 256 bits in CBC mode and <b>hmacWithSHA512</b> PRF:</p>
<pre><code>openssl pkcs8 -in key.pem -topk8 -v2 aes-256-cbc -v2prf hmacWithSHA512 -out enckey.pem</code></pre>
<p>Convert a private key to PKCS#8 using a PKCS#5 1.5 compatible algorithm (DES):</p>
<pre><code>openssl pkcs8 -in key.pem -topk8 -v1 PBE-MD5-DES -out enckey.pem</code></pre>
<p>Convert a private key to PKCS#8 using a PKCS#12 compatible algorithm (3DES):</p>
<pre><code>openssl pkcs8 -in key.pem -topk8 -out enckey.pem -v1 PBE-SHA1-3DES</code></pre>
<p>Read a DER unencrypted PKCS#8 format private key:</p>
<pre><code>openssl pkcs8 -inform DER -nocrypt -in key.der -out key.pem</code></pre>
<p>Convert a private key from any PKCS#8 encrypted format to traditional format:</p>
<pre><code>openssl pkcs8 -in pk8.pem -traditional -out key.pem</code></pre>
<p>Convert a private key to PKCS#8 format, encrypting with AES-256 and with one million iterations of the password:</p>
<pre><code>openssl pkcs8 -in key.pem -topk8 -v2 aes-256-cbc -iter 1000000 -out pk8.pem</code></pre>
<h1 id="STANDARDS">STANDARDS</h1>
<p>Test vectors from this PKCS#5 v2.0 implementation were posted to the pkcs-tng mailing list using triple DES, DES and RC2 with high iteration counts, several people confirmed that they could decrypt the private keys produced and therefore, it can be assumed that the PKCS#5 v2.0 implementation is reasonably accurate at least as far as these algorithms are concerned.</p>
<p>The format of PKCS#8 DSA (and other) private keys is not well documented: it is hidden away in PKCS#11 v2.01, section 11.9. OpenSSL's default DSA PKCS#8 private key format complies with this standard.</p>
<h1 id="BUGS">BUGS</h1>
<p>There should be an option that prints out the encryption algorithm in use and other details such as the iteration count.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The <b>-iter</b> option was added in OpenSSL 1.1.0.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�?{ �6 �6 openssl/html/man1/genpkey.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>genpkey</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#KEY-GENERATION-OPTIONS">KEY GENERATION OPTIONS</a>
<ul>
<li><a href="#RSA-Key-Generation-Options">RSA Key Generation Options</a></li>
<li><a href="#RSA-PSS-Key-Generation-Options">RSA-PSS Key Generation Options</a></li>
<li><a href="#EC-Key-Generation-Options">EC Key Generation Options</a></li>
</ul>
</li>
<li><a href="#PARAMETER-GENERATION-OPTIONS">PARAMETER GENERATION OPTIONS</a>
<ul>
<li><a href="#DSA-Parameter-Generation-Options">DSA Parameter Generation Options</a></li>
<li><a href="#DH-Parameter-Generation-Options">DH Parameter Generation Options</a></li>
<li><a href="#EC-Parameter-Generation-Options">EC Parameter Generation Options</a></li>
</ul>
</li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-genpkey, genpkey - generate a private key</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>genpkey</b> [<b>-help</b>] [<b>-out filename</b>] [<b>-outform PEM|DER</b>] [<b>-pass arg</b>] [<b>-<i>cipher</i></b>] [<b>-engine id</b>] [<b>-paramfile file</b>] [<b>-algorithm alg</b>] [<b>-pkeyopt opt:value</b>] [<b>-genparam</b>] [<b>-text</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>genpkey</b> command generates a private key.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Output the key to the specified file. If this argument is not specified then standard output is used.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format DER or PEM. The default format is PEM.</p>
</dd>
<dt id="pass-arg"><b>-pass arg</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="cipher"><b>-<i>cipher</i></b></dt>
<dd>
<p>This option encrypts the private key with the supplied cipher. Any algorithm name accepted by EVP_get_cipherbyname() is acceptable such as <b>des3</b>.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>genpkey</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. If used this option should precede all other options.</p>
</dd>
<dt id="algorithm-alg"><b>-algorithm alg</b></dt>
<dd>
<p>Public key algorithm to use such as RSA, DSA or DH. If used this option must precede any <b>-pkeyopt</b> options. The options <b>-paramfile</b> and <b>-algorithm</b> are mutually exclusive. Engines may add algorithms in addition to the standard built-in ones.</p>
<p>Valid built-in algorithm names for private key generation are RSA, RSA-PSS, EC, X25519, X448, ED25519 and ED448.</p>
<p>Valid built-in algorithm names for parameter generation (see the <b>-genparam</b> option) are DH, DSA and EC.</p>
<p>Note that the algorithm name X9.42 DH may be used as a synonym for the DH algorithm. These are identical and do not indicate the type of parameters that will be generated. Use the <b>dh_paramgen_type</b> option to indicate whether PKCS#3 or X9.42 DH parameters are required. See <a href="#DH-Parameter-Generation-Options">"DH Parameter Generation Options"</a> below for more details.</p>
</dd>
<dt id="pkeyopt-opt:value"><b>-pkeyopt opt:value</b></dt>
<dd>
<p>Set the public key algorithm option <b>opt</b> to <b>value</b>. The precise set of options supported depends on the public key algorithm used and its implementation. See <a href="#KEY-GENERATION-OPTIONS">"KEY GENERATION OPTIONS"</a> and <a href="#PARAMETER-GENERATION-OPTIONS">"PARAMETER GENERATION OPTIONS"</a> below for more details.</p>
</dd>
<dt id="genparam"><b>-genparam</b></dt>
<dd>
<p>Generate a set of parameters instead of a private key. If used this option must precede any <b>-algorithm</b>, <b>-paramfile</b> or <b>-pkeyopt</b> options.</p>
</dd>
<dt id="paramfile-filename"><b>-paramfile filename</b></dt>
<dd>
<p>Some public key algorithms generate a private key based on a set of parameters. They can be supplied using this option. If this option is used the public key algorithm used is determined by the parameters. If used this option must precede any <b>-pkeyopt</b> options. The options <b>-paramfile</b> and <b>-algorithm</b> are mutually exclusive.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Print an (unencrypted) text representation of private and public keys and parameters along with the PEM or DER structure.</p>
</dd>
</dl>
<h1 id="KEY-GENERATION-OPTIONS">KEY GENERATION OPTIONS</h1>
<p>The options supported by each algorithm and indeed each implementation of an algorithm can vary. The options for the OpenSSL implementations are detailed below. There are no key generation options defined for the X25519, X448, ED25519 or ED448 algorithms.</p>
<h2 id="RSA-Key-Generation-Options">RSA Key Generation Options</h2>
<dl>
<dt id="rsa_keygen_bits:numbits"><b>rsa_keygen_bits:numbits</b></dt>
<dd>
<p>The number of bits in the generated key. If not specified 2048 is used.</p>
</dd>
<dt id="rsa_keygen_primes:numprimes"><b>rsa_keygen_primes:numprimes</b></dt>
<dd>
<p>The number of primes in the generated key. If not specified 2 is used.</p>
</dd>
<dt id="rsa_keygen_pubexp:value"><b>rsa_keygen_pubexp:value</b></dt>
<dd>
<p>The RSA public exponent value. This can be a large decimal or hexadecimal value if preceded by <b>0x</b>. Default value is 65537.</p>
</dd>
</dl>
<h2 id="RSA-PSS-Key-Generation-Options">RSA-PSS Key Generation Options</h2>
<p>Note: by default an <b>RSA-PSS</b> key has no parameter restrictions.</p>
<dl>
<dt id="rsa_keygen_bits:numbits-rsa_keygen_primes:numprimes-rsa_keygen_pubexp:value"><b>rsa_keygen_bits:numbits</b>, <b>rsa_keygen_primes:numprimes</b>, <b>rsa_keygen_pubexp:value</b></dt>
<dd>
<p>These options have the same meaning as the <b>RSA</b> algorithm.</p>
</dd>
<dt id="rsa_pss_keygen_md:digest"><b>rsa_pss_keygen_md:digest</b></dt>
<dd>
<p>If set the key is restricted and can only use <b>digest</b> for signing.</p>
</dd>
<dt id="rsa_pss_keygen_mgf1_md:digest"><b>rsa_pss_keygen_mgf1_md:digest</b></dt>
<dd>
<p>If set the key is restricted and can only use <b>digest</b> as it's MGF1 parameter.</p>
</dd>
<dt id="rsa_pss_keygen_saltlen:len"><b>rsa_pss_keygen_saltlen:len</b></dt>
<dd>
<p>If set the key is restricted and <b>len</b> specifies the minimum salt length.</p>
</dd>
</dl>
<h2 id="EC-Key-Generation-Options">EC Key Generation Options</h2>
<p>The EC key generation options can also be used for parameter generation.</p>
<dl>
<dt id="ec_paramgen_curve:curve"><b>ec_paramgen_curve:curve</b></dt>
<dd>
<p>The EC curve to use. OpenSSL supports NIST curve names such as "P-256".</p>
</dd>
<dt id="ec_param_enc:encoding"><b>ec_param_enc:encoding</b></dt>
<dd>
<p>The encoding to use for parameters. The "encoding" parameter must be either "named_curve" or "explicit". The default value is "named_curve".</p>
</dd>
</dl>
<h1 id="PARAMETER-GENERATION-OPTIONS">PARAMETER GENERATION OPTIONS</h1>
<p>The options supported by each algorithm and indeed each implementation of an algorithm can vary. The options for the OpenSSL implementations are detailed below.</p>
<h2 id="DSA-Parameter-Generation-Options">DSA Parameter Generation Options</h2>
<dl>
<dt id="dsa_paramgen_bits:numbits"><b>dsa_paramgen_bits:numbits</b></dt>
<dd>
<p>The number of bits in the generated prime. If not specified 2048 is used.</p>
</dd>
<dt id="dsa_paramgen_q_bits:numbits"><b>dsa_paramgen_q_bits:numbits</b></dt>
<dd>
<p>The number of bits in the q parameter. Must be one of 160, 224 or 256. If not specified 224 is used.</p>
</dd>
<dt id="dsa_paramgen_md:digest"><b>dsa_paramgen_md:digest</b></dt>
<dd>
<p>The digest to use during parameter generation. Must be one of <b>sha1</b>, <b>sha224</b> or <b>sha256</b>. If set, then the number of bits in <b>q</b> will match the output size of the specified digest and the <b>dsa_paramgen_q_bits</b> parameter will be ignored. If not set, then a digest will be used that gives an output matching the number of bits in <b>q</b>, i.e. <b>sha1</b> if q length is 160, <b>sha224</b> if it 224 or <b>sha256</b> if it is 256.</p>
</dd>
</dl>
<h2 id="DH-Parameter-Generation-Options">DH Parameter Generation Options</h2>
<dl>
<dt id="dh_paramgen_prime_len:numbits"><b>dh_paramgen_prime_len:numbits</b></dt>
<dd>
<p>The number of bits in the prime parameter <b>p</b>. The default is 2048.</p>
</dd>
<dt id="dh_paramgen_subprime_len:numbits"><b>dh_paramgen_subprime_len:numbits</b></dt>
<dd>
<p>The number of bits in the sub prime parameter <b>q</b>. The default is 256 if the prime is at least 2048 bits long or 160 otherwise. Only relevant if used in conjunction with the <b>dh_paramgen_type</b> option to generate X9.42 DH parameters.</p>
</dd>
<dt id="dh_paramgen_generator:value"><b>dh_paramgen_generator:value</b></dt>
<dd>
<p>The value to use for the generator <b>g</b>. The default is 2.</p>
</dd>
<dt id="dh_paramgen_type:value"><b>dh_paramgen_type:value</b></dt>
<dd>
<p>The type of DH parameters to generate. Use 0 for PKCS#3 DH and 1 for X9.42 DH. The default is 0.</p>
</dd>
<dt id="dh_rfc5114:num"><b>dh_rfc5114:num</b></dt>
<dd>
<p>If this option is set, then the appropriate RFC5114 parameters are used instead of generating new parameters. The value <b>num</b> can take the values 1, 2 or 3 corresponding to RFC5114 DH parameters consisting of 1024 bit group with 160 bit subgroup, 2048 bit group with 224 bit subgroup and 2048 bit group with 256 bit subgroup as mentioned in RFC5114 sections 2.1, 2.2 and 2.3 respectively. If present this overrides all other DH parameter options.</p>
</dd>
</dl>
<h2 id="EC-Parameter-Generation-Options">EC Parameter Generation Options</h2>
<p>The EC parameter generation options are the same as for key generation. See <a href="#EC-Key-Generation-Options">"EC Key Generation Options"</a> above.</p>
<h1 id="NOTES">NOTES</h1>
<p>The use of the genpkey program is encouraged over the algorithm specific utilities because additional algorithm options and ENGINE provided algorithms can be used.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Generate an RSA private key using default parameters:</p>
<pre><code>openssl genpkey -algorithm RSA -out key.pem</code></pre>
<p>Encrypt output private key using 128 bit AES and the passphrase "hello":</p>
<pre><code>openssl genpkey -algorithm RSA -out key.pem -aes-128-cbc -pass pass:hello</code></pre>
<p>Generate a 2048 bit RSA key using 3 as the public exponent:</p>
<pre><code>openssl genpkey -algorithm RSA -out key.pem \
-pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3</code></pre>
<p>Generate 2048 bit DSA parameters:</p>
<pre><code>openssl genpkey -genparam -algorithm DSA -out dsap.pem \
-pkeyopt dsa_paramgen_bits:2048</code></pre>
<p>Generate DSA key from parameters:</p>
<pre><code>openssl genpkey -paramfile dsap.pem -out dsakey.pem</code></pre>
<p>Generate 2048 bit DH parameters:</p>
<pre><code>openssl genpkey -genparam -algorithm DH -out dhp.pem \
-pkeyopt dh_paramgen_prime_len:2048</code></pre>
<p>Generate 2048 bit X9.42 DH parameters:</p>
<pre><code>openssl genpkey -genparam -algorithm DH -out dhpx.pem \
-pkeyopt dh_paramgen_prime_len:2048 \
-pkeyopt dh_paramgen_type:1</code></pre>
<p>Output RFC5114 2048 bit DH parameters with 224 bit subgroup:</p>
<pre><code>openssl genpkey -genparam -algorithm DH -out dhp.pem -pkeyopt dh_rfc5114:2</code></pre>
<p>Generate DH key from parameters:</p>
<pre><code>openssl genpkey -paramfile dhp.pem -out dhkey.pem</code></pre>
<p>Generate EC parameters:</p>
<pre><code>openssl genpkey -genparam -algorithm EC -out ecp.pem \
-pkeyopt ec_paramgen_curve:secp384r1 \
-pkeyopt ec_param_enc:named_curve</code></pre>
<p>Generate EC key from parameters:</p>
<pre><code>openssl genpkey -paramfile ecp.pem -out eckey.pem</code></pre>
<p>Generate EC key directly:</p>
<pre><code>openssl genpkey -algorithm EC -out eckey.pem \
-pkeyopt ec_paramgen_curve:P-384 \
-pkeyopt ec_param_enc:named_curve</code></pre>
<p>Generate an X25519 private key:</p>
<pre><code>openssl genpkey -algorithm X25519 -out xkey.pem</code></pre>
<p>Generate an ED448 private key:</p>
<pre><code>openssl genpkey -algorithm ED448 -out xkey.pem</code></pre>
<h1 id="HISTORY">HISTORY</h1>
<p>The ability to use NIST curve names, and to generate an EC key directly, were added in OpenSSL 1.0.2. The ability to generate X25519 keys was added in OpenSSL 1.1.0. The ability to generate X448, ED25519 and ED448 keys was added in OpenSSL 1.1.1.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]T��`� `� openssl/html/man1/s_client.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>s_client</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#CONNECTED-COMMANDS">CONNECTED COMMANDS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-s_client, s_client - SSL/TLS client program</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>s_client</b> [<b>-help</b>] [<b>-connect host:port</b>] [<b>-bind host:port</b>] [<b>-proxy host:port</b>] [<b>-unix path</b>] [<b>-4</b>] [<b>-6</b>] [<b>-servername name</b>] [<b>-noservername</b>] [<b>-verify depth</b>] [<b>-verify_return_error</b>] [<b>-cert filename</b>] [<b>-certform DER|PEM</b>] [<b>-key filename</b>] [<b>-keyform DER|PEM</b>] [<b>-cert_chain filename</b>] [<b>-build_chain</b>] [<b>-xkey</b>] [<b>-xcert</b>] [<b>-xchain</b>] [<b>-xchain_build</b>] [<b>-xcertform PEM|DER</b>] [<b>-xkeyform PEM|DER</b>] [<b>-pass arg</b>] [<b>-CApath directory</b>] [<b>-CAfile filename</b>] [<b>-chainCApath directory</b>] [<b>-chainCAfile filename</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-requestCAfile filename</b>] [<b>-dane_tlsa_domain domain</b>] [<b>-dane_tlsa_rrdata rrdata</b>] [<b>-dane_ee_no_namechecks</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-nameopt option</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-build_chain</b>] [<b>-x509_strict</b>] [<b>-reconnect</b>] [<b>-showcerts</b>] [<b>-debug</b>] [<b>-msg</b>] [<b>-nbio_test</b>] [<b>-state</b>] [<b>-nbio</b>] [<b>-crlf</b>] [<b>-ign_eof</b>] [<b>-no_ign_eof</b>] [<b>-psk_identity identity</b>] [<b>-psk key</b>] [<b>-psk_session file</b>] [<b>-quiet</b>] [<b>-ssl3</b>] [<b>-tls1</b>] [<b>-tls1_1</b>] [<b>-tls1_2</b>] [<b>-tls1_3</b>] [<b>-no_ssl3</b>] [<b>-no_tls1</b>] [<b>-no_tls1_1</b>] [<b>-no_tls1_2</b>] [<b>-no_tls1_3</b>] [<b>-dtls</b>] [<b>-dtls1</b>] [<b>-dtls1_2</b>] [<b>-sctp</b>] [<b>-sctp_label_bug</b>] [<b>-fallback_scsv</b>] [<b>-async</b>] [<b>-max_send_frag</b>] [<b>-split_send_frag</b>] [<b>-max_pipelines</b>] [<b>-read_buf</b>] [<b>-bugs</b>] [<b>-comp</b>] [<b>-no_comp</b>] [<b>-allow_no_dhe_kex</b>] [<b>-sigalgs sigalglist</b>] [<b>-curves curvelist</b>] [<b>-cipher cipherlist</b>] [<b>-ciphersuites val</b>] [<b>-serverpref</b>] [<b>-starttls protocol</b>] [<b>-xmpphost hostname</b>] [<b>-name hostname</b>] [<b>-engine id</b>] [<b>-tlsextdebug</b>] [<b>-no_ticket</b>] [<b>-sess_out filename</b>] [<b>-sess_in filename</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-serverinfo types</b>] [<b>-status</b>] [<b>-alpn protocols</b>] [<b>-nextprotoneg protocols</b>] [<b>-ct</b>] [<b>-noct</b>] [<b>-ctlogfile</b>] [<b>-keylogfile file</b>] [<b>-early_data file</b>] [<b>-enable_pha</b>] [<b>target</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>s_client</b> command implements a generic SSL/TLS client which connects to a remote host using SSL/TLS. It is a <i>very</i> useful diagnostic tool for SSL servers.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<p>In addition to the options below the <b>s_client</b> utility also supports the common and client only options documented in the "Supported Command Line Commands" section of the <a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a> manual page.</p>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="connect-host:port"><b>-connect host:port</b></dt>
<dd>
<p>This specifies the host and optional port to connect to. It is possible to select the host and port using the optional target positional argument instead. If neither this nor the target positional argument are specified then an attempt is made to connect to the local host on port 4433.</p>
</dd>
<dt id="bind-host:port"><b>-bind host:port</b>]</dt>
<dd>
<p>This specifies the host address and or port to bind as the source for the connection. For Unix-domain sockets the port is ignored and the host is used as the source socket address.</p>
</dd>
<dt id="proxy-host:port"><b>-proxy host:port</b></dt>
<dd>
<p>When used with the <b>-connect</b> flag, the program uses the host and port specified with this flag and issues an HTTP CONNECT command to connect to the desired server.</p>
</dd>
<dt id="unix-path"><b>-unix path</b></dt>
<dd>
<p>Connect over the specified Unix-domain socket.</p>
</dd>
<dt id="pod-4"><b>-4</b></dt>
<dd>
<p>Use IPv4 only.</p>
</dd>
<dt id="pod-6"><b>-6</b></dt>
<dd>
<p>Use IPv6 only.</p>
</dd>
<dt id="servername-name"><b>-servername name</b></dt>
<dd>
<p>Set the TLS SNI (Server Name Indication) extension in the ClientHello message to the given value. If <b>-servername</b> is not provided, the TLS SNI extension will be populated with the name given to <b>-connect</b> if it follows a DNS name format. If <b>-connect</b> is not provided either, the SNI is set to "localhost". This is the default since OpenSSL 1.1.1.</p>
<p>Even though SNI should normally be a DNS name and not an IP address, if <b>-servername</b> is provided then that name will be sent, regardless of whether it is a DNS name or not.</p>
<p>This option cannot be used in conjunction with <b>-noservername</b>.</p>
</dd>
<dt id="noservername"><b>-noservername</b></dt>
<dd>
<p>Suppresses sending of the SNI (Server Name Indication) extension in the ClientHello message. Cannot be used in conjunction with the <b>-servername</b> or <-dane_tlsa_domain> options.</p>
</dd>
<dt id="cert-certname"><b>-cert certname</b></dt>
<dd>
<p>The certificate to use, if one is requested by the server. The default is not to use a certificate.</p>
</dd>
<dt id="certform-format"><b>-certform format</b></dt>
<dd>
<p>The certificate format to use: DER or PEM. PEM is the default.</p>
</dd>
<dt id="key-keyfile"><b>-key keyfile</b></dt>
<dd>
<p>The private key to use. If not specified then the certificate file will be used.</p>
</dd>
<dt id="keyform-format"><b>-keyform format</b></dt>
<dd>
<p>The private format to use: DER or PEM. PEM is the default.</p>
</dd>
<dt id="cert_chain"><b>-cert_chain</b></dt>
<dd>
<p>A file containing trusted certificates to use when attempting to build the client/server certificate chain related to the certificate specified via the <b>-cert</b> option.</p>
</dd>
<dt id="build_chain"><b>-build_chain</b></dt>
<dd>
<p>Specify whether the application should build the certificate chain to be provided to the server.</p>
</dd>
<dt id="xkey-infile--xcert-infile--xchain"><b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b></dt>
<dd>
<p>Specify an extra certificate, private key and certificate chain. These behave in the same manner as the <b>-cert</b>, <b>-key</b> and <b>-cert_chain</b> options. When specified, the callback returning the first valid chain will be in use by the client.</p>
</dd>
<dt id="xchain_build"><b>-xchain_build</b></dt>
<dd>
<p>Specify whether the application should build the certificate chain to be provided to the server for the extra certificates provided via <b>-xkey infile</b>, <b>-xcert infile</b>, <b>-xchain</b> options.</p>
</dd>
<dt id="xcertform-PEM-DER--xkeyform-PEM-DER"><b>-xcertform PEM|DER</b>, <b>-xkeyform PEM|DER</b></dt>
<dd>
<p>Extra certificate and private key format respectively.</p>
</dd>
<dt id="pass-arg"><b>-pass arg</b></dt>
<dd>
<p>the private key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="verify-depth"><b>-verify depth</b></dt>
<dd>
<p>The verify depth to use. This specifies the maximum length of the server certificate chain and turns on server certificate verification. Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure.</p>
</dd>
<dt id="verify_return_error"><b>-verify_return_error</b></dt>
<dd>
<p>Return verification errors instead of continuing. This will typically abort the handshake with a fatal error.</p>
</dd>
<dt id="nameopt-option"><b>-nameopt option</b></dt>
<dd>
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <a href="../man1/x509.html">x509(1)</a> manual page for details.</p>
</dd>
<dt id="CApath-directory"><b>-CApath directory</b></dt>
<dd>
<p>The directory to use for server certificate verification. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information. These are also used when building the client certificate chain.</p>
</dd>
<dt id="CAfile-file"><b>-CAfile file</b></dt>
<dd>
<p>A file containing trusted certificates to use during server authentication and to use when attempting to build the client certificate chain.</p>
</dd>
<dt id="chainCApath-directory"><b>-chainCApath directory</b></dt>
<dd>
<p>The directory to use for building the chain provided to the server. This directory must be in "hash format", see <a href="../man1/verify.html">verify(1)</a> for more information.</p>
</dd>
<dt id="chainCAfile-file"><b>-chainCAfile file</b></dt>
<dd>
<p>A file containing trusted certificates to use when attempting to build the client certificate chain.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location</p>
</dd>
<dt id="requestCAfile-file"><b>-requestCAfile file</b></dt>
<dd>
<p>A file containing a list of certificates whose subject names will be sent to the server in the <b>certificate_authorities</b> extension. Only supported for TLS 1.3</p>
</dd>
<dt id="dane_tlsa_domain-domain"><b>-dane_tlsa_domain domain</b></dt>
<dd>
<p>Enable RFC6698/RFC7671 DANE TLSA authentication and specify the TLSA base domain which becomes the default SNI hint and the primary reference identifier for hostname checks. This must be used in combination with at least one instance of the <b>-dane_tlsa_rrdata</b> option below.</p>
<p>When DANE authentication succeeds, the diagnostic output will include the lowest (closest to 0) depth at which a TLSA record authenticated a chain certificate. When that TLSA record is a "2 1 0" trust anchor public key that signed (rather than matched) the top-most certificate of the chain, the result is reported as "TA public key verified". Otherwise, either the TLSA record "matched TA certificate" at a positive depth or else "matched EE certificate" at depth 0.</p>
</dd>
<dt id="dane_tlsa_rrdata-rrdata"><b>-dane_tlsa_rrdata rrdata</b></dt>
<dd>
<p>Use one or more times to specify the RRDATA fields of the DANE TLSA RRset associated with the target service. The <b>rrdata</b> value is specified in "presentation form", that is four whitespace separated fields that specify the usage, selector, matching type and associated data, with the last of these encoded in hexadecimal. Optional whitespace is ignored in the associated data field. For example:</p>
<pre><code>$ openssl s_client -brief -starttls smtp \
-connect smtp.example.com:25 \
-dane_tlsa_domain smtp.example.com \
-dane_tlsa_rrdata "2 1 1
B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B" \
-dane_tlsa_rrdata "2 1 1
60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18"
...
Verification: OK
Verified peername: smtp.example.com
DANE TLSA 2 1 1 ...ee12d2cc90180517616e8a18 matched TA certificate at depth 1
...</code></pre>
</dd>
<dt id="dane_ee_no_namechecks"><b>-dane_ee_no_namechecks</b></dt>
<dd>
<p>This disables server name checks when authenticating via DANE-EE(3) TLSA records. For some applications, primarily web browsers, it is not safe to disable name checks due to "unknown key share" attacks, in which a malicious server can convince a client that a connection to a victim server is instead a secure connection to the malicious server. The malicious server may then be able to violate cross-origin scripting restrictions. Thus, despite the text of RFC7671, name checks are by default enabled for DANE-EE(3) TLSA records, and can be disabled in applications where it is safe to do so. In particular, SMTP and XMPP clients should set this option as SRV and MX records already make it possible for a remote domain to redirect client connections to any server of its choice, and in any case SMTP and XMPP clients do not execute scripts downloaded from remote servers.</p>
</dd>
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
<dd>
<p>Set various certificate chain validation options. See the <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
</dd>
<dt id="reconnect"><b>-reconnect</b></dt>
<dd>
<p>Reconnects to the same server 5 times using the same session ID, this can be used as a test that session caching is working.</p>
</dd>
<dt id="showcerts"><b>-showcerts</b></dt>
<dd>
<p>Displays the server certificate list as sent by the server: it only consists of certificates the server has sent (in the order the server has sent them). It is <b>not</b> a verified chain.</p>
</dd>
<dt id="prexit"><b>-prexit</b></dt>
<dd>
<p>Print session information when the program exits. This will always attempt to print out information even if the connection fails. Normally information will only be printed out once if the connection succeeds. This option is useful because the cipher in use may be renegotiated or the connection may fail because a client certificate is required or is requested only after an attempt is made to access a certain URL. Note: the output produced by this option is not always accurate because a connection might never have been established.</p>
</dd>
<dt id="state"><b>-state</b></dt>
<dd>
<p>Prints out the SSL session states.</p>
</dd>
<dt id="debug"><b>-debug</b></dt>
<dd>
<p>Print extensive debugging information including a hex dump of all traffic.</p>
</dd>
<dt id="msg"><b>-msg</b></dt>
<dd>
<p>Show all protocol messages with hex dump.</p>
</dd>
<dt id="trace"><b>-trace</b></dt>
<dd>
<p>Show verbose trace output of protocol messages. OpenSSL needs to be compiled with <b>enable-ssl-trace</b> for this option to work.</p>
</dd>
<dt id="msgfile"><b>-msgfile</b></dt>
<dd>
<p>File to send output of <b>-msg</b> or <b>-trace</b> to, default standard output.</p>
</dd>
<dt id="nbio_test"><b>-nbio_test</b></dt>
<dd>
<p>Tests nonblocking I/O</p>
</dd>
<dt id="nbio"><b>-nbio</b></dt>
<dd>
<p>Turns on nonblocking I/O</p>
</dd>
<dt id="crlf"><b>-crlf</b></dt>
<dd>
<p>This option translated a line feed from the terminal into CR+LF as required by some servers.</p>
</dd>
<dt id="ign_eof"><b>-ign_eof</b></dt>
<dd>
<p>Inhibit shutting down the connection when end of file is reached in the input.</p>
</dd>
<dt id="quiet"><b>-quiet</b></dt>
<dd>
<p>Inhibit printing of session and certificate information. This implicitly turns on <b>-ign_eof</b> as well.</p>
</dd>
<dt id="no_ign_eof"><b>-no_ign_eof</b></dt>
<dd>
<p>Shut down the connection when end of file is reached in the input. Can be used to override the implicit <b>-ign_eof</b> after <b>-quiet</b>.</p>
</dd>
<dt id="psk_identity-identity"><b>-psk_identity identity</b></dt>
<dd>
<p>Use the PSK identity <b>identity</b> when using a PSK cipher suite. The default value is "Client_identity" (without the quotes).</p>
</dd>
<dt id="psk-key"><b>-psk key</b></dt>
<dd>
<p>Use the PSK key <b>key</b> when using a PSK cipher suite. The key is given as a hexadecimal number without leading 0x, for example -psk 1a2b3c4d. This option must be provided in order to use a PSK cipher.</p>
</dd>
<dt id="psk_session-file"><b>-psk_session file</b></dt>
<dd>
<p>Use the pem encoded SSL_SESSION data stored in <b>file</b> as the basis of a PSK. Note that this will only work if TLSv1.3 is negotiated.</p>
</dd>
<dt id="ssl3--tls1--tls1_1--tls1_2--tls1_3--no_ssl3--no_tls1--no_tls1_1--no_tls1_2--no_tls1_3"><b>-ssl3</b>, <b>-tls1</b>, <b>-tls1_1</b>, <b>-tls1_2</b>, <b>-tls1_3</b>, <b>-no_ssl3</b>, <b>-no_tls1</b>, <b>-no_tls1_1</b>, <b>-no_tls1_2</b>, <b>-no_tls1_3</b></dt>
<dd>
<p>These options require or disable the use of the specified SSL or TLS protocols. By default <b>s_client</b> will negotiate the highest mutually supported protocol version. When a specific TLS version is required, only that version will be offered to and accepted from the server. Note that not all protocols and flags may be available, depending on how OpenSSL was built.</p>
</dd>
<dt id="dtls--dtls1--dtls1_2"><b>-dtls</b>, <b>-dtls1</b>, <b>-dtls1_2</b></dt>
<dd>
<p>These options make <b>s_client</b> use DTLS protocols instead of TLS. With <b>-dtls</b>, <b>s_client</b> will negotiate any supported DTLS protocol version, whilst <b>-dtls1</b> and <b>-dtls1_2</b> will only support DTLS1.0 and DTLS1.2 respectively.</p>
</dd>
<dt id="sctp"><b>-sctp</b></dt>
<dd>
<p>Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in conjunction with <b>-dtls</b>, <b>-dtls1</b> or <b>-dtls1_2</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
</dd>
<dt id="sctp_label_bug"><b>-sctp_label_bug</b></dt>
<dd>
<p>Use the incorrect behaviour of older OpenSSL implementations when computing endpoint-pair shared secrets for DTLS/SCTP. This allows communication with older broken implementations but breaks interoperability with correct implementations. Must be used in conjunction with <b>-sctp</b>. This option is only available where OpenSSL has support for SCTP enabled.</p>
</dd>
<dt id="fallback_scsv"><b>-fallback_scsv</b></dt>
<dd>
<p>Send TLS_FALLBACK_SCSV in the ClientHello.</p>
</dd>
<dt id="async"><b>-async</b></dt>
<dd>
<p>Switch on asynchronous mode. Cryptographic operations will be performed asynchronously. This will only have an effect if an asynchronous capable engine is also used via the <b>-engine</b> option. For test purposes the dummy async engine (dasync) can be used (if available).</p>
</dd>
<dt id="max_send_frag-int"><b>-max_send_frag int</b></dt>
<dd>
<p>The maximum size of data fragment to send. See <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a> for further information.</p>
</dd>
<dt id="split_send_frag-int"><b>-split_send_frag int</b></dt>
<dd>
<p>The size used to split data for encrypt pipelines. If more data is written in one go than this value then it will be split into multiple pipelines, up to the maximum number of pipelines defined by max_pipelines. This only has an effect if a suitable cipher suite has been negotiated, an engine that supports pipelining has been loaded, and max_pipelines is greater than 1. See <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a> for further information.</p>
</dd>
<dt id="max_pipelines-int"><b>-max_pipelines int</b></dt>
<dd>
<p>The maximum number of encrypt/decrypt pipelines to be used. This will only have an effect if an engine has been loaded that supports pipelining (e.g. the dasync engine) and a suitable cipher suite has been negotiated. The default value is 1. See <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a> for further information.</p>
</dd>
<dt id="read_buf-int"><b>-read_buf int</b></dt>
<dd>
<p>The default read buffer size to be used for connections. This will only have an effect if the buffer size is larger than the size that would otherwise be used and pipelining is in use (see <a href="../man3/SSL_CTX_set_default_read_buffer_len.html">SSL_CTX_set_default_read_buffer_len(3)</a> for further information).</p>
</dd>
<dt id="bugs"><b>-bugs</b></dt>
<dd>
<p>There are several known bugs in SSL and TLS implementations. Adding this option enables various workarounds.</p>
</dd>
<dt id="comp"><b>-comp</b></dt>
<dd>
<p>Enables support for SSL/TLS compression. This option was introduced in OpenSSL 1.1.0. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
</dd>
<dt id="no_comp"><b>-no_comp</b></dt>
<dd>
<p>Disables support for SSL/TLS compression. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.</p>
</dd>
<dt id="brief"><b>-brief</b></dt>
<dd>
<p>Only provide a brief summary of connection parameters instead of the normal verbose output.</p>
</dd>
<dt id="sigalgs-sigalglist"><b>-sigalgs sigalglist</b></dt>
<dd>
<p>Specifies the list of signature algorithms that are sent by the client. The server selects one entry in the list based on its preferences. For example strings, see <a href="../man3/SSL_CTX_set1_sigalgs.html">SSL_CTX_set1_sigalgs(3)</a></p>
</dd>
<dt id="curves-curvelist"><b>-curves curvelist</b></dt>
<dd>
<p>Specifies the list of supported curves to be sent by the client. The curve is ultimately selected by the server. For a list of all curves, use:</p>
<pre><code>$ openssl ecparam -list_curves</code></pre>
</dd>
<dt id="cipher-cipherlist"><b>-cipher cipherlist</b></dt>
<dd>
<p>This allows the TLSv1.2 and below cipher list sent by the client to be modified. This list will be combined with any TLSv1.3 ciphersuites that have been configured. Although the server determines which ciphersuite is used it should take the first supported cipher in the list sent by the client. See the <b>ciphers</b> command for more information.</p>
</dd>
<dt id="ciphersuites-val"><b>-ciphersuites val</b></dt>
<dd>
<p>This allows the TLSv1.3 ciphersuites sent by the client to be modified. This list will be combined with any TLSv1.2 and below ciphersuites that have been configured. Although the server determines which cipher suite is used it should take the first supported cipher in the list sent by the client. See the <b>ciphers</b> command for more information. The format for this list is a simple colon (":") separated list of TLSv1.3 ciphersuite names.</p>
</dd>
<dt id="starttls-protocol"><b>-starttls protocol</b></dt>
<dd>
<p>Send the protocol-specific message(s) to switch to TLS for communication. <b>protocol</b> is a keyword for the intended protocol. Currently, the only supported keywords are "smtp", "pop3", "imap", "ftp", "xmpp", "xmpp-server", "irc", "postgres", "mysql", "lmtp", "nntp", "sieve" and "ldap".</p>
</dd>
<dt id="xmpphost-hostname"><b>-xmpphost hostname</b></dt>
<dd>
<p>This option, when used with "-starttls xmpp" or "-starttls xmpp-server", specifies the host for the "to" attribute of the stream element. If this option is not specified, then the host specified with "-connect" will be used.</p>
<p>This option is an alias of the <b>-name</b> option for "xmpp" and "xmpp-server".</p>
</dd>
<dt id="name-hostname"><b>-name hostname</b></dt>
<dd>
<p>This option is used to specify hostname information for various protocols used with <b>-starttls</b> option. Currently only "xmpp", "xmpp-server", "smtp" and "lmtp" can utilize this <b>-name</b> option.</p>
<p>If this option is used with "-starttls xmpp" or "-starttls xmpp-server", if specifies the host for the "to" attribute of the stream element. If this option is not specified, then the host specified with "-connect" will be used.</p>
<p>If this option is used with "-starttls lmtp" or "-starttls smtp", it specifies the name to use in the "LMTP LHLO" or "SMTP EHLO" message, respectively. If this option is not specified, then "mail.example.com" will be used.</p>
</dd>
<dt id="tlsextdebug"><b>-tlsextdebug</b></dt>
<dd>
<p>Print out a hex dump of any TLS extensions received from the server.</p>
</dd>
<dt id="no_ticket"><b>-no_ticket</b></dt>
<dd>
<p>Disable RFC4507bis session ticket support.</p>
</dd>
<dt id="sess_out-filename"><b>-sess_out filename</b></dt>
<dd>
<p>Output SSL session to <b>filename</b>.</p>
</dd>
<dt id="sess_in-sess.pem"><b>-sess_in sess.pem</b></dt>
<dd>
<p>Load SSL session from <b>filename</b>. The client will attempt to resume a connection from this session.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>s_client</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="serverinfo-types"><b>-serverinfo types</b></dt>
<dd>
<p>A list of comma-separated TLS Extension Types (numbers between 0 and 65535). Each type will be sent as an empty ClientHello TLS Extension. The server's response (if any) will be encoded and displayed as a PEM file.</p>
</dd>
<dt id="status"><b>-status</b></dt>
<dd>
<p>Sends a certificate status request to the server (OCSP stapling). The server response (if any) is printed out.</p>
</dd>
<dt id="alpn-protocols--nextprotoneg-protocols"><b>-alpn protocols</b>, <b>-nextprotoneg protocols</b></dt>
<dd>
<p>These flags enable the Enable the Application-Layer Protocol Negotiation or Next Protocol Negotiation (NPN) extension, respectively. ALPN is the IETF standard and replaces NPN. The <b>protocols</b> list is a comma-separated list of protocol names that the client should advertise support for. The list should contain the most desirable protocols first. Protocol names are printable ASCII strings, for example "http/1.1" or "spdy/3". An empty list of protocols is treated specially and will cause the client to advertise support for the TLS extension but disconnect just after receiving ServerHello with a list of server supported protocols. The flag <b>-nextprotoneg</b> cannot be specified if <b>-tls1_3</b> is used.</p>
</dd>
<dt id="ct--noct"><b>-ct</b>, <b>-noct</b></dt>
<dd>
<p>Use one of these two options to control whether Certificate Transparency (CT) is enabled (<b>-ct</b>) or disabled (<b>-noct</b>). If CT is enabled, signed certificate timestamps (SCTs) will be requested from the server and reported at handshake completion.</p>
<p>Enabling CT also enables OCSP stapling, as this is one possible delivery method for SCTs.</p>
</dd>
<dt id="ctlogfile"><b>-ctlogfile</b></dt>
<dd>
<p>A file containing a list of known Certificate Transparency logs. See <a href="../man3/SSL_CTX_set_ctlog_list_file.html">SSL_CTX_set_ctlog_list_file(3)</a> for the expected file format.</p>
</dd>
<dt id="keylogfile-file"><b>-keylogfile file</b></dt>
<dd>
<p>Appends TLS secrets to the specified keylog file such that external programs (like Wireshark) can decrypt TLS connections.</p>
</dd>
<dt id="early_data-file"><b>-early_data file</b></dt>
<dd>
<p>Reads the contents of the specified file and attempts to send it as early data to the server. This will only work with resumed sessions that support early data and when the server accepts the early data.</p>
</dd>
<dt id="enable_pha"><b>-enable_pha</b></dt>
<dd>
<p>For TLSv1.3 only, send the Post-Handshake Authentication extension. This will happen whether or not a certificate has been provided via <b>-cert</b>.</p>
</dd>
<dt id="target"><b>[target]</b></dt>
<dd>
<p>Rather than providing <b>-connect</b>, the target hostname and optional port may be provided as a single positional argument after all options. If neither this nor <b>-connect</b> are provided, falls back to attempting to connect to localhost on port 4433.</p>
</dd>
</dl>
<h1 id="CONNECTED-COMMANDS">CONNECTED COMMANDS</h1>
<p>If a connection is established with an SSL server then any data received from the server is displayed and any key presses will be sent to the server. If end of file is reached then the connection will be closed down. When used interactively (which means neither <b>-quiet</b> nor <b>-ign_eof</b> have been given), then certain commands are also recognized which perform special operations. These commands are a letter which must appear at the start of a line. They are listed below.</p>
<dl>
<dt id="Q"><b>Q</b></dt>
<dd>
<p>End the current SSL connection and exit.</p>
</dd>
<dt id="R"><b>R</b></dt>
<dd>
<p>Renegotiate the SSL session (TLSv1.2 and below only).</p>
</dd>
<dt id="B"><b>B</b></dt>
<dd>
<p>Send a heartbeat message to the server (DTLS only)</p>
</dd>
<dt id="k"><b>k</b></dt>
<dd>
<p>Send a key update message to the server (TLSv1.3 only)</p>
</dd>
<dt id="K"><b>K</b></dt>
<dd>
<p>Send a key update message to the server and request one back (TLSv1.3 only)</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p><b>s_client</b> can be used to debug SSL servers. To connect to an SSL HTTP server the command:</p>
<pre><code>openssl s_client -connect servername:443</code></pre>
<p>would typically be used (https uses port 443). If the connection succeeds then an HTTP command can be given such as "GET /" to retrieve a web page.</p>
<p>If the handshake fails then there are several possible causes, if it is nothing obvious like no client certificate then the <b>-bugs</b>, <b>-ssl3</b>, <b>-tls1</b>, <b>-no_ssl3</b>, <b>-no_tls1</b> options can be tried in case it is a buggy server. In particular you should play with these options <b>before</b> submitting a bug report to an OpenSSL mailing list.</p>
<p>A frequent problem when attempting to get client certificates working is that a web client complains it has no certificates or gives an empty list to choose from. This is normally because the server is not sending the clients certificate authority in its "acceptable CA list" when it requests a certificate. By using <b>s_client</b> the CA list can be viewed and checked. However, some servers only request client authentication after a specific URL is requested. To obtain the list in this case it is necessary to use the <b>-prexit</b> option and send an HTTP request for an appropriate page.</p>
<p>If a certificate is specified on the command line using the <b>-cert</b> option it will not be used unless the server specifically requests a client certificate. Therefore, merely including a client certificate on the command line is no guarantee that the certificate works.</p>
<p>If there are problems verifying a server certificate then the <b>-showcerts</b> option can be used to show all the certificates sent by the server.</p>
<p>The <b>s_client</b> utility is a test tool and is designed to continue the handshake after any certificate verification errors. As a result it will accept any certificate chain (trusted or not) sent by the peer. Non-test applications should <b>not</b> do this as it makes them vulnerable to a MITM attack. This behaviour can be changed by with the <b>-verify_return_error</b> option: any verify errors are then returned aborting the handshake.</p>
<p>The <b>-bind</b> option may be useful if the server or a firewall requires connections to come from some particular address and or port.</p>
<h1 id="BUGS">BUGS</h1>
<p>Because this program has a lot of options and also because some of the techniques used are rather old, the C source of <b>s_client</b> is rather hard to read and not a model of how things should be done. A typical SSL client program would be much simpler.</p>
<p>The <b>-prexit</b> option is a bit of a hack. We should really report information whenever a session is renegotiated.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man3/SSL_CONF_cmd.html">SSL_CONF_cmd(3)</a>, <a href="../man1/sess_id.html">sess_id(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a>, <a href="../man3/SSL_CTX_set_max_send_fragment.html">SSL_CTX_set_max_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_split_send_fragment.html">SSL_CTX_set_split_send_fragment(3)</a>, <a href="../man3/SSL_CTX_set_max_pipelines.html">SSL_CTX_set_max_pipelines(3)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The <b>-no_alt_chains</b> option was added in OpenSSL 1.1.0. The <b>-name</b> option was added in OpenSSL 1.1.1.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]y��[ [ openssl/html/man1/ec.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>ec</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-ec, ec - EC key processing</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>ec</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-param_out</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-conv_form arg</b>] [<b>-param_enc arg</b>] [<b>-no_public</b>] [<b>-check</b>] [<b>-engine id</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>ec</b> command processes EC keys. They can be converted between various forms and their components printed out. <b>Note</b> OpenSSL uses the private key format specified in 'SEC 1: Elliptic Curve Cryptography' (http://www.secg.org/). To convert an OpenSSL EC private key into the PKCS#8 private key format use the <b>pkcs8</b> command.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option with a private key uses an ASN.1 DER encoded SEC1 private key. When used with a public key it uses the SubjectPublicKeyInfo structure as specified in RFC 3280. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines. In the case of a private key PKCS#8 format is also accepted.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The input file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write a key to or standard output by is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="passout-arg"><b>-passout arg</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="des--des3--idea"><b>-des|-des3|-idea</b></dt>
<dd>
<p>These options encrypt the private key with the DES, triple DES, IDEA or any other cipher supported by OpenSSL before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the <b>ec</b> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the public, private key components and parameters.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option prevents output of the encoded version of the key.</p>
</dd>
<dt id="pubin"><b>-pubin</b></dt>
<dd>
<p>By default, a private key is read from the input file. With this option a public key is read instead.</p>
</dd>
<dt id="pubout"><b>-pubout</b></dt>
<dd>
<p>By default a private key is output. With this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
</dd>
<dt id="conv_form"><b>-conv_form</b></dt>
<dd>
<p>This specifies how the points on the elliptic curve are converted into octet strings. Possible values are: <b>compressed</b> (the default value), <b>uncompressed</b> and <b>hybrid</b>. For more information regarding the point conversion forms please read the X9.62 standard. <b>Note</b> Due to patent issues the <b>compressed</b> option is disabled by default for binary curves and can be enabled by defining the preprocessor macro <b>OPENSSL_EC_BIN_PT_COMP</b> at compile time.</p>
</dd>
<dt id="param_enc-arg"><b>-param_enc arg</b></dt>
<dd>
<p>This specifies how the elliptic curve parameters are encoded. Possible value are: <b>named_curve</b>, i.e. the ec parameters are specified by an OID, or <b>explicit</b> where the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures). The default value is <b>named_curve</b>. <b>Note</b> the <b>implicitlyCA</b> alternative, as specified in RFC 3279, is currently not implemented in OpenSSL.</p>
</dd>
<dt id="no_public"><b>-no_public</b></dt>
<dd>
<p>This option omits the public key components from the private key output.</p>
</dd>
<dt id="check"><b>-check</b></dt>
<dd>
<p>This option checks the consistency of an EC private or public key.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ec</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The PEM private key format uses the header and footer lines:</p>
<pre><code>-----BEGIN EC PRIVATE KEY-----
-----END EC PRIVATE KEY-----</code></pre>
<p>The PEM public key format uses the header and footer lines:</p>
<pre><code>-----BEGIN PUBLIC KEY-----
-----END PUBLIC KEY-----</code></pre>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>To encrypt a private key using triple DES:</p>
<pre><code>openssl ec -in key.pem -des3 -out keyout.pem</code></pre>
<p>To convert a private key from PEM to DER format:</p>
<pre><code>openssl ec -in key.pem -outform DER -out keyout.der</code></pre>
<p>To print out the components of a private key to standard output:</p>
<pre><code>openssl ec -in key.pem -text -noout</code></pre>
<p>To just output the public part of a private key:</p>
<pre><code>openssl ec -in key.pem -pubout -out pubkey.pem</code></pre>
<p>To change the parameters encoding to <b>explicit</b>:</p>
<pre><code>openssl ec -in key.pem -param_enc explicit -out keyout.pem</code></pre>
<p>To change the point conversion form to <b>compressed</b>:</p>
<pre><code>openssl ec -in key.pem -conv_form compressed -out keyout.pem</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/ecparam.html">ecparam(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2003-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]+3ƕAS AS openssl/html/man1/ocsp.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>ocsp</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a>
<ul>
<li><a href="#OCSP-Client-Options">OCSP Client Options</a></li>
<li><a href="#OCSP-Server-Options">OCSP Server Options</a></li>
</ul>
</li>
<li><a href="#OCSP-Response-verification">OCSP Response verification.</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-ocsp, ocsp - Online Certificate Status Protocol utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>ocsp</b> [<b>-help</b>] [<b>-out file</b>] [<b>-issuer file</b>] [<b>-cert file</b>] [<b>-serial n</b>] [<b>-signer file</b>] [<b>-signkey file</b>] [<b>-sign_other file</b>] [<b>-no_certs</b>] [<b>-req_text</b>] [<b>-resp_text</b>] [<b>-text</b>] [<b>-reqout file</b>] [<b>-respout file</b>] [<b>-reqin file</b>] [<b>-respin file</b>] [<b>-nonce</b>] [<b>-no_nonce</b>] [<b>-url URL</b>] [<b>-host host:port</b>] [<b>-multi process-count</b>] [<b>-header</b>] [<b>-path</b>] [<b>-CApath dir</b>] [<b>-CAfile file</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-VAfile file</b>] [<b>-validity_period n</b>] [<b>-status_age n</b>] [<b>-noverify</b>] [<b>-verify_other file</b>] [<b>-trust_other</b>] [<b>-no_intern</b>] [<b>-no_signature_verify</b>] [<b>-no_cert_verify</b>] [<b>-no_chain</b>] [<b>-no_cert_checks</b>] [<b>-no_explicit</b>] [<b>-port num</b>] [<b>-ignore_err</b>] [<b>-index file</b>] [<b>-CA file</b>] [<b>-rsigner file</b>] [<b>-rkey file</b>] [<b>-rother file</b>] [<b>-rsigopt nm:v</b>] [<b>-resp_no_certs</b>] [<b>-nmin n</b>] [<b>-ndays n</b>] [<b>-resp_key_id</b>] [<b>-nrequest n</b>] [<b>-<i>digest</i></b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The Online Certificate Status Protocol (OCSP) enables applications to determine the (revocation) state of an identified certificate (RFC 2560).</p>
<p>The <b>ocsp</b> command performs many common OCSP tasks. It can be used to print out requests and responses, create requests and send queries to an OCSP responder and behave like a mini OCSP server itself.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<p>This command operates as either a client or a server. The options are described below, divided into those two modes.</p>
<h2 id="OCSP-Client-Options">OCSP Client Options</h2>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>specify output filename, default is standard output.</p>
</dd>
<dt id="issuer-filename"><b>-issuer filename</b></dt>
<dd>
<p>This specifies the current issuer certificate. This option can be used multiple times. The certificate specified in <b>filename</b> must be in PEM format. This option <b>MUST</b> come before any <b>-cert</b> options.</p>
</dd>
<dt id="cert-filename"><b>-cert filename</b></dt>
<dd>
<p>Add the certificate <b>filename</b> to the request. The issuer certificate is taken from the previous <b>issuer</b> option, or an error occurs if no issuer certificate is specified.</p>
</dd>
<dt id="serial-num"><b>-serial num</b></dt>
<dd>
<p>Same as the <b>cert</b> option except the certificate with serial number <b>num</b> is added to the request. The serial number is interpreted as a decimal integer unless preceded by <b>0x</b>. Negative integers can also be specified by preceding the value by a <b>-</b> sign.</p>
</dd>
<dt id="signer-filename--signkey-filename"><b>-signer filename</b>, <b>-signkey filename</b></dt>
<dd>
<p>Sign the OCSP request using the certificate specified in the <b>signer</b> option and the private key specified by the <b>signkey</b> option. If the <b>signkey</b> option is not present then the private key is read from the same file as the certificate. If neither option is specified then the OCSP request is not signed.</p>
</dd>
<dt id="sign_other-filename"><b>-sign_other filename</b></dt>
<dd>
<p>Additional certificates to include in the signed request.</p>
</dd>
<dt id="nonce--no_nonce"><b>-nonce</b>, <b>-no_nonce</b></dt>
<dd>
<p>Add an OCSP nonce extension to a request or disable OCSP nonce addition. Normally if an OCSP request is input using the <b>reqin</b> option no nonce is added: using the <b>nonce</b> option will force addition of a nonce. If an OCSP request is being created (using <b>cert</b> and <b>serial</b> options) a nonce is automatically added specifying <b>no_nonce</b> overrides this.</p>
</dd>
<dt id="req_text--resp_text--text"><b>-req_text</b>, <b>-resp_text</b>, <b>-text</b></dt>
<dd>
<p>Print out the text form of the OCSP request, response or both respectively.</p>
</dd>
<dt id="reqout-file--respout-file"><b>-reqout file</b>, <b>-respout file</b></dt>
<dd>
<p>Write out the DER encoded certificate request or response to <b>file</b>.</p>
</dd>
<dt id="reqin-file--respin-file"><b>-reqin file</b>, <b>-respin file</b></dt>
<dd>
<p>Read OCSP request or response file from <b>file</b>. These option are ignored if OCSP request or response creation is implied by other options (for example with <b>serial</b>, <b>cert</b> and <b>host</b> options).</p>
</dd>
<dt id="url-responder_url"><b>-url responder_url</b></dt>
<dd>
<p>Specify the responder URL. Both HTTP and HTTPS (SSL/TLS) URLs can be specified.</p>
</dd>
<dt id="host-hostname:port--path-pathname"><b>-host hostname:port</b>, <b>-path pathname</b></dt>
<dd>
<p>If the <b>host</b> option is present then the OCSP request is sent to the host <b>hostname</b> on port <b>port</b>. <b>path</b> specifies the HTTP pathname to use or "/" by default. This is equivalent to specifying <b>-url</b> with scheme http:// and the given hostname, port, and pathname.</p>
</dd>
<dt id="header-name-value"><b>-header name=value</b></dt>
<dd>
<p>Adds the header <b>name</b> with the specified <b>value</b> to the OCSP request that is sent to the responder. This may be repeated.</p>
</dd>
<dt id="timeout-seconds"><b>-timeout seconds</b></dt>
<dd>
<p>Connection timeout to the OCSP responder in seconds. On POSIX systems, when running as an OCSP responder, this option also limits the time that the responder is willing to wait for the client request. This time is measured from the time the responder accepts the connection until the complete request is received.</p>
</dd>
<dt id="multi-process-count"><b>-multi process-count</b></dt>
<dd>
<p>Run the specified number of OCSP responder child processes, with the parent process respawning child processes as needed. Child processes will detect changes in the CA index file and automatically reload it. When running as a responder <b>-timeout</b> option is recommended to limit the time each child is willing to wait for the client's OCSP response. This option is available on POSIX systems (that support the fork() and other required unix system-calls).</p>
</dd>
<dt id="CAfile-file--CApath-pathname"><b>-CAfile file</b>, <b>-CApath pathname</b></dt>
<dd>
<p>File or pathname containing trusted CA certificates. These are used to verify the signature on the OCSP response.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location</p>
</dd>
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
<dd>
<p>Set different certificate verification options. See <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
</dd>
<dt id="verify_other-file"><b>-verify_other file</b></dt>
<dd>
<p>File containing additional certificates to search when attempting to locate the OCSP response signing certificate. Some responders omit the actual signer's certificate from the response: this option can be used to supply the necessary certificate in such cases.</p>
</dd>
<dt id="trust_other"><b>-trust_other</b></dt>
<dd>
<p>The certificates specified by the <b>-verify_other</b> option should be explicitly trusted and no additional checks will be performed on them. This is useful when the complete responder certificate chain is not available or trusting a root CA is not appropriate.</p>
</dd>
<dt id="VAfile-file"><b>-VAfile file</b></dt>
<dd>
<p>File containing explicitly trusted responder certificates. Equivalent to the <b>-verify_other</b> and <b>-trust_other</b> options.</p>
</dd>
<dt id="noverify"><b>-noverify</b></dt>
<dd>
<p>Don't attempt to verify the OCSP response signature or the nonce values. This option will normally only be used for debugging since it disables all verification of the responders certificate.</p>
</dd>
<dt id="no_intern"><b>-no_intern</b></dt>
<dd>
<p>Ignore certificates contained in the OCSP response when searching for the signers certificate. With this option the signers certificate must be specified with either the <b>-verify_other</b> or <b>-VAfile</b> options.</p>
</dd>
<dt id="no_signature_verify"><b>-no_signature_verify</b></dt>
<dd>
<p>Don't check the signature on the OCSP response. Since this option tolerates invalid signatures on OCSP responses it will normally only be used for testing purposes.</p>
</dd>
<dt id="no_cert_verify"><b>-no_cert_verify</b></dt>
<dd>
<p>Don't verify the OCSP response signers certificate at all. Since this option allows the OCSP response to be signed by any certificate it should only be used for testing purposes.</p>
</dd>
<dt id="no_chain"><b>-no_chain</b></dt>
<dd>
<p>Do not use certificates in the response as additional untrusted CA certificates.</p>
</dd>
<dt id="no_explicit"><b>-no_explicit</b></dt>
<dd>
<p>Do not explicitly trust the root CA if it is set to be trusted for OCSP signing.</p>
</dd>
<dt id="no_cert_checks"><b>-no_cert_checks</b></dt>
<dd>
<p>Don't perform any additional checks on the OCSP response signers certificate. That is do not make any checks to see if the signers certificate is authorised to provide the necessary status information: as a result this option should only be used for testing purposes.</p>
</dd>
<dt id="validity_period-nsec--status_age-age"><b>-validity_period nsec</b>, <b>-status_age age</b></dt>
<dd>
<p>These options specify the range of times, in seconds, which will be tolerated in an OCSP response. Each certificate status response includes a <b>notBefore</b> time and an optional <b>notAfter</b> time. The current time should fall between these two values, but the interval between the two times may be only a few seconds. In practice the OCSP responder and clients clocks may not be precisely synchronised and so such a check may fail. To avoid this the <b>-validity_period</b> option can be used to specify an acceptable error range in seconds, the default value is 5 minutes.</p>
<p>If the <b>notAfter</b> time is omitted from a response then this means that new status information is immediately available. In this case the age of the <b>notBefore</b> field is checked to see it is not older than <b>age</b> seconds old. By default this additional check is not performed.</p>
</dd>
<dt id="digest"><b>-<i>digest</i></b></dt>
<dd>
<p>This option sets digest algorithm to use for certificate identification in the OCSP request. Any digest supported by the OpenSSL <b>dgst</b> command can be used. The default is SHA-1. This option may be used multiple times to specify the digest used by subsequent certificate identifiers.</p>
</dd>
</dl>
<h2 id="OCSP-Server-Options">OCSP Server Options</h2>
<dl>
<dt id="index-indexfile"><b>-index indexfile</b></dt>
<dd>
<p>The <b>indexfile</b> parameter is the name of a text index file in <b>ca</b> format containing certificate revocation information.</p>
<p>If the <b>index</b> option is specified the <b>ocsp</b> utility is in responder mode, otherwise it is in client mode. The request(s) the responder processes can be either specified on the command line (using <b>issuer</b> and <b>serial</b> options), supplied in a file (using the <b>reqin</b> option) or via external OCSP clients (if <b>port</b> or <b>url</b> is specified).</p>
<p>If the <b>index</b> option is present then the <b>CA</b> and <b>rsigner</b> options must also be present.</p>
</dd>
<dt id="CA-file"><b>-CA file</b></dt>
<dd>
<p>CA certificate corresponding to the revocation information in <b>indexfile</b>.</p>
</dd>
<dt id="rsigner-file"><b>-rsigner file</b></dt>
<dd>
<p>The certificate to sign OCSP responses with.</p>
</dd>
<dt id="rother-file"><b>-rother file</b></dt>
<dd>
<p>Additional certificates to include in the OCSP response.</p>
</dd>
<dt id="resp_no_certs"><b>-resp_no_certs</b></dt>
<dd>
<p>Don't include any certificates in the OCSP response.</p>
</dd>
<dt id="resp_key_id"><b>-resp_key_id</b></dt>
<dd>
<p>Identify the signer certificate using the key ID, default is to use the subject name.</p>
</dd>
<dt id="rkey-file"><b>-rkey file</b></dt>
<dd>
<p>The private key to sign OCSP responses with: if not present the file specified in the <b>rsigner</b> option is used.</p>
</dd>
<dt id="rsigopt-nm:v"><b>-rsigopt nm:v</b></dt>
<dd>
<p>Pass options to the signature algorithm when signing OCSP responses. Names and values of these options are algorithm-specific.</p>
</dd>
<dt id="port-portnum"><b>-port portnum</b></dt>
<dd>
<p>Port to listen for OCSP requests on. The port may also be specified using the <b>url</b> option.</p>
</dd>
<dt id="ignore_err"><b>-ignore_err</b></dt>
<dd>
<p>Ignore malformed requests or responses: When acting as an OCSP client, retry if a malformed response is received. When acting as an OCSP responder, continue running instead of terminating upon receiving a malformed request.</p>
</dd>
<dt id="nrequest-number"><b>-nrequest number</b></dt>
<dd>
<p>The OCSP server will exit after receiving <b>number</b> requests, default unlimited.</p>
</dd>
<dt id="nmin-minutes--ndays-days"><b>-nmin minutes</b>, <b>-ndays days</b></dt>
<dd>
<p>Number of minutes or days when fresh revocation information is available: used in the <b>nextUpdate</b> field. If neither option is present then the <b>nextUpdate</b> field is omitted meaning fresh revocation information is immediately available.</p>
</dd>
</dl>
<h1 id="OCSP-Response-verification">OCSP Response verification.</h1>
<p>OCSP Response follows the rules specified in RFC2560.</p>
<p>Initially the OCSP responder certificate is located and the signature on the OCSP request checked using the responder certificate's public key.</p>
<p>Then a normal certificate verify is performed on the OCSP responder certificate building up a certificate chain in the process. The locations of the trusted certificates used to build the chain can be specified by the <b>CAfile</b> and <b>CApath</b> options or they will be looked for in the standard OpenSSL certificates directory.</p>
<p>If the initial verify fails then the OCSP verify process halts with an error.</p>
<p>Otherwise the issuing CA certificate in the request is compared to the OCSP responder certificate: if there is a match then the OCSP verify succeeds.</p>
<p>Otherwise the OCSP responder certificate's CA is checked against the issuing CA certificate in the request. If there is a match and the OCSPSigning extended key usage is present in the OCSP responder certificate then the OCSP verify succeeds.</p>
<p>Otherwise, if <b>-no_explicit</b> is <b>not</b> set the root CA of the OCSP responders CA is checked to see if it is trusted for OCSP signing. If it is the OCSP verify succeeds.</p>
<p>If none of these checks is successful then the OCSP verify fails.</p>
<p>What this effectively means if that if the OCSP responder certificate is authorised directly by the CA it is issuing revocation information about (and it is correctly configured) then verification will succeed.</p>
<p>If the OCSP responder is a "global responder" which can give details about multiple CAs and has its own separate certificate chain then its root CA can be trusted for OCSP signing. For example:</p>
<pre><code>openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem</code></pre>
<p>Alternatively the responder certificate itself can be explicitly trusted with the <b>-VAfile</b> option.</p>
<h1 id="NOTES">NOTES</h1>
<p>As noted, most of the verify options are for testing or debugging purposes. Normally only the <b>-CApath</b>, <b>-CAfile</b> and (if the responder is a 'global VA') <b>-VAfile</b> options need to be used.</p>
<p>The OCSP server is only useful for test and demonstration purposes: it is not really usable as a full OCSP responder. It contains only a very simple HTTP request handling and can only handle the POST form of OCSP queries. It also handles requests serially meaning it cannot respond to new requests until it has processed the current one. The text index file format of revocation is also inefficient for large quantities of revocation data.</p>
<p>It is possible to run the <b>ocsp</b> application in responder mode via a CGI script using the <b>reqin</b> and <b>respout</b> options.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Create an OCSP request and write it to a file:</p>
<pre><code>openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem -reqout req.der</code></pre>
<p>Send a query to an OCSP responder with URL http://ocsp.myhost.com/ save the response to a file, print it out in text form, and verify the response:</p>
<pre><code>openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \
-url http://ocsp.myhost.com/ -resp_text -respout resp.der</code></pre>
<p>Read in an OCSP response and print out text form:</p>
<pre><code>openssl ocsp -respin resp.der -text -noverify</code></pre>
<p>OCSP server on port 8888 using a standard <b>ca</b> configuration, and a separate responder certificate. All requests and responses are printed to a file.</p>
<pre><code>openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
-text -out log.txt</code></pre>
<p>As above but exit after processing one request:</p>
<pre><code>openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
-nrequest 1</code></pre>
<p>Query status information using an internally generated request:</p>
<pre><code>openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
-issuer demoCA/cacert.pem -serial 1</code></pre>
<p>Query status information using request read from a file, and write the response to a second file.</p>
<pre><code>openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
-reqin req.der -respout resp.der</code></pre>
<h1 id="HISTORY">HISTORY</h1>
<p>The -no_alt_chains option was added in OpenSSL 1.1.0.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]=���> > openssl/html/man1/version.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>version</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-version, version - print OpenSSL version information</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl version</b> [<b>-help</b>] [<b>-a</b>] [<b>-v</b>] [<b>-b</b>] [<b>-o</b>] [<b>-f</b>] [<b>-p</b>] [<b>-d</b>] [<b>-e</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>This command is used to print out version information about OpenSSL.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="a"><b>-a</b></dt>
<dd>
<p>All information, this is the same as setting all the other flags.</p>
</dd>
<dt id="v"><b>-v</b></dt>
<dd>
<p>The current OpenSSL version.</p>
</dd>
<dt id="b"><b>-b</b></dt>
<dd>
<p>The date the current version of OpenSSL was built.</p>
</dd>
<dt id="o"><b>-o</b></dt>
<dd>
<p>Option information: various options set when the library was built.</p>
</dd>
<dt id="f"><b>-f</b></dt>
<dd>
<p>Compilation flags.</p>
</dd>
<dt id="p"><b>-p</b></dt>
<dd>
<p>Platform setting.</p>
</dd>
<dt id="d"><b>-d</b></dt>
<dd>
<p>OPENSSLDIR setting.</p>
</dd>
<dt id="e"><b>-e</b></dt>
<dd>
<p>ENGINESDIR setting.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The output of <b>openssl version -a</b> would typically be used when sending in a bug report.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]����R �R openssl/html/man1/smime.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>smime</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXIT-CODES">EXIT CODES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-smime, smime - S/MIME utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>smime</b> [<b>-help</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-sign</b>] [<b>-resign</b>] [<b>-verify</b>] [<b>-pk7out</b>] [<b>-binary</b>] [<b>-crlfeol</b>] [<b>-<i>cipher</i></b>] [<b>-in file</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-certfile file</b>] [<b>-signer file</b>] [<b>-recip file</b>] [<b>-inform SMIME|PEM|DER</b>] [<b>-passin arg</b>] [<b>-inkey file_or_id</b>] [<b>-out file</b>] [<b>-outform SMIME|PEM|DER</b>] [<b>-content file</b>] [<b>-to addr</b>] [<b>-from ad</b>] [<b>-subject s</b>] [<b>-text</b>] [<b>-indef</b>] [<b>-noindef</b>] [<b>-stream</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-md digest</b>] [cert.pem]...</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>smime</b> command handles S/MIME mail. It can encrypt, decrypt, sign and verify S/MIME messages.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<p>There are six operation options that set the type of operation to be performed. The meaning of the other options varies according to the operation type.</p>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="encrypt"><b>-encrypt</b></dt>
<dd>
<p>Encrypt mail for the given recipient certificates. Input file is the message to be encrypted. The output file is the encrypted mail in MIME format.</p>
<p>Note that no revocation check is done for the recipient cert, so if that key has been compromised, others may be able to decrypt the text.</p>
</dd>
<dt id="decrypt"><b>-decrypt</b></dt>
<dd>
<p>Decrypt mail using the supplied certificate and private key. Expects an encrypted mail message in MIME format for the input file. The decrypted mail is written to the output file.</p>
</dd>
<dt id="sign"><b>-sign</b></dt>
<dd>
<p>Sign mail using the supplied certificate and private key. Input file is the message to be signed. The signed message in MIME format is written to the output file.</p>
</dd>
<dt id="verify"><b>-verify</b></dt>
<dd>
<p>Verify signed mail. Expects a signed mail message on input and outputs the signed data. Both clear text and opaque signing is supported.</p>
</dd>
<dt id="pk7out"><b>-pk7out</b></dt>
<dd>
<p>Takes an input message and writes out a PEM encoded PKCS#7 structure.</p>
</dd>
<dt id="resign"><b>-resign</b></dt>
<dd>
<p>Resign a message: take an existing message and one or more new signers.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>The input message to be encrypted or signed or the MIME message to be decrypted or verified.</p>
</dd>
<dt id="inform-SMIME-PEM-DER"><b>-inform SMIME|PEM|DER</b></dt>
<dd>
<p>This specifies the input format for the PKCS#7 structure. The default is <b>SMIME</b> which reads an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to expect PEM and DER format PKCS#7 structures instead. This currently only affects the input format of the PKCS#7 structure, if no PKCS#7 structure is being input (for example with <b>-encrypt</b> or <b>-sign</b>) this option has no effect.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>The message text that has been decrypted or verified or the output MIME format message that has been signed or verified.</p>
</dd>
<dt id="outform-SMIME-PEM-DER"><b>-outform SMIME|PEM|DER</b></dt>
<dd>
<p>This specifies the output format for the PKCS#7 structure. The default is <b>SMIME</b> which write an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to write PEM and DER format PKCS#7 structures instead. This currently only affects the output format of the PKCS#7 structure, if no PKCS#7 structure is being output (for example with <b>-verify</b> or <b>-decrypt</b>) this option has no effect.</p>
</dd>
<dt id="stream--indef--noindef"><b>-stream -indef -noindef</b></dt>
<dd>
<p>The <b>-stream</b> and <b>-indef</b> options are equivalent and enable streaming I/O for encoding operations. This permits single pass processing of data without the need to hold the entire contents in memory, potentially supporting very large files. Streaming is automatically set for S/MIME signing with detached data if the output format is <b>SMIME</b> it is currently off by default for all other operations.</p>
</dd>
<dt id="noindef"><b>-noindef</b></dt>
<dd>
<p>Disable streaming I/O where it would produce and indefinite length constructed encoding. This option currently has no effect. In future streaming will be enabled by default on all relevant operations and this option will disable it.</p>
</dd>
<dt id="content-filename"><b>-content filename</b></dt>
<dd>
<p>This specifies a file containing the detached content, this is only useful with the <b>-verify</b> command. This is only usable if the PKCS#7 structure is using the detached signature form where the content is not included. This option will override any content if the input format is S/MIME and it uses the multipart/signed MIME content type.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>This option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs.</p>
</dd>
<dt id="CAfile-file"><b>-CAfile file</b></dt>
<dd>
<p>A file containing trusted CA certificates, only used with <b>-verify</b>.</p>
</dd>
<dt id="CApath-dir"><b>-CApath dir</b></dt>
<dd>
<p>A directory containing trusted CA certificates, only used with <b>-verify</b>. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location.</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location.</p>
</dd>
<dt id="md-digest"><b>-md digest</b></dt>
<dd>
<p>Digest algorithm to use when signing or resigning. If not present then the default digest algorithm for the signing key will be used (usually SHA1).</p>
</dd>
<dt id="cipher"><b>-<i>cipher</i></b></dt>
<dd>
<p>The encryption algorithm to use. For example DES (56 bits) - <b>-des</b>, triple DES (168 bits) - <b>-des3</b>, EVP_get_cipherbyname() function) can also be used preceded by a dash, for example <b>-aes-128-cbc</b>. See <a href="../man1/enc.html"><b>enc</b></a> for list of ciphers supported by your version of OpenSSL.</p>
<p>If not specified triple DES is used. Only used with <b>-encrypt</b>.</p>
</dd>
<dt id="nointern"><b>-nointern</b></dt>
<dd>
<p>When verifying a message normally certificates (if any) included in the message are searched for the signing certificate. With this option only the certificates specified in the <b>-certfile</b> option are used. The supplied certificates can still be used as untrusted CAs however.</p>
</dd>
<dt id="noverify"><b>-noverify</b></dt>
<dd>
<p>Do not verify the signers certificate of a signed message.</p>
</dd>
<dt id="nochain"><b>-nochain</b></dt>
<dd>
<p>Do not do chain verification of signers certificates: that is don't use the certificates in the signed message as untrusted CAs.</p>
</dd>
<dt id="nosigs"><b>-nosigs</b></dt>
<dd>
<p>Don't try to verify the signatures on the message.</p>
</dd>
<dt id="nocerts"><b>-nocerts</b></dt>
<dd>
<p>When signing a message the signer's certificate is normally included with this option it is excluded. This will reduce the size of the signed message but the verifier must have a copy of the signers certificate available locally (passed using the <b>-certfile</b> option for example).</p>
</dd>
<dt id="noattr"><b>-noattr</b></dt>
<dd>
<p>Normally when a message is signed a set of attributes are included which include the signing time and supported symmetric algorithms. With this option they are not included.</p>
</dd>
<dt id="binary"><b>-binary</b></dt>
<dd>
<p>Normally the input message is converted to "canonical" format which is effectively using CR and LF as end of line: as required by the S/MIME specification. When this option is present no translation occurs. This is useful when handling binary data which may not be in MIME format.</p>
</dd>
<dt id="crlfeol"><b>-crlfeol</b></dt>
<dd>
<p>Normally the output file uses a single <b>LF</b> as end of line. When this option is present <b>CRLF</b> is used instead.</p>
</dd>
<dt id="nodetach"><b>-nodetach</b></dt>
<dd>
<p>When signing a message use opaque signing: this form is more resistant to translation by mail relays but it cannot be read by mail agents that do not support S/MIME. Without this option cleartext signing with the MIME type multipart/signed is used.</p>
</dd>
<dt id="certfile-file"><b>-certfile file</b></dt>
<dd>
<p>Allows additional certificates to be specified. When signing these will be included with the message. When verifying these will be searched for the signers certificates. The certificates should be in PEM format.</p>
</dd>
<dt id="signer-file"><b>-signer file</b></dt>
<dd>
<p>A signing certificate when signing or resigning a message, this option can be used multiple times if more than one signer is required. If a message is being verified then the signers certificates will be written to this file if the verification was successful.</p>
</dd>
<dt id="recip-file"><b>-recip file</b></dt>
<dd>
<p>The recipients certificate when decrypting a message. This certificate must match one of the recipients of the message or an error occurs.</p>
</dd>
<dt id="inkey-file_or_id"><b>-inkey file_or_id</b></dt>
<dd>
<p>The private key to use when signing or decrypting. This must match the corresponding certificate. If this option is not specified then the private key must be included in the certificate file specified with the <b>-recip</b> or <b>-signer</b> file. When signing this option can be used multiple times to specify successive keys. If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The private key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="cert.pem"><b>cert.pem...</b></dt>
<dd>
<p>One or more certificates of message recipients: used when encrypting a message.</p>
</dd>
<dt id="to--from--subject"><b>-to, -from, -subject</b></dt>
<dd>
<p>The relevant mail headers. These are included outside the signed portion of a message so they may be included manually. If signing then many S/MIME mail clients check the signers certificate's email address matches that specified in the From: address.</p>
</dd>
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
<dd>
<p>Set various options of certificate chain verification. See <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The MIME message must be sent without any blank lines between the headers and the output. Some mail programs will automatically add a blank line. Piping the mail directly to sendmail is one way to achieve the correct format.</p>
<p>The supplied message to be signed or encrypted must include the necessary MIME headers or many S/MIME clients won't display it properly (if at all). You can use the <b>-text</b> option to automatically add plain text headers.</p>
<p>A "signed and encrypted" message is one where a signed message is then encrypted. This can be produced by encrypting an already signed message: see the examples section.</p>
<p>This version of the program only allows one signer per message but it will verify multiple signers on received messages. Some S/MIME clients choke if a message contains multiple signers. It is possible to sign messages "in parallel" by signing an already signed message.</p>
<p>The options <b>-encrypt</b> and <b>-decrypt</b> reflect common usage in S/MIME clients. Strictly speaking these process PKCS#7 enveloped data: PKCS#7 encrypted data is used for other purposes.</p>
<p>The <b>-resign</b> option uses an existing message digest when adding a new signer. This means that attributes must be present in at least one existing signer using the same message digest or this operation will fail.</p>
<p>The <b>-stream</b> and <b>-indef</b> options enable streaming I/O support. As a result the encoding is BER using indefinite length constructed encoding and no longer DER. Streaming is supported for the <b>-encrypt</b> operation and the <b>-sign</b> operation if the content is not detached.</p>
<p>Streaming is always used for the <b>-sign</b> operation with detached data but since the content is no longer part of the PKCS#7 structure the encoding remains DER.</p>
<h1 id="EXIT-CODES">EXIT CODES</h1>
<dl>
<dt id="pod0">0</dt>
<dd>
<p>The operation was completely successfully.</p>
</dd>
<dt id="pod1">1</dt>
<dd>
<p>An error occurred parsing the command options.</p>
</dd>
<dt id="pod2">2</dt>
<dd>
<p>One of the input files could not be read.</p>
</dd>
<dt id="pod3">3</dt>
<dd>
<p>An error occurred creating the PKCS#7 file or when reading the MIME message.</p>
</dd>
<dt id="pod4">4</dt>
<dd>
<p>An error occurred decrypting or verifying the message.</p>
</dd>
<dt id="pod5">5</dt>
<dd>
<p>The message was verified correctly but an error occurred writing out the signers certificates.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Create a cleartext signed message:</p>
<pre><code>openssl smime -sign -in message.txt -text -out mail.msg \
-signer mycert.pem</code></pre>
<p>Create an opaque signed message:</p>
<pre><code>openssl smime -sign -in message.txt -text -out mail.msg -nodetach \
-signer mycert.pem</code></pre>
<p>Create a signed message, include some additional certificates and read the private key from another file:</p>
<pre><code>openssl smime -sign -in in.txt -text -out mail.msg \
-signer mycert.pem -inkey mykey.pem -certfile mycerts.pem</code></pre>
<p>Create a signed message with two signers:</p>
<pre><code>openssl smime -sign -in message.txt -text -out mail.msg \
-signer mycert.pem -signer othercert.pem</code></pre>
<p>Send a signed message under Unix directly to sendmail, including headers:</p>
<pre><code>openssl smime -sign -in in.txt -text -signer mycert.pem \
-from steve@openssl.org -to someone@somewhere \
-subject "Signed message" | sendmail someone@somewhere</code></pre>
<p>Verify a message and extract the signer's certificate if successful:</p>
<pre><code>openssl smime -verify -in mail.msg -signer user.pem -out signedtext.txt</code></pre>
<p>Send encrypted mail using triple DES:</p>
<pre><code>openssl smime -encrypt -in in.txt -from steve@openssl.org \
-to someone@somewhere -subject "Encrypted message" \
-des3 user.pem -out mail.msg</code></pre>
<p>Sign and encrypt mail:</p>
<pre><code>openssl smime -sign -in ml.txt -signer my.pem -text \
| openssl smime -encrypt -out mail.msg \
-from steve@openssl.org -to someone@somewhere \
-subject "Signed and Encrypted message" -des3 user.pem</code></pre>
<p>Note: the encryption command does not include the <b>-text</b> option because the message being encrypted already has MIME headers.</p>
<p>Decrypt mail:</p>
<pre><code>openssl smime -decrypt -in mail.msg -recip mycert.pem -inkey key.pem</code></pre>
<p>The output from Netscape form signing is a PKCS#7 structure with the detached signature format. You can use this program to verify the signature by line wrapping the base64 encoded structure and surrounding it with:</p>
<pre><code>-----BEGIN PKCS7-----
-----END PKCS7-----</code></pre>
<p>and using the command:</p>
<pre><code>openssl smime -verify -inform PEM -in signature.pem -content content.txt</code></pre>
<p>Alternatively you can base64 decode the signature and use:</p>
<pre><code>openssl smime -verify -inform DER -in signature.der -content content.txt</code></pre>
<p>Create an encrypted message using 128 bit Camellia:</p>
<pre><code>openssl smime -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem</code></pre>
<p>Add a signer to an existing message:</p>
<pre><code>openssl smime -resign -in mail.msg -signer newsign.pem -out mail2.msg</code></pre>
<h1 id="BUGS">BUGS</h1>
<p>The MIME parser isn't very clever: it seems to handle most messages that I've thrown at it but it may choke on others.</p>
<p>The code currently will only write out the signer's certificate to a file: if the signer has a separate encryption certificate this must be manually extracted. There should be some heuristic that determines the correct encryption certificate.</p>
<p>Ideally a database should be maintained of a certificates for each email address.</p>
<p>The code doesn't currently take note of the permitted symmetric encryption algorithms as supplied in the SMIMECapabilities signed attribute. This means the user has to manually include the correct encryption algorithm. It should store the list of permitted ciphers in a database and only use those.</p>
<p>No revocation checking is done on the signer's certificate.</p>
<p>The current code can only handle S/MIME v2 messages, the more complex S/MIME v3 structures may cause parsing errors.</p>
<h1 id="HISTORY">HISTORY</h1>
<p>The use of multiple <b>-signer</b> options and the <b>-resign</b> command were first added in OpenSSL 1.0.0</p>
<p>The -no_alt_chains option was added in OpenSSL 1.1.0.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]3Pu�S �S openssl/html/man1/openssl.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>openssl</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#COMMAND-SUMMARY">COMMAND SUMMARY</a>
<ul>
<li><a href="#Standard-Commands">Standard Commands</a></li>
<li><a href="#Message-Digest-Commands">Message Digest Commands</a></li>
<li><a href="#Encoding-and-Cipher-Commands">Encoding and Cipher Commands</a></li>
</ul>
</li>
<li><a href="#OPTIONS">OPTIONS</a>
<ul>
<li><a href="#Common-Options">Common Options</a></li>
<li><a href="#Pass-Phrase-Options">Pass Phrase Options</a></li>
</ul>
</li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl - OpenSSL command line tool</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <i>command</i> [ <i>command_opts</i> ] [ <i>command_args</i> ]</p>
<p><b>openssl</b> <b>list</b> [ <b>standard-commands</b> | <b>digest-commands</b> | <b>cipher-commands</b> | <b>cipher-algorithms</b> | <b>digest-algorithms</b> | <b>public-key-algorithms</b>]</p>
<p><b>openssl</b> <b>no-</b><i>XXX</i> [ <i>arbitrary options</i> ]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them.</p>
<p>The <b>openssl</b> program is a command line tool for using the various cryptography functions of OpenSSL's <b>crypto</b> library from the shell. It can be used for</p>
<pre><code>o Creation and management of private keys, public keys and parameters
o Public key cryptographic operations
o Creation of X.509 certificates, CSRs and CRLs
o Calculation of Message Digests
o Encryption and Decryption with Ciphers
o SSL/TLS Client and Server Tests
o Handling of S/MIME signed or encrypted mail
o Time Stamp requests, generation and verification</code></pre>
<h1 id="COMMAND-SUMMARY">COMMAND SUMMARY</h1>
<p>The <b>openssl</b> program provides a rich variety of commands (<i>command</i> in the SYNOPSIS above), each of which often has a wealth of options and arguments (<i>command_opts</i> and <i>command_args</i> in the SYNOPSIS).</p>
<p>Detailed documentation and use cases for most standard subcommands are available (e.g., <a href="../man1/x509.html">x509(1)</a> or <a href="../man1/openssl-x509.html">openssl-x509(1)</a>).</p>
<p>Many commands use an external configuration file for some or all of their arguments and have a <b>-config</b> option to specify that file. The environment variable <b>OPENSSL_CONF</b> can be used to specify the location of the file. If the environment variable is not specified, then the file is named <b>openssl.cnf</b> in the default certificate storage area, whose value depends on the configuration flags specified when the OpenSSL was built.</p>
<p>The list parameters <b>standard-commands</b>, <b>digest-commands</b>, and <b>cipher-commands</b> output a list (one entry per line) of the names of all standard commands, message digest commands, or cipher commands, respectively, that are available in the present <b>openssl</b> utility.</p>
<p>The list parameters <b>cipher-algorithms</b> and <b>digest-algorithms</b> list all cipher and message digest names, one entry per line. Aliases are listed as:</p>
<pre><code>from => to</code></pre>
<p>The list parameter <b>public-key-algorithms</b> lists all supported public key algorithms.</p>
<p>The command <b>no-</b><i>XXX</i> tests whether a command of the specified name is available. If no command named <i>XXX</i> exists, it returns 0 (success) and prints <b>no-</b><i>XXX</i>; otherwise it returns 1 and prints <i>XXX</i>. In both cases, the output goes to <b>stdout</b> and nothing is printed to <b>stderr</b>. Additional command line arguments are always ignored. Since for each cipher there is a command of the same name, this provides an easy way for shell scripts to test for the availability of ciphers in the <b>openssl</b> program. (<b>no-</b><i>XXX</i> is not able to detect pseudo-commands such as <b>quit</b>, <b>list</b>, or <b>no-</b><i>XXX</i> itself.)</p>
<h2 id="Standard-Commands">Standard Commands</h2>
<dl>
<dt id="asn1parse"><b>asn1parse</b></dt>
<dd>
<p>Parse an ASN.1 sequence.</p>
</dd>
<dt id="ca"><b>ca</b></dt>
<dd>
<p>Certificate Authority (CA) Management.</p>
</dd>
<dt id="ciphers"><b>ciphers</b></dt>
<dd>
<p>Cipher Suite Description Determination.</p>
</dd>
<dt id="cms"><b>cms</b></dt>
<dd>
<p>CMS (Cryptographic Message Syntax) utility.</p>
</dd>
<dt id="crl"><b>crl</b></dt>
<dd>
<p>Certificate Revocation List (CRL) Management.</p>
</dd>
<dt id="crl2pkcs7"><b>crl2pkcs7</b></dt>
<dd>
<p>CRL to PKCS#7 Conversion.</p>
</dd>
<dt id="dgst"><b>dgst</b></dt>
<dd>
<p>Message Digest Calculation.</p>
</dd>
<dt id="dh"><b>dh</b></dt>
<dd>
<p>Diffie-Hellman Parameter Management. Obsoleted by <a href="../man1/dhparam.html">dhparam(1)</a>.</p>
</dd>
<dt id="dhparam"><b>dhparam</b></dt>
<dd>
<p>Generation and Management of Diffie-Hellman Parameters. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a> and <a href="../man1/pkeyparam.html">pkeyparam(1)</a>.</p>
</dd>
<dt id="dsa"><b>dsa</b></dt>
<dd>
<p>DSA Data Management.</p>
</dd>
<dt id="dsaparam"><b>dsaparam</b></dt>
<dd>
<p>DSA Parameter Generation and Management. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a> and <a href="../man1/pkeyparam.html">pkeyparam(1)</a>.</p>
</dd>
<dt id="ec"><b>ec</b></dt>
<dd>
<p>EC (Elliptic curve) key processing.</p>
</dd>
<dt id="ecparam"><b>ecparam</b></dt>
<dd>
<p>EC parameter manipulation and generation.</p>
</dd>
<dt id="enc"><b>enc</b></dt>
<dd>
<p>Encoding with Ciphers.</p>
</dd>
<dt id="engine"><b>engine</b></dt>
<dd>
<p>Engine (loadable module) information and manipulation.</p>
</dd>
<dt id="errstr"><b>errstr</b></dt>
<dd>
<p>Error Number to Error String Conversion.</p>
</dd>
<dt id="gendh"><b>gendh</b></dt>
<dd>
<p>Generation of Diffie-Hellman Parameters. Obsoleted by <a href="../man1/dhparam.html">dhparam(1)</a>.</p>
</dd>
<dt id="gendsa"><b>gendsa</b></dt>
<dd>
<p>Generation of DSA Private Key from Parameters. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a> and <a href="../man1/pkey.html">pkey(1)</a>.</p>
</dd>
<dt id="genpkey"><b>genpkey</b></dt>
<dd>
<p>Generation of Private Key or Parameters.</p>
</dd>
<dt id="genrsa"><b>genrsa</b></dt>
<dd>
<p>Generation of RSA Private Key. Superseded by <a href="../man1/genpkey.html">genpkey(1)</a>.</p>
</dd>
<dt id="nseq"><b>nseq</b></dt>
<dd>
<p>Create or examine a Netscape certificate sequence.</p>
</dd>
<dt id="ocsp"><b>ocsp</b></dt>
<dd>
<p>Online Certificate Status Protocol utility.</p>
</dd>
<dt id="passwd"><b>passwd</b></dt>
<dd>
<p>Generation of hashed passwords.</p>
</dd>
<dt id="pkcs12"><b>pkcs12</b></dt>
<dd>
<p>PKCS#12 Data Management.</p>
</dd>
<dt id="pkcs7"><b>pkcs7</b></dt>
<dd>
<p>PKCS#7 Data Management.</p>
</dd>
<dt id="pkcs8"><b>pkcs8</b></dt>
<dd>
<p>PKCS#8 format private key conversion tool.</p>
</dd>
<dt id="pkey"><b>pkey</b></dt>
<dd>
<p>Public and private key management.</p>
</dd>
<dt id="pkeyparam"><b>pkeyparam</b></dt>
<dd>
<p>Public key algorithm parameter management.</p>
</dd>
<dt id="pkeyutl"><b>pkeyutl</b></dt>
<dd>
<p>Public key algorithm cryptographic operation utility.</p>
</dd>
<dt id="prime"><b>prime</b></dt>
<dd>
<p>Compute prime numbers.</p>
</dd>
<dt id="rand"><b>rand</b></dt>
<dd>
<p>Generate pseudo-random bytes.</p>
</dd>
<dt id="rehash"><b>rehash</b></dt>
<dd>
<p>Create symbolic links to certificate and CRL files named by the hash values.</p>
</dd>
<dt id="req"><b>req</b></dt>
<dd>
<p>PKCS#10 X.509 Certificate Signing Request (CSR) Management.</p>
</dd>
<dt id="rsa"><b>rsa</b></dt>
<dd>
<p>RSA key management.</p>
</dd>
<dt id="rsautl"><b>rsautl</b></dt>
<dd>
<p>RSA utility for signing, verification, encryption, and decryption. Superseded by <a href="../man1/pkeyutl.html">pkeyutl(1)</a>.</p>
</dd>
<dt id="s_client"><b>s_client</b></dt>
<dd>
<p>This implements a generic SSL/TLS client which can establish a transparent connection to a remote server speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL <b>ssl</b> library.</p>
</dd>
<dt id="s_server"><b>s_server</b></dt>
<dd>
<p>This implements a generic SSL/TLS server which accepts connections from remote clients speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL <b>ssl</b> library. It provides both an own command line oriented protocol for testing SSL functions and a simple HTTP response facility to emulate an SSL/TLS-aware webserver.</p>
</dd>
<dt id="s_time"><b>s_time</b></dt>
<dd>
<p>SSL Connection Timer.</p>
</dd>
<dt id="sess_id"><b>sess_id</b></dt>
<dd>
<p>SSL Session Data Management.</p>
</dd>
<dt id="smime"><b>smime</b></dt>
<dd>
<p>S/MIME mail processing.</p>
</dd>
<dt id="speed"><b>speed</b></dt>
<dd>
<p>Algorithm Speed Measurement.</p>
</dd>
<dt id="spkac"><b>spkac</b></dt>
<dd>
<p>SPKAC printing and generating utility.</p>
</dd>
<dt id="srp"><b>srp</b></dt>
<dd>
<p>Maintain SRP password file.</p>
</dd>
<dt id="storeutl"><b>storeutl</b></dt>
<dd>
<p>Utility to list and display certificates, keys, CRLs, etc.</p>
</dd>
<dt id="ts"><b>ts</b></dt>
<dd>
<p>Time Stamping Authority tool (client/server).</p>
</dd>
<dt id="verify"><b>verify</b></dt>
<dd>
<p>X.509 Certificate Verification.</p>
</dd>
<dt id="version"><b>version</b></dt>
<dd>
<p>OpenSSL Version Information.</p>
</dd>
<dt id="x509"><b>x509</b></dt>
<dd>
<p>X.509 Certificate Data Management.</p>
</dd>
</dl>
<h2 id="Message-Digest-Commands">Message Digest Commands</h2>
<dl>
<dt id="blake2b512"><b>blake2b512</b></dt>
<dd>
<p>BLAKE2b-512 Digest</p>
</dd>
<dt id="blake2s256"><b>blake2s256</b></dt>
<dd>
<p>BLAKE2s-256 Digest</p>
</dd>
<dt id="md2"><b>md2</b></dt>
<dd>
<p>MD2 Digest</p>
</dd>
<dt id="md4"><b>md4</b></dt>
<dd>
<p>MD4 Digest</p>
</dd>
<dt id="md5"><b>md5</b></dt>
<dd>
<p>MD5 Digest</p>
</dd>
<dt id="mdc2"><b>mdc2</b></dt>
<dd>
<p>MDC2 Digest</p>
</dd>
<dt id="rmd160"><b>rmd160</b></dt>
<dd>
<p>RMD-160 Digest</p>
</dd>
<dt id="sha1"><b>sha1</b></dt>
<dd>
<p>SHA-1 Digest</p>
</dd>
<dt id="sha224"><b>sha224</b></dt>
<dd>
<p>SHA-2 224 Digest</p>
</dd>
<dt id="sha256"><b>sha256</b></dt>
<dd>
<p>SHA-2 256 Digest</p>
</dd>
<dt id="sha384"><b>sha384</b></dt>
<dd>
<p>SHA-2 384 Digest</p>
</dd>
<dt id="sha512"><b>sha512</b></dt>
<dd>
<p>SHA-2 512 Digest</p>
</dd>
<dt id="sha3-224"><b>sha3-224</b></dt>
<dd>
<p>SHA-3 224 Digest</p>
</dd>
<dt id="sha3-256"><b>sha3-256</b></dt>
<dd>
<p>SHA-3 256 Digest</p>
</dd>
<dt id="sha3-384"><b>sha3-384</b></dt>
<dd>
<p>SHA-3 384 Digest</p>
</dd>
<dt id="sha3-512"><b>sha3-512</b></dt>
<dd>
<p>SHA-3 512 Digest</p>
</dd>
<dt id="shake128"><b>shake128</b></dt>
<dd>
<p>SHA-3 SHAKE128 Digest</p>
</dd>
<dt id="shake256"><b>shake256</b></dt>
<dd>
<p>SHA-3 SHAKE256 Digest</p>
</dd>
<dt id="sm3"><b>sm3</b></dt>
<dd>
<p>SM3 Digest</p>
</dd>
</dl>
<h2 id="Encoding-and-Cipher-Commands">Encoding and Cipher Commands</h2>
<p>The following aliases provide convenient access to the most used encodings and ciphers.</p>
<p>Depending on how OpenSSL was configured and built, not all ciphers listed here may be present. See <a href="../man1/enc.html">enc(1)</a> for more information and command usage.</p>
<dl>
<dt id="aes128-aes-128-cbc-aes-128-cfb-aes-128-ctr-aes-128-ecb-aes-128-ofb"><b>aes128</b>, <b>aes-128-cbc</b>, <b>aes-128-cfb</b>, <b>aes-128-ctr</b>, <b>aes-128-ecb</b>, <b>aes-128-ofb</b></dt>
<dd>
<p>AES-128 Cipher</p>
</dd>
<dt id="aes192-aes-192-cbc-aes-192-cfb-aes-192-ctr-aes-192-ecb-aes-192-ofb"><b>aes192</b>, <b>aes-192-cbc</b>, <b>aes-192-cfb</b>, <b>aes-192-ctr</b>, <b>aes-192-ecb</b>, <b>aes-192-ofb</b></dt>
<dd>
<p>AES-192 Cipher</p>
</dd>
<dt id="aes256-aes-256-cbc-aes-256-cfb-aes-256-ctr-aes-256-ecb-aes-256-ofb"><b>aes256</b>, <b>aes-256-cbc</b>, <b>aes-256-cfb</b>, <b>aes-256-ctr</b>, <b>aes-256-ecb</b>, <b>aes-256-ofb</b></dt>
<dd>
<p>AES-256 Cipher</p>
</dd>
<dt id="aria128-aria-128-cbc-aria-128-cfb-aria-128-ctr-aria-128-ecb-aria-128-ofb"><b>aria128</b>, <b>aria-128-cbc</b>, <b>aria-128-cfb</b>, <b>aria-128-ctr</b>, <b>aria-128-ecb</b>, <b>aria-128-ofb</b></dt>
<dd>
<p>Aria-128 Cipher</p>
</dd>
<dt id="aria192-aria-192-cbc-aria-192-cfb-aria-192-ctr-aria-192-ecb-aria-192-ofb"><b>aria192</b>, <b>aria-192-cbc</b>, <b>aria-192-cfb</b>, <b>aria-192-ctr</b>, <b>aria-192-ecb</b>, <b>aria-192-ofb</b></dt>
<dd>
<p>Aria-192 Cipher</p>
</dd>
<dt id="aria256-aria-256-cbc-aria-256-cfb-aria-256-ctr-aria-256-ecb-aria-256-ofb"><b>aria256</b>, <b>aria-256-cbc</b>, <b>aria-256-cfb</b>, <b>aria-256-ctr</b>, <b>aria-256-ecb</b>, <b>aria-256-ofb</b></dt>
<dd>
<p>Aria-256 Cipher</p>
</dd>
<dt id="base64"><b>base64</b></dt>
<dd>
<p>Base64 Encoding</p>
</dd>
<dt id="bf-bf-cbc-bf-cfb-bf-ecb-bf-ofb"><b>bf</b>, <b>bf-cbc</b>, <b>bf-cfb</b>, <b>bf-ecb</b>, <b>bf-ofb</b></dt>
<dd>
<p>Blowfish Cipher</p>
</dd>
<dt id="camellia128-camellia-128-cbc-camellia-128-cfb-camellia-128-ctr-camellia-128-ecb-camellia-128-ofb"><b>camellia128</b>, <b>camellia-128-cbc</b>, <b>camellia-128-cfb</b>, <b>camellia-128-ctr</b>, <b>camellia-128-ecb</b>, <b>camellia-128-ofb</b></dt>
<dd>
<p>Camellia-128 Cipher</p>
</dd>
<dt id="camellia192-camellia-192-cbc-camellia-192-cfb-camellia-192-ctr-camellia-192-ecb-camellia-192-ofb"><b>camellia192</b>, <b>camellia-192-cbc</b>, <b>camellia-192-cfb</b>, <b>camellia-192-ctr</b>, <b>camellia-192-ecb</b>, <b>camellia-192-ofb</b></dt>
<dd>
<p>Camellia-192 Cipher</p>
</dd>
<dt id="camellia256-camellia-256-cbc-camellia-256-cfb-camellia-256-ctr-camellia-256-ecb-camellia-256-ofb"><b>camellia256</b>, <b>camellia-256-cbc</b>, <b>camellia-256-cfb</b>, <b>camellia-256-ctr</b>, <b>camellia-256-ecb</b>, <b>camellia-256-ofb</b></dt>
<dd>
<p>Camellia-256 Cipher</p>
</dd>
<dt id="cast-cast-cbc"><b>cast</b>, <b>cast-cbc</b></dt>
<dd>
<p>CAST Cipher</p>
</dd>
<dt id="cast5-cbc-cast5-cfb-cast5-ecb-cast5-ofb"><b>cast5-cbc</b>, <b>cast5-cfb</b>, <b>cast5-ecb</b>, <b>cast5-ofb</b></dt>
<dd>
<p>CAST5 Cipher</p>
</dd>
<dt id="chacha20"><b>chacha20</b></dt>
<dd>
<p>Chacha20 Cipher</p>
</dd>
<dt id="des-des-cbc-des-cfb-des-ecb-des-ede-des-ede-cbc-des-ede-cfb-des-ede-ofb-des-ofb"><b>des</b>, <b>des-cbc</b>, <b>des-cfb</b>, <b>des-ecb</b>, <b>des-ede</b>, <b>des-ede-cbc</b>, <b>des-ede-cfb</b>, <b>des-ede-ofb</b>, <b>des-ofb</b></dt>
<dd>
<p>DES Cipher</p>
</dd>
<dt id="des3-desx-des-ede3-des-ede3-cbc-des-ede3-cfb-des-ede3-ofb"><b>des3</b>, <b>desx</b>, <b>des-ede3</b>, <b>des-ede3-cbc</b>, <b>des-ede3-cfb</b>, <b>des-ede3-ofb</b></dt>
<dd>
<p>Triple-DES Cipher</p>
</dd>
<dt id="idea-idea-cbc-idea-cfb-idea-ecb-idea-ofb"><b>idea</b>, <b>idea-cbc</b>, <b>idea-cfb</b>, <b>idea-ecb</b>, <b>idea-ofb</b></dt>
<dd>
<p>IDEA Cipher</p>
</dd>
<dt id="rc2-rc2-cbc-rc2-cfb-rc2-ecb-rc2-ofb"><b>rc2</b>, <b>rc2-cbc</b>, <b>rc2-cfb</b>, <b>rc2-ecb</b>, <b>rc2-ofb</b></dt>
<dd>
<p>RC2 Cipher</p>
</dd>
<dt id="rc4"><b>rc4</b></dt>
<dd>
<p>RC4 Cipher</p>
</dd>
<dt id="rc5-rc5-cbc-rc5-cfb-rc5-ecb-rc5-ofb"><b>rc5</b>, <b>rc5-cbc</b>, <b>rc5-cfb</b>, <b>rc5-ecb</b>, <b>rc5-ofb</b></dt>
<dd>
<p>RC5 Cipher</p>
</dd>
<dt id="seed-seed-cbc-seed-cfb-seed-ecb-seed-ofb"><b>seed</b>, <b>seed-cbc</b>, <b>seed-cfb</b>, <b>seed-ecb</b>, <b>seed-ofb</b></dt>
<dd>
<p>SEED Cipher</p>
</dd>
<dt id="sm4-sm4-cbc-sm4-cfb-sm4-ctr-sm4-ecb-sm4-ofb"><b>sm4</b>, <b>sm4-cbc</b>, <b>sm4-cfb</b>, <b>sm4-ctr</b>, <b>sm4-ecb</b>, <b>sm4-ofb</b></dt>
<dd>
<p>SM4 Cipher</p>
</dd>
</dl>
<h1 id="OPTIONS">OPTIONS</h1>
<p>Details of which options are available depend on the specific command. This section describes some common options with common behavior.</p>
<h2 id="Common-Options">Common Options</h2>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Provides a terse summary of all options.</p>
</dd>
</dl>
<h2 id="Pass-Phrase-Options">Pass Phrase Options</h2>
<p>Several commands accept password arguments, typically using <b>-passin</b> and <b>-passout</b> for input and output passwords respectively. These allow the password to be obtained from a variety of sources. Both of these options take a single argument whose format is described below. If no password argument is given and a password is required then the user is prompted to enter one: this will typically be read from the current terminal with echoing turned off.</p>
<p>Note that character encoding may be relevant, please see <a href="../man7/passphrase-encoding.html">passphrase-encoding(7)</a>.</p>
<dl>
<dt id="pass:password"><b>pass:password</b></dt>
<dd>
<p>The actual password is <b>password</b>. Since the password is visible to utilities (like 'ps' under Unix) this form should only be used where security is not important.</p>
</dd>
<dt id="env:var"><b>env:var</b></dt>
<dd>
<p>Obtain the password from the environment variable <b>var</b>. Since the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes) this option should be used with caution.</p>
</dd>
<dt id="file:pathname"><b>file:pathname</b></dt>
<dd>
<p>The first line of <b>pathname</b> is the password. If the same <b>pathname</b> argument is supplied to <b>-passin</b> and <b>-passout</b> arguments then the first line will be used for the input password and the next line for the output password. <b>pathname</b> need not refer to a regular file: it could for example refer to a device or named pipe.</p>
</dd>
<dt id="fd:number"><b>fd:number</b></dt>
<dd>
<p>Read the password from the file descriptor <b>number</b>. This can be used to send the data via a pipe for example.</p>
</dd>
<dt id="stdin"><b>stdin</b></dt>
<dd>
<p>Read the password from standard input.</p>
</dd>
</dl>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/asn1parse.html">asn1parse(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/ciphers.html">ciphers(1)</a>, <a href="../man1/cms.html">cms(1)</a>, <a href="../man5/config.html">config(5)</a>, <a href="../man1/crl.html">crl(1)</a>, <a href="../man1/crl2pkcs7.html">crl2pkcs7(1)</a>, <a href="../man1/dgst.html">dgst(1)</a>, <a href="../man1/dhparam.html">dhparam(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/dsaparam.html">dsaparam(1)</a>, <a href="../man1/ec.html">ec(1)</a>, <a href="../man1/ecparam.html">ecparam(1)</a>, <a href="../man1/enc.html">enc(1)</a>, <a href="../man1/engine.html">engine(1)</a>, <a href="../man1/errstr.html">errstr(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/nseq.html">nseq(1)</a>, <a href="../man1/ocsp.html">ocsp(1)</a>, <a href="../man1/passwd.html">passwd(1)</a>, <a href="../man1/pkcs12.html">pkcs12(1)</a>, <a href="../man1/pkcs7.html">pkcs7(1)</a>, <a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/pkey.html">pkey(1)</a>, <a href="../man1/pkeyparam.html">pkeyparam(1)</a>, <a href="../man1/pkeyutl.html">pkeyutl(1)</a>, <a href="../man1/prime.html">prime(1)</a>, <a href="../man1/rand.html">rand(1)</a>, <a href="../man1/rehash.html">rehash(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/rsautl.html">rsautl(1)</a>, <a href="../man1/s_client.html">s_client(1)</a>, <a href="../man1/s_server.html">s_server(1)</a>, <a href="../man1/s_time.html">s_time(1)</a>, <a href="../man1/sess_id.html">sess_id(1)</a>, <a href="../man1/smime.html">smime(1)</a>, <a href="../man1/speed.html">speed(1)</a>, <a href="../man1/spkac.html">spkac(1)</a>, <a href="../man1/srp.html">srp(1)</a>, <a href="../man1/storeutl.html">storeutl(1)</a>, <a href="../man1/ts.html">ts(1)</a>, <a href="../man1/verify.html">verify(1)</a>, <a href="../man1/version.html">version(1)</a>, <a href="../man1/x509.html">x509(1)</a>, <a href="../man7/crypto.html">crypto(7)</a>, <a href="../man7/ssl.html">ssl(7)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The <b>list-</b><i>XXX</i><b>-algorithms</b> pseudo-commands were added in OpenSSL 1.0.0; For notes on the availability of other commands, see their individual manual pages.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]D��)� � openssl/html/man1/dhparam.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>dhparam</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#WARNINGS">WARNINGS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-dhparam, dhparam - DH parameter manipulation and generation</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl dhparam</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-in</b> <i>filename</i>] [<b>-out</b> <i>filename</i>] [<b>-dsaparam</b>] [<b>-check</b>] [<b>-noout</b>] [<b>-text</b>] [<b>-C</b>] [<b>-2</b>] [<b>-5</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<i>numbits</i>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>This command is used to manipulate DH parameter files.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with the PKCS#3 DHparameter structure. The PEM form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in</b> <i>filename</i></dt>
<dd>
<p>This specifies the input filename to read parameters from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out</b> <i>filename</i></dt>
<dd>
<p>This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="dsaparam"><b>-dsaparam</b></dt>
<dd>
<p>If this option is used, DSA rather than DH parameters are read or created; they are converted to DH format. Otherwise, "strong" primes (such that (p-1)/2 is also prime) will be used for DH parameter generation.</p>
<p>DH parameter generation with the <b>-dsaparam</b> option is much faster, and the recommended exponent length is shorter, which makes DH key exchange more efficient. Beware that with such DSA-style DH parameters, a fresh DH key should be created for each use to avoid small-subgroup attacks that may be possible otherwise.</p>
</dd>
<dt id="check"><b>-check</b></dt>
<dd>
<p>Performs numerous checks to see if the supplied parameters are valid and displays a warning if not.</p>
</dd>
<dt id="pod-2--5"><b>-2</b>, <b>-5</b></dt>
<dd>
<p>The generator to use, either 2 or 5. If present then the input file is ignored and parameters are generated instead. If not present but <b>numbits</b> is present, parameters are generated with the default generator 2.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="numbits"><i>numbits</i></dt>
<dd>
<p>This option specifies that a parameter set should be generated of size <i>numbits</i>. It must be the last option. If this option is present then the input file is ignored and parameters are generated instead. If this option is not present but a generator (<b>-2</b> or <b>-5</b>) is present, parameters are generated with a default length of 2048 bits.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option inhibits the output of the encoded version of the parameters.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>This option prints out the DH parameters in human readable form.</p>
</dd>
<dt id="C"><b>-C</b></dt>
<dd>
<p>This option converts the parameters into C code. The parameters can then be loaded by calling the get_dhNNNN() function.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>dhparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="WARNINGS">WARNINGS</h1>
<p>The program <b>dhparam</b> combines the functionality of the programs <b>dh</b> and <b>gendh</b> in previous versions of OpenSSL. The <b>dh</b> and <b>gendh</b> programs are retained for now but may have different purposes in future versions of OpenSSL.</p>
<h1 id="NOTES">NOTES</h1>
<p>PEM format DH parameters use the header and footer lines:</p>
<pre><code>-----BEGIN DH PARAMETERS-----
-----END DH PARAMETERS-----</code></pre>
<p>OpenSSL currently only supports the older PKCS#3 DH, not the newer X9.42 DH.</p>
<p>This program manipulates DH parameters not keys.</p>
<h1 id="BUGS">BUGS</h1>
<p>There should be a way to generate and manipulate DH keys.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/dsaparam.html">dsaparam(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]T���� � openssl/html/man1/dsa.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>dsa</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-dsa, dsa - DSA key processing</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>dsa</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-modulus</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-engine id</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>dsa</b> command processes DSA keys. They can be converted between various forms and their components printed out. <b>Note</b> This command uses the traditional SSLeay compatible format for private key encryption: newer applications should use the more secure PKCS#8 format using the <b>pkcs8</b></p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option with a private key uses an ASN1 DER encoded form of an ASN.1 SEQUENCE consisting of the values of version (currently zero), p, q, g, the public and private key components respectively as ASN.1 INTEGERs. When used with a public key it uses a SubjectPublicKeyInfo structure: it is an error if the key is not DSA.</p>
<p>The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines. In the case of a private key PKCS#8 format is also accepted.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The input file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write a key to or standard output by is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="passout-arg"><b>-passout arg</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
<dd>
<p>These options encrypt the private key with the specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the <b>dsa</b> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the public, private key components and parameters.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option prevents output of the encoded version of the key.</p>
</dd>
<dt id="modulus"><b>-modulus</b></dt>
<dd>
<p>This option prints out the value of the public key component of the key.</p>
</dd>
<dt id="pubin"><b>-pubin</b></dt>
<dd>
<p>By default, a private key is read from the input file. With this option a public key is read instead.</p>
</dd>
<dt id="pubout"><b>-pubout</b></dt>
<dd>
<p>By default, a private key is output. With this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>dsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The PEM private key format uses the header and footer lines:</p>
<pre><code>-----BEGIN DSA PRIVATE KEY-----
-----END DSA PRIVATE KEY-----</code></pre>
<p>The PEM public key format uses the header and footer lines:</p>
<pre><code>-----BEGIN PUBLIC KEY-----
-----END PUBLIC KEY-----</code></pre>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>To remove the pass phrase on a DSA private key:</p>
<pre><code>openssl dsa -in key.pem -out keyout.pem</code></pre>
<p>To encrypt a private key using triple DES:</p>
<pre><code>openssl dsa -in key.pem -des3 -out keyout.pem</code></pre>
<p>To convert a private key from PEM to DER format:</p>
<pre><code>openssl dsa -in key.pem -outform DER -out keyout.der</code></pre>
<p>To print out the components of a private key to standard output:</p>
<pre><code>openssl dsa -in key.pem -text -noout</code></pre>
<p>To just output the public part of a private key:</p>
<pre><code>openssl dsa -in key.pem -pubout -out pubkey.pem</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/dsaparam.html">dsaparam(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]����~
~
openssl/html/man1/list.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>list</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-list, list - list algorithms and features</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl list</b> [<b>-help</b>] [<b>-1</b>] [<b>-commands</b>] [<b>-digest-commands</b>] [<b>-digest-algorithms</b>] [<b>-cipher-commands</b>] [<b>-cipher-algorithms</b>] [<b>-public-key-algorithms</b>] [<b>-public-key-methods</b>] [<b>-disabled</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>This command is used to generate list of algorithms or disabled features.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Display a usage message.</p>
</dd>
<dt id="pod-1"><b>-1</b></dt>
<dd>
<p>List the commands, digest-commands, or cipher-commands in a single column. If used, this option must be given first.</p>
</dd>
<dt id="commands"><b>-commands</b></dt>
<dd>
<p>Display a list of standard commands.</p>
</dd>
<dt id="digest-commands"><b>-digest-commands</b></dt>
<dd>
<p>Display a list of message digest commands, which are typically used as input to the <a href="../man1/dgst.html">dgst(1)</a> or <a href="../man1/speed.html">speed(1)</a> commands.</p>
</dd>
<dt id="digest-algorithms"><b>-digest-algorithms</b></dt>
<dd>
<p>Display a list of message digest algorithms. If a line is of the form foo => bar then <b>foo</b> is an alias for the official algorithm name, <b>bar</b>.</p>
</dd>
<dt id="cipher-commands"><b>-cipher-commands</b></dt>
<dd>
<p>Display a list of cipher commands, which are typically used as input to the <a href="../man1/dgst.html">dgst(1)</a> or <a href="../man1/speed.html">speed(1)</a> commands.</p>
</dd>
<dt id="cipher-algorithms"><b>-cipher-algorithms</b></dt>
<dd>
<p>Display a list of cipher algorithms. If a line is of the form foo => bar then <b>foo</b> is an alias for the official algorithm name, <b>bar</b>.</p>
</dd>
<dt id="public-key-algorithms"><b>-public-key-algorithms</b></dt>
<dd>
<p>Display a list of public key algorithms, with each algorithm as a block of multiple lines, all but the first are indented.</p>
</dd>
<dt id="public-key-methods"><b>-public-key-methods</b></dt>
<dd>
<p>Display a list of public key method OIDs: this also includes public key methods without an associated ASN.1 method, for example, KDF algorithms.</p>
</dd>
<dt id="disabled"><b>-disabled</b></dt>
<dd>
<p>Display a list of disabled features, those that were compiled out of the installation.</p>
</dd>
</dl>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )][��� � openssl/html/man1/sess_id.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>sess_id</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#OUTPUT">OUTPUT</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-sess_id, sess_id - SSL/TLS session handling utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>sess_id</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER|NSS</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-context ID</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>sess_id</b> process the encoded version of the SSL session structure and optionally prints out SSL session details (for example the SSL session master key) in human readable format. Since this is a diagnostic tool that needs some knowledge of the SSL protocol to use properly, most users will not need to use it.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded format containing session details. The precise format can vary from one version to the next. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
</dd>
<dt id="outform-DER-PEM-NSS"><b>-outform DER|PEM|NSS</b></dt>
<dd>
<p>This specifies the output format. The <b>PEM</b> and <b>DER</b> options have the same meaning and default as the <b>-inform</b> option. The <b>NSS</b> option outputs the session id and the master key in NSS keylog format.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read session information from or standard input by default.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write session information to or standard output if this option is not specified.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the various public or private key components in plain text in addition to the encoded version.</p>
</dd>
<dt id="cert"><b>-cert</b></dt>
<dd>
<p>If a certificate is present in the session it will be output using this option, if the <b>-text</b> option is also present then it will be printed out in text form.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option prevents output of the encoded version of the session.</p>
</dd>
<dt id="context-ID"><b>-context ID</b></dt>
<dd>
<p>This option can set the session id so the output session information uses the supplied ID. The ID can be any string of characters. This option won't normally be used.</p>
</dd>
</dl>
<h1 id="OUTPUT">OUTPUT</h1>
<p>Typical output:</p>
<pre><code>SSL-Session:
Protocol : TLSv1
Cipher : 0016
Session-ID: 871E62626C554CE95488823752CBD5F3673A3EF3DCE9C67BD916C809914B40ED
Session-ID-ctx: 01000000
Master-Key: A7CEFC571974BE02CAC305269DC59F76EA9F0B180CB6642697A68251F2D2BB57E51DBBB4C7885573192AE9AEE220FACD
Key-Arg : None
Start Time: 948459261
Timeout : 300 (sec)
Verify return code 0 (ok)</code></pre>
<p>These are described below in more detail.</p>
<dl>
<dt id="Protocol"><b>Protocol</b></dt>
<dd>
<p>This is the protocol in use TLSv1.3, TLSv1.2, TLSv1.1, TLSv1 or SSLv3.</p>
</dd>
<dt id="Cipher"><b>Cipher</b></dt>
<dd>
<p>The cipher used this is the actual raw SSL or TLS cipher code, see the SSL or TLS specifications for more information.</p>
</dd>
<dt id="Session-ID"><b>Session-ID</b></dt>
<dd>
<p>The SSL session ID in hex format.</p>
</dd>
<dt id="Session-ID-ctx"><b>Session-ID-ctx</b></dt>
<dd>
<p>The session ID context in hex format.</p>
</dd>
<dt id="Master-Key"><b>Master-Key</b></dt>
<dd>
<p>This is the SSL session master key.</p>
</dd>
<dt id="Start-Time"><b>Start Time</b></dt>
<dd>
<p>This is the session start time represented as an integer in standard Unix format.</p>
</dd>
<dt id="Timeout"><b>Timeout</b></dt>
<dd>
<p>The timeout in seconds.</p>
</dd>
<dt id="Verify-return-code"><b>Verify return code</b></dt>
<dd>
<p>This is the return code when an SSL client certificate is verified.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The PEM encoded session format uses the header and footer lines:</p>
<pre><code>-----BEGIN SSL SESSION PARAMETERS-----
-----END SSL SESSION PARAMETERS-----</code></pre>
<p>Since the SSL session output contains the master key it is possible to read the contents of an encrypted session using this information. Therefore, appropriate security precautions should be taken if the information is being output by a "real" application. This is however strongly discouraged and should only be used for debugging purposes.</p>
<h1 id="BUGS">BUGS</h1>
<p>The cipher and start time should be printed out in human readable form.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/ciphers.html">ciphers(1)</a>, <a href="../man1/s_server.html">s_server(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�w �
�
openssl/html/man1/srp.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>srp</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-srp, srp - maintain SRP password file</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl srp</b> [<b>-help</b>] [<b>-verbose</b>] [<b>-add</b>] [<b>-modify</b>] [<b>-delete</b>] [<b>-list</b>] [<b>-name section</b>] [<b>-config file</b>] [<b>-srpvfile file</b>] [<b>-gn identifier</b>] [<b>-userinfo text...</b>] [<b>-passin arg</b>] [<b>-passout arg</b>] [<i>user...</i>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>srp</b> command is user to maintain an SRP (secure remote password) file. At most one of the <b>-add</b>, <b>-modify</b>, <b>-delete</b>, and <b>-list</b> options can be specified. These options take zero or more usernames as parameters and perform the appropriate operation on the SRP file. For <b>-list</b>, if no <b>user</b> is given then all users are displayed.</p>
<p>The configuration file to use, and the section within the file, can be specified with the <b>-config</b> and <b>-name</b> flags, respectively. If the config file is not specified, the <b>-srpvfile</b> can be used to just specify the file to operate on.</p>
<p>The <b>-userinfo</b> option specifies additional information to add when adding or modifying a user.</p>
<p>The <b>-gn</b> flag specifies the <b>g</b> and <b>N</b> values, using one of the strengths defined in IETF RFC 5054.</p>
<p>The <b>-passin</b> and <b>-passout</b> arguments are parsed as described in the <a href="../man1/openssl.html">openssl(1)</a> command.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help">[<b>-help</b>]</dt>
<dd>
<p>Display an option summary.</p>
</dd>
<dt id="verbose">[<b>-verbose</b>]</dt>
<dd>
<p>Generate verbose output while processing.</p>
</dd>
</dl>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]{� W� � openssl/html/man1/x509.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>x509</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a>
<ul>
<li><a href="#Input-Output-and-General-Purpose-Options">Input, Output, and General Purpose Options</a></li>
<li><a href="#Display-Options">Display Options</a></li>
<li><a href="#Trust-Settings">Trust Settings</a></li>
<li><a href="#Signing-Options">Signing Options</a></li>
<li><a href="#Name-Options">Name Options</a></li>
<li><a href="#Text-Options">Text Options</a></li>
</ul>
</li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#CERTIFICATE-EXTENSIONS">CERTIFICATE EXTENSIONS</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-x509, x509 - Certificate display and signing utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>x509</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-keyform DER|PEM|ENGINE</b>] [<b>-CAform DER|PEM</b>] [<b>-CAkeyform DER|PEM</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-serial</b>] [<b>-hash</b>] [<b>-subject_hash</b>] [<b>-issuer_hash</b>] [<b>-ocspid</b>] [<b>-subject</b>] [<b>-issuer</b>] [<b>-nameopt option</b>] [<b>-email</b>] [<b>-ocsp_uri</b>] [<b>-startdate</b>] [<b>-enddate</b>] [<b>-purpose</b>] [<b>-dates</b>] [<b>-checkend num</b>] [<b>-modulus</b>] [<b>-pubkey</b>] [<b>-fingerprint</b>] [<b>-alias</b>] [<b>-noout</b>] [<b>-trustout</b>] [<b>-clrtrust</b>] [<b>-clrreject</b>] [<b>-addtrust arg</b>] [<b>-addreject arg</b>] [<b>-setalias arg</b>] [<b>-days arg</b>] [<b>-set_serial n</b>] [<b>-signkey arg</b>] [<b>-passin arg</b>] [<b>-x509toreq</b>] [<b>-req</b>] [<b>-CA filename</b>] [<b>-CAkey filename</b>] [<b>-CAcreateserial</b>] [<b>-CAserial filename</b>] [<b>-force_pubkey key</b>] [<b>-text</b>] [<b>-ext extensions</b>] [<b>-certopt option</b>] [<b>-C</b>] [<b>-<i>digest</i></b>] [<b>-clrext</b>] [<b>-extfile filename</b>] [<b>-extensions section</b>] [<b>-sigopt nm:v</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>-preserve_dates</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>x509</b> command is a multi purpose certificate utility. It can be used to display certificate information, convert certificates to various forms, sign certificate requests like a "mini CA" or edit certificate trust settings.</p>
<p>Since there are a large number of options they will split up into various sections.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<h2 id="Input-Output-and-General-Purpose-Options">Input, Output, and General Purpose Options</h2>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format normally the command will expect an X509 certificate but this can change if other options such as <b>-req</b> are present. The DER format is the DER encoding of the certificate and PEM is the base64 encoding of the DER encoding with header and footer lines added. The default format is PEM.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a certificate from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="digest"><b>-<i>digest</i></b></dt>
<dd>
<p>The digest to use. This affects any signing or display option that uses a message digest, such as the <b>-fingerprint</b>, <b>-signkey</b> and <b>-CA</b> options. Any digest supported by the OpenSSL <b>dgst</b> command can be used. If not specified then SHA1 is used with <b>-fingerprint</b> or the default digest for the signing algorithm is used, typically SHA256.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>x509</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="preserve_dates"><b>-preserve_dates</b></dt>
<dd>
<p>When signing a certificate, preserve the "notBefore" and "notAfter" dates instead of adjusting them to current time and duration. Cannot be used with the <b>-days</b> option.</p>
</dd>
</dl>
<h2 id="Display-Options">Display Options</h2>
<p>Note: the <b>-alias</b> and <b>-purpose</b> options are also display options but are described in the <b>TRUST SETTINGS</b> section.</p>
<dl>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the certificate in text form. Full details are output including the public key, signature algorithms, issuer and subject names, serial number any extensions present and any trust settings.</p>
</dd>
<dt id="ext-extensions"><b>-ext extensions</b></dt>
<dd>
<p>Prints out the certificate extensions in text form. Extensions are specified with a comma separated string, e.g., "subjectAltName,subjectKeyIdentifier". See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for the extension names.</p>
</dd>
<dt id="certopt-option"><b>-certopt option</b></dt>
<dd>
<p>Customise the output format used with <b>-text</b>. The <b>option</b> argument can be a single option or multiple options separated by commas. The <b>-certopt</b> switch may be also be used more than once to set multiple options. See the <b>TEXT OPTIONS</b> section for more information.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option prevents output of the encoded version of the certificate.</p>
</dd>
<dt id="pubkey"><b>-pubkey</b></dt>
<dd>
<p>Outputs the certificate's SubjectPublicKeyInfo block in PEM format.</p>
</dd>
<dt id="modulus"><b>-modulus</b></dt>
<dd>
<p>This option prints out the value of the modulus of the public key contained in the certificate.</p>
</dd>
<dt id="serial"><b>-serial</b></dt>
<dd>
<p>Outputs the certificate serial number.</p>
</dd>
<dt id="subject_hash"><b>-subject_hash</b></dt>
<dd>
<p>Outputs the "hash" of the certificate subject name. This is used in OpenSSL to form an index to allow certificates in a directory to be looked up by subject name.</p>
</dd>
<dt id="issuer_hash"><b>-issuer_hash</b></dt>
<dd>
<p>Outputs the "hash" of the certificate issuer name.</p>
</dd>
<dt id="ocspid"><b>-ocspid</b></dt>
<dd>
<p>Outputs the OCSP hash values for the subject name and public key.</p>
</dd>
<dt id="hash"><b>-hash</b></dt>
<dd>
<p>Synonym for "-subject_hash" for backward compatibility reasons.</p>
</dd>
<dt id="subject_hash_old"><b>-subject_hash_old</b></dt>
<dd>
<p>Outputs the "hash" of the certificate subject name using the older algorithm as used by OpenSSL before version 1.0.0.</p>
</dd>
<dt id="issuer_hash_old"><b>-issuer_hash_old</b></dt>
<dd>
<p>Outputs the "hash" of the certificate issuer name using the older algorithm as used by OpenSSL before version 1.0.0.</p>
</dd>
<dt id="subject"><b>-subject</b></dt>
<dd>
<p>Outputs the subject name.</p>
</dd>
<dt id="issuer"><b>-issuer</b></dt>
<dd>
<p>Outputs the issuer name.</p>
</dd>
<dt id="nameopt-option"><b>-nameopt option</b></dt>
<dd>
<p>Option which determines how the subject or issuer names are displayed. The <b>option</b> argument can be a single option or multiple options separated by commas. Alternatively the <b>-nameopt</b> switch may be used more than once to set multiple options. See the <b>NAME OPTIONS</b> section for more information.</p>
</dd>
<dt id="email"><b>-email</b></dt>
<dd>
<p>Outputs the email address(es) if any.</p>
</dd>
<dt id="ocsp_uri"><b>-ocsp_uri</b></dt>
<dd>
<p>Outputs the OCSP responder address(es) if any.</p>
</dd>
<dt id="startdate"><b>-startdate</b></dt>
<dd>
<p>Prints out the start date of the certificate, that is the notBefore date.</p>
</dd>
<dt id="enddate"><b>-enddate</b></dt>
<dd>
<p>Prints out the expiry date of the certificate, that is the notAfter date.</p>
</dd>
<dt id="dates"><b>-dates</b></dt>
<dd>
<p>Prints out the start and expiry dates of a certificate.</p>
</dd>
<dt id="checkend-arg"><b>-checkend arg</b></dt>
<dd>
<p>Checks if the certificate expires within the next <b>arg</b> seconds and exits nonzero if yes it will expire or zero if not.</p>
</dd>
<dt id="fingerprint"><b>-fingerprint</b></dt>
<dd>
<p>Calculates and outputs the digest of the DER encoded version of the entire certificate (see digest options). This is commonly called a "fingerprint". Because of the nature of message digests, the fingerprint of a certificate is unique to that certificate and two certificates with the same fingerprint can be considered to be the same.</p>
</dd>
<dt id="C"><b>-C</b></dt>
<dd>
<p>This outputs the certificate in the form of a C source file.</p>
</dd>
</dl>
<h2 id="Trust-Settings">Trust Settings</h2>
<p>A <b>trusted certificate</b> is an ordinary certificate which has several additional pieces of information attached to it such as the permitted and prohibited uses of the certificate and an "alias".</p>
<p>Normally when a certificate is being verified at least one certificate must be "trusted". By default a trusted certificate must be stored locally and must be a root CA: any certificate chain ending in this CA is then usable for any purpose.</p>
<p>Trust settings currently are only used with a root CA. They allow a finer control over the purposes the root CA can be used for. For example a CA may be trusted for SSL client but not SSL server use.</p>
<p>See the description of the <b>verify</b> utility for more information on the meaning of trust settings.</p>
<p>Future versions of OpenSSL will recognize trust settings on any certificate: not just root CAs.</p>
<dl>
<dt id="trustout"><b>-trustout</b></dt>
<dd>
<p>This causes <b>x509</b> to output a <b>trusted</b> certificate. An ordinary or trusted certificate can be input but by default an ordinary certificate is output and any trust settings are discarded. With the <b>-trustout</b> option a trusted certificate is output. A trusted certificate is automatically output if any trust settings are modified.</p>
</dd>
<dt id="setalias-arg"><b>-setalias arg</b></dt>
<dd>
<p>Sets the alias of the certificate. This will allow the certificate to be referred to using a nickname for example "Steve's Certificate".</p>
</dd>
<dt id="alias"><b>-alias</b></dt>
<dd>
<p>Outputs the certificate alias, if any.</p>
</dd>
<dt id="clrtrust"><b>-clrtrust</b></dt>
<dd>
<p>Clears all the permitted or trusted uses of the certificate.</p>
</dd>
<dt id="clrreject"><b>-clrreject</b></dt>
<dd>
<p>Clears all the prohibited or rejected uses of the certificate.</p>
</dd>
<dt id="addtrust-arg"><b>-addtrust arg</b></dt>
<dd>
<p>Adds a trusted certificate use. Any object name can be used here but currently only <b>clientAuth</b> (SSL client use), <b>serverAuth</b> (SSL server use), <b>emailProtection</b> (S/MIME email) and <b>anyExtendedKeyUsage</b> are used. As of OpenSSL 1.1.0, the last of these blocks all purposes when rejected or enables all purposes when trusted. Other OpenSSL applications may define additional uses.</p>
</dd>
<dt id="addreject-arg"><b>-addreject arg</b></dt>
<dd>
<p>Adds a prohibited use. It accepts the same values as the <b>-addtrust</b> option.</p>
</dd>
<dt id="purpose"><b>-purpose</b></dt>
<dd>
<p>This option performs tests on the certificate extensions and outputs the results. For a more complete description see the <b>CERTIFICATE EXTENSIONS</b> section.</p>
</dd>
</dl>
<h2 id="Signing-Options">Signing Options</h2>
<p>The <b>x509</b> utility can be used to sign certificates and requests: it can thus behave like a "mini CA".</p>
<dl>
<dt id="signkey-arg"><b>-signkey arg</b></dt>
<dd>
<p>This option causes the input file to be self signed using the supplied private key or engine. The private key's format is specified with the <b>-keyform</b> option.</p>
<p>If the input file is a certificate it sets the issuer name to the subject name (i.e. makes it self signed) changes the public key to the supplied value and changes the start and end dates. The start date is set to the current time and the end date is set to a value determined by the <b>-days</b> option. Any certificate extensions are retained unless the <b>-clrext</b> option is supplied; this includes, for example, any existing key identifier extensions.</p>
<p>If the input is a certificate request then a self signed certificate is created using the supplied private key using the subject name in the request.</p>
</dd>
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
<dd>
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="clrext"><b>-clrext</b></dt>
<dd>
<p>Delete any extensions from a certificate. This option is used when a certificate is being created from another certificate (for example with the <b>-signkey</b> or the <b>-CA</b> options). Normally all extensions are retained.</p>
</dd>
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
<dd>
<p>Specifies the format (DER or PEM) of the private key file used in the <b>-signkey</b> option.</p>
</dd>
<dt id="days-arg"><b>-days arg</b></dt>
<dd>
<p>Specifies the number of days to make a certificate valid for. The default is 30 days. Cannot be used with the <b>-preserve_dates</b> option.</p>
</dd>
<dt id="x509toreq"><b>-x509toreq</b></dt>
<dd>
<p>Converts a certificate into a certificate request. The <b>-signkey</b> option is used to pass the required private key.</p>
</dd>
<dt id="req"><b>-req</b></dt>
<dd>
<p>By default a certificate is expected on input. With this option a certificate request is expected instead.</p>
</dd>
<dt id="set_serial-n"><b>-set_serial n</b></dt>
<dd>
<p>Specifies the serial number to use. This option can be used with either the <b>-signkey</b> or <b>-CA</b> options. If used in conjunction with the <b>-CA</b> option the serial number file (as specified by the <b>-CAserial</b> or <b>-CAcreateserial</b> options) is not used.</p>
<p>The serial number can be decimal or hex (if preceded by <b>0x</b>).</p>
</dd>
<dt id="CA-filename"><b>-CA filename</b></dt>
<dd>
<p>Specifies the CA certificate to be used for signing. When this option is present <b>x509</b> behaves like a "mini CA". The input file is signed by this CA using this option: that is its issuer name is set to the subject name of the CA and it is digitally signed using the CAs private key.</p>
<p>This option is normally combined with the <b>-req</b> option. Without the <b>-req</b> option the input is a certificate which must be self signed.</p>
</dd>
<dt id="CAkey-filename"><b>-CAkey filename</b></dt>
<dd>
<p>Sets the CA private key to sign a certificate with. If this option is not specified then it is assumed that the CA private key is present in the CA certificate file.</p>
</dd>
<dt id="CAserial-filename"><b>-CAserial filename</b></dt>
<dd>
<p>Sets the CA serial number file to use.</p>
<p>When creating a certificate with this option, and with the <b>-CA</b> option, the certificate serial number is stored in the given file. This file consists of one line containing an even number of hex digits with the serial number used last time. After reading this number, it is incremented and used, and the file is updated.</p>
<p>The default filename consists of the CA certificate file base name with ".srl" appended. For example if the CA certificate file is called "mycacert.pem" it expects to find a serial number file called "mycacert.srl".</p>
<p>If the <b>-CA</b> option is specified and neither <-CAserial> or <-CAcreateserial> is given and the default serial number file does not exist, a random number is generated; this is the recommended practice.</p>
</dd>
<dt id="CAcreateserial"><b>-CAcreateserial</b></dt>
<dd>
<p>With this option and the <b>-CA</b> option the CA serial number file is created if it does not exist. A random number is generated, used for the certificate, and saved into the serial number file determined as described above.</p>
</dd>
<dt id="extfile-filename"><b>-extfile filename</b></dt>
<dd>
<p>File containing certificate extensions to use. If not specified then no extensions are added to the certificate.</p>
</dd>
<dt id="extensions-section"><b>-extensions section</b></dt>
<dd>
<p>The section to add certificate extensions from. If this option is not specified then the extensions should either be contained in the unnamed (default) section or the default section should contain a variable called "extensions" which contains the section to use. See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
</dd>
<dt id="force_pubkey-key"><b>-force_pubkey key</b></dt>
<dd>
<p>When a certificate is created set its public key to <b>key</b> instead of the key in the certificate or certificate request. This option is useful for creating certificates where the algorithm can't normally sign requests, for example DH.</p>
<p>The format or <b>key</b> can be specified using the <b>-keyform</b> option.</p>
</dd>
</dl>
<h2 id="Name-Options">Name Options</h2>
<p>The <b>nameopt</b> command line switch determines how the subject and issuer names are displayed. If no <b>nameopt</b> switch is present the default "oneline" format is used which is compatible with previous versions of OpenSSL. Each option is described in detail below, all options can be preceded by a <b>-</b> to turn the option off. Only the first four will normally be used.</p>
<dl>
<dt id="compat"><b>compat</b></dt>
<dd>
<p>Use the old format.</p>
</dd>
<dt id="RFC2253"><b>RFC2253</b></dt>
<dd>
<p>Displays names compatible with RFC2253 equivalent to <b>esc_2253</b>, <b>esc_ctrl</b>, <b>esc_msb</b>, <b>utf8</b>, <b>dump_nostr</b>, <b>dump_unknown</b>, <b>dump_der</b>, <b>sep_comma_plus</b>, <b>dn_rev</b> and <b>sname</b>.</p>
</dd>
<dt id="oneline"><b>oneline</b></dt>
<dd>
<p>A oneline format which is more readable than RFC2253. It is equivalent to specifying the <b>esc_2253</b>, <b>esc_ctrl</b>, <b>esc_msb</b>, <b>utf8</b>, <b>dump_nostr</b>, <b>dump_der</b>, <b>use_quote</b>, <b>sep_comma_plus_space</b>, <b>space_eq</b> and <b>sname</b> options. This is the <i>default</i> of no name options are given explicitly.</p>
</dd>
<dt id="multiline"><b>multiline</b></dt>
<dd>
<p>A multiline format. It is equivalent <b>esc_ctrl</b>, <b>esc_msb</b>, <b>sep_multiline</b>, <b>space_eq</b>, <b>lname</b> and <b>align</b>.</p>
</dd>
<dt id="esc_2253"><b>esc_2253</b></dt>
<dd>
<p>Escape the "special" characters required by RFC2253 in a field. That is <b>,+"<>;</b>. Additionally <b>#</b> is escaped at the beginning of a string and a space character at the beginning or end of a string.</p>
</dd>
<dt id="esc_2254"><b>esc_2254</b></dt>
<dd>
<p>Escape the "special" characters required by RFC2254 in a field. That is the <b>NUL</b> character as well as and <b>()*</b>.</p>
</dd>
<dt id="esc_ctrl"><b>esc_ctrl</b></dt>
<dd>
<p>Escape control characters. That is those with ASCII values less than 0x20 (space) and the delete (0x7f) character. They are escaped using the RFC2253 \XX notation (where XX are two hex digits representing the character value).</p>
</dd>
<dt id="esc_msb"><b>esc_msb</b></dt>
<dd>
<p>Escape characters with the MSB set, that is with ASCII values larger than 127.</p>
</dd>
<dt id="use_quote"><b>use_quote</b></dt>
<dd>
<p>Escapes some characters by surrounding the whole string with <b>"</b> characters, without the option all escaping is done with the <b>\</b> character.</p>
</dd>
<dt id="utf8"><b>utf8</b></dt>
<dd>
<p>Convert all strings to UTF8 format first. This is required by RFC2253. If you are lucky enough to have a UTF8 compatible terminal then the use of this option (and <b>not</b> setting <b>esc_msb</b>) may result in the correct display of multibyte (international) characters. Is this option is not present then multibyte characters larger than 0xff will be represented using the format \UXXXX for 16 bits and \WXXXXXXXX for 32 bits. Also if this option is off any UTF8Strings will be converted to their character form first.</p>
</dd>
<dt id="ignore_type"><b>ignore_type</b></dt>
<dd>
<p>This option does not attempt to interpret multibyte characters in any way. That is their content octets are merely dumped as though one octet represents each character. This is useful for diagnostic purposes but will result in rather odd looking output.</p>
</dd>
<dt id="show_type"><b>show_type</b></dt>
<dd>
<p>Show the type of the ASN1 character string. The type precedes the field contents. For example "BMPSTRING: Hello World".</p>
</dd>
<dt id="dump_der"><b>dump_der</b></dt>
<dd>
<p>When this option is set any fields that need to be hexdumped will be dumped using the DER encoding of the field. Otherwise just the content octets will be displayed. Both options use the RFC2253 <b>#XXXX...</b> format.</p>
</dd>
<dt id="dump_nostr"><b>dump_nostr</b></dt>
<dd>
<p>Dump non character string types (for example OCTET STRING) if this option is not set then non character string types will be displayed as though each content octet represents a single character.</p>
</dd>
<dt id="dump_all"><b>dump_all</b></dt>
<dd>
<p>Dump all fields. This option when used with <b>dump_der</b> allows the DER encoding of the structure to be unambiguously determined.</p>
</dd>
<dt id="dump_unknown"><b>dump_unknown</b></dt>
<dd>
<p>Dump any field whose OID is not recognised by OpenSSL.</p>
</dd>
<dt id="sep_comma_plus-sep_comma_plus_space-sep_semi_plus_space-sep_multiline"><b>sep_comma_plus</b>, <b>sep_comma_plus_space</b>, <b>sep_semi_plus_space</b>, <b>sep_multiline</b></dt>
<dd>
<p>These options determine the field separators. The first character is between RDNs and the second between multiple AVAs (multiple AVAs are very rare and their use is discouraged). The options ending in "space" additionally place a space after the separator to make it more readable. The <b>sep_multiline</b> uses a linefeed character for the RDN separator and a spaced <b>+</b> for the AVA separator. It also indents the fields by four characters. If no field separator is specified then <b>sep_comma_plus_space</b> is used by default.</p>
</dd>
<dt id="dn_rev"><b>dn_rev</b></dt>
<dd>
<p>Reverse the fields of the DN. This is required by RFC2253. As a side effect this also reverses the order of multiple AVAs but this is permissible.</p>
</dd>
<dt id="nofname-sname-lname-oid"><b>nofname</b>, <b>sname</b>, <b>lname</b>, <b>oid</b></dt>
<dd>
<p>These options alter how the field name is displayed. <b>nofname</b> does not display the field at all. <b>sname</b> uses the "short name" form (CN for commonName for example). <b>lname</b> uses the long form. <b>oid</b> represents the OID in numerical form and is useful for diagnostic purpose.</p>
</dd>
<dt id="align"><b>align</b></dt>
<dd>
<p>Align field values for a more readable output. Only usable with <b>sep_multiline</b>.</p>
</dd>
<dt id="space_eq"><b>space_eq</b></dt>
<dd>
<p>Places spaces round the <b>=</b> character which follows the field name.</p>
</dd>
</dl>
<h2 id="Text-Options">Text Options</h2>
<p>As well as customising the name output format, it is also possible to customise the actual fields printed using the <b>certopt</b> options when the <b>text</b> option is present. The default behaviour is to print all fields.</p>
<dl>
<dt id="compatible"><b>compatible</b></dt>
<dd>
<p>Use the old format. This is equivalent to specifying no output options at all.</p>
</dd>
<dt id="no_header"><b>no_header</b></dt>
<dd>
<p>Don't print header information: that is the lines saying "Certificate" and "Data".</p>
</dd>
<dt id="no_version"><b>no_version</b></dt>
<dd>
<p>Don't print out the version number.</p>
</dd>
<dt id="no_serial"><b>no_serial</b></dt>
<dd>
<p>Don't print out the serial number.</p>
</dd>
<dt id="no_signame"><b>no_signame</b></dt>
<dd>
<p>Don't print out the signature algorithm used.</p>
</dd>
<dt id="no_validity"><b>no_validity</b></dt>
<dd>
<p>Don't print the validity, that is the <b>notBefore</b> and <b>notAfter</b> fields.</p>
</dd>
<dt id="no_subject"><b>no_subject</b></dt>
<dd>
<p>Don't print out the subject name.</p>
</dd>
<dt id="no_issuer"><b>no_issuer</b></dt>
<dd>
<p>Don't print out the issuer name.</p>
</dd>
<dt id="no_pubkey"><b>no_pubkey</b></dt>
<dd>
<p>Don't print out the public key.</p>
</dd>
<dt id="no_sigdump"><b>no_sigdump</b></dt>
<dd>
<p>Don't give a hexadecimal dump of the certificate signature.</p>
</dd>
<dt id="no_aux"><b>no_aux</b></dt>
<dd>
<p>Don't print out certificate trust information.</p>
</dd>
<dt id="no_extensions"><b>no_extensions</b></dt>
<dd>
<p>Don't print out any X509V3 extensions.</p>
</dd>
<dt id="ext_default"><b>ext_default</b></dt>
<dd>
<p>Retain default extension behaviour: attempt to print out unsupported certificate extensions.</p>
</dd>
<dt id="ext_error"><b>ext_error</b></dt>
<dd>
<p>Print an error message for unsupported certificate extensions.</p>
</dd>
<dt id="ext_parse"><b>ext_parse</b></dt>
<dd>
<p>ASN1 parse unsupported extensions.</p>
</dd>
<dt id="ext_dump"><b>ext_dump</b></dt>
<dd>
<p>Hex dump unsupported extensions.</p>
</dd>
<dt id="ca_default"><b>ca_default</b></dt>
<dd>
<p>The value used by the <b>ca</b> utility, equivalent to <b>no_issuer</b>, <b>no_pubkey</b>, <b>no_header</b>, and <b>no_version</b>.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Note: in these examples the '\' means the example should be all on one line.</p>
<p>Display the contents of a certificate:</p>
<pre><code>openssl x509 -in cert.pem -noout -text</code></pre>
<p>Display the "Subject Alternative Name" extension of a certificate:</p>
<pre><code>openssl x509 -in cert.pem -noout -ext subjectAltName</code></pre>
<p>Display more extensions of a certificate:</p>
<pre><code>openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType</code></pre>
<p>Display the certificate serial number:</p>
<pre><code>openssl x509 -in cert.pem -noout -serial</code></pre>
<p>Display the certificate subject name:</p>
<pre><code>openssl x509 -in cert.pem -noout -subject</code></pre>
<p>Display the certificate subject name in RFC2253 form:</p>
<pre><code>openssl x509 -in cert.pem -noout -subject -nameopt RFC2253</code></pre>
<p>Display the certificate subject name in oneline form on a terminal supporting UTF8:</p>
<pre><code>openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb</code></pre>
<p>Display the certificate SHA1 fingerprint:</p>
<pre><code>openssl x509 -sha1 -in cert.pem -noout -fingerprint</code></pre>
<p>Convert a certificate from PEM to DER format:</p>
<pre><code>openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER</code></pre>
<p>Convert a certificate to a certificate request:</p>
<pre><code>openssl x509 -x509toreq -in cert.pem -out req.pem -signkey key.pem</code></pre>
<p>Convert a certificate request into a self signed certificate using extensions for a CA:</p>
<pre><code>openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca \
-signkey key.pem -out cacert.pem</code></pre>
<p>Sign a certificate request using the CA certificate above and add user certificate extensions:</p>
<pre><code>openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr \
-CA cacert.pem -CAkey key.pem -CAcreateserial</code></pre>
<p>Set a certificate to be trusted for SSL client use and change set its alias to "Steve's Class 1 CA"</p>
<pre><code>openssl x509 -in cert.pem -addtrust clientAuth \
-setalias "Steve's Class 1 CA" -out trust.pem</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>The PEM format uses the header and footer lines:</p>
<pre><code>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</code></pre>
<p>it will also handle files containing:</p>
<pre><code>-----BEGIN X509 CERTIFICATE-----
-----END X509 CERTIFICATE-----</code></pre>
<p>Trusted certificates have the lines</p>
<pre><code>-----BEGIN TRUSTED CERTIFICATE-----
-----END TRUSTED CERTIFICATE-----</code></pre>
<p>The conversion to UTF8 format used with the name options assumes that T61Strings use the ISO8859-1 character set. This is wrong but Netscape and MSIE do this as do many certificates. So although this is incorrect it is more likely to display the majority of certificates correctly.</p>
<p>The <b>-email</b> option searches the subject name and the subject alternative name extension. Only unique email addresses will be printed out: it will not print the same address more than once.</p>
<h1 id="CERTIFICATE-EXTENSIONS">CERTIFICATE EXTENSIONS</h1>
<p>The <b>-purpose</b> option checks the certificate extensions and determines what the certificate can be used for. The actual checks done are rather complex and include various hacks and workarounds to handle broken certificates and software.</p>
<p>The same code is used when verifying untrusted certificates in chains so this section is useful if a chain is rejected by the verify code.</p>
<p>The basicConstraints extension CA flag is used to determine whether the certificate can be used as a CA. If the CA flag is true then it is a CA, if the CA flag is false then it is not a CA. <b>All</b> CAs should have the CA flag set to true.</p>
<p>If the basicConstraints extension is absent then the certificate is considered to be a "possible CA" other extensions are checked according to the intended use of the certificate. A warning is given in this case because the certificate should really not be regarded as a CA: however it is allowed to be a CA to work around some broken software.</p>
<p>If the certificate is a V1 certificate (and thus has no extensions) and it is self signed it is also assumed to be a CA but a warning is again given: this is to work around the problem of Verisign roots which are V1 self signed certificates.</p>
<p>If the keyUsage extension is present then additional restraints are made on the uses of the certificate. A CA certificate <b>must</b> have the keyCertSign bit set if the keyUsage extension is present.</p>
<p>The extended key usage extension places additional restrictions on the certificate uses. If this extension is present (whether critical or not) the key can only be used for the purposes specified.</p>
<p>A complete description of each test is given below. The comments about basicConstraints and keyUsage and V1 certificates above apply to <b>all</b> CA certificates.</p>
<dl>
<dt id="SSL-Client"><b>SSL Client</b></dt>
<dd>
<p>The extended key usage extension must be absent or include the "web client authentication" OID. keyUsage must be absent or it must have the digitalSignature bit set. Netscape certificate type must be absent or it must have the SSL client bit set.</p>
</dd>
<dt id="SSL-Client-CA"><b>SSL Client CA</b></dt>
<dd>
<p>The extended key usage extension must be absent or include the "web client authentication" OID. Netscape certificate type must be absent or it must have the SSL CA bit set: this is used as a work around if the basicConstraints extension is absent.</p>
</dd>
<dt id="SSL-Server"><b>SSL Server</b></dt>
<dd>
<p>The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. keyUsage must be absent or it must have the digitalSignature, the keyEncipherment set or both bits set. Netscape certificate type must be absent or have the SSL server bit set.</p>
</dd>
<dt id="SSL-Server-CA"><b>SSL Server CA</b></dt>
<dd>
<p>The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. Netscape certificate type must be absent or the SSL CA bit must be set: this is used as a work around if the basicConstraints extension is absent.</p>
</dd>
<dt id="Netscape-SSL-Server"><b>Netscape SSL Server</b></dt>
<dd>
<p>For Netscape SSL clients to connect to an SSL server it must have the keyEncipherment bit set if the keyUsage extension is present. This isn't always valid because some cipher suites use the key for digital signing. Otherwise it is the same as a normal SSL server.</p>
</dd>
<dt id="Common-S-MIME-Client-Tests"><b>Common S/MIME Client Tests</b></dt>
<dd>
<p>The extended key usage extension must be absent or include the "email protection" OID. Netscape certificate type must be absent or should have the S/MIME bit set. If the S/MIME bit is not set in Netscape certificate type then the SSL client bit is tolerated as an alternative but a warning is shown: this is because some Verisign certificates don't set the S/MIME bit.</p>
</dd>
<dt id="S-MIME-Signing"><b>S/MIME Signing</b></dt>
<dd>
<p>In addition to the common S/MIME client tests the digitalSignature bit or the nonRepudiation bit must be set if the keyUsage extension is present.</p>
</dd>
<dt id="S-MIME-Encryption"><b>S/MIME Encryption</b></dt>
<dd>
<p>In addition to the common S/MIME tests the keyEncipherment bit must be set if the keyUsage extension is present.</p>
</dd>
<dt id="S-MIME-CA"><b>S/MIME CA</b></dt>
<dd>
<p>The extended key usage extension must be absent or include the "email protection" OID. Netscape certificate type must be absent or must have the S/MIME CA bit set: this is used as a work around if the basicConstraints extension is absent.</p>
</dd>
<dt id="CRL-Signing"><b>CRL Signing</b></dt>
<dd>
<p>The keyUsage extension must be absent or it must have the CRL signing bit set.</p>
</dd>
<dt id="CRL-Signing-CA"><b>CRL Signing CA</b></dt>
<dd>
<p>The normal CA tests apply. Except in this case the basicConstraints extension must be present.</p>
</dd>
</dl>
<h1 id="BUGS">BUGS</h1>
<p>Extensions in certificates are not transferred to certificate requests and vice versa.</p>
<p>It is possible to produce invalid certificates or requests by specifying the wrong private key or using inconsistent options in some cases: these should be checked.</p>
<p>There should be options to explicitly set such things as start and end dates rather than an offset from the current time.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/req.html">req(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/verify.html">verify(1)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
<h1 id="HISTORY">HISTORY</h1>
<p>The hash algorithm used in the <b>-subject_hash</b> and <b>-issuer_hash</b> options before OpenSSL 1.0.0 was based on the deprecated MD5 algorithm and the encoding of the distinguished name. In OpenSSL 1.0.0 and later it is based on a canonical version of the DN using SHA1. This means that any directories using the old form must have their links rebuilt using <b>c_rehash</b> or similar.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]��H�| | openssl/html/man1/dsaparam.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>dsaparam</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-dsaparam, dsaparam - DSA parameter manipulation and generation</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl dsaparam</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-text</b>] [<b>-C</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-genkey</b>] [<b>-engine id</b>] [<b>numbits</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>This command is used to manipulate or generate DSA parameter files.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with RFC2459 (PKIX) DSS-Parms that is a SEQUENCE consisting of p, q and g respectively. The PEM form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read parameters from or standard input if this option is not specified. If the <b>numbits</b> parameter is included then this option will be ignored.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option inhibits the output of the encoded version of the parameters.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>This option prints out the DSA parameters in human readable form.</p>
</dd>
<dt id="C"><b>-C</b></dt>
<dd>
<p>This option converts the parameters into C code. The parameters can then be loaded by calling the get_dsaXXX() function.</p>
</dd>
<dt id="genkey"><b>-genkey</b></dt>
<dd>
<p>This option will generate a DSA either using the specified or generated parameters.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="numbits"><b>numbits</b></dt>
<dd>
<p>This option specifies that a parameter set should be generated of size <b>numbits</b>. It must be the last option. If this option is included then the input file (if any) is ignored.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>dsaparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>PEM format DSA parameters use the header and footer lines:</p>
<pre><code>-----BEGIN DSA PARAMETERS-----
-----END DSA PARAMETERS-----</code></pre>
<p>DSA parameter generation is a slow process and as a result the same set of DSA parameters is often used to generate several distinct keys.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/gendsa.html">gendsa(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/rsa.html">rsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�J��$# $# openssl/html/man1/dgst.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>dgst</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-dgst, dgst - perform digest operations</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl dgst</b> [<b>-<i>digest</i></b>] [<b>-help</b>] [<b>-c</b>] [<b>-d</b>] [<b>-list</b>] [<b>-hex</b>] [<b>-binary</b>] [<b>-r</b>] [<b>-out filename</b>] [<b>-sign filename</b>] [<b>-keyform arg</b>] [<b>-passin arg</b>] [<b>-verify filename</b>] [<b>-prverify filename</b>] [<b>-signature filename</b>] [<b>-sigopt nm:v</b>] [<b>-hmac key</b>] [<b>-fips-fingerprint</b>] [<b>-rand file...</b>] [<b>-engine id</b>] [<b>-engine_impl</b>] [<b>file...</b>]</p>
<p><b>openssl</b> <i>digest</i> [<b>...</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The digest functions output the message digest of a supplied file or files in hexadecimal. The digest functions also generate and verify digital signatures using message digests.</p>
<p>The generic name, <b>dgst</b>, may be used with an option specifying the algorithm to be used. The default digest is <i>sha256</i>. A supported <i>digest</i> name may also be used as the command name. To see the list of supported algorithms, use the <i>list --digest-commands</i> command.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="digest"><b>-<i>digest</i></b></dt>
<dd>
<p>Specifies name of a supported digest to be used. To see the list of supported digests, use the command <i>list --digest-commands</i>.</p>
</dd>
<dt id="c"><b>-c</b></dt>
<dd>
<p>Print out the digest in two digit groups separated by colons, only relevant if <b>hex</b> format output is used.</p>
</dd>
<dt id="d"><b>-d</b></dt>
<dd>
<p>Print out BIO debugging information.</p>
</dd>
<dt id="list"><b>-list</b></dt>
<dd>
<p>Prints out a list of supported message digests.</p>
</dd>
<dt id="hex"><b>-hex</b></dt>
<dd>
<p>Digest is to be output as a hex dump. This is the default case for a "normal" digest as opposed to a digital signature. See NOTES below for digital signatures using <b>-hex</b>.</p>
</dd>
<dt id="binary"><b>-binary</b></dt>
<dd>
<p>Output the digest or signature in binary form.</p>
</dd>
<dt id="r"><b>-r</b></dt>
<dd>
<p>Output the digest in the "coreutils" format, including newlines. Used by programs like <b>sha1sum</b>.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Filename to output to, or standard output by default.</p>
</dd>
<dt id="sign-filename"><b>-sign filename</b></dt>
<dd>
<p>Digitally sign the digest using the private key in "filename". Note this option does not support Ed25519 or Ed448 private keys.</p>
</dd>
<dt id="keyform-arg"><b>-keyform arg</b></dt>
<dd>
<p>Specifies the key format to sign digest with. The DER, PEM, P12, and ENGINE formats are supported.</p>
</dd>
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
<dd>
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The private key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="verify-filename"><b>-verify filename</b></dt>
<dd>
<p>Verify the signature using the public key in "filename". The output is either "Verification OK" or "Verification Failure".</p>
</dd>
<dt id="prverify-filename"><b>-prverify filename</b></dt>
<dd>
<p>Verify the signature using the private key in "filename".</p>
</dd>
<dt id="signature-filename"><b>-signature filename</b></dt>
<dd>
<p>The actual signature to verify.</p>
</dd>
<dt id="hmac-key"><b>-hmac key</b></dt>
<dd>
<p>Create a hashed MAC using "key".</p>
</dd>
<dt id="mac-alg"><b>-mac alg</b></dt>
<dd>
<p>Create MAC (keyed Message Authentication Code). The most popular MAC algorithm is HMAC (hash-based MAC), but there are other MAC algorithms which are not based on hash, for instance <b>gost-mac</b> algorithm, supported by <b>ccgost</b> engine. MAC keys and other options should be set via <b>-macopt</b> parameter.</p>
</dd>
<dt id="macopt-nm:v"><b>-macopt nm:v</b></dt>
<dd>
<p>Passes options to MAC algorithm, specified by <b>-mac</b> key. Following options are supported by both by <b>HMAC</b> and <b>gost-mac</b>:</p>
<dl>
<dt id="key:string"><b>key:string</b></dt>
<dd>
<p>Specifies MAC key as alphanumeric string (use if key contain printable characters only). String length must conform to any restrictions of the MAC algorithm for example exactly 32 chars for gost-mac.</p>
</dd>
<dt id="hexkey:string"><b>hexkey:string</b></dt>
<dd>
<p>Specifies MAC key in hexadecimal form (two hex digits per byte). Key length must conform to any restrictions of the MAC algorithm for example exactly 32 chars for gost-mac.</p>
</dd>
</dl>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="fips-fingerprint"><b>-fips-fingerprint</b></dt>
<dd>
<p>Compute HMAC using a specific key for certain OpenSSL-FIPS operations.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Use engine <b>id</b> for operations (including private key storage). This engine is not used as source for digest algorithms, unless it is also specified in the configuration file or <b>-engine_impl</b> is also specified.</p>
</dd>
<dt id="engine_impl"><b>-engine_impl</b></dt>
<dd>
<p>When used with the <b>-engine</b> option, it specifies to also use engine <b>id</b> for digest operations.</p>
</dd>
<dt id="file"><b>file...</b></dt>
<dd>
<p>File or files to digest. If no files are specified then standard input is used.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>To create a hex-encoded message digest of a file: openssl dgst -md5 -hex file.txt</p>
<p>To sign a file using SHA-256 with binary file output: openssl dgst -sha256 -sign privatekey.pem -out signature.sign file.txt</p>
<p>To verify a signature: openssl dgst -sha256 -verify publickey.pem \ -signature signature.sign \ file.txt</p>
<h1 id="NOTES">NOTES</h1>
<p>The digest mechanisms that are available will depend on the options used when building OpenSSL. The <b>list digest-commands</b> command can be used to list them.</p>
<p>New or agile applications should use probably use SHA-256. Other digests, particularly SHA-1 and MD5, are still widely used for interoperating with existing formats and protocols.</p>
<p>When signing a file, <b>dgst</b> will automatically determine the algorithm (RSA, ECC, etc) to use for signing based on the private key's ASN.1 info. When verifying signatures, it only handles the RSA, DSA, or ECDSA signature itself, not the related data to identify the signer and algorithm used in formats such as x.509, CMS, and S/MIME.</p>
<p>A source of random numbers is required for certain signing algorithms, in particular ECDSA and DSA.</p>
<p>The signing and verify options should only be used if a single file is being signed or verified.</p>
<p>Hex signatures cannot be verified using <b>openssl</b>. Instead, use "xxd -r" or similar program to transform the hex signature into a binary signature prior to verification.</p>
<h1 id="HISTORY">HISTORY</h1>
<p>The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0. The FIPS-related options were removed in OpenSSL 1.1.0.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]ʉ�� � openssl/html/man1/crl2pkcs7.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>crl2pkcs7</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-crl2pkcs7, crl2pkcs7 - Create a PKCS#7 structure from a CRL and certificates</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>crl2pkcs7</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-certfile filename</b>] [<b>-nocrl</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>crl2pkcs7</b> command takes an optional CRL and one or more certificates and converts them into a PKCS#7 degenerate "certificates only" structure.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the CRL input format. <b>DER</b> format is DER encoded CRL structure.<b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines. The default format is PEM.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the PKCS#7 structure output format. <b>DER</b> format is DER encoded PKCS#7 structure.<b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines. The default format is PEM.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a CRL from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Specifies the output filename to write the PKCS#7 structure to or standard output by default.</p>
</dd>
<dt id="certfile-filename"><b>-certfile filename</b></dt>
<dd>
<p>Specifies a filename containing one or more certificates in <b>PEM</b> format. All certificates in the file will be added to the PKCS#7 structure. This option can be used more than once to read certificates from multiple files.</p>
</dd>
<dt id="nocrl"><b>-nocrl</b></dt>
<dd>
<p>Normally a CRL is included in the output file. With this option no CRL is included in the output file and a CRL is not read from the input file.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Create a PKCS#7 structure from a certificate and CRL:</p>
<pre><code>openssl crl2pkcs7 -in crl.pem -certfile cert.pem -out p7.pem</code></pre>
<p>Creates a PKCS#7 structure in DER format with no CRL from several different certificates:</p>
<pre><code>openssl crl2pkcs7 -nocrl -certfile newcert.pem
-certfile demoCA/cacert.pem -outform DER -out p7.der</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>The output file is a PKCS#7 signed data structure containing no signers and just certificates and an optional CRL.</p>
<p>This utility can be used to send certificates and CAs to Netscape as part of the certificate enrollment process. This involves sending the DER encoded output as MIME type application/x-x509-user-cert.</p>
<p>The <b>PEM</b> encoded form with the header and footer lines removed can be used to install user certificates and CAs in MSIE using the Xenroll control.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/pkcs7.html">pkcs7(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]���� � openssl/html/man1/passwd.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>passwd</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-passwd, passwd - compute password hashes</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl passwd</b> [<b>-help</b>] [<b>-crypt</b>] [<b>-1</b>] [<b>-apr1</b>] [<b>-aixmd5</b>] [<b>-5</b>] [<b>-6</b>] [<b>-salt</b> <i>string</i>] [<b>-in</b> <i>file</i>] [<b>-stdin</b>] [<b>-noverify</b>] [<b>-quiet</b>] [<b>-table</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] {<i>password</i>}</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>passwd</b> command computes the hash of a password typed at run-time or the hash of each password in a list. The password list is taken from the named file for option <b>-in file</b>, from stdin for option <b>-stdin</b>, or from the command line, or from the terminal otherwise.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="crypt"><b>-crypt</b></dt>
<dd>
<p>Use the <b>crypt</b> algorithm (default).</p>
</dd>
<dt id="pod-1"><b>-1</b></dt>
<dd>
<p>Use the MD5 based BSD password algorithm <b>1</b>.</p>
</dd>
<dt id="apr1"><b>-apr1</b></dt>
<dd>
<p>Use the <b>apr1</b> algorithm (Apache variant of the BSD algorithm).</p>
</dd>
<dt id="aixmd5"><b>-aixmd5</b></dt>
<dd>
<p>Use the <b>AIX MD5</b> algorithm (AIX variant of the BSD algorithm).</p>
</dd>
<dt id="pod-5"><b>-5</b></dt>
<dd>
</dd>
<dt id="pod-6"><b>-6</b></dt>
<dd>
<p>Use the <b>SHA256</b> / <b>SHA512</b> based algorithms defined by Ulrich Drepper. See <a href="https://www.akkadia.org/drepper/SHA-crypt.txt">https://www.akkadia.org/drepper/SHA-crypt.txt</a>.</p>
</dd>
<dt id="salt-string"><b>-salt</b> <i>string</i></dt>
<dd>
<p>Use the specified salt. When reading a password from the terminal, this implies <b>-noverify</b>.</p>
</dd>
<dt id="in-file"><b>-in</b> <i>file</i></dt>
<dd>
<p>Read passwords from <i>file</i>.</p>
</dd>
<dt id="stdin"><b>-stdin</b></dt>
<dd>
<p>Read passwords from <b>stdin</b>.</p>
</dd>
<dt id="noverify"><b>-noverify</b></dt>
<dd>
<p>Don't verify when reading a password from the terminal.</p>
</dd>
<dt id="quiet"><b>-quiet</b></dt>
<dd>
<p>Don't output warnings when passwords given at the command line are truncated.</p>
</dd>
<dt id="table"><b>-table</b></dt>
<dd>
<p>In the output list, prepend the cleartext password and a TAB character to each password hash.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<pre><code>% openssl passwd -crypt -salt xx password
xxj31ZMTZzkVA
% openssl passwd -1 -salt xxxxxxxx password
$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.
% openssl passwd -apr1 -salt xxxxxxxx password
$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0
% openssl passwd -aixmd5 -salt xxxxxxxx password
xxxxxxxx$8Oaipk/GPKhC64w/YVeFD/</code></pre>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]'�TS{ S{ openssl/html/man1/ca.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>ca</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#CRL-OPTIONS">CRL OPTIONS</a></li>
<li><a href="#CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</a></li>
<li><a href="#POLICY-FORMAT">POLICY FORMAT</a></li>
<li><a href="#SPKAC-FORMAT">SPKAC FORMAT</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#FILES">FILES</a></li>
<li><a href="#RESTRICTIONS">RESTRICTIONS</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#WARNINGS">WARNINGS</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-ca, ca - sample minimal CA application</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>ca</b> [<b>-help</b>] [<b>-verbose</b>] [<b>-config filename</b>] [<b>-name section</b>] [<b>-gencrl</b>] [<b>-revoke file</b>] [<b>-valid file</b>] [<b>-status serial</b>] [<b>-updatedb</b>] [<b>-crl_reason reason</b>] [<b>-crl_hold instruction</b>] [<b>-crl_compromise time</b>] [<b>-crl_CA_compromise time</b>] [<b>-crldays days</b>] [<b>-crlhours hours</b>] [<b>-crlexts section</b>] [<b>-startdate date</b>] [<b>-enddate date</b>] [<b>-days arg</b>] [<b>-md arg</b>] [<b>-policy arg</b>] [<b>-keyfile arg</b>] [<b>-keyform PEM|DER</b>] [<b>-key arg</b>] [<b>-passin arg</b>] [<b>-cert file</b>] [<b>-selfsign</b>] [<b>-in file</b>] [<b>-out file</b>] [<b>-notext</b>] [<b>-outdir dir</b>] [<b>-infiles</b>] [<b>-spkac file</b>] [<b>-ss_cert file</b>] [<b>-preserveDN</b>] [<b>-noemailDN</b>] [<b>-batch</b>] [<b>-msie_hack</b>] [<b>-extensions section</b>] [<b>-extfile section</b>] [<b>-engine id</b>] [<b>-subj arg</b>] [<b>-utf8</b>] [<b>-sigopt nm:v</b>] [<b>-create_serial</b>] [<b>-rand_serial</b>] [<b>-multivalue-rdn</b>] [<b>-rand file...</b>] [<b>-writerand file</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>ca</b> command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status.</p>
<p>The options descriptions will be divided into each purpose.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="verbose"><b>-verbose</b></dt>
<dd>
<p>This prints extra details about the operations being performed.</p>
</dd>
<dt id="config-filename"><b>-config filename</b></dt>
<dd>
<p>Specifies the configuration file to use. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>.</p>
</dd>
<dt id="name-section"><b>-name section</b></dt>
<dd>
<p>Specifies the configuration file section to use (overrides <b>default_ca</b> in the <b>ca</b> section).</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>An input filename containing a single certificate request to be signed by the CA.</p>
</dd>
<dt id="ss_cert-filename"><b>-ss_cert filename</b></dt>
<dd>
<p>A single self-signed certificate to be signed by the CA.</p>
</dd>
<dt id="spkac-filename"><b>-spkac filename</b></dt>
<dd>
<p>A file containing a single Netscape signed public key and challenge and additional field values to be signed by the CA. See the <b>SPKAC FORMAT</b> section for information on the required input and output format.</p>
</dd>
<dt id="infiles"><b>-infiles</b></dt>
<dd>
<p>If present this should be the last option, all subsequent arguments are taken as the names of files containing certificate requests.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>The output file to output certificates to. The default is standard output. The certificate details will also be printed out to this file in PEM format (except that <b>-spkac</b> outputs DER format).</p>
</dd>
<dt id="outdir-directory"><b>-outdir directory</b></dt>
<dd>
<p>The directory to output certificates to. The certificate will be written to a filename consisting of the serial number in hex with ".pem" appended.</p>
</dd>
<dt id="cert"><b>-cert</b></dt>
<dd>
<p>The CA certificate file.</p>
</dd>
<dt id="keyfile-filename"><b>-keyfile filename</b></dt>
<dd>
<p>The private key to sign requests with.</p>
</dd>
<dt id="keyform-PEM-DER"><b>-keyform PEM|DER</b></dt>
<dd>
<p>The format of the data in the private key file. The default is PEM.</p>
</dd>
<dt id="sigopt-nm:v"><b>-sigopt nm:v</b></dt>
<dd>
<p>Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific.</p>
</dd>
<dt id="key-password"><b>-key password</b></dt>
<dd>
<p>The password used to encrypt the private key. Since on some systems the command line arguments are visible (e.g. Unix with the 'ps' utility) this option should be used with caution.</p>
</dd>
<dt id="selfsign"><b>-selfsign</b></dt>
<dd>
<p>Indicates the issued certificates are to be signed with the key the certificate requests were signed with (given with <b>-keyfile</b>). Certificate requests signed with a different key are ignored. If <b>-spkac</b>, <b>-ss_cert</b> or <b>-gencrl</b> are given, <b>-selfsign</b> is ignored.</p>
<p>A consequence of using <b>-selfsign</b> is that the self-signed certificate appears among the entries in the certificate database (see the configuration option <b>database</b>), and uses the same serial number counter as all other certificates sign with the self-signed certificate.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="notext"><b>-notext</b></dt>
<dd>
<p>Don't output the text form of a certificate to the output file.</p>
</dd>
<dt id="startdate-date"><b>-startdate date</b></dt>
<dd>
<p>This allows the start date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present.</p>
</dd>
<dt id="enddate-date"><b>-enddate date</b></dt>
<dd>
<p>This allows the expiry date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present.</p>
</dd>
<dt id="days-arg"><b>-days arg</b></dt>
<dd>
<p>The number of days to certify the certificate for.</p>
</dd>
<dt id="md-alg"><b>-md alg</b></dt>
<dd>
<p>The message digest to use. Any digest supported by the OpenSSL <b>dgst</b> command can be used. For signing algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message digest that is set is ignored. This option also applies to CRLs.</p>
</dd>
<dt id="policy-arg"><b>-policy arg</b></dt>
<dd>
<p>This option defines the CA "policy" to use. This is a section in the configuration file which decides which fields should be mandatory or match the CA certificate. Check out the <b>POLICY FORMAT</b> section for more information.</p>
</dd>
<dt id="msie_hack"><b>-msie_hack</b></dt>
<dd>
<p>This is a deprecated option to make <b>ca</b> work with very old versions of the IE certificate enrollment control "certenr3". It used UniversalStrings for almost everything. Since the old control has various security bugs its use is strongly discouraged.</p>
</dd>
<dt id="preserveDN"><b>-preserveDN</b></dt>
<dd>
<p>Normally the DN order of a certificate is the same as the order of the fields in the relevant policy section. When this option is set the order is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll.</p>
</dd>
<dt id="noemailDN"><b>-noemailDN</b></dt>
<dd>
<p>The DN of a certificate can contain the EMAIL field if present in the request DN, however, it is good policy just having the e-mail set into the altName extension of the certificate. When this option is set the EMAIL field is removed from the certificate' subject and set only in the, eventually present, extensions. The <b>email_in_dn</b> keyword can be used in the configuration file to enable this behaviour.</p>
</dd>
<dt id="batch"><b>-batch</b></dt>
<dd>
<p>This sets the batch mode. In this mode no questions will be asked and all certificates will be certified automatically.</p>
</dd>
<dt id="extensions-section"><b>-extensions section</b></dt>
<dd>
<p>The section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to <b>x509_extensions</b> unless the <b>-extfile</b> option is used). If no extension section is present then, a V1 certificate is created. If the extension section is present (even if it is empty), then a V3 certificate is created. See the <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
</dd>
<dt id="extfile-file"><b>-extfile file</b></dt>
<dd>
<p>An additional configuration file to read certificate extensions from (using the default section unless the <b>-extensions</b> option is also used).</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ca</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="subj-arg"><b>-subj arg</b></dt>
<dd>
<p>Supersedes subject name given in the request. The arg must be formatted as <i>/type0=value0/type1=value1/type2=...</i>. Keyword characters may be escaped by \ (backslash), and whitespace is retained. Empty values are permitted, but the corresponding type will not be included in the resulting certificate.</p>
</dd>
<dt id="utf8"><b>-utf8</b></dt>
<dd>
<p>This option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings.</p>
</dd>
<dt id="create_serial"><b>-create_serial</b></dt>
<dd>
<p>If reading serial from the text file as specified in the configuration fails, specifying this option creates a new random serial to be used as next serial number. To get random serial numbers, use the <b>-rand_serial</b> flag instead; this should only be used for simple error-recovery.</p>
</dd>
<dt id="rand_serial"><b>-rand_serial</b></dt>
<dd>
<p>Generate a large random number to use as the serial number. This overrides any option or configuration to use a serial number file.</p>
</dd>
<dt id="multivalue-rdn"><b>-multivalue-rdn</b></dt>
<dd>
<p>This option causes the -subj argument to be interpreted with full support for multivalued RDNs. Example:</p>
<p><i>/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe</i></p>
<p>If -multi-rdn is not used then the UID value is <i>123456+CN=John Doe</i>.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
</dl>
<h1 id="CRL-OPTIONS">CRL OPTIONS</h1>
<dl>
<dt id="gencrl"><b>-gencrl</b></dt>
<dd>
<p>This option generates a CRL based on information in the index file.</p>
</dd>
<dt id="crldays-num"><b>-crldays num</b></dt>
<dd>
<p>The number of days before the next CRL is due. That is the days from now to place in the CRL nextUpdate field.</p>
</dd>
<dt id="crlhours-num"><b>-crlhours num</b></dt>
<dd>
<p>The number of hours before the next CRL is due.</p>
</dd>
<dt id="revoke-filename"><b>-revoke filename</b></dt>
<dd>
<p>A filename containing a certificate to revoke.</p>
</dd>
<dt id="valid-filename"><b>-valid filename</b></dt>
<dd>
<p>A filename containing a certificate to add a Valid certificate entry.</p>
</dd>
<dt id="status-serial"><b>-status serial</b></dt>
<dd>
<p>Displays the revocation status of the certificate with the specified serial number and exits.</p>
</dd>
<dt id="updatedb"><b>-updatedb</b></dt>
<dd>
<p>Updates the database index to purge expired certificates.</p>
</dd>
<dt id="crl_reason-reason"><b>-crl_reason reason</b></dt>
<dd>
<p>Revocation reason, where <b>reason</b> is one of: <b>unspecified</b>, <b>keyCompromise</b>, <b>CACompromise</b>, <b>affiliationChanged</b>, <b>superseded</b>, <b>cessationOfOperation</b>, <b>certificateHold</b> or <b>removeFromCRL</b>. The matching of <b>reason</b> is case insensitive. Setting any revocation reason will make the CRL v2.</p>
<p>In practice <b>removeFromCRL</b> is not particularly useful because it is only used in delta CRLs which are not currently implemented.</p>
</dd>
<dt id="crl_hold-instruction"><b>-crl_hold instruction</b></dt>
<dd>
<p>This sets the CRL revocation reason code to <b>certificateHold</b> and the hold instruction to <b>instruction</b> which must be an OID. Although any OID can be used only <b>holdInstructionNone</b> (the use of which is discouraged by RFC2459) <b>holdInstructionCallIssuer</b> or <b>holdInstructionReject</b> will normally be used.</p>
</dd>
<dt id="crl_compromise-time"><b>-crl_compromise time</b></dt>
<dd>
<p>This sets the revocation reason to <b>keyCompromise</b> and the compromise time to <b>time</b>. <b>time</b> should be in GeneralizedTime format that is <b>YYYYMMDDHHMMSSZ</b>.</p>
</dd>
<dt id="crl_CA_compromise-time"><b>-crl_CA_compromise time</b></dt>
<dd>
<p>This is the same as <b>crl_compromise</b> except the revocation reason is set to <b>CACompromise</b>.</p>
</dd>
<dt id="crlexts-section"><b>-crlexts section</b></dt>
<dd>
<p>The section of the configuration file containing CRL extensions to include. If no CRL extension section is present then a V1 CRL is created, if the CRL extension section is present (even if it is empty) then a V2 CRL is created. The CRL extensions specified are CRL extensions and <b>not</b> CRL entry extensions. It should be noted that some software (for example Netscape) can't handle V2 CRLs. See <a href="../man5/x509v3_config.html">x509v3_config(5)</a> manual page for details of the extension section format.</p>
</dd>
</dl>
<h1 id="CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</h1>
<p>The section of the configuration file containing options for <b>ca</b> is found as follows: If the <b>-name</b> command line option is used, then it names the section to be used. Otherwise the section to be used must be named in the <b>default_ca</b> option of the <b>ca</b> section of the configuration file (or in the default section of the configuration file). Besides <b>default_ca</b>, the following options are read directly from the <b>ca</b> section: RANDFILE preserve msie_hack With the exception of <b>RANDFILE</b>, this is probably a bug and may change in future releases.</p>
<p>Many of the configuration file options are identical to command line options. Where the option is present in the configuration file and the command line the command line value is used. Where an option is described as mandatory then it must be present in the configuration file or the command line equivalent (if any) used.</p>
<dl>
<dt id="oid_file"><b>oid_file</b></dt>
<dd>
<p>This specifies a file containing additional <b>OBJECT IDENTIFIERS</b>. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed by white space and finally the long name.</p>
</dd>
<dt id="oid_section"><b>oid_section</b></dt>
<dd>
<p>This specifies a section in the configuration file containing extra object identifiers. Each line should consist of the short name of the object identifier followed by <b>=</b> and the numerical form. The short and long names are the same when this option is used.</p>
</dd>
<dt id="new_certs_dir"><b>new_certs_dir</b></dt>
<dd>
<p>The same as the <b>-outdir</b> command line option. It specifies the directory where new certificates will be placed. Mandatory.</p>
</dd>
<dt id="certificate"><b>certificate</b></dt>
<dd>
<p>The same as <b>-cert</b>. It gives the file containing the CA certificate. Mandatory.</p>
</dd>
<dt id="private_key"><b>private_key</b></dt>
<dd>
<p>Same as the <b>-keyfile</b> option. The file containing the CA private key. Mandatory.</p>
</dd>
<dt id="RANDFILE"><b>RANDFILE</b></dt>
<dd>
<p>At startup the specified file is loaded into the random number generator, and at exit 256 bytes will be written to it.</p>
</dd>
<dt id="default_days"><b>default_days</b></dt>
<dd>
<p>The same as the <b>-days</b> option. The number of days to certify a certificate for.</p>
</dd>
<dt id="default_startdate"><b>default_startdate</b></dt>
<dd>
<p>The same as the <b>-startdate</b> option. The start date to certify a certificate for. If not set the current time is used.</p>
</dd>
<dt id="default_enddate"><b>default_enddate</b></dt>
<dd>
<p>The same as the <b>-enddate</b> option. Either this option or <b>default_days</b> (or the command line equivalents) must be present.</p>
</dd>
<dt id="default_crl_hours-default_crl_days"><b>default_crl_hours default_crl_days</b></dt>
<dd>
<p>The same as the <b>-crlhours</b> and the <b>-crldays</b> options. These will only be used if neither command line option is present. At least one of these must be present to generate a CRL.</p>
</dd>
<dt id="default_md"><b>default_md</b></dt>
<dd>
<p>The same as the <b>-md</b> option. Mandatory except where the signing algorithm does not require a digest (i.e. Ed25519 and Ed448).</p>
</dd>
<dt id="database"><b>database</b></dt>
<dd>
<p>The text database file to use. Mandatory. This file must be present though initially it will be empty.</p>
</dd>
<dt id="unique_subject"><b>unique_subject</b></dt>
<dd>
<p>If the value <b>yes</b> is given, the valid certificate entries in the database must have unique subjects. if the value <b>no</b> is given, several valid certificate entries may have the exact same subject. The default value is <b>yes</b>, to be compatible with older (pre 0.9.8) versions of OpenSSL. However, to make CA certificate roll-over easier, it's recommended to use the value <b>no</b>, especially if combined with the <b>-selfsign</b> command line option.</p>
<p>Note that it is valid in some circumstances for certificates to be created without any subject. In the case where there are multiple certificates without subjects this does not count as a duplicate.</p>
</dd>
<dt id="serial"><b>serial</b></dt>
<dd>
<p>A text file containing the next serial number to use in hex. Mandatory. This file must be present and contain a valid serial number.</p>
</dd>
<dt id="crlnumber"><b>crlnumber</b></dt>
<dd>
<p>A text file containing the next CRL number to use in hex. The crl number will be inserted in the CRLs only if this file exists. If this file is present, it must contain a valid CRL number.</p>
</dd>
<dt id="x509_extensions"><b>x509_extensions</b></dt>
<dd>
<p>The same as <b>-extensions</b>.</p>
</dd>
<dt id="crl_extensions"><b>crl_extensions</b></dt>
<dd>
<p>The same as <b>-crlexts</b>.</p>
</dd>
<dt id="preserve"><b>preserve</b></dt>
<dd>
<p>The same as <b>-preserveDN</b></p>
</dd>
<dt id="email_in_dn"><b>email_in_dn</b></dt>
<dd>
<p>The same as <b>-noemailDN</b>. If you want the EMAIL field to be removed from the DN of the certificate simply set this to 'no'. If not present the default is to allow for the EMAIL filed in the certificate's DN.</p>
</dd>
<dt id="msie_hack1"><b>msie_hack</b></dt>
<dd>
<p>The same as <b>-msie_hack</b></p>
</dd>
<dt id="policy"><b>policy</b></dt>
<dd>
<p>The same as <b>-policy</b>. Mandatory. See the <b>POLICY FORMAT</b> section for more information.</p>
</dd>
<dt id="name_opt-cert_opt"><b>name_opt</b>, <b>cert_opt</b></dt>
<dd>
<p>These options allow the format used to display the certificate details when asking the user to confirm signing. All the options supported by the <b>x509</b> utilities <b>-nameopt</b> and <b>-certopt</b> switches can be used here, except the <b>no_signame</b> and <b>no_sigdump</b> are permanently set and cannot be disabled (this is because the certificate signature cannot be displayed because the certificate has not been signed at this point).</p>
<p>For convenience the values <b>ca_default</b> are accepted by both to produce a reasonable output.</p>
<p>If neither option is present the format used in earlier versions of OpenSSL is used. Use of the old format is <b>strongly</b> discouraged because it only displays fields mentioned in the <b>policy</b> section, mishandles multicharacter string types and does not display extensions.</p>
</dd>
<dt id="copy_extensions"><b>copy_extensions</b></dt>
<dd>
<p>Determines how extensions in certificate requests should be handled. If set to <b>none</b> or this option is not present then extensions are ignored and not copied to the certificate. If set to <b>copy</b> then any extensions present in the request that are not already present are copied to the certificate. If set to <b>copyall</b> then all extensions in the request are copied to the certificate: if the extension is already present in the certificate it is deleted first. See the <b>WARNINGS</b> section before using this option.</p>
<p>The main use of this option is to allow a certificate request to supply values for certain extensions such as subjectAltName.</p>
</dd>
</dl>
<h1 id="POLICY-FORMAT">POLICY FORMAT</h1>
<p>The policy section consists of a set of variables corresponding to certificate DN fields. If the value is "match" then the field value must match the same field in the CA certificate. If the value is "supplied" then it must be present. If the value is "optional" then it may be present. Any fields not mentioned in the policy section are silently deleted, unless the <b>-preserveDN</b> option is set but this can be regarded more of a quirk than intended behaviour.</p>
<h1 id="SPKAC-FORMAT">SPKAC FORMAT</h1>
<p>The input to the <b>-spkac</b> command line option is a Netscape signed public key and challenge. This will usually come from the <b>KEYGEN</b> tag in an HTML form to create a new private key. It is however possible to create SPKACs using the <b>spkac</b> utility.</p>
<p>The file should contain the variable SPKAC set to the value of the SPKAC and also the required DN components as name value pairs. If you need to include the same component twice then it can be preceded by a number and a '.'.</p>
<p>When processing SPKAC format, the output is DER if the <b>-out</b> flag is used, but PEM format if sending to stdout or the <b>-outdir</b> flag is used.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Note: these examples assume that the <b>ca</b> directory structure is already set up and the relevant files already exist. This usually involves creating a CA certificate and private key with <b>req</b>, a serial number file and an empty index file and placing them in the relevant directories.</p>
<p>To use the sample configuration file below the directories demoCA, demoCA/private and demoCA/newcerts would be created. The CA certificate would be copied to demoCA/cacert.pem and its private key to demoCA/private/cakey.pem. A file demoCA/serial would be created containing for example "01" and the empty index file demoCA/index.txt.</p>
<p>Sign a certificate request:</p>
<pre><code>openssl ca -in req.pem -out newcert.pem</code></pre>
<p>Sign a certificate request, using CA extensions:</p>
<pre><code>openssl ca -in req.pem -extensions v3_ca -out newcert.pem</code></pre>
<p>Generate a CRL</p>
<pre><code>openssl ca -gencrl -out crl.pem</code></pre>
<p>Sign several requests:</p>
<pre><code>openssl ca -infiles req1.pem req2.pem req3.pem</code></pre>
<p>Certify a Netscape SPKAC:</p>
<pre><code>openssl ca -spkac spkac.txt</code></pre>
<p>A sample SPKAC file (the SPKAC line has been truncated for clarity):</p>
<pre><code>SPKAC=MIG0MGAwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAn7PDhCeV/xIxUg8V70YRxK2A5
CN=Steve Test
emailAddress=steve@openssl.org
0.OU=OpenSSL Group
1.OU=Another Group</code></pre>
<p>A sample configuration file with the relevant sections for <b>ca</b>:</p>
<pre><code>[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = ./demoCA # top dir
database = $dir/index.txt # index file.
new_certs_dir = $dir/newcerts # new certs dir
certificate = $dir/cacert.pem # The CA cert
serial = $dir/serial # serial no file
#rand_serial = yes # for random serial#'s
private_key = $dir/private/cakey.pem# CA private key
RANDFILE = $dir/private/.rand # random number file
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = md5 # md to use
policy = policy_any # default policy
email_in_dn = no # Don't add the email into cert DN
name_opt = ca_default # Subject name display option
cert_opt = ca_default # Certificate display option
copy_extensions = none # Don't copy extensions from request
[ policy_any ]
countryName = supplied
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional</code></pre>
<h1 id="FILES">FILES</h1>
<p>Note: the location of all files can change either by compile time options, configuration file entries, environment variables or command line options. The values below reflect the default values.</p>
<pre><code>/usr/local/ssl/lib/openssl.cnf - master configuration file
./demoCA - main CA directory
./demoCA/cacert.pem - CA certificate
./demoCA/private/cakey.pem - CA private key
./demoCA/serial - CA serial number file
./demoCA/serial.old - CA serial number backup file
./demoCA/index.txt - CA text database file
./demoCA/index.txt.old - CA text database backup file
./demoCA/certs - certificate output file
./demoCA/.rnd - CA random seed information</code></pre>
<h1 id="RESTRICTIONS">RESTRICTIONS</h1>
<p>The text database index file is a critical part of the process and if corrupted it can be difficult to fix. It is theoretically possible to rebuild the index file from all the issued certificates and a current CRL: however there is no option to do this.</p>
<p>V2 CRL features like delta CRLs are not currently supported.</p>
<p>Although several requests can be input and handled at once it is only possible to include one SPKAC or self-signed certificate.</p>
<h1 id="BUGS">BUGS</h1>
<p>The use of an in-memory text database can cause problems when large numbers of certificates are present because, as the name implies the database has to be kept in memory.</p>
<p>The <b>ca</b> command really needs rewriting or the required functionality exposed at either a command or interface level so a more friendly utility (perl script or GUI) can handle things properly. The script <b>CA.pl</b> helps a little but not very much.</p>
<p>Any fields in a request that are not present in a policy are silently deleted. This does not happen if the <b>-preserveDN</b> option is used. To enforce the absence of the EMAIL field within the DN, as suggested by RFCs, regardless the contents of the request' subject the <b>-noemailDN</b> option can be used. The behaviour should be more friendly and configurable.</p>
<p>Canceling some commands by refusing to certify a certificate can create an empty file.</p>
<h1 id="WARNINGS">WARNINGS</h1>
<p>The <b>ca</b> command is quirky and at times downright unfriendly.</p>
<p>The <b>ca</b> utility was originally meant as an example of how to do things in a CA. It was not supposed to be used as a full blown CA itself: nevertheless some people are using it for this purpose.</p>
<p>The <b>ca</b> command is effectively a single user command: no locking is done on the various files and attempts to run more than one <b>ca</b> command on the same database can have unpredictable results.</p>
<p>The <b>copy_extensions</b> option should be used with caution. If care is not taken then it can be a security risk. For example if a certificate request contains a basicConstraints extension with CA:TRUE and the <b>copy_extensions</b> value is set to <b>copyall</b> and the user does not spot this when the certificate is displayed then this will hand the requester a valid CA certificate.</p>
<p>This situation can be avoided by setting <b>copy_extensions</b> to <b>copy</b> and including basicConstraints with CA:FALSE in the configuration file. Then if the request contains a basicConstraints extension it will be ignored.</p>
<p>It is advisable to also include values for other extensions such as <b>keyUsage</b> to prevent a request supplying its own values.</p>
<p>Additional restrictions can be placed on the CA certificate itself. For example if the CA certificate has:</p>
<pre><code>basicConstraints = CA:TRUE, pathlen:0</code></pre>
<p>then even if a certificate is issued with CA:TRUE it will not be valid.</p>
<h1 id="HISTORY">HISTORY</h1>
<p>Since OpenSSL 1.1.1, the program follows RFC5280. Specifically, certificate validity period (specified by any of <b>-startdate</b>, <b>-enddate</b> and <b>-days</b>) will be encoded as UTCTime if the dates are earlier than year 2049 (included), and as GeneralizedTime if the dates are in year 2050 or later.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/req.html">req(1)</a>, <a href="../man1/spkac.html">spkac(1)</a>, <a href="../man1/x509.html">x509(1)</a>, <a href="../man1/CA.pl.html">CA.pl(1)</a>, <a href="../man5/config.html">config(5)</a>, <a href="../man5/x509v3_config.html">x509v3_config(5)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]��8Y{ { openssl/html/man1/genrsa.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>genrsa</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-genrsa, genrsa - generate an RSA private key</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>genrsa</b> [<b>-help</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-f4</b>] [<b>-3</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>-primes num</b>] [<b>numbits</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>genrsa</b> command generates an RSA private key.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Output the key to the specified file. If this argument is not specified then standard output is used.</p>
</dd>
<dt id="passout-arg"><b>-passout arg</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
<dd>
<p>These options encrypt the private key with specified cipher before outputting it. If none of these options is specified no encryption is used. If encryption is used a pass phrase is prompted for if it is not supplied via the <b>-passout</b> argument.</p>
</dd>
<dt id="F4--3"><b>-F4|-3</b></dt>
<dd>
<p>The public exponent to use, either 65537 or 3. The default is 65537.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>genrsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="primes-num"><b>-primes num</b></dt>
<dd>
<p>Specify the number of primes to use while generating the RSA key. The <b>num</b> parameter must be a positive integer that is greater than 1 and less than 16. If <b>num</b> is greater than 2, then the generated key is called a 'multi-prime' RSA key, which is defined in RFC 8017.</p>
</dd>
<dt id="numbits"><b>numbits</b></dt>
<dd>
<p>The size of the private key to generate in bits. This must be the last option specified. The default is 2048 and values less than 512 are not allowed.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>RSA private key generation essentially involves the generation of two or more prime numbers. When generating a private key various symbols will be output to indicate the progress of the generation. A <b>.</b> represents each number which has passed an initial sieve test, <b>+</b> means a number has passed a single round of the Miller-Rabin primality test, <b>*</b> means the current prime starts a regenerating progress due to some failed tests. A newline means that the number has passed all the prime tests (the actual number depends on the key size).</p>
<p>Because key generation is a random process the time taken to generate a key may vary somewhat. But in general, more primes lead to less generation time of a key.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/gendsa.html">gendsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�,�-f f openssl/html/man1/errstr.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>errstr</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-errstr, errstr - lookup error codes</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl errstr error_code</b></p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>Sometimes an application will not load error message and only numerical forms will be available. The <b>errstr</b> utility can be used to display the meaning of the hex code. The hex code is the hex digits after the second colon.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<p>None.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>The error code:</p>
<pre><code>27594:error:2006D080:lib(32):func(109):reason(128):bss_file.c:107:</code></pre>
<p>can be displayed with:</p>
<pre><code>openssl errstr 2006D080</code></pre>
<p>to produce the error message:</p>
<pre><code>error:2006D080:BIO routines:BIO_new_file:no such file</code></pre>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�ڳ�X X openssl/html/man1/ecparam.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>ecparam</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-ecparam, ecparam - EC parameter manipulation and generation</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl ecparam</b> [<b>-help</b>] [<b>-inform DER|PEM</b>] [<b>-outform DER|PEM</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-text</b>] [<b>-C</b>] [<b>-check</b>] [<b>-name arg</b>] [<b>-list_curves</b>] [<b>-conv_form arg</b>] [<b>-param_enc arg</b>] [<b>-no_seed</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-genkey</b>] [<b>-engine id</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>This command is used to manipulate or generate EC parameter files.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option uses an ASN.1 DER encoded form compatible with RFC 3279 EcpkParameters. The PEM form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read parameters from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option inhibits the output of the encoded version of the parameters.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>This option prints out the EC parameters in human readable form.</p>
</dd>
<dt id="C"><b>-C</b></dt>
<dd>
<p>This option converts the EC parameters into C code. The parameters can then be loaded by calling the get_ec_group_XXX() function.</p>
</dd>
<dt id="check"><b>-check</b></dt>
<dd>
<p>Validate the elliptic curve parameters.</p>
</dd>
<dt id="name-arg"><b>-name arg</b></dt>
<dd>
<p>Use the EC parameters with the specified 'short' name. Use <b>-list_curves</b> to get a list of all currently implemented EC parameters.</p>
</dd>
<dt id="list_curves"><b>-list_curves</b></dt>
<dd>
<p>If this options is specified <b>ecparam</b> will print out a list of all currently implemented EC parameters names and exit.</p>
</dd>
<dt id="conv_form"><b>-conv_form</b></dt>
<dd>
<p>This specifies how the points on the elliptic curve are converted into octet strings. Possible values are: <b>compressed</b>, <b>uncompressed</b> (the default value) and <b>hybrid</b>. For more information regarding the point conversion forms please read the X9.62 standard. <b>Note</b> Due to patent issues the <b>compressed</b> option is disabled by default for binary curves and can be enabled by defining the preprocessor macro <b>OPENSSL_EC_BIN_PT_COMP</b> at compile time.</p>
</dd>
<dt id="param_enc-arg"><b>-param_enc arg</b></dt>
<dd>
<p>This specifies how the elliptic curve parameters are encoded. Possible value are: <b>named_curve</b>, i.e. the ec parameters are specified by an OID, or <b>explicit</b> where the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures). The default value is <b>named_curve</b>. <b>Note</b> the <b>implicitlyCA</b> alternative, as specified in RFC 3279, is currently not implemented in OpenSSL.</p>
</dd>
<dt id="no_seed"><b>-no_seed</b></dt>
<dd>
<p>This option inhibits that the 'seed' for the parameter generation is included in the ECParameters structure (see RFC 3279).</p>
</dd>
<dt id="genkey"><b>-genkey</b></dt>
<dd>
<p>This option will generate an EC private key using the specified parameters.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ecparam</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>PEM format EC parameters use the header and footer lines:</p>
<pre><code>-----BEGIN EC PARAMETERS-----
-----END EC PARAMETERS-----</code></pre>
<p>OpenSSL is currently not able to generate new groups and therefore <b>ecparam</b> can only create EC parameters from known (named) curves.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>To create EC parameters with the group 'prime192v1':</p>
<pre><code>openssl ecparam -out ec_param.pem -name prime192v1</code></pre>
<p>To create EC parameters with explicit parameters:</p>
<pre><code>openssl ecparam -out ec_param.pem -name prime192v1 -param_enc explicit</code></pre>
<p>To validate given EC parameters:</p>
<pre><code>openssl ecparam -in ec_param.pem -check</code></pre>
<p>To create EC parameters and a private key:</p>
<pre><code>openssl ecparam -out ec_key.pem -name prime192v1 -genkey</code></pre>
<p>To change the point encoding to 'compressed':</p>
<pre><code>openssl ecparam -in ec_in.pem -out ec_out.pem -conv_form compressed</code></pre>
<p>To print out the EC parameters to standard output:</p>
<pre><code>openssl ecparam -in ec_param.pem -noout -text</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/ec.html">ec(1)</a>, <a href="../man1/dsaparam.html">dsaparam(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2003-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]��7�� � openssl/html/man1/engine.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>engine</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#ENVIRONMENT">ENVIRONMENT</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-engine, engine - load and query engines</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl engine</b> [ <i>engine...</i> ] [<b>-v</b>] [<b>-vv</b>] [<b>-vvv</b>] [<b>-vvv</b>] [<b>-vvv</b>] [<b>-c</b>] [<b>-t</b>] [<b>-tt</b>] [<b>-pre</b> <i>command</i>] [<b>-post</b> <i>command</i>] [ <i>engine...</i> ]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>engine</b> command is used to query the status and capabilities of the specified <b>engine</b>'s. Engines may be specified before and after all other command-line flags. Only those specified are queried.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="v--vv--vvv--vvvv"><b>-v</b> <b>-vv</b> <b>-vvv</b> <b>-vvvv</b></dt>
<dd>
<p>Provides information about each specified engine. The first flag lists all the possible run-time control commands; the second adds a description of each command; the third adds the input flags, and the final option adds the internal input flags.</p>
</dd>
<dt id="c"><b>-c</b></dt>
<dd>
<p>Lists the capabilities of each engine.</p>
</dd>
<dt id="t"><b>-t</b></dt>
<dd>
<p>Tests if each specified engine is available, and displays the answer.</p>
</dd>
<dt id="tt"><b>-tt</b></dt>
<dd>
<p>Displays an error trace for any unavailable engine.</p>
</dd>
<dt id="pre-command"><b>-pre</b> <i>command</i></dt>
<dd>
</dd>
<dt id="post-command"><b>-post</b> <i>command</i></dt>
<dd>
<p>Command-line configuration of engines. The <b>-pre</b> command is given to the engine before it is loaded and the <b>-post</b> command is given after the engine is loaded. The <i>command</i> is of the form <i>cmd:val</i> where <i>cmd</i> is the command, and <i>val</i> is the value for the command. See the example below.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>To list all the commands available to a dynamic engine:</p>
<pre><code>$ openssl engine -t -tt -vvvv dynamic
(dynamic) Dynamic engine loading support
[ unavailable ]
SO_PATH: Specifies the path to the new ENGINE shared library
(input flags): STRING
NO_VCHECK: Specifies to continue even if version checking fails (boolean)
(input flags): NUMERIC
ID: Specifies an ENGINE id name for loading
(input flags): STRING
LIST_ADD: Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)
(input flags): NUMERIC
DIR_LOAD: Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)
(input flags): NUMERIC
DIR_ADD: Adds a directory from which ENGINEs can be loaded
(input flags): STRING
LOAD: Load up the ENGINE specified by other settings
(input flags): NO_INPUT</code></pre>
<p>To list the capabilities of the <i>rsax</i> engine:</p>
<pre><code>$ openssl engine -c
(rsax) RSAX engine support
[RSA]
(dynamic) Dynamic engine loading support</code></pre>
<h1 id="ENVIRONMENT">ENVIRONMENT</h1>
<dl>
<dt id="OPENSSL_ENGINES"><b>OPENSSL_ENGINES</b></dt>
<dd>
<p>The path to the engines directory.</p>
</dd>
</dl>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man5/config.html">config(5)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]
.r� � openssl/html/man1/crl.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>crl</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-crl, crl - CRL utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>crl</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-text</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-nameopt option</b>] [<b>-noout</b>] [<b>-hash</b>] [<b>-issuer</b>] [<b>-lastupdate</b>] [<b>-nextupdate</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>crl</b> command processes CRL files in DER or PEM format.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. <b>DER</b> format is DER encoded CRL structure. <b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Print out the CRL in text form.</p>
</dd>
<dt id="nameopt-option"><b>-nameopt option</b></dt>
<dd>
<p>Option which determines how the subject or issuer names are displayed. See the description of <b>-nameopt</b> in <a href="../man1/x509.html">x509(1)</a>.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>Don't output the encoded version of the CRL.</p>
</dd>
<dt id="hash"><b>-hash</b></dt>
<dd>
<p>Output a hash of the issuer name. This can be use to lookup CRLs in a directory by issuer name.</p>
</dd>
<dt id="hash_old"><b>-hash_old</b></dt>
<dd>
<p>Outputs the "hash" of the CRL issuer name using the older algorithm as used by OpenSSL before version 1.0.0.</p>
</dd>
<dt id="issuer"><b>-issuer</b></dt>
<dd>
<p>Output the issuer name.</p>
</dd>
<dt id="lastupdate"><b>-lastupdate</b></dt>
<dd>
<p>Output the lastUpdate field.</p>
</dd>
<dt id="nextupdate"><b>-nextupdate</b></dt>
<dd>
<p>Output the nextUpdate field.</p>
</dd>
<dt id="CAfile-file"><b>-CAfile file</b></dt>
<dd>
<p>Verify the signature on a CRL by looking up the issuing certificate in <b>file</b>.</p>
</dd>
<dt id="CApath-dir"><b>-CApath dir</b></dt>
<dd>
<p>Verify the signature on a CRL by looking up the issuing certificate in <b>dir</b>. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The PEM CRL format uses the header and footer lines:</p>
<pre><code>-----BEGIN X509 CRL-----
-----END X509 CRL-----</code></pre>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Convert a CRL file from PEM to DER:</p>
<pre><code>openssl crl -in crl.pem -outform DER -out crl.der</code></pre>
<p>Output the text form of a DER encoded certificate:</p>
<pre><code>openssl crl -in crl.der -inform DER -text -noout</code></pre>
<h1 id="BUGS">BUGS</h1>
<p>Ideally it should be possible to create a CRL using appropriate options and files too.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/crl2pkcs7.html">crl2pkcs7(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/x509.html">x509(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]m;��# # openssl/html/man1/rsautl.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>rsautl</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-rsautl, rsautl - RSA utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>rsautl</b> [<b>-help</b>] [<b>-in file</b>] [<b>-out file</b>] [<b>-inkey file</b>] [<b>-keyform PEM|DER|ENGINE</b>] [<b>-pubin</b>] [<b>-certin</b>] [<b>-sign</b>] [<b>-verify</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-pkcs</b>] [<b>-ssl</b>] [<b>-raw</b>] [<b>-hexdump</b>] [<b>-asn1parse</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>rsautl</b> command can be used to sign, verify, encrypt and decrypt data using the RSA algorithm.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read data from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="inkey-file"><b>-inkey file</b></dt>
<dd>
<p>The input key file, by default it should be an RSA private key.</p>
</dd>
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
<dd>
<p>The key format PEM, DER or ENGINE.</p>
</dd>
<dt id="pubin"><b>-pubin</b></dt>
<dd>
<p>The input file is an RSA public key.</p>
</dd>
<dt id="certin"><b>-certin</b></dt>
<dd>
<p>The input is a certificate containing an RSA public key.</p>
</dd>
<dt id="sign"><b>-sign</b></dt>
<dd>
<p>Sign the input data and output the signed result. This requires an RSA private key.</p>
</dd>
<dt id="verify"><b>-verify</b></dt>
<dd>
<p>Verify the input data and output the recovered data.</p>
</dd>
<dt id="encrypt"><b>-encrypt</b></dt>
<dd>
<p>Encrypt the input data using an RSA public key.</p>
</dd>
<dt id="decrypt"><b>-decrypt</b></dt>
<dd>
<p>Decrypt the input data using an RSA private key.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="pkcs--oaep--ssl--raw"><b>-pkcs, -oaep, -ssl, -raw</b></dt>
<dd>
<p>The padding to use: PKCS#1 v1.5 (the default), PKCS#1 OAEP, special padding used in SSL v2 backwards compatible handshakes, or no padding, respectively. For signatures, only <b>-pkcs</b> and <b>-raw</b> can be used.</p>
</dd>
<dt id="hexdump"><b>-hexdump</b></dt>
<dd>
<p>Hex dump the output data.</p>
</dd>
<dt id="asn1parse"><b>-asn1parse</b></dt>
<dd>
<p>Parse the ASN.1 output data, this is useful when combined with the <b>-verify</b> option.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p><b>rsautl</b> because it uses the RSA algorithm directly can only be used to sign or verify small pieces of data.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Sign some data using a private key:</p>
<pre><code>openssl rsautl -sign -in file -inkey key.pem -out sig</code></pre>
<p>Recover the signed data</p>
<pre><code>openssl rsautl -verify -in sig -inkey key.pem</code></pre>
<p>Examine the raw signed data:</p>
<pre><code>openssl rsautl -verify -in sig -inkey key.pem -raw -hexdump
0000 - 00 01 ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
0010 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
0020 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
0030 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
0040 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
0050 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
0060 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
0070 - ff ff ff ff 00 68 65 6c-6c 6f 20 77 6f 72 6c 64 .....hello world</code></pre>
<p>The PKCS#1 block formatting is evident from this. If this was done using encrypt and decrypt the block would have been of type 2 (the second byte) and random padding data visible instead of the 0xff bytes.</p>
<p>It is possible to analyse the signature of certificates using this utility in conjunction with <b>asn1parse</b>. Consider the self signed example in certs/pca-cert.pem . Running <b>asn1parse</b> as follows yields:</p>
<pre><code>openssl asn1parse -in pca-cert.pem
0:d=0 hl=4 l= 742 cons: SEQUENCE
4:d=1 hl=4 l= 591 cons: SEQUENCE
8:d=2 hl=2 l= 3 cons: cont [ 0 ]
10:d=3 hl=2 l= 1 prim: INTEGER :02
13:d=2 hl=2 l= 1 prim: INTEGER :00
16:d=2 hl=2 l= 13 cons: SEQUENCE
18:d=3 hl=2 l= 9 prim: OBJECT :md5WithRSAEncryption
29:d=3 hl=2 l= 0 prim: NULL
31:d=2 hl=2 l= 92 cons: SEQUENCE
33:d=3 hl=2 l= 11 cons: SET
35:d=4 hl=2 l= 9 cons: SEQUENCE
37:d=5 hl=2 l= 3 prim: OBJECT :countryName
42:d=5 hl=2 l= 2 prim: PRINTABLESTRING :AU
....
599:d=1 hl=2 l= 13 cons: SEQUENCE
601:d=2 hl=2 l= 9 prim: OBJECT :md5WithRSAEncryption
612:d=2 hl=2 l= 0 prim: NULL
614:d=1 hl=3 l= 129 prim: BIT STRING</code></pre>
<p>The final BIT STRING contains the actual signature. It can be extracted with:</p>
<pre><code>openssl asn1parse -in pca-cert.pem -out sig -noout -strparse 614</code></pre>
<p>The certificate public key can be extracted with:</p>
<pre><code>openssl x509 -in test/testx509.pem -pubkey -noout >pubkey.pem</code></pre>
<p>The signature can be analysed with:</p>
<pre><code>openssl rsautl -in sig -verify -asn1parse -inkey pubkey.pem -pubin
0:d=0 hl=2 l= 32 cons: SEQUENCE
2:d=1 hl=2 l= 12 cons: SEQUENCE
4:d=2 hl=2 l= 8 prim: OBJECT :md5
14:d=2 hl=2 l= 0 prim: NULL
16:d=1 hl=2 l= 16 prim: OCTET STRING
0000 - f3 46 9e aa 1a 4a 73 c9-37 ea 93 00 48 25 08 b5 .F...Js.7...H%..</code></pre>
<p>This is the parsed version of an ASN1 DigestInfo structure. It can be seen that the digest used was md5. The actual part of the certificate that was signed can be extracted with:</p>
<pre><code>openssl asn1parse -in pca-cert.pem -out tbs -noout -strparse 4</code></pre>
<p>and its digest computed with:</p>
<pre><code>openssl md5 -c tbs
MD5(tbs)= f3:46:9e:aa:1a:4a:73:c9:37:ea:93:00:48:25:08:b5</code></pre>
<p>which it can be seen agrees with the recovered value above.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/dgst.html">dgst(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]?=��6% 6% openssl/html/man1/CA.pl.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>CA.pl</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#DSA-CERTIFICATES">DSA CERTIFICATES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>CA.pl - friendlier interface for OpenSSL certificate programs</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>CA.pl</b> <b>-?</b> | <b>-h</b> | <b>-help</b></p>
<p><b>CA.pl</b> <b>-newcert</b> | <b>-newreq</b> | <b>-newreq-nodes</b> | <b>-xsign</b> | <b>-sign</b> | <b>-signCA</b> | <b>-signcert</b> | <b>-crl</b> | <b>-newca</b> [<b>-extra-cmd</b> extra-params]</p>
<p><b>CA.pl</b> <b>-pkcs12</b> [<b>-extra-pkcs12</b> extra-params] [<b>certname</b>]</p>
<p><b>CA.pl</b> <b>-verify</b> [<b>-extra-verify</b> extra-params] <b>certfile</b>...</p>
<p><b>CA.pl</b> <b>-revoke</b> [<b>-extra-ca</b> extra-params] <b>certfile</b> [<b>reason</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>CA.pl</b> script is a perl script that supplies the relevant command line arguments to the <b>openssl</b> command for some common certificate operations. It is intended to simplify the process of certificate creation and management by the use of some simple options.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="h--help"><b>?</b>, <b>-h</b>, <b>-help</b></dt>
<dd>
<p>Prints a usage message.</p>
</dd>
<dt id="newcert"><b>-newcert</b></dt>
<dd>
<p>Creates a new self signed certificate. The private key is written to the file "newkey.pem" and the request written to the file "newreq.pem". This argument invokes <b>openssl req</b> command.</p>
</dd>
<dt id="newreq"><b>-newreq</b></dt>
<dd>
<p>Creates a new certificate request. The private key is written to the file "newkey.pem" and the request written to the file "newreq.pem". Executes <b>openssl req</b> command below the hood.</p>
</dd>
<dt id="newreq-nodes"><b>-newreq-nodes</b></dt>
<dd>
<p>Is like <b>-newreq</b> except that the private key will not be encrypted. Uses <b>openssl req</b> command.</p>
</dd>
<dt id="newca"><b>-newca</b></dt>
<dd>
<p>Creates a new CA hierarchy for use with the <b>ca</b> program (or the <b>-signcert</b> and <b>-xsign</b> options). The user is prompted to enter the filename of the CA certificates (which should also contain the private key) or by hitting ENTER details of the CA will be prompted for. The relevant files and directories are created in a directory called "demoCA" in the current directory. <b>openssl req</b> and <b>openssl ca</b> commands are get invoked.</p>
</dd>
<dt id="pkcs12"><b>-pkcs12</b></dt>
<dd>
<p>Create a PKCS#12 file containing the user certificate, private key and CA certificate. It expects the user certificate and private key to be in the file "newcert.pem" and the CA certificate to be in the file demoCA/cacert.pem, it creates a file "newcert.p12". This command can thus be called after the <b>-sign</b> option. The PKCS#12 file can be imported directly into a browser. If there is an additional argument on the command line it will be used as the "friendly name" for the certificate (which is typically displayed in the browser list box), otherwise the name "My Certificate" is used. Delegates work to <b>openssl pkcs12</b> command.</p>
</dd>
<dt id="sign--signcert--xsign"><b>-sign</b>, <b>-signcert</b>, <b>-xsign</b></dt>
<dd>
<p>Calls the <b>ca</b> program to sign a certificate request. It expects the request to be in the file "newreq.pem". The new certificate is written to the file "newcert.pem" except in the case of the <b>-xsign</b> option when it is written to standard output. Leverages <b>openssl ca</b> command.</p>
</dd>
<dt id="signCA"><b>-signCA</b></dt>
<dd>
<p>This option is the same as the <b>-sign</b> option except it uses the configuration file section <b>v3_ca</b> and so makes the signed request a valid CA certificate. This is useful when creating intermediate CA from a root CA. Extra params are passed on to <b>openssl ca</b> command.</p>
</dd>
<dt id="signcert"><b>-signcert</b></dt>
<dd>
<p>This option is the same as <b>-sign</b> except it expects a self signed certificate to be present in the file "newreq.pem". Extra params are passed on to <b>openssl x509</b> and <b>openssl ca</b> commands.</p>
</dd>
<dt id="crl"><b>-crl</b></dt>
<dd>
<p>Generate a CRL. Executes <b>openssl ca</b> command.</p>
</dd>
<dt id="revoke-certfile-reason"><b>-revoke certfile [reason]</b></dt>
<dd>
<p>Revoke the certificate contained in the specified <b>certfile</b>. An optional reason may be specified, and must be one of: <b>unspecified</b>, <b>keyCompromise</b>, <b>CACompromise</b>, <b>affiliationChanged</b>, <b>superseded</b>, <b>cessationOfOperation</b>, <b>certificateHold</b>, or <b>removeFromCRL</b>. Leverages <b>openssl ca</b> command.</p>
</dd>
<dt id="verify"><b>-verify</b></dt>
<dd>
<p>Verifies certificates against the CA certificate for "demoCA". If no certificates are specified on the command line it tries to verify the file "newcert.pem". Invokes <b>openssl verify</b> command.</p>
</dd>
<dt id="extra-req--extra-ca--extra-pkcs12--extra-x509--extra-verify-extra-params"><b>-extra-req</b> | <b>-extra-ca</b> | <b>-extra-pkcs12</b> | <b>-extra-x509</b> | <b>-extra-verify</b> <extra-params></dt>
<dd>
<p>The purpose of these parameters is to allow optional parameters to be supplied to <b>openssl</b> that this command executes. The <b>-extra-cmd</b> are specific to the option being used and the <b>openssl</b> command getting invoked. For example when this command invokes <b>openssl req</b> extra parameters can be passed on with the <b>-extra-req</b> parameter. The <b>openssl</b> commands being invoked per option are documented below. Users should consult <b>openssl</b> command documentation for more information.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Create a CA hierarchy:</p>
<pre><code>CA.pl -newca</code></pre>
<p>Complete certificate creation example: create a CA, create a request, sign the request and finally create a PKCS#12 file containing it.</p>
<pre><code>CA.pl -newca
CA.pl -newreq
CA.pl -sign
CA.pl -pkcs12 "My Test Certificate"</code></pre>
<h1 id="DSA-CERTIFICATES">DSA CERTIFICATES</h1>
<p>Although the <b>CA.pl</b> creates RSA CAs and requests it is still possible to use it with DSA certificates and requests using the <a href="../man1/req.html">req(1)</a> command directly. The following example shows the steps that would typically be taken.</p>
<p>Create some DSA parameters:</p>
<pre><code>openssl dsaparam -out dsap.pem 1024</code></pre>
<p>Create a DSA CA certificate and private key:</p>
<pre><code>openssl req -x509 -newkey dsa:dsap.pem -keyout cacert.pem -out cacert.pem</code></pre>
<p>Create the CA directories and files:</p>
<pre><code>CA.pl -newca</code></pre>
<p>enter cacert.pem when prompted for the CA filename.</p>
<p>Create a DSA certificate request and private key (a different set of parameters can optionally be created first):</p>
<pre><code>openssl req -out newreq.pem -newkey dsa:dsap.pem</code></pre>
<p>Sign the request:</p>
<pre><code>CA.pl -sign</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>Most of the filenames mentioned can be modified by editing the <b>CA.pl</b> script.</p>
<p>If the demoCA directory already exists then the <b>-newca</b> command will not overwrite it and will do nothing. This can happen if a previous call using the <b>-newca</b> option terminated abnormally. To get the correct behaviour delete the demoCA directory if it already exists.</p>
<p>Under some environments it may not be possible to run the <b>CA.pl</b> script directly (for example Win32) and the default configuration file location may be wrong. In this case the command:</p>
<pre><code>perl -S CA.pl</code></pre>
<p>can be used and the <b>OPENSSL_CONF</b> environment variable changed to point to the correct path of the configuration file.</p>
<p>The script is intended as a simple front end for the <b>openssl</b> program for use by a beginner. Its behaviour isn't always what is wanted. For more control over the behaviour of the certificate commands call the <b>openssl</b> command directly.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/x509.html">x509(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/pkcs12.html">pkcs12(1)</a>, <a href="../man5/config.html">config(5)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]7+*��= �= openssl/html/man1/pkcs12.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>pkcs12</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#PARSING-OPTIONS">PARSING OPTIONS</a></li>
<li><a href="#FILE-CREATION-OPTIONS">FILE CREATION OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-pkcs12, pkcs12 - PKCS#12 file utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>pkcs12</b> [<b>-help</b>] [<b>-export</b>] [<b>-chain</b>] [<b>-inkey file_or_id</b>] [<b>-certfile filename</b>] [<b>-name name</b>] [<b>-caname name</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-noout</b>] [<b>-nomacver</b>] [<b>-nocerts</b>] [<b>-clcerts</b>] [<b>-cacerts</b>] [<b>-nokeys</b>] [<b>-info</b>] [<b>-des | -des3 | -idea | -aes128 | -aes192 | -aes256 | -aria128 | -aria192 | -aria256 | -camellia128 | -camellia192 | -camellia256 | -nodes</b>] [<b>-noiter</b>] [<b>-maciter | -nomaciter | -nomac</b>] [<b>-twopass</b>] [<b>-descert</b>] [<b>-certpbe cipher</b>] [<b>-keypbe cipher</b>] [<b>-macalg digest</b>] [<b>-keyex</b>] [<b>-keysig</b>] [<b>-password arg</b>] [<b>-passin arg</b>] [<b>-passout arg</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-CSP name</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>pkcs12</b> command allows PKCS#12 files (sometimes referred to as PFX files) to be created and parsed. PKCS#12 files are used by several programs including Netscape, MSIE and MS Outlook.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<p>There are a lot of options the meaning of some depends of whether a PKCS#12 file is being created or parsed. By default a PKCS#12 file is parsed. A PKCS#12 file can be created by using the <b>-export</b> option (see below).</p>
<h1 id="PARSING-OPTIONS">PARSING OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies filename of the PKCS#12 file to be parsed. Standard input is used by default.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>The filename to write certificates and private keys to, standard output by default. They are all written in PEM format.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The PKCS#12 file (i.e. input file) password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="passout-arg"><b>-passout arg</b></dt>
<dd>
<p>Pass phrase source to encrypt any outputted private keys with. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="password-arg"><b>-password arg</b></dt>
<dd>
<p>With -export, -password is equivalent to -passout. Otherwise, -password is equivalent to -passin.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option inhibits output of the keys and certificates to the output file version of the PKCS#12 file.</p>
</dd>
<dt id="clcerts"><b>-clcerts</b></dt>
<dd>
<p>Only output client certificates (not CA certificates).</p>
</dd>
<dt id="cacerts"><b>-cacerts</b></dt>
<dd>
<p>Only output CA certificates (not client certificates).</p>
</dd>
<dt id="nocerts"><b>-nocerts</b></dt>
<dd>
<p>No certificates at all will be output.</p>
</dd>
<dt id="nokeys"><b>-nokeys</b></dt>
<dd>
<p>No private keys will be output.</p>
</dd>
<dt id="info"><b>-info</b></dt>
<dd>
<p>Output additional information about the PKCS#12 file structure, algorithms used and iteration counts.</p>
</dd>
<dt id="des"><b>-des</b></dt>
<dd>
<p>Use DES to encrypt private keys before outputting.</p>
</dd>
<dt id="des3"><b>-des3</b></dt>
<dd>
<p>Use triple DES to encrypt private keys before outputting, this is the default.</p>
</dd>
<dt id="idea"><b>-idea</b></dt>
<dd>
<p>Use IDEA to encrypt private keys before outputting.</p>
</dd>
<dt id="aes128--aes192--aes256"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b></dt>
<dd>
<p>Use AES to encrypt private keys before outputting.</p>
</dd>
<dt id="aria128--aria192--aria256"><b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b></dt>
<dd>
<p>Use ARIA to encrypt private keys before outputting.</p>
</dd>
<dt id="camellia128--camellia192--camellia256"><b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b></dt>
<dd>
<p>Use Camellia to encrypt private keys before outputting.</p>
</dd>
<dt id="nodes"><b>-nodes</b></dt>
<dd>
<p>Don't encrypt the private keys at all.</p>
</dd>
<dt id="nomacver"><b>-nomacver</b></dt>
<dd>
<p>Don't attempt to verify the integrity MAC before reading the file.</p>
</dd>
<dt id="twopass"><b>-twopass</b></dt>
<dd>
<p>Prompt for separate integrity and encryption passwords: most software always assumes these are the same so this option will render such PKCS#12 files unreadable. Cannot be used in combination with the options -password, -passin (if importing) or -passout (if exporting).</p>
</dd>
</dl>
<h1 id="FILE-CREATION-OPTIONS">FILE CREATION OPTIONS</h1>
<dl>
<dt id="export"><b>-export</b></dt>
<dd>
<p>This option specifies that a PKCS#12 file will be created rather than parsed.</p>
</dd>
<dt id="out-filename1"><b>-out filename</b></dt>
<dd>
<p>This specifies filename to write the PKCS#12 file to. Standard output is used by default.</p>
</dd>
<dt id="in-filename1"><b>-in filename</b></dt>
<dd>
<p>The filename to read certificates and private keys from, standard input by default. They must all be in PEM format. The order doesn't matter but one private key and its corresponding certificate should be present. If additional certificates are present they will also be included in the PKCS#12 file.</p>
</dd>
<dt id="inkey-file_or_id"><b>-inkey file_or_id</b></dt>
<dd>
<p>File to read private key from. If not present then a private key must be present in the input file. If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.</p>
</dd>
<dt id="name-friendlyname"><b>-name friendlyname</b></dt>
<dd>
<p>This specifies the "friendly name" for the certificate and private key. This name is typically displayed in list boxes by software importing the file.</p>
</dd>
<dt id="certfile-filename"><b>-certfile filename</b></dt>
<dd>
<p>A filename to read additional certificates from.</p>
</dd>
<dt id="caname-friendlyname"><b>-caname friendlyname</b></dt>
<dd>
<p>This specifies the "friendly name" for other certificates. This option may be used multiple times to specify names for all certificates in the order they appear. Netscape ignores friendly names on other certificates whereas MSIE displays them.</p>
</dd>
<dt id="pass-arg--passout-arg"><b>-pass arg</b>, <b>-passout arg</b></dt>
<dd>
<p>The PKCS#12 file (i.e. output file) password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="passin-password"><b>-passin password</b></dt>
<dd>
<p>Pass phrase source to decrypt any input private keys with. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="chain"><b>-chain</b></dt>
<dd>
<p>If this option is present then an attempt is made to include the entire certificate chain of the user certificate. The standard CA store is used for this search. If the search fails it is considered a fatal error.</p>
</dd>
<dt id="descert"><b>-descert</b></dt>
<dd>
<p>Encrypt the certificate using triple DES, this may render the PKCS#12 file unreadable by some "export grade" software. By default the private key is encrypted using triple DES and the certificate using 40 bit RC2 unless RC2 is disabled in which case triple DES is used.</p>
</dd>
<dt id="keypbe-alg--certpbe-alg"><b>-keypbe alg</b>, <b>-certpbe alg</b></dt>
<dd>
<p>These options allow the algorithm used to encrypt the private key and certificates to be selected. Any PKCS#5 v1.5 or PKCS#12 PBE algorithm name can be used (see <b>NOTES</b> section for more information). If a cipher name (as output by the <b>list-cipher-algorithms</b> command is specified then it is used with PKCS#5 v2.0. For interoperability reasons it is advisable to only use PKCS#12 algorithms.</p>
</dd>
<dt id="keyex--keysig"><b>-keyex|-keysig</b></dt>
<dd>
<p>Specifies that the private key is to be used for key exchange or just signing. This option is only interpreted by MSIE and similar MS software. Normally "export grade" software will only allow 512 bit RSA keys to be used for encryption purposes but arbitrary length keys for signing. The <b>-keysig</b> option marks the key for signing only. Signing only keys can be used for S/MIME signing, authenticode (ActiveX control signing) and SSL client authentication, however, due to a bug only MSIE 5.0 and later support the use of signing only keys for SSL client authentication.</p>
</dd>
<dt id="macalg-digest"><b>-macalg digest</b></dt>
<dd>
<p>Specify the MAC digest algorithm. If not included them SHA1 will be used.</p>
</dd>
<dt id="nomaciter--noiter"><b>-nomaciter</b>, <b>-noiter</b></dt>
<dd>
<p>These options affect the iteration counts on the MAC and key algorithms. Unless you wish to produce files compatible with MSIE 4.0 you should leave these options alone.</p>
<p>To discourage attacks by using large dictionaries of common passwords the algorithm that derives keys from passwords can have an iteration count applied to it: this causes a certain part of the algorithm to be repeated and slows it down. The MAC is used to check the file integrity but since it will normally have the same password as the keys and certificates it could also be attacked. By default both MAC and encryption iteration counts are set to 2048, using these options the MAC and encryption iteration counts can be set to 1, since this reduces the file security you should not use these options unless you really have to. Most software supports both MAC and key iteration counts. MSIE 4.0 doesn't support MAC iteration counts so it needs the <b>-nomaciter</b> option.</p>
</dd>
<dt id="maciter"><b>-maciter</b></dt>
<dd>
<p>This option is included for compatibility with previous versions, it used to be needed to use MAC iterations counts but they are now used by default.</p>
</dd>
<dt id="nomac"><b>-nomac</b></dt>
<dd>
<p>Don't attempt to provide the MAC integrity.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="CAfile-file"><b>-CAfile file</b></dt>
<dd>
<p>CA storage as a file.</p>
</dd>
<dt id="CApath-dir"><b>-CApath dir</b></dt>
<dd>
<p>CA storage as a directory. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location.</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location.</p>
</dd>
<dt id="CSP-name"><b>-CSP name</b></dt>
<dd>
<p>Write <b>name</b> as a Microsoft CSP name.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>Although there are a large number of options most of them are very rarely used. For PKCS#12 file parsing only <b>-in</b> and <b>-out</b> need to be used for PKCS#12 file creation <b>-export</b> and <b>-name</b> are also used.</p>
<p>If none of the <b>-clcerts</b>, <b>-cacerts</b> or <b>-nocerts</b> options are present then all certificates will be output in the order they appear in the input PKCS#12 files. There is no guarantee that the first certificate present is the one corresponding to the private key. Certain software which requires a private key and certificate and assumes the first certificate in the file is the one corresponding to the private key: this may not always be the case. Using the <b>-clcerts</b> option will solve this problem by only outputting the certificate corresponding to the private key. If the CA certificates are required then they can be output to a separate file using the <b>-nokeys -cacerts</b> options to just output CA certificates.</p>
<p>The <b>-keypbe</b> and <b>-certpbe</b> algorithms allow the precise encryption algorithms for private keys and certificates to be specified. Normally the defaults are fine but occasionally software can't handle triple DES encrypted private keys, then the option <b>-keypbe PBE-SHA1-RC2-40</b> can be used to reduce the private key encryption to 40 bit RC2. A complete description of all algorithms is contained in the <b>pkcs8</b> manual page.</p>
<p>Prior 1.1 release passwords containing non-ASCII characters were encoded in non-compliant manner, which limited interoperability, in first hand with Windows. But switching to standard-compliant password encoding poses problem accessing old data protected with broken encoding. For this reason even legacy encodings is attempted when reading the data. If you use PKCS#12 files in production application you are advised to convert the data, because implemented heuristic approach is not MT-safe, its sole goal is to facilitate the data upgrade with this utility.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Parse a PKCS#12 file and output it to a file:</p>
<pre><code>openssl pkcs12 -in file.p12 -out file.pem</code></pre>
<p>Output only client certificates to a file:</p>
<pre><code>openssl pkcs12 -in file.p12 -clcerts -out file.pem</code></pre>
<p>Don't encrypt the private key:</p>
<pre><code>openssl pkcs12 -in file.p12 -out file.pem -nodes</code></pre>
<p>Print some info about a PKCS#12 file:</p>
<pre><code>openssl pkcs12 -in file.p12 -info -noout</code></pre>
<p>Create a PKCS#12 file:</p>
<pre><code>openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate"</code></pre>
<p>Include some extra certificates:</p>
<pre><code>openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate" \
-certfile othercerts.pem</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/pkcs8.html">pkcs8(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]��S S openssl/html/man1/rand.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>rand</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-rand, rand - generate pseudo-random bytes</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl rand</b> [<b>-help</b>] [<b>-out</b> <i>file</i>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-base64</b>] [<b>-hex</b>] <i>num</i></p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>This command generates <i>num</i> random bytes using a cryptographically secure pseudo random number generator (CSPRNG).</p>
<p>The random bytes are generated using the <a href="../man3/RAND_bytes.html">RAND_bytes(3)</a> function, which provides a security level of 256 bits, provided it managed to seed itself successfully from a trusted operating system entropy source. Otherwise, the command will fail with a nonzero error code. For more details, see <a href="../man3/RAND_bytes.html">RAND_bytes(3)</a>, <a href="../man7/RAND.html">RAND(7)</a>, and <a href="../man7/RAND_DRBG.html">RAND_DRBG(7)</a>.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="out-file"><b>-out file</b></dt>
<dd>
<p>Write to <i>file</i> instead of standard output.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others. Explicitly specifying a seed file is in general not necessary, see the <a href="#NOTES">"NOTES"</a> section for more information.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="base64"><b>-base64</b></dt>
<dd>
<p>Perform base64 encoding on the output.</p>
</dd>
<dt id="hex"><b>-hex</b></dt>
<dd>
<p>Show the output as a hex string.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>Prior to OpenSSL 1.1.1, it was common for applications to store information about the state of the random-number generator in a file that was loaded at startup and rewritten upon exit. On modern operating systems, this is generally no longer necessary as OpenSSL will seed itself from a trusted entropy source provided by the operating system. The <b>-rand</b> and <b>-writerand</b> flags are still supported for special platforms or circumstances that might require them.</p>
<p>It is generally an error to use the same seed file more than once and every use of <b>-rand</b> should be paired with <b>-writerand</b>.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man3/RAND_bytes.html">RAND_bytes(3)</a>, <a href="../man7/RAND.html">RAND(7)</a>, <a href="../man7/RAND_DRBG.html">RAND_DRBG(7)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�:k� w w openssl/html/man1/cms.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>cms</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXIT-CODES">EXIT CODES</a></li>
<li><a href="#COMPATIBILITY-WITH-PKCS-7-format">COMPATIBILITY WITH PKCS#7 format.</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#HISTORY">HISTORY</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-cms, cms - CMS utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>cms</b> [<b>-help</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-sign</b>] [<b>-verify</b>] [<b>-cmsout</b>] [<b>-resign</b>] [<b>-data_create</b>] [<b>-data_out</b>] [<b>-digest_create</b>] [<b>-digest_verify</b>] [<b>-compress</b>] [<b>-uncompress</b>] [<b>-EncryptedData_encrypt</b>] [<b>-sign_receipt</b>] [<b>-verify_receipt receipt</b>] [<b>-in filename</b>] [<b>-inform SMIME|PEM|DER</b>] [<b>-rctform SMIME|PEM|DER</b>] [<b>-out filename</b>] [<b>-outform SMIME|PEM|DER</b>] [<b>-stream -indef -noindef</b>] [<b>-noindef</b>] [<b>-content filename</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-print</b>] [<b>-CAfile file</b>] [<b>-CApath dir</b>] [<b>-no-CAfile</b>] [<b>-no-CApath</b>] [<b>-attime timestamp</b>] [<b>-check_ss_sig</b>] [<b>-crl_check</b>] [<b>-crl_check_all</b>] [<b>-explicit_policy</b>] [<b>-extended_crl</b>] [<b>-ignore_critical</b>] [<b>-inhibit_any</b>] [<b>-inhibit_map</b>] [<b>-no_check_time</b>] [<b>-partial_chain</b>] [<b>-policy arg</b>] [<b>-policy_check</b>] [<b>-policy_print</b>] [<b>-purpose purpose</b>] [<b>-suiteB_128</b>] [<b>-suiteB_128_only</b>] [<b>-suiteB_192</b>] [<b>-trusted_first</b>] [<b>-no_alt_chains</b>] [<b>-use_deltas</b>] [<b>-auth_level num</b>] [<b>-verify_depth num</b>] [<b>-verify_email email</b>] [<b>-verify_hostname hostname</b>] [<b>-verify_ip ip</b>] [<b>-verify_name name</b>] [<b>-x509_strict</b>] [<b>-md digest</b>] [<b>-<i>cipher</i></b>] [<b>-nointern</b>] [<b>-noverify</b>] [<b>-nocerts</b>] [<b>-noattr</b>] [<b>-nosmimecap</b>] [<b>-binary</b>] [<b>-crlfeol</b>] [<b>-asciicrlf</b>] [<b>-nodetach</b>] [<b>-certfile file</b>] [<b>-certsout file</b>] [<b>-signer file</b>] [<b>-recip file</b>] [<b>-keyid</b>] [<b>-receipt_request_all</b>] [<b>-receipt_request_first</b>] [<b>-receipt_request_from emailaddress</b>] [<b>-receipt_request_to emailaddress</b>] [<b>-receipt_request_print</b>] [<b>-secretkey key</b>] [<b>-secretkeyid id</b>] [<b>-econtent_type type</b>] [<b>-inkey file</b>] [<b>-keyopt name:parameter</b>] [<b>-passin arg</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>cert.pem...</b>] [<b>-to addr</b>] [<b>-from addr</b>] [<b>-subject subj</b>] [cert.pem]...</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>cms</b> command handles S/MIME v3.1 mail. It can encrypt, decrypt, sign and verify, compress and uncompress S/MIME messages.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<p>There are fourteen operation options that set the type of operation to be performed. The meaning of the other options varies according to the operation type.</p>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="encrypt"><b>-encrypt</b></dt>
<dd>
<p>Encrypt mail for the given recipient certificates. Input file is the message to be encrypted. The output file is the encrypted mail in MIME format. The actual CMS type is <B>EnvelopedData<B>.</p>
<p>Note that no revocation check is done for the recipient cert, so if that key has been compromised, others may be able to decrypt the text.</p>
</dd>
<dt id="decrypt"><b>-decrypt</b></dt>
<dd>
<p>Decrypt mail using the supplied certificate and private key. Expects an encrypted mail message in MIME format for the input file. The decrypted mail is written to the output file.</p>
</dd>
<dt id="debug_decrypt"><b>-debug_decrypt</b></dt>
<dd>
<p>This option sets the <b>CMS_DEBUG_DECRYPT</b> flag. This option should be used with caution: see the notes section below.</p>
</dd>
<dt id="sign"><b>-sign</b></dt>
<dd>
<p>Sign mail using the supplied certificate and private key. Input file is the message to be signed. The signed message in MIME format is written to the output file.</p>
</dd>
<dt id="verify"><b>-verify</b></dt>
<dd>
<p>Verify signed mail. Expects a signed mail message on input and outputs the signed data. Both clear text and opaque signing is supported.</p>
</dd>
<dt id="cmsout"><b>-cmsout</b></dt>
<dd>
<p>Takes an input message and writes out a PEM encoded CMS structure.</p>
</dd>
<dt id="resign"><b>-resign</b></dt>
<dd>
<p>Resign a message: take an existing message and one or more new signers.</p>
</dd>
<dt id="data_create"><b>-data_create</b></dt>
<dd>
<p>Create a CMS <b>Data</b> type.</p>
</dd>
<dt id="data_out"><b>-data_out</b></dt>
<dd>
<p><b>Data</b> type and output the content.</p>
</dd>
<dt id="digest_create"><b>-digest_create</b></dt>
<dd>
<p>Create a CMS <b>DigestedData</b> type.</p>
</dd>
<dt id="digest_verify"><b>-digest_verify</b></dt>
<dd>
<p>Verify a CMS <b>DigestedData</b> type and output the content.</p>
</dd>
<dt id="compress"><b>-compress</b></dt>
<dd>
<p>Create a CMS <b>CompressedData</b> type. OpenSSL must be compiled with <b>zlib</b> support for this option to work, otherwise it will output an error.</p>
</dd>
<dt id="uncompress"><b>-uncompress</b></dt>
<dd>
<p>Uncompress a CMS <b>CompressedData</b> type and output the content. OpenSSL must be compiled with <b>zlib</b> support for this option to work, otherwise it will output an error.</p>
</dd>
<dt id="EncryptedData_encrypt"><b>-EncryptedData_encrypt</b></dt>
<dd>
<p>Encrypt content using supplied symmetric key and algorithm using a CMS <b>EncryptedData</b> type and output the content.</p>
</dd>
<dt id="sign_receipt"><b>-sign_receipt</b></dt>
<dd>
<p>Generate and output a signed receipt for the supplied message. The input message <b>must</b> contain a signed receipt request. Functionality is otherwise similar to the <b>-sign</b> operation.</p>
</dd>
<dt id="verify_receipt-receipt"><b>-verify_receipt receipt</b></dt>
<dd>
<p>Verify a signed receipt in filename <b>receipt</b>. The input message <b>must</b> contain the original receipt request. Functionality is otherwise similar to the <b>-verify</b> operation.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>The input message to be encrypted or signed or the message to be decrypted or verified.</p>
</dd>
<dt id="inform-SMIME-PEM-DER"><b>-inform SMIME|PEM|DER</b></dt>
<dd>
<p>This specifies the input format for the CMS structure. The default is <b>SMIME</b> which reads an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to expect PEM and DER format CMS structures instead. This currently only affects the input format of the CMS structure, if no CMS structure is being input (for example with <b>-encrypt</b> or <b>-sign</b>) this option has no effect.</p>
</dd>
<dt id="rctform-SMIME-PEM-DER"><b>-rctform SMIME|PEM|DER</b></dt>
<dd>
<p>Specify the format for a signed receipt for use with the <b>-receipt_verify</b> operation.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>The message text that has been decrypted or verified or the output MIME format message that has been signed or verified.</p>
</dd>
<dt id="outform-SMIME-PEM-DER"><b>-outform SMIME|PEM|DER</b></dt>
<dd>
<p>This specifies the output format for the CMS structure. The default is <b>SMIME</b> which writes an S/MIME format message. <b>PEM</b> and <b>DER</b> format change this to write PEM and DER format CMS structures instead. This currently only affects the output format of the CMS structure, if no CMS structure is being output (for example with <b>-verify</b> or <b>-decrypt</b>) this option has no effect.</p>
</dd>
<dt id="stream--indef--noindef"><b>-stream -indef -noindef</b></dt>
<dd>
<p>The <b>-stream</b> and <b>-indef</b> options are equivalent and enable streaming I/O for encoding operations. This permits single pass processing of data without the need to hold the entire contents in memory, potentially supporting very large files. Streaming is automatically set for S/MIME signing with detached data if the output format is <b>SMIME</b> it is currently off by default for all other operations.</p>
</dd>
<dt id="noindef"><b>-noindef</b></dt>
<dd>
<p>Disable streaming I/O where it would produce and indefinite length constructed encoding. This option currently has no effect. In future streaming will be enabled by default on all relevant operations and this option will disable it.</p>
</dd>
<dt id="content-filename"><b>-content filename</b></dt>
<dd>
<p>This specifies a file containing the detached content, this is only useful with the <b>-verify</b> command. This is only usable if the CMS structure is using the detached signature form where the content is not included. This option will override any content if the input format is S/MIME and it uses the multipart/signed MIME content type.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>This option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>For the <b>-cmsout</b> operation do not output the parsed CMS structure. This is useful when combined with the <b>-print</b> option or if the syntax of the CMS structure is being checked.</p>
</dd>
<dt id="print"><b>-print</b></dt>
<dd>
<p>For the <b>-cmsout</b> operation print out all fields of the CMS structure. This is mainly useful for testing purposes.</p>
</dd>
<dt id="CAfile-file"><b>-CAfile file</b></dt>
<dd>
<p>A file containing trusted CA certificates, only used with <b>-verify</b>.</p>
</dd>
<dt id="CApath-dir"><b>-CApath dir</b></dt>
<dd>
<p>A directory containing trusted CA certificates, only used with <b>-verify</b>. This directory must be a standard certificate directory: that is a hash of each subject name (using <b>x509 -hash</b>) should be linked to each certificate.</p>
</dd>
<dt id="no-CAfile"><b>-no-CAfile</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default file location</p>
</dd>
<dt id="no-CApath"><b>-no-CApath</b></dt>
<dd>
<p>Do not load the trusted CA certificates from the default directory location</p>
</dd>
<dt id="md-digest"><b>-md digest</b></dt>
<dd>
<p>Digest algorithm to use when signing or resigning. If not present then the default digest algorithm for the signing key will be used (usually SHA1).</p>
</dd>
<dt id="cipher"><b>-<i>cipher</i></b></dt>
<dd>
<p>The encryption algorithm to use. For example triple DES (168 bits) - <b>-des3</b> or 256 bit AES - <b>-aes256</b>. Any standard algorithm name (as used by the EVP_get_cipherbyname() function) can also be used preceded by a dash, for example <b>-aes-128-cbc</b>. See <a href="../man1/enc.html">enc(1)</a> for a list of ciphers supported by your version of OpenSSL.</p>
<p>If not specified triple DES is used. Only used with <b>-encrypt</b> and <b>-EncryptedData_create</b> commands.</p>
</dd>
<dt id="nointern"><b>-nointern</b></dt>
<dd>
<p>When verifying a message normally certificates (if any) included in the message are searched for the signing certificate. With this option only the certificates specified in the <b>-certfile</b> option are used. The supplied certificates can still be used as untrusted CAs however.</p>
</dd>
<dt id="noverify"><b>-noverify</b></dt>
<dd>
<p>Do not verify the signers certificate of a signed message.</p>
</dd>
<dt id="nocerts"><b>-nocerts</b></dt>
<dd>
<p>When signing a message the signer's certificate is normally included with this option it is excluded. This will reduce the size of the signed message but the verifier must have a copy of the signers certificate available locally (passed using the <b>-certfile</b> option for example).</p>
</dd>
<dt id="noattr"><b>-noattr</b></dt>
<dd>
<p>Normally when a message is signed a set of attributes are included which include the signing time and supported symmetric algorithms. With this option they are not included.</p>
</dd>
<dt id="nosmimecap"><b>-nosmimecap</b></dt>
<dd>
<p>Exclude the list of supported algorithms from signed attributes, other options such as signing time and content type are still included.</p>
</dd>
<dt id="binary"><b>-binary</b></dt>
<dd>
<p>Normally the input message is converted to "canonical" format which is effectively using CR and LF as end of line: as required by the S/MIME specification. When this option is present no translation occurs. This is useful when handling binary data which may not be in MIME format.</p>
</dd>
<dt id="crlfeol"><b>-crlfeol</b></dt>
<dd>
<p>Normally the output file uses a single <b>LF</b> as end of line. When this option is present <b>CRLF</b> is used instead.</p>
</dd>
<dt id="asciicrlf"><b>-asciicrlf</b></dt>
<dd>
<p>When signing use ASCII CRLF format canonicalisation. This strips trailing whitespace from all lines, deletes trailing blank lines at EOF and sets the encapsulated content type. This option is normally used with detached content and an output signature format of DER. This option is not normally needed when verifying as it is enabled automatically if the encapsulated content format is detected.</p>
</dd>
<dt id="nodetach"><b>-nodetach</b></dt>
<dd>
<p>When signing a message use opaque signing: this form is more resistant to translation by mail relays but it cannot be read by mail agents that do not support S/MIME. Without this option cleartext signing with the MIME type multipart/signed is used.</p>
</dd>
<dt id="certfile-file"><b>-certfile file</b></dt>
<dd>
<p>Allows additional certificates to be specified. When signing these will be included with the message. When verifying these will be searched for the signers certificates. The certificates should be in PEM format.</p>
</dd>
<dt id="certsout-file"><b>-certsout file</b></dt>
<dd>
<p>Any certificates contained in the message are written to <b>file</b>.</p>
</dd>
<dt id="signer-file"><b>-signer file</b></dt>
<dd>
<p>A signing certificate when signing or resigning a message, this option can be used multiple times if more than one signer is required. If a message is being verified then the signers certificates will be written to this file if the verification was successful.</p>
</dd>
<dt id="recip-file"><b>-recip file</b></dt>
<dd>
<p>When decrypting a message this specifies the recipients certificate. The certificate must match one of the recipients of the message or an error occurs.</p>
<p>When encrypting a message this option may be used multiple times to specify each recipient. This form <b>must</b> be used if customised parameters are required (for example to specify RSA-OAEP).</p>
<p>Only certificates carrying RSA, Diffie-Hellman or EC keys are supported by this option.</p>
</dd>
<dt id="keyid"><b>-keyid</b></dt>
<dd>
<p>Use subject key identifier to identify certificates instead of issuer name and serial number. The supplied certificate <b>must</b> include a subject key identifier extension. Supported by <b>-sign</b> and <b>-encrypt</b> options.</p>
</dd>
<dt id="receipt_request_all--receipt_request_first"><b>-receipt_request_all</b>, <b>-receipt_request_first</b></dt>
<dd>
<p>For <b>-sign</b> option include a signed receipt request. Indicate requests should be provided by all recipient or first tier recipients (those mailed directly and not from a mailing list). Ignored it <b>-receipt_request_from</b> is included.</p>
</dd>
<dt id="receipt_request_from-emailaddress"><b>-receipt_request_from emailaddress</b></dt>
<dd>
<p>For <b>-sign</b> option include a signed receipt request. Add an explicit email address where receipts should be supplied.</p>
</dd>
<dt id="receipt_request_to-emailaddress"><b>-receipt_request_to emailaddress</b></dt>
<dd>
<p>Add an explicit email address where signed receipts should be sent to. This option <b>must</b> but supplied if a signed receipt it requested.</p>
</dd>
<dt id="receipt_request_print"><b>-receipt_request_print</b></dt>
<dd>
<p>For the <b>-verify</b> operation print out the contents of any signed receipt requests.</p>
</dd>
<dt id="secretkey-key"><b>-secretkey key</b></dt>
<dd>
<p>Specify symmetric key to use. The key must be supplied in hex format and be consistent with the algorithm used. Supported by the <b>-EncryptedData_encrypt</b> <b>-EncryptedData_decrypt</b>, <b>-encrypt</b> and <b>-decrypt</b> options. When used with <b>-encrypt</b> or <b>-decrypt</b> the supplied key is used to wrap or unwrap the content encryption key using an AES key in the <b>KEKRecipientInfo</b> type.</p>
</dd>
<dt id="secretkeyid-id"><b>-secretkeyid id</b></dt>
<dd>
<p>The key identifier for the supplied symmetric key for <b>KEKRecipientInfo</b> type. This option <b>must</b> be present if the <b>-secretkey</b> option is used with <b>-encrypt</b>. With <b>-decrypt</b> operations the <b>id</b> is used to locate the relevant key if it is not supplied then an attempt is used to decrypt any <b>KEKRecipientInfo</b> structures.</p>
</dd>
<dt id="econtent_type-type"><b>-econtent_type type</b></dt>
<dd>
<p>Set the encapsulated content type to <b>type</b> if not supplied the <b>Data</b> type is used. The <b>type</b> argument can be any valid OID name in either text or numerical format.</p>
</dd>
<dt id="inkey-file"><b>-inkey file</b></dt>
<dd>
<p>The private key to use when signing or decrypting. This must match the corresponding certificate. If this option is not specified then the private key must be included in the certificate file specified with the <b>-recip</b> or <b>-signer</b> file. When signing this option can be used multiple times to specify successive keys.</p>
</dd>
<dt id="keyopt-name:opt"><b>-keyopt name:opt</b></dt>
<dd>
<p>For signing and encryption this option can be used multiple times to set customised parameters for the preceding key or certificate. It can currently be used to set RSA-PSS for signing, RSA-OAEP for encryption or to modify default parameters for ECDH.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The private key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="cert.pem"><b>cert.pem...</b></dt>
<dd>
<p>One or more certificates of message recipients: used when encrypting a message.</p>
</dd>
<dt id="to--from--subject"><b>-to, -from, -subject</b></dt>
<dd>
<p>The relevant mail headers. These are included outside the signed portion of a message so they may be included manually. If signing then many S/MIME mail clients check the signers certificate's email address matches that specified in the From: address.</p>
</dd>
<dt id="attime--check_ss_sig--crl_check--crl_check_all--explicit_policy--extended_crl--ignore_critical--inhibit_any--inhibit_map--no_alt_chains--no_check_time--partial_chain--policy--policy_check--policy_print--purpose--suiteB_128--suiteB_128_only--suiteB_192--trusted_first--use_deltas--auth_level--verify_depth--verify_email--verify_hostname--verify_ip--verify_name--x509_strict"><b>-attime</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, <b>-x509_strict</b></dt>
<dd>
<p>Set various certificate chain validation options. See the <a href="../man1/verify.html">verify(1)</a> manual page for details.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The MIME message must be sent without any blank lines between the headers and the output. Some mail programs will automatically add a blank line. Piping the mail directly to sendmail is one way to achieve the correct format.</p>
<p>The supplied message to be signed or encrypted must include the necessary MIME headers or many S/MIME clients won't display it properly (if at all). You can use the <b>-text</b> option to automatically add plain text headers.</p>
<p>A "signed and encrypted" message is one where a signed message is then encrypted. This can be produced by encrypting an already signed message: see the examples section.</p>
<p>This version of the program only allows one signer per message but it will verify multiple signers on received messages. Some S/MIME clients choke if a message contains multiple signers. It is possible to sign messages "in parallel" by signing an already signed message.</p>
<p>The options <b>-encrypt</b> and <b>-decrypt</b> reflect common usage in S/MIME clients. Strictly speaking these process CMS enveloped data: CMS encrypted data is used for other purposes.</p>
<p>The <b>-resign</b> option uses an existing message digest when adding a new signer. This means that attributes must be present in at least one existing signer using the same message digest or this operation will fail.</p>
<p>The <b>-stream</b> and <b>-indef</b> options enable streaming I/O support. As a result the encoding is BER using indefinite length constructed encoding and no longer DER. Streaming is supported for the <b>-encrypt</b> operation and the <b>-sign</b> operation if the content is not detached.</p>
<p>Streaming is always used for the <b>-sign</b> operation with detached data but since the content is no longer part of the CMS structure the encoding remains DER.</p>
<p>If the <b>-decrypt</b> option is used without a recipient certificate then an attempt is made to locate the recipient by trying each potential recipient in turn using the supplied private key. To thwart the MMA attack (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) all recipients are tried whether they succeed or not and if no recipients match the message is "decrypted" using a random key which will typically output garbage. The <b>-debug_decrypt</b> option can be used to disable the MMA attack protection and return an error if no recipient can be found: this option should be used with caution. For a fuller description see <a href="../man3/CMS_decrypt.html">CMS_decrypt(3)</a>).</p>
<h1 id="EXIT-CODES">EXIT CODES</h1>
<dl>
<dt id="pod0">0</dt>
<dd>
<p>The operation was completely successfully.</p>
</dd>
<dt id="pod1">1</dt>
<dd>
<p>An error occurred parsing the command options.</p>
</dd>
<dt id="pod2">2</dt>
<dd>
<p>One of the input files could not be read.</p>
</dd>
<dt id="pod3">3</dt>
<dd>
<p>An error occurred creating the CMS file or when reading the MIME message.</p>
</dd>
<dt id="pod4">4</dt>
<dd>
<p>An error occurred decrypting or verifying the message.</p>
</dd>
<dt id="pod5">5</dt>
<dd>
<p>The message was verified correctly but an error occurred writing out the signers certificates.</p>
</dd>
</dl>
<h1 id="COMPATIBILITY-WITH-PKCS-7-format">COMPATIBILITY WITH PKCS#7 format.</h1>
<p>The <b>smime</b> utility can only process the older <b>PKCS#7</b> format. The <b>cms</b> utility supports Cryptographic Message Syntax format. Use of some features will result in messages which cannot be processed by applications which only support the older format. These are detailed below.</p>
<p>The use of the <b>-keyid</b> option with <b>-sign</b> or <b>-encrypt</b>.</p>
<p>The <b>-outform PEM</b> option uses different headers.</p>
<p>The <b>-compress</b> option.</p>
<p>The <b>-secretkey</b> option when used with <b>-encrypt</b>.</p>
<p>The use of PSS with <b>-sign</b>.</p>
<p>The use of OAEP or non-RSA keys with <b>-encrypt</b>.</p>
<p>Additionally the <b>-EncryptedData_create</b> and <b>-data_create</b> type cannot be processed by the older <b>smime</b> command.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Create a cleartext signed message:</p>
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg \
-signer mycert.pem</code></pre>
<p>Create an opaque signed message</p>
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg -nodetach \
-signer mycert.pem</code></pre>
<p>Create a signed message, include some additional certificates and read the private key from another file:</p>
<pre><code>openssl cms -sign -in in.txt -text -out mail.msg \
-signer mycert.pem -inkey mykey.pem -certfile mycerts.pem</code></pre>
<p>Create a signed message with two signers, use key identifier:</p>
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg \
-signer mycert.pem -signer othercert.pem -keyid</code></pre>
<p>Send a signed message under Unix directly to sendmail, including headers:</p>
<pre><code>openssl cms -sign -in in.txt -text -signer mycert.pem \
-from steve@openssl.org -to someone@somewhere \
-subject "Signed message" | sendmail someone@somewhere</code></pre>
<p>Verify a message and extract the signer's certificate if successful:</p>
<pre><code>openssl cms -verify -in mail.msg -signer user.pem -out signedtext.txt</code></pre>
<p>Send encrypted mail using triple DES:</p>
<pre><code>openssl cms -encrypt -in in.txt -from steve@openssl.org \
-to someone@somewhere -subject "Encrypted message" \
-des3 user.pem -out mail.msg</code></pre>
<p>Sign and encrypt mail:</p>
<pre><code>openssl cms -sign -in ml.txt -signer my.pem -text \
| openssl cms -encrypt -out mail.msg \
-from steve@openssl.org -to someone@somewhere \
-subject "Signed and Encrypted message" -des3 user.pem</code></pre>
<p>Note: the encryption command does not include the <b>-text</b> option because the message being encrypted already has MIME headers.</p>
<p>Decrypt mail:</p>
<pre><code>openssl cms -decrypt -in mail.msg -recip mycert.pem -inkey key.pem</code></pre>
<p>The output from Netscape form signing is a PKCS#7 structure with the detached signature format. You can use this program to verify the signature by line wrapping the base64 encoded structure and surrounding it with:</p>
<pre><code>-----BEGIN PKCS7-----
-----END PKCS7-----</code></pre>
<p>and using the command,</p>
<pre><code>openssl cms -verify -inform PEM -in signature.pem -content content.txt</code></pre>
<p>alternatively you can base64 decode the signature and use</p>
<pre><code>openssl cms -verify -inform DER -in signature.der -content content.txt</code></pre>
<p>Create an encrypted message using 128 bit Camellia:</p>
<pre><code>openssl cms -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem</code></pre>
<p>Add a signer to an existing message:</p>
<pre><code>openssl cms -resign -in mail.msg -signer newsign.pem -out mail2.msg</code></pre>
<p>Sign mail using RSA-PSS:</p>
<pre><code>openssl cms -sign -in message.txt -text -out mail.msg \
-signer mycert.pem -keyopt rsa_padding_mode:pss</code></pre>
<p>Create encrypted mail using RSA-OAEP:</p>
<pre><code>openssl cms -encrypt -in plain.txt -out mail.msg \
-recip cert.pem -keyopt rsa_padding_mode:oaep</code></pre>
<p>Use SHA256 KDF with an ECDH certificate:</p>
<pre><code>openssl cms -encrypt -in plain.txt -out mail.msg \
-recip ecdhcert.pem -keyopt ecdh_kdf_md:sha256</code></pre>
<h1 id="BUGS">BUGS</h1>
<p>The MIME parser isn't very clever: it seems to handle most messages that I've thrown at it but it may choke on others.</p>
<p>The code currently will only write out the signer's certificate to a file: if the signer has a separate encryption certificate this must be manually extracted. There should be some heuristic that determines the correct encryption certificate.</p>
<p>Ideally a database should be maintained of a certificates for each email address.</p>
<p>The code doesn't currently take note of the permitted symmetric encryption algorithms as supplied in the SMIMECapabilities signed attribute. this means the user has to manually include the correct encryption algorithm. It should store the list of permitted ciphers in a database and only use those.</p>
<p>No revocation checking is done on the signer's certificate.</p>
<p>The <b>-binary</b> option does not work correctly when processing text input which (contrary to the S/MIME specification) uses LF rather than CRLF line endings.</p>
<h1 id="HISTORY">HISTORY</h1>
<p>The use of multiple <b>-signer</b> options and the <b>-resign</b> command were first added in OpenSSL 1.0.0.</p>
<p>The <b>keyopt</b> option was added in OpenSSL 1.0.2.</p>
<p>Support for RSA-OAEP and RSA-PSS was added in OpenSSL 1.0.2.</p>
<p>The use of non-RSA keys with <b>-encrypt</b> and <b>-decrypt</b> was added in OpenSSL 1.0.2.</p>
<p>The -no_alt_chains option was added in OpenSSL 1.0.2b.</p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2008-2022 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )](��L� � openssl/html/man1/pkey.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>pkey</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-pkey, pkey - public or private key processing tool</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>pkey</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-traditional</b>] [<b>-<i>cipher</i></b>] [<b>-text</b>] [<b>-text_pub</b>] [<b>-noout</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-engine id</b>] [<b>-check</b>] [<b>-pubcheck</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>pkey</b> command processes public or private keys. They can be converted between various forms and their components printed out.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format DER or PEM. The default format is PEM.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The input file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write a key to or standard output if this option is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="passout-password"><b>-passout password</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="traditional"><b>-traditional</b></dt>
<dd>
<p>Normally a private key is written using standard format: this is PKCS#8 form with the appropriate encryption algorithm (if any). If the <b>-traditional</b> option is specified then the older "traditional" format is used instead.</p>
</dd>
<dt id="cipher"><b>-<i>cipher</i></b></dt>
<dd>
<p>These options encrypt the private key with the supplied cipher. Any algorithm name accepted by EVP_get_cipherbyname() is acceptable such as <b>des3</b>.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the various public or private key components in plain text in addition to the encoded version.</p>
</dd>
<dt id="text_pub"><b>-text_pub</b></dt>
<dd>
<p>Print out only public key components even if a private key is being processed.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>Do not output the encoded version of the key.</p>
</dd>
<dt id="pubin"><b>-pubin</b></dt>
<dd>
<p>By default a private key is read from the input file: with this option a public key is read instead.</p>
</dd>
<dt id="pubout"><b>-pubout</b></dt>
<dd>
<p>By default a private key is output: with this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkey</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="check"><b>-check</b></dt>
<dd>
<p>This option checks the consistency of a key pair for both public and private components.</p>
</dd>
<dt id="pubcheck"><b>-pubcheck</b></dt>
<dd>
<p>This option checks the correctness of either a public key or the public component of a key pair.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>To remove the pass phrase on an RSA private key:</p>
<pre><code>openssl pkey -in key.pem -out keyout.pem</code></pre>
<p>To encrypt a private key using triple DES:</p>
<pre><code>openssl pkey -in key.pem -des3 -out keyout.pem</code></pre>
<p>To convert a private key from PEM to DER format:</p>
<pre><code>openssl pkey -in key.pem -outform DER -out keyout.der</code></pre>
<p>To print out the components of a private key to standard output:</p>
<pre><code>openssl pkey -in key.pem -text -noout</code></pre>
<p>To print out the public components of a private key to standard output:</p>
<pre><code>openssl pkey -in key.pem -text_pub -noout</code></pre>
<p>To just output the public part of a private key:</p>
<pre><code>openssl pkey -in key.pem -pubout -out pubkey.pem</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]!�N>� � openssl/html/man1/pkcs7.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>pkcs7</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#RESTRICTIONS">RESTRICTIONS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-pkcs7, pkcs7 - PKCS#7 utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>pkcs7</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-print_certs</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-engine id</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>pkcs7</b> command processes PKCS#7 files in DER or PEM format.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. <b>DER</b> format is DER encoded PKCS#7 v1.5 structure.<b>PEM</b> (the default) is a base64 encoded version of the DER form with header and footer lines.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="print_certs"><b>-print_certs</b></dt>
<dd>
<p>Prints out any certificates or CRLs contained in the file. They are preceded by their subject and issuer names in one line format.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out certificates details in full rather than just subject and issuer names.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>Don't output the encoded version of the PKCS#7 structure (or certificates is <b>-print_certs</b> is set).</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkcs7</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Convert a PKCS#7 file from PEM to DER:</p>
<pre><code>openssl pkcs7 -in file.pem -outform DER -out file.der</code></pre>
<p>Output all certificates in a file:</p>
<pre><code>openssl pkcs7 -in file.pem -print_certs -out certs.pem</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>The PEM PKCS#7 format uses the header and footer lines:</p>
<pre><code>-----BEGIN PKCS7-----
-----END PKCS7-----</code></pre>
<p>For compatibility with some CAs it will also accept:</p>
<pre><code>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</code></pre>
<h1 id="RESTRICTIONS">RESTRICTIONS</h1>
<p>There is no option to print out all the fields of a PKCS#7 file.</p>
<p>This PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC2315 they cannot currently parse, for example, the new CMS as described in RFC2630.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/crl2pkcs7.html">crl2pkcs7(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�n�Q Q openssl/html/man1/spkac.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>spkac</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-spkac, spkac - SPKAC printing and generating utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>spkac</b> [<b>-help</b>] [<b>-in filename</b>] [<b>-out filename</b>] [<b>-key keyfile</b>] [<b>-keyform PEM|DER|ENGINE</b>] [<b>-passin arg</b>] [<b>-challenge string</b>] [<b>-pubkey</b>] [<b>-spkac spkacname</b>] [<b>-spksect section</b>] [<b>-noout</b>] [<b>-verify</b>] [<b>-engine id</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>spkac</b> command processes Netscape signed public key and challenge (SPKAC) files. It can print out their contents, verify the signature and produce its own SPKACs from a supplied private key.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read from or standard input if this option is not specified. Ignored if the <b>-key</b> option is used.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="key-keyfile"><b>-key keyfile</b></dt>
<dd>
<p>Create an SPKAC file using the private key in <b>keyfile</b>. The <b>-in</b>, <b>-noout</b>, <b>-spksect</b> and <b>-verify</b> options are ignored if present.</p>
</dd>
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
<dd>
<p>Whether the key format is PEM, DER, or an engine-backed key. The default is PEM.</p>
</dd>
<dt id="passin-password"><b>-passin password</b></dt>
<dd>
<p>The input file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="challenge-string"><b>-challenge string</b></dt>
<dd>
<p>Specifies the challenge string if an SPKAC is being created.</p>
</dd>
<dt id="spkac-spkacname"><b>-spkac spkacname</b></dt>
<dd>
<p>Allows an alternative name form the variable containing the SPKAC. The default is "SPKAC". This option affects both generated and input SPKAC files.</p>
</dd>
<dt id="spksect-section"><b>-spksect section</b></dt>
<dd>
<p>Allows an alternative name form the section containing the SPKAC. The default is the default section.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>Don't output the text version of the SPKAC (not used if an SPKAC is being created).</p>
</dd>
<dt id="pubkey"><b>-pubkey</b></dt>
<dd>
<p>Output the public key of an SPKAC (not used if an SPKAC is being created).</p>
</dd>
<dt id="verify"><b>-verify</b></dt>
<dd>
<p>Verifies the digital signature on the supplied SPKAC.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>spkac</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Print out the contents of an SPKAC:</p>
<pre><code>openssl spkac -in spkac.cnf</code></pre>
<p>Verify the signature of an SPKAC:</p>
<pre><code>openssl spkac -in spkac.cnf -noout -verify</code></pre>
<p>Create an SPKAC using the challenge string "hello":</p>
<pre><code>openssl spkac -key key.pem -challenge hello -out spkac.cnf</code></pre>
<p>Example of an SPKAC, (long lines split up for clarity):</p>
<pre><code>SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA\
1cCoq2Wa3Ixs47uI7FPVwHVIPDx5yso105Y6zpozam135a\
8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03uPFoQIDAQAB\
FgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJ\
h1bEIYuc2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnD\
dq+NQ3F+X4deMx9AaEglZtULwV4=</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>A created SPKAC with suitable DN components appended can be fed into the <b>ca</b> utility.</p>
<p>SPKACs are typically generated by Netscape when a form is submitted containing the <b>KEYGEN</b> tag as part of the certificate enrollment process.</p>
<p>The challenge string permits a primitive form of proof of possession of private key. By checking the SPKAC signature and a random challenge string some guarantee is given that the user knows the private key corresponding to the public key being certified. This is important in some applications. Without this it is possible for a previous SPKAC to be used in a "replay attack".</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/ca.html">ca(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]���� � openssl/html/man1/tsget.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>tsget</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#ENVIRONMENT-VARIABLES">ENVIRONMENT VARIABLES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-tsget, tsget - Time Stamping HTTP/HTTPS client</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>tsget</b> <b>-h</b> server_url [<b>-e</b> extension] [<b>-o</b> output] [<b>-v</b>] [<b>-d</b>] [<b>-k</b> private_key.pem] [<b>-p</b> key_password] [<b>-c</b> client_cert.pem] [<b>-C</b> CA_certs.pem] [<b>-P</b> CA_path] [<b>-r</b> file:file...] [<b>-g</b> EGD_socket] [request]...</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>tsget</b> command can be used for sending a timestamp request, as specified in <b>RFC 3161</b>, to a timestamp server over HTTP or HTTPS and storing the timestamp response in a file. This tool cannot be used for creating the requests and verifying responses, you can use the OpenSSL <b>ts(1)</b> command to do that. <b>tsget</b> can send several requests to the server without closing the TCP connection if more than one requests are specified on the command line.</p>
<p>The tool sends the following HTTP request for each timestamp request:</p>
<pre><code>POST url HTTP/1.1
User-Agent: OpenTSA tsget.pl/<version>
Host: <host>:<port>
Pragma: no-cache
Content-Type: application/timestamp-query
Accept: application/timestamp-reply
Content-Length: length of body
...binary request specified by the user...</code></pre>
<p><b>tsget</b> expects a response of type application/timestamp-reply, which is written to a file without any interpretation.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="h-server_url"><b>-h</b> server_url</dt>
<dd>
<p>The URL of the HTTP/HTTPS server listening for timestamp requests.</p>
</dd>
<dt id="e-extension"><b>-e</b> extension</dt>
<dd>
<p>If the <b>-o</b> option is not given this argument specifies the extension of the output files. The base name of the output file will be the same as those of the input files. Default extension is '.tsr'. (Optional)</p>
</dd>
<dt id="o-output"><b>-o</b> output</dt>
<dd>
<p>This option can be specified only when just one request is sent to the server. The timestamp response will be written to the given output file. '-' means standard output. In case of multiple timestamp requests or the absence of this argument the names of the output files will be derived from the names of the input files and the default or specified extension argument. (Optional)</p>
</dd>
<dt id="v"><b>-v</b></dt>
<dd>
<p>The name of the currently processed request is printed on standard error. (Optional)</p>
</dd>
<dt id="d"><b>-d</b></dt>
<dd>
<p>Switches on verbose mode for the underlying <b>curl</b> library. You can see detailed debug messages for the connection. (Optional)</p>
</dd>
<dt id="k-private_key.pem"><b>-k</b> private_key.pem</dt>
<dd>
<p>(HTTPS) In case of certificate-based client authentication over HTTPS <private_key.pem> must contain the private key of the user. The private key file can optionally be protected by a passphrase. The <b>-c</b> option must also be specified. (Optional)</p>
</dd>
<dt id="p-key_password"><b>-p</b> key_password</dt>
<dd>
<p>(HTTPS) Specifies the passphrase for the private key specified by the <b>-k</b> argument. If this option is omitted and the key is passphrase protected <b>tsget</b> will ask for it. (Optional)</p>
</dd>
<dt id="c-client_cert.pem"><b>-c</b> client_cert.pem</dt>
<dd>
<p>(HTTPS) In case of certificate-based client authentication over HTTPS <client_cert.pem> must contain the X.509 certificate of the user. The <b>-k</b> option must also be specified. If this option is not specified no certificate-based client authentication will take place. (Optional)</p>
</dd>
<dt id="C-CA_certs.pem"><b>-C</b> CA_certs.pem</dt>
<dd>
<p>(HTTPS) The trusted CA certificate store. The certificate chain of the peer's certificate must include one of the CA certificates specified in this file. Either option <b>-C</b> or option <b>-P</b> must be given in case of HTTPS. (Optional)</p>
</dd>
<dt id="P-CA_path"><b>-P</b> CA_path</dt>
<dd>
<p>(HTTPS) The path containing the trusted CA certificates to verify the peer's certificate. The directory must be prepared with the <b>c_rehash</b> OpenSSL utility. Either option <b>-C</b> or option <b>-P</b> must be given in case of HTTPS. (Optional)</p>
</dd>
<dt id="rand-file:file"><b>-rand</b> file:file...</dt>
<dd>
<p>The files containing random data for seeding the random number generator. Multiple files can be specified, the separator is <b>;</b> for MS-Windows, <b>,</b> for VMS and <b>:</b> for all other platforms. (Optional)</p>
</dd>
<dt id="g-EGD_socket"><b>-g</b> EGD_socket</dt>
<dd>
<p>The name of an EGD socket to get random data from. (Optional)</p>
</dd>
<dt id="request">[request]...</dt>
<dd>
<p>List of files containing <b>RFC 3161</b> DER-encoded timestamp requests. If no requests are specified only one request will be sent to the server and it will be read from the standard input. (Optional)</p>
</dd>
</dl>
<h1 id="ENVIRONMENT-VARIABLES">ENVIRONMENT VARIABLES</h1>
<p>The <b>TSGET</b> environment variable can optionally contain default arguments. The content of this variable is added to the list of command line arguments.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>The examples below presume that <b>file1.tsq</b> and <b>file2.tsq</b> contain valid timestamp requests, tsa.opentsa.org listens at port 8080 for HTTP requests and at port 8443 for HTTPS requests, the TSA service is available at the /tsa absolute path.</p>
<p>Get a timestamp response for file1.tsq over HTTP, output is written to file1.tsr:</p>
<pre><code>tsget -h http://tsa.opentsa.org:8080/tsa file1.tsq</code></pre>
<p>Get a timestamp response for file1.tsq and file2.tsq over HTTP showing progress, output is written to file1.reply and file2.reply respectively:</p>
<pre><code>tsget -h http://tsa.opentsa.org:8080/tsa -v -e .reply \
file1.tsq file2.tsq</code></pre>
<p>Create a timestamp request, write it to file3.tsq, send it to the server and write the response to file3.tsr:</p>
<pre><code>openssl ts -query -data file3.txt -cert | tee file3.tsq \
| tsget -h http://tsa.opentsa.org:8080/tsa \
-o file3.tsr</code></pre>
<p>Get a timestamp response for file1.tsq over HTTPS without client authentication:</p>
<pre><code>tsget -h https://tsa.opentsa.org:8443/tsa \
-C cacerts.pem file1.tsq</code></pre>
<p>Get a timestamp response for file1.tsq over HTTPS with certificate-based client authentication (it will ask for the passphrase if client_key.pem is protected):</p>
<pre><code>tsget -h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
-k client_key.pem -c client_cert.pem file1.tsq</code></pre>
<p>You can shorten the previous command line if you make use of the <b>TSGET</b> environment variable. The following commands do the same as the previous example:</p>
<pre><code>TSGET='-h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
-k client_key.pem -c client_cert.pem'
export TSGET
tsget file1.tsq</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/openssl.html">openssl(1)</a>, <a href="../man1/ts.html">ts(1)</a>, <a href="../man1/curl.html">curl(1)</a>, <b>RFC 3161</b></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]r��j j openssl/html/man1/ts.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>ts</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a>
<ul>
<li><a href="#Time-Stamp-Request-generation">Time Stamp Request generation</a></li>
<li><a href="#Time-Stamp-Response-generation">Time Stamp Response generation</a></li>
<li><a href="#Time-Stamp-Response-verification">Time Stamp Response verification</a></li>
</ul>
</li>
<li><a href="#CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a>
<ul>
<li><a href="#Time-Stamp-Request">Time Stamp Request</a></li>
<li><a href="#Time-Stamp-Response">Time Stamp Response</a></li>
<li><a href="#Time-Stamp-Verification">Time Stamp Verification</a></li>
</ul>
</li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-ts, ts - Time Stamping Authority tool (client/server)</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>ts</b> <b>-query</b> [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-config</b> configfile] [<b>-data</b> file_to_hash] [<b>-digest</b> digest_bytes] [<b>-<i>digest</i></b>] [<b>-tspolicy</b> object_id] [<b>-no_nonce</b>] [<b>-cert</b>] [<b>-in</b> request.tsq] [<b>-out</b> request.tsq] [<b>-text</b>]</p>
<p><b>openssl</b> <b>ts</b> <b>-reply</b> [<b>-config</b> configfile] [<b>-section</b> tsa_section] [<b>-queryfile</b> request.tsq] [<b>-passin</b> password_src] [<b>-signer</b> tsa_cert.pem] [<b>-inkey</b> file_or_id] [<b>-<i>digest</i></b>] [<b>-chain</b> certs_file.pem] [<b>-tspolicy</b> object_id] [<b>-in</b> response.tsr] [<b>-token_in</b>] [<b>-out</b> response.tsr] [<b>-token_out</b>] [<b>-text</b>] [<b>-engine</b> id]</p>
<p><b>openssl</b> <b>ts</b> <b>-verify</b> [<b>-data</b> file_to_hash] [<b>-digest</b> digest_bytes] [<b>-queryfile</b> request.tsq] [<b>-in</b> response.tsr] [<b>-token_in</b>] [<b>-CApath</b> trusted_cert_path] [<b>-CAfile</b> trusted_certs.pem] [<b>-untrusted</b> cert_file.pem] [<i>verify options</i>]</p>
<p><i>verify options:</i> [-attime timestamp] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-issuer_checks] [-no_alt_chains] [-no_check_time] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>ts</b> command is a basic Time Stamping Authority (TSA) client and server application as specified in RFC 3161 (Time-Stamp Protocol, TSP). A TSA can be part of a PKI deployment and its role is to provide long term proof of the existence of a certain datum before a particular time. Here is a brief description of the protocol:</p>
<ol>
<li><p>The TSA client computes a one-way hash value for a data file and sends the hash to the TSA.</p>
</li>
<li><p>The TSA attaches the current date and time to the received hash value, signs them and sends the timestamp token back to the client. By creating this token the TSA certifies the existence of the original data file at the time of response generation.</p>
</li>
<li><p>The TSA client receives the timestamp token and verifies the signature on it. It also checks if the token contains the same hash value that it had sent to the TSA.</p>
</li>
</ol>
<p>There is one DER encoded protocol data unit defined for transporting a timestamp request to the TSA and one for sending the timestamp response back to the client. The <b>ts</b> command has three main functions: creating a timestamp request based on a data file, creating a timestamp response based on a request, verifying if a response corresponds to a particular request or a data file.</p>
<p>There is no support for sending the requests/responses automatically over HTTP or TCP yet as suggested in RFC 3161. The users must send the requests either by ftp or e-mail.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<h2 id="Time-Stamp-Request-generation">Time Stamp Request generation</h2>
<p>The <b>-query</b> switch can be used for creating and printing a timestamp request with the following options:</p>
<dl>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="config-configfile"><b>-config</b> configfile</dt>
<dd>
<p>The configuration file to use. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>.</p>
</dd>
<dt id="data-file_to_hash"><b>-data</b> file_to_hash</dt>
<dd>
<p>The data file for which the timestamp request needs to be created. stdin is the default if neither the <b>-data</b> nor the <b>-digest</b> parameter is specified. (Optional)</p>
</dd>
<dt id="digest-digest_bytes"><b>-digest</b> digest_bytes</dt>
<dd>
<p>It is possible to specify the message imprint explicitly without the data file. The imprint must be specified in a hexadecimal format, two characters per byte, the bytes optionally separated by colons (e.g. 1A:F6:01:... or 1AF601...). The number of bytes must match the message digest algorithm in use. (Optional)</p>
</dd>
<dt id="digest"><b>-<i>digest</i></b></dt>
<dd>
<p>The message digest to apply to the data file. Any digest supported by the OpenSSL <b>dgst</b> command can be used. The default is SHA-1. (Optional)</p>
</dd>
<dt id="tspolicy-object_id"><b>-tspolicy</b> object_id</dt>
<dd>
<p>The policy that the client expects the TSA to use for creating the timestamp token. Either the dotted OID notation or OID names defined in the config file can be used. If no policy is requested the TSA will use its own default policy. (Optional)</p>
</dd>
<dt id="no_nonce"><b>-no_nonce</b></dt>
<dd>
<p>No nonce is specified in the request if this option is given. Otherwise a 64 bit long pseudo-random none is included in the request. It is recommended to use nonce to protect against replay-attacks. (Optional)</p>
</dd>
<dt id="cert"><b>-cert</b></dt>
<dd>
<p>The TSA is expected to include its signing certificate in the response. (Optional)</p>
</dd>
<dt id="in-request.tsq"><b>-in</b> request.tsq</dt>
<dd>
<p>This option specifies a previously created timestamp request in DER format that will be printed into the output file. Useful when you need to examine the content of a request in human-readable format. (Optional)</p>
</dd>
<dt id="out-request.tsq"><b>-out</b> request.tsq</dt>
<dd>
<p>Name of the output file to which the request will be written. Default is stdout. (Optional)</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>If this option is specified the output is human-readable text format instead of DER. (Optional)</p>
</dd>
</dl>
<h2 id="Time-Stamp-Response-generation">Time Stamp Response generation</h2>
<p>A timestamp response (TimeStampResp) consists of a response status and the timestamp token itself (ContentInfo), if the token generation was successful. The <b>-reply</b> command is for creating a timestamp response or timestamp token based on a request and printing the response/token in human-readable format. If <b>-token_out</b> is not specified the output is always a timestamp response (TimeStampResp), otherwise it is a timestamp token (ContentInfo).</p>
<dl>
<dt id="config-configfile1"><b>-config</b> configfile</dt>
<dd>
<p>The configuration file to use. Optional; for a description of the default value, see <a href="../man1/openssl.html">"COMMAND SUMMARY" in openssl(1)</a>. See <b>CONFIGURATION FILE OPTIONS</b> for configurable variables.</p>
</dd>
<dt id="section-tsa_section"><b>-section</b> tsa_section</dt>
<dd>
<p>The name of the config file section containing the settings for the response generation. If not specified the default TSA section is used, see <b>CONFIGURATION FILE OPTIONS</b> for details. (Optional)</p>
</dd>
<dt id="queryfile-request.tsq"><b>-queryfile</b> request.tsq</dt>
<dd>
<p>The name of the file containing a DER encoded timestamp request. (Optional)</p>
</dd>
<dt id="passin-password_src"><b>-passin</b> password_src</dt>
<dd>
<p>Specifies the password source for the private key of the TSA. See <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>. (Optional)</p>
</dd>
<dt id="signer-tsa_cert.pem"><b>-signer</b> tsa_cert.pem</dt>
<dd>
<p>The signer certificate of the TSA in PEM format. The TSA signing certificate must have exactly one extended key usage assigned to it: timeStamping. The extended key usage must also be critical, otherwise the certificate is going to be refused. Overrides the <b>signer_cert</b> variable of the config file. (Optional)</p>
</dd>
<dt id="inkey-file_or_id"><b>-inkey</b> file_or_id</dt>
<dd>
<p>The signer private key of the TSA in PEM format. Overrides the <b>signer_key</b> config file option. (Optional) If no engine is used, the argument is taken as a file; if an engine is specified, the argument is given to the engine as a key identifier.</p>
</dd>
<dt id="digest1"><b>-<i>digest</i></b></dt>
<dd>
<p>Signing digest to use. Overrides the <b>signer_digest</b> config file option. (Mandatory unless specified in the config file)</p>
</dd>
<dt id="chain-certs_file.pem"><b>-chain</b> certs_file.pem</dt>
<dd>
<p>The collection of certificates in PEM format that will all be included in the response in addition to the signer certificate if the <b>-cert</b> option was used for the request. This file is supposed to contain the certificate chain for the signer certificate from its issuer upwards. The <b>-reply</b> command does not build a certificate chain automatically. (Optional)</p>
</dd>
<dt id="tspolicy-object_id1"><b>-tspolicy</b> object_id</dt>
<dd>
<p>The default policy to use for the response unless the client explicitly requires a particular TSA policy. The OID can be specified either in dotted notation or with its name. Overrides the <b>default_policy</b> config file option. (Optional)</p>
</dd>
<dt id="in-response.tsr"><b>-in</b> response.tsr</dt>
<dd>
<p>Specifies a previously created timestamp response or timestamp token (if <b>-token_in</b> is also specified) in DER format that will be written to the output file. This option does not require a request, it is useful e.g. when you need to examine the content of a response or token or you want to extract the timestamp token from a response. If the input is a token and the output is a timestamp response a default 'granted' status info is added to the token. (Optional)</p>
</dd>
<dt id="token_in"><b>-token_in</b></dt>
<dd>
<p>This flag can be used together with the <b>-in</b> option and indicates that the input is a DER encoded timestamp token (ContentInfo) instead of a timestamp response (TimeStampResp). (Optional)</p>
</dd>
<dt id="out-response.tsr"><b>-out</b> response.tsr</dt>
<dd>
<p>The response is written to this file. The format and content of the file depends on other options (see <b>-text</b>, <b>-token_out</b>). The default is stdout. (Optional)</p>
</dd>
<dt id="token_out"><b>-token_out</b></dt>
<dd>
<p>The output is a timestamp token (ContentInfo) instead of timestamp response (TimeStampResp). (Optional)</p>
</dd>
<dt id="text1"><b>-text</b></dt>
<dd>
<p>If this option is specified the output is human-readable text format instead of DER. (Optional)</p>
</dd>
<dt id="engine-id"><b>-engine</b> id</dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>ts</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. Default is builtin. (Optional)</p>
</dd>
</dl>
<h2 id="Time-Stamp-Response-verification">Time Stamp Response verification</h2>
<p>The <b>-verify</b> command is for verifying if a timestamp response or timestamp token is valid and matches a particular timestamp request or data file. The <b>-verify</b> command does not use the configuration file.</p>
<dl>
<dt id="data-file_to_hash1"><b>-data</b> file_to_hash</dt>
<dd>
<p>The response or token must be verified against file_to_hash. The file is hashed with the message digest algorithm specified in the token. The <b>-digest</b> and <b>-queryfile</b> options must not be specified with this one. (Optional)</p>
</dd>
<dt id="digest-digest_bytes1"><b>-digest</b> digest_bytes</dt>
<dd>
<p>The response or token must be verified against the message digest specified with this option. The number of bytes must match the message digest algorithm specified in the token. The <b>-data</b> and <b>-queryfile</b> options must not be specified with this one. (Optional)</p>
</dd>
<dt id="queryfile-request.tsq1"><b>-queryfile</b> request.tsq</dt>
<dd>
<p>The original timestamp request in DER format. The <b>-data</b> and <b>-digest</b> options must not be specified with this one. (Optional)</p>
</dd>
<dt id="in-response.tsr1"><b>-in</b> response.tsr</dt>
<dd>
<p>The timestamp response that needs to be verified in DER format. (Mandatory)</p>
</dd>
<dt id="token_in1"><b>-token_in</b></dt>
<dd>
<p>This flag can be used together with the <b>-in</b> option and indicates that the input is a DER encoded timestamp token (ContentInfo) instead of a timestamp response (TimeStampResp). (Optional)</p>
</dd>
<dt id="CApath-trusted_cert_path"><b>-CApath</b> trusted_cert_path</dt>
<dd>
<p>The name of the directory containing the trusted CA certificates of the client. See the similar option of <a href="../man1/verify.html">verify(1)</a> for additional details. Either this option or <b>-CAfile</b> must be specified. (Optional)</p>
</dd>
<dt id="CAfile-trusted_certs.pem"><b>-CAfile</b> trusted_certs.pem</dt>
<dd>
<p>The name of the file containing a set of trusted self-signed CA certificates in PEM format. See the similar option of <a href="../man1/verify.html">verify(1)</a> for additional details. Either this option or <b>-CApath</b> must be specified. (Optional)</p>
</dd>
<dt id="untrusted-cert_file.pem"><b>-untrusted</b> cert_file.pem</dt>
<dd>
<p>Set of additional untrusted certificates in PEM format which may be needed when building the certificate chain for the TSA's signing certificate. This file must contain the TSA signing certificate and all intermediate CA certificates unless the response includes them. (Optional)</p>
</dd>
<dt id="verify-options"><i>verify options</i></dt>
<dd>
<p>The options <b>-attime timestamp</b>, <b>-check_ss_sig</b>, <b>-crl_check</b>, <b>-crl_check_all</b>, <b>-explicit_policy</b>, <b>-extended_crl</b>, <b>-ignore_critical</b>, <b>-inhibit_any</b>, <b>-inhibit_map</b>, <b>-issuer_checks</b>, <b>-no_alt_chains</b>, <b>-no_check_time</b>, <b>-partial_chain</b>, <b>-policy</b>, <b>-policy_check</b>, <b>-policy_print</b>, <b>-purpose</b>, <b>-suiteB_128</b>, <b>-suiteB_128_only</b>, <b>-suiteB_192</b>, <b>-trusted_first</b>, <b>-use_deltas</b>, <b>-auth_level</b>, <b>-verify_depth</b>, <b>-verify_email</b>, <b>-verify_hostname</b>, <b>-verify_ip</b>, <b>-verify_name</b>, and <b>-x509_strict</b> can be used to control timestamp verification. See <a href="../man1/verify.html">verify(1)</a>.</p>
</dd>
</dl>
<h1 id="CONFIGURATION-FILE-OPTIONS">CONFIGURATION FILE OPTIONS</h1>
<p>The <b>-query</b> and <b>-reply</b> commands make use of a configuration file. See <a href="../man5/config.html">config(5)</a> for a general description of the syntax of the config file. The <b>-query</b> command uses only the symbolic OID names section and it can work without it. However, the <b>-reply</b> command needs the config file for its operation.</p>
<p>When there is a command line switch equivalent of a variable the switch always overrides the settings in the config file.</p>
<dl>
<dt id="tsa-section-default_tsa"><b>tsa</b> section, <b>default_tsa</b></dt>
<dd>
<p>This is the main section and it specifies the name of another section that contains all the options for the <b>-reply</b> command. This default section can be overridden with the <b>-section</b> command line switch. (Optional)</p>
</dd>
<dt id="oid_file"><b>oid_file</b></dt>
<dd>
<p>See <a href="../man1/ca.html">ca(1)</a> for description. (Optional)</p>
</dd>
<dt id="oid_section"><b>oid_section</b></dt>
<dd>
<p>See <a href="../man1/ca.html">ca(1)</a> for description. (Optional)</p>
</dd>
<dt id="RANDFILE"><b>RANDFILE</b></dt>
<dd>
<p>See <a href="../man1/ca.html">ca(1)</a> for description. (Optional)</p>
</dd>
<dt id="serial"><b>serial</b></dt>
<dd>
<p>The name of the file containing the hexadecimal serial number of the last timestamp response created. This number is incremented by 1 for each response. If the file does not exist at the time of response generation a new file is created with serial number 1. (Mandatory)</p>
</dd>
<dt id="crypto_device"><b>crypto_device</b></dt>
<dd>
<p>Specifies the OpenSSL engine that will be set as the default for all available algorithms. The default value is builtin, you can specify any other engines supported by OpenSSL (e.g. use chil for the NCipher HSM). (Optional)</p>
</dd>
<dt id="signer_cert"><b>signer_cert</b></dt>
<dd>
<p>TSA signing certificate in PEM format. The same as the <b>-signer</b> command line option. (Optional)</p>
</dd>
<dt id="certs"><b>certs</b></dt>
<dd>
<p>A file containing a set of PEM encoded certificates that need to be included in the response. The same as the <b>-chain</b> command line option. (Optional)</p>
</dd>
<dt id="signer_key"><b>signer_key</b></dt>
<dd>
<p>The private key of the TSA in PEM format. The same as the <b>-inkey</b> command line option. (Optional)</p>
</dd>
<dt id="signer_digest"><b>signer_digest</b></dt>
<dd>
<p>Signing digest to use. The same as the <b>-<i>digest</i></b> command line option. (Mandatory unless specified on the command line)</p>
</dd>
<dt id="default_policy"><b>default_policy</b></dt>
<dd>
<p>The default policy to use when the request does not mandate any policy. The same as the <b>-tspolicy</b> command line option. (Optional)</p>
</dd>
<dt id="other_policies"><b>other_policies</b></dt>
<dd>
<p>Comma separated list of policies that are also acceptable by the TSA and used only if the request explicitly specifies one of them. (Optional)</p>
</dd>
<dt id="digests"><b>digests</b></dt>
<dd>
<p>The list of message digest algorithms that the TSA accepts. At least one algorithm must be specified. (Mandatory)</p>
</dd>
<dt id="accuracy"><b>accuracy</b></dt>
<dd>
<p>The accuracy of the time source of the TSA in seconds, milliseconds and microseconds. E.g. secs:1, millisecs:500, microsecs:100. If any of the components is missing zero is assumed for that field. (Optional)</p>
</dd>
<dt id="clock_precision_digits"><b>clock_precision_digits</b></dt>
<dd>
<p>Specifies the maximum number of digits, which represent the fraction of seconds, that need to be included in the time field. The trailing zeros must be removed from the time, so there might actually be fewer digits, or no fraction of seconds at all. Supported only on UNIX platforms. The maximum value is 6, default is 0. (Optional)</p>
</dd>
<dt id="ordering"><b>ordering</b></dt>
<dd>
<p>If this option is yes the responses generated by this TSA can always be ordered, even if the time difference between two responses is less than the sum of their accuracies. Default is no. (Optional)</p>
</dd>
<dt id="tsa_name"><b>tsa_name</b></dt>
<dd>
<p>Set this option to yes if the subject name of the TSA must be included in the TSA name field of the response. Default is no. (Optional)</p>
</dd>
<dt id="ess_cert_id_chain"><b>ess_cert_id_chain</b></dt>
<dd>
<p>The SignedData objects created by the TSA always contain the certificate identifier of the signing certificate in a signed attribute (see RFC 2634, Enhanced Security Services). If this option is set to yes and either the <b>certs</b> variable or the <b>-chain</b> option is specified then the certificate identifiers of the chain will also be included in the SigningCertificate signed attribute. If this variable is set to no, only the signing certificate identifier is included. Default is no. (Optional)</p>
</dd>
<dt id="ess_cert_id_alg"><b>ess_cert_id_alg</b></dt>
<dd>
<p>This option specifies the hash function to be used to calculate the TSA's public key certificate identifier. Default is sha1. (Optional)</p>
</dd>
</dl>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>All the examples below presume that <b>OPENSSL_CONF</b> is set to a proper configuration file, e.g. the example configuration file openssl/apps/openssl.cnf will do.</p>
<h2 id="Time-Stamp-Request">Time Stamp Request</h2>
<p>To create a timestamp request for design1.txt with SHA-1 without nonce and policy and no certificate is required in the response:</p>
<pre><code>openssl ts -query -data design1.txt -no_nonce \
-out design1.tsq</code></pre>
<p>To create a similar timestamp request with specifying the message imprint explicitly:</p>
<pre><code>openssl ts -query -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
-no_nonce -out design1.tsq</code></pre>
<p>To print the content of the previous request in human readable format:</p>
<pre><code>openssl ts -query -in design1.tsq -text</code></pre>
<p>To create a timestamp request which includes the MD-5 digest of design2.txt, requests the signer certificate and nonce, specifies a policy id (assuming the tsa_policy1 name is defined in the OID section of the config file):</p>
<pre><code>openssl ts -query -data design2.txt -md5 \
-tspolicy tsa_policy1 -cert -out design2.tsq</code></pre>
<h2 id="Time-Stamp-Response">Time Stamp Response</h2>
<p>Before generating a response a signing certificate must be created for the TSA that contains the <b>timeStamping</b> critical extended key usage extension without any other key usage extensions. You can add this line to the user certificate section of the config file to generate a proper certificate;</p>
<pre><code>extendedKeyUsage = critical,timeStamping</code></pre>
<p>See <a href="../man1/req.html">req(1)</a>, <a href="../man1/ca.html">ca(1)</a>, and <a href="../man1/x509.html">x509(1)</a> for instructions. The examples below assume that cacert.pem contains the certificate of the CA, tsacert.pem is the signing certificate issued by cacert.pem and tsakey.pem is the private key of the TSA.</p>
<p>To create a timestamp response for a request:</p>
<pre><code>openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \
-signer tsacert.pem -out design1.tsr</code></pre>
<p>If you want to use the settings in the config file you could just write:</p>
<pre><code>openssl ts -reply -queryfile design1.tsq -out design1.tsr</code></pre>
<p>To print a timestamp reply to stdout in human readable format:</p>
<pre><code>openssl ts -reply -in design1.tsr -text</code></pre>
<p>To create a timestamp token instead of timestamp response:</p>
<pre><code>openssl ts -reply -queryfile design1.tsq -out design1_token.der -token_out</code></pre>
<p>To print a timestamp token to stdout in human readable format:</p>
<pre><code>openssl ts -reply -in design1_token.der -token_in -text -token_out</code></pre>
<p>To extract the timestamp token from a response:</p>
<pre><code>openssl ts -reply -in design1.tsr -out design1_token.der -token_out</code></pre>
<p>To add 'granted' status info to a timestamp token thereby creating a valid response:</p>
<pre><code>openssl ts -reply -in design1_token.der -token_in -out design1.tsr</code></pre>
<h2 id="Time-Stamp-Verification">Time Stamp Verification</h2>
<p>To verify a timestamp reply against a request:</p>
<pre><code>openssl ts -verify -queryfile design1.tsq -in design1.tsr \
-CAfile cacert.pem -untrusted tsacert.pem</code></pre>
<p>To verify a timestamp reply that includes the certificate chain:</p>
<pre><code>openssl ts -verify -queryfile design2.tsq -in design2.tsr \
-CAfile cacert.pem</code></pre>
<p>To verify a timestamp token against the original data file: openssl ts -verify -data design2.txt -in design2.tsr \ -CAfile cacert.pem</p>
<p>To verify a timestamp token against a message imprint: openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \ -in design2.tsr -CAfile cacert.pem</p>
<p>You could also look at the 'test' directory for more examples.</p>
<h1 id="BUGS">BUGS</h1>
<ul>
<li><p>No support for timestamps over SMTP, though it is quite easy to implement an automatic e-mail based TSA with <a href="../man1/procmail.html">procmail(1)</a> and <a href="../man1/perl.html">perl(1)</a>. HTTP server support is provided in the form of a separate apache module. HTTP client support is provided by <a href="../man1/tsget.html">tsget(1)</a>. Pure TCP/IP protocol is not supported.</p>
</li>
<li><p>The file containing the last serial number of the TSA is not locked when being read or written. This is a problem if more than one instance of <a href="../man1/openssl.html">openssl(1)</a> is trying to create a timestamp response at the same time. This is not an issue when using the apache server module, it does proper locking.</p>
</li>
<li><p>Look for the FIXME word in the source files.</p>
</li>
<li><p>The source code should really be reviewed by somebody else, too.</p>
</li>
<li><p>More testing is needed, I have done only some basic tests (see test/testtsa).</p>
</li>
</ul>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/tsget.html">tsget(1)</a>, <a href="../man1/openssl.html">openssl(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/x509.html">x509(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man5/config.html">config(5)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]���� � openssl/html/man1/rsa.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>rsa</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-rsa, rsa - RSA key processing tool</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>rsa</b> [<b>-help</b>] [<b>-inform PEM|DER</b>] [<b>-outform PEM|DER</b>] [<b>-in filename</b>] [<b>-passin arg</b>] [<b>-out filename</b>] [<b>-passout arg</b>] [<b>-aes128</b>] [<b>-aes192</b>] [<b>-aes256</b>] [<b>-aria128</b>] [<b>-aria192</b>] [<b>-aria256</b>] [<b>-camellia128</b>] [<b>-camellia192</b>] [<b>-camellia256</b>] [<b>-des</b>] [<b>-des3</b>] [<b>-idea</b>] [<b>-text</b>] [<b>-noout</b>] [<b>-modulus</b>] [<b>-check</b>] [<b>-pubin</b>] [<b>-pubout</b>] [<b>-RSAPublicKey_in</b>] [<b>-RSAPublicKey_out</b>] [<b>-engine id</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>rsa</b> command processes RSA keys. They can be converted between various forms and their components printed out. <b>Note</b> this command uses the traditional SSLeay compatible format for private key encryption: newer applications should use the more secure PKCS#8 format using the <b>pkcs8</b> utility.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="inform-DER-PEM"><b>-inform DER|PEM</b></dt>
<dd>
<p>This specifies the input format. The <b>DER</b> option uses an ASN1 DER encoded form compatible with the PKCS#1 RSAPrivateKey or SubjectPublicKeyInfo format. The <b>PEM</b> form is the default format: it consists of the <b>DER</b> format base64 encoded with additional header and footer lines. On input PKCS#8 format private keys are also accepted.</p>
</dd>
<dt id="outform-DER-PEM"><b>-outform DER|PEM</b></dt>
<dd>
<p>This specifies the output format, the options have the same meaning and default as the <b>-inform</b> option.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read a key from or standard input if this option is not specified. If the key is encrypted a pass phrase will be prompted for.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The input file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>This specifies the output filename to write a key to or standard output if this option is not specified. If any encryption options are set then a pass phrase will be prompted for. The output filename should <b>not</b> be the same as the input filename.</p>
</dd>
<dt id="passout-password"><b>-passout password</b></dt>
<dd>
<p>The output file password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="aes128--aes192--aes256--aria128--aria192--aria256--camellia128--camellia192--camellia256--des--des3--idea"><b>-aes128</b>, <b>-aes192</b>, <b>-aes256</b>, <b>-aria128</b>, <b>-aria192</b>, <b>-aria256</b>, <b>-camellia128</b>, <b>-camellia192</b>, <b>-camellia256</b>, <b>-des</b>, <b>-des3</b>, <b>-idea</b></dt>
<dd>
<p>These options encrypt the private key with the specified cipher before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This means that using the <b>rsa</b> utility to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key, or by setting the encryption options it can be use to add or change the pass phrase. These options can only be used with PEM format output files.</p>
</dd>
<dt id="text"><b>-text</b></dt>
<dd>
<p>Prints out the various public or private key components in plain text in addition to the encoded version.</p>
</dd>
<dt id="noout"><b>-noout</b></dt>
<dd>
<p>This option prevents output of the encoded version of the key.</p>
</dd>
<dt id="modulus"><b>-modulus</b></dt>
<dd>
<p>This option prints out the value of the modulus of the key.</p>
</dd>
<dt id="check"><b>-check</b></dt>
<dd>
<p>This option checks the consistency of an RSA private key.</p>
</dd>
<dt id="pubin"><b>-pubin</b></dt>
<dd>
<p>By default a private key is read from the input file: with this option a public key is read instead.</p>
</dd>
<dt id="pubout"><b>-pubout</b></dt>
<dd>
<p>By default a private key is output: with this option a public key will be output instead. This option is automatically set if the input is a public key.</p>
</dd>
<dt id="RSAPublicKey_in--RSAPublicKey_out"><b>-RSAPublicKey_in</b>, <b>-RSAPublicKey_out</b></dt>
<dd>
<p>Like <b>-pubin</b> and <b>-pubout</b> except <b>RSAPublicKey</b> format is used instead.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>rsa</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The PEM private key format uses the header and footer lines:</p>
<pre><code>-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----</code></pre>
<p>The PEM public key format uses the header and footer lines:</p>
<pre><code>-----BEGIN PUBLIC KEY-----
-----END PUBLIC KEY-----</code></pre>
<p>The PEM <b>RSAPublicKey</b> format uses the header and footer lines:</p>
<pre><code>-----BEGIN RSA PUBLIC KEY-----
-----END RSA PUBLIC KEY-----</code></pre>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>To remove the pass phrase on an RSA private key:</p>
<pre><code>openssl rsa -in key.pem -out keyout.pem</code></pre>
<p>To encrypt a private key using triple DES:</p>
<pre><code>openssl rsa -in key.pem -des3 -out keyout.pem</code></pre>
<p>To convert a private key from PEM to DER format:</p>
<pre><code>openssl rsa -in key.pem -outform DER -out keyout.der</code></pre>
<p>To print out the components of a private key to standard output:</p>
<pre><code>openssl rsa -in key.pem -text -noout</code></pre>
<p>To just output the public part of a private key:</p>
<pre><code>openssl rsa -in key.pem -pubout -out pubkey.pem</code></pre>
<p>Output the public part of a private key in <b>RSAPublicKey</b> format:</p>
<pre><code>openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem</code></pre>
<h1 id="BUGS">BUGS</h1>
<p>There should be an option that automatically handles .key files, without having to manually edit them.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/pkcs8.html">pkcs8(1)</a>, <a href="../man1/dsa.html">dsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man1/gendsa.html">gendsa(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]�Ӻ7 7 openssl/html/man1/pkeyutl.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>pkeyutl</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#SYNOPSIS">SYNOPSIS</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPTIONS">OPTIONS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#RSA-ALGORITHM">RSA ALGORITHM</a></li>
<li><a href="#RSA-PSS-ALGORITHM">RSA-PSS ALGORITHM</a></li>
<li><a href="#DSA-ALGORITHM">DSA ALGORITHM</a></li>
<li><a href="#DH-ALGORITHM">DH ALGORITHM</a></li>
<li><a href="#EC-ALGORITHM">EC ALGORITHM</a></li>
<li><a href="#X25519-and-X448-ALGORITHMS">X25519 and X448 ALGORITHMS</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>openssl-pkeyutl, pkeyutl - public key algorithm utility</p>
<h1 id="SYNOPSIS">SYNOPSIS</h1>
<p><b>openssl</b> <b>pkeyutl</b> [<b>-help</b>] [<b>-in file</b>] [<b>-out file</b>] [<b>-sigfile file</b>] [<b>-inkey file</b>] [<b>-keyform PEM|DER|ENGINE</b>] [<b>-passin arg</b>] [<b>-peerkey file</b>] [<b>-peerform PEM|DER|ENGINE</b>] [<b>-pubin</b>] [<b>-certin</b>] [<b>-rev</b>] [<b>-sign</b>] [<b>-verify</b>] [<b>-verifyrecover</b>] [<b>-encrypt</b>] [<b>-decrypt</b>] [<b>-derive</b>] [<b>-kdf algorithm</b>] [<b>-kdflen length</b>] [<b>-pkeyopt opt:value</b>] [<b>-hexdump</b>] [<b>-asn1parse</b>] [<b>-rand file...</b>] [<b>-writerand file</b>] [<b>-engine id</b>] [<b>-engine_impl</b>]</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The <b>pkeyutl</b> command can be used to perform low-level public key operations using any supported algorithm.</p>
<h1 id="OPTIONS">OPTIONS</h1>
<dl>
<dt id="help"><b>-help</b></dt>
<dd>
<p>Print out a usage message.</p>
</dd>
<dt id="in-filename"><b>-in filename</b></dt>
<dd>
<p>This specifies the input filename to read data from or standard input if this option is not specified.</p>
</dd>
<dt id="out-filename"><b>-out filename</b></dt>
<dd>
<p>Specifies the output filename to write to or standard output by default.</p>
</dd>
<dt id="sigfile-file"><b>-sigfile file</b></dt>
<dd>
<p>Signature file, required for <b>verify</b> operations only</p>
</dd>
<dt id="inkey-file"><b>-inkey file</b></dt>
<dd>
<p>The input key file, by default it should be a private key.</p>
</dd>
<dt id="keyform-PEM-DER-ENGINE"><b>-keyform PEM|DER|ENGINE</b></dt>
<dd>
<p>The key format PEM, DER or ENGINE. Default is PEM.</p>
</dd>
<dt id="passin-arg"><b>-passin arg</b></dt>
<dd>
<p>The input key password source. For more information about the format of <b>arg</b> see <a href="../man1/openssl.html">"Pass Phrase Options" in openssl(1)</a>.</p>
</dd>
<dt id="peerkey-file"><b>-peerkey file</b></dt>
<dd>
<p>The peer key file, used by key derivation (agreement) operations.</p>
</dd>
<dt id="peerform-PEM-DER-ENGINE"><b>-peerform PEM|DER|ENGINE</b></dt>
<dd>
<p>The peer key format PEM, DER or ENGINE. Default is PEM.</p>
</dd>
<dt id="pubin"><b>-pubin</b></dt>
<dd>
<p>The input file is a public key.</p>
</dd>
<dt id="certin"><b>-certin</b></dt>
<dd>
<p>The input is a certificate containing a public key.</p>
</dd>
<dt id="rev"><b>-rev</b></dt>
<dd>
<p>Reverse the order of the input buffer. This is useful for some libraries (such as CryptoAPI) which represent the buffer in little endian format.</p>
</dd>
<dt id="sign"><b>-sign</b></dt>
<dd>
<p>Sign the input data (which must be a hash) and output the signed result. This requires a private key.</p>
</dd>
<dt id="verify"><b>-verify</b></dt>
<dd>
<p>Verify the input data (which must be a hash) against the signature file and indicate if the verification succeeded or failed.</p>
</dd>
<dt id="verifyrecover"><b>-verifyrecover</b></dt>
<dd>
<p>Verify the input data (which must be a hash) and output the recovered data.</p>
</dd>
<dt id="encrypt"><b>-encrypt</b></dt>
<dd>
<p>Encrypt the input data using a public key.</p>
</dd>
<dt id="decrypt"><b>-decrypt</b></dt>
<dd>
<p>Decrypt the input data using a private key.</p>
</dd>
<dt id="derive"><b>-derive</b></dt>
<dd>
<p>Derive a shared secret using the peer key.</p>
</dd>
<dt id="kdf-algorithm"><b>-kdf algorithm</b></dt>
<dd>
<p>Use key derivation function <b>algorithm</b>. The supported algorithms are at present <b>TLS1-PRF</b> and <b>HKDF</b>. Note: additional parameters and the KDF output length will normally have to be set for this to work. See <a href="../man3/EVP_PKEY_CTX_set_hkdf_md.html">EVP_PKEY_CTX_set_hkdf_md(3)</a> and <a href="../man3/EVP_PKEY_CTX_set_tls1_prf_md.html">EVP_PKEY_CTX_set_tls1_prf_md(3)</a> for the supported string parameters of each algorithm.</p>
</dd>
<dt id="kdflen-length"><b>-kdflen length</b></dt>
<dd>
<p>Set the output length for KDF.</p>
</dd>
<dt id="pkeyopt-opt:value"><b>-pkeyopt opt:value</b></dt>
<dd>
<p>Public key options specified as opt:value. See NOTES below for more details.</p>
</dd>
<dt id="hexdump"><b>-hexdump</b></dt>
<dd>
<p>hex dump the output data.</p>
</dd>
<dt id="asn1parse"><b>-asn1parse</b></dt>
<dd>
<p>Parse the ASN.1 output data, this is useful when combined with the <b>-verifyrecover</b> option when an ASN1 structure is signed.</p>
</dd>
<dt id="rand-file"><b>-rand file...</b></dt>
<dd>
<p>A file or files containing random data used to seed the random number generator. Multiple files can be specified separated by an OS-dependent character. The separator is <b>;</b> for MS-Windows, <b>,</b> for OpenVMS, and <b>:</b> for all others.</p>
</dd>
<dt id="writerand-file">[<b>-writerand file</b>]</dt>
<dd>
<p>Writes random data to the specified <i>file</i> upon exit. This can be used with a subsequent <b>-rand</b> flag.</p>
</dd>
<dt id="engine-id"><b>-engine id</b></dt>
<dd>
<p>Specifying an engine (by its unique <b>id</b> string) will cause <b>pkeyutl</b> to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms.</p>
</dd>
<dt id="engine_impl"><b>-engine_impl</b></dt>
<dd>
<p>When used with the <b>-engine</b> option, it specifies to also use engine <b>id</b> for crypto operations.</p>
</dd>
</dl>
<h1 id="NOTES">NOTES</h1>
<p>The operations and options supported vary according to the key algorithm and its implementation. The OpenSSL operations and options are indicated below.</p>
<p>Unless otherwise mentioned all algorithms support the <b>digest:alg</b> option which specifies the digest in use for sign, verify and verifyrecover operations. The value <b>alg</b> should represent a digest name as used in the EVP_get_digestbyname() function for example <b>sha1</b>. This value is not used to hash the input data. It is used (by some algorithms) for sanity-checking the lengths of data passed in to the <b>pkeyutl</b> and for creating the structures that make up the signature (e.g. <b>DigestInfo</b> in RSASSA PKCS#1 v1.5 signatures).</p>
<p>This utility does not hash the input data but rather it will use the data directly as input to the signature algorithm. Depending on the key type, signature type, and mode of padding, the maximum acceptable lengths of input data differ. The signed data can't be longer than the key modulus with RSA. In case of ECDSA and DSA the data shouldn't be longer than the field size, otherwise it will be silently truncated to the field size. In any event the input size must not be larger than the largest supported digest size.</p>
<p>In other words, if the value of digest is <b>sha1</b> the input should be the 20 bytes long binary encoding of the SHA-1 hash function output.</p>
<p>The Ed25519 and Ed448 signature algorithms are not supported by this utility. They accept non-hashed input, but this utility can only be used to sign hashed input.</p>
<h1 id="RSA-ALGORITHM">RSA ALGORITHM</h1>
<p>The RSA algorithm generally supports the encrypt, decrypt, sign, verify and verifyrecover operations. However, some padding modes support only a subset of these operations. The following additional <b>pkeyopt</b> values are supported:</p>
<dl>
<dt id="rsa_padding_mode:mode"><b>rsa_padding_mode:mode</b></dt>
<dd>
<p>This sets the RSA padding mode. Acceptable values for <b>mode</b> are <b>pkcs1</b> for PKCS#1 padding, <b>sslv23</b> for SSLv23 padding, <b>none</b> for no padding, <b>oaep</b> for <b>OAEP</b> mode, <b>x931</b> for X9.31 mode and <b>pss</b> for PSS.</p>
<p>In PKCS#1 padding if the message digest is not set then the supplied data is signed or verified directly instead of using a <b>DigestInfo</b> structure. If a digest is set then the a <b>DigestInfo</b> structure is used and its the length must correspond to the digest type.</p>
<p>For <b>oaep</b> mode only encryption and decryption is supported.</p>
<p>For <b>x931</b> if the digest type is set it is used to format the block data otherwise the first byte is used to specify the X9.31 digest ID. Sign, verify and verifyrecover are can be performed in this mode.</p>
<p>For <b>pss</b> mode only sign and verify are supported and the digest type must be specified.</p>
</dd>
<dt id="rsa_pss_saltlen:len"><b>rsa_pss_saltlen:len</b></dt>
<dd>
<p>For <b>pss</b> mode only this option specifies the salt length. Three special values are supported: "digest" sets the salt length to the digest length, "max" sets the salt length to the maximum permissible value. When verifying "auto" causes the salt length to be automatically determined based on the <b>PSS</b> block structure.</p>
</dd>
<dt id="rsa_mgf1_md:digest"><b>rsa_mgf1_md:digest</b></dt>
<dd>
<p>For PSS and OAEP padding sets the MGF1 digest. If the MGF1 digest is not explicitly set in PSS mode then the signing digest is used.</p>
</dd>
<dt id="rsa_oaep_md:digest"><b>rsa_oaep_md:</b><i>digest</i></dt>
<dd>
<p>Sets the digest used for the OAEP hash function. If not explicitly set then SHA1 is used.</p>
</dd>
</dl>
<h1 id="RSA-PSS-ALGORITHM">RSA-PSS ALGORITHM</h1>
<p>The RSA-PSS algorithm is a restricted version of the RSA algorithm which only supports the sign and verify operations with PSS padding. The following additional <b>pkeyopt</b> values are supported:</p>
<dl>
<dt id="rsa_padding_mode:mode-rsa_pss_saltlen:len-rsa_mgf1_md:digest"><b>rsa_padding_mode:mode</b>, <b>rsa_pss_saltlen:len</b>, <b>rsa_mgf1_md:digest</b></dt>
<dd>
<p>These have the same meaning as the <b>RSA</b> algorithm with some additional restrictions. The padding mode can only be set to <b>pss</b> which is the default value.</p>
<p>If the key has parameter restrictions than the digest, MGF1 digest and salt length are set to the values specified in the parameters. The digest and MG cannot be changed and the salt length cannot be set to a value less than the minimum restriction.</p>
</dd>
</dl>
<h1 id="DSA-ALGORITHM">DSA ALGORITHM</h1>
<p>The DSA algorithm supports signing and verification operations only. Currently there are no additional <b>-pkeyopt</b> options other than <b>digest</b>. The SHA1 digest is assumed by default.</p>
<h1 id="DH-ALGORITHM">DH ALGORITHM</h1>
<p>The DH algorithm only supports the derivation operation and no additional <b>-pkeyopt</b> options.</p>
<h1 id="EC-ALGORITHM">EC ALGORITHM</h1>
<p>The EC algorithm supports sign, verify and derive operations. The sign and verify operations use ECDSA and derive uses ECDH. SHA1 is assumed by default for the <b>-pkeyopt</b> <b>digest</b> option.</p>
<h1 id="X25519-and-X448-ALGORITHMS">X25519 and X448 ALGORITHMS</h1>
<p>The X25519 and X448 algorithms support key derivation only. Currently there are no additional options.</p>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Sign some data using a private key:</p>
<pre><code>openssl pkeyutl -sign -in file -inkey key.pem -out sig</code></pre>
<p>Recover the signed data (e.g. if an RSA key is used):</p>
<pre><code>openssl pkeyutl -verifyrecover -in sig -inkey key.pem</code></pre>
<p>Verify the signature (e.g. a DSA key):</p>
<pre><code>openssl pkeyutl -verify -in file -sigfile sig -inkey key.pem</code></pre>
<p>Sign data using a message digest value (this is currently only valid for RSA):</p>
<pre><code>openssl pkeyutl -sign -in file -inkey key.pem -out sig -pkeyopt digest:sha256</code></pre>
<p>Derive a shared secret value:</p>
<pre><code>openssl pkeyutl -derive -inkey key.pem -peerkey pubkey.pem -out secret</code></pre>
<p>Hexdump 48 bytes of TLS1 PRF using digest <b>SHA256</b> and shared secret and seed consisting of the single byte 0xFF:</p>
<pre><code>openssl pkeyutl -kdf TLS1-PRF -kdflen 48 -pkeyopt md:SHA256 \
-pkeyopt hexsecret:ff -pkeyopt hexseed:ff -hexdump</code></pre>
<p>Decrypt some data using a private key with OAEP padding using SHA256:</p>
<pre><code>openssl pkeyutl -decrypt -in file -inkey key.pem -out secret \
-pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/genpkey.html">genpkey(1)</a>, <a href="../man1/pkey.html">pkey(1)</a>, <a href="../man1/rsautl.html">rsautl(1)</a> <a href="../man1/dgst.html">dgst(1)</a>, <a href="../man1/rsa.html">rsa(1)</a>, <a href="../man1/genrsa.html">genrsa(1)</a>, <a href="../man3/EVP_PKEY_CTX_set_hkdf_md.html">EVP_PKEY_CTX_set_hkdf_md(3)</a>, <a href="../man3/EVP_PKEY_CTX_set_tls1_prf_md.html">EVP_PKEY_CTX_set_tls1_prf_md(3)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]376�aU aU $ openssl/html/man5/x509v3_config.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>x509v3_config</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#STANDARD-EXTENSIONS">STANDARD EXTENSIONS</a>
<ul>
<li><a href="#Basic-Constraints">Basic Constraints.</a></li>
<li><a href="#Key-Usage">Key Usage.</a></li>
<li><a href="#Extended-Key-Usage">Extended Key Usage.</a></li>
<li><a href="#Subject-Key-Identifier">Subject Key Identifier.</a></li>
<li><a href="#Authority-Key-Identifier">Authority Key Identifier.</a></li>
<li><a href="#Subject-Alternative-Name">Subject Alternative Name.</a></li>
<li><a href="#Issuer-Alternative-Name">Issuer Alternative Name.</a></li>
<li><a href="#Authority-Info-Access">Authority Info Access.</a></li>
<li><a href="#CRL-distribution-points">CRL distribution points</a></li>
<li><a href="#Issuing-Distribution-Point">Issuing Distribution Point</a></li>
<li><a href="#Certificate-Policies">Certificate Policies.</a></li>
<li><a href="#Policy-Constraints">Policy Constraints</a></li>
<li><a href="#Inhibit-Any-Policy">Inhibit Any Policy</a></li>
<li><a href="#Name-Constraints">Name Constraints</a></li>
<li><a href="#OCSP-No-Check">OCSP No Check</a></li>
<li><a href="#TLS-Feature-aka-Must-Staple">TLS Feature (aka Must Staple)</a></li>
</ul>
</li>
<li><a href="#DEPRECATED-EXTENSIONS">DEPRECATED EXTENSIONS</a>
<ul>
<li><a href="#Netscape-String-extensions">Netscape String extensions.</a></li>
<li><a href="#Netscape-Certificate-Type">Netscape Certificate Type</a></li>
</ul>
</li>
<li><a href="#ARBITRARY-EXTENSIONS">ARBITRARY EXTENSIONS</a></li>
<li><a href="#WARNINGS">WARNINGS</a></li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>x509v3_config - X509 V3 certificate extension configuration format</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>Several of the OpenSSL utilities can add extensions to a certificate or certificate request based on the contents of a configuration file.</p>
<p>Typically the application will contain an option to point to an extension section. Each line of the extension section takes the form:</p>
<pre><code>extension_name=[critical,] extension_options</code></pre>
<p>If <b>critical</b> is present then the extension will be critical.</p>
<p>The format of <b>extension_options</b> depends on the value of <b>extension_name</b>.</p>
<p>There are four main types of extension: <i>string</i> extensions, <i>multi-valued</i> extensions, <i>raw</i> and <i>arbitrary</i> extensions.</p>
<p>String extensions simply have a string which contains either the value itself or how it is obtained.</p>
<p>For example:</p>
<pre><code>nsComment="This is a Comment"</code></pre>
<p>Multi-valued extensions have a short form and a long form. The short form is a list of names and values:</p>
<pre><code>basicConstraints=critical,CA:true,pathlen:1</code></pre>
<p>The long form allows the values to be placed in a separate section:</p>
<pre><code>basicConstraints=critical,@bs_section
[bs_section]
CA=true
pathlen=1</code></pre>
<p>Both forms are equivalent.</p>
<p>The syntax of raw extensions is governed by the extension code: it can for example contain data in multiple sections. The correct syntax to use is defined by the extension code itself: check out the certificate policies extension for an example.</p>
<p>If an extension type is unsupported then the <i>arbitrary</i> extension syntax must be used, see the <a href="#ARBITRARY-EXTENSIONS">ARBITRARY EXTENSIONS</a> section for more details.</p>
<h1 id="STANDARD-EXTENSIONS">STANDARD EXTENSIONS</h1>
<p>The following sections describe each supported extension in detail.</p>
<h2 id="Basic-Constraints">Basic Constraints.</h2>
<p>This is a multi valued extension which indicates whether a certificate is a CA certificate. The first (mandatory) name is <b>CA</b> followed by <b>TRUE</b> or <b>FALSE</b>. If <b>CA</b> is <b>TRUE</b> then an optional <b>pathlen</b> name followed by a nonnegative value can be included.</p>
<p>For example:</p>
<pre><code>basicConstraints=CA:TRUE
basicConstraints=CA:FALSE
basicConstraints=critical,CA:TRUE, pathlen:0</code></pre>
<p>A CA certificate <b>must</b> include the basicConstraints value with the CA field set to TRUE. An end user certificate must either set CA to FALSE or exclude the extension entirely. Some software may require the inclusion of basicConstraints with CA set to FALSE for end entity certificates.</p>
<p>The pathlen parameter indicates the maximum number of CAs that can appear below this one in a chain. So if you have a CA with a pathlen of zero it can only be used to sign end user certificates and not further CAs.</p>
<h2 id="Key-Usage">Key Usage.</h2>
<p>Key usage is a multi valued extension consisting of a list of names of the permitted key usages.</p>
<p>The supported names are: digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly.</p>
<p>Examples:</p>
<pre><code>keyUsage=digitalSignature, nonRepudiation
keyUsage=critical, keyCertSign</code></pre>
<h2 id="Extended-Key-Usage">Extended Key Usage.</h2>
<p>This extensions consists of a list of usages indicating purposes for which the certificate public key can be used for,</p>
<p>These can either be object short names or the dotted numerical form of OIDs. While any OID can be used only certain values make sense. In particular the following PKIX, NS and MS values are meaningful:</p>
<pre><code>Value Meaning
----- -------
serverAuth SSL/TLS Web Server Authentication.
clientAuth SSL/TLS Web Client Authentication.
codeSigning Code signing.
emailProtection E-mail Protection (S/MIME).
timeStamping Trusted Timestamping
OCSPSigning OCSP Signing
ipsecIKE ipsec Internet Key Exchange
msCodeInd Microsoft Individual Code Signing (authenticode)
msCodeCom Microsoft Commercial Code Signing (authenticode)
msCTLSign Microsoft Trust List Signing
msEFS Microsoft Encrypted File System</code></pre>
<p>Examples:</p>
<pre><code>extendedKeyUsage=critical,codeSigning,1.2.3.4
extendedKeyUsage=serverAuth,clientAuth</code></pre>
<h2 id="Subject-Key-Identifier">Subject Key Identifier.</h2>
<p>This is really a string extension and can take two possible values. Either the word <b>hash</b> which will automatically follow the guidelines in RFC3280 or a hex string giving the extension value to include. The use of the hex string is strongly discouraged.</p>
<p>Example:</p>
<pre><code>subjectKeyIdentifier=hash</code></pre>
<h2 id="Authority-Key-Identifier">Authority Key Identifier.</h2>
<p>The authority key identifier extension permits two options. keyid and issuer: both can take the optional value "always".</p>
<p>If the keyid option is present an attempt is made to copy the subject key identifier from the parent certificate. If the value "always" is present then an error is returned if the option fails.</p>
<p>The issuer option copies the issuer and serial number from the issuer certificate. This will only be done if the keyid option fails or is not included unless the "always" flag will always include the value.</p>
<p>Example:</p>
<pre><code>authorityKeyIdentifier=keyid,issuer</code></pre>
<h2 id="Subject-Alternative-Name">Subject Alternative Name.</h2>
<p>The subject alternative name extension allows various literal values to be included in the configuration file. These include <b>email</b> (an email address) <b>URI</b> a uniform resource indicator, <b>DNS</b> (a DNS domain name), <b>RID</b> (a registered ID: OBJECT IDENTIFIER), <b>IP</b> (an IP address), <b>dirName</b> (a distinguished name) and otherName.</p>
<p>The email option include a special 'copy' value. This will automatically include any email addresses contained in the certificate subject name in the extension.</p>
<p>The IP address used in the <b>IP</b> options can be in either IPv4 or IPv6 format.</p>
<p>The value of <b>dirName</b> should point to a section containing the distinguished name to use as a set of name value pairs. Multi values AVAs can be formed by prefacing the name with a <b>+</b> character.</p>
<p>otherName can include arbitrary data associated with an OID: the value should be the OID followed by a semicolon and the content in standard <a href="../man3/ASN1_generate_nconf.html">ASN1_generate_nconf(3)</a> format.</p>
<p>Examples:</p>
<pre><code>subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/
subjectAltName=IP:192.168.7.1
subjectAltName=IP:13::17
subjectAltName=email:my@other.address,RID:1.2.3.4
subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
subjectAltName=dirName:dir_sect
[dir_sect]
C=UK
O=My Organization
OU=My Unit
CN=My Name</code></pre>
<h2 id="Issuer-Alternative-Name">Issuer Alternative Name.</h2>
<p>The issuer alternative name option supports all the literal options of subject alternative name. It does <b>not</b> support the email:copy option because that would not make sense. It does support an additional issuer:copy option that will copy all the subject alternative name values from the issuer certificate (if possible).</p>
<p>Example:</p>
<pre><code>issuerAltName = issuer:copy</code></pre>
<h2 id="Authority-Info-Access">Authority Info Access.</h2>
<p>The authority information access extension gives details about how to access certain information relating to the CA. Its syntax is accessOID;location where <i>location</i> has the same syntax as subject alternative name (except that email:copy is not supported). accessOID can be any valid OID but only certain values are meaningful, for example OCSP and caIssuers.</p>
<p>Example:</p>
<pre><code>authorityInfoAccess = OCSP;URI:http://ocsp.my.host/
authorityInfoAccess = caIssuers;URI:http://my.ca/ca.html</code></pre>
<h2 id="CRL-distribution-points">CRL distribution points</h2>
<p>This is a multi-valued extension whose options can be either in name:value pair using the same form as subject alternative name or a single value representing a section name containing all the distribution point fields.</p>
<p>For a name:value pair a new DistributionPoint with the fullName field set to the given value both the cRLissuer and reasons fields are omitted in this case.</p>
<p>In the single option case the section indicated contains values for each field. In this section:</p>
<p>If the name is "fullname" the value field should contain the full name of the distribution point in the same format as subject alternative name.</p>
<p>If the name is "relativename" then the value field should contain a section name whose contents represent a DN fragment to be placed in this field.</p>
<p>The name "CRLIssuer" if present should contain a value for this field in subject alternative name format.</p>
<p>If the name is "reasons" the value field should consist of a comma separated field containing the reasons. Valid reasons are: "keyCompromise", "CACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", "privilegeWithdrawn" and "AACompromise".</p>
<p>Simple examples:</p>
<pre><code>crlDistributionPoints=URI:http://myhost.com/myca.crl
crlDistributionPoints=URI:http://my.com/my.crl,URI:http://oth.com/my.crl</code></pre>
<p>Full distribution point example:</p>
<pre><code>crlDistributionPoints=crldp1_section
[crldp1_section]
fullname=URI:http://myhost.com/myca.crl
CRLissuer=dirName:issuer_sect
reasons=keyCompromise, CACompromise
[issuer_sect]
C=UK
O=Organisation
CN=Some Name</code></pre>
<h2 id="Issuing-Distribution-Point">Issuing Distribution Point</h2>
<p>This extension should only appear in CRLs. It is a multi valued extension whose syntax is similar to the "section" pointed to by the CRL distribution points extension with a few differences.</p>
<p>The names "reasons" and "CRLissuer" are not recognized.</p>
<p>The name "onlysomereasons" is accepted which sets this field. The value is in the same format as the CRL distribution point "reasons" field.</p>
<p>The names "onlyuser", "onlyCA", "onlyAA" and "indirectCRL" are also accepted the values should be a boolean value (TRUE or FALSE) to indicate the value of the corresponding field.</p>
<p>Example:</p>
<pre><code>issuingDistributionPoint=critical, @idp_section
[idp_section]
fullname=URI:http://myhost.com/myca.crl
indirectCRL=TRUE
onlysomereasons=keyCompromise, CACompromise
[issuer_sect]
C=UK
O=Organisation
CN=Some Name</code></pre>
<h2 id="Certificate-Policies">Certificate Policies.</h2>
<p>This is a <i>raw</i> extension. All the fields of this extension can be set by using the appropriate syntax.</p>
<p>If you follow the PKIX recommendations and just using one OID then you just include the value of that OID. Multiple OIDs can be set separated by commas, for example:</p>
<pre><code>certificatePolicies= 1.2.4.5, 1.1.3.4</code></pre>
<p>If you wish to include qualifiers then the policy OID and qualifiers need to be specified in a separate section: this is done by using the @section syntax instead of a literal OID value.</p>
<p>The section referred to must include the policy OID using the name policyIdentifier, cPSuri qualifiers can be included using the syntax:</p>
<pre><code>CPS.nnn=value</code></pre>
<p>userNotice qualifiers can be set using the syntax:</p>
<pre><code>userNotice.nnn=@notice</code></pre>
<p>The value of the userNotice qualifier is specified in the relevant section. This section can include explicitText, organization and noticeNumbers options. explicitText and organization are text strings, noticeNumbers is a comma separated list of numbers. The organization and noticeNumbers options (if included) must BOTH be present. If you use the userNotice option with IE5 then you need the 'ia5org' option at the top level to modify the encoding: otherwise it will not be interpreted properly.</p>
<p>Example:</p>
<pre><code>certificatePolicies=ia5org,1.2.3.4,1.5.6.7.8,@polsect
[polsect]
policyIdentifier = 1.3.5.8
CPS.1="http://my.host.name/"
CPS.2="http://my.your.name/"
userNotice.1=@notice
[notice]
explicitText="Explicit Text Here"
organization="Organisation Name"
noticeNumbers=1,2,3,4</code></pre>
<p>The <b>ia5org</b> option changes the type of the <i>organization</i> field. In RFC2459 it can only be of type DisplayText. In RFC3280 IA5String is also permissible. Some software (for example some versions of MSIE) may require ia5org.</p>
<p>ASN1 type of explicitText can be specified by prepending <b>UTF8</b>, <b>BMP</b> or <b>VISIBLE</b> prefix followed by colon. For example:</p>
<pre><code>[notice]
explicitText="UTF8:Explicit Text Here"</code></pre>
<h2 id="Policy-Constraints">Policy Constraints</h2>
<p>This is a multi-valued extension which consisting of the names <b>requireExplicitPolicy</b> or <b>inhibitPolicyMapping</b> and a non negative integer value. At least one component must be present.</p>
<p>Example:</p>
<pre><code>policyConstraints = requireExplicitPolicy:3</code></pre>
<h2 id="Inhibit-Any-Policy">Inhibit Any Policy</h2>
<p>This is a string extension whose value must be a non negative integer.</p>
<p>Example:</p>
<pre><code>inhibitAnyPolicy = 2</code></pre>
<h2 id="Name-Constraints">Name Constraints</h2>
<p>The name constraints extension is a multi-valued extension. The name should begin with the word <b>permitted</b> or <b>excluded</b> followed by a <b>;</b>. The rest of the name and the value follows the syntax of subjectAltName except email:copy is not supported and the <b>IP</b> form should consist of an IP addresses and subnet mask separated by a <b>/</b>.</p>
<p>Examples:</p>
<pre><code>nameConstraints=permitted;IP:192.168.0.0/255.255.0.0
nameConstraints=permitted;email:.somedomain.com
nameConstraints=excluded;email:.com</code></pre>
<h2 id="OCSP-No-Check">OCSP No Check</h2>
<p>The OCSP No Check extension is a string extension but its value is ignored.</p>
<p>Example:</p>
<pre><code>noCheck = ignored</code></pre>
<h2 id="TLS-Feature-aka-Must-Staple">TLS Feature (aka Must Staple)</h2>
<p>This is a multi-valued extension consisting of a list of TLS extension identifiers. Each identifier may be a number (0..65535) or a supported name. When a TLS client sends a listed extension, the TLS server is expected to include that extension in its reply.</p>
<p>The supported names are: <b>status_request</b> and <b>status_request_v2</b>.</p>
<p>Example:</p>
<pre><code>tlsfeature = status_request</code></pre>
<h1 id="DEPRECATED-EXTENSIONS">DEPRECATED EXTENSIONS</h1>
<p>The following extensions are non standard, Netscape specific and largely obsolete. Their use in new applications is discouraged.</p>
<h2 id="Netscape-String-extensions">Netscape String extensions.</h2>
<p>Netscape Comment (<b>nsComment</b>) is a string extension containing a comment which will be displayed when the certificate is viewed in some browsers.</p>
<p>Example:</p>
<pre><code>nsComment = "Some Random Comment"</code></pre>
<p>Other supported extensions in this category are: <b>nsBaseUrl</b>, <b>nsRevocationUrl</b>, <b>nsCaRevocationUrl</b>, <b>nsRenewalUrl</b>, <b>nsCaPolicyUrl</b> and <b>nsSslServerName</b>.</p>
<h2 id="Netscape-Certificate-Type">Netscape Certificate Type</h2>
<p>This is a multi-valued extensions which consists of a list of flags to be included. It was used to indicate the purposes for which a certificate could be used. The basicConstraints, keyUsage and extended key usage extensions are now used instead.</p>
<p>Acceptable values for nsCertType are: <b>client</b>, <b>server</b>, <b>email</b>, <b>objsign</b>, <b>reserved</b>, <b>sslCA</b>, <b>emailCA</b>, <b>objCA</b>.</p>
<h1 id="ARBITRARY-EXTENSIONS">ARBITRARY EXTENSIONS</h1>
<p>If an extension is not supported by the OpenSSL code then it must be encoded using the arbitrary extension format. It is also possible to use the arbitrary format for supported extensions. Extreme care should be taken to ensure that the data is formatted correctly for the given extension type.</p>
<p>There are two ways to encode arbitrary extensions.</p>
<p>The first way is to use the word ASN1 followed by the extension content using the same syntax as <a href="../man3/ASN1_generate_nconf.html">ASN1_generate_nconf(3)</a>. For example:</p>
<pre><code>1.2.3.4=critical,ASN1:UTF8String:Some random data
1.2.3.4=ASN1:SEQUENCE:seq_sect
[seq_sect]
field1 = UTF8:field1
field2 = UTF8:field2</code></pre>
<p>It is also possible to use the word DER to include the raw encoded data in any extension.</p>
<pre><code>1.2.3.4=critical,DER:01:02:03:04
1.2.3.4=DER:01020304</code></pre>
<p>The value following DER is a hex dump of the DER encoding of the extension Any extension can be placed in this form to override the default behaviour. For example:</p>
<pre><code>basicConstraints=critical,DER:00:01:02:03</code></pre>
<h1 id="WARNINGS">WARNINGS</h1>
<p>There is no guarantee that a specific implementation will process a given extension. It may therefore be sometimes possible to use certificates for purposes prohibited by their extensions because a specific application does not recognize or honour the values of the relevant extensions.</p>
<p>The DER and ASN1 options should be used with caution. It is possible to create totally invalid extensions if they are not used carefully.</p>
<h1 id="NOTES">NOTES</h1>
<p>If an extension is multi-value and a field value must contain a comma the long form must be used otherwise the comma would be misinterpreted as a field separator. For example:</p>
<pre><code>subjectAltName=URI:ldap://somehost.com/CN=foo,OU=bar</code></pre>
<p>will produce an error but the equivalent form:</p>
<pre><code>subjectAltName=@subject_alt_section
[subject_alt_section]
subjectAltName=URI:ldap://somehost.com/CN=foo,OU=bar</code></pre>
<p>is valid.</p>
<p>Due to the behaviour of the OpenSSL <b>conf</b> library the same field name can only occur once in a section. This means that:</p>
<pre><code>subjectAltName=@alt_section
[alt_section]
email=steve@here
email=steve@there</code></pre>
<p>will only recognize the last value. This can be worked around by using the form:</p>
<pre><code>[alt_section]
email.1=steve@here
email.2=steve@there</code></pre>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/req.html">req(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/x509.html">x509(1)</a>, <a href="../man3/ASN1_generate_nconf.html">ASN1_generate_nconf(3)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK )]'3)�mH mH openssl/html/man5/config.htmlnu �[��� <?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>config</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>
<body>
<ul id="index">
<li><a href="#NAME">NAME</a></li>
<li><a href="#DESCRIPTION">DESCRIPTION</a></li>
<li><a href="#OPENSSL-LIBRARY-CONFIGURATION">OPENSSL LIBRARY CONFIGURATION</a>
<ul>
<li><a href="#ASN1-Object-Configuration-Module">ASN1 Object Configuration Module</a></li>
<li><a href="#Engine-Configuration-Module">Engine Configuration Module</a></li>
<li><a href="#EVP-Configuration-Module">EVP Configuration Module</a></li>
<li><a href="#SSL-Configuration-Module">SSL Configuration Module</a></li>
</ul>
</li>
<li><a href="#NOTES">NOTES</a></li>
<li><a href="#EXAMPLES">EXAMPLES</a></li>
<li><a href="#ENVIRONMENT">ENVIRONMENT</a></li>
<li><a href="#BUGS">BUGS</a></li>
<li><a href="#SEE-ALSO">SEE ALSO</a></li>
<li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>
<h1 id="NAME">NAME</h1>
<p>config - OpenSSL CONF library configuration files</p>
<h1 id="DESCRIPTION">DESCRIPTION</h1>
<p>The OpenSSL CONF library can be used to read configuration files. It is used for the OpenSSL master configuration file <b>openssl.cnf</b> and in a few other places like <b>SPKAC</b> files and certificate extension files for the <b>x509</b> utility. OpenSSL applications can also use the CONF library for their own purposes.</p>
<p>A configuration file is divided into a number of sections. Each section starts with a line <b>[ section_name ]</b> and ends when a new section is started or end of file is reached. A section name can consist of alphanumeric characters and underscores.</p>
<p>The first section of a configuration file is special and is referred to as the <b>default</b> section. This section is usually unnamed and spans from the start of file until the first named section. When a name is being looked up it is first looked up in a named section (if any) and then the default section.</p>
<p>The environment is mapped onto a section called <b>ENV</b>.</p>
<p>Comments can be included by preceding them with the <b>#</b> character</p>
<p>Other files can be included using the <b>.include</b> directive followed by a path. If the path points to a directory all files with names ending with <b>.cnf</b> or <b>.conf</b> are included from the directory. Recursive inclusion of directories from files in such directory is not supported. That means the files in the included directory can also contain <b>.include</b> directives but only inclusion of regular files is supported there. The inclusion of directories is not supported on systems without POSIX IO support.</p>
<p>It is strongly recommended to use absolute paths with the <b>.include</b> directive. Relative paths are evaluated based on the application current working directory so unless the configuration file containing the <b>.include</b> directive is application specific the inclusion will not work as expected.</p>
<p>There can be optional <b>=</b> character and whitespace characters between <b>.include</b> directive and the path which can be useful in cases the configuration file needs to be loaded by old OpenSSL versions which do not support the <b>.include</b> syntax. They would bail out with error if the <b>=</b> character is not present but with it they just ignore the include.</p>
<p>Each section in a configuration file consists of a number of name and value pairs of the form <b>name=value</b></p>
<p>The <b>name</b> string can contain any alphanumeric characters as well as a few punctuation symbols such as <b>.</b> <b>,</b> <b>;</b> and <b>_</b>.</p>
<p>The <b>value</b> string consists of the string following the <b>=</b> character until end of line with any leading and trailing white space removed.</p>
<p>The value string undergoes variable expansion. This can be done by including the form <b>$var</b> or <b>${var}</b>: this will substitute the value of the named variable in the current section. It is also possible to substitute a value from another section using the syntax <b>$section::name</b> or <b>${section::name}</b>. By using the form <b>$ENV::name</b> environment variables can be substituted. It is also possible to assign values to environment variables by using the name <b>ENV::name</b>, this will work if the program looks up environment variables using the <b>CONF</b> library instead of calling getenv() directly. The value string must not exceed 64k in length after variable expansion. Otherwise an error will occur.</p>
<p>It is possible to escape certain characters by using any kind of quote or the <b>\</b> character. By making the last character of a line a <b>\</b> a <b>value</b> string can be spread across multiple lines. In addition the sequences <b>\n</b>, <b>\r</b>, <b>\b</b> and <b>\t</b> are recognized.</p>
<p>All expansion and escape rules as described above that apply to <b>value</b> also apply to the path of the <b>.include</b> directive.</p>
<h1 id="OPENSSL-LIBRARY-CONFIGURATION">OPENSSL LIBRARY CONFIGURATION</h1>
<p>Applications can automatically configure certain aspects of OpenSSL using the master OpenSSL configuration file, or optionally an alternative configuration file. The <b>openssl</b> utility includes this functionality: any sub command uses the master OpenSSL configuration file unless an option is used in the sub command to use an alternative configuration file.</p>
<p>To enable library configuration the default section needs to contain an appropriate line which points to the main configuration section. The default name is <b>openssl_conf</b> which is used by the <b>openssl</b> utility. Other applications may use an alternative name such as <b>myapplication_conf</b>. All library configuration lines appear in the default section at the start of the configuration file.</p>
<p>The configuration section should consist of a set of name value pairs which contain specific module configuration information. The <b>name</b> represents the name of the <i>configuration module</i>. The meaning of the <b>value</b> is module specific: it may, for example, represent a further configuration section containing configuration module specific information. E.g.:</p>
<pre><code># This must be in the default section
openssl_conf = openssl_init
[openssl_init]
oid_section = new_oids
engines = engine_section
[new_oids]
... new oids here ...
[engine_section]
... engine stuff here ...</code></pre>
<p>The features of each configuration module are described below.</p>
<h2 id="ASN1-Object-Configuration-Module">ASN1 Object Configuration Module</h2>
<p>This module has the name <b>oid_section</b>. The value of this variable points to a section containing name value pairs of OIDs: the name is the OID short and long name, the value is the numerical form of the OID. Although some of the <b>openssl</b> utility sub commands already have their own ASN1 OBJECT section functionality not all do. By using the ASN1 OBJECT configuration module <b>all</b> the <b>openssl</b> utility sub commands can see the new objects as well as any compliant applications. For example:</p>
<pre><code>[new_oids]
some_new_oid = 1.2.3.4
some_other_oid = 1.2.3.5</code></pre>
<p>It is also possible to set the value to the long name followed by a comma and the numerical OID form. For example:</p>
<pre><code>shortName = some object long name, 1.2.3.4</code></pre>
<h2 id="Engine-Configuration-Module">Engine Configuration Module</h2>
<p>This ENGINE configuration module has the name <b>engines</b>. The value of this variable points to a section containing further ENGINE configuration information.</p>
<p>The section pointed to by <b>engines</b> is a table of engine names (though see <b>engine_id</b> below) and further sections containing configuration information specific to each ENGINE.</p>
<p>Each ENGINE specific section is used to set default algorithms, load dynamic, perform initialization and send ctrls. The actual operation performed depends on the <i>command</i> name which is the name of the name value pair. The currently supported commands are listed below.</p>
<p>For example:</p>
<pre><code>[engine_section]
# Configure ENGINE named "foo"
foo = foo_section
# Configure ENGINE named "bar"
bar = bar_section
[foo_section]
... foo ENGINE specific commands ...
[bar_section]
... "bar" ENGINE specific commands ...</code></pre>
<p>The command <b>engine_id</b> is used to give the ENGINE name. If used this command must be first. For example:</p>
<pre><code>[engine_section]
# This would normally handle an ENGINE named "foo"
foo = foo_section
[foo_section]
# Override default name and use "myfoo" instead.
engine_id = myfoo</code></pre>
<p>The command <b>dynamic_path</b> loads and adds an ENGINE from the given path. It is equivalent to sending the ctrls <b>SO_PATH</b> with the path argument followed by <b>LIST_ADD</b> with value 2 and <b>LOAD</b> to the dynamic ENGINE. If this is not the required behaviour then alternative ctrls can be sent directly to the dynamic ENGINE using ctrl commands.</p>
<p>The command <b>init</b> determines whether to initialize the ENGINE. If the value is <b>0</b> the ENGINE will not be initialized, if <b>1</b> and attempt it made to initialized the ENGINE immediately. If the <b>init</b> command is not present then an attempt will be made to initialize the ENGINE after all commands in its section have been processed.</p>
<p>The command <b>default_algorithms</b> sets the default algorithms an ENGINE will supply using the functions ENGINE_set_default_string().</p>
<p>If the name matches none of the above command names it is assumed to be a ctrl command which is sent to the ENGINE. The value of the command is the argument to the ctrl command. If the value is the string <b>EMPTY</b> then no value is sent to the command.</p>
<p>For example:</p>
<pre><code>[engine_section]
# Configure ENGINE named "foo"
foo = foo_section
[foo_section]
# Load engine from DSO
dynamic_path = /some/path/fooengine.so
# A foo specific ctrl.
some_ctrl = some_value
# Another ctrl that doesn't take a value.
other_ctrl = EMPTY
# Supply all default algorithms
default_algorithms = ALL</code></pre>
<h2 id="EVP-Configuration-Module">EVP Configuration Module</h2>
<p>This modules has the name <b>alg_section</b> which points to a section containing algorithm commands.</p>
<p>Currently the only algorithm command supported is <b>fips_mode</b> whose value can only be the boolean string <b>off</b>. If <b>fips_mode</b> is set to <b>on</b>, an error occurs as this library version is not FIPS capable.</p>
<h2 id="SSL-Configuration-Module">SSL Configuration Module</h2>
<p>This module has the name <b>ssl_conf</b> which points to a section containing SSL configurations.</p>
<p>Each line in the SSL configuration section contains the name of the configuration and the section containing it.</p>
<p>Each configuration section consists of command value pairs for <b>SSL_CONF</b>. Each pair will be passed to a <b>SSL_CTX</b> or <b>SSL</b> structure if it calls SSL_CTX_config() or SSL_config() with the appropriate configuration name.</p>
<p>Note: any characters before an initial dot in the configuration section are ignored so the same command can be used multiple times.</p>
<p>For example:</p>
<pre><code>ssl_conf = ssl_sect
[ssl_sect]
server = server_section
[server_section]
RSA.Certificate = server-rsa.pem
ECDSA.Certificate = server-ecdsa.pem
Ciphers = ALL:!RC4</code></pre>
<p>The system default configuration with name <b>system_default</b> if present will be applied during any creation of the <b>SSL_CTX</b> structure.</p>
<p>Example of a configuration with the system default:</p>
<pre><code>ssl_conf = ssl_sect
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
MinProtocol = TLSv1.2
MinProtocol = DTLSv1.2</code></pre>
<h1 id="NOTES">NOTES</h1>
<p>If a configuration file attempts to expand a variable that doesn't exist then an error is flagged and the file will not load. This can happen if an attempt is made to expand an environment variable that doesn't exist. For example in a previous version of OpenSSL the default OpenSSL master configuration file used the value of <b>HOME</b> which may not be defined on non Unix systems and would cause an error.</p>
<p>This can be worked around by including a <b>default</b> section to provide a default value: then if the environment lookup fails the default value will be used instead. For this to work properly the default value must be defined earlier in the configuration file than the expansion. See the <b>EXAMPLES</b> section for an example of how to do this.</p>
<p>If the same variable exists in the same section then all but the last value will be silently ignored. In certain circumstances such as with DNs the same field may occur multiple times. This is usually worked around by ignoring any characters before an initial <b>.</b> e.g.</p>
<pre><code>1.OU="My first OU"
2.OU="My Second OU"</code></pre>
<h1 id="EXAMPLES">EXAMPLES</h1>
<p>Here is a sample configuration file using some of the features mentioned above.</p>
<pre><code># This is the default section.
HOME=/temp
RANDFILE= ${ENV::HOME}/.rnd
configdir=$ENV::HOME/config
[ section_one ]
# We are now in section one.
# Quotes permit leading and trailing whitespace
any = " any variable name "
other = A string that can \
cover several lines \
by including \\ characters
message = Hello World\n
[ section_two ]
greeting = $section_one::message</code></pre>
<p>This next example shows how to expand environment variables safely.</p>
<p>Suppose you want a variable called <b>tmpfile</b> to refer to a temporary filename. The directory it is placed in can determined by the <b>TEMP</b> or <b>TMP</b> environment variables but they may not be set to any value at all. If you just include the environment variable names and the variable doesn't exist then this will cause an error when an attempt is made to load the configuration file. By making use of the default section both values can be looked up with <b>TEMP</b> taking priority and <b>/tmp</b> used if neither is defined:</p>
<pre><code>TMP=/tmp
# The above value is used if TMP isn't in the environment
TEMP=$ENV::TMP
# The above value is used if TEMP isn't in the environment
tmpfile=${ENV::TEMP}/tmp.filename</code></pre>
<p>Simple OpenSSL library configuration example to enter FIPS mode:</p>
<pre><code># Default appname: should match "appname" parameter (if any)
# supplied to CONF_modules_load_file et al.
openssl_conf = openssl_conf_section
[openssl_conf_section]
# Configuration module list
alg_section = evp_sect
[evp_sect]
# Set to "yes" to enter FIPS mode if supported
fips_mode = yes</code></pre>
<p>Note: in the above example you will get an error in non FIPS capable versions of OpenSSL.</p>
<p>Simple OpenSSL library configuration to make TLS 1.2 and DTLS 1.2 the system-default minimum TLS and DTLS versions, respectively:</p>
<pre><code># Toplevel section for openssl (including libssl)
openssl_conf = default_conf_section
[default_conf_section]
# We only specify configuration for the "ssl module"
ssl_conf = ssl_section
[ssl_section]
system_default = system_default_section
[system_default_section]
MinProtocol = TLSv1.2
MinProtocol = DTLSv1.2</code></pre>
<p>The minimum TLS protocol is applied to <b>SSL_CTX</b> objects that are TLS-based, and the minimum DTLS protocol to those are DTLS-based. The same applies also to maximum versions set with <b>MaxProtocol</b>.</p>
<p>More complex OpenSSL library configuration. Add OID and don't enter FIPS mode:</p>
<pre><code># Default appname: should match "appname" parameter (if any)
# supplied to CONF_modules_load_file et al.
openssl_conf = openssl_conf_section
[openssl_conf_section]
# Configuration module list
alg_section = evp_sect
oid_section = new_oids
[evp_sect]
# This will have no effect as FIPS mode is off by default.
# Set to "yes" to enter FIPS mode, if supported
fips_mode = no
[new_oids]
# New OID, just short name
newoid1 = 1.2.3.4.1
# New OID shortname and long name
newoid2 = New OID 2 long name, 1.2.3.4.2</code></pre>
<p>The above examples can be used with any application supporting library configuration if "openssl_conf" is modified to match the appropriate "appname".</p>
<p>For example if the second sample file above is saved to "example.cnf" then the command line:</p>
<pre><code>OPENSSL_CONF=example.cnf openssl asn1parse -genstr OID:1.2.3.4.1</code></pre>
<p>will output:</p>
<pre><code>0:d=0 hl=2 l= 4 prim: OBJECT :newoid1</code></pre>
<p>showing that the OID "newoid1" has been added as "1.2.3.4.1".</p>
<h1 id="ENVIRONMENT">ENVIRONMENT</h1>
<dl>
<dt id="OPENSSL_CONF"><b>OPENSSL_CONF</b></dt>
<dd>
<p>The path to the config file. Ignored in set-user-ID and set-group-ID programs.</p>
</dd>
<dt id="OPENSSL_ENGINES"><b>OPENSSL_ENGINES</b></dt>
<dd>
<p>The path to the engines directory. Ignored in set-user-ID and set-group-ID programs.</p>
</dd>
</dl>
<h1 id="BUGS">BUGS</h1>
<p>Currently there is no way to include characters using the octal <b>\nnn</b> form. Strings are all null terminated so nulls cannot form part of the value.</p>
<p>The escaping isn't quite right: if you want to use sequences like <b>\n</b> you can't use any quote escaping on the same line.</p>
<p>Files are loaded in a single pass. This means that a variable expansion will only work if the variables referenced are defined earlier in the file.</p>
<h1 id="SEE-ALSO">SEE ALSO</h1>
<p><a href="../man1/x509.html">x509(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/ca.html">ca(1)</a></p>
<h1 id="COPYRIGHT">COPYRIGHT</h1>
<p>Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>
PK ;K]l��
�
ea-php82-php-common/ZEND_LICENSEnu ȯ�� --------------------------------------------------------------------
The Zend Engine License, Version 2.00
Copyright (c) 1999-2006 Zend Technologies Ltd. All rights reserved.
--------------------------------------------------------------------
Redistribution and use in source and binary forms, with or without
modification, is permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
3. The names "Zend" and "Zend Engine" must not be used to endorse
or promote products derived from this software without prior
permission from Zend Technologies Ltd. For written permission,
please contact license@zend.com.
4. Zend Technologies Ltd. may publish revised and/or new versions
of the license from time to time. Each version will be given a
distinguishing version number.
Once covered code has been published under a particular version
of the license, you may always continue to use it under the
terms of that version. You may also choose to use such covered
code under the terms of any subsequent version of the license
published by Zend Technologies Ltd. No one other than Zend
Technologies Ltd. has the right to modify the terms applicable
to covered code created under this License.
5. Redistributions of any form whatsoever must retain the following
acknowledgment:
"This product includes the Zend Engine, freely available at
http://www.zend.com"
6. All advertising materials mentioning features or use of this
software must display the following acknowledgment:
"The Zend Engine is freely available at http://www.zend.com"
THIS SOFTWARE IS PROVIDED BY ZEND TECHNOLOGIES LTD. ``AS IS'' AND
ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ZEND
TECHNOLOGIES LTD. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
--------------------------------------------------------------------
PK ;K]��N(� � ea-php82-php-common/README.mdnu ȯ�� <div align="center">
<a href="https://php.net">
<img
alt="PHP"
src="https://www.php.net/images/logos/new-php-logo.svg"
width="150">
</a>
</div>
# The PHP Interpreter
PHP is a popular general-purpose scripting language that is especially suited to
web development. Fast, flexible and pragmatic, PHP powers everything from your
blog to the most popular websites in the world. PHP is distributed under the
[PHP License v3.01](LICENSE).
[](https://github.com/php/php-src/actions/workflows/push.yml)
[](https://travis-ci.com/github/php/php-src)
[](https://dev.azure.com/phpazuredevops/php/_build/latest?definitionId=1&branchName=master)
[](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:php)
## Documentation
The PHP manual is available at [php.net/docs](https://php.net/docs).
## Installation
### Prebuilt packages and binaries
Prebuilt packages and binaries can be used to get up and running fast with PHP.
For Windows, the PHP binaries can be obtained from
[windows.php.net](https://windows.php.net). After extracting the archive the
`*.exe` files are ready to use.
For other systems, see the [installation chapter](https://php.net/install).
### Building PHP source code
*For Windows, see [Build your own PHP on Windows](https://wiki.php.net/internals/windows/stepbystepbuild_sdk_2).*
For a minimal PHP build from Git, you will need autoconf, bison, and re2c. For
a default build, you will additionally need libxml2 and libsqlite3.
On Ubuntu, you can install these using:
sudo apt install -y pkg-config build-essential autoconf bison re2c \
libxml2-dev libsqlite3-dev
On Fedora, you can install these using:
sudo dnf install re2c bison autoconf make libtool ccache libxml2-devel sqlite-devel
Generate configure:
./buildconf
Configure your build. `--enable-debug` is recommended for development, see
`./configure --help` for a full list of options.
# For development
./configure --enable-debug
# For production
./configure
Build PHP. To speed up the build, specify the maximum number of jobs using `-j`:
make -j4
The number of jobs should usually match the number of available cores, which
can be determined using `nproc`.
## Testing PHP source code
PHP ships with an extensive test suite, the command `make test` is used after
successful compilation of the sources to run this test suite.
It is possible to run tests using multiple cores by setting `-jN` in
`TEST_PHP_ARGS`:
make TEST_PHP_ARGS=-j4 test
Shall run `make test` with a maximum of 4 concurrent jobs: Generally the maximum
number of jobs should not exceed the number of cores available.
The [qa.php.net](https://qa.php.net) site provides more detailed info about
testing and quality assurance.
## Installing PHP built from source
After a successful build (and test), PHP may be installed with:
make install
Depending on your permissions and prefix, `make install` may need super user
permissions.
## PHP extensions
Extensions provide additional functionality on top of PHP. PHP consists of many
essential bundled extensions. Additional extensions can be found in the PHP
Extension Community Library - [PECL](https://pecl.php.net).
## Contributing
The PHP source code is located in the Git repository at
[github.com/php/php-src](https://github.com/php/php-src). Contributions are most
welcome by forking the repository and sending a pull request.
Discussions are done on GitHub, but depending on the topic can also be relayed
to the official PHP developer mailing list internals@lists.php.net.
New features require an RFC and must be accepted by the developers. See
[Request for comments - RFC](https://wiki.php.net/rfc) and
[Voting on PHP features](https://wiki.php.net/rfc/voting) for more information
on the process.
Bug fixes don't require an RFC. If the bug has a GitHub issue, reference it in
the commit message using `GH-NNNNNN`. Use `#NNNNNN` for tickets in the old
[bugs.php.net](https://bugs.php.net) bug tracker.
Fix GH-7815: php_uname doesn't recognise latest Windows versions
Fix #55371: get_magic_quotes_gpc() throws deprecation warning
See [Git workflow](https://wiki.php.net/vcs/gitworkflow) for details on how pull
requests are merged.
### Guidelines for contributors
See further documents in the repository for more information on how to
contribute:
- [Contributing to PHP](/CONTRIBUTING.md)
- [PHP coding standards](/CODING_STANDARDS.md)
- [Mailing list rules](/docs/mailinglist-rules.md)
- [PHP release process](/docs/release-process.md)
## Credits
For the list of people who've put work into PHP, please see the
[PHP credits page](https://php.net/credits.php).
PK ;K]ʱ!E� � $ ea-php82-php-common/libmagic_LICENSEnu ȯ�� Author: Christos Zoulas <christos@zoulas.com>
Download: ftp://ftp.astron.com/pub/file/
Files: *
Copyright:
(C) 1985-1995 Ian F. Darwin
(C) 1994-2009 Christos Zoulas <christos@zoulas.com>
License: BSD
This software is not subject to any export provision of the United States
Department of Commerce, and may be exported to any country or planet.
.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
.
1. Redistributions of source code must retain the above copyright
notice immediately at the beginning of the file, without modification,
this list of conditions, and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
PK ;K]I� � ea-php82-php-common/LICENSEnu ȯ�� --------------------------------------------------------------------
The PHP License, version 3.01
Copyright (c) 1999 - 2024 The PHP Group. All rights reserved.
--------------------------------------------------------------------
Redistribution and use in source and binary forms, with or without
modification, is permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
3. The name "PHP" must not be used to endorse or promote products
derived from this software without prior written permission. For
written permission, please contact group@php.net.
4. Products derived from this software may not be called "PHP", nor
may "PHP" appear in their name, without prior written permission
from group@php.net. You may indicate that your software works in
conjunction with PHP by saying "Foo for PHP" instead of calling
it "PHP Foo" or "phpfoo"
5. The PHP Group may publish revised and/or new versions of the
license from time to time. Each version will be given a
distinguishing version number.
Once covered code has been published under a particular version
of the license, you may always continue to use it under the terms
of that version. You may also choose to use such covered code
under the terms of any subsequent version of the license
published by the PHP Group. No one other than the PHP Group has
the right to modify the terms applicable to covered code created
under this License.
6. Redistributions of any form whatsoever must retain the following
acknowledgment:
"This product includes PHP software, freely available from
<http://www.php.net/software/>".
THIS SOFTWARE IS PROVIDED BY THE PHP DEVELOPMENT TEAM ``AS IS'' AND
ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE PHP
DEVELOPMENT TEAM OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.
--------------------------------------------------------------------
This software consists of voluntary contributions made by many
individuals on behalf of the PHP Group.
The PHP Group can be contacted via Email at group@php.net.
For more information on the PHP Group and the PHP project,
please see <http://www.php.net>.
PHP includes the Zend Engine, freely available at
<http://www.zend.com>.
PK ;K]M�r" " ea-php82-php-common/TSRM_LICENSEnu ȯ�� Copyright (c) 1999-2006, Andi Gutmans, Sascha Schumann, Zeev Suraski.
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
- Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
- Neither name of the copyright holders nor the names of their contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS
IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
PK ;K] ��)_ )_ ea-php82-php-common/EXTENSIONSnu ȯ�� List of PHP maintainers
=======================
Maintenance legend
------------------
Maintained: Someone actually looks after it.
Odd Fixes: It has a maintainer but they don't have time to do
much other than throw the odd patch in. See below.
Orphan: No current maintainer [but maybe you could take the
role as you write your new code].
Obsolete: Old code. Something tagged obsolete generally means
it has been replaced by a better system and you
should be using that.
Unknown: Not known at this time.
Status legend
-------------
Working: Working under both Windows and Unix.
Windows: Working only under Windows.
Unix: Working only under Unix.
Experimental: Under development or initial release.
Not Working: Not working.
Unknown: Status unknown.
== Server APIs ==
-------------------------------------------------------------------------------
EXTENSION: apache2handler
PRIMARY MAINTAINER: Aaron Bannert <aaron@php.net>, Ilia Alshanetsky <iliaa@php.net>
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: cgi
MAINTENANCE: Unknown
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: cli
PRIMARY MAINTAINER: Marcus Börger <helly@php.net>, Edin Kadribasic <edink@php.net>
MAINTENANCE: Xinchen Hui <laruence@php.net> (2013 - 2020)
STATUS: Working
SINCE: 4.3.0
-------------------------------------------------------------------------------
EXTENSION: embed
PRIMARY MAINTAINER: Edin Kadribasic <edink@php.net>
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: fpm
PRIMARY MAINTAINER: Jakub Zelenka <bukka@php.net>
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3.3
-------------------------------------------------------------------------------
EXTENSION: litespeed
PRIMARY MAINTAINER: George Wang <gwang@php.net>
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3
-------------------------------------------------------------------------------
EXTENSION: phpdbg
PRIMARY MAINTAINER: Joe Watkins <krakjoe@php.net>, Bob Weinand <bwoebi@php.net>
MAINTENANCE: Unknown
STATUS: 5.6
-------------------------------------------------------------------------------
== Database extensions ==
-------------------------------------------------------------------------------
EXTENSION: dba
PRIMARY MAINTAINER: Marcus Börger <helly@php.net> (2002 - 2007)
Christopher Jones <sixd@php.net> (2008 - 2013)
Pierre-Alain Joye <pajoye@php.net> (2011 - 2011)
MAINTENANCE: Maintained
STATUS: Working
COMMENT: DBM abstraction for db2, db3, db4, dbm, ndbm, gdbm, ini
-------------------------------------------------------------------------------
EXTENSION: mysqli
PRIMARY MAINTAINER: Georg Richter <georg@php.net> (2003 - 2006)
Andrey Hristov <andrey@php.net> (2003 - 2016)
Johannes Schlüter <johannes@php.net> (2008 - 2014)
Ulf Wendel <uw@php.net> (2007 - 2013)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.0
-------------------------------------------------------------------------------
EXTENSION: mysqlnd
PRIMARY MAINTAINER: Andrey Hristov <andrey@php.net> (2007 - 2017)
Johannes Schlüter <johannes@php.net> (2008 - 2018)
Ulf Wendel <uw@php.net> (2009 - 2011)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3
-------------------------------------------------------------------------------
EXTENSION: oci8
PRIMARY MAINTAINER: Christopher Jones <sixd@php.net> (2007 - 2017)
Antony Dovgal <tony2001@php.net> (2003 - 2009)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: odbc
PRIMARY MAINTAINER: Daniel R. Kalowsky <kalowsky@php.net> (2000 - 2004)
MAINTENANCE: Maintained
STATUS: Working
COMMENT: Working
-------------------------------------------------------------------------------
EXTENSION: pdo
PRIMARY MAINTAINER: Ilia Alshanetsky <iliaa@php.net> (2004 - 2011)
Wez Furlong <wez@php.net> (2004 - 2006)
MAINTENANCE: Odd fixes
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pdo_dblib
PRIMARY MAINTAINER: Adam Baratz <adambaratz@php.net> (2016 - 2017)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pdo_firebird
PRIMARY MAINTAINER: Lars Westermann <lwe@php.net> (2007 - 2007)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pdo_mysql
PRIMARY MAINTAINER: Ilia Alshanetsky <iliaa@php.net> (2004 - 2010)
Johannes Schlüter <johannes@php.net> (2008 - 2014)
Andrey Hristov <andrey@php.net> (2005 - 2015)
Ulf Wendel <uw@php.net> (2008 - 2012)
MAINTENANCE: Odd fixes
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pdo_odbc
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Odd fixes
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pdo_oci
PRIMARY MAINTAINER: Christopher Jones <sixd@php.net> (2007 - 2017)
MAINTENANCE: Odd fixes
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pdo_pgsql
PRIMARY MAINTAINER: Ilia Alshanetsky <iliaa@php.net> (2004 - 2011)
MAINTENANCE: Odd fixes
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pdo_sqlite
PRIMARY MAINTAINER: Ilia Alshanetsky <iliaa@php.net> (2005 - 2011)
MAINTENANCE: Odd fixes
STATUS: Working
SINCE: 5.1
-------------------------------------------------------------------------------
EXTENSION: pgsql
PRIMARY MAINTAINER: Marcus Börger <helly@php.net> (2002 - 2007)
Yasuo Ohgaki <yohgaki@php.net> (2001 - 2015)
MAINTENANCE: Maintained
STATUS: Working
COMMENT: Use PostgreSQL 7.0.x or later. PostgreSQL 6.5.3 or less have fatal bug.
-------------------------------------------------------------------------------
EXTENSION: sqlite3
PRIMARY MAINTAINER: Scott MacVicar <scottmac@php.net> (2008 - 2011)
Christoph M. Becker <cmb@php.net> (2016 - 2020)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3
COMMENT: Integrates SQLite 3 embeddable SQL database engine.
-------------------------------------------------------------------------------
== XML extensions ==
-------------------------------------------------------------------------------
EXTENSION: dom
PRIMARY MAINTAINER: Christian Stocker <chregu@php.net> (2003 - 2011)
Rob Richards <rrichards@php.net> (2003 - 2012)
Marcus Börger <helly@php.net> (2003 - 2006)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.0
-------------------------------------------------------------------------------
EXTENSION: simplexml
PRIMARY MAINTAINER: Marcus Börger <helly@php.net> (2003 - 2008)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.0
-------------------------------------------------------------------------------
EXTENSION: soap
PRIMARY MAINTAINER: Dmitry Stogov <dmitry@php.net> (2004 - 2018)
Niels Dossche <nielsdos@php.net> (2024 - 2024)
MAINTENANCE: Odd fixes
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: xml
PRIMARY MAINTAINER: Thies C. Arntzen <thies@thieso.net> (1999 - 2002)
Rob Richards <rrichards@php.net> (2003 - 2013)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: libxml
PRIMARY MAINTAINER: Rob Richards <rrichards@php.net> (2003 - 2009)
Christian Stocker <chregu@php.net> (2004 - 2011)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: xmlreader
PRIMARY MAINTAINER: Rob Richards <rrichards@php.net> (2004 - 2010)
Christian Stocker <chregu@php.net> (2004 - 2004)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: xmlwriter
PRIMARY MAINTAINER: Rob Richards <rrichards@php.net> (2004 - 2010)
Pierre-Alain Joye <pajoye@php.net> (2005-2009)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: xsl
PRIMARY MAINTAINER: Christian Stocker <chregu@php.net> (2003 - 2011)
Rob Richards <rrichards@php.net> (2003 - 2010)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.0
-------------------------------------------------------------------------------
== Other extensions ==
-------------------------------------------------------------------------------
EXTENSION: bcmath
PRIMARY MAINTAINER: Andi Gutmans <andi@php.net> (2000 - 2004)
MAINTENANCE: Unknown
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: bz2
PRIMARY MAINTAINER: Hartmut Holzgraefe <hholzgra@php.net> (2004 - 2004)
MAINTENANCE: Odd Fixes
STATUS: Working
SINCE: 4.0.3
-------------------------------------------------------------------------------
EXTENSION: calendar
PRIMARY MAINTAINER: Hartmut Holzgraefe <hholzgra@php.net> (2000 - 2004)
MAINTENANCE: Odd Fixes
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: com_dotnet
PRIMARY MAINTAINER: Wez Furlong <wez@php.net> (2003 - 2005)
Christoph M. Becker <cmb@php.net> (2018 - 2022)
MAINTENANCE: Maintained
STATUS: Windows
SINCE: 5.0
-------------------------------------------------------------------------------
EXTENSION: ctype
PRIMARY MAINTAINER: Hartmut Holzgraefe <hholzgra@php.net> (2000 - 2004)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: curl
PRIMARY MAINTAINER: Sterling Hughes <sterling@php.net> (2000 - 2004)
Ilia Alshanetsky <iliaa@php.net> (2002 - 2011)
Pierrick Charron <pierrick@php.net> (2010 - 2016)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 4.0.2
-------------------------------------------------------------------------------
EXTENSION: date
PRIMARY MAINTAINER: Derick Rethans <derick@php.net> (2005 - 2018)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: enchant
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3
-------------------------------------------------------------------------------
EXTENSION: exif
PRIMARY MAINTAINER: Kalle Sommer Nielsen <kalle@php.net> (2010 - 2018)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 4.2
-------------------------------------------------------------------------------
EXTENSION: ffi
PRIMARY MAINTAINER: Dmitry Stogov <dmitry@php.net> (2018 - 2019)
MAINTENANCE: Maintained
STATUS: Experimental
SINCE: 7.4.0
-------------------------------------------------------------------------------
EXTENSION: fileinfo
PRIMARY MAINTAINER: Derick Rethans <derick@php.net> (2004 - 2008)
Anatol Belski <ab@php.net> (2012 - 2020)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3
-------------------------------------------------------------------------------
EXTENSION: filter
PRIMARY MAINTAINER: Derick Rethans <derick@php.net> (2006 - 2006)
Pierre-Alain Joye <pajoye@php.net> (2006 - 2011)
Ilia Alshanetsky <iliaa@php.net> (2006 - 2011)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.2
-------------------------------------------------------------------------------
EXTENSION: ftp
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Odd fixes
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: gd
PRIMARY MAINTAINER: Pierre-Alain Joye <pajoye@php.net> (2002 - 2016)
Christoph M. Becker <cmb@php.net> (2015 - 2022)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: gettext
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Unknown
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: gmp
PRIMARY MAINTAINER: Stanislav Malyshev <stas@php.net> (2000 - 2019)
Antony Dovgal <tony2001@php.net> (2005 - 2010)
Nikita Popov <nikic@php.net> (2013 - 2020)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 4.0.4
-------------------------------------------------------------------------------
EXTENSION: hash
PRIMARY MAINTAINER: Sara Golemon <pollita@php.net> (2005 - 2017)
Mike Wallner <mike@php.net> (2005 - 2013)
Anatol Belski <ab@php.net> (2014 - 2018)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.1.2
-------------------------------------------------------------------------------
EXTENSION: iconv
PRIMARY MAINTAINER: Moriyoshi Koizumi <moriyoshi@php.net> (2002 - 2010)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: intl
PRIMARY MAINTAINER: Stanislav Malyshev <stas@php.net> (2008 - 2019)
Anatol Belski <ab@php.net> (2017 - 2018)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3
-------------------------------------------------------------------------------
EXTENSION: imap
PRIMARY MAINTAINER: Chuck Hagenbuch <chuck@horde.org> (1999 - 2004)
Ilia Alshanetsky <iliaa@php.net> (2002 - 2010)
Pierre-Alain Joye <pajoye@php.net> (2008 - 2010)
Bishop Bettini <bishop@php.net> (2018 - 2019)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: json
PRIMARY MAINTAINER: Jakub Zelenka <bukka@php.net> (2014 - 2018)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.2
-------------------------------------------------------------------------------
EXTENSION: ldap
PRIMARY MAINTAINER: Stig Venaas <venaas@php.net> (2000 - 2002)
Douglas Goldstein <cardoe@php.net> (2007 - 2007)
Pierre-Alain Joye <pajoye@php.net> (2008 - 2010)
Côme Bernigaud <mcmic@php.net> (2015 - 2017)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: mbstring
PRIMARY MAINTAINER: Rui Hirokawa <hirokawa@php.net> (2001 - 2013)
Nikita Popov <nikic@php.net> (2017 - 2020)
Alex Dowad <alexinbeijing@gmail.com> (2021 - 2022)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: opcache
PRIMARY MAINTAINER: Dmitry Stogov <dmitry@php.net> (2013 - 2018)
Xinchen Hui <laruence@php.net> (2013 - 2020)
Nikita Popov <nikic@php.net> (2016 - 2020)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.5.0
-------------------------------------------------------------------------------
EXTENSION: openssl
PRIMARY MAINTAINER: Wez Furlong <wez@php.net> (2001 - 2006)
Pierre-Alain Joye <pajoye@php.net> (2006 - 2011)
Jakub Zelenka <bukka@php.net> (2015 - 2019)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 4.0.4
-------------------------------------------------------------------------------
EXTENSION: pcntl
PRIMARY MAINTAINER: Arnaud Le Blanc <lbarnaud@php.net> (2008 - 2010)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: pcre
PRIMARY MAINTAINER: Andrei Zmievski <andrei@php.net> (1999 - 2006)
Nuno Lopes <nlopess@php.net> (2006 - 2009)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: phar
PRIMARY MAINTAINER: Greg Beaver <cellog@php.net> (2008 - 2009)
Marcus Börger <helly@php.net> (2008 - 2008)
Steph Fox <sfox@php.net> (2008 - 2008)
Bishop Bettini <bishop@php.net> (2018 - 2019)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.3
-------------------------------------------------------------------------------
EXTENSION: posix
PRIMARY MAINTAINER: Kristian Köhntopp <kris@koehntopp.de> (2000 - 2000)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: pspell
PRIMARY MAINTAINER: Vlad Krupin <phpdevel@echospace.com> (2000 - 2004)
MAINTENANCE: Unknown
STATUS: Working
SINCE: 4.0.2
-------------------------------------------------------------------------------
EXTENSION: random
PRIMARY MAINTAINER Go Kudo <zeriyoshi@php.net> (2022 - 2022)
Tim Düsterhus <timwolla@php.net> (2022 - 2022)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 8.2.0
-------------------------------------------------------------------------------
EXTENSION: readline
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Unknown
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: reflection
PRIMARY MAINTAINER: Marcus Börger <helly@php.net> (2003 - 2009)
Johannes Schlüter <johannes@php.net> (2006 - 2014)
Nikita Popov <nikic@php.net> (2019 - 2020)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: session
PRIMARY MAINTAINER: Sascha Schumann <sascha@schumann.cx> (1999 - 2004)
Ilia Alshanetsky <iliaa@php.net> (2002 - 2012)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: shmop
PRIMARY MAINTAINER: Ilia Alshanetsky <iliaa@php.net> (2002 - 2008)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 4.0.3
-------------------------------------------------------------------------------
EXTENSION: snmp
PRIMARY MAINTAINER: Boris Lytochkin <lytboris@php.net> (2011 - 2013)
Rasmus Lerdorf <rasmus@php.net> (1999 - 2002)
Pierre-Alain Joye <pajoye@php.net> (2010 - 2011)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: sockets
PRIMARY MAINTAINER: Chris Vandomelen <chrisv@b0rked.dhs.org> (2000 - 2000)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 4.0.2
-------------------------------------------------------------------------------
EXTENSION: sodium
PRIMARY MAINTAINER: Frank Denis <jedisct1@php.net> (2017 - 2017)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 7.2.0
-------------------------------------------------------------------------------
EXTENSION: spl
PRIMARY MAINTAINER: Marcus Börger <helly@php.net> (2003 - 2009)
Etienne Kneuss <colder@php.net> (2008 - 2014)
MAINTENANCE: Maintained
STATUS: Working
SINCE: 5.0.0
-------------------------------------------------------------------------------
EXTENSION: sysvmsg
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Unknown
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: sysvsem
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Unknown
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: sysvshm
PRIMARY MAINTAINER: Unknown
MAINTENANCE: Unknown
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: tidy
PRIMARY MAINTAINER: John Coggeshall <john@php.net> (2003 - 2006)
Ilia Alshanetsky <iliaa@php.net> (2003 - 2009)
Nuno Lopes <nlopess@php.net> (2006 - 2012)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: tokenizer
PRIMARY MAINTAINER: Andrei Zmievski <andrei@php.net> (2002 - 2002)
Nikita Popov <nikic@php.net> (2013 - 2020)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: zip
PRIMARY MAINTAINER: Pierre-Alain Joye <pajoye@php.net> (2006 - 2011)
Remi Collet <remi@php.net> (2013-2020)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
EXTENSION: zlib
PRIMARY MAINTAINER: Stefan Roehrich <sr@linux.de> (1999 - 2003)
MAINTENANCE: Maintained
STATUS: Working
-------------------------------------------------------------------------------
PK ;K]�ɽo �o ea-php82-php-common/NEWSnu ȯ�� PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
30 Jul 2026, PHP 8.2.33
- Date:
. Fixed leak on double DatePeriod::__construct() call. (ilutov)
- GD:
. Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
- PGSQL:
. Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
(CVE-2026-17543) (ilutov)
- Phar:
. Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
(Jakub Zelenka)
02 Jul 2026, PHP 8.2.32
- OpenSSL:
. Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in
openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)
07 May 2026, PHP 8.2.31
- Curl:
. Add support for brotli and zstd on Windows. (Shivam Mathur)
- FPM:
. Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)
(Jakub Zelenka)
- MBString:
. Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in
php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
(vi3tL0u1s)
- OpenSSL:
. Fix compatibility issues with OpenSSL 4.0. (jordikroon, Remi)
- PDO_Firebird:
. Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings).
(CVE-2025-14179) (SakiTakamachi)
- SOAP:
. Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache
Map). (CVE-2026-6722) (ilutov)
. Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with
SOAP_PERSISTENCE_SESSION). (CVE-2026-7261) (ilutov)
. Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check).
(CVE-2026-7262) (ilutov)
- Standard:
. Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset).
(CVE-2026-7568) (TimWolla)
. Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h
functions). (CVE-2026-7258) (ilutov)
18 Dec 2025, PHP 8.2.30
- Curl:
. Fix curl build and test failures with version 8.16.
(nielsdos, ilutov, Jakub Zelenka)
- Opcache:
. Reset global pointers to prevent use-after-free in zend_jit_status().
(Florian Engelhardt)
- PDO:
. Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
(Jakub Zelenka)
- Standard:
. Fixed GHSA-www2-q4fc-65wf (Null byte termination in dns_get_record()).
(ndossche)
. Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()).
(CVE-2025-14178) (ndossche)
. Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize).
(CVE-2025-14177) (ndossche)
03 Jul 2025, PHP 8.2.29
- PGSQL:
. Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during
escaping). (CVE-2025-1735) (Jakub Zelenka)
- SOAP:
. Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension
via Large XML Namespace Prefix). (CVE-2025-6491) (Lekssays, nielsdos)
- Standard:
. Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames).
(CVE-2025-1220) (Jakub Zelenka)
13 Mar 2025, PHP 8.2.28
- Core:
. Fixed bug GH-17211 (observer segfault on function loaded with dl()).
(Arnaud)
- LibXML:
. Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714). (nielsdos)
. Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header
when requesting a redirected resource). (CVE-2025-1219) (timwolla)
- Streams:
. Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit
basic auth header). (CVE-2025-1736) (Jakub Zelenka)
. Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location
to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)
. Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers
without colon). (CVE-2025-1734) (Jakub Zelenka)
. Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not
handle folded headers). (CVE-2025-1217) (Jakub Zelenka)
- Windows:
. Fixed phpize for Windows 11 (24H2). (bwoebi)
19 Dec 2024, PHP 8.2.27
- Calendar:
. Fixed jdtogregorian overflow. (David Carlier)
. Fixed cal_to_jd julian_days argument overflow. (David Carlier)
- COM:
. Fixed bug GH-16991 (Getting typeinfo of non DISPATCH variant segfaults).
(cmb)
- Core:
. Fail early in *nix configuration build script. (hakre)
. Fixed bug GH-16727 (Opcache bad signal 139 crash in ZTS bookworm
(frankenphp)). (nielsdos)
. Fixed bug GH-16799 (Assertion failure at Zend/zend_vm_execute.h:7469).
(nielsdos)
. Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs).
(nielsdos)
. Fix is_zend_ptr() huge block comparison. (nielsdos)
. Fixed potential OOB read in zend_dirname() on Windows. (cmb)
- Curl:
. Fix various memory leaks in curl mime handling. (nielsdos)
- FPM:
. Fixed GH-16432 (PHP-FPM 8.2 SIGSEGV in fpm_get_status). (Jakub Zelenka)
- GD:
. Fixed GH-16776 (imagecreatefromstring overflow). (David Carlier)
- GMP:
. Revert gmp_pow() overly restrictive overflow checks.
(David Carlier)
- Hash:
. Fixed GH-16711: Segfault in mhash(). (Girgias)
- Opcache:
. Fixed bug GH-16770 (Tracing JIT type mismatch when returning UNDEF).
(nielsdos, Dmitry)
. Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
(dktapps)
. Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64). (nielsdos)
- OpenSSL:
. Prevent unexpected array entry conversion when reading key. (nielsdos)
. Fix various memory leaks related to openssl exports. (nielsdos)
. Fix memory leak in php_openssl_pkey_from_zval(). (nielsdos)
- PDO:
. Fixed memory leak of `setFetchMode()`. (SakiTakamachi)
- Phar:
. Fixed bug GH-16695 (phar:// tar parser and zero-length file header blocks).
(nielsdos, Hans Krentel)
- PHPDBG:
. Fixed bug GH-15208 (Segfault with breakpoint map and phpdbg_clear()).
(nielsdos)
- SAPI:
. Fixed bug GH-16998 (UBSAN warning in rfc1867). (nielsdos)
- SimpleXML:
. Fixed bug GH-16808 (Segmentation fault in RecursiveIteratorIterator
->current() with a xml element input). (nielsdos)
- SNMP:
. Fixed bug GH-16959 (snmget modifies the object_id array).
(David Carlier)
- Standard:
. Fixed bug GH-16905 (Internal iterator functions can't handle UNDEF
properties). (nielsdos)
- Streams:
. Fixed network connect poll interuption handling. (Jakub Zelenka)
- Windows:
. Fixed bug GH-16849 (Error dialog causes process to hang). (cmb)
21 Nov 2024, PHP 8.2.26
- CLI:
. Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server
started through shebang). (ilutov)
. Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
Processing in CLI SAPI Interface). (nielsdos)
- COM:
. Fixed out of bound writes to SafeArray data. (cmb)
- Core:
. Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled
with Xcode 16 clang on macOS 15). (nielsdos)
. Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646). (Arnaud)
. Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for
call trampoline). (ilutov)
. Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
(ilutov)
. Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed
early bound classes). (ilutov)
. Fixed bug GH-16648 (Use-after-free during array sorting). (ilutov)
. Fixed bug GH-15915 (overflow with a high value for precision INI).
(David Carlier / cmb)
- Curl:
. Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if
curl_multi_add_handle fails). (timwolla)
- Date:
. Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
(cmb)
. Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c). (Derick)
. Fixed bug GH-14732 (date_sun_info() fails for non-finite values). (cmb)
- DBA:
. Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams). (cmb)
- DOM:
. Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
(nielsdos)
. Fixed bug GH-16473 (dom_import_simplexml stub is wrong). (nielsdos)
. Fixed bug GH-16533 (Segfault when adding attribute to parent that is not
an element). (nielsdos)
. Fixed bug GH-16535 (UAF when using document as a child). (nielsdos)
. Fixed bug GH-16593 (Assertion failure in DOM->replaceChild). (nielsdos)
. Fixed bug GH-16595 (Another UAF in DOM -> cloneNode). (nielsdos)
- EXIF:
. Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a
real file). (nielsdos, cmb)
- FFI:
. Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
(nielsdos)
- Filter:
. Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen). (cmb)
- FPM:
. Fixed bug GH-16628 (FPM logs are getting corrupted with this log
statement). (nielsdos)
- GD:
. Fixed bug GH-16334 (imageaffine overflow on matrix elements).
(David Carlier)
. Fixed bug GH-16427 (Unchecked libavif return values). (cmb)
. Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
(nielsdos)
- GMP:
. Fixed bug GH-16411 (gmp_export() can cause overflow). (cmb)
. Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
(David Carlier)
. Fixed segfaults and other issues related to operator overloading with
GMP objects. (Girgias)
- LDAP:
. Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
(nielsdos)
- MBstring:
. Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
(David Carlier)
- MySQLnd:
. Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through
heap buffer over-read). (CVE-2024-8929) (Jakub Zelenka)
- OpenSSL:
. Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
(cmb)
. Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
(cmb)
. Fix various memory leaks on error conditions in openssl_x509_parse().
(nielsdos)
- PDO DBLIB:
. Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing
OOB writes). (CVE-2024-11236) (nielsdos)
- PDO Firebird:
. Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter
causing OOB writes). (CVE-2024-11236) (nielsdos)
- PDO ODBC:
. Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values). (cmb)
- Phar:
. Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808). (nielsdos)
- PHPDBG:
. Fixed bug GH-16174 (Empty string is an invalid expression for ev). (cmb)
- Reflection:
. Fixed bug GH-16601 (Memory leak in Reflection constructors). (nielsdos)
- Session:
. Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
(nielsdos)
. Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
(David Carlier)
- SOAP:
. Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
(nielsdos)
- Sockets:
. Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)
- SPL:
. Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos)
. Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
(ilutov)
. Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov)
. Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov)
. Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos)
. Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed
SplFileObject::__constructor). (Girgias)
. Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()). (nielsdos)
. Fixed bug GH-14687 (segfault on SplObjectIterator instance).
(David Carlier)
. Fixed bug GH-16604 (Memory leaks in SPL constructors). (nielsdos)
. Fixed bug GH-16646 (UAF in ArrayObject::unset() and
ArrayObject::exchangeArray()). (ilutov)
- Standard:
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with
bail enabled). (ilutov)
- Streams:
. Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
. Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)
- SysVMsg:
. Fixed bug GH-16592 (msg_send() crashes when a type does not properly
serialized). (David Carlier / cmb)
- SysVShm:
. Fixed bug GH-16591 (Assertion error in shm_put_var). (nielsdos, cmb)
- XMLReader:
. Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
(nielsdos)
- Zlib:
. Fixed bug GH-16326 (Memory management is broken for bad dictionaries.)
(cmb)
24 Oct 2024, PHP 8.2.25
- Calendar:
. Fixed GH-16240: jdtounix overflow on argument value. (David Carlier)
. Fixed GH-16241: easter_days/easter_date overflow on year argument.
(David Carlier)
. Fixed GH-16263: jddayofweek overflow. (cmb)
. Fixed GH-16234: jewishtojd overflow. (nielsdos)
- CLI:
. Fixed bug GH-16137: duplicate http headers when set several times by
the client. (David Carlier)
- Core:
. Fixed bug GH-15712: zend_strtod overflow with precision INI set on
large value. (David Carlier)
. Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER). (cmb)
. Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to
exception). (ilutov)
. Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of
nested generator frame). (ilutov)
. Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c). (Arnaud)
. Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c). (Arnaud)
. Fixed bug GH-16233 (Observer segfault when calling user function in
internal function via trampoline). (nielsdos)
- Date:
. Fixed bug GH-15582: Crash when not calling parent constructor of
DateTimeZone. (Derick)
. Fixed regression where signs after the first one were ignored while parsing
a signed integer, with the DateTimeInterface::modify() function. (Derick)
- DOM:
. Fixed bug GH-16039 (Segmentation fault (access null pointer) in
ext/dom/parentnode/tree.c). (nielsdos)
. Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
(nielsdos)
- GD:
. Fixed bug GH-16232 (bitshift overflow on wbmp file content reading /
fix backport from upstream). (David Carlier)
. Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value)
(David Carlier)
. Fixed bug GH-16274 (imagescale underflow on RBG channels /
fix backport from upstream). (David Carlier)
- LDAP:
. Fixed bug GH-16032 (Various NULL pointer dereferencements in
ldap_modify_batch()). (Girgias)
. Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search()
when LDAPs array is not a list). (Girgias)
. Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated
by ZMM.). (Girgias)
. Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a
proper dictionary). (Girgias)
- MBString:
. Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
(nielsdos)
- OpenSSL:
. Fixed stub for openssl_csr_new. (Jakub Zelenka)
- PCRE:
. Fixed bug GH-16189 (underflow on offset argument). (David Carlier)
. Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
(nielsdos)
- PHPDBG:
. Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs). (cmb)
. Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
(cmb)
- Reflection:
. Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
(DanielEScherzer)
- SAPI:
. Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
(Jakub Zelenka, David Carlier)
- SimpleXML:
. Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
(nielsdos)
- Sockets:
. Fixed bug GH-16267 (socket_strerror overflow on errno argument).
(David Carlier)
- SOAP:
. Fixed bug #62900 (Wrong namespace on xsd import error message). (nielsdos)
. Fixed bug GH-16237 (Segmentation fault when cloning SoapServer). (nielsdos)
. Fix Soap leaking http_msg on error. (nielsdos)
. Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
(nielsdos)
. Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
(nielsdos)
- Standard:
. Fixed bug GH-15613 (overflow on unpack call hex string repeater).
(David Carlier)
. Fixed bug GH-15937 (overflow on stream timeout option value).
(David Carlier)
. Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c). (Arnaud)
- Streams:
. Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
(nielsdos)
. Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
(cmb)
- TSRM:
. Prevent closing of unrelated handles. (cmb)
- XML:
. Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after
exception). (nielsdos)
26 Sep 2024, PHP 8.2.24
- CGI:
. Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
Vulnerability). (CVE-2024-8926) (nielsdos)
. Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
bypassable due to the environment variable collision). (CVE-2024-8927)
(nielsdos)
- Core:
. Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
(zeriyoshi)
. Fixed bug GH-15515 (Configure error grep illegal option q). (Peter Kokot)
. Fixed bug GH-15514 (Configure error: genif.sh: syntax error). (Peter Kokot)
. Fixed bug GH-15565 (--disable-ipv6 during compilation produces error
EAI_SYSTEM not found). (nielsdos)
. Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
(Bernd Kuhls, Thomas Petazzoni)
. Fixed bug GH-15330 (Do not scan generator frames more than once). (Arnaud)
. Fixed uninitialized lineno in constant AST of internal enums. (ilutov)
- Curl:
. FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
(David Carlier)
- DOM:
. Fixed bug GH-15551 (Segmentation fault (access null pointer) in
ext/dom/xml_common.h). (nielsdos)
- Fileinfo:
. Fixed bug GH-15752 (Incorrect error message for finfo_file
with an empty filename argument). (DanielEScherzer)
- FPM:
. Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered).
(CVE-2024-9026) (Jakub Zelenka)
- MySQLnd:
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
Kamil Tekiela)
- Opcache:
. Fixed bug GH-15661 (Access null pointer in
Zend/Optimizer/zend_inference.c). (nielsdos)
. Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
(nielsdos)
- SAPI:
. Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
(CVE-2024-8925) (Arnaud)
- SOAP:
. Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP
headers in array form). (nielsdos)
- Standard:
. Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb)
- Streams:
. Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
(cmb)
29 Aug 2024, PHP 8.2.23
- Core:
. Fixed bug GH-15020 (Memory leak in Zend/Optimizer/escape_analysis.c).
(nielsdos)
. Fixed bug GH-15023 (Memory leak in Zend/zend_ini.c). (nielsdos)
. Fixed bug GH-13330 (Append -Wno-implicit-fallthrough flag conditionally).
(Peter Kokot)
. Fix uninitialized memory in network.c. (nielsdos)
. Fixed bug GH-15108 (Segfault when destroying generator during shutdown).
(Arnaud)
. Fixed bug GH-15275 (Crash during GC of suspended generator delegate).
(Arnaud)
- Curl:
. Fixed case when curl_error returns an empty string.
(David Carlier)
- DOM:
. Fix UAF when removing doctype and using foreach iteration. (nielsdos)
- FFI:
. Fixed bug GH-14286 (ffi enum type (when enum has no name) make memory
leak). (nielsdos, dstogov)
- Hash:
. Fix crash when converting array data for array in shm in xxh3. (nielsdos)
- Intl:
. Fixed bug GH-15087 (IntlChar::foldCase()'s $option is not optional). (cmb)
- Opcache:
. Fixed bug GH-13817 (Segmentation fault for enabled observers after pass 4).
(Bob)
. Fixed bug GH-13775 (Memory leak possibly related to opcache SHM placement).
(Arnaud, nielsdos)
- Output:
. Fixed bug GH-15179 (Segmentation fault (null pointer dereference) in
ext/standard/url_scanner_ex.re). (nielsdos)
- PDO_Firebird:
. Fix bogus fallthrough path in firebird_handle_get_attribute(). (nielsdos)
- PHPDBG:
. Fixed bug GH-13199 (EOF emits redundant prompt in phpdbg local console mode
with libedit/readline). (Peter Kokot)
. Fixed bug GH-15268 (heap buffer overflow in phpdbg
(zend_hash_num_elements() Zend/zend_hash.h)). (nielsdos)
. Fixed bug GH-15210 use-after-free on watchpoint allocations. (nielsdos)
- Random:
. Fixed part of bug GH-15381, checking getrandom availability on solaris.
(David Carlier)
- Soap:
. Fixed bug #55639 (Digest autentication dont work). (nielsdos)
. Fix SoapFault property destruction. (nielsdos)
. Fixed bug GH-15252 (SOAP XML broken since PHP 8.3.9 when using classmap
constructor option). (nielsdos)
- Standard:
. Fix passing non-finite timeout values in stream functions. (nielsdos)
. Fixed GH-14780 p(f)sockopen timeout overflow. (David Carlier)
. Fixed GH-15653 overflow on fgetcsv length parameter. (David Carlier)
- Streams:
. Fixed bug GH-15028 (Memory leak in ext/phar/stream.c). (nielsdos)
. Fixed bug GH-15034 (Integer overflow on stream_notification_callback
byte_max parameter with files bigger than 2GB). (nielsdos)
- Tidy:
. Fix memory leaks in ext/tidy basedir restriction code. (nielsdos)
01 Aug 2024, PHP 8.2.22
- Core:
. Fixed bug GH-13922 (Fixed support for systems with
sysconf(_SC_GETPW_R_SIZE_MAX) == -1). (Arnaud)
. Fixed bug GH-14626 (Fix is_zend_ptr() for huge blocks). (Arnaud)
. Fixed bug GH-14590 (Memory leak in FPM test gh13563-conf-bool-env.phpt.
(nielsdos)
. Fixed OSS-Fuzz #69765. (nielsdos)
. Fixed bug GH-14741 (Segmentation fault in Zend/zend_types.h). (nielsdos)
. Fixed bug GH-14969 (Use-after-free in property coercion with __toString()).
(ilutov)
. Fixed bug GH-14961 (Comment between -> and keyword results in parse error).
(ilutov)
- Dom:
. Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)
- Gd:
. ext/gd/tests/gh10614.phpt: skip if no PNG support. (orlitzky)
. restored warning instead of fata error. (dryabov)
- LibXML:
. Fixed bug GH-14563 (Build failure with libxml2 v2.13.0). (nielsdos)
- Opcache:
. Fixed bug GH-14550 (No warning message when Zend DTrace is enabled that
opcache.jit is implictly disabled). (nielsdos)
- Output:
. Fixed bug GH-14808 (Unexpected null pointer in Zend/zend_string.h with
empty output buffer). (nielsdos)
- PDO:
. Fixed bug GH-14712 (Crash with PDORow access to null property).
(David Carlier)
- Phar:
. Fixed bug GH-14603 (null string from zip entry).
(David Carlier)
- PHPDBG:
. Fixed bug GH-14596 (crashes with ASAN and ZEND_RC_DEBUG=1).
(David Carlier)
. Fixed bug GH-14553 (echo output trimmed at NULL byte). (nielsdos)
- Shmop:
. Fixed bug GH-14537 (shmop Windows 11 crashes the process). (nielsdos)
- SimpleXML:
. Fixed bug GH-14638 (null dereference after XML parsing failure).
(David Carlier)
- SPL:
. Fixed bug GH-14639 (Member access within null pointer in
ext/spl/spl_observer.c). (nielsdos)
- Standard:
. Fix 32-bit wordwrap test failures. (orlitzky)
. Fixed bug GH-14774 (time_sleep_until overflow). (David Carlier)
- Tidy:
. Fix memory leak in tidy_repair_file(). (nielsdos)
- Treewide:
. Fix compatibility with libxml2 2.13.2. (nielsdos)
- XML:
. Move away from to-be-deprecated libxml fields. (nielsdos)
. Fixed bug GH-14834 (Error installing PHP when --with-pear is used).
(nielsdos)
04 Jul 2024, PHP 8.2.21
- Core:
. Fixed bug GH-14315 (Incompatible pointer type warnings). (Peter Kokot)
. Fixed bug GH-12814 (max_execution_time reached too early on MacOS 14
when running on Apple Silicon). (Manuel Kress)
. Fixed bug GH-14387 (Crash when stack walking in destructor of yielded from
values during Generator->throw()). (Bob)
. Fixed bug GH-14456 (Attempting to initialize class with private constructor
calls destructor). (Girgias)
. Fixed bug GH-14549 (Incompatible function pointer type for fclose).
(Ryan Carsten Schmidt)
- BCMath:
. Fixed bug (bcpowmod() with mod = -1 returns 1 when it must be 0). (Girgias)
- Curl:
. Fixed bug GH-14307 (Test curl_basic_024 fails with curl 8.8.0). (nielsdos)
- DOM:
. Fixed bug GH-14343 (Memory leak in xml and dom). (nielsdos)
- FPM:
. Fixed bug GH-14037 (PHP-FPM ping.path and ping.response config vars are
ignored in status pool). (Wilhansen Li, Pierrick Charron)
- GD:
. Fix parameter numbers for imagecolorset(). (Giovanni Giacobbi)
- Intl:
. Fix reference handling in SpoofChecker. (nielsdos)
- MySQLnd:
. Partially fix bug GH-10599 (Apache crash on Windows when using a
self-referencing anonymous function inside a class with an active
mysqli connection). (nielsdos)
- Opcache:
. Fixed bug GH-14267 (opcache.jit=off does not allow enabling JIT at runtime).
(ilutov)
. Fixed TLS access in JIT on FreeBSD/amd64. (Arnaud)
. Fixed bug GH-11188 (Error when building TSRM in ARM64). (nielsdos)
- PDO ODBC:
. Fixed bug GH-14367 (incompatible SDWORD type with iODBC). (Calvin Buckley)
- PHPDBG:
. Fixed bug GH-13681 (segfault on watchpoint addition failure). (David Carlier)
- Soap:
. Fixed bug #47925 (PHPClient can't decompress response). (nielsdos)
. Fix missing error restore code. (nielsdos)
. Fix memory leak if calling SoapServer::setObject() twice. (nielsdos)
. Fix memory leak if calling SoapServer::setClass() twice. (nielsdos)
. Fix reading zlib ini settings in ext-soap. (nielsdos)
. Fix memory leaks with string function name lookups. (nielsdos)
. Fixed bug #69280 (SoapClient classmap doesn't support fully qualified class
name). (nielsdos)
. Fixed bug #76232 (SoapClient Cookie Header Semicolon). (nielsdos)
. Fixed memory leaks when calling SoapFault::__construct() twice. (Girgias)
- Sodium:
. Fix memory leaks in ext/sodium on failure of some functions. (nielsdos)
- SPL:
. Fixed bug GH-14290 (Member access within null pointer in extension spl).
(nielsdos)
- Standard:
. Fixed bug GH-14483 (Fixed off-by-one error in checking length of abstract
namespace Unix sockets). (Derick)
- Streams:
. Fixed bug GH-11078 (PHP Fatal error triggers pointer being freed was not
allocated and malloc: double free for ptr errors). (nielsdos)
06 Jun 2024, PHP 8.2.20
- CGI:
. Fixed buffer limit on Windows, replacing read call usage by _read.
(David Carlier)
. Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
in PHP-CGI). (CVE-2024-4577) (nielsdos)
- CLI:
. Fixed bug GH-14189 (PHP Interactive shell input state incorrectly handles
quoted heredoc literals.). (nielsdos)
- Core:
. Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for
non-compile-time expressions). (ilutov)
. Fixed bug GH-14140 (Floating point bug in range operation on Apple Silicon
hardware). (Derick, Saki)
- DOM:
. Fix crashes when entity declaration is removed while still having entity
references. (nielsdos)
. Fix references not handled correctly in C14N. (nielsdos)
. Fix crash when calling childNodes next() when iterator is exhausted.
(nielsdos)
. Fix crash in ParentNode::append() when dealing with a fragment
containing text nodes. (nielsdos)
- FFI:
. Fixed bug GH-14215 (Cannot use FFI::load on CRLF header file with
apache2handler). (nielsdos)
- Filter:
. Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL).
(CVE-2024-5458) (nielsdos)
- FPM:
. Fix bug GH-14175 (Show decimal number instead of scientific notation in
systemd status). (Benjamin Cremer)
- Hash:
. ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__`
(Saki Takamachi)
- Intl:
. Fixed build regression on systems without C++17 compilers. (Calvin Buckley,
Peter Kokot)
- Ini:
. Fixed bug GH-14100 (Corrected spelling mistake in php.ini files).
(Marcus Xavier)
- MySQLnd:
. Fix bug GH-14255 (mysqli_fetch_assoc reports error from
nested query). (Kamil Tekiela)
- Opcache:
. Fixed bug GH-14109 (Fix accidental persisting of internal class constant in
shm). (ilutov)
- OpenSSL:
. The openssl_private_decrypt function in PHP, when using PKCS1 padding
(OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack
unless it is used with an OpenSSL version that includes the changes from this pull
request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection).
These changes are part of OpenSSL 3.2 and have also been backported to stable
versions of various Linux distributions, as well as to the PHP builds provided for
Windows since the previous release. All distributors and builders should ensure that
this version is used to prevent PHP from being vulnerable. (CVE-2024-2408)
- Standard:
. Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874).
(CVE-2024-5585) (nielsdos)
- XML:
. Fixed bug GH-14124 (Segmentation fault with XML extension under certain
memory limit). (nielsdos)
- XMLReader:
. Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos)
09 May 2024, PHP 8.2.19
- Core:
. Fixed bug GH-13772 (Invalid execute_data->opline pointers in observer fcall
handlers when JIT is enabled). (Bob)
. Fixed bug GH-13931 (Applying zero offset to null pointer in
Zend/zend_opcode.c). (nielsdos)
. Fixed bug GH-13942 (Align the behavior of zend-max-execution-timers with
other timeout implementations). (Kévin Dunglas)
. Fixed bug GH-14003 (Broken cleanup of unfinished calls with callable convert
parameters). (ilutov)
. Fixed bug GH-14013 (Erroneous dnl appended in configure). (Peter Kokot)
. Fixed bug GH-10232 (If autoloading occurs during constant resolution
filename and lineno are identified incorrectly). (ranvis)
. Fixed bug GH-13727 (Missing void keyword). (Peter Kokot)
- Fibers:
. Fixed bug GH-13903 (ASAN false positive underflow when executing copy()).
(nielsdos)
- FPM:
. Fixed bug GH-13563 (Setting bool values via env in FPM config fails).
(Jakub Zelenka)
- Intl:
. Fixed build for icu 74 and onwards. (dunglas)
- MySQLnd:
. Fix shift out of bounds on 32-bit non-fast-path platforms. (nielsdos)
- Opcache:
. Fixed incorrect assumptions across compilation units for static calls.
(ilutov)
- OpenSSL:
. Fixed bug GH-10495 (feof on OpenSSL stream hangs indefinitely).
(Jakub Zelenka)
- PDO SQLite:
. Fix GH-13984 (Buffer size is now checked before memcmp). (Saki Takamachi)
. Fix GH-13998 (Manage refcount of agg_context->val correctly).
(Saki Takamachi)
- Phar:
. Fixed bug GH-13836 (Renaming a file in a Phar to an already existing
filename causes a NULL pointer dereference). (nielsdos)
. Fixed bug GH-13833 (Applying zero offset to null pointer in zend_hash.c).
(nielsdos)
. Fix potential NULL pointer dereference before calling EVP_SignInit. (icy17)
- PHPDBG:
. Fixed bug GH-13827 (Null pointer access of type 'zval' in phpdbg_frame).
(nielsdos)
- Posix:
. Fix usage of reentrant functions in ext/posix. (Arnaud)
- Session:
. Fixed bug GH-13856 (Member access within null pointer of type 'ps_files' in
ext/session/mod_files.c). (nielsdos)
. Fixed bug GH-13891 (memleak and segfault when using ini_set with
session.trans_sid_hosts). (nielsdos, kamil-tekiela)
. Fixed buffer _read/_write size limit on windows for the file mode. (David Carlier)
- Streams:
. Fixed file_get_contents() on Windows fails with "errno=22 Invalid
argument". (Damian Wójcik)
. Fixed bug GH-13264 (Part 1 - Memory leak on stream filter failure).
(Jakub Zelenka)
. Fixed bug GH-13860 (Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case in
ext/openssl/xp_ssl.c - causing use of dead socket). (nielsdos)
. Fixed bug GH-11678 (Build fails on musl 1.2.4 - lfs64). (Arnaud)
- Treewide:
. Fix gcc-14 Wcalloc-transposed-args warnings. (Cristian Rodríguez)
11 Apr 2024, PHP 8.2.18
- Core:
. Fixed bug GH-13612 (Corrupted memory in destructor with weak references).
(nielsdos)
. Fixed bug GH-13784 (AX_GCC_FUNC_ATTRIBUTE failure). (Remi)
. Fixed bug GH-13670 (GC does not scale well with a lot of objects created in
destructor). (Arnaud)
- DOM:
. Add some missing ZPP checks. (nielsdos)
. Fix potential memory leak in XPath evaluation results. (nielsdos)
. Fix phpdoc for DOMDocument load methods. (VincentLanglet)
- FPM
. Fixed incorrect check in fpm_shm_free(). (nielsdos)
- GD:
. Fixed bug GH-12019 (add GDLIB_CFLAGS in feature tests). (Michael Orlitzky)
- Gettext:
. Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5
with category set to LC_ALL. (David Carlier)
- MySQLnd:
. Fix GH-13452 (Fixed handshake response [mysqlnd]). (Saki Takamachi)
. Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)
- Opcache:
. Fixed GH-13508 (JITed QM_ASSIGN may be optimized out when op1 is null).
(Arnaud, Dmitry)
. Fixed GH-13712 (Segmentation fault for enabled observers when calling trait
method of internal trait when opcache is loaded). (Bob)
- PDO:
. Fix various PDORow bugs. (Girgias)
- Random:
. Fixed bug GH-13544 (Pre-PHP 8.2 compatibility for mt_srand with unknown
modes). (timwolla)
. Fixed bug GH-13690 (Global Mt19937 is not properly reset in-between
requests when MT_RAND_PHP is used). (timwolla)
- Session:
. Fixed bug GH-13680 (Segfault with session_decode and compilation error).
(nielsdos)
- Sockets:
. Fixed bug GH-13604 (socket_getsockname returns random characters in the end
of the socket name). (David Carlier)
- SPL:
. Fixed bug GH-13531 (Unable to resize SplfixedArray after being unserialized
in PHP 8.2.15). (nielsdos)
. Fixed bug GH-13685 (Unexpected null pointer in zend_string.h). (nielsdos)
- Standard:
. Fixed bug GH-11808 (Live filesystem modified by tests). (nielsdos)
. Fixed GH-13402 (Added validation of `\n` in $additional_headers of mail()).
(SakiTakamachi)
. Fixed bug GH-13203 (file_put_contents fail on strings over 4GB on Windows).
(divinity76)
. Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command
parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
. Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to
partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
. Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)
- XML:
. Fixed bug GH-13517 (Multiple test failures when building with
--with-expat). (nielsdos)
14 Mar 2024, PHP 8.2.17
- Core:
. Fix ZTS persistent resource crashes on shutdown. (nielsdos)
- Curl:
. Fix failing tests due to string changes in libcurl 8.6.0. (Ayesh)
- DOM:
. Fix reference access in dimensions for DOMNodeList and DOMNodeMap.
(nielsdos)
- Fileinfo:
. Fixed bug GH-13344 (finfo::buffer(): Failed identify data 0:(null),
backport). (nielsdos)
- FPM:
. Fixed bug #75712 (getenv in php-fpm should not read $_ENV, $_SERVER).
(Jakub Zelenka)
- GD:
. Fixed bug GH-12019 (detection of image formats in system gd library).
(Michael Orlitzky)
- MySQLnd:
. Fixed bug GH-11950 ([mysqlnd] Fixed not to set CR_MALFORMED_PACKET to error
if CR_SERVER_GONE_ERROR is already set). (Saki Takamachi)
- PGSQL:
. Fixed bug GH-13354 (pg_execute/pg_send_query_params/pg_send_execute
with null value passed by reference). (George Barbarosie)
- Standard:
. Fixed array key as hash to string (case insensitive) comparison typo
for the second operand buffer size (albeit unused for now). (A. Slepykh)
15 Feb 2024, PHP 8.2.16
- Core:
. Fixed timer leak in zend-max-execution-timers builds. (withinboredom)
. Fixed bug GH-12349 (linking failure on ARM with mold). (Jan Palus)
. Fixed bug GH-13097 (Anonymous class reference in trigger_error / thrown
Exception). (nielsdos)
. Fixed bug GH-13215 (GCC 14 build failure). (Remi)
- Curl:
. Fix missing error check in curl_multi_init(). (divinity76)
- FPM:
. Fixed bug GH-12996 (Incorrect SCRIPT_NAME with Apache ProxyPassMatch when
plus in path). (Jakub Zelenka)
- GD:
. Fixed bug GH-10344 (imagettfbbox(): Could not find/open font UNC path).
(nielsdos)
. Fixed bug GH-10614 (imagerotate will turn the picture all black, when
rotated 90). (nielsdos)
- MySQLnd:
. Fixed bug GH-12107 (When running a stored procedure (that returns a result
set) twice, PHP crashes). (nielsdos)
- Opcache:
. Fixed bug GH-13232 (Segmentation fault will be reported when JIT is off but
JIT_debug is still on). (nielsdos)
- OpenSSL:
. Fixed LibreSSL undefined reference when OPENSSL_NO_ENGINE not set.
(David Carlier).
- PDO_Firebird:
. Fix GH-13119 (Changed to convert float and double values into strings using
`H` format). (SakiTakamachi)
- Phar:
. Fixed bug #71465 (PHAR doesn't know about litespeed). (nielsdos)
. Fixed bug GH-13037 (PharData incorrectly extracts zip file). (nielsdos)
- Random:
. Fixed bug GH-13138 (Randomizer::pickArrayKeys() does not detect broken
engines). (timwolla)
- Session:
. Fixed bug GH-12504 (Corrupted session written when there's a fatal error
in autoloader). (nielsdos)
- Streams:
. Fixed bug GH-13071 (Copying large files using mmap-able source streams may
exhaust available memory and fail). (nielsdos)
18 Jan 2024, PHP 8.2.15
- Core:
. Fixed bug GH-12953 (false positive SSA integrity verification failed when
loading composer classmaps with more than 11k elements). (nielsdos)
. Fixed bug GH-12966 (missing cross-compiling 3rd argument so Autoconf doesn't
emit warnings). (Peter Kokot)
. Fixed bug GH-13727 (missing void keyword for C generate code for feature test).
(Peter Kokot/David Carlier)
- Cli:
. Fix incorrect timeout in built-in web server when using router script and
max_input_time. (ilutov)
- FFI:
. Fixed bug GH-9698 (stream_wrapper_register crashes with FFI\CData).
(Jakub Zelenka)
. Fixed bug GH-12905 (FFI::new interacts badly with observers). (nielsdos)
- GD:
. Fixed GH-13082 undefined behavior with GdFont instances handling with
imageload* and imagechar*. (David Carlier)
- Intl:
. Fixed GH-12943 (IntlDateFormatter::__construct accepts 'C' as valid locale).
(David Carlier)
- Hash:
. Fixed bug GH-12936 (hash() function hangs endlessly if using sha512 on
strings >= 4GiB). (nielsdos)
- ODBC:
. Fix crash on Apache shutdown with persistent connections. (nielsdos)
- Opcache:
. Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM
with NULL when DIM is the same var as result). (ilutov)
. Added workaround for SELinux mprotect execheap issue.
See https://bugzilla.kernel.org/show_bug.cgi?id=218258. (ilutov)
- OpenSSL:
. Fixed bug GH-12987 (openssl_csr_sign might leak new cert on error).
(Jakub Zelenka)
- PDO:
. Fix GH-12969 (Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES).
(SakiTakamachi)
- PDO_ODBC:
. Fixed bug GH-12767 (Unable to turn on autocommit mode with setAttribute()).
(SakiTakamachi)
- PGSQL:
. Fixed auto_reset_persistent handling and allow_persistent type. (David Carlier)
. Fixed bug GH-12974 (Apache crashes on shutdown when using pg_pconnect()).
(nielsdos)
- Phar:
. Fixed bug #77432 (Segmentation fault on including phar file). (nielsdos)
- PHPDBG:
. Fixed bug GH-12962 (Double free of init_file in phpdbg_prompt.c). (nielsdos)
- SimpleXML:
. Fix getting the address of an uninitialized property of a SimpleXMLElement
resulting in a crash. (nielsdos)
- Tidy:
. Fixed bug GH-12980 (tidynode.props.attribute is missing
"Boolean Attributes" and empty attributes). (nielsdos)
21 Dec 2023, PHP 8.2.14
- Core:
. Fixed oss-fuzz #54325 (Use-after-free of name in var-var with malicious
error handler). (ilutov)
. Fixed oss-fuzz #64209 (In-place modification of filename in
php_message_handler_for_zend). (ilutov)
. Fixed bug GH-12758 / GH-12768 (Invalid opline in OOM handlers within
ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC). (Florian Engelhardt)
. Fix various missing NULL checks. (nielsdos, dstogov)
. Fixed bug GH-12835 (Leak of call->extra_named_params on internal __call).
(ilutov)
- Date:
. Fixed improbably integer overflow while parsing really large (or small)
Unix timestamps. (Derick)
- DOM:
. Fixed bug GH-12616 (DOM: Removing XMLNS namespace node results in invalid
default: prefix). (nielsdos)
- FPM:
. Fixed bug GH-12705 (Segmentation fault in fpm_status_export_to_zval).
(Patrick Prasse)
- FTP:
. Fixed bug GH-9348 (FTP & SSL session reuse). (nielsdos)
- Intl:
. Fixed bug GH-12635 (Test bug69398.phpt fails with ICU 74.1). (nielsdos)
- LibXML:
. Fixed bug GH-12702 (libxml2 2.12.0 issue building from src). (nono303)
. Fixed test failures for libxml2 2.12.0. (nielsdos)
- MySQLnd:
. Avoid using uninitialised struct. (mikhainin)
. Fixed bug GH-12791 (Possible dereference of NULL in MySQLnd debug code).
(nielsdos)
- Opcache:
. Fixed JIT bug (Function JIT emits "Uninitialized string offset" warning
at the same time as invalid offset Error). (Girgias)
. Fixed JIT bug (JIT emits "Attempt to assign property of non-object"
warning at the same time as Error is being thrown). (Girgias)
- OpenSSL:
. Fixed bug #50713 (openssl_pkcs7_verify() may ignore untrusted CAs).
(Jakub Zelenka)
- PCRE:
. Fixed bug GH-12628 (The gh11374 test fails on Alpinelinux). (nielsdos)
- PDO PGSQL:
. Fixed the default value of $fetchMode in PDO::pgsqlGetNotify() (kocsismate)
- PGSQL:
. Fixed bug GH-12763 wrong argument type for pg_untrace. (degtyarov)
- PHPDBG:
. Fixed bug GH-12675 (MEMORY_LEAK in phpdbg_prompt.c). (nielsdos)
- SOAP:
. Fixed bug GH-12838 ([SOAP] Temporary WSDL cache files not being deleted).
(nielsdos)
- SPL:
. Fixed bug GH-12721 (SplFileInfo::getFilename() segfault in combination
with GlobIterator and no directory separator). (nielsdos)
- SQLite3:
. Fixed bug GH-12633 (sqlite3_defensive.phpt fails with sqlite 3.44.0).
(SakiTakamachi)
- Standard:
. Fix memory leak in syslog device handling. (danog)
. Fixed bug GH-12621 (browscap segmentation fault when configured in the
vhost). (nielsdos)
. Fixed bug GH-12655 (proc_open() does not take into account references
in the descriptor array). (nielsdos)
- Streams:
. Fixed bug #79945 (Stream wrappers in imagecreatefrompng causes segfault).
(Jakub Zelenka)
- Zip:
. Fixed bug GH-12661 (Inconsistency in ZipArchive::addGlob remove_path Option
Behavior). (Remi)
23 Nov 2023, PHP 8.2.13
- Core:
. Fixed double-free of non-interned enum case name. (ilutov)
. Fixed bug GH-12457 (Incorrect result of stripos with single character
needle). (SakiTakamachi)
. Fixed bug GH-12468 (Double-free of doc_comment when overriding static
property via trait). (ilutov)
. Fixed segfault caused by weak references to FFI objects. (sj-i)
. Fixed max_execution_time: don't delete an unitialized timer. (Kévin Dunglas)
. Fixed bug GH-12558 (Arginfo soft-breaks with namespaced class return type
if the class name starts with N). (kocsismate)
- DOM:
. Fix registerNodeClass with abstract class crashing. (nielsdos)
. Add missing NULL pointer error check. (icy17)
. Fix validation logic of php:function() callbacks. (nielsdos)
- Fiber:
. Fixed bug GH-11121 (ReflectionFiber segfault). (danog, trowski, bwoebi)
- FPM:
. Fixed bug GH-9921 (Loading ext in FPM config does not register module
handlers). (Jakub Zelenka)
. Fixed bug GH-12232 (FPM: segfault dynamically loading extension without
opcache). (Jakub Zelenka)
. Fixed bug #76922 (FastCGI terminates conn after FCGI_GET_VALUES).
(Jakub Zelenka)
- Intl:
. Removed the BC break on IntlDateFormatter::construct which threw an
exception with an invalid locale. (David Carlier)
- Opcache:
. Added warning when JIT cannot be enabled. (danog)
. Fixed bug GH-8143 (Crashes in zend_accel_inheritance_cache_find since
upgrading to 8.1.3 due to corrupt on-disk file cache). (turchanov)
- OpenSSL:
. Fixed bug GH-12489 (Missing sigbio creation checking in openssl_cms_verify).
(Jakub Zelenka)
- PCRE:
. Fixed bug GH-11374 (Backport upstream fix, Different preg_match result
with -d pcre.jit=0). (mvorisek)
- SOAP:
. Fixed bug GH-12392 (Segmentation fault on SoapClient::__getTypes).
(nielsdos)
. Fixed bug #66150 (SOAP WSDL cache race condition causes Segmentation
Fault). (nielsdos)
. Fixed bug #67617 (SOAP leaves incomplete cache file on ENOSPC). (nielsdos)
. Fix incorrect uri check in SOAP caching. (nielsdos)
. Fix segfault and assertion failure with refcounted props and arrays.
(nielsdos)
. Fix potential crash with an edge case of persistent encoders. (nielsdos)
. Fixed bug #75306 (Memleak in SoapClient). (nielsdos)
- Streams:
. Fixed bug #75708 (getimagesize with "&$imageinfo" fails on StreamWrappers).
(Jakub Zelenka)
- XMLReader:
. Add missing NULL pointer error check. (icy17)
- XMLWriter:
. Add missing NULL pointer error check. (icy17)
- XSL:
. Add missing module dependency. (nielsdos)
. Fix validation logic of php:function() callbacks. (nielsdos)
26 Oct 2023, PHP 8.2.12
- Core:
. Fixed bug GH-12207 (memory leak when class using trait with doc block).
(rioderelfte)
. Fixed bug GH-12215 (Module entry being overwritten causes type errors in
ext/dom). (nielsdos)
. Fixed bug GH-12273 (__builtin_cpu_init check). (Freaky)
. Fixed bug #80092 (ZTS + preload = segfault on shutdown). (nielsdos)
- CLI:
. Ensure a single Date header is present. (coppolafab)
- CType:
. Fixed bug GH-11997 (ctype_alnum 5 times slower in PHP 8.1 or greater).
(nielsdos)
- DOM:
. Restore old namespace reconciliation behaviour. (nielsdos)
. Fixed bug GH-8996 (DOMNode serialization on PHP ^8.1). (nielsdos)
- Fileinfo:
. Fixed bug GH-11891 (fileinfo returns text/xml for some svg files). (usarise)
- Filter:
. Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK (ilutov)
- Hash:
. Fixed bug GH-12186 (segfault copying/cloning a finalized HashContext).
(MaxSem)
- Intl:
. Fixed bug GH-12243 (segfault on IntlDateFormatter::construct).
(David Carlier)
. Fixed bug GH-12282 (IntlDateFormatter::construct should throw an exception
on an invalid locale). (David Carlier)
- MySQLnd:
. Fixed bug GH-12297 (PHP Startup: Invalid library (maybe not a PHP library)
'mysqlnd.so' in Unknown on line). (nielsdos)
- Opcache:
. Fixed opcache_invalidate() on deleted file. (mikhainin)
. Fixed bug GH-12380 (JIT+private array property access inside closure
accesses private property in child class). (nielsdos)
- PCRE:
. Fixed bug GH-11956 (Backport upstream fix, PCRE regular expressions with
JIT enabled gives different result). (nielsdos)
- SimpleXML:
. Fixed bug GH-12170 (Can't use xpath with comments in SimpleXML). (nielsdos)
. Fixed bug GH-12223 (Entity reference produces infinite loop in
var_dump/print_r). (nielsdos)
. Fixed bug GH-12167 (Unable to get processing instruction contents in
SimpleXML). (nielsdos)
. Fixed bug GH-12169 (Unable to get comment contents in SimpleXML).
(nielsdos)
- Streams:
. Fixed bug GH-12190 (binding ipv4 address with both address and port at 0).
(David Carlier)
- XML:
. Fix return type of stub of xml_parse_into_struct(). (nielsdos)
. Fix memory leak when calling xml_parse_into_struct() twice. (nielsdos)
- XSL:
. Fix type error on XSLTProcessor::transformToDoc return value with
SimpleXML. (nielsdos)
28 Sep 2023, PHP 8.2.11
- Core:
. Fixed bug GH-11937 (Constant ASTs containing objects). (ilutov)
. Fixed bug GH-11790 (On riscv64 require libatomic if actually needed).
(Jeremie Courreges-Anglas)
. Fixed bug GH-11876: ini_parse_quantity() accepts invalid quantities.
(Girgias)
. Fixed bug GH-12073 (Segfault when freeing incompletely initialized
closures). (ilutov)
. Fixed bug GH-12060 (Internal iterator rewind handler is called twice).
(ju1ius)
. Fixed bug GH-12102 (Incorrect compile error when using array access on TMP
value in function call). (ilutov)
- DOM:
. Fix memory leak when setting an invalid DOMDocument encoding. (nielsdos)
- Iconv:
. Fixed build for NetBSD which still uses the old iconv signature.
(David Carlier)
- Intl:
. Fixed bug GH-12020 (intl_get_error_message() broken after
MessageFormatter::formatMessage() fails). (Girgias)
- MySQLnd:
. Fixed bug GH-10270 (Invalid error message when connection via SSL fails:
"trying to connect via (null)"). (Kamil Tekiela)
- ODBC:
. Fixed memory leak with failed SQLPrepare. (NattyNarwhal)
. Fixed persistent procedural ODBC connections not getting closed.
(NattyNarwhal)
- SimpleXML:
. Fixed bug #52751 (XPath processing-instruction() function is not
supported). (nielsdos)
- SPL:
. Fixed bug GH-11972 (RecursiveCallbackFilterIterator regression in 8.1.18).
(nielsdos)
- SQLite3:
. Fixed bug GH-11878 (SQLite3 callback functions cause a memory leak with
a callable array). (nielsdos, arnaud-lb)
31 Aug 2023, PHP 8.2.10
- CLI:
. Fixed bug GH-11716 (cli server crashes on SIGINT when compiled with
ZEND_RC_DEBUG=1). (nielsdos)
. Fixed bug GH-10964 (Improve man page about the built-in server).
(Alexandre Daubois)
- Date:
. Fixed bug GH-11416 (Crash with DatePeriod when uninitialised objects are
passed in). (Derick)
- Core:
. Fixed strerror_r detection at configuration time. (Kévin Dunglas)
. Fixed trait typed properties using a DNF type not being correctly bound.
(Girgias)
. Fixed trait property types not being arena allocated if copied from
an internal trait. (Girgias)
. Fixed deep copy of property DNF type during lazy class load.
(Girgias, ilutov)
. Fixed memory freeing of DNF types for non arena allocated types.
(Girgias, ju1ius)
- DOM:
. Fix DOMEntity field getter bugs. (nielsdos)
. Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.
(nielsdos)
. Fix DOMCharacterData::replaceWith() with itself. (nielsdos)
. Fix empty argument cases for DOMParentNode methods. (nielsdos)
. Fixed bug GH-11791 (Wrong default value of DOMDocument::xmlStandalone).
(nielsdos)
. Fix json_encode result on DOMDocument. (nielsdos)
. Fix manually calling __construct() on DOM classes. (nielsdos)
. Fixed bug GH-11830 (ParentNode methods should perform their checks
upfront). (nielsdos)
. Fix viable next sibling search for replaceWith. (nielsdos)
. Fix segfault when DOMParentNode::prepend() is called when the child
disappears. (nielsdos)
- FFI:
. Fix leaking definitions when using FFI::cdef()->new(...). (ilutov)
- Hash:
. Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options
parameter in signature. (ilutov)
- MySQLnd:
. Fixed bug GH-11440 (authentication to a sha256_password account fails over
SSL). (nielsdos)
. Fixed bug GH-11438 (mysqlnd fails to authenticate with sha256_password
accounts using passwords longer than 19 characters).
(nielsdos, Kamil Tekiela)
. Fixed bug GH-11550 (MySQL Statement has a empty query result when
the response field has changed, also Segmentation fault).
(Yurunsoft)
. Fixed invalid error message "Malformed packet" when connection is dropped.
(Kamil Tekiela)
- Opcache:
. Fixed bug GH-11715 (opcache.interned_strings_buffer either has no effect or
opcache_get_status() / phpinfo() is wrong). (nielsdos)
. Avoid adding an unnecessary read-lock when loading script from shm if
restart is in progress. (mikhainin)
- PCNTL:
. Revert behaviour of receiving SIGCHLD signals back to the behaviour
before 8.1.22. (nielsdos)
- SPL:
. Fixed bug #81992 (SplFixedArray::setSize() causes use-after-free).
(nielsdos)
- Standard:
. Prevent int overflow on $decimals in number_format. (Marc Bennewitz)
. Fixed bug GH-11870 (Fix off-by-one bug when truncating tempnam prefix)
(athos-ribeiro)
03 Aug 2023, PHP 8.2.9
- Build:
. Fixed bug GH-11522 (PHP version check fails with '-' separator).
(SVGAnimate)
- CLI:
. Fix interrupted CLI output causing the process to exit. (nielsdos)
- Core:
. Fixed oss-fuzz #60011 (Mis-compilation of by-reference nullsafe operator).
(ilutov)
. Fixed line number of JMP instruction over else block. (ilutov)
. Fixed use-of-uninitialized-value with ??= on assert. (ilutov)
. Fixed oss-fuzz #60411 (Fix double-compilation of arrow-functions). (ilutov)
. Fixed build for FreeBSD before the 11.0 releases. (David Carlier)
- Curl:
. Fix crash when an invalid callback function is passed to
CURLMOPT_PUSHFUNCTION. (nielsdos)
- Date:
. Fixed bug GH-11368 (Date modify returns invalid datetime). (Derick)
. Fixed bug GH-11600 (Can't parse time strings which include (narrow)
non-breaking space characters). (Derick)
. Fixed bug GH-11854 (DateTime:createFromFormat stopped parsing datetime with
extra space). (nielsdos, Derick)
- DOM:
. Fixed bug GH-11625 (DOMElement::replaceWith() doesn't replace node with
DOMDocumentFragment but just deletes node or causes wrapping <></>
depending on libxml2 version). (nielsdos)
- Fileinfo:
. Fixed bug GH-11298 (finfo returns wrong mime type for xz files). (Anatol)
- FTP:
. Fix context option check for "overwrite". (JonasQuinten)
. Fixed bug GH-10562 (Memory leak and invalid state with consecutive
ftp_nb_fget). (nielsdos)
- GD:
. Fix most of the external libgd test failures. (Michael Orlitzky)
- Intl:
. Fix memory leak in MessageFormatter::format() on failure. (Girgias)
- Libxml:
. Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading
in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)
- MBString:
. Fix GH-11300 (license issue: restricted unicode license headers).
(nielsdos)
- Opcache:
. Fixed bug GH-10914 (OPCache with Enum and Callback functions results in
segmentation fault). (nielsdos)
. Prevent potential deadlock if accelerated globals cannot be allocated.
(nielsdos)
- PCNTL:
. Fixed bug GH-11498 (SIGCHLD is not always returned from proc_open).
(nielsdos)
- PDO:
. Fix GH-11587 (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true
and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer
filled). (SakiTakamachi)
- PDO SQLite:
. Fix GH-11492 (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt).
(KapitanOczywisty, CViniciusSDias)
- Phar:
. Add missing check on EVP_VerifyUpdate() in phar util. (nielsdos)
. Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()).
(CVE-2023-3824) (nielsdos)
- PHPDBG:
. Fixed bug GH-9669 (phpdbg -h options doesn't list the -z option). (adsr)
- Session:
. Removed broken url support for transferring session ID. (ilutov)
- Standard:
. Fix serialization of RC1 objects appearing in object graph twice. (ilutov)
- Streams:
. Fixed bug GH-11735 (Use-after-free when unregistering user stream wrapper
from itself). (ilutov)
- SQLite3:
. Fix replaced error handling in SQLite3Stmt::__construct. (nielsdos)
- XMLReader:
. Fix GH-11548 (Argument corruption when calling XMLReader::open or
XMLReader::XML non-statically with observer active). (Bob)
06 Jul 2023, PHP 8.2.8
- CLI:
. Fixed bug GH-11246 (cli/get_set_process_title fails on MacOS).
(James Lucas)
- Core:
. Fixed build for the riscv64 architecture/GCC 12. (Daniil Gentili)
- Curl:
. Fixed bug GH-11433 (Unable to set CURLOPT_ACCEPT_ENCODING to NULL).
(nielsdos)
- Date:
. Fixed bug GH-11455 (Segmentation fault with custom object date properties).
(nielsdos)
- DOM:
. Fixed bugs GH-11288 and GH-11289 and GH-11290 and GH-9142 (DOMExceptions
and segfaults with replaceWith). (nielsdos)
. Fixed bug GH-10234 (Setting DOMAttr::textContent results in an empty
attribute value). (nielsdos)
. Fix return value in stub file for DOMNodeList::item. (divinity76)
. Fix spec compliance error with '*' namespace for
DOMDocument::getElementsByTagNameNS. (nielsdos)
. Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.
(nielsdos)
. Fixed bug GH-11347 (Memory leak when calling a static method inside an
xpath query). (nielsdos)
. Fixed bug #67440 (append_node of a DOMDocumentFragment does not reconcile
namespaces). (nielsdos)
. Fixed bug #81642 (DOMChildNode::replaceWith() bug when replacing a node
with itself). (nielsdos)
. Fixed bug #77686 (Removed elements are still returned by getElementById).
(nielsdos)
. Fixed bug #70359 (print_r() on DOMAttr causes Segfault in
php_libxml_node_free_list()). (nielsdos)
. Fixed bug #78577 (Crash in DOMNameSpace debug info handlers). (nielsdos)
. Fix lifetime issue with getAttributeNodeNS(). (nielsdos)
. Fix "invalid state error" with cloned namespace declarations. (nielsdos)
. Fixed bug #55294 and #47530 and #47847 (various namespace reconciliation
issues). (nielsdos)
. Fixed bug #80332 (Completely broken array access functionality with
DOMNamedNodeMap). (nielsdos)
- Opcache:
. Fix allocation loop in zend_shared_alloc_startup(). (nielsdos)
. Access violation on smm_shared_globals with ALLOC_FALLBACK. (KoudelkaB)
. Fixed bug GH-11336 (php still tries to unlock the shared memory ZendSem
with opcache.file_cache_only=1 but it was never locked). (nielsdos)
- OpenSSL:
. Fixed bug GH-9356 Incomplete validation of IPv6 Address fields in
subjectAltNames (James Lucas, Jakub Zelenka).
- PCRE:
. Fix preg_replace_callback_array() pattern validation. (ilutov)
- PGSQL:
. Fixed intermittent segfault with pg_trace. (David Carlier)
- Phar:
. Fix cross-compilation check in phar generation for FreeBSD. (peter279k)
- SPL:
. Fixed bug GH-11338 (SplFileInfo empty getBasename with more than one
slash). (nielsdos)
- Standard:
. Fix access on NULL pointer in array_merge_recursive(). (ilutov)
. Fix exception handling in array_multisort(). (ilutov)
- SQLite3:
. Fixed bug GH-11451 (Invalid associative array containing duplicate
keys). (nielsdos)
08 Jun 2023, PHP 8.2.7
- Core:
. Fixed bug GH-11152 (Unable to alias namespaces containing reserved class
names). (ilutov)
. Fixed bug GH-9068 (Conditional jump or move depends on uninitialised
value(s)). (nielsdos)
. Fixed bug GH-11189 (Exceeding memory limit in zend_hash_do_resize leaves
the array in an invalid state). (Bob)
. Fixed bug GH-11063 (Compilation error on old GCC versions). (ingamedeo)
. Fixed bug GH-11222 (foreach by-ref may jump over keys during a rehash).
(Bob)
- Date:
. Fixed bug GH-11281 (DateTimeZone::getName() does not include seconds in
offset). (nielsdos)
- Exif:
. Fixed bug GH-10834 (exif_read_data() cannot read smaller stream wrapper
chunk sizes). (nielsdos)
- FPM:
. Fixed bug GH-10461 (PHP-FPM segfault due to after free usage of
child->ev_std(out|err)). (Jakub Zelenka)
. Fixed bug #64539 (FPM status page: query_string not properly JSON encoded).
(Jakub Zelenka)
. Fixed memory leak for invalid primary script file handle. (Jakub Zelenka)
- Hash:
. Fixed bug GH-11180 (hash_file() appears to be restricted to 3 arguments).
(nielsdos)
- LibXML:
. Fixed bug GH-11160 (Few tests failed building with new libxml 2.11.0).
(nielsdos)
- MBString:
. Fix bug GH-11217 (Segfault in mb_strrpos / mb_strripos when using negative
offset and ASCII encoding). (ilutov)
- Opcache:
. Fixed bug GH-11134 (Incorrect match default branch optimization). (ilutov)
. Fixed too wide OR and AND range inference. (nielsdos)
. Fixed missing class redeclaration error with OPcache enabled. (ilutov)
. Fixed bug GH-11245 (In some specific cases SWITCH with one default
statement will cause segfault). (nielsdos)
- PCNTL:
. Fixed maximum argument count of pcntl_forkx(). (nielsdos)
- PGSQL:
. Fixed parameter parsing of pg_lo_export(). (kocsismate)
- Phar:
. Fixed bug GH-11099 (Generating phar.php during cross-compile can't be
done). (peter279k)
- Soap:
. Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
bytes in HTTP Digest authentication for SOAP).
(CVE-2023-3247) (nielsdos, timwolla)
. Fixed bug GH-8426 (make test fail while soap extension build). (nielsdos)
- SPL:
. Fixed bug GH-11178 (Segmentation fault in spl_array_it_get_current_data
(PHP 8.1.18)). (nielsdos)
- Standard:
. Fixed bug GH-11138 (move_uploaded_file() emits open_basedir warning for
source file). (ilutov)
. Fixed bug GH-11274 (POST/PATCH request switches to GET after a HTTP 308
redirect). (nielsdos)
- Streams:
. Fixed bug GH-10031 ([Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted
irregularly for last chunk of data). (nielsdos)
. Fixed bug GH-11175 (Stream Socket Timeout). (nielsdos)
. Fixed bug GH-11177 (ASAN UndefinedBehaviorSanitizer when timeout = -1
passed to stream_socket_accept/stream_socket_client). (nielsdos)
11 May 2023, PHP 8.2.6
- Core:
. Fix inconsistent float negation in constant expressions. (ilutov)
. Fixed bug GH-8841 (php-cli core dump calling a badly formed function).
(nielsdos)
. Fixed bug GH-10737 (PHP 8.1.16 segfaults on line 597 of
sapi/apache2handler/sapi_apache2.c). (nielsdos, ElliotNB)
. Fixed bug GH-11028 (Heap Buffer Overflow in zval_undefined_cv.). (nielsdos)
. Fixed bug GH-11108 (Incorrect CG(memoize_mode) state after bailout in ??=).
(ilutov)
- Date:
. Fixed bug where the diff() method would not return the right result around
DST changeover for date/times associated with a timezone identifier. (Derick)
. Fixed out-of-range bug when converting to/from around the LONG_MIN unix
timestamp. (Derick)
- DOM:
. Fixed bug #80602 (Segfault when using DOMChildNode::before()).
(Nathan Freeman)
. Fixed incorrect error handling in dom_zvals_to_fragment(). (nielsdos)
- Exif:
. Fixed bug GH-9397 (exif read : warnings and errors : Potentially invalid
endianess, Illegal IFD size and Undefined index). (nielsdos)
- Intl:
. Fixed bug GH-11071 (TZData version not displayed anymore). (Remi)
- PCRE:
. Fixed bug GH-10968 (Segfault in preg_replace_callback_array()). (ilutov)
- Reflection:
. Fixed bug GH-10983 (State-dependant segfault in
ReflectionObject::getProperties). (nielsdos)
- SPL:
. Handle indirect zvals and use up-to-date properties in
SplFixedArray::__serialize. (nielsdos)
- Standard:
. Fixed bug GH-10990 (mail() throws TypeError after iterating over
$additional_headers array by reference). (nielsdos)
. Fixed bug GH-9775 (Duplicates returned by array_unique when using enums).
(ilutov)
- Streams:
. Fixed bug GH-10406 (feof() behavior change for UNIX based socket
resources). (Jakub Zelenka)
13 Apr 2023, PHP 8.2.5
- Core:
. Added optional support for max_execution_time in ZTS/Linux builds
(Kévin Dunglas)
. Fixed use-after-free in recursive AST evaluation. (ilutov)
. Fixed bug GH-8646 (Memory leak PHP FPM 8.1). (nielsdos)
. Re-add some CTE functions that were removed from being CTE by a mistake.
(mvorisek)
. Remove CTE flag from array_diff_ukey(), which was added by mistake.
(mvorisek)
. Fixed bug GH-10801 (Named arguments in CTE functions cause a segfault).
(nielsdos)
. Fixed bug GH-8789 (PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on
apache). (nielsdos)
. Fixed bug GH-10015 (zend_signal_handler_defer crashes on apache shutdown).
(nielsdos)
. Fixed bug GH-10810 (Fix NUL byte terminating Exception::__toString()).
(ilutov)
. Fix potential memory corruption when mixing __callStatic() and FFI. (ilutov)
- Date:
. Fixed bug GH-10747 (Private and protected properties in serialized Date*
objects throw). (Derick)
- FPM:
. Fixed bug GH-10611 (fpm_env_init_main leaks environ). (nielsdos)
. Destroy file_handle in fpm_main. (Jakub Zelenka, nielsdos)
. Fixed bug #74129 (Incorrect SCRIPT_NAME with apache ProxyPassMatch when
spaces are in path). (Jakub Zelenka)
- FTP:
. Propagate success status of ftp_close(). (nielsdos)
. Fixed bug GH-10521 (ftp_get/ftp_nb_get resumepos offset is maximum 10GB).
(nielsdos)
- IMAP:
. Fix build failure with Clang 16. (orlitzky)
- MySQLnd:
. Fixed bug GH-8979 (Possible Memory Leak with SSL-enabled MySQL
connections). (nielsdos)
- Opcache:
. Fixed build for macOS to cater with pkg-config settings. (David Carlier)
. Fixed bug GH-8065 (opcache.consistency_checks > 0 causes segfaults in
PHP >= 8.1.5 in fpm context). (nielsdos)
- OpenSSL:
. Add missing error checks on file writing functions. (nielsdos)
- PDO Firebird:
. Fixed bug GH-10908 (Bus error with PDO Firebird on RPI with 64 bit kernel
and 32 bit userland). (nielsdos)
- Phar:
. Fixed bug GH-10766 (PharData archive created with Phar::Zip format does
not keep files metadata (datetime)). (nielsdos)
. Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit().
(nielsdos)
- PDO ODBC:
. Fixed missing and inconsistent error checks on SQLAllocHandle. (nielsdos)
- PGSQL:
. Fixed typo in the array returned from pg_meta_data (extended mode).
(David Carlier)
- SPL:
. Fixed bug GH-10519 (Array Data Address Reference Issue). (Nathan Freeman)
. Fixed bug GH-10907 (Unable to serialize processed SplFixedArrays in
PHP 8.2.4). (nielsdos)
. Fixed bug GH-10844 (ArrayIterator allows modification of readonly props).
(ilutov)
- Standard:
. Fixed bug GH-10885 (stream_socket_server context leaks). (ilutov)
. Fixed bug GH-10052 (Browscap crashes PHP 8.1.12 on request shutdown
(apache2)). (nielsdos)
. Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter
and enclosure). (ilutov)
. Fixed undefined behaviour in unpack(). (nielsdos)
16 Mar 2023, PHP 8.2.4
- Core:
. Fixed incorrect check condition in ZEND_YIELD. (nielsdos)
. Fixed incorrect check condition in type inference. (nielsdos)
. Fix incorrect check in zend_internal_call_should_throw(). (nielsdos)
. Fixed overflow check in OnUpdateMemoryConsumption. (nielsdos)
. Fixed bug GH-9916 (Entering shutdown sequence with a fiber suspended in a
Generator emits an unavoidable fatal error or crashes). (Arnaud)
. Fixed bug GH-10437 (Segfault/assertion when using fibers in shutdown
function after bailout). (trowski)
. Fixed SSA object type update for compound assignment opcodes. (nielsdos)
. Fixed language scanner generation build. (Daniel Black)
. Fixed zend_update_static_property() calling zend_update_static_property_ex()
misleadingly with the wrong return type. (nielsdos)
. Fix bug GH-10570 (Fixed unknown string hash on property fetch with integer
constant name). (nielsdos)
. Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle()
freeing dangling pointers on the handle as it was uninitialized. (nielsdos)
- Curl:
. Fixed deprecation warning at compile time. (Max Kellermann)
. Fixed bug GH-10270 (Unable to return CURL_READFUNC_PAUSE in readfunc
callback). (Pierrick Charron)
- Date:
. Fix GH-10447 ('p' format specifier does not yield 'Z' for 00:00). (Derick)
. Fix GH-10152 (Custom properties of Date's child classes are not
serialised). (Derick)
- FFI:
. Fixed incorrect bitshifting and masking in ffi bitfield. (nielsdos)
- Fiber:
. Fixed assembly on alpine x86. (nielsdos)
. Fixed bug GH-10496 (segfault when garbage collector is invoked inside of
fiber). (Bob, Arnaud)
- FPM:
. Fixed bug GH-10315 (FPM unknown child alert not valid). (Jakub Zelenka)
. Fixed bug GH-10385 (FPM successful config test early exit). (nielsdos)
- GMP:
. Properly implement GMP::__construct(). (nielsdos)
- Intl:
. Fixed bug GH-10647 (Spoolchecker isSuspicious/areConfusable methods
error code's argument always returning NULL0. (Nathan Freeman)
- JSON:
. Fixed JSON scanner and parser generation build.
(Daniel Black, Jakub Zelenka)
- MBString:
. ext/mbstring: fix new_value length check. (Max Kellermann)
. Fix bug GH-10627 (mb_convert_encoding crashes PHP on Windows). (nielsdos)
- Opcache:
. Fix incorrect page_size check. (nielsdos)
. Fix readonly modification check when using inc/dec operators on readonly
property with JIT. (ilutov)
- OpenSSL:
. Fixed php_openssl_set_server_dh_param() DH params errors handling. (nielsdos)
- PDO OCI:
. Fixed bug #60994 (Reading a multibyte CLOB caps at 8192 chars).
(Michael Voříšek)
- PHPDBG:
. Fixed bug GH-10715 (heap buffer overflow on --run option misuse). (nielsdos)
- PGSQL:
. Fix GH-10672 (pg_lo_open segfaults in the strict_types mode). (girgias)
- Phar:
. Fix incorrect check in phar tar parsing. (nielsdos)
- Random:
. Fix GH-10390 (Do not trust arc4random_buf() on glibc). (timwolla)
. Fix GH-10292 (Made the default value of the first param of srand() and
mt_srand() unknown). (kocsismate)
- Reflection:
. Fixed bug GH-10623 (Reflection::getClosureUsedVariables opcode fix with
variadic arguments). (nielsdos)
. Fix Segfault when using ReflectionFiber suspended by an internal function.
(danog)
- Session:
. Fixed ps_files_cleanup_dir() on failure code paths with -1 instead of 0 as
the latter was considered success by callers. (nielsdos).
- Standard:
. Fixed bug GH-8086 (Introduce mail.mixed_lf_and_crlf INI). (Jakub Zelenka)
. Fixed bug GH-10292 (Made the default value of the first param of srand() and
mt_srand() unknown). (kocsismate)
. Fix incorrect check in cs_8559_5 in map_from_unicode(). (nielsdos)
. Fix bug GH-9697 for reset/end/next/prev() attempting to move pointer of
properties table for certain internal classes such as FFI classes
. Fix incorrect error check in browsecap for pcre2_match(). (nielsdos)
- Streams:
. Fixed bug GH-10370 (File corruption in _php_stream_copy_to_stream_ex when
using copy_file_range). (nielsdos)
. Fixed bug GH-10548 (copy() fails on cifs mounts because of incorrect
copy_file_range() len). (nielsdos)
- Tidy:
. Fix memory leaks when attempting to open a non-existing file or a file over
4GB. (Girgias)
. Add missing error check on tidyLoadConfig. (nielsdos)
- Zlib:
. Fixed output_handler directive value's length which counted the string
terminator. (nieldos)
14 Feb 2023, PHP 8.2.3
- Core:
. Fixed bug #81744 (Password_verify() always return true with some hash).
(CVE-2023-0567). (Tim Düsterhus)
. Fixed bug #81746 (1-byte array overrun in common path resolve code).
(CVE-2023-0568). (Niels Dossche)
- SAPI:
. Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
request body). (CVE-2023-0662) (Jakub Zelenka)
02 Feb 2023, PHP 8.2.2
- Core:
. Fixed bug GH-10200 (zif_get_object_vars:
Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed). (nielsdos)
. Fix GH-10251 (Assertion `(flag & (1<<3)) == 0' failed). (nielsdos)
. Fix GH-10240 (Assertion failure when adding more than 2**30 elements to an
unpacked array). (Arnaud)
. Fix GH-9735 (Fiber stack variables do not participate in cycle collector).
(Arnaud)
. Fix GH-9675 (Broken run_time_cache init for internal enum methods).
(Petar Obradović, Bob)
. Fix GH-10248 (Assertion `!(zval_get_type(&(*(property))) == 10)' failed).
(nielsdos)
- FPM:
. Fixed bug #77106 (Missing separator in FPM FastCGI errors). (Jakub Zelenka)
. Fixed bug GH-9981 (FPM does not reset fastcgi.error_header).
(Jakub Zelenka)
. Fixed bug #68591 (Configuration test does not perform UID lookups).
(Jakub Zelenka)
. Fixed memory leak when running FPM config test. (Jakub Zelenka)
. Fixed bug #67244 (Wrong owner:group for listening unix socket).
(Jakub Zelenka)
- Hash:
. Handle exceptions from __toString in XXH3's initialization (nielsdos)
- LDAP:
. Fixed bug GH-10112 (LDAP\Connection::__construct() refers to ldap_create()).
(cmb)
- Opcache:
. Fix inverted bailout value in zend_runtime_jit() (Max Kellermann).
. Fix access to uninitialized variable in accel_preload(). (nielsdos)
. Fix zend_jit_find_trace() crashes. (Max Kellermann)
. Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit. (Max Kellermann)
- Phar:
. Fix wrong flags check for compression method in phar_object.c (nielsdos)
- PHPDBG:
. Fix undefined behaviour in phpdbg_load_module_or_extension(). (nielsdos)
. Fix NULL pointer dereference in phpdbg_create_conditional_breal(). (nielsdos)
. Fix GH-9710: phpdbg memory leaks by option "-h" (nielsdos)
. Fix phpdbg segmentation fault in case of malformed input (nielsdos)
- Posix:
. Fix memory leak in posix_ttyname() (girgias)
- Random:
. Fixed bug GH-10247 (Theoretical file descriptor leak for /dev/urandom). (timwolla)
- Standard:
. Fix GH-10187 (Segfault in stripslashes() with arm64). (nielsdos)
. Fixed bug GH-10214 (Incomplete validation of object syntax during
unserialize()). (timwolla)
. Fix substr_replace with slots in repl_ht being UNDEF. (nielsdos)
- XMLWriter
. Fix missing check for xmlTextWriterEndElement (nielsdos)
05 Jan 2023, PHP 8.2.1
- Core:
. Fixed bug GH-9905 (constant() behaves inconsistent when class is undefined).
(cmb)
. Fixed bug GH-9918 (License information for xxHash is not included in
README.REDIST.BINS file). (Akama Hitoshi)
. Fixed bug GH-9890 (OpenSSL legacy providers not available on Windows). (cmb)
. Fixed bug GH-9650 (Can't initialize heap: [0x000001e7]). (Michael Voříšek)
. Fixed potentially undefined behavior in Windows ftok(3) emulation. (cmb)
. Fixed GH-9769 (Misleading error message for unpacking of objects). (jhdxr)
- Apache:
. Fixed bug GH-9949 (Partial content on incomplete POST request). (cmb)
- FPM:
. Fixed bug GH-9959 (Solaris port event mechanism is still broken after bug
#66694). (Petr Sumbera)
. Fixed bug #68207 (Setting fastcgi.error_header can result in a WARNING).
(Jakub Zelenka)
. Fixed bug #80669 (FPM numeric user fails to set groups). (Jakub Zelenka)
. Fixed bug GH-8517 (Random crash of FPM master process in
fpm_stdio_child_said). (Jakub Zelenka)
- Imap:
. Fixed bug GH-10051 (IMAP: there's no way to check if a IMAP\Connection is
still open). (Girgias)
- MBString:
. Fixed bug GH-9535 (The behavior of mb_strcut in mbstring has been changed in
PHP8.1). (Nathan Freeman)
- Opcache:
. Fixed bug GH-9968 (Segmentation Fault during OPCache Preload).
(Arnaud, michdingpayc)
- OpenSSL:
. Fixed bug GH-9997 (OpenSSL engine clean up segfault). (Jakub Zelenka)
. Fixed bug GH-9064 (PHP fails to build if openssl was built with --no-ec).
(Jakub Zelenka)
. Fixed bug GH-10000 (OpenSSL test failures when OpenSSL compiled with
no-dsa). (Jakub Zelenka)
- Pcntl:
. Fixed bug GH-9298 (Signal handler called after rshutdown leads to crash).
(Erki Aring)
- PDO_Firebird:
. Fixed bug GH-9971 (Incorrect NUMERIC value returned from PDO_Firebird).
(cmb)
- PDO/SQLite:
. Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)
(cmb)
- Session:
. Fixed GH-9932 (session name silently fails with . and [). (David Carlier)
- SPL:
. Fixed GH-9883 (SplFileObject::__toString() reads next line). (Girgias)
. Fixed GH-10011 (Trampoline autoloader will get reregistered and cannot be
unregistered). (Girgias)
- SQLite3:
. Fixed bug #81742 (open_basedir bypass in SQLite3 by using file URI). (cmb)
- TSRM:
. Fixed Windows shmget() wrt. IPC_PRIVATE. (Tyson Andre)
08 Dec 2022, PHP 8.2.0
- CLI:
. Fixed bug #81496 (Server logs incorrect request method). (lauri)
. Updated the mime-type table for the builtin-server. (Ayesh Karunaratne)
. Fixed potential overflow for the builtin server via the
PHP_CLI_SERVER_WORKERS environment variable. (yiyuaner)
. Fixed GH-8575 by changing STDOUT, STDERR and STDIN to not close on resource
destruction. (Jakub Zelenka)
. Implement built-in web server responding without body to HEAD request on
a static resource. (Vedran Miletic, Marin Martuslovic)
. Implement built-in web server responding with HTTP status 405 to
DELETE/PUT/PATCH request on a static resource.
(Vedran Miletic, Marin Martuslovic)
. Fixed bug GH-9709 (Null pointer dereference with -w/-s options).
(Adam Saponara)
- COM:
. Fixed bug GH-8750 (Can not create VT_ERROR variant type). (cmb)
- Core:
. Fixed bug #81380 (Observer may not be initialized properly). (krakjoe)
. Fixed bug GH-7771 (Fix filename/lineno of constant expressions). (ilutov)
. Fixed bug GH-7792 (Improve class type in error messages). (ilutov)
. Support huge pages on MacOS. (David CARLIER)
. Fixed bug GH-8655 (Casting an object to array does not unwrap refcount=1
references). (Nicolas Grekas)
. Fixed bug GH-8661 (Nullsafe in coalesce triggers undefined variable
warning). (ilutov)
. Fixed bug GH-7821 and GH-8418 (Allow arbitrary const expressions in backed
enums). (ilutov)
. Fixed bug GH-8810 (Incorrect lineno in backtrace of multi-line function
calls). (ilutov)
. Optimised code path for newly created file with the stream plain wrapper. (Max Kellermann)
. Uses safe_perealloc instead of perealloc for the
ZEND_PTR_STACK_RESIZE_IF_NEEDED to avoid possible overflows. (David Carlier)
. Reduced the memory footprint of strings returned by var_export(),
json_encode(), serialize(), iconv_*(), mb_ereg*(), session_create_id(),
http_build_query(), strstr(), Reflection*::__toString(). (Arnaud)
. Fixed bug GH-8995 (WeakMap object reference offset causing TypeError).
(Tobias Bachert)
. Added error_log_mode ini setting. (Mikhail Galanin)
. Updated request startup messages. (Eric Norris)
. Fixed bug GH-7900 (Arrow function with never return type compile-time
errors). (ilutov)
. Fixed incorrect double to long casting in latest clang. (zeriyoshi)
. Added support for defining constants in traits. (sj-i)
. Stop incorrectly emitting false positive deprecation notice alongside
unsupported syntax fatal error for `"{$g{'h'}}"`. (TysonAndre)
. Fix unexpected deprecated dynamic property warning, which occurred when
exit() in finally block after an exception was thrown without catching.
(Twosee)
. Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function)
(Tim Starling)
. Fixed bug GH-9227 (Trailing dots and spaces in filenames are ignored).
(cmb)
. Fixed bug GH-9285 (Traits cannot be used in readonly classes).
(kocsismate)
. Fixed bug GH-9186 (@strict-properties can be bypassed using
unserialization). (kocsismate)
. Fixed bug GH-9500 (Using dnf type with parentheses after readonly keyword
results in a parse error). (ilutov)
. Fixed bug GH-9516 ((A&B)|D as a param should allow AB or D. Not just A).
(Girgias)
. Fixed observer class notify with Opcache file_cache_only=1. (ilutov)
. Fixes segfault with Fiber on FreeBSD i386 architecture. (David Carlier)
. Fixed bug GH-9655 (Pure intersection types cannot be implicitly nullable)
(Girgias)
. Fixed bug GH-9589 (dl() segfaults when module is already loaded). (cmb,
Arnaud)
. Fixed bug GH-9752 (Generator crashes when interrupted during argument
evaluation with extra named params). (Arnaud)
. Fixed bug GH-9801 (Generator crashes when memory limit is exceeded during
initialization). (Arnaud)
. Fixed a bug with preloaded enums possibly segfaulting. (Bob)
. Fixed bug GH-9823 (Don’t reset func in zend_closure_internal_handler).
(Florian Sowade)
. Fixed potential NULL pointer dereference Windows shm*() functions. (cmb)
. Fix target validation for internal attributes with constructor property
promotion. (kooldev)
. Fixed bug GH-9750 (Generator memory leak when interrupted during argument
evaluation. (Arnaud)
- Curl:
. Added support for CURLOPT_XFERINFOFUNCTION. (David Carlier)
. Added support for CURLOPT_MAXFILESIZE_LARGE. (David Carlier)
. Added new constants from cURL 7.62 to 7.80. (Pierrick)
. New function curl_upkeep(). (Pierrick)
- Date:
. Fixed GH-8458 (DateInterval::createFromDateString does not throw if
non-relative items are present). (Derick)
. Fixed bug #52015 (Allow including end date in DatePeriod iterations)
(Daniel Egeberg, Derick)
. idate() now accepts format specifiers "N" (ISO Day-of-Week) and "o" (ISO
Year). (Pavel Djundik)
. Fixed bug GH-8730 (DateTime::diff miscalculation is same time zone of
different type). (Derick)
. Fixed bug GH-8964 (DateTime object comparison after applying delta less
than 1 second). (Derick)
. Fixed bug GH-9106: (DateInterval 1.5s added to DateTimeInterface is rounded
down since PHP 8.1.0). (Derick)
. Fixed bug #75035 (Datetime fails to unserialize "extreme" dates).
(Derick)
. Fixed bug #80483 (DateTime Object with 5-digit year can't unserialized).
(Derick)
. Fixed bug #81263 (Wrong result from DateTimeImmutable::diff). (Derick)
. Fixed bug GH-9431 (DateTime::getLastErrors() not returning false when no
errors/warnings). (Derick)
. Fixed bug with parsing large negative numbers with the @ notation. (Derick)
- DBA:
. Fixed LMDB driver hanging when attempting to delete a non-existing key
(Girgias)
. Fixed LMDB driver memory leak on DB creation failure (Girgias)
. Fixed GH-8856 (dba: lmdb: allow to override the MDB_NOSUBDIR flag). (Girgias)
- FFI:
. Fixed bug GH-9090 (Support assigning function pointers in FFI). (Adam
Saponara)
- Fileinfo:
. Fixed bug GH-8805 (finfo returns wrong mime type for woff/woff2 files).
(Anatol)
- Filter:
. Added FILTER_FLAG_GLOBAL_RANGE to filter Global IPs. (vnsavage)
- FPM:
. Emit error for invalid port setting. (David Carlier)
. Added extra check for FPM proc dumpable on SELinux based systems.
(David Carlier)
. Added support for listening queue on macOS. (David Carlier)
. Changed default for listen.backlog on Linux to -1. (Cristian Rodríguez)
. Added listen.setfib pool option to set route FIB on FreeBSD. (David Carlier)
. Added access.suppress_path pool option to filter access log entries.
(Mark Gallagher)
. Fixed on fpm scoreboard occasional warning on acquisition failure.
(Felix Wiedemann)
. Fixed bug GH-9754 (SaltStack (using Python subprocess) hangs when running
php-fpm 8.1.11). (Jakub Zelenka)
- FTP:
. Fix datetime format string to follow POSIX spec in ftp_mdtm(). (Jihwan Kim)
- GD:
. Fixed bug #81739: OOB read due to insufficient input validation in
imageloadfont(). (CVE-2022-31630) (cmb)
- GMP:
. Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed
to gmp_init()). (Girgias)
- Hash:
. Fixed bug #81738: buffer overflow in hash_update() on long parameter.
(CVE-2022-37454) (nicky at mouha dot be)
. Fixed bug GH-10077: Fix compilation on RHEL 7 ppc64le. (Mattias Ellert)
- Intl:
. Update all grandfathered language tags with preferred values
. Fixed GH-7939 (Cannot unserialize IntlTimeZone objects). (cmb)
. Fixed build for ICU 69.x and onwards. (David Carlier)
. Declared Transliterator::$id as readonly to unlock subclassing it. (Nicolas
Grekas)
. Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter).
(Girgias)
- MBString:
. Fixed bug GH-9248 (Segmentation fault in mb_strimwidth()). (cmb)
- mysqli:
. Fixed bug GH-9841 (mysqli_query throws warning despite using
silenced error mode). (Kamil Tekiela)
- MySQLnd:
. Fixed potential heap corruption due to alignment mismatch. (cmb)
- OCI8:
. Added oci8.prefetch_lob_size directive to tune LOB query performance
. Support for building against Oracle Client libraries 10.1 and 10.2 has been
dropped. Oracle Client libraries 11.2 or newer are now required.
- ODBC:
. Fixed bug GH-8300 (User input not escaped when building connection string).
(Calvin Buckley)
. Fixed bug GH-9347 (Current ODBC liveness checks may be inadequate). (Calvin
Buckley)
- Opcache:
. Allocate JIT buffer close to PHP .text segemnt to allow using direct
IP-relative calls and jumps.
(Su Tao, Wang Xue, Chen Hu, Lizhen Lizhen, Dmitry)
. Added initial support for JIT performance profiling generation
for macOs Instrument. (David Carlier)
. Fixed bug GH-8030 (Segfault with JIT and large match/switch statements).
(Arnaud)
. Added JIT support improvement for macOs for segments and executable permission
bit handling. (David Carlier)
. Added JIT buffer allocation near the .text section on FreeNSD. (David Carlier)
. Fixed bug GH-9371 (Crash with JIT on mac arm64)
(jdp1024/David Carlier)
. Fixed bug GH-9259 (opcache.interned_strings_buffer setting integer
overflow). (Arnaud)
. Added indirect call reduction for jit on x86 architectures. (wxue1)
- OPcache:
. Fixed bug GH-9164 (Segfault in zend_accel_class_hash_copy).
(Arnaud, Sergei Turchanov)
- OpenSSL:
. Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT. (Max Kellermann)
. Fixed bug GH-9310 (SSL local_cert and local_pk do not respect
open_basedir). (Jakub Zelenka)
. Implement FR #76935 ("chacha20-poly1305" is an AEAD but does not work like
AEAD). (Jakub Zelenka)
. Added openssl_cipher_key_length function. (Jakub Zelenka)
. Fixed bug GH-9517 (Compilation error openssl extension related to PR
GH-9366). (Jakub Zelenka)
. Fixed missing clean up of OpenSSL engine list - attempt to fix GH-8620.
(Jakub Zelenka)
. Fixed bug GH-8430 (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does
not build). (Jakub Zelenka, fsbruva)
- PCNTL:
. Fixed pcntl_(get|set)priority error handling for MacOS. (Juan Morales)
- PCRE:
. Implemented FR #77726 (Allow null character in regex patterns). (tobil4sk)
. Updated bundled libpcre to 10.40. (cmb)
- PDO:
. Fixed bug GH-9818 (Initialize run time cache in PDO methods).
(Florian Sowade)
- PDO_Firebird:
. Fixed bug GH-8576 (Bad interpretation of length when char is UTF-8). (cmb)
- PDO_ODBC:
. Fixed bug #80909 (crash with persistent connections in PDO_ODBC). (Calvin
Buckley)
. Fixed bug GH-8300 (User input not escaped when building connection string).
(Calvin Buckley)
. Fixed bug GH-9347 (Current ODBC liveness checks may be inadequate). (Calvin
Buckley)
. Fixed bug GH-9372 (HY010 when binding overlong parameter). (cmb)
- PDO_PGSQL:
. Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).
(Yurunsoft)
- Random:
. Added new random extension. (Go Kudo)
. Fixed bug GH-9067 (random extension is not thread safe). (cmb)
. Fixed bug GH-9055 (segmentation fault if user engine throws). (timwolla)
. Fixed bug GH-9066 (signed integer overflow). (zeriyoshi)
. Fixed bug GH-9083 (undefined behavior during shifting). (timwolla)
. Fixed bug GH-9088, GH-9056 (incorrect expansion of bytes when
generating uniform integers within a given range). (timwolla)
. Fixed bug GH-9089 (Fix memory leak on Randomizer::__construct()
call twice). (zeriyoshi)
. Fixed bug GH-9212 (PcgOneseq128XslRr64::jump() should not allow negative
$advance). (Anton Smirnov)
. Changed Mt19937 to throw a ValueError instead of InvalidArgumentException
for invalid $mode. (timwolla)
. Splitted Random\Randomizer::getInt() (without arguments) to
Random\Randomizer::nextInt(). (zeriyoshi)
. Fixed bug GH-9235 (non-existant $sequence parameter in stub for
PcgOneseq128XslRr64::__construct()). (timwolla)
. Fixed bug GH-9190, GH-9191 (undefined behavior for MT_RAND_PHP when
handling large ranges). (timwolla)
. Fixed bug GH-9249 (Xoshiro256StarStar does not reject the invalid
all-zero state). (timwolla)
. Removed redundant RuntimeExceptions from Randomizer methods. The
exceptions thrown by the engines will be exposed directly. (timwolla)
. Added extension specific Exceptions/Errors (RandomException, RandomError,
BrokenRandomEngineError). (timwolla)
. Fixed bug GH-9415 (Randomizer::getInt(0, 2**32 - 1) with Mt19937
always returns 1). (timwolla)
. Fixed Randomizer::getInt() consistency for 32-bit engines. (timwolla)
. Fixed bug GH-9464 (build on older macOs releases). (David Bohman)
. Fixed bug GH-9839 (Pre-PHP 8.2 output compatibility for non-mt_rand()
functions for MT_RAND_PHP). (timwolla)
- Reflection:
. Added ReflectionFunction::isAnonymous(). (Nicolas Grekas)
. Added ReflectionMethod::hasPrototype(). (Ollie Read)
. Narrow ReflectionEnum::getBackingType() return type to ReflectionNamedType.
(SamMousa)
. Fixed bug GH-8932 (ReflectionFunction provides no way to get the called
class of a Closure). (cmb, Nicolas Grekas)
- Session:
. Fixed bug GH-7787 (Improve session write failure message for user error
handlers). (ilutov)
. Fixed GH-9200 (setcookie has an obsolete expires date format). (timwolla)
. Fixed GH-9584 (Avoid memory corruption when not unregistering custom session
handler). (ilutov)
. Fixed bug GH-9583 (session_create_id() fails with user defined save handler
that doesn't have a validateId() method). (Girgias)
- SOAP:
. Fixed bug GH-9720 (Null pointer dereference while serializing the response).
(cmb)
- Sockets:
. Added TCP_NOTSENT_LOWAT socket option. (David Carlier)
. Added SO_MEMINFO socket option. (David Carlier)
. Added SO_RTABLE socket option (OpenBSD), equivalent of SO_MARK (Linux).
(David Carlier)
. Added TCP_KEEPALIVE, TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT socket
options. (David Carlier)
. Added ancillary data support for FreeBSD. (David Carlier)
. Added ancillary data support for NetBSD. (David Carlier)
. Added SO_BPF_EXTENSIONS socket option. (David Carlier)
. Added SO_SETFIB socket option. (David Carlier)
. Added TCP_CONGESTION socket option. (David Carlier)
. Added SO_ZEROCOPY/MSG_ZEROCOPY options. (David Carlier)
. Added SOL_FILTER socket option for Solaris. (David Carlier)
. Fixed socket constants regression as of PHP 8.2.0beta3. (Bruce Dou)
- Sodium:
. Added sodium_crypto_stream_xchacha20_xor_ic(). (Scott)
- SPL:
. Uses safe_erealloc instead of erealloc to handle heap growth
for the SplHeap::insert method to avoid possible overflows. (David Carlier)
. Widen iterator_to_array() and iterator_count()'s $iterator parameter to
iterable. (timwolla)
. Fixed bug #69181 (READ_CSV|DROP_NEW_LINE drops newlines within fields).
(cmb)
. Fixed bug #65069 (GlobIterator incorrect handling of open_basedir check).
(Jakub Zelenka)
- SQLite3:
. Changed sqlite3.defensive from PHP_INI_SYSTEM to PHP_INI_USER. (bohwaz)
- Standard:
. net_get_interfaces() also reports wireless network interfaces on Windows.
(Yurun)
. Finished AVIF support in getimagesize(). (Yannis Guyon)
. Fixed bug GH-7847 (stripos with large haystack has bad performance).
(ilutov)
. New function memory_reset_peak_usage(). (Patrick Allaert)
. Fixed parse_url(): can not recognize port without scheme. (pandaLIU)
. Deprecated utf8_encode() and utf8_decode(). (Rowan Tommins)
. Fixed the crypt_sha256/512 api build with clang > 12. (David Carlier)
. Uses safe_erealloc instead of erealloc to handle options in getopt
to avoid possible overflows. (David Carlier)
. Implemented FR GH-8924 (str_split should return empty array for empty
string). (Michael Vorisek)
. Added ini_parse_quantity function to convert ini quantities shorthand
notation to int. (Dennis Snell)
. Enable arc4random_buf for Linux glibc 2.36 and onwards
for the random_bytes. (Cristian Rodriguez)
. Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier).
. Fixed bug #65489 (glob() basedir check is inconsistent). (Jakub Zelenka)
. Fixed GH-9200 (setcookie has an obsolete expires date format). (Derick)
. Fixed GH-9244 (Segfault with array_multisort + array_shift). (cmb)
. Fixed bug GH-9296 (`ksort` behaves incorrectly on arrays with mixed keys).
(Denis Vaksman)
. Marked crypt()'s $string parameter as #[\SensitiveParameter]. (timwolla)
. Fixed bug GH-9464 (build on older macOs releases). (David Bohman)
. Fixed bug GH-9518 (Disabling IPv6 support disables unrelated constants).
(cmb)
. Revert "Fixed parse_url(): can not recognize port without scheme."
(andypost)
- Streams:
. Set IP_BIND_ADDRESS_NO_PORT if available when connecting to remote host.
(Cristian Rodríguez)
. Fixed bug GH-8548 (stream_wrapper_unregister() leaks memory). (ilutov)
. Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT. (Max Kellermann)
. Fixed bug GH-9316 ($http_response_header is wrong for long status line).
(cmb, timwolla)
. Fixed bug GH-9590 (stream_select does not abort upon exception or empty
valid fd set). (Arnaud)
. Fixed bug GH-9653 (file copy between different filesystems). (David Carlier)
. Fixed bug GH-9779 (stream_copy_to_stream fails if dest in append mode).
(Jakub Zelenka)
- Windows:
. Added preliminary support for (cross-)building for ARM64. (Yun Dou)
- XML:
. Added libxml_get_external_entity_loader() function. (Tim Starling)
- Zip:
. add ZipArchive::clearError() method
. add ZipArchive::getStreamName() method
. add ZipArchive::getStreamIndex() method
. On Windows, the Zip extension is now built as shared library (DLL) by
default. (cmb)
. Implement fseek for zip stream when possible with libzip 1.9.1. (Remi)
PK ;K] J�� � ' ea-php82-php-common/php.ini-developmentnu ȯ�� [PHP]
;;;;;;;;;;;;;;;;;;;
; About php.ini ;
;;;;;;;;;;;;;;;;;;;
; PHP's initialization file, generally called php.ini, is responsible for
; configuring many of the aspects of PHP's behavior.
; PHP attempts to find and load this configuration from a number of locations.
; The following is a summary of its search order:
; 1. SAPI module specific location.
; 2. The PHPRC environment variable.
; 3. A number of predefined registry keys on Windows
; 4. Current working directory (except CLI)
; 5. The web server's directory (for SAPI modules), or directory of PHP
; (otherwise in Windows)
; 6. The directory from the --with-config-file-path compile time option, or the
; Windows directory (usually C:\windows)
; See the PHP docs for more specific information.
; https://php.net/configuration.file
; The syntax of the file is extremely simple. Whitespace and lines
; beginning with a semicolon are silently ignored (as you probably guessed).
; Section headers (e.g. [Foo]) are also silently ignored, even though
; they might mean something in the future.
; Directives following the section heading [PATH=/www/mysite] only
; apply to PHP files in the /www/mysite directory. Directives
; following the section heading [HOST=www.example.com] only apply to
; PHP files served from www.example.com. Directives set in these
; special sections cannot be overridden by user-defined INI files or
; at runtime. Currently, [PATH=] and [HOST=] sections only work under
; CGI/FastCGI.
; https://php.net/ini.sections
; Directives are specified using the following syntax:
; directive = value
; Directive names are *case sensitive* - foo=bar is different from FOO=bar.
; Directives are variables used to configure PHP or PHP extensions.
; There is no name validation. If PHP can't find an expected
; directive because it is not set or is mistyped, a default value will be used.
; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one
; of the INI constants (On, Off, True, False, Yes, No and None) or an expression
; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a
; previously set variable or directive (e.g. ${foo})
; Expressions in the INI file are limited to bitwise operators and parentheses:
; | bitwise OR
; ^ bitwise XOR
; & bitwise AND
; ~ bitwise NOT
; ! boolean NOT
; Boolean flags can be turned on using the values 1, On, True or Yes.
; They can be turned off using the values 0, Off, False or No.
; An empty string can be denoted by simply not writing anything after the equal
; sign, or by using the None keyword:
; foo = ; sets foo to an empty string
; foo = None ; sets foo to an empty string
; foo = "None" ; sets foo to the string 'None'
; If you use constants in your value, and these constants belong to a
; dynamically loaded extension (either a PHP extension or a Zend extension),
; you may only use these constants *after* the line that loads the extension.
;;;;;;;;;;;;;;;;;;;
; About this file ;
;;;;;;;;;;;;;;;;;;;
; PHP comes packaged with two INI files. One that is recommended to be used
; in production environments and one that is recommended to be used in
; development environments.
; php.ini-production contains settings which hold security, performance and
; best practices at its core. But please be aware, these settings may break
; compatibility with older or less security-conscious applications. We
; recommending using the production ini in production and testing environments.
; php.ini-development is very similar to its production variant, except it is
; much more verbose when it comes to errors. We recommend using the
; development version only in development environments, as errors shown to
; application users can inadvertently leak otherwise secure information.
; This is the php.ini-development INI file.
;;;;;;;;;;;;;;;;;;;
; Quick Reference ;
;;;;;;;;;;;;;;;;;;;
; The following are all the settings which are different in either the production
; or development versions of the INIs with respect to PHP's default behavior.
; Please see the actual settings later in the document for more details as to why
; we recommend these changes in PHP's behavior.
; display_errors
; Default Value: On
; Development Value: On
; Production Value: Off
; display_startup_errors
; Default Value: On
; Development Value: On
; Production Value: Off
; error_reporting
; Default Value: E_ALL
; Development Value: E_ALL
; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
; log_errors
; Default Value: Off
; Development Value: On
; Production Value: On
; max_input_time
; Default Value: -1 (Unlimited)
; Development Value: 60 (60 seconds)
; Production Value: 60 (60 seconds)
; output_buffering
; Default Value: Off
; Development Value: 4096
; Production Value: 4096
; register_argc_argv
; Default Value: On
; Development Value: Off
; Production Value: Off
; request_order
; Default Value: None
; Development Value: "GP"
; Production Value: "GP"
; session.gc_divisor
; Default Value: 100
; Development Value: 1000
; Production Value: 1000
; session.sid_bits_per_character
; Default Value: 4
; Development Value: 5
; Production Value: 5
; short_open_tag
; Default Value: On
; Development Value: Off
; Production Value: Off
; variables_order
; Default Value: "EGPCS"
; Development Value: "GPCS"
; Production Value: "GPCS"
; zend.exception_ignore_args
; Default Value: Off
; Development Value: Off
; Production Value: On
; zend.exception_string_param_max_len
; Default Value: 15
; Development Value: 15
; Production Value: 0
;;;;;;;;;;;;;;;;;;;;
; php.ini Options ;
;;;;;;;;;;;;;;;;;;;;
; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini"
;user_ini.filename = ".user.ini"
; To disable this feature set this option to an empty value
;user_ini.filename =
; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)
;user_ini.cache_ttl = 300
;;;;;;;;;;;;;;;;;;;;
; Language Options ;
;;;;;;;;;;;;;;;;;;;;
; Enable the PHP scripting language engine under Apache.
; https://php.net/engine
engine = On
; This directive determines whether or not PHP will recognize code between
; <? and ?> tags as PHP source which should be processed as such. It is
; generally recommended that <?php and ?> should be used and that this feature
; should be disabled, as enabling it may result in issues when generating XML
; documents, however this remains supported for backward compatibility reasons.
; Note that this directive does not control the <?= shorthand tag, which can be
; used regardless of this directive.
; Default Value: On
; Development Value: Off
; Production Value: Off
; https://php.net/short-open-tag
short_open_tag = Off
; The number of significant digits displayed in floating point numbers.
; https://php.net/precision
precision = 14
; Output buffering is a mechanism for controlling how much output data
; (excluding headers and cookies) PHP should keep internally before pushing that
; data to the client. If your application's output exceeds this setting, PHP
; will send that data in chunks of roughly the size you specify.
; Turning on this setting and managing its maximum buffer size can yield some
; interesting side-effects depending on your application and web server.
; You may be able to send headers and cookies after you've already sent output
; through print or echo. You also may see performance benefits if your server is
; emitting less packets due to buffered output versus PHP streaming the output
; as it gets it. On production servers, 4096 bytes is a good setting for performance
; reasons.
; Note: Output buffering can also be controlled via Output Buffering Control
; functions.
; Possible Values:
; On = Enabled and buffer is unlimited. (Use with caution)
; Off = Disabled
; Integer = Enables the buffer and sets its maximum size in bytes.
; Note: This directive is hardcoded to Off for the CLI SAPI
; Default Value: Off
; Development Value: 4096
; Production Value: 4096
; https://php.net/output-buffering
output_buffering = 4096
; You can redirect all of the output of your scripts to a function. For
; example, if you set output_handler to "mb_output_handler", character
; encoding will be transparently converted to the specified encoding.
; Setting any output handler automatically turns on output buffering.
; Note: People who wrote portable scripts should not depend on this ini
; directive. Instead, explicitly set the output handler using ob_start().
; Using this ini directive may cause problems unless you know what script
; is doing.
; Note: You cannot use both "mb_output_handler" with "ob_iconv_handler"
; and you cannot use both "ob_gzhandler" and "zlib.output_compression".
; Note: output_handler must be empty if this is set 'On' !!!!
; Instead you must use zlib.output_handler.
; https://php.net/output-handler
;output_handler =
; URL rewriter function rewrites URL on the fly by using
; output buffer. You can set target tags by this configuration.
; "form" tag is special tag. It will add hidden input tag to pass values.
; Refer to session.trans_sid_tags for usage.
; Default Value: "form="
; Development Value: "form="
; Production Value: "form="
;url_rewriter.tags
; URL rewriter will not rewrite absolute URL nor form by default. To enable
; absolute URL rewrite, allowed hosts must be defined at RUNTIME.
; Refer to session.trans_sid_hosts for more details.
; Default Value: ""
; Development Value: ""
; Production Value: ""
;url_rewriter.hosts
; Transparent output compression using the zlib library
; Valid values for this option are 'off', 'on', or a specific buffer size
; to be used for compression (default is 4KB)
; Note: Resulting chunk size may vary due to nature of compression. PHP
; outputs chunks that are few hundreds bytes each as a result of
; compression. If you prefer a larger chunk size for better
; performance, enable output_buffering in addition.
; Note: You need to use zlib.output_handler instead of the standard
; output_handler, or otherwise the output will be corrupted.
; https://php.net/zlib.output-compression
zlib.output_compression = Off
; https://php.net/zlib.output-compression-level
;zlib.output_compression_level = -1
; You cannot specify additional output handlers if zlib.output_compression
; is activated here. This setting does the same as output_handler but in
; a different order.
; https://php.net/zlib.output-handler
;zlib.output_handler =
; Implicit flush tells PHP to tell the output layer to flush itself
; automatically after every output block. This is equivalent to calling the
; PHP function flush() after each and every call to print() or echo() and each
; and every HTML block. Turning this option on has serious performance
; implications and is generally recommended for debugging purposes only.
; https://php.net/implicit-flush
; Note: This directive is hardcoded to On for the CLI SAPI
implicit_flush = Off
; The unserialize callback function will be called (with the undefined class'
; name as parameter), if the unserializer finds an undefined class
; which should be instantiated. A warning appears if the specified function is
; not defined, or if the function doesn't include/implement the missing class.
; So only set this entry, if you really want to implement such a
; callback-function.
unserialize_callback_func =
; The unserialize_max_depth specifies the default depth limit for unserialized
; structures. Setting the depth limit too high may result in stack overflows
; during unserialization. The unserialize_max_depth ini setting can be
; overridden by the max_depth option on individual unserialize() calls.
; A value of 0 disables the depth limit.
;unserialize_max_depth = 4096
; When floats & doubles are serialized, store serialize_precision significant
; digits after the floating point. The default value ensures that when floats
; are decoded with unserialize, the data will remain the same.
; The value is also used for json_encode when encoding double values.
; If -1 is used, then dtoa mode 0 is used which automatically select the best
; precision.
serialize_precision = -1
; open_basedir, if set, limits all file operations to the defined directory
; and below. This directive makes most sense if used in a per-directory
; or per-virtualhost web server configuration file.
; Note: disables the realpath cache
; https://php.net/open-basedir
;open_basedir =
; This directive allows you to disable certain functions.
; It receives a comma-delimited list of function names.
; https://php.net/disable-functions
disable_functions =
; This directive allows you to disable certain classes.
; It receives a comma-delimited list of class names.
; https://php.net/disable-classes
disable_classes =
; Colors for Syntax Highlighting mode. Anything that's acceptable in
; <span style="color: ???????"> would work.
; https://php.net/syntax-highlighting
;highlight.string = #DD0000
;highlight.comment = #FF9900
;highlight.keyword = #007700
;highlight.default = #0000BB
;highlight.html = #000000
; If enabled, the request will be allowed to complete even if the user aborts
; the request. Consider enabling it if executing long requests, which may end up
; being interrupted by the user or a browser timing out. PHP's default behavior
; is to disable this feature.
; https://php.net/ignore-user-abort
;ignore_user_abort = On
; Determines the size of the realpath cache to be used by PHP. This value should
; be increased on systems where PHP opens many files to reflect the quantity of
; the file operations performed.
; Note: if open_basedir is set, the cache is disabled
; https://php.net/realpath-cache-size
;realpath_cache_size = 4096k
; Duration of time, in seconds for which to cache realpath information for a given
; file or directory. For systems with rarely changing files, consider increasing this
; value.
; https://php.net/realpath-cache-ttl
;realpath_cache_ttl = 120
; Enables or disables the circular reference collector.
; https://php.net/zend.enable-gc
zend.enable_gc = On
; If enabled, scripts may be written in encodings that are incompatible with
; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such
; encodings. To use this feature, mbstring extension must be enabled.
;zend.multibyte = Off
; Allows to set the default encoding for the scripts. This value will be used
; unless "declare(encoding=...)" directive appears at the top of the script.
; Only affects if zend.multibyte is set.
;zend.script_encoding =
; Allows to include or exclude arguments from stack traces generated for exceptions.
; In production, it is recommended to turn this setting on to prohibit the output
; of sensitive information in stack traces
; Default Value: Off
; Development Value: Off
; Production Value: On
zend.exception_ignore_args = Off
; Allows setting the maximum string length in an argument of a stringified stack trace
; to a value between 0 and 1000000.
; This has no effect when zend.exception_ignore_args is enabled.
; Default Value: 15
; Development Value: 15
; Production Value: 0
zend.exception_string_param_max_len = 15
;;;;;;;;;;;;;;;;;
; Miscellaneous ;
;;;;;;;;;;;;;;;;;
; Decides whether PHP may expose the fact that it is installed on the server
; (e.g. by adding its signature to the Web server header). It is no security
; threat in any way, but it makes it possible to determine whether you use PHP
; on your server or not.
; https://php.net/expose-php
expose_php = On
;;;;;;;;;;;;;;;;;;;
; Resource Limits ;
;;;;;;;;;;;;;;;;;;;
; Maximum execution time of each script, in seconds
; https://php.net/max-execution-time
; Note: This directive is hardcoded to 0 for the CLI SAPI
max_execution_time = 30
; Maximum amount of time each script may spend parsing request data. It's a good
; idea to limit this time on productions servers in order to eliminate unexpectedly
; long running scripts.
; Note: This directive is hardcoded to -1 for the CLI SAPI
; Default Value: -1 (Unlimited)
; Development Value: 60 (60 seconds)
; Production Value: 60 (60 seconds)
; https://php.net/max-input-time
max_input_time = 60
; Maximum input variable nesting level
; https://php.net/max-input-nesting-level
;max_input_nesting_level = 64
; How many GET/POST/COOKIE input variables may be accepted
;max_input_vars = 1000
; How many multipart body parts (combined input variable and file uploads) may
; be accepted.
; Default Value: -1 (Sum of max_input_vars and max_file_uploads)
;max_multipart_body_parts = 1500
; Maximum amount of memory a script may consume
; https://php.net/memory-limit
memory_limit = 128M
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Error handling and logging ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; This directive informs PHP of which errors, warnings and notices you would like
; it to take action for. The recommended way of setting values for this
; directive is through the use of the error level constants and bitwise
; operators. The error level constants are below here for convenience as well as
; some common settings and their meanings.
; By default, PHP is set to take action on all errors, notices and warnings EXCEPT
; those related to E_NOTICE and E_STRICT, which together cover best practices and
; recommended coding standards in PHP. For performance reasons, this is the
; recommend error reporting setting. Your production server shouldn't be wasting
; resources complaining about best practices and coding standards. That's what
; development servers and development settings are for.
; Note: The php.ini-development file has this setting as E_ALL. This
; means it pretty much reports everything which is exactly what you want during
; development and early testing.
;
; Error Level Constants:
; E_ALL - All errors and warnings
; E_ERROR - fatal run-time errors
; E_RECOVERABLE_ERROR - almost fatal run-time errors
; E_WARNING - run-time warnings (non-fatal errors)
; E_PARSE - compile-time parse errors
; E_NOTICE - run-time notices (these are warnings which often result
; from a bug in your code, but it's possible that it was
; intentional (e.g., using an uninitialized variable and
; relying on the fact it is automatically initialized to an
; empty string)
; E_STRICT - run-time notices, enable to have PHP suggest changes
; to your code which will ensure the best interoperability
; and forward compatibility of your code
; E_CORE_ERROR - fatal errors that occur during PHP's initial startup
; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's
; initial startup
; E_COMPILE_ERROR - fatal compile-time errors
; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)
; E_USER_ERROR - user-generated error message
; E_USER_WARNING - user-generated warning message
; E_USER_NOTICE - user-generated notice message
; E_DEPRECATED - warn about code that will not work in future versions
; of PHP
; E_USER_DEPRECATED - user-generated deprecation warnings
;
; Common Values:
; E_ALL (Show all errors, warnings and notices including coding standards.)
; E_ALL & ~E_NOTICE (Show all errors, except for notices)
; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)
; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)
; Default Value: E_ALL
; Development Value: E_ALL
; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
; https://php.net/error-reporting
error_reporting = E_ALL
; This directive controls whether or not and where PHP will output errors,
; notices and warnings too. Error output is very useful during development, but
; it could be very dangerous in production environments. Depending on the code
; which is triggering the error, sensitive information could potentially leak
; out of your application such as database usernames and passwords or worse.
; For production environments, we recommend logging errors rather than
; sending them to STDOUT.
; Possible Values:
; Off = Do not display any errors
; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
; On or stdout = Display errors to STDOUT
; Default Value: On
; Development Value: On
; Production Value: Off
; https://php.net/display-errors
display_errors = On
; The display of errors which occur during PHP's startup sequence are handled
; separately from display_errors. We strongly recommend you set this to 'off'
; for production servers to avoid leaking configuration details.
; Default Value: On
; Development Value: On
; Production Value: Off
; https://php.net/display-startup-errors
display_startup_errors = On
; Besides displaying errors, PHP can also log errors to locations such as a
; server-specific log, STDERR, or a location specified by the error_log
; directive found below. While errors should not be displayed on productions
; servers they should still be monitored and logging is a great way to do that.
; Default Value: Off
; Development Value: On
; Production Value: On
; https://php.net/log-errors
log_errors = On
; Do not log repeated messages. Repeated errors must occur in same file on same
; line unless ignore_repeated_source is set true.
; https://php.net/ignore-repeated-errors
ignore_repeated_errors = Off
; Ignore source of message when ignoring repeated messages. When this setting
; is On you will not log errors with repeated messages from different files or
; source lines.
; https://php.net/ignore-repeated-source
ignore_repeated_source = Off
; If this parameter is set to Off, then memory leaks will not be shown (on
; stdout or in the log). This is only effective in a debug compile, and if
; error reporting includes E_WARNING in the allowed list
; https://php.net/report-memleaks
report_memleaks = On
; This setting is off by default.
;report_zend_debug = 0
; Turn off normal error reporting and emit XML-RPC error XML
; https://php.net/xmlrpc-errors
;xmlrpc_errors = 0
; An XML-RPC faultCode
;xmlrpc_error_number = 0
; When PHP displays or logs an error, it has the capability of formatting the
; error message as HTML for easier reading. This directive controls whether
; the error message is formatted as HTML or not.
; Note: This directive is hardcoded to Off for the CLI SAPI
; https://php.net/html-errors
;html_errors = On
; If html_errors is set to On *and* docref_root is not empty, then PHP
; produces clickable error messages that direct to a page describing the error
; or function causing the error in detail.
; You can download a copy of the PHP manual from https://php.net/docs
; and change docref_root to the base URL of your local copy including the
; leading '/'. You must also specify the file extension being used including
; the dot. PHP's default behavior is to leave these settings empty, in which
; case no links to documentation are generated.
; Note: Never use this feature for production boxes.
; https://php.net/docref-root
; Examples
;docref_root = "/phpmanual/"
; https://php.net/docref-ext
;docref_ext = .html
; String to output before an error message. PHP's default behavior is to leave
; this setting blank.
; https://php.net/error-prepend-string
; Example:
;error_prepend_string = "<span style='color: #ff0000'>"
; String to output after an error message. PHP's default behavior is to leave
; this setting blank.
; https://php.net/error-append-string
; Example:
;error_append_string = "</span>"
; Log errors to specified file. PHP's default behavior is to leave this value
; empty.
; https://php.net/error-log
; Example:
;error_log = php_errors.log
; Log errors to syslog (Event Log on Windows).
;error_log = syslog
; The syslog ident is a string which is prepended to every message logged
; to syslog. Only used when error_log is set to syslog.
;syslog.ident = php
; The syslog facility is used to specify what type of program is logging
; the message. Only used when error_log is set to syslog.
;syslog.facility = user
; Set this to disable filtering control characters (the default).
; Some loggers only accept NVT-ASCII, others accept anything that's not
; control characters. If your logger accepts everything, then no filtering
; is needed at all.
; Allowed values are:
; ascii (all printable ASCII characters and NL)
; no-ctrl (all characters except control characters)
; all (all characters)
; raw (like "all", but messages are not split at newlines)
; https://php.net/syslog.filter
;syslog.filter = ascii
;windows.show_crt_warning
; Default value: 0
; Development value: 0
; Production value: 0
;;;;;;;;;;;;;;;;;
; Data Handling ;
;;;;;;;;;;;;;;;;;
; The separator used in PHP generated URLs to separate arguments.
; PHP's default setting is "&".
; https://php.net/arg-separator.output
; Example:
;arg_separator.output = "&"
; List of separator(s) used by PHP to parse input URLs into variables.
; PHP's default setting is "&".
; NOTE: Every character in this directive is considered as separator!
; https://php.net/arg-separator.input
; Example:
;arg_separator.input = ";&"
; This directive determines which super global arrays are registered when PHP
; starts up. G,P,C,E & S are abbreviations for the following respective super
; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty
; paid for the registration of these arrays and because ENV is not as commonly
; used as the others, ENV is not recommended on productions servers. You
; can still get access to the environment variables through getenv() should you
; need to.
; Default Value: "EGPCS"
; Development Value: "GPCS"
; Production Value: "GPCS";
; https://php.net/variables-order
variables_order = "GPCS"
; This directive determines which super global data (G,P & C) should be
; registered into the super global array REQUEST. If so, it also determines
; the order in which that data is registered. The values for this directive
; are specified in the same manner as the variables_order directive,
; EXCEPT one. Leaving this value empty will cause PHP to use the value set
; in the variables_order directive. It does not mean it will leave the super
; globals array REQUEST empty.
; Default Value: None
; Development Value: "GP"
; Production Value: "GP"
; https://php.net/request-order
request_order = "GP"
; This directive determines whether PHP registers $argv & $argc each time it
; runs. $argv contains an array of all the arguments passed to PHP when a script
; is invoked. $argc contains an integer representing the number of arguments
; that were passed when the script was invoked. These arrays are extremely
; useful when running scripts from the command line. When this directive is
; enabled, registering these variables consumes CPU cycles and memory each time
; a script is executed. For performance reasons, this feature should be disabled
; on production servers.
; Note: This directive is hardcoded to On for the CLI SAPI
; Default Value: On
; Development Value: Off
; Production Value: Off
; https://php.net/register-argc-argv
register_argc_argv = Off
; When enabled, the ENV, REQUEST and SERVER variables are created when they're
; first used (Just In Time) instead of when the script starts. If these
; variables are not used within a script, having this directive on will result
; in a performance gain. The PHP directive register_argc_argv must be disabled
; for this directive to have any effect.
; https://php.net/auto-globals-jit
auto_globals_jit = On
; Whether PHP will read the POST data.
; This option is enabled by default.
; Most likely, you won't want to disable this option globally. It causes $_POST
; and $_FILES to always be empty; the only way you will be able to read the
; POST data will be through the php://input stream wrapper. This can be useful
; to proxy requests or to process the POST data in a memory efficient fashion.
; https://php.net/enable-post-data-reading
;enable_post_data_reading = Off
; Maximum size of POST data that PHP will accept.
; Its value may be 0 to disable the limit. It is ignored if POST data reading
; is disabled through enable_post_data_reading.
; https://php.net/post-max-size
post_max_size = 8M
; Automatically add files before PHP document.
; https://php.net/auto-prepend-file
auto_prepend_file =
; Automatically add files after PHP document.
; https://php.net/auto-append-file
auto_append_file =
; By default, PHP will output a media type using the Content-Type header. To
; disable this, simply set it to be empty.
;
; PHP's built-in default media type is set to text/html.
; https://php.net/default-mimetype
default_mimetype = "text/html"
; PHP's default character set is set to UTF-8.
; https://php.net/default-charset
default_charset = "UTF-8"
; PHP internal character encoding is set to empty.
; If empty, default_charset is used.
; https://php.net/internal-encoding
;internal_encoding =
; PHP input character encoding is set to empty.
; If empty, default_charset is used.
; https://php.net/input-encoding
;input_encoding =
; PHP output character encoding is set to empty.
; If empty, default_charset is used.
; See also output_buffer.
; https://php.net/output-encoding
;output_encoding =
;;;;;;;;;;;;;;;;;;;;;;;;;
; Paths and Directories ;
;;;;;;;;;;;;;;;;;;;;;;;;;
; UNIX: "/path1:/path2"
;include_path = ".:/php/includes"
;
; Windows: "\path1;\path2"
;include_path = ".;c:\php\includes"
;
; PHP's default setting for include_path is ".;/path/to/php/pear"
; https://php.net/include-path
; The root of the PHP pages, used only if nonempty.
; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root
; if you are running php as a CGI under any web server (other than IIS)
; see documentation for security issues. The alternate is to use the
; cgi.force_redirect configuration below
; https://php.net/doc-root
doc_root =
; The directory under which PHP opens the script using /~username used only
; if nonempty.
; https://php.net/user-dir
user_dir =
; Directory in which the loadable extensions (modules) reside.
; https://php.net/extension-dir
;extension_dir = "./"
; On windows:
;extension_dir = "ext"
; Directory where the temporary files should be placed.
; Defaults to the system default (see sys_get_temp_dir)
;sys_temp_dir = "/tmp"
; Whether or not to enable the dl() function. The dl() function does NOT work
; properly in multithreaded servers, such as IIS or Zeus, and is automatically
; disabled on them.
; https://php.net/enable-dl
enable_dl = Off
; cgi.force_redirect is necessary to provide security running PHP as a CGI under
; most web servers. Left undefined, PHP turns this on by default. You can
; turn it off here AT YOUR OWN RISK
; **You CAN safely turn this off for IIS, in fact, you MUST.**
; https://php.net/cgi.force-redirect
;cgi.force_redirect = 1
; if cgi.nph is enabled it will force cgi to always sent Status: 200 with
; every request. PHP's default behavior is to disable this feature.
;cgi.nph = 1
; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape
; (iPlanet) web servers, you MAY need to set an environment variable name that PHP
; will look for to know it is OK to continue execution. Setting this variable MAY
; cause security issues, KNOW WHAT YOU ARE DOING FIRST.
; https://php.net/cgi.redirect-status-env
;cgi.redirect_status_env =
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; https://php.net/cgi.fix-pathinfo
;cgi.fix_pathinfo=1
; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside
; of the web tree and people will not be able to circumvent .htaccess security.
;cgi.discard_path=1
; FastCGI under IIS supports the ability to impersonate
; security tokens of the calling client. This allows IIS to define the
; security context that the request runs under. mod_fastcgi under Apache
; does not currently support this feature (03/17/2002)
; Set to 1 if running under IIS. Default is zero.
; https://php.net/fastcgi.impersonate
;fastcgi.impersonate = 1
; Disable logging through FastCGI connection. PHP's default behavior is to enable
; this feature.
;fastcgi.logging = 0
; cgi.rfc2616_headers configuration option tells PHP what type of headers to
; use when sending HTTP response code. If set to 0, PHP sends Status: header that
; is supported by Apache. When this option is set to 1, PHP will send
; RFC2616 compliant header.
; Default is zero.
; https://php.net/cgi.rfc2616-headers
;cgi.rfc2616_headers = 0
; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!
; (shebang) at the top of the running script. This line might be needed if the
; script support running both as stand-alone script and via PHP CGI<. PHP in CGI
; mode skips this line and ignores its content if this directive is turned on.
; https://php.net/cgi.check-shebang-line
;cgi.check_shebang_line=1
;;;;;;;;;;;;;;;;
; File Uploads ;
;;;;;;;;;;;;;;;;
; Whether to allow HTTP file uploads.
; https://php.net/file-uploads
file_uploads = On
; Temporary directory for HTTP uploaded files (will use system default if not
; specified).
; https://php.net/upload-tmp-dir
;upload_tmp_dir =
; Maximum allowed size for uploaded files.
; https://php.net/upload-max-filesize
upload_max_filesize = 2M
; Maximum number of files that can be uploaded via a single request
max_file_uploads = 20
;;;;;;;;;;;;;;;;;;
; Fopen wrappers ;
;;;;;;;;;;;;;;;;;;
; Whether to allow the treatment of URLs (like http:// or ftp://) as files.
; https://php.net/allow-url-fopen
allow_url_fopen = On
; Whether to allow include/require to open URLs (like https:// or ftp://) as files.
; https://php.net/allow-url-include
allow_url_include = Off
; Define the anonymous ftp password (your email address). PHP's default setting
; for this is empty.
; https://php.net/from
;from="john@doe.com"
; Define the User-Agent string. PHP's default setting for this is empty.
; https://php.net/user-agent
;user_agent="PHP"
; Default timeout for socket based streams (seconds)
; https://php.net/default-socket-timeout
default_socket_timeout = 60
; If your scripts have to deal with files from Macintosh systems,
; or you are running on a Mac and need to deal with files from
; unix or win32 systems, setting this flag will cause PHP to
; automatically detect the EOL character in those files so that
; fgets() and file() will work regardless of the source of the file.
; https://php.net/auto-detect-line-endings
;auto_detect_line_endings = Off
;;;;;;;;;;;;;;;;;;;;;;
; Dynamic Extensions ;
;;;;;;;;;;;;;;;;;;;;;;
; If you wish to have an extension loaded automatically, use the following
; syntax:
;
; extension=modulename
;
; For example:
;
; extension=mysqli
;
; When the extension library to load is not located in the default extension
; directory, You may specify an absolute path to the library file:
;
; extension=/path/to/extension/mysqli.so
;
; Note : The syntax used in previous PHP versions ('extension=<ext>.so' and
; 'extension='php_<ext>.dll') is supported for legacy reasons and may be
; deprecated in a future PHP major version. So, when it is possible, please
; move to the new ('extension=<ext>) syntax.
;
; Notes for Windows environments :
;
; - Many DLL files are located in the ext/
; extension folders as well as the separate PECL DLL download.
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2
; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap
;extension=curl
;extension=ffi
;extension=ftp
;extension=fileinfo
;extension=gd
;extension=gettext
;extension=gmp
;extension=intl
;extension=imap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
;extension=oci8_12c ; Use with Oracle Database 12c Instant Client
;extension=oci8_19 ; Use with Oracle Database 19 Instant Client
;extension=odbc
;extension=openssl
;extension=pdo_firebird
;extension=pdo_mysql
;extension=pdo_oci
;extension=pdo_odbc
;extension=pdo_pgsql
;extension=pdo_sqlite
;extension=pgsql
;extension=shmop
; The MIBS data available in the PHP distribution must be installed.
; See https://www.php.net/manual/en/snmp.installation.php
;extension=snmp
;extension=soap
;extension=sockets
;extension=sodium
;extension=sqlite3
;extension=tidy
;extension=xsl
;extension=zip
;zend_extension=opcache
;;;;;;;;;;;;;;;;;;;
; Module Settings ;
;;;;;;;;;;;;;;;;;;;
[CLI Server]
; Whether the CLI web server uses ANSI color coding in its terminal output.
cli_server.color = On
[Date]
; Defines the default timezone used by the date functions
; https://php.net/date.timezone
;date.timezone =
; https://php.net/date.default-latitude
;date.default_latitude = 31.7667
; https://php.net/date.default-longitude
;date.default_longitude = 35.2333
; https://php.net/date.sunrise-zenith
;date.sunrise_zenith = 90.833333
; https://php.net/date.sunset-zenith
;date.sunset_zenith = 90.833333
[filter]
; https://php.net/filter.default
;filter.default = unsafe_raw
; https://php.net/filter.default-flags
;filter.default_flags =
[iconv]
; Use of this INI entry is deprecated, use global input_encoding instead.
; If empty, default_charset or input_encoding or iconv.input_encoding is used.
; The precedence is: default_charset < input_encoding < iconv.input_encoding
;iconv.input_encoding =
; Use of this INI entry is deprecated, use global internal_encoding instead.
; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.
; The precedence is: default_charset < internal_encoding < iconv.internal_encoding
;iconv.internal_encoding =
; Use of this INI entry is deprecated, use global output_encoding instead.
; If empty, default_charset or output_encoding or iconv.output_encoding is used.
; The precedence is: default_charset < output_encoding < iconv.output_encoding
; To use an output encoding conversion, iconv's output handler must be set
; otherwise output encoding conversion cannot be performed.
;iconv.output_encoding =
[imap]
; rsh/ssh logins are disabled by default. Use this INI entry if you want to
; enable them. Note that the IMAP library does not filter mailbox names before
; passing them to rsh/ssh command, thus passing untrusted data to this function
; with rsh/ssh enabled is insecure.
;imap.enable_insecure_rsh=0
[intl]
;intl.default_locale =
; This directive allows you to produce PHP errors when some error
; happens within intl functions. The value is the level of the error produced.
; Default is 0, which does not produce any errors.
;intl.error_level = E_WARNING
;intl.use_exceptions = 0
[sqlite3]
; Directory pointing to SQLite3 extensions
; https://php.net/sqlite3.extension-dir
;sqlite3.extension_dir =
; SQLite defensive mode flag (only available from SQLite 3.26+)
; When the defensive flag is enabled, language features that allow ordinary
; SQL to deliberately corrupt the database file are disabled. This forbids
; writing directly to the schema, shadow tables (eg. FTS data tables), or
; the sqlite_dbpage virtual table.
; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html
; (for older SQLite versions, this flag has no use)
;sqlite3.defensive = 1
[Pcre]
; PCRE library backtracking limit.
; https://php.net/pcre.backtrack-limit
;pcre.backtrack_limit=100000
; PCRE library recursion limit.
; Please note that if you set this value to a high number you may consume all
; the available process stack and eventually crash PHP (due to reaching the
; stack size limit imposed by the Operating System).
; https://php.net/pcre.recursion-limit
;pcre.recursion_limit=100000
; Enables or disables JIT compilation of patterns. This requires the PCRE
; library to be compiled with JIT support.
;pcre.jit=1
[Pdo]
; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off"
; https://php.net/pdo-odbc.connection-pooling
;pdo_odbc.connection_pooling=strict
[Pdo_mysql]
; Default socket name for local MySQL connects. If empty, uses the built-in
; MySQL defaults.
pdo_mysql.default_socket=
[Phar]
; https://php.net/phar.readonly
;phar.readonly = On
; https://php.net/phar.require-hash
;phar.require_hash = On
;phar.cache_list =
[mail function]
; For Win32 only.
; https://php.net/smtp
SMTP = localhost
; https://php.net/smtp-port
smtp_port = 25
; For Win32 only.
; https://php.net/sendmail-from
;sendmail_from = me@example.com
; For Unix only. You may supply arguments as well (default: "sendmail -t -i").
; https://php.net/sendmail-path
;sendmail_path =
; Force the addition of the specified parameters to be passed as extra parameters
; to the sendmail binary. These parameters will always replace the value of
; the 5th parameter to mail().
;mail.force_extra_parameters =
; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename
mail.add_x_header = Off
; Use mixed LF and CRLF line separators to keep compatibility with some
; RFC 2822 non conformant MTA.
mail.mixed_lf_and_crlf = Off
; The path to a log file that will log all mail() calls. Log entries include
; the full path of the script, line number, To address and headers.
;mail.log =
; Log mail to syslog (Event Log on Windows).
;mail.log = syslog
[ODBC]
; https://php.net/odbc.default-db
;odbc.default_db = Not yet implemented
; https://php.net/odbc.default-user
;odbc.default_user = Not yet implemented
; https://php.net/odbc.default-pw
;odbc.default_pw = Not yet implemented
; Controls the ODBC cursor model.
; Default: SQL_CURSOR_STATIC (default).
;odbc.default_cursortype
; Allow or prevent persistent links.
; https://php.net/odbc.allow-persistent
odbc.allow_persistent = On
; Check that a connection is still valid before reuse.
; https://php.net/odbc.check-persistent
odbc.check_persistent = On
; Maximum number of persistent links. -1 means no limit.
; https://php.net/odbc.max-persistent
odbc.max_persistent = -1
; Maximum number of links (persistent + non-persistent). -1 means no limit.
; https://php.net/odbc.max-links
odbc.max_links = -1
; Handling of LONG fields. Returns number of bytes to variables. 0 means
; passthru.
; https://php.net/odbc.defaultlrl
odbc.defaultlrl = 4096
; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.
; See the documentation on odbc_binmode and odbc_longreadlen for an explanation
; of odbc.defaultlrl and odbc.defaultbinmode
; https://php.net/odbc.defaultbinmode
odbc.defaultbinmode = 1
[MySQLi]
; Maximum number of persistent links. -1 means no limit.
; https://php.net/mysqli.max-persistent
mysqli.max_persistent = -1
; Allow accessing, from PHP's perspective, local files with LOAD DATA statements
; https://php.net/mysqli.allow_local_infile
;mysqli.allow_local_infile = On
; It allows the user to specify a folder where files that can be sent via LOAD DATA
; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.
;mysqli.local_infile_directory =
; Allow or prevent persistent links.
; https://php.net/mysqli.allow-persistent
mysqli.allow_persistent = On
; Maximum number of links. -1 means no limit.
; https://php.net/mysqli.max-links
mysqli.max_links = -1
; Default port number for mysqli_connect(). If unset, mysqli_connect() will use
; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the
; compile-time value defined MYSQL_PORT (in that order). Win32 will only look
; at MYSQL_PORT.
; https://php.net/mysqli.default-port
mysqli.default_port = 3306
; Default socket name for local MySQL connects. If empty, uses the built-in
; MySQL defaults.
; https://php.net/mysqli.default-socket
mysqli.default_socket =
; Default host for mysqli_connect() (doesn't apply in safe mode).
; https://php.net/mysqli.default-host
mysqli.default_host =
; Default user for mysqli_connect() (doesn't apply in safe mode).
; https://php.net/mysqli.default-user
mysqli.default_user =
; Default password for mysqli_connect() (doesn't apply in safe mode).
; Note that this is generally a *bad* idea to store passwords in this file.
; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw")
; and reveal this password! And of course, any users with read access to this
; file will be able to reveal the password as well.
; https://php.net/mysqli.default-pw
mysqli.default_pw =
; If this option is enabled, closing a persistent connection will rollback
; any pending transactions of this connection, before it is put back
; into the persistent connection pool.
;mysqli.rollback_on_cached_plink = Off
[mysqlnd]
; Enable / Disable collection of general statistics by mysqlnd which can be
; used to tune and monitor MySQL operations.
mysqlnd.collect_statistics = On
; Enable / Disable collection of memory usage statistics by mysqlnd which can be
; used to tune and monitor MySQL operations.
mysqlnd.collect_memory_statistics = On
; Records communication from all extensions using mysqlnd to the specified log
; file.
; https://php.net/mysqlnd.debug
;mysqlnd.debug =
; Defines which queries will be logged.
;mysqlnd.log_mask = 0
; Default size of the mysqlnd memory pool, which is used by result sets.
;mysqlnd.mempool_default_size = 16000
; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.
;mysqlnd.net_cmd_buffer_size = 2048
; Size of a pre-allocated buffer used for reading data sent by the server in
; bytes.
;mysqlnd.net_read_buffer_size = 32768
; Timeout for network requests in seconds.
;mysqlnd.net_read_timeout = 31536000
; SHA-256 Authentication Plugin related. File with the MySQL server public RSA
; key.
;mysqlnd.sha256_server_public_key =
[OCI8]
; Connection: Enables privileged connections using external
; credentials (OCI_SYSOPER, OCI_SYSDBA)
; https://php.net/oci8.privileged-connect
;oci8.privileged_connect = Off
; Connection: The maximum number of persistent OCI8 connections per
; process. Using -1 means no limit.
; https://php.net/oci8.max-persistent
;oci8.max_persistent = -1
; Connection: The maximum number of seconds a process is allowed to
; maintain an idle persistent connection. Using -1 means idle
; persistent connections will be maintained forever.
; https://php.net/oci8.persistent-timeout
;oci8.persistent_timeout = -1
; Connection: The number of seconds that must pass before issuing a
; ping during oci_pconnect() to check the connection validity. When
; set to 0, each oci_pconnect() will cause a ping. Using -1 disables
; pings completely.
; https://php.net/oci8.ping-interval
;oci8.ping_interval = 60
; Connection: Set this to a user chosen connection class to be used
; for all pooled server requests with Oracle Database Resident
; Connection Pooling (DRCP). To use DRCP, this value should be set to
; the same string for all web servers running the same application,
; the database pool must be configured, and the connection string must
; specify to use a pooled server.
;oci8.connection_class =
; High Availability: Using On lets PHP receive Fast Application
; Notification (FAN) events generated when a database node fails. The
; database must also be configured to post FAN events.
;oci8.events = Off
; Tuning: This option enables statement caching, and specifies how
; many statements to cache. Using 0 disables statement caching.
; https://php.net/oci8.statement-cache-size
;oci8.statement_cache_size = 20
; Tuning: Enables row prefetching and sets the default number of
; rows that will be fetched automatically after statement execution.
; https://php.net/oci8.default-prefetch
;oci8.default_prefetch = 100
; Tuning: Sets the amount of LOB data that is internally returned from
; Oracle Database when an Oracle LOB locator is initially retrieved as
; part of a query. Setting this can improve performance by reducing
; round-trips.
; https://php.net/oci8.prefetch-lob-size
; oci8.prefetch_lob_size = 0
; Compatibility. Using On means oci_close() will not close
; oci_connect() and oci_new_connect() connections.
; https://php.net/oci8.old-oci-close-semantics
;oci8.old_oci_close_semantics = Off
[PostgreSQL]
; Allow or prevent persistent links.
; https://php.net/pgsql.allow-persistent
pgsql.allow_persistent = On
; Detect broken persistent links always with pg_pconnect().
; Auto reset feature requires a little overheads.
; https://php.net/pgsql.auto-reset-persistent
pgsql.auto_reset_persistent = Off
; Maximum number of persistent links. -1 means no limit.
; https://php.net/pgsql.max-persistent
pgsql.max_persistent = -1
; Maximum number of links (persistent+non persistent). -1 means no limit.
; https://php.net/pgsql.max-links
pgsql.max_links = -1
; Ignore PostgreSQL backends Notice message or not.
; Notice message logging require a little overheads.
; https://php.net/pgsql.ignore-notice
pgsql.ignore_notice = 0
; Log PostgreSQL backends Notice message or not.
; Unless pgsql.ignore_notice=0, module cannot log notice message.
; https://php.net/pgsql.log-notice
pgsql.log_notice = 0
[bcmath]
; Number of decimal digits for all bcmath functions.
; https://php.net/bcmath.scale
bcmath.scale = 0
[browscap]
; https://php.net/browscap
;browscap = extra/browscap.ini
[Session]
; Handler used to store/retrieve data.
; https://php.net/session.save-handler
session.save_handler = files
; Argument passed to save_handler. In the case of files, this is the path
; where data files are stored. Note: Windows users have to change this
; variable in order to use PHP's session functions.
;
; The path can be defined as:
;
; session.save_path = "N;/path"
;
; where N is an integer. Instead of storing all the session files in
; /path, what this will do is use subdirectories N-levels deep, and
; store the session data in those directories. This is useful if
; your OS has problems with many files in one directory, and is
; a more efficient layout for servers that handle many sessions.
;
; NOTE 1: PHP will not create this directory structure automatically.
; You can use the script in the ext/session dir for that purpose.
; NOTE 2: See the section on garbage collection below if you choose to
; use subdirectories for session storage
;
; The file storage module creates files using mode 600 by default.
; You can change that by using
;
; session.save_path = "N;MODE;/path"
;
; where MODE is the octal representation of the mode. Note that this
; does not overwrite the process's umask.
; https://php.net/session.save-path
;session.save_path = "/tmp"
; Whether to use strict session mode.
; Strict session mode does not accept an uninitialized session ID, and
; regenerates the session ID if the browser sends an uninitialized session ID.
; Strict mode protects applications from session fixation via a session adoption
; vulnerability. It is disabled by default for maximum compatibility, but
; enabling it is encouraged.
; https://wiki.php.net/rfc/strict_sessions
session.use_strict_mode = 0
; Whether to use cookies.
; https://php.net/session.use-cookies
session.use_cookies = 1
; https://php.net/session.cookie-secure
;session.cookie_secure =
; This option forces PHP to fetch and use a cookie for storing and maintaining
; the session id. We encourage this operation as it's very helpful in combating
; session hijacking when not specifying and managing your own session id. It is
; not the be-all and end-all of session hijacking defense, but it's a good start.
; https://php.net/session.use-only-cookies
session.use_only_cookies = 1
; Name of the session (used as cookie name).
; https://php.net/session.name
session.name = PHPSESSID
; Initialize session on request startup.
; https://php.net/session.auto-start
session.auto_start = 0
; Lifetime in seconds of cookie or, if 0, until browser is restarted.
; https://php.net/session.cookie-lifetime
session.cookie_lifetime = 0
; The path for which the cookie is valid.
; https://php.net/session.cookie-path
session.cookie_path = /
; The domain for which the cookie is valid.
; https://php.net/session.cookie-domain
session.cookie_domain =
; Whether or not to add the httpOnly flag to the cookie, which makes it
; inaccessible to browser scripting languages such as JavaScript.
; https://php.net/session.cookie-httponly
session.cookie_httponly =
; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)
; Current valid values are "Strict", "Lax" or "None". When using "None",
; make sure to include the quotes, as `none` is interpreted like `false` in ini files.
; https://tools.ietf.org/html/draft-west-first-party-cookies-07
session.cookie_samesite =
; Handler used to serialize data. php is the standard serializer of PHP.
; https://php.net/session.serialize-handler
session.serialize_handler = php
; Defines the probability that the 'garbage collection' process is started on every
; session initialization. The probability is calculated by using gc_probability/gc_divisor,
; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.
; Default Value: 1
; Development Value: 1
; Production Value: 1
; https://php.net/session.gc-probability
session.gc_probability = 1
; Defines the probability that the 'garbage collection' process is started on every
; session initialization. The probability is calculated by using gc_probability/gc_divisor,
; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.
; For high volume production servers, using a value of 1000 is a more efficient approach.
; Default Value: 100
; Development Value: 1000
; Production Value: 1000
; https://php.net/session.gc-divisor
session.gc_divisor = 1000
; After this number of seconds, stored data will be seen as 'garbage' and
; cleaned up by the garbage collection process.
; https://php.net/session.gc-maxlifetime
session.gc_maxlifetime = 1440
; NOTE: If you are using the subdirectory option for storing session files
; (see session.save_path above), then garbage collection does *not*
; happen automatically. You will need to do your own garbage
; collection through a shell script, cron entry, or some other method.
; For example, the following script is the equivalent of setting
; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):
; find /path/to/sessions -cmin +24 -type f | xargs rm
; Check HTTP Referer to invalidate externally stored URLs containing ids.
; HTTP_REFERER has to contain this substring for the session to be
; considered as valid.
; https://php.net/session.referer-check
session.referer_check =
; Set to {nocache,private,public,} to determine HTTP caching aspects
; or leave this empty to avoid sending anti-caching headers.
; https://php.net/session.cache-limiter
session.cache_limiter = nocache
; Document expires after n minutes.
; https://php.net/session.cache-expire
session.cache_expire = 180
; trans sid support is disabled by default.
; Use of trans sid may risk your users' security.
; Use this option with caution.
; - User may send URL contains active session ID
; to other person via. email/irc/etc.
; - URL that contains active session ID may be stored
; in publicly accessible computer.
; - User may access your site with the same session ID
; always using URL stored in browser's history or bookmarks.
; https://php.net/session.use-trans-sid
session.use_trans_sid = 0
; Set session ID character length. This value could be between 22 to 256.
; Shorter length than default is supported only for compatibility reason.
; Users should use 32 or more chars.
; https://php.net/session.sid-length
; Default Value: 32
; Development Value: 26
; Production Value: 26
session.sid_length = 26
; The URL rewriter will look for URLs in a defined set of HTML tags.
; <form> is special; if you include them here, the rewriter will
; add a hidden <input> field with the info which is otherwise appended
; to URLs. <form> tag's action attribute URL will not be modified
; unless it is specified.
; Note that all valid entries require a "=", even if no value follows.
; Default Value: "a=href,area=href,frame=src,form="
; Development Value: "a=href,area=href,frame=src,form="
; Production Value: "a=href,area=href,frame=src,form="
; https://php.net/url-rewriter.tags
session.trans_sid_tags = "a=href,area=href,frame=src,form="
; URL rewriter does not rewrite absolute URLs by default.
; To enable rewrites for absolute paths, target hosts must be specified
; at RUNTIME. i.e. use ini_set()
; <form> tags is special. PHP will check action attribute's URL regardless
; of session.trans_sid_tags setting.
; If no host is defined, HTTP_HOST will be used for allowed host.
; Example value: php.net,www.php.net,wiki.php.net
; Use "," for multiple hosts. No spaces are allowed.
; Default Value: ""
; Development Value: ""
; Production Value: ""
;session.trans_sid_hosts=""
; Define how many bits are stored in each character when converting
; the binary hash data to something readable.
; Possible values:
; 4 (4 bits: 0-9, a-f)
; 5 (5 bits: 0-9, a-v)
; 6 (6 bits: 0-9, a-z, A-Z, "-", ",")
; Default Value: 4
; Development Value: 5
; Production Value: 5
; https://php.net/session.hash-bits-per-character
session.sid_bits_per_character = 5
; Enable upload progress tracking in $_SESSION
; Default Value: On
; Development Value: On
; Production Value: On
; https://php.net/session.upload-progress.enabled
;session.upload_progress.enabled = On
; Cleanup the progress information as soon as all POST data has been read
; (i.e. upload completed).
; Default Value: On
; Development Value: On
; Production Value: On
; https://php.net/session.upload-progress.cleanup
;session.upload_progress.cleanup = On
; A prefix used for the upload progress key in $_SESSION
; Default Value: "upload_progress_"
; Development Value: "upload_progress_"
; Production Value: "upload_progress_"
; https://php.net/session.upload-progress.prefix
;session.upload_progress.prefix = "upload_progress_"
; The index name (concatenated with the prefix) in $_SESSION
; containing the upload progress information
; Default Value: "PHP_SESSION_UPLOAD_PROGRESS"
; Development Value: "PHP_SESSION_UPLOAD_PROGRESS"
; Production Value: "PHP_SESSION_UPLOAD_PROGRESS"
; https://php.net/session.upload-progress.name
;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS"
; How frequently the upload progress should be updated.
; Given either in percentages (per-file), or in bytes
; Default Value: "1%"
; Development Value: "1%"
; Production Value: "1%"
; https://php.net/session.upload-progress.freq
;session.upload_progress.freq = "1%"
; The minimum delay between updates, in seconds
; Default Value: 1
; Development Value: 1
; Production Value: 1
; https://php.net/session.upload-progress.min-freq
;session.upload_progress.min_freq = "1"
; Only write session data when session data is changed. Enabled by default.
; https://php.net/session.lazy-write
;session.lazy_write = On
[Assertion]
; Switch whether to compile assertions at all (to have no overhead at run-time)
; -1: Do not compile at all
; 0: Jump over assertion at run-time
; 1: Execute assertions
; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)
; Default Value: 1
; Development Value: 1
; Production Value: -1
; https://php.net/zend.assertions
zend.assertions = 1
; Assert(expr); active by default.
; https://php.net/assert.active
;assert.active = On
; Throw an AssertionError on failed assertions
; https://php.net/assert.exception
;assert.exception = On
; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)
; https://php.net/assert.warning
;assert.warning = On
; Don't bail out by default.
; https://php.net/assert.bail
;assert.bail = Off
; User-function to be called if an assertion fails.
; https://php.net/assert.callback
;assert.callback = 0
[COM]
; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs
; https://php.net/com.typelib-file
;com.typelib_file =
; allow Distributed-COM calls
; https://php.net/com.allow-dcom
;com.allow_dcom = true
; autoregister constants of a component's typelib on com_load()
; https://php.net/com.autoregister-typelib
;com.autoregister_typelib = true
; register constants casesensitive
; https://php.net/com.autoregister-casesensitive
;com.autoregister_casesensitive = false
; show warnings on duplicate constant registrations
; https://php.net/com.autoregister-verbose
;com.autoregister_verbose = true
; The default character set code-page to use when passing strings to and from COM objects.
; Default: system ANSI code page
;com.code_page=
; The version of the .NET framework to use. The value of the setting are the first three parts
; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319".
;com.dotnet_version=
[mbstring]
; language for internal character representation.
; This affects mb_send_mail() and mbstring.detect_order.
; https://php.net/mbstring.language
;mbstring.language = Japanese
; Use of this INI entry is deprecated, use global internal_encoding instead.
; internal/script encoding.
; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)
; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.
; The precedence is: default_charset < internal_encoding < iconv.internal_encoding
;mbstring.internal_encoding =
; Use of this INI entry is deprecated, use global input_encoding instead.
; http input encoding.
; mbstring.encoding_translation = On is needed to use this setting.
; If empty, default_charset or input_encoding or mbstring.input is used.
; The precedence is: default_charset < input_encoding < mbstring.http_input
; https://php.net/mbstring.http-input
;mbstring.http_input =
; Use of this INI entry is deprecated, use global output_encoding instead.
; http output encoding.
; mb_output_handler must be registered as output buffer to function.
; If empty, default_charset or output_encoding or mbstring.http_output is used.
; The precedence is: default_charset < output_encoding < mbstring.http_output
; To use an output encoding conversion, mbstring's output handler must be set
; otherwise output encoding conversion cannot be performed.
; https://php.net/mbstring.http-output
;mbstring.http_output =
; enable automatic encoding translation according to
; mbstring.internal_encoding setting. Input chars are
; converted to internal encoding by setting this to On.
; Note: Do _not_ use automatic encoding translation for
; portable libs/applications.
; https://php.net/mbstring.encoding-translation
;mbstring.encoding_translation = Off
; automatic encoding detection order.
; "auto" detect order is changed according to mbstring.language
; https://php.net/mbstring.detect-order
;mbstring.detect_order = auto
; substitute_character used when character cannot be converted
; one from another
; https://php.net/mbstring.substitute-character
;mbstring.substitute_character = none
; Enable strict encoding detection.
;mbstring.strict_detection = Off
; This directive specifies the regex pattern of content types for which mb_output_handler()
; is activated.
; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml)
;mbstring.http_output_conv_mimetypes=
; This directive specifies maximum stack depth for mbstring regular expressions. It is similar
; to the pcre.recursion_limit for PCRE.
;mbstring.regex_stack_limit=100000
; This directive specifies maximum retry count for mbstring regular expressions. It is similar
; to the pcre.backtrack_limit for PCRE.
;mbstring.regex_retry_limit=1000000
[gd]
; Tell the jpeg decode to ignore warnings and try to create
; a gd image. The warning will then be displayed as notices
; disabled by default
; https://php.net/gd.jpeg-ignore-warning
;gd.jpeg_ignore_warning = 1
[exif]
; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.
; With mbstring support this will automatically be converted into the encoding
; given by corresponding encode setting. When empty mbstring.internal_encoding
; is used. For the decode settings you can distinguish between motorola and
; intel byte order. A decode setting cannot be empty.
; https://php.net/exif.encode-unicode
;exif.encode_unicode = ISO-8859-15
; https://php.net/exif.decode-unicode-motorola
;exif.decode_unicode_motorola = UCS-2BE
; https://php.net/exif.decode-unicode-intel
;exif.decode_unicode_intel = UCS-2LE
; https://php.net/exif.encode-jis
;exif.encode_jis =
; https://php.net/exif.decode-jis-motorola
;exif.decode_jis_motorola = JIS
; https://php.net/exif.decode-jis-intel
;exif.decode_jis_intel = JIS
[Tidy]
; The path to a default tidy configuration file to use when using tidy
; https://php.net/tidy.default-config
;tidy.default_config = /usr/local/lib/php/default.tcfg
; Should tidy clean and repair output automatically?
; WARNING: Do not use this option if you are generating non-html content
; such as dynamic images
; https://php.net/tidy.clean-output
tidy.clean_output = Off
[soap]
; Enables or disables WSDL caching feature.
; https://php.net/soap.wsdl-cache-enabled
soap.wsdl_cache_enabled=1
; Sets the directory name where SOAP extension will put cache files.
; https://php.net/soap.wsdl-cache-dir
soap.wsdl_cache_dir="/tmp"
; (time to live) Sets the number of second while cached file will be used
; instead of original one.
; https://php.net/soap.wsdl-cache-ttl
soap.wsdl_cache_ttl=86400
; Sets the size of the cache limit. (Max. number of WSDL files to cache)
soap.wsdl_cache_limit = 5
[sysvshm]
; A default size of the shared memory segment
;sysvshm.init_mem = 10000
[ldap]
; Sets the maximum number of open links or -1 for unlimited.
ldap.max_links = -1
[dba]
;dba.default_handler=
[opcache]
; Determines if Zend OPCache is enabled
;opcache.enable=1
; Determines if Zend OPCache is enabled for the CLI version of PHP
;opcache.enable_cli=0
; The OPcache shared memory storage size.
;opcache.memory_consumption=128
; The amount of memory for interned strings in Mbytes.
;opcache.interned_strings_buffer=8
; The maximum number of keys (scripts) in the OPcache hash table.
; Only numbers between 200 and 1000000 are allowed.
;opcache.max_accelerated_files=10000
; The maximum percentage of "wasted" memory until a restart is scheduled.
;opcache.max_wasted_percentage=5
; When this directive is enabled, the OPcache appends the current working
; directory to the script key, thus eliminating possible collisions between
; files with the same name (basename). Disabling the directive improves
; performance, but may break existing applications.
;opcache.use_cwd=1
; When disabled, you must reset the OPcache manually or restart the
; webserver for changes to the filesystem to take effect.
;opcache.validate_timestamps=1
; How often (in seconds) to check file timestamps for changes to the shared
; memory storage allocation. ("1" means validate once per second, but only
; once per request. "0" means always validate)
;opcache.revalidate_freq=2
; Enables or disables file search in include_path optimization
;opcache.revalidate_path=0
; If disabled, all PHPDoc comments are dropped from the code to reduce the
; size of the optimized code.
;opcache.save_comments=1
; If enabled, compilation warnings (including notices and deprecations) will
; be recorded and replayed each time a file is included. Otherwise, compilation
; warnings will only be emitted when the file is first cached.
;opcache.record_warnings=0
; Allow file existence override (file_exists, etc.) performance feature.
;opcache.enable_file_override=0
; A bitmask, where each bit enables or disables the appropriate OPcache
; passes
;opcache.optimization_level=0x7FFFBFFF
;opcache.dups_fix=0
; The location of the OPcache blacklist file (wildcards allowed).
; Each OPcache blacklist file is a text file that holds the names of files
; that should not be accelerated. The file format is to add each filename
; to a new line. The filename may be a full path or just a file prefix
; (i.e., /var/www/x blacklists all the files and directories in /var/www
; that start with 'x'). Line starting with a ; are ignored (comments).
;opcache.blacklist_filename=
; Allows exclusion of large files from being cached. By default all files
; are cached.
;opcache.max_file_size=0
; Check the cache checksum each N requests.
; The default value of "0" means that the checks are disabled.
;opcache.consistency_checks=0
; How long to wait (in seconds) for a scheduled restart to begin if the cache
; is not being accessed.
;opcache.force_restart_timeout=180
; OPcache error_log file name. Empty string assumes "stderr".
;opcache.error_log=
; All OPcache errors go to the Web server log.
; By default, only fatal errors (level 0) or errors (level 1) are logged.
; You can also enable warnings (level 2), info messages (level 3) or
; debug messages (level 4).
;opcache.log_verbosity_level=1
; Preferred Shared Memory back-end. Leave empty and let the system decide.
;opcache.preferred_memory_model=
; Protect the shared memory from unexpected writing during script execution.
; Useful for internal debugging only.
;opcache.protect_memory=0
; Allows calling OPcache API functions only from PHP scripts which path is
; started from specified string. The default "" means no restriction
;opcache.restrict_api=
; Mapping base of shared memory segments (for Windows only). All the PHP
; processes have to map shared memory into the same address space. This
; directive allows to manually fix the "Unable to reattach to base address"
; errors.
;opcache.mmap_base=
; Facilitates multiple OPcache instances per user (for Windows only). All PHP
; processes with the same cache ID and user share an OPcache instance.
;opcache.cache_id=
; Enables and sets the second level cache directory.
; It should improve performance when SHM memory is full, at server restart or
; SHM reset. The default "" disables file based caching.
;opcache.file_cache=
; Enables or disables opcode caching in shared memory.
;opcache.file_cache_only=0
; Enables or disables checksum validation when script loaded from file cache.
;opcache.file_cache_consistency_checks=1
; Implies opcache.file_cache_only=1 for a certain process that failed to
; reattach to the shared memory (for Windows only). Explicitly enabled file
; cache is required.
;opcache.file_cache_fallback=1
; Enables or disables copying of PHP code (text segment) into HUGE PAGES.
; Under certain circumstances (if only a single global PHP process is
; started from which all others fork), this can increase performance
; by a tiny amount because TLB misses are reduced. On the other hand, this
; delays PHP startup, increases memory usage and degrades performance
; under memory pressure - use with care.
; Requires appropriate OS configuration.
;opcache.huge_code_pages=0
; Validate cached file permissions.
;opcache.validate_permission=0
; Prevent name collisions in chroot'ed environment.
;opcache.validate_root=0
; If specified, it produces opcode dumps for debugging different stages of
; optimizations.
;opcache.opt_debug_level=0
; Specifies a PHP script that is going to be compiled and executed at server
; start-up.
; https://php.net/opcache.preload
;opcache.preload=
; Preloading code as root is not allowed for security reasons. This directive
; facilitates to let the preloading to be run as another user.
; https://php.net/opcache.preload_user
;opcache.preload_user=
; Prevents caching files that are less than this number of seconds old. It
; protects from caching of incompletely updated files. In case all file updates
; on your site are atomic, you may increase performance by setting it to "0".
;opcache.file_update_protection=2
; Absolute path used to store shared lockfiles (for *nix only).
;opcache.lockfile_path=/tmp
[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
;curl.cainfo =
[openssl]
; The location of a Certificate Authority (CA) file on the local filesystem
; to use when verifying the identity of SSL/TLS peers. Most users should
; not specify a value for this directive as PHP will attempt to use the
; OS-managed cert stores in its absence. If specified, this value may still
; be overridden on a per-stream basis via the "cafile" SSL stream context
; option.
;openssl.cafile=
; If openssl.cafile is not specified or if the CA file is not found, the
; directory pointed to by openssl.capath is searched for a suitable
; certificate. This value must be a correctly hashed certificate directory.
; Most users should not specify a value for this directive as PHP will
; attempt to use the OS-managed cert stores in its absence. If specified,
; this value may still be overridden on a per-stream basis via the "capath"
; SSL stream context option.
;openssl.capath=
[ffi]
; FFI API restriction. Possible values:
; "preload" - enabled in CLI scripts and preloaded files (default)
; "false" - always disabled
; "true" - always enabled
;ffi.enable=preload
; List of headers files to preload, wildcard patterns allowed.
;ffi.preload=
PK ;K]���q+ q+ ' ea-php82-php-common/CODING_STANDARDS.mdnu ȯ�� # PHP coding standards
This file lists standards that any programmer adding or changing code in
PHP should follow. The code base does not yet fully follow it, but new
features are going in that general direction. Many sections have been
rewritten to comply with these rules.
## Code implementation
1. Document your code in source files and the manual. (tm)
2. Functions that are given pointers to resources should not free them.
For instance, `function int mail(char *to, char *from)` should NOT free `to`
and/or `from`.
Exceptions:
* The function's designated behavior is freeing that resource. E.g.
`efree()`
* The function is given a boolean argument, that controls whether or not the
function may free its arguments (if true, the function must free its
arguments; if false, it must not)
* Low-level parser routines, that are tightly integrated with the token
cache and the bison code for minimum memory copying overhead.
3. Functions that are tightly integrated with other functions within the same
module, and rely on each other's non-trivial behavior, should be documented as
such and declared `static`. They should be avoided if possible.
4. Use definitions and macros whenever possible, so that constants have
meaningful names and can be easily manipulated. Any use of a numeric
constant to specify different behavior or actions should be done through
a `#define`.
5. When writing functions that deal with strings, be sure to remember that PHP
holds the length property of each string, and that it shouldn't be
calculated with `strlen()`. Write your functions in such a way so that
they'll take advantage of the length property, both for efficiency and in
order for them to be binary-safe. Functions that change strings and obtain
their new lengths while doing so, should return that new length, so it
doesn't have to be recalculated with `strlen()` (e.g. `php_addslashes()`).
6. NEVER USE `strncat()`. If you're absolutely sure you know what you're doing,
check its man page again, and only then, consider using it, and even then,
try avoiding it.
7. Use `PHP_*` macros in the PHP source, and `ZEND_*` macros in the Zend part of
the source. Although the `PHP_*` macros are mostly aliased to the `ZEND_*`
macros it gives a better understanding on what kind of macro you're calling.
8. When commenting out code using a `#if` statement, do NOT use `0` only.
Instead use `"<git username here>_0"`. For example, `#if FOO_0`, where `FOO`
is your git user `foo`. This allows easier tracking of why code was
commented out, especially in bundled libraries.
9. Do not define functions that are not available. For instance, if a library is
missing a function, do not define the PHP version of the function, and do
not raise a run-time error about the function not existing. End users should
use `function_exists()` to test for the existence of a function.
10. Prefer `emalloc()`, `efree()`, `estrdup()`, etc. to their standard C library
counterparts. These functions implement an internal "safety-net" mechanism
that ensures the deallocation of any unfreed memory at the end of a request.
They also provide useful allocation and overflow information while running
in debug mode.
In almost all cases, memory returned to the engine must be allocated using
`emalloc()`.
The use of `malloc()` should be limited to cases where a third-party library
may need to control or free the memory, or when the memory in question needs
to survive between multiple requests.
## User functions/methods naming conventions
1. Function names for user-level functions should be enclosed with in the
`PHP_FUNCTION()` macro. They should be in lowercase, with words underscore
delimited, with care taken to minimize the letter count. Abbreviations
should not be used when they greatly decrease the readability of the
function name itself:
Good:
```php
str_word_count
array_key_exists
```
Ok:
```php
date_interval_create_from_date_string
// Could be 'date_intvl_create_from_date_str'?
get_html_translation_table()
// Could be 'html_get_trans_table'?
```
Bad:
```php
hw_GetObjectByQueryCollObj
pg_setclientencoding
jf_n_s_i
```
2. If they are part of a "parent set" of functions, that parent should be
included in the user function name, and should be clearly related to the
parent program or function family. This should be in the form of `parent_*`:
A family of `foo` functions, for example:
Good:
```php
foo_select_bar
foo_insert_baz
foo_delete_baz
```
Bad:
```php
fooselect_bar
fooinsertbaz
delete_foo_baz
```
3. Function names used by user functions should be prefixed with `_php_`, and
followed by a word or an underscore-delimited list of words, in lowercase
letters, that describes the function. If applicable, they should be declared
`static`.
4. Variable names must be meaningful. One letter variable names must be avoided,
except for places where the variable has no real meaning or a trivial
meaning (e.g. `for (i=0; i<100; i++) ...`).
5. Variable names should be in lowercase. Use underscores to separate between
words.
6. Method names follow the *studlyCaps* (also referred to as *bumpy case* or
*camel caps*) naming convention, with care taken to minimize the letter
count. The initial letter of the name is lowercase, and each letter that
starts a new `word` is capitalized:
Good:
```php
connect()
getData()
buildSomeWidget()
```
Bad:
```php
get_Data()
buildsomewidget()
getI()
```
7. Class names should be descriptive nouns in *PascalCase* and as short as
possible. Each word in the class name should start with a capital letter,
without underscore delimiters. The class name should be prefixed with the
name of the "parent set" (e.g. the name of the extension) if no namespaces
are used. Abbreviations and acronyms as well as initialisms should be
avoided wherever possible, unless they are much more widely used than the
long form (e.g. HTTP or URL). Abbreviations start with a capital letter
followed by lowercase letters, whereas acronyms and initialisms are written
according to their standard notation. Usage of acronyms and initialisms is
not allowed if they are not widely adopted and recognized as such.
Good:
```php
Curl
CurlResponse
HTTPStatusCode
URL
BTreeMap // B-tree Map
Id // Identifier
ID // Identity Document
Char // Character
Intl // Internationalization
Radar // Radio Detecting and Ranging
```
Bad:
```php
curl
curl_response
HttpStatusCode
Url
BtreeMap
ID // Identifier
CHAR
INTL
RADAR // Radio Detecting and Ranging
```
## Internal function naming conventions
1. Functions that are part of the external API should be named
`php_modulename_function()` to avoid symbol collision. They should be in
lowercase, with words underscore delimited. Exposed API must be defined in
`php_modulename.h`.
```c
PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS);
```
Unexposed module function should be static and should not be defined in
`php_modulename.h`.
```c
static int php_session_destroy()
```
2. Main module source file must be named `modulename.c`.
3. Header file that is used by other sources must be named `php_modulename.h`.
## Syntax and indentation
1. Never use C++ style comments (i.e. `//` comment). Always use C-style comments
instead. PHP is written in C, and is aimed at compiling under any ANSI-C
compliant compiler. Even though many compilers accept C++-style comments in
C code, you have to ensure that your code would compile with other compilers
as well. The only exception to this rule is code that is Win32-specific,
because the Win32 port is MS-Visual C++ specific, and this compiler is known
to accept C++-style comments in C code.
2. Use K&R-style. Of course, we can't and don't want to force anybody to use a
style he or she is not used to, but, at the very least, when you write code
that goes into the core of PHP or one of its standard modules, please
maintain the K&R style. This applies to just about everything, starting with
indentation and comment styles and up to function declaration syntax. Also
see [Indentstyle](http://www.catb.org/~esr/jargon/html/I/indent-style.html).
3. Be generous with whitespace and braces. Keep one empty line between the
variable declaration section and the statements in a block, as well as
between logical statement groups in a block. Maintain at least one empty
line between two functions, preferably two. Always prefer:
```c
if (foo) {
bar;
}
```
to:
```c
if(foo)bar;
```
4. When indenting, use the tab character. A tab is expected to represent four
spaces. It is important to maintain consistency in indentation so that
definitions, comments, and control structures line up correctly.
5. Preprocessor statements (`#if` and such) MUST start at column one. To indent
preprocessor directives you should put the `#` at the beginning of a line,
followed by any number of spaces.
## Testing
1. Extensions should be well tested using `*.phpt` tests. Read more at
[qa.php.net](https://qa.php.net/write-test.php) documentation.
## New and experimental functions
To reduce the problems normally associated with the first public implementation
of a new set of functions, it has been suggested that the first implementation
include a file labeled `EXPERIMENTAL` in the function directory, and that the
functions follow the standard prefixing conventions during their initial
implementation.
The file labelled `EXPERIMENTAL` should include the following information:
* Any authoring information (known bugs, future directions of the module).
* Ongoing status notes which may not be appropriate for Git comments.
In general, new features should go to PECL or experimental branches until there
are specific reasons for directly adding them to the core distribution.
## Aliases & legacy documentation
You may also have some deprecated aliases with close to duplicate names, for
example, `somedb_select_result` and `somedb_selectresult`. For documentation
purposes, these will only be documented by the most current name, with the
aliases listed in the documentation for the parent function. For ease of
reference, user-functions with completely different names, that alias to the
same function (such as `highlight_file` and `show_source`), will be separately
documented.
Backwards compatible functions and names should be maintained as long as the
code can be reasonably be kept as part of the codebase. See the `README` in the
PHP documentation repository for more information on documentation.
PK ;K]`/� v v & ea-php82-php-common/README.REDIST.BINSnu ȯ�� 1. libmagic (ext/fileinfo) see ext/fileinfo/libmagic/LICENSE
2. libmbfl (ext/mbstring) see ext/mbstring/libmbfl/LICENSE
3. pcre2lib (ext/pcre)
4. ext/standard crypt
5. ext/standard crypt's blowfish implementation
6. ext/standard/rand
7. ext/standard/scanf
8. ext/standard/strnatcmp.c
9. ext/standard/uuencode
10. main/snprintf.c
11. main/strlcat
12. main/strlcpy
13. libgd (ext/gd)
14. ext/phar portions of tar implementations
15. ext/phar/zip.c portion extracted from libzip
16. libbcmath (ext/bcmath) see ext/bcmath/libbcmath/LICENSE
17. ext/mbstring/ucgendat portions based on the ucgendat.c from the OpenLDAP
18. avifinfo (ext/standard/libavifinfo) see ext/standard/libavifinfo/LICENSE
19. xxHash (ext/hash/xxhash)
3. pcre2lib (ext/pcre)
PCRE2 LICENCE
-------------
PCRE2 is a library of functions to support regular expressions whose syntax
and semantics are as close as possible to those of the Perl 5 language.
Releases 10.00 and above of PCRE2 are distributed under the terms of the "BSD"
licence, as specified below, with one exemption for certain binary
redistributions. The documentation for PCRE2, supplied in the "doc" directory,
is distributed under the same terms as the software itself. The data in the
testdata directory is not copyrighted and is in the public domain.
The basic library functions are written in C and are freestanding. Also
included in the distribution is a just-in-time compiler that can be used to
optimize pattern matching. This is an optional feature that can be omitted when
the library is built.
THE BASIC LIBRARY FUNCTIONS
---------------------------
Written by: Philip Hazel
Email local part: ph10
Email domain: cam.ac.uk
University of Cambridge Computing Service,
Cambridge, England.
Copyright (c) 1997-2019 University of Cambridge
All rights reserved.
PCRE2 JUST-IN-TIME COMPILATION SUPPORT
--------------------------------------
Written by: Zoltan Herczeg
Email local part: hzmester
Email domain: freemail.hu
Copyright(c) 2010-2019 Zoltan Herczeg
All rights reserved.
STACK-LESS JUST-IN-TIME COMPILER
--------------------------------
Written by: Zoltan Herczeg
Email local part: hzmester
Email domain: freemail.hu
Copyright(c) 2009-2019 Zoltan Herczeg
All rights reserved.
THE "BSD" LICENCE
-----------------
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notices,
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notices, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
* Neither the name of the University of Cambridge nor the names of any
contributors may be used to endorse or promote products derived from this
software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
EXEMPTION FOR BINARY LIBRARY-LIKE PACKAGES
------------------------------------------
The second condition in the BSD licence (covering binary redistributions) does
not apply all the way down a chain of software. If binary package A includes
PCRE2, it must respect the condition, but if package B is software that
includes package A, the condition is not imposed on package B unless it uses
PCRE2 independently.
End
4. ext/standard crypt
FreeSec: libcrypt for NetBSD
Copyright (c) 1994 David Burren
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. Neither the name of the author nor the names of other contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
5. ext/standard crypt's blowfish implementation
The crypt_blowfish homepage is:
http://www.openwall.com/crypt/
This code comes from John the Ripper password cracker, with reentrant
and crypt(3) interfaces added, but optimizations specific to password
cracking removed.
Written by Solar Designer <solar at openwall.com> in 1998-2011.
No copyright is claimed, and the software is hereby placed in the public
domain. In case this attempt to disclaim copyright and place the software
in the public domain is deemed null and void, then the software is
Copyright (c) 1998-2011 Solar Designer and it is hereby released to the
general public under the following terms:
Redistribution and use in source and binary forms, with or without
modification, are permitted.
There's ABSOLUTELY NO WARRANTY, express or implied.
It is my intent that you should be able to use this on your system,
as part of a software package, or anywhere else to improve security,
ensure compatibility, or for any other purpose. I would appreciate
it if you give credit where it is due and keep your modifications in
the public domain as well, but I don't require that in order to let
you place this code and any modifications you make under a license
of your choice.
This implementation is mostly compatible with OpenBSD's bcrypt.c (prefix
"$2a$") by Niels Provos <provos at citi.umich.edu>, and uses some of his
ideas. The password hashing algorithm was designed by David Mazieres
<dm at lcs.mit.edu>. For more information on the level of compatibility,
please refer to the comments in BF_set_key() and to the crypt(3) man page
included in the crypt_blowfish tarball.
There's a paper on the algorithm that explains its design decisions:
http://www.usenix.org/events/usenix99/provos.html
Some of the tricks in BF_ROUND might be inspired by Eric Young's
Blowfish library (I can't be sure if I would think of something if I
hadn't seen his code).
6. ext/standard/rand
The following php_mt_...() functions are based on a C++ class MTRand by
Richard J. Wagner. For more information see the web page at
http://www-personal.engin.umich.edu/~wagnerr/MersenneTwister.html
Mersenne Twister random number generator -- a C++ class MTRand
Based on code by Makoto Matsumoto, Takuji Nishimura, and Shawn Cokus
Richard J. Wagner v1.0 15 May 2003 rjwagner@writeme.com
The Mersenne Twister is an algorithm for generating random numbers. It
was designed with consideration of the flaws in various other generators.
The period, 2^19937-1, and the order of equidistribution, 623 dimensions,
are far greater. The generator is also fast; it avoids multiplication and
division, and it benefits from caches and pipelines. For more information
see the inventors' web page at http://www.math.keio.ac.jp/~matumoto/emt.html
Reference
M. Matsumoto and T. Nishimura, "Mersenne Twister: A 623-Dimensionally
Equidistributed Uniform Pseudo-Random Number Generator", ACM Transactions on
Modeling and Computer Simulation, Vol. 8, No. 1, January 1998, pp 3-30.
Copyright (C) 1997 - 2002, Makoto Matsumoto and Takuji Nishimura,
Copyright (C) 2000 - 2003, Richard J. Wagner
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. The names of its contributors may not be used to endorse or promote
products derived from this software without specific prior written
permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
7. ext/standard/scanf
scanf.c --
This file contains the base code which implements sscanf and by extension
fscanf. Original code is from TCL8.3.0 and bears the following copyright:
This software is copyrighted by the Regents of the University of
California, Sun Microsystems, Inc., Scriptics Corporation,
and other parties. The following terms apply to all files associated
with the software unless explicitly disclaimed in individual files.
The authors hereby grant permission to use, copy, modify, distribute,
and license this software and its documentation for any purpose, provided
that existing copyright notices are retained in all copies and that this
notice is included verbatim in any distributions. No written agreement,
license, or royalty fee is required for any of the authorized uses.
Modifications to this software may be copyrighted by their authors
and need not follow the licensing terms described here, provided that
the new terms are clearly indicated on the first page of each file where
they apply.
IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY
FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
ARISING OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY
DERIVATIVES THEREOF, EVEN IF THE AUTHORS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
THE AUTHORS AND DISTRIBUTORS SPECIFICALLY DISCLAIM ANY WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS SOFTWARE
IS PROVIDED ON AN "AS IS" BASIS, AND THE AUTHORS AND DISTRIBUTORS HAVE
NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.
GOVERNMENT USE: If you are acquiring this software on behalf of the
U.S. government, the Government shall have only "Restricted Rights"
in the software and related documentation as defined in the Federal
Acquisition Regulations (FARs) in Clause 52.227.19 (c) (2). If you
are acquiring the software on behalf of the Department of Defense, the
software shall be classified as "Commercial Computer Software" and the
Government shall have only "Restricted Rights" as defined in Clause
252.227-7013 (c) (1) of DFARs. Notwithstanding the foregoing, the
authors grant the U.S. Government and others acting in its behalf
permission to use and distribute the software in accordance with the
terms specified in this license.
8. ext/standard/strnatcmp.c
strnatcmp.c -- Perform 'natural order' comparisons of strings in C.
Copyright (C) 2000 by Martin Pool <mbp@humbug.org.au>
This software is provided 'as-is', without any express or implied
warranty. In no event will the authors be held liable for any damages
arising from the use of this software.
Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:
1. The origin of this software must not be misrepresented; you must not
claim that you wrote the original software. If you use this software
in a product, an acknowledgment in the product documentation would be
appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.
9. ext/standard/uuencode
Portions of this code are based on Berkeley's uuencode/uudecode
implementation.
Copyright (c) 1983, 1993
The Regents of the University of California. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software
must display the following acknowledgement:
This product includes software developed by the University of
California, Berkeley and its contributors.
4. Neither the name of the University nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
10. main/snprintf.c
Copyright (c) 2002, 2006 Todd C. Miller <Todd.Miller@courtesan.com>
Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
Sponsored in part by the Defense Advanced Research Projects
Agency (DARPA) and Air Force Research Laboratory, Air Force
Materiel Command, USAF, under agreement number F39502-99-1-0512.
main/spprintf
Copyright (c) 1995-1998 The Apache Group. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
3. All advertising materials mentioning features or use of this
software must display the following acknowledgment:
"This product includes software developed by the Apache Group
for use in the Apache HTTP server project (http://www.apache.org/)."
4. The names "Apache Server" and "Apache Group" must not be used to
endorse or promote products derived from this software without
prior written permission.
5. Redistributions of any form whatsoever must retain the following
acknowledgment:
"This product includes software developed by the Apache Group
for use in the Apache HTTP server project (http://www.apache.org/)."
THIS SOFTWARE IS PROVIDED BY THE APACHE GROUP ``AS IS'' AND ANY
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE APACHE GROUP OR
ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.
====================================================================
This software consists of voluntary contributions made by many
individuals on behalf of the Apache Group and was originally based
on public domain software written at the National Center for
Supercomputing Applications, University of Illinois, Urbana-Champaign.
For more information on the Apache Group and the Apache HTTP server
project, please see <http://www.apache.org/>.
This code is based on, and used with the permission of, the
SIO stdio-replacement strx_* functions by Panos Tsirigotis
<panos@alumni.cs.colorado.edu> for xinetd.
11. main/strlcat
12. main/strlcpy
Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. The name of the author may not be used to endorse or promote products
derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
13. libgd (ext/gd)
* Portions copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
2002, 2003, 2004 by Cold Spring Harbor Laboratory. Funded under
Grant P41-RR02188 by the National Institutes of Health.
* Portions copyright 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003,
2004 by Boutell.Com, Inc.
* Portions relating to GD2 format copyright 1999, 2000, 2001, 2002,
2003, 2004 Philip Warner.
* Portions relating to PNG copyright 1999, 2000, 2001, 2002, 2003,
2004 Greg Roelofs.
* Portions relating to gdttf.c copyright 1999, 2000, 2001, 2002,
2003, 2004 John Ellson (ellson@graphviz.org).
* Portions relating to gdft.c copyright 2001, 2002, 2003, 2004 John
Ellson (ellson@graphviz.org).
* Portions copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
Pierre-Alain Joye (pierre@libgd.org).
* Portions relating to JPEG and to color quantization copyright
2000, 2001, 2002, 2003, 2004, Doug Becker and copyright (C) 1994,
1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004 Thomas
G. Lane. This software is based in part on the work of the
Independent JPEG Group. See the file README-JPEG.TXT for more
information.
* Portions relating to GIF compression copyright 1989 by Jef
Poskanzer and David Rowley, with modifications for thread safety
by Thomas Boutell.
* Portions relating to GIF decompression copyright 1990, 1991, 1993
by David Koblas, with modifications for thread safety by Thomas
Boutell.
* Portions relating to WBMP copyright 2000, 2001, 2002, 2003, 2004
Maurice Szmurlo and Johan Van den Brande.
* Portions relating to GIF animations copyright 2004 Jaakko Hyvätti
(jaakko.hyvatti@iki.fi)
Permission has been granted to copy, distribute and modify gd in
any context without fee, including a commercial application,
provided that this notice is present in user-accessible supporting
documentation.
This does not affect your ownership of the derived work itself,
and the intent is to assure proper credit for the authors of gd,
not to interfere with your productive use of gd. If you have
questions, ask. "Derived works" includes all programs that utilize
the library. Credit must be given in user-accessible
documentation.
This software is provided "AS IS." The copyright holders disclaim
all warranties, either express or implied, including but not
limited to implied warranties of merchantability and fitness for a
particular purpose, with respect to this code and accompanying
documentation.
Although their code does not appear in the current release, the
authors wish to thank David Koblas, David Rowley, and Hutchison
Avenue Software Corporation for their prior contributions.
END OF COPYRIGHT STATEMENT
14. ext/phar portions of tar implementations
portions of tar implementations in ext/phar - phar_tar_octal() are based on an
implementation by Tim Kientzle from libarchive, licensed with this license:
Copyright (c) 2003-2007 Tim Kientzle
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
15. ext/phar/zip.c portion extracted from libzip
zip_dirent.c -- read directory entry (local or central), clean dirent
Copyright (C) 1999, 2003, 2004, 2005 Dieter Baron and Thomas Klausner
This function is part of libzip, a library to manipulate ZIP archives.
The authors can be contacted at <nih@giga.or.at>
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
3. The names of the authors may not be used to endorse or promote
products derived from this software without specific prior
written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
17. ext/mbstring/ucgendat portions based on the ucgendat.c from the OpenLDAP
The OpenLDAP Public License
Version 2.8, 17 August 2003
Redistribution and use of this software and associated documentation
("Software"), with or without modification, are permitted provided
that the following conditions are met:
1. Redistributions in source form must retain copyright statements
and notices,
2. Redistributions in binary form must reproduce applicable copyright
statements and notices, this list of conditions, and the following
disclaimer in the documentation and/or other materials provided
with the distribution, and
3. Redistributions must contain a verbatim copy of this document.
The OpenLDAP Foundation may revise this license from time to time.
Each revision is distinguished by a version number. You may use
this Software under terms of this license revision or under the
terms of any subsequent revision of the license.
THIS SOFTWARE IS PROVIDED BY THE OPENLDAP FOUNDATION AND ITS
CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
SHALL THE OPENLDAP FOUNDATION, ITS CONTRIBUTORS, OR THE AUTHOR(S)
OR OWNER(S) OF THE SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
The names of the authors and copyright holders must not be used in
advertising or otherwise to promote the sale, use or other dealing
in this Software without specific, written prior permission. Title
to copyright in this Software shall at all times remain with copyright
holders.
OpenLDAP is a registered trademark of the OpenLDAP Foundation.
Copyright 1999-2003 The OpenLDAP Foundation, Redwood City,
California, USA. All Rights Reserved. Permission to copy and
distribute verbatim copies of this document is granted.
19. xxHash
xxHash - Extremely Fast Hash algorithm
Header File
Copyright (C) 2012-2020 Yann Collet
BSD 2-Clause License (https://www.opensource.org/licenses/bsd-license.php)
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
You can contact the author at:
- xxHash homepage: https://www.xxhash.com
- xxHash source repository: https://github.com/Cyan4973/xxHash
PK ;K]$�-�� � & ea-php82-php-common/php.ini-productionnu ȯ�� [PHP]
;;;;;;;;;;;;;;;;;;;
; About php.ini ;
;;;;;;;;;;;;;;;;;;;
; PHP's initialization file, generally called php.ini, is responsible for
; configuring many of the aspects of PHP's behavior.
; PHP attempts to find and load this configuration from a number of locations.
; The following is a summary of its search order:
; 1. SAPI module specific location.
; 2. The PHPRC environment variable.
; 3. A number of predefined registry keys on Windows
; 4. Current working directory (except CLI)
; 5. The web server's directory (for SAPI modules), or directory of PHP
; (otherwise in Windows)
; 6. The directory from the --with-config-file-path compile time option, or the
; Windows directory (usually C:\windows)
; See the PHP docs for more specific information.
; https://php.net/configuration.file
; The syntax of the file is extremely simple. Whitespace and lines
; beginning with a semicolon are silently ignored (as you probably guessed).
; Section headers (e.g. [Foo]) are also silently ignored, even though
; they might mean something in the future.
; Directives following the section heading [PATH=/www/mysite] only
; apply to PHP files in the /www/mysite directory. Directives
; following the section heading [HOST=www.example.com] only apply to
; PHP files served from www.example.com. Directives set in these
; special sections cannot be overridden by user-defined INI files or
; at runtime. Currently, [PATH=] and [HOST=] sections only work under
; CGI/FastCGI.
; https://php.net/ini.sections
; Directives are specified using the following syntax:
; directive = value
; Directive names are *case sensitive* - foo=bar is different from FOO=bar.
; Directives are variables used to configure PHP or PHP extensions.
; There is no name validation. If PHP can't find an expected
; directive because it is not set or is mistyped, a default value will be used.
; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one
; of the INI constants (On, Off, True, False, Yes, No and None) or an expression
; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a
; previously set variable or directive (e.g. ${foo})
; Expressions in the INI file are limited to bitwise operators and parentheses:
; | bitwise OR
; ^ bitwise XOR
; & bitwise AND
; ~ bitwise NOT
; ! boolean NOT
; Boolean flags can be turned on using the values 1, On, True or Yes.
; They can be turned off using the values 0, Off, False or No.
; An empty string can be denoted by simply not writing anything after the equal
; sign, or by using the None keyword:
; foo = ; sets foo to an empty string
; foo = None ; sets foo to an empty string
; foo = "None" ; sets foo to the string 'None'
; If you use constants in your value, and these constants belong to a
; dynamically loaded extension (either a PHP extension or a Zend extension),
; you may only use these constants *after* the line that loads the extension.
;;;;;;;;;;;;;;;;;;;
; About this file ;
;;;;;;;;;;;;;;;;;;;
; PHP comes packaged with two INI files. One that is recommended to be used
; in production environments and one that is recommended to be used in
; development environments.
; php.ini-production contains settings which hold security, performance and
; best practices at its core. But please be aware, these settings may break
; compatibility with older or less security-conscious applications. We
; recommending using the production ini in production and testing environments.
; php.ini-development is very similar to its production variant, except it is
; much more verbose when it comes to errors. We recommend using the
; development version only in development environments, as errors shown to
; application users can inadvertently leak otherwise secure information.
; This is the php.ini-production INI file.
;;;;;;;;;;;;;;;;;;;
; Quick Reference ;
;;;;;;;;;;;;;;;;;;;
; The following are all the settings which are different in either the production
; or development versions of the INIs with respect to PHP's default behavior.
; Please see the actual settings later in the document for more details as to why
; we recommend these changes in PHP's behavior.
; display_errors
; Default Value: On
; Development Value: On
; Production Value: Off
; display_startup_errors
; Default Value: On
; Development Value: On
; Production Value: Off
; error_reporting
; Default Value: E_ALL
; Development Value: E_ALL
; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
; log_errors
; Default Value: Off
; Development Value: On
; Production Value: On
; max_input_time
; Default Value: -1 (Unlimited)
; Development Value: 60 (60 seconds)
; Production Value: 60 (60 seconds)
; output_buffering
; Default Value: Off
; Development Value: 4096
; Production Value: 4096
; register_argc_argv
; Default Value: On
; Development Value: Off
; Production Value: Off
; request_order
; Default Value: None
; Development Value: "GP"
; Production Value: "GP"
; session.gc_divisor
; Default Value: 100
; Development Value: 1000
; Production Value: 1000
; session.sid_bits_per_character
; Default Value: 4
; Development Value: 5
; Production Value: 5
; short_open_tag
; Default Value: On
; Development Value: Off
; Production Value: Off
; variables_order
; Default Value: "EGPCS"
; Development Value: "GPCS"
; Production Value: "GPCS"
; zend.exception_ignore_args
; Default Value: Off
; Development Value: Off
; Production Value: On
; zend.exception_string_param_max_len
; Default Value: 15
; Development Value: 15
; Production Value: 0
;;;;;;;;;;;;;;;;;;;;
; php.ini Options ;
;;;;;;;;;;;;;;;;;;;;
; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini"
;user_ini.filename = ".user.ini"
; To disable this feature set this option to an empty value
;user_ini.filename =
; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)
;user_ini.cache_ttl = 300
;;;;;;;;;;;;;;;;;;;;
; Language Options ;
;;;;;;;;;;;;;;;;;;;;
; Enable the PHP scripting language engine under Apache.
; https://php.net/engine
engine = On
; This directive determines whether or not PHP will recognize code between
; <? and ?> tags as PHP source which should be processed as such. It is
; generally recommended that <?php and ?> should be used and that this feature
; should be disabled, as enabling it may result in issues when generating XML
; documents, however this remains supported for backward compatibility reasons.
; Note that this directive does not control the <?= shorthand tag, which can be
; used regardless of this directive.
; Default Value: On
; Development Value: Off
; Production Value: Off
; https://php.net/short-open-tag
short_open_tag = Off
; The number of significant digits displayed in floating point numbers.
; https://php.net/precision
precision = 14
; Output buffering is a mechanism for controlling how much output data
; (excluding headers and cookies) PHP should keep internally before pushing that
; data to the client. If your application's output exceeds this setting, PHP
; will send that data in chunks of roughly the size you specify.
; Turning on this setting and managing its maximum buffer size can yield some
; interesting side-effects depending on your application and web server.
; You may be able to send headers and cookies after you've already sent output
; through print or echo. You also may see performance benefits if your server is
; emitting less packets due to buffered output versus PHP streaming the output
; as it gets it. On production servers, 4096 bytes is a good setting for performance
; reasons.
; Note: Output buffering can also be controlled via Output Buffering Control
; functions.
; Possible Values:
; On = Enabled and buffer is unlimited. (Use with caution)
; Off = Disabled
; Integer = Enables the buffer and sets its maximum size in bytes.
; Note: This directive is hardcoded to Off for the CLI SAPI
; Default Value: Off
; Development Value: 4096
; Production Value: 4096
; https://php.net/output-buffering
output_buffering = 4096
; You can redirect all of the output of your scripts to a function. For
; example, if you set output_handler to "mb_output_handler", character
; encoding will be transparently converted to the specified encoding.
; Setting any output handler automatically turns on output buffering.
; Note: People who wrote portable scripts should not depend on this ini
; directive. Instead, explicitly set the output handler using ob_start().
; Using this ini directive may cause problems unless you know what script
; is doing.
; Note: You cannot use both "mb_output_handler" with "ob_iconv_handler"
; and you cannot use both "ob_gzhandler" and "zlib.output_compression".
; Note: output_handler must be empty if this is set 'On' !!!!
; Instead you must use zlib.output_handler.
; https://php.net/output-handler
;output_handler =
; URL rewriter function rewrites URL on the fly by using
; output buffer. You can set target tags by this configuration.
; "form" tag is special tag. It will add hidden input tag to pass values.
; Refer to session.trans_sid_tags for usage.
; Default Value: "form="
; Development Value: "form="
; Production Value: "form="
;url_rewriter.tags
; URL rewriter will not rewrite absolute URL nor form by default. To enable
; absolute URL rewrite, allowed hosts must be defined at RUNTIME.
; Refer to session.trans_sid_hosts for more details.
; Default Value: ""
; Development Value: ""
; Production Value: ""
;url_rewriter.hosts
; Transparent output compression using the zlib library
; Valid values for this option are 'off', 'on', or a specific buffer size
; to be used for compression (default is 4KB)
; Note: Resulting chunk size may vary due to nature of compression. PHP
; outputs chunks that are few hundreds bytes each as a result of
; compression. If you prefer a larger chunk size for better
; performance, enable output_buffering in addition.
; Note: You need to use zlib.output_handler instead of the standard
; output_handler, or otherwise the output will be corrupted.
; https://php.net/zlib.output-compression
zlib.output_compression = Off
; https://php.net/zlib.output-compression-level
;zlib.output_compression_level = -1
; You cannot specify additional output handlers if zlib.output_compression
; is activated here. This setting does the same as output_handler but in
; a different order.
; https://php.net/zlib.output-handler
;zlib.output_handler =
; Implicit flush tells PHP to tell the output layer to flush itself
; automatically after every output block. This is equivalent to calling the
; PHP function flush() after each and every call to print() or echo() and each
; and every HTML block. Turning this option on has serious performance
; implications and is generally recommended for debugging purposes only.
; https://php.net/implicit-flush
; Note: This directive is hardcoded to On for the CLI SAPI
implicit_flush = Off
; The unserialize callback function will be called (with the undefined class'
; name as parameter), if the unserializer finds an undefined class
; which should be instantiated. A warning appears if the specified function is
; not defined, or if the function doesn't include/implement the missing class.
; So only set this entry, if you really want to implement such a
; callback-function.
unserialize_callback_func =
; The unserialize_max_depth specifies the default depth limit for unserialized
; structures. Setting the depth limit too high may result in stack overflows
; during unserialization. The unserialize_max_depth ini setting can be
; overridden by the max_depth option on individual unserialize() calls.
; A value of 0 disables the depth limit.
;unserialize_max_depth = 4096
; When floats & doubles are serialized, store serialize_precision significant
; digits after the floating point. The default value ensures that when floats
; are decoded with unserialize, the data will remain the same.
; The value is also used for json_encode when encoding double values.
; If -1 is used, then dtoa mode 0 is used which automatically select the best
; precision.
serialize_precision = -1
; open_basedir, if set, limits all file operations to the defined directory
; and below. This directive makes most sense if used in a per-directory
; or per-virtualhost web server configuration file.
; Note: disables the realpath cache
; https://php.net/open-basedir
;open_basedir =
; This directive allows you to disable certain functions.
; It receives a comma-delimited list of function names.
; https://php.net/disable-functions
disable_functions =
; This directive allows you to disable certain classes.
; It receives a comma-delimited list of class names.
; https://php.net/disable-classes
disable_classes =
; Colors for Syntax Highlighting mode. Anything that's acceptable in
; <span style="color: ???????"> would work.
; https://php.net/syntax-highlighting
;highlight.string = #DD0000
;highlight.comment = #FF9900
;highlight.keyword = #007700
;highlight.default = #0000BB
;highlight.html = #000000
; If enabled, the request will be allowed to complete even if the user aborts
; the request. Consider enabling it if executing long requests, which may end up
; being interrupted by the user or a browser timing out. PHP's default behavior
; is to disable this feature.
; https://php.net/ignore-user-abort
;ignore_user_abort = On
; Determines the size of the realpath cache to be used by PHP. This value should
; be increased on systems where PHP opens many files to reflect the quantity of
; the file operations performed.
; Note: if open_basedir is set, the cache is disabled
; https://php.net/realpath-cache-size
;realpath_cache_size = 4096k
; Duration of time, in seconds for which to cache realpath information for a given
; file or directory. For systems with rarely changing files, consider increasing this
; value.
; https://php.net/realpath-cache-ttl
;realpath_cache_ttl = 120
; Enables or disables the circular reference collector.
; https://php.net/zend.enable-gc
zend.enable_gc = On
; If enabled, scripts may be written in encodings that are incompatible with
; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such
; encodings. To use this feature, mbstring extension must be enabled.
;zend.multibyte = Off
; Allows to set the default encoding for the scripts. This value will be used
; unless "declare(encoding=...)" directive appears at the top of the script.
; Only affects if zend.multibyte is set.
;zend.script_encoding =
; Allows to include or exclude arguments from stack traces generated for exceptions.
; In production, it is recommended to turn this setting on to prohibit the output
; of sensitive information in stack traces
; Default Value: Off
; Development Value: Off
; Production Value: On
zend.exception_ignore_args = On
; Allows setting the maximum string length in an argument of a stringified stack trace
; to a value between 0 and 1000000.
; This has no effect when zend.exception_ignore_args is enabled.
; Default Value: 15
; Development Value: 15
; Production Value: 0
; In production, it is recommended to set this to 0 to reduce the output
; of sensitive information in stack traces.
zend.exception_string_param_max_len = 0
;;;;;;;;;;;;;;;;;
; Miscellaneous ;
;;;;;;;;;;;;;;;;;
; Decides whether PHP may expose the fact that it is installed on the server
; (e.g. by adding its signature to the Web server header). It is no security
; threat in any way, but it makes it possible to determine whether you use PHP
; on your server or not.
; https://php.net/expose-php
expose_php = On
;;;;;;;;;;;;;;;;;;;
; Resource Limits ;
;;;;;;;;;;;;;;;;;;;
; Maximum execution time of each script, in seconds
; https://php.net/max-execution-time
; Note: This directive is hardcoded to 0 for the CLI SAPI
max_execution_time = 30
; Maximum amount of time each script may spend parsing request data. It's a good
; idea to limit this time on productions servers in order to eliminate unexpectedly
; long running scripts.
; Note: This directive is hardcoded to -1 for the CLI SAPI
; Default Value: -1 (Unlimited)
; Development Value: 60 (60 seconds)
; Production Value: 60 (60 seconds)
; https://php.net/max-input-time
max_input_time = 60
; Maximum input variable nesting level
; https://php.net/max-input-nesting-level
;max_input_nesting_level = 64
; How many GET/POST/COOKIE input variables may be accepted
;max_input_vars = 1000
; How many multipart body parts (combined input variable and file uploads) may
; be accepted.
; Default Value: -1 (Sum of max_input_vars and max_file_uploads)
;max_multipart_body_parts = 1500
; Maximum amount of memory a script may consume
; https://php.net/memory-limit
memory_limit = 128M
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Error handling and logging ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; This directive informs PHP of which errors, warnings and notices you would like
; it to take action for. The recommended way of setting values for this
; directive is through the use of the error level constants and bitwise
; operators. The error level constants are below here for convenience as well as
; some common settings and their meanings.
; By default, PHP is set to take action on all errors, notices and warnings EXCEPT
; those related to E_NOTICE and E_STRICT, which together cover best practices and
; recommended coding standards in PHP. For performance reasons, this is the
; recommend error reporting setting. Your production server shouldn't be wasting
; resources complaining about best practices and coding standards. That's what
; development servers and development settings are for.
; Note: The php.ini-development file has this setting as E_ALL. This
; means it pretty much reports everything which is exactly what you want during
; development and early testing.
;
; Error Level Constants:
; E_ALL - All errors and warnings
; E_ERROR - fatal run-time errors
; E_RECOVERABLE_ERROR - almost fatal run-time errors
; E_WARNING - run-time warnings (non-fatal errors)
; E_PARSE - compile-time parse errors
; E_NOTICE - run-time notices (these are warnings which often result
; from a bug in your code, but it's possible that it was
; intentional (e.g., using an uninitialized variable and
; relying on the fact it is automatically initialized to an
; empty string)
; E_STRICT - run-time notices, enable to have PHP suggest changes
; to your code which will ensure the best interoperability
; and forward compatibility of your code
; E_CORE_ERROR - fatal errors that occur during PHP's initial startup
; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's
; initial startup
; E_COMPILE_ERROR - fatal compile-time errors
; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)
; E_USER_ERROR - user-generated error message
; E_USER_WARNING - user-generated warning message
; E_USER_NOTICE - user-generated notice message
; E_DEPRECATED - warn about code that will not work in future versions
; of PHP
; E_USER_DEPRECATED - user-generated deprecation warnings
;
; Common Values:
; E_ALL (Show all errors, warnings and notices including coding standards.)
; E_ALL & ~E_NOTICE (Show all errors, except for notices)
; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)
; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)
; Default Value: E_ALL
; Development Value: E_ALL
; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
; https://php.net/error-reporting
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
; This directive controls whether or not and where PHP will output errors,
; notices and warnings too. Error output is very useful during development, but
; it could be very dangerous in production environments. Depending on the code
; which is triggering the error, sensitive information could potentially leak
; out of your application such as database usernames and passwords or worse.
; For production environments, we recommend logging errors rather than
; sending them to STDOUT.
; Possible Values:
; Off = Do not display any errors
; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
; On or stdout = Display errors to STDOUT
; Default Value: On
; Development Value: On
; Production Value: Off
; https://php.net/display-errors
display_errors = Off
; The display of errors which occur during PHP's startup sequence are handled
; separately from display_errors. We strongly recommend you set this to 'off'
; for production servers to avoid leaking configuration details.
; Default Value: On
; Development Value: On
; Production Value: Off
; https://php.net/display-startup-errors
display_startup_errors = Off
; Besides displaying errors, PHP can also log errors to locations such as a
; server-specific log, STDERR, or a location specified by the error_log
; directive found below. While errors should not be displayed on productions
; servers they should still be monitored and logging is a great way to do that.
; Default Value: Off
; Development Value: On
; Production Value: On
; https://php.net/log-errors
log_errors = On
; Do not log repeated messages. Repeated errors must occur in same file on same
; line unless ignore_repeated_source is set true.
; https://php.net/ignore-repeated-errors
ignore_repeated_errors = Off
; Ignore source of message when ignoring repeated messages. When this setting
; is On you will not log errors with repeated messages from different files or
; source lines.
; https://php.net/ignore-repeated-source
ignore_repeated_source = Off
; If this parameter is set to Off, then memory leaks will not be shown (on
; stdout or in the log). This is only effective in a debug compile, and if
; error reporting includes E_WARNING in the allowed list
; https://php.net/report-memleaks
report_memleaks = On
; This setting is off by default.
;report_zend_debug = 0
; Turn off normal error reporting and emit XML-RPC error XML
; https://php.net/xmlrpc-errors
;xmlrpc_errors = 0
; An XML-RPC faultCode
;xmlrpc_error_number = 0
; When PHP displays or logs an error, it has the capability of formatting the
; error message as HTML for easier reading. This directive controls whether
; the error message is formatted as HTML or not.
; Note: This directive is hardcoded to Off for the CLI SAPI
; https://php.net/html-errors
;html_errors = On
; If html_errors is set to On *and* docref_root is not empty, then PHP
; produces clickable error messages that direct to a page describing the error
; or function causing the error in detail.
; You can download a copy of the PHP manual from https://php.net/docs
; and change docref_root to the base URL of your local copy including the
; leading '/'. You must also specify the file extension being used including
; the dot. PHP's default behavior is to leave these settings empty, in which
; case no links to documentation are generated.
; Note: Never use this feature for production boxes.
; https://php.net/docref-root
; Examples
;docref_root = "/phpmanual/"
; https://php.net/docref-ext
;docref_ext = .html
; String to output before an error message. PHP's default behavior is to leave
; this setting blank.
; https://php.net/error-prepend-string
; Example:
;error_prepend_string = "<span style='color: #ff0000'>"
; String to output after an error message. PHP's default behavior is to leave
; this setting blank.
; https://php.net/error-append-string
; Example:
;error_append_string = "</span>"
; Log errors to specified file. PHP's default behavior is to leave this value
; empty.
; https://php.net/error-log
; Example:
;error_log = php_errors.log
; Log errors to syslog (Event Log on Windows).
;error_log = syslog
; The syslog ident is a string which is prepended to every message logged
; to syslog. Only used when error_log is set to syslog.
;syslog.ident = php
; The syslog facility is used to specify what type of program is logging
; the message. Only used when error_log is set to syslog.
;syslog.facility = user
; Set this to disable filtering control characters (the default).
; Some loggers only accept NVT-ASCII, others accept anything that's not
; control characters. If your logger accepts everything, then no filtering
; is needed at all.
; Allowed values are:
; ascii (all printable ASCII characters and NL)
; no-ctrl (all characters except control characters)
; all (all characters)
; raw (like "all", but messages are not split at newlines)
; https://php.net/syslog.filter
;syslog.filter = ascii
;windows.show_crt_warning
; Default value: 0
; Development value: 0
; Production value: 0
;;;;;;;;;;;;;;;;;
; Data Handling ;
;;;;;;;;;;;;;;;;;
; The separator used in PHP generated URLs to separate arguments.
; PHP's default setting is "&".
; https://php.net/arg-separator.output
; Example:
;arg_separator.output = "&"
; List of separator(s) used by PHP to parse input URLs into variables.
; PHP's default setting is "&".
; NOTE: Every character in this directive is considered as separator!
; https://php.net/arg-separator.input
; Example:
;arg_separator.input = ";&"
; This directive determines which super global arrays are registered when PHP
; starts up. G,P,C,E & S are abbreviations for the following respective super
; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty
; paid for the registration of these arrays and because ENV is not as commonly
; used as the others, ENV is not recommended on productions servers. You
; can still get access to the environment variables through getenv() should you
; need to.
; Default Value: "EGPCS"
; Development Value: "GPCS"
; Production Value: "GPCS";
; https://php.net/variables-order
variables_order = "GPCS"
; This directive determines which super global data (G,P & C) should be
; registered into the super global array REQUEST. If so, it also determines
; the order in which that data is registered. The values for this directive
; are specified in the same manner as the variables_order directive,
; EXCEPT one. Leaving this value empty will cause PHP to use the value set
; in the variables_order directive. It does not mean it will leave the super
; globals array REQUEST empty.
; Default Value: None
; Development Value: "GP"
; Production Value: "GP"
; https://php.net/request-order
request_order = "GP"
; This directive determines whether PHP registers $argv & $argc each time it
; runs. $argv contains an array of all the arguments passed to PHP when a script
; is invoked. $argc contains an integer representing the number of arguments
; that were passed when the script was invoked. These arrays are extremely
; useful when running scripts from the command line. When this directive is
; enabled, registering these variables consumes CPU cycles and memory each time
; a script is executed. For performance reasons, this feature should be disabled
; on production servers.
; Note: This directive is hardcoded to On for the CLI SAPI
; Default Value: On
; Development Value: Off
; Production Value: Off
; https://php.net/register-argc-argv
register_argc_argv = Off
; When enabled, the ENV, REQUEST and SERVER variables are created when they're
; first used (Just In Time) instead of when the script starts. If these
; variables are not used within a script, having this directive on will result
; in a performance gain. The PHP directive register_argc_argv must be disabled
; for this directive to have any effect.
; https://php.net/auto-globals-jit
auto_globals_jit = On
; Whether PHP will read the POST data.
; This option is enabled by default.
; Most likely, you won't want to disable this option globally. It causes $_POST
; and $_FILES to always be empty; the only way you will be able to read the
; POST data will be through the php://input stream wrapper. This can be useful
; to proxy requests or to process the POST data in a memory efficient fashion.
; https://php.net/enable-post-data-reading
;enable_post_data_reading = Off
; Maximum size of POST data that PHP will accept.
; Its value may be 0 to disable the limit. It is ignored if POST data reading
; is disabled through enable_post_data_reading.
; https://php.net/post-max-size
post_max_size = 8M
; Automatically add files before PHP document.
; https://php.net/auto-prepend-file
auto_prepend_file =
; Automatically add files after PHP document.
; https://php.net/auto-append-file
auto_append_file =
; By default, PHP will output a media type using the Content-Type header. To
; disable this, simply set it to be empty.
;
; PHP's built-in default media type is set to text/html.
; https://php.net/default-mimetype
default_mimetype = "text/html"
; PHP's default character set is set to UTF-8.
; https://php.net/default-charset
default_charset = "UTF-8"
; PHP internal character encoding is set to empty.
; If empty, default_charset is used.
; https://php.net/internal-encoding
;internal_encoding =
; PHP input character encoding is set to empty.
; If empty, default_charset is used.
; https://php.net/input-encoding
;input_encoding =
; PHP output character encoding is set to empty.
; If empty, default_charset is used.
; See also output_buffer.
; https://php.net/output-encoding
;output_encoding =
;;;;;;;;;;;;;;;;;;;;;;;;;
; Paths and Directories ;
;;;;;;;;;;;;;;;;;;;;;;;;;
; UNIX: "/path1:/path2"
;include_path = ".:/php/includes"
;
; Windows: "\path1;\path2"
;include_path = ".;c:\php\includes"
;
; PHP's default setting for include_path is ".;/path/to/php/pear"
; https://php.net/include-path
; The root of the PHP pages, used only if nonempty.
; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root
; if you are running php as a CGI under any web server (other than IIS)
; see documentation for security issues. The alternate is to use the
; cgi.force_redirect configuration below
; https://php.net/doc-root
doc_root =
; The directory under which PHP opens the script using /~username used only
; if nonempty.
; https://php.net/user-dir
user_dir =
; Directory in which the loadable extensions (modules) reside.
; https://php.net/extension-dir
;extension_dir = "./"
; On windows:
;extension_dir = "ext"
; Directory where the temporary files should be placed.
; Defaults to the system default (see sys_get_temp_dir)
;sys_temp_dir = "/tmp"
; Whether or not to enable the dl() function. The dl() function does NOT work
; properly in multithreaded servers, such as IIS or Zeus, and is automatically
; disabled on them.
; https://php.net/enable-dl
enable_dl = Off
; cgi.force_redirect is necessary to provide security running PHP as a CGI under
; most web servers. Left undefined, PHP turns this on by default. You can
; turn it off here AT YOUR OWN RISK
; **You CAN safely turn this off for IIS, in fact, you MUST.**
; https://php.net/cgi.force-redirect
;cgi.force_redirect = 1
; if cgi.nph is enabled it will force cgi to always sent Status: 200 with
; every request. PHP's default behavior is to disable this feature.
;cgi.nph = 1
; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape
; (iPlanet) web servers, you MAY need to set an environment variable name that PHP
; will look for to know it is OK to continue execution. Setting this variable MAY
; cause security issues, KNOW WHAT YOU ARE DOING FIRST.
; https://php.net/cgi.redirect-status-env
;cgi.redirect_status_env =
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; https://php.net/cgi.fix-pathinfo
;cgi.fix_pathinfo=1
; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside
; of the web tree and people will not be able to circumvent .htaccess security.
;cgi.discard_path=1
; FastCGI under IIS supports the ability to impersonate
; security tokens of the calling client. This allows IIS to define the
; security context that the request runs under. mod_fastcgi under Apache
; does not currently support this feature (03/17/2002)
; Set to 1 if running under IIS. Default is zero.
; https://php.net/fastcgi.impersonate
;fastcgi.impersonate = 1
; Disable logging through FastCGI connection. PHP's default behavior is to enable
; this feature.
;fastcgi.logging = 0
; cgi.rfc2616_headers configuration option tells PHP what type of headers to
; use when sending HTTP response code. If set to 0, PHP sends Status: header that
; is supported by Apache. When this option is set to 1, PHP will send
; RFC2616 compliant header.
; Default is zero.
; https://php.net/cgi.rfc2616-headers
;cgi.rfc2616_headers = 0
; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!
; (shebang) at the top of the running script. This line might be needed if the
; script support running both as stand-alone script and via PHP CGI<. PHP in CGI
; mode skips this line and ignores its content if this directive is turned on.
; https://php.net/cgi.check-shebang-line
;cgi.check_shebang_line=1
;;;;;;;;;;;;;;;;
; File Uploads ;
;;;;;;;;;;;;;;;;
; Whether to allow HTTP file uploads.
; https://php.net/file-uploads
file_uploads = On
; Temporary directory for HTTP uploaded files (will use system default if not
; specified).
; https://php.net/upload-tmp-dir
;upload_tmp_dir =
; Maximum allowed size for uploaded files.
; https://php.net/upload-max-filesize
upload_max_filesize = 2M
; Maximum number of files that can be uploaded via a single request
max_file_uploads = 20
;;;;;;;;;;;;;;;;;;
; Fopen wrappers ;
;;;;;;;;;;;;;;;;;;
; Whether to allow the treatment of URLs (like http:// or ftp://) as files.
; https://php.net/allow-url-fopen
allow_url_fopen = On
; Whether to allow include/require to open URLs (like https:// or ftp://) as files.
; https://php.net/allow-url-include
allow_url_include = Off
; Define the anonymous ftp password (your email address). PHP's default setting
; for this is empty.
; https://php.net/from
;from="john@doe.com"
; Define the User-Agent string. PHP's default setting for this is empty.
; https://php.net/user-agent
;user_agent="PHP"
; Default timeout for socket based streams (seconds)
; https://php.net/default-socket-timeout
default_socket_timeout = 60
; If your scripts have to deal with files from Macintosh systems,
; or you are running on a Mac and need to deal with files from
; unix or win32 systems, setting this flag will cause PHP to
; automatically detect the EOL character in those files so that
; fgets() and file() will work regardless of the source of the file.
; https://php.net/auto-detect-line-endings
;auto_detect_line_endings = Off
;;;;;;;;;;;;;;;;;;;;;;
; Dynamic Extensions ;
;;;;;;;;;;;;;;;;;;;;;;
; If you wish to have an extension loaded automatically, use the following
; syntax:
;
; extension=modulename
;
; For example:
;
; extension=mysqli
;
; When the extension library to load is not located in the default extension
; directory, You may specify an absolute path to the library file:
;
; extension=/path/to/extension/mysqli.so
;
; Note : The syntax used in previous PHP versions ('extension=<ext>.so' and
; 'extension='php_<ext>.dll') is supported for legacy reasons and may be
; deprecated in a future PHP major version. So, when it is possible, please
; move to the new ('extension=<ext>) syntax.
;
; Notes for Windows environments :
;
; - Many DLL files are located in the ext/
; extension folders as well as the separate PECL DLL download.
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2
; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap
;extension=curl
;extension=ffi
;extension=ftp
;extension=fileinfo
;extension=gd
;extension=gettext
;extension=gmp
;extension=intl
;extension=imap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
;extension=oci8_12c ; Use with Oracle Database 12c Instant Client
;extension=oci8_19 ; Use with Oracle Database 19 Instant Client
;extension=odbc
;extension=openssl
;extension=pdo_firebird
;extension=pdo_mysql
;extension=pdo_oci
;extension=pdo_odbc
;extension=pdo_pgsql
;extension=pdo_sqlite
;extension=pgsql
;extension=shmop
; The MIBS data available in the PHP distribution must be installed.
; See https://www.php.net/manual/en/snmp.installation.php
;extension=snmp
;extension=soap
;extension=sockets
;extension=sodium
;extension=sqlite3
;extension=tidy
;extension=xsl
;extension=zip
;zend_extension=opcache
;;;;;;;;;;;;;;;;;;;
; Module Settings ;
;;;;;;;;;;;;;;;;;;;
[CLI Server]
; Whether the CLI web server uses ANSI color coding in its terminal output.
cli_server.color = On
[Date]
; Defines the default timezone used by the date functions
; https://php.net/date.timezone
;date.timezone =
; https://php.net/date.default-latitude
;date.default_latitude = 31.7667
; https://php.net/date.default-longitude
;date.default_longitude = 35.2333
; https://php.net/date.sunrise-zenith
;date.sunrise_zenith = 90.833333
; https://php.net/date.sunset-zenith
;date.sunset_zenith = 90.833333
[filter]
; https://php.net/filter.default
;filter.default = unsafe_raw
; https://php.net/filter.default-flags
;filter.default_flags =
[iconv]
; Use of this INI entry is deprecated, use global input_encoding instead.
; If empty, default_charset or input_encoding or iconv.input_encoding is used.
; The precedence is: default_charset < input_encoding < iconv.input_encoding
;iconv.input_encoding =
; Use of this INI entry is deprecated, use global internal_encoding instead.
; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.
; The precedence is: default_charset < internal_encoding < iconv.internal_encoding
;iconv.internal_encoding =
; Use of this INI entry is deprecated, use global output_encoding instead.
; If empty, default_charset or output_encoding or iconv.output_encoding is used.
; The precedence is: default_charset < output_encoding < iconv.output_encoding
; To use an output encoding conversion, iconv's output handler must be set
; otherwise output encoding conversion cannot be performed.
;iconv.output_encoding =
[imap]
; rsh/ssh logins are disabled by default. Use this INI entry if you want to
; enable them. Note that the IMAP library does not filter mailbox names before
; passing them to rsh/ssh command, thus passing untrusted data to this function
; with rsh/ssh enabled is insecure.
;imap.enable_insecure_rsh=0
[intl]
;intl.default_locale =
; This directive allows you to produce PHP errors when some error
; happens within intl functions. The value is the level of the error produced.
; Default is 0, which does not produce any errors.
;intl.error_level = E_WARNING
;intl.use_exceptions = 0
[sqlite3]
; Directory pointing to SQLite3 extensions
; https://php.net/sqlite3.extension-dir
;sqlite3.extension_dir =
; SQLite defensive mode flag (only available from SQLite 3.26+)
; When the defensive flag is enabled, language features that allow ordinary
; SQL to deliberately corrupt the database file are disabled. This forbids
; writing directly to the schema, shadow tables (eg. FTS data tables), or
; the sqlite_dbpage virtual table.
; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html
; (for older SQLite versions, this flag has no use)
;sqlite3.defensive = 1
[Pcre]
; PCRE library backtracking limit.
; https://php.net/pcre.backtrack-limit
;pcre.backtrack_limit=100000
; PCRE library recursion limit.
; Please note that if you set this value to a high number you may consume all
; the available process stack and eventually crash PHP (due to reaching the
; stack size limit imposed by the Operating System).
; https://php.net/pcre.recursion-limit
;pcre.recursion_limit=100000
; Enables or disables JIT compilation of patterns. This requires the PCRE
; library to be compiled with JIT support.
;pcre.jit=1
[Pdo]
; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off"
; https://php.net/pdo-odbc.connection-pooling
;pdo_odbc.connection_pooling=strict
[Pdo_mysql]
; Default socket name for local MySQL connects. If empty, uses the built-in
; MySQL defaults.
pdo_mysql.default_socket=
[Phar]
; https://php.net/phar.readonly
;phar.readonly = On
; https://php.net/phar.require-hash
;phar.require_hash = On
;phar.cache_list =
[mail function]
; For Win32 only.
; https://php.net/smtp
SMTP = localhost
; https://php.net/smtp-port
smtp_port = 25
; For Win32 only.
; https://php.net/sendmail-from
;sendmail_from = me@example.com
; For Unix only. You may supply arguments as well (default: "sendmail -t -i").
; https://php.net/sendmail-path
;sendmail_path =
; Force the addition of the specified parameters to be passed as extra parameters
; to the sendmail binary. These parameters will always replace the value of
; the 5th parameter to mail().
;mail.force_extra_parameters =
; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename
mail.add_x_header = Off
; Use mixed LF and CRLF line separators to keep compatibility with some
; RFC 2822 non conformant MTA.
mail.mixed_lf_and_crlf = Off
; The path to a log file that will log all mail() calls. Log entries include
; the full path of the script, line number, To address and headers.
;mail.log =
; Log mail to syslog (Event Log on Windows).
;mail.log = syslog
[ODBC]
; https://php.net/odbc.default-db
;odbc.default_db = Not yet implemented
; https://php.net/odbc.default-user
;odbc.default_user = Not yet implemented
; https://php.net/odbc.default-pw
;odbc.default_pw = Not yet implemented
; Controls the ODBC cursor model.
; Default: SQL_CURSOR_STATIC (default).
;odbc.default_cursortype
; Allow or prevent persistent links.
; https://php.net/odbc.allow-persistent
odbc.allow_persistent = On
; Check that a connection is still valid before reuse.
; https://php.net/odbc.check-persistent
odbc.check_persistent = On
; Maximum number of persistent links. -1 means no limit.
; https://php.net/odbc.max-persistent
odbc.max_persistent = -1
; Maximum number of links (persistent + non-persistent). -1 means no limit.
; https://php.net/odbc.max-links
odbc.max_links = -1
; Handling of LONG fields. Returns number of bytes to variables. 0 means
; passthru.
; https://php.net/odbc.defaultlrl
odbc.defaultlrl = 4096
; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.
; See the documentation on odbc_binmode and odbc_longreadlen for an explanation
; of odbc.defaultlrl and odbc.defaultbinmode
; https://php.net/odbc.defaultbinmode
odbc.defaultbinmode = 1
[MySQLi]
; Maximum number of persistent links. -1 means no limit.
; https://php.net/mysqli.max-persistent
mysqli.max_persistent = -1
; Allow accessing, from PHP's perspective, local files with LOAD DATA statements
; https://php.net/mysqli.allow_local_infile
;mysqli.allow_local_infile = On
; It allows the user to specify a folder where files that can be sent via LOAD DATA
; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.
;mysqli.local_infile_directory =
; Allow or prevent persistent links.
; https://php.net/mysqli.allow-persistent
mysqli.allow_persistent = On
; Maximum number of links. -1 means no limit.
; https://php.net/mysqli.max-links
mysqli.max_links = -1
; Default port number for mysqli_connect(). If unset, mysqli_connect() will use
; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the
; compile-time value defined MYSQL_PORT (in that order). Win32 will only look
; at MYSQL_PORT.
; https://php.net/mysqli.default-port
mysqli.default_port = 3306
; Default socket name for local MySQL connects. If empty, uses the built-in
; MySQL defaults.
; https://php.net/mysqli.default-socket
mysqli.default_socket =
; Default host for mysqli_connect() (doesn't apply in safe mode).
; https://php.net/mysqli.default-host
mysqli.default_host =
; Default user for mysqli_connect() (doesn't apply in safe mode).
; https://php.net/mysqli.default-user
mysqli.default_user =
; Default password for mysqli_connect() (doesn't apply in safe mode).
; Note that this is generally a *bad* idea to store passwords in this file.
; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw")
; and reveal this password! And of course, any users with read access to this
; file will be able to reveal the password as well.
; https://php.net/mysqli.default-pw
mysqli.default_pw =
; If this option is enabled, closing a persistent connection will rollback
; any pending transactions of this connection, before it is put back
; into the persistent connection pool.
;mysqli.rollback_on_cached_plink = Off
[mysqlnd]
; Enable / Disable collection of general statistics by mysqlnd which can be
; used to tune and monitor MySQL operations.
mysqlnd.collect_statistics = On
; Enable / Disable collection of memory usage statistics by mysqlnd which can be
; used to tune and monitor MySQL operations.
mysqlnd.collect_memory_statistics = Off
; Records communication from all extensions using mysqlnd to the specified log
; file.
; https://php.net/mysqlnd.debug
;mysqlnd.debug =
; Defines which queries will be logged.
;mysqlnd.log_mask = 0
; Default size of the mysqlnd memory pool, which is used by result sets.
;mysqlnd.mempool_default_size = 16000
; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.
;mysqlnd.net_cmd_buffer_size = 2048
; Size of a pre-allocated buffer used for reading data sent by the server in
; bytes.
;mysqlnd.net_read_buffer_size = 32768
; Timeout for network requests in seconds.
;mysqlnd.net_read_timeout = 31536000
; SHA-256 Authentication Plugin related. File with the MySQL server public RSA
; key.
;mysqlnd.sha256_server_public_key =
[OCI8]
; Connection: Enables privileged connections using external
; credentials (OCI_SYSOPER, OCI_SYSDBA)
; https://php.net/oci8.privileged-connect
;oci8.privileged_connect = Off
; Connection: The maximum number of persistent OCI8 connections per
; process. Using -1 means no limit.
; https://php.net/oci8.max-persistent
;oci8.max_persistent = -1
; Connection: The maximum number of seconds a process is allowed to
; maintain an idle persistent connection. Using -1 means idle
; persistent connections will be maintained forever.
; https://php.net/oci8.persistent-timeout
;oci8.persistent_timeout = -1
; Connection: The number of seconds that must pass before issuing a
; ping during oci_pconnect() to check the connection validity. When
; set to 0, each oci_pconnect() will cause a ping. Using -1 disables
; pings completely.
; https://php.net/oci8.ping-interval
;oci8.ping_interval = 60
; Connection: Set this to a user chosen connection class to be used
; for all pooled server requests with Oracle Database Resident
; Connection Pooling (DRCP). To use DRCP, this value should be set to
; the same string for all web servers running the same application,
; the database pool must be configured, and the connection string must
; specify to use a pooled server.
;oci8.connection_class =
; High Availability: Using On lets PHP receive Fast Application
; Notification (FAN) events generated when a database node fails. The
; database must also be configured to post FAN events.
;oci8.events = Off
; Tuning: This option enables statement caching, and specifies how
; many statements to cache. Using 0 disables statement caching.
; https://php.net/oci8.statement-cache-size
;oci8.statement_cache_size = 20
; Tuning: Enables row prefetching and sets the default number of
; rows that will be fetched automatically after statement execution.
; https://php.net/oci8.default-prefetch
;oci8.default_prefetch = 100
; Tuning: Sets the amount of LOB data that is internally returned from
; Oracle Database when an Oracle LOB locator is initially retrieved as
; part of a query. Setting this can improve performance by reducing
; round-trips.
; https://php.net/oci8.prefetch-lob-size
; oci8.prefetch_lob_size = 0
; Compatibility. Using On means oci_close() will not close
; oci_connect() and oci_new_connect() connections.
; https://php.net/oci8.old-oci-close-semantics
;oci8.old_oci_close_semantics = Off
[PostgreSQL]
; Allow or prevent persistent links.
; https://php.net/pgsql.allow-persistent
pgsql.allow_persistent = On
; Detect broken persistent links always with pg_pconnect().
; Auto reset feature requires a little overheads.
; https://php.net/pgsql.auto-reset-persistent
pgsql.auto_reset_persistent = Off
; Maximum number of persistent links. -1 means no limit.
; https://php.net/pgsql.max-persistent
pgsql.max_persistent = -1
; Maximum number of links (persistent+non persistent). -1 means no limit.
; https://php.net/pgsql.max-links
pgsql.max_links = -1
; Ignore PostgreSQL backends Notice message or not.
; Notice message logging require a little overheads.
; https://php.net/pgsql.ignore-notice
pgsql.ignore_notice = 0
; Log PostgreSQL backends Notice message or not.
; Unless pgsql.ignore_notice=0, module cannot log notice message.
; https://php.net/pgsql.log-notice
pgsql.log_notice = 0
[bcmath]
; Number of decimal digits for all bcmath functions.
; https://php.net/bcmath.scale
bcmath.scale = 0
[browscap]
; https://php.net/browscap
;browscap = extra/browscap.ini
[Session]
; Handler used to store/retrieve data.
; https://php.net/session.save-handler
session.save_handler = files
; Argument passed to save_handler. In the case of files, this is the path
; where data files are stored. Note: Windows users have to change this
; variable in order to use PHP's session functions.
;
; The path can be defined as:
;
; session.save_path = "N;/path"
;
; where N is an integer. Instead of storing all the session files in
; /path, what this will do is use subdirectories N-levels deep, and
; store the session data in those directories. This is useful if
; your OS has problems with many files in one directory, and is
; a more efficient layout for servers that handle many sessions.
;
; NOTE 1: PHP will not create this directory structure automatically.
; You can use the script in the ext/session dir for that purpose.
; NOTE 2: See the section on garbage collection below if you choose to
; use subdirectories for session storage
;
; The file storage module creates files using mode 600 by default.
; You can change that by using
;
; session.save_path = "N;MODE;/path"
;
; where MODE is the octal representation of the mode. Note that this
; does not overwrite the process's umask.
; https://php.net/session.save-path
;session.save_path = "/tmp"
; Whether to use strict session mode.
; Strict session mode does not accept an uninitialized session ID, and
; regenerates the session ID if the browser sends an uninitialized session ID.
; Strict mode protects applications from session fixation via a session adoption
; vulnerability. It is disabled by default for maximum compatibility, but
; enabling it is encouraged.
; https://wiki.php.net/rfc/strict_sessions
session.use_strict_mode = 0
; Whether to use cookies.
; https://php.net/session.use-cookies
session.use_cookies = 1
; https://php.net/session.cookie-secure
;session.cookie_secure =
; This option forces PHP to fetch and use a cookie for storing and maintaining
; the session id. We encourage this operation as it's very helpful in combating
; session hijacking when not specifying and managing your own session id. It is
; not the be-all and end-all of session hijacking defense, but it's a good start.
; https://php.net/session.use-only-cookies
session.use_only_cookies = 1
; Name of the session (used as cookie name).
; https://php.net/session.name
session.name = PHPSESSID
; Initialize session on request startup.
; https://php.net/session.auto-start
session.auto_start = 0
; Lifetime in seconds of cookie or, if 0, until browser is restarted.
; https://php.net/session.cookie-lifetime
session.cookie_lifetime = 0
; The path for which the cookie is valid.
; https://php.net/session.cookie-path
session.cookie_path = /
; The domain for which the cookie is valid.
; https://php.net/session.cookie-domain
session.cookie_domain =
; Whether or not to add the httpOnly flag to the cookie, which makes it
; inaccessible to browser scripting languages such as JavaScript.
; https://php.net/session.cookie-httponly
session.cookie_httponly =
; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)
; Current valid values are "Strict", "Lax" or "None". When using "None",
; make sure to include the quotes, as `none` is interpreted like `false` in ini files.
; https://tools.ietf.org/html/draft-west-first-party-cookies-07
session.cookie_samesite =
; Handler used to serialize data. php is the standard serializer of PHP.
; https://php.net/session.serialize-handler
session.serialize_handler = php
; Defines the probability that the 'garbage collection' process is started on every
; session initialization. The probability is calculated by using gc_probability/gc_divisor,
; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.
; Default Value: 1
; Development Value: 1
; Production Value: 1
; https://php.net/session.gc-probability
session.gc_probability = 1
; Defines the probability that the 'garbage collection' process is started on every
; session initialization. The probability is calculated by using gc_probability/gc_divisor,
; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.
; For high volume production servers, using a value of 1000 is a more efficient approach.
; Default Value: 100
; Development Value: 1000
; Production Value: 1000
; https://php.net/session.gc-divisor
session.gc_divisor = 1000
; After this number of seconds, stored data will be seen as 'garbage' and
; cleaned up by the garbage collection process.
; https://php.net/session.gc-maxlifetime
session.gc_maxlifetime = 1440
; NOTE: If you are using the subdirectory option for storing session files
; (see session.save_path above), then garbage collection does *not*
; happen automatically. You will need to do your own garbage
; collection through a shell script, cron entry, or some other method.
; For example, the following script is the equivalent of setting
; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):
; find /path/to/sessions -cmin +24 -type f | xargs rm
; Check HTTP Referer to invalidate externally stored URLs containing ids.
; HTTP_REFERER has to contain this substring for the session to be
; considered as valid.
; https://php.net/session.referer-check
session.referer_check =
; Set to {nocache,private,public,} to determine HTTP caching aspects
; or leave this empty to avoid sending anti-caching headers.
; https://php.net/session.cache-limiter
session.cache_limiter = nocache
; Document expires after n minutes.
; https://php.net/session.cache-expire
session.cache_expire = 180
; trans sid support is disabled by default.
; Use of trans sid may risk your users' security.
; Use this option with caution.
; - User may send URL contains active session ID
; to other person via. email/irc/etc.
; - URL that contains active session ID may be stored
; in publicly accessible computer.
; - User may access your site with the same session ID
; always using URL stored in browser's history or bookmarks.
; https://php.net/session.use-trans-sid
session.use_trans_sid = 0
; Set session ID character length. This value could be between 22 to 256.
; Shorter length than default is supported only for compatibility reason.
; Users should use 32 or more chars.
; https://php.net/session.sid-length
; Default Value: 32
; Development Value: 26
; Production Value: 26
session.sid_length = 26
; The URL rewriter will look for URLs in a defined set of HTML tags.
; <form> is special; if you include them here, the rewriter will
; add a hidden <input> field with the info which is otherwise appended
; to URLs. <form> tag's action attribute URL will not be modified
; unless it is specified.
; Note that all valid entries require a "=", even if no value follows.
; Default Value: "a=href,area=href,frame=src,form="
; Development Value: "a=href,area=href,frame=src,form="
; Production Value: "a=href,area=href,frame=src,form="
; https://php.net/url-rewriter.tags
session.trans_sid_tags = "a=href,area=href,frame=src,form="
; URL rewriter does not rewrite absolute URLs by default.
; To enable rewrites for absolute paths, target hosts must be specified
; at RUNTIME. i.e. use ini_set()
; <form> tags is special. PHP will check action attribute's URL regardless
; of session.trans_sid_tags setting.
; If no host is defined, HTTP_HOST will be used for allowed host.
; Example value: php.net,www.php.net,wiki.php.net
; Use "," for multiple hosts. No spaces are allowed.
; Default Value: ""
; Development Value: ""
; Production Value: ""
;session.trans_sid_hosts=""
; Define how many bits are stored in each character when converting
; the binary hash data to something readable.
; Possible values:
; 4 (4 bits: 0-9, a-f)
; 5 (5 bits: 0-9, a-v)
; 6 (6 bits: 0-9, a-z, A-Z, "-", ",")
; Default Value: 4
; Development Value: 5
; Production Value: 5
; https://php.net/session.hash-bits-per-character
session.sid_bits_per_character = 5
; Enable upload progress tracking in $_SESSION
; Default Value: On
; Development Value: On
; Production Value: On
; https://php.net/session.upload-progress.enabled
;session.upload_progress.enabled = On
; Cleanup the progress information as soon as all POST data has been read
; (i.e. upload completed).
; Default Value: On
; Development Value: On
; Production Value: On
; https://php.net/session.upload-progress.cleanup
;session.upload_progress.cleanup = On
; A prefix used for the upload progress key in $_SESSION
; Default Value: "upload_progress_"
; Development Value: "upload_progress_"
; Production Value: "upload_progress_"
; https://php.net/session.upload-progress.prefix
;session.upload_progress.prefix = "upload_progress_"
; The index name (concatenated with the prefix) in $_SESSION
; containing the upload progress information
; Default Value: "PHP_SESSION_UPLOAD_PROGRESS"
; Development Value: "PHP_SESSION_UPLOAD_PROGRESS"
; Production Value: "PHP_SESSION_UPLOAD_PROGRESS"
; https://php.net/session.upload-progress.name
;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS"
; How frequently the upload progress should be updated.
; Given either in percentages (per-file), or in bytes
; Default Value: "1%"
; Development Value: "1%"
; Production Value: "1%"
; https://php.net/session.upload-progress.freq
;session.upload_progress.freq = "1%"
; The minimum delay between updates, in seconds
; Default Value: 1
; Development Value: 1
; Production Value: 1
; https://php.net/session.upload-progress.min-freq
;session.upload_progress.min_freq = "1"
; Only write session data when session data is changed. Enabled by default.
; https://php.net/session.lazy-write
;session.lazy_write = On
[Assertion]
; Switch whether to compile assertions at all (to have no overhead at run-time)
; -1: Do not compile at all
; 0: Jump over assertion at run-time
; 1: Execute assertions
; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)
; Default Value: 1
; Development Value: 1
; Production Value: -1
; https://php.net/zend.assertions
zend.assertions = -1
; Assert(expr); active by default.
; https://php.net/assert.active
;assert.active = On
; Throw an AssertionError on failed assertions
; https://php.net/assert.exception
;assert.exception = On
; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)
; https://php.net/assert.warning
;assert.warning = On
; Don't bail out by default.
; https://php.net/assert.bail
;assert.bail = Off
; User-function to be called if an assertion fails.
; https://php.net/assert.callback
;assert.callback = 0
[COM]
; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs
; https://php.net/com.typelib-file
;com.typelib_file =
; allow Distributed-COM calls
; https://php.net/com.allow-dcom
;com.allow_dcom = true
; autoregister constants of a component's typelib on com_load()
; https://php.net/com.autoregister-typelib
;com.autoregister_typelib = true
; register constants casesensitive
; https://php.net/com.autoregister-casesensitive
;com.autoregister_casesensitive = false
; show warnings on duplicate constant registrations
; https://php.net/com.autoregister-verbose
;com.autoregister_verbose = true
; The default character set code-page to use when passing strings to and from COM objects.
; Default: system ANSI code page
;com.code_page=
; The version of the .NET framework to use. The value of the setting are the first three parts
; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319".
;com.dotnet_version=
[mbstring]
; language for internal character representation.
; This affects mb_send_mail() and mbstring.detect_order.
; https://php.net/mbstring.language
;mbstring.language = Japanese
; Use of this INI entry is deprecated, use global internal_encoding instead.
; internal/script encoding.
; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)
; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.
; The precedence is: default_charset < internal_encoding < iconv.internal_encoding
;mbstring.internal_encoding =
; Use of this INI entry is deprecated, use global input_encoding instead.
; http input encoding.
; mbstring.encoding_translation = On is needed to use this setting.
; If empty, default_charset or input_encoding or mbstring.input is used.
; The precedence is: default_charset < input_encoding < mbstring.http_input
; https://php.net/mbstring.http-input
;mbstring.http_input =
; Use of this INI entry is deprecated, use global output_encoding instead.
; http output encoding.
; mb_output_handler must be registered as output buffer to function.
; If empty, default_charset or output_encoding or mbstring.http_output is used.
; The precedence is: default_charset < output_encoding < mbstring.http_output
; To use an output encoding conversion, mbstring's output handler must be set
; otherwise output encoding conversion cannot be performed.
; https://php.net/mbstring.http-output
;mbstring.http_output =
; enable automatic encoding translation according to
; mbstring.internal_encoding setting. Input chars are
; converted to internal encoding by setting this to On.
; Note: Do _not_ use automatic encoding translation for
; portable libs/applications.
; https://php.net/mbstring.encoding-translation
;mbstring.encoding_translation = Off
; automatic encoding detection order.
; "auto" detect order is changed according to mbstring.language
; https://php.net/mbstring.detect-order
;mbstring.detect_order = auto
; substitute_character used when character cannot be converted
; one from another
; https://php.net/mbstring.substitute-character
;mbstring.substitute_character = none
; Enable strict encoding detection.
;mbstring.strict_detection = Off
; This directive specifies the regex pattern of content types for which mb_output_handler()
; is activated.
; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml)
;mbstring.http_output_conv_mimetypes=
; This directive specifies maximum stack depth for mbstring regular expressions. It is similar
; to the pcre.recursion_limit for PCRE.
;mbstring.regex_stack_limit=100000
; This directive specifies maximum retry count for mbstring regular expressions. It is similar
; to the pcre.backtrack_limit for PCRE.
;mbstring.regex_retry_limit=1000000
[gd]
; Tell the jpeg decode to ignore warnings and try to create
; a gd image. The warning will then be displayed as notices
; disabled by default
; https://php.net/gd.jpeg-ignore-warning
;gd.jpeg_ignore_warning = 1
[exif]
; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.
; With mbstring support this will automatically be converted into the encoding
; given by corresponding encode setting. When empty mbstring.internal_encoding
; is used. For the decode settings you can distinguish between motorola and
; intel byte order. A decode setting cannot be empty.
; https://php.net/exif.encode-unicode
;exif.encode_unicode = ISO-8859-15
; https://php.net/exif.decode-unicode-motorola
;exif.decode_unicode_motorola = UCS-2BE
; https://php.net/exif.decode-unicode-intel
;exif.decode_unicode_intel = UCS-2LE
; https://php.net/exif.encode-jis
;exif.encode_jis =
; https://php.net/exif.decode-jis-motorola
;exif.decode_jis_motorola = JIS
; https://php.net/exif.decode-jis-intel
;exif.decode_jis_intel = JIS
[Tidy]
; The path to a default tidy configuration file to use when using tidy
; https://php.net/tidy.default-config
;tidy.default_config = /usr/local/lib/php/default.tcfg
; Should tidy clean and repair output automatically?
; WARNING: Do not use this option if you are generating non-html content
; such as dynamic images
; https://php.net/tidy.clean-output
tidy.clean_output = Off
[soap]
; Enables or disables WSDL caching feature.
; https://php.net/soap.wsdl-cache-enabled
soap.wsdl_cache_enabled=1
; Sets the directory name where SOAP extension will put cache files.
; https://php.net/soap.wsdl-cache-dir
soap.wsdl_cache_dir="/tmp"
; (time to live) Sets the number of second while cached file will be used
; instead of original one.
; https://php.net/soap.wsdl-cache-ttl
soap.wsdl_cache_ttl=86400
; Sets the size of the cache limit. (Max. number of WSDL files to cache)
soap.wsdl_cache_limit = 5
[sysvshm]
; A default size of the shared memory segment
;sysvshm.init_mem = 10000
[ldap]
; Sets the maximum number of open links or -1 for unlimited.
ldap.max_links = -1
[dba]
;dba.default_handler=
[opcache]
; Determines if Zend OPCache is enabled
;opcache.enable=1
; Determines if Zend OPCache is enabled for the CLI version of PHP
;opcache.enable_cli=0
; The OPcache shared memory storage size.
;opcache.memory_consumption=128
; The amount of memory for interned strings in Mbytes.
;opcache.interned_strings_buffer=8
; The maximum number of keys (scripts) in the OPcache hash table.
; Only numbers between 200 and 1000000 are allowed.
;opcache.max_accelerated_files=10000
; The maximum percentage of "wasted" memory until a restart is scheduled.
;opcache.max_wasted_percentage=5
; When this directive is enabled, the OPcache appends the current working
; directory to the script key, thus eliminating possible collisions between
; files with the same name (basename). Disabling the directive improves
; performance, but may break existing applications.
;opcache.use_cwd=1
; When disabled, you must reset the OPcache manually or restart the
; webserver for changes to the filesystem to take effect.
;opcache.validate_timestamps=1
; How often (in seconds) to check file timestamps for changes to the shared
; memory storage allocation. ("1" means validate once per second, but only
; once per request. "0" means always validate)
;opcache.revalidate_freq=2
; Enables or disables file search in include_path optimization
;opcache.revalidate_path=0
; If disabled, all PHPDoc comments are dropped from the code to reduce the
; size of the optimized code.
;opcache.save_comments=1
; If enabled, compilation warnings (including notices and deprecations) will
; be recorded and replayed each time a file is included. Otherwise, compilation
; warnings will only be emitted when the file is first cached.
;opcache.record_warnings=0
; Allow file existence override (file_exists, etc.) performance feature.
;opcache.enable_file_override=0
; A bitmask, where each bit enables or disables the appropriate OPcache
; passes
;opcache.optimization_level=0x7FFFBFFF
;opcache.dups_fix=0
; The location of the OPcache blacklist file (wildcards allowed).
; Each OPcache blacklist file is a text file that holds the names of files
; that should not be accelerated. The file format is to add each filename
; to a new line. The filename may be a full path or just a file prefix
; (i.e., /var/www/x blacklists all the files and directories in /var/www
; that start with 'x'). Line starting with a ; are ignored (comments).
;opcache.blacklist_filename=
; Allows exclusion of large files from being cached. By default all files
; are cached.
;opcache.max_file_size=0
; Check the cache checksum each N requests.
; The default value of "0" means that the checks are disabled.
;opcache.consistency_checks=0
; How long to wait (in seconds) for a scheduled restart to begin if the cache
; is not being accessed.
;opcache.force_restart_timeout=180
; OPcache error_log file name. Empty string assumes "stderr".
;opcache.error_log=
; All OPcache errors go to the Web server log.
; By default, only fatal errors (level 0) or errors (level 1) are logged.
; You can also enable warnings (level 2), info messages (level 3) or
; debug messages (level 4).
;opcache.log_verbosity_level=1
; Preferred Shared Memory back-end. Leave empty and let the system decide.
;opcache.preferred_memory_model=
; Protect the shared memory from unexpected writing during script execution.
; Useful for internal debugging only.
;opcache.protect_memory=0
; Allows calling OPcache API functions only from PHP scripts which path is
; started from specified string. The default "" means no restriction
;opcache.restrict_api=
; Mapping base of shared memory segments (for Windows only). All the PHP
; processes have to map shared memory into the same address space. This
; directive allows to manually fix the "Unable to reattach to base address"
; errors.
;opcache.mmap_base=
; Facilitates multiple OPcache instances per user (for Windows only). All PHP
; processes with the same cache ID and user share an OPcache instance.
;opcache.cache_id=
; Enables and sets the second level cache directory.
; It should improve performance when SHM memory is full, at server restart or
; SHM reset. The default "" disables file based caching.
;opcache.file_cache=
; Enables or disables opcode caching in shared memory.
;opcache.file_cache_only=0
; Enables or disables checksum validation when script loaded from file cache.
;opcache.file_cache_consistency_checks=1
; Implies opcache.file_cache_only=1 for a certain process that failed to
; reattach to the shared memory (for Windows only). Explicitly enabled file
; cache is required.
;opcache.file_cache_fallback=1
; Enables or disables copying of PHP code (text segment) into HUGE PAGES.
; Under certain circumstances (if only a single global PHP process is
; started from which all others fork), this can increase performance
; by a tiny amount because TLB misses are reduced. On the other hand, this
; delays PHP startup, increases memory usage and degrades performance
; under memory pressure - use with care.
; Requires appropriate OS configuration.
;opcache.huge_code_pages=0
; Validate cached file permissions.
;opcache.validate_permission=0
; Prevent name collisions in chroot'ed environment.
;opcache.validate_root=0
; If specified, it produces opcode dumps for debugging different stages of
; optimizations.
;opcache.opt_debug_level=0
; Specifies a PHP script that is going to be compiled and executed at server
; start-up.
; https://php.net/opcache.preload
;opcache.preload=
; Preloading code as root is not allowed for security reasons. This directive
; facilitates to let the preloading to be run as another user.
; https://php.net/opcache.preload_user
;opcache.preload_user=
; Prevents caching files that are less than this number of seconds old. It
; protects from caching of incompletely updated files. In case all file updates
; on your site are atomic, you may increase performance by setting it to "0".
;opcache.file_update_protection=2
; Absolute path used to store shared lockfiles (for *nix only).
;opcache.lockfile_path=/tmp
[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
;curl.cainfo =
[openssl]
; The location of a Certificate Authority (CA) file on the local filesystem
; to use when verifying the identity of SSL/TLS peers. Most users should
; not specify a value for this directive as PHP will attempt to use the
; OS-managed cert stores in its absence. If specified, this value may still
; be overridden on a per-stream basis via the "cafile" SSL stream context
; option.
;openssl.cafile=
; If openssl.cafile is not specified or if the CA file is not found, the
; directory pointed to by openssl.capath is searched for a suitable
; certificate. This value must be a correctly hashed certificate directory.
; Most users should not specify a value for this directive as PHP will
; attempt to use the OS-managed cert stores in its absence. If specified,
; this value may still be overridden on a per-stream basis via the "capath"
; SSL stream context option.
;openssl.capath=
[ffi]
; FFI API restriction. Possible values:
; "preload" - enabled in CLI scripts and preloaded files (default)
; "false" - always disabled
; "true" - always enabled
;ffi.enable=preload
; List of headers files to preload, wildcard patterns allowed.
;ffi.preload=
PK ;K]� ;? ? % ea-php82-php-fpm/php-fpm.conf.defaultnu ȯ�� ;;;;;;;;;;;;;;;;;;;;;
; FPM Configuration ;
;;;;;;;;;;;;;;;;;;;;;
; All relative paths in this configuration file are relative to PHP's install
; prefix (/opt/cpanel/ea-php82/root/usr). This prefix can be dynamically changed by using the
; '-p' argument from the command line.
;;;;;;;;;;;;;;;;;;
; Global Options ;
;;;;;;;;;;;;;;;;;;
[global]
; Pid file
; Note: the default prefix is /opt/cpanel/ea-php82/root/var
; Default Value: none
;pid = run/php-fpm.pid
; Error log file
; If it's set to "syslog", log is sent to syslogd instead of being written
; into a local file.
; Note: the default prefix is /opt/cpanel/ea-php82/root/var
; Default Value: log/php-fpm.log
;error_log = log/php-fpm.log
; syslog_facility is used to specify what type of program is logging the
; message. This lets syslogd specify that messages from different facilities
; will be handled differently.
; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)
; Default Value: daemon
;syslog.facility = daemon
; syslog_ident is prepended to every message. If you have multiple FPM
; instances running on the same server, you can change the default value
; which must suit common needs.
; Default Value: php-fpm
;syslog.ident = php-fpm
; Log level
; Possible Values: alert, error, warning, notice, debug
; Default Value: notice
;log_level = notice
; Log limit on number of characters in the single line (log entry). If the
; line is over the limit, it is wrapped on multiple lines. The limit is for
; all logged characters including message prefix and suffix if present. However
; the new line character does not count into it as it is present only when
; logging to a file descriptor. It means the new line character is not present
; when logging to syslog.
; Default Value: 1024
;log_limit = 4096
; Log buffering specifies if the log line is buffered which means that the
; line is written in a single write operation. If the value is false, then the
; data is written directly into the file descriptor. It is an experimental
; option that can potentially improve logging performance and memory usage
; for some heavy logging scenarios. This option is ignored if logging to syslog
; as it has to be always buffered.
; Default value: yes
;log_buffering = no
; If this number of child processes exit with SIGSEGV or SIGBUS within the time
; interval set by emergency_restart_interval then FPM will restart. A value
; of '0' means 'Off'.
; Default Value: 0
;emergency_restart_threshold = 0
; Interval of time used by emergency_restart_interval to determine when
; a graceful restart will be initiated. This can be useful to work around
; accidental corruptions in an accelerator's shared memory.
; Available Units: s(econds), m(inutes), h(ours), or d(ays)
; Default Unit: seconds
; Default Value: 0
;emergency_restart_interval = 0
; Time limit for child processes to wait for a reaction on signals from master.
; Available units: s(econds), m(inutes), h(ours), or d(ays)
; Default Unit: seconds
; Default Value: 0
;process_control_timeout = 0
; The maximum number of processes FPM will fork. This has been designed to control
; the global number of processes when using dynamic PM within a lot of pools.
; Use it with caution.
; Note: A value of 0 indicates no limit
; Default Value: 0
; process.max = 128
; Specify the nice(2) priority to apply to the master process (only if set)
; The value can vary from -19 (highest priority) to 20 (lowest priority)
; Note: - It will only work if the FPM master process is launched as root
; - The pool process will inherit the master process priority
; unless specified otherwise
; Default Value: no set
; process.priority = -19
; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.
; Default Value: yes
;daemonize = yes
; Set open file descriptor rlimit for the master process.
; Default Value: system defined value
;rlimit_files = 1024
; Set max core size rlimit for the master process.
; Possible Values: 'unlimited' or an integer greater or equal to 0
; Default Value: system defined value
;rlimit_core = 0
; Specify the event mechanism FPM will use. The following is available:
; - select (any POSIX os)
; - poll (any POSIX os)
; - epoll (linux >= 2.5.44)
; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)
; - /dev/poll (Solaris >= 7)
; - port (Solaris >= 10)
; Default Value: not set (auto detection)
;events.mechanism = epoll
; When FPM is built with systemd integration, specify the interval,
; in seconds, between health report notification to systemd.
; Set to 0 to disable.
; Available Units: s(econds), m(inutes), h(ours)
; Default Unit: seconds
; Default value: 10
;systemd_interval = 10
;;;;;;;;;;;;;;;;;;;;
; Pool Definitions ;
;;;;;;;;;;;;;;;;;;;;
; Multiple pools of child processes may be started with different listening
; ports and different management options. The name of the pool will be
; used in logs and stats. There is no limitation on the number of pools which
; FPM can handle. Your system will tell you anyway :)
; Include one or more files. If glob(3) exists, it is used to include a bunch of
; files from a glob(3) pattern. This directive can be used everywhere in the
; file.
; Relative path can also be used. They will be prefixed by:
; - the global prefix if it's been set (-p argument)
; - /opt/cpanel/ea-php82/root/usr otherwise
include=/opt/cpanel/ea-php82/root/etc/php-fpm.d/*.conf
PK ;K]�f� � # pear/XML_Util/examples/example2.phpnu �[��� <?php
/* vim: set expandtab tabstop=4 shiftwidth=4 softtabstop=4: */
/**
* Examples (file #2)
*
* several examples for the methods of XML_Util
*
* PHP versions 4 and 5
*
* LICENSE:
*
* Copyright (c) 2003-2008 Stephan Schmidt <schst@php.net>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* * The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
* IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
* @category XML
* @package XML_Util
* @subpackage Examples
* @author Stephan Schmidt <schst@php.net>
* @copyright 2003-2008 Stephan Schmidt <schst@php.net>
* @license http://opensource.org/licenses/bsd-license New BSD License
* @version CVS: $Id$
* @link http://pear.php.net/package/XML_Util
*/
/**
* set error level
*/
error_reporting(E_ALL);
require_once 'XML/Util.php';
/**
* creating a start element
*/
print 'creating a start element:<br>';
print htmlentities(XML_Util::createStartElement('myNs:myTag',
array('foo' => 'bar'), 'http://www.w3c.org/myNs#'));
print "\n<br><br>\n";
/**
* creating a start element
*/
print 'creating a start element:<br>';
print htmlentities(XML_Util::createStartElement('myTag',
array(), 'http://www.w3c.org/myNs#'));
print "\n<br><br>\n";
/**
* creating a start element
*/
print 'creating a start element:<br>';
print '<pre>';
print htmlentities(XML_Util::createStartElement('myTag',
array('foo' => 'bar', 'argh' => 'tomato'),
'http://www.w3c.org/myNs#', true));
print '</pre>';
print "\n<br><br>\n";
/**
* creating an end element
*/
print 'creating an end element:<br>';
print htmlentities(XML_Util::createEndElement('myNs:myTag'));
print "\n<br><br>\n";
/**
* creating a CData section
*/
print 'creating a CData section:<br>';
print htmlentities(XML_Util::createCDataSection('I am content.'));
print "\n<br><br>\n";
/**
* creating a comment
*/
print 'creating a comment:<br>';
print htmlentities(XML_Util::createComment('I am a comment.'));
print "\n<br><br>\n";
/**
* creating an XML tag with multiline mode
*/
$tag = array(
'qname' => 'foo:bar',
'namespaceUri' => 'http://foo.com',
'attributes' => array('key' => 'value', 'argh' => 'fruit&vegetable'),
'content' => 'I\'m inside the tag & contain dangerous chars'
);
print 'creating a tag with qualified name and namespaceUri:<br>';
print '<pre>';
print htmlentities(XML_Util::createTagFromArray($tag,
XML_UTIL_REPLACE_ENTITIES, true));
print '</pre>';
print "\n<br><br>\n";
/**
* create an attribute string without replacing the entities
*/
$atts = array('series' => 'Starsky & Hutch', 'channel' => 'ABC');
print 'creating a attribute string, '
. 'entities in values already had been replaced:<br>';
print htmlentities(XML_Util::attributesToString($atts,
true, false, false, false, XML_UTIL_ENTITIES_NONE));
print "\n<br><br>\n";
/**
* using the array-syntax for attributesToString()
*/
$atts = array('series' => 'Starsky & Hutch', 'channel' => 'ABC');
print 'using the array-syntax for attributesToString()<br>';
print htmlentities(XML_Util::attributesToString($atts,
array('entities' => XML_UTIL_ENTITIES_NONE)));
print "\n<br><br>\n";
?>
PK ;K]5k��# �# " pear/XML_Util/examples/example.phpnu �[��� <?php
/* vim: set expandtab tabstop=4 shiftwidth=4 softtabstop=4: */
/**
* Examples (file #1)
*
* several examples for the methods of XML_Util
*
* PHP versions 4 and 5
*
* LICENSE:
*
* Copyright (c) 2003-2008 Stephan Schmidt <schst@php.net>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* * The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
* IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
* @category XML
* @package XML_Util
* @subpackage Examples
* @author Stephan Schmidt <schst@php.net>
* @copyright 2003-2008 Stephan Schmidt <schst@php.net>
* @license http://opensource.org/licenses/bsd-license New BSD License
* @version CVS: $Id$
* @link http://pear.php.net/package/XML_Util
*/
/**
* set error level
*/
error_reporting(E_ALL);
require_once 'XML/Util.php';
/**
* replacing XML entities
*/
print 'replace XML entities:<br>';
print XML_Util::replaceEntities('This string contains < & >.');
print "\n<br><br>\n";
/**
* reversing XML entities
*/
print 'replace XML entities:<br>';
print XML_Util::reverseEntities('This string contains < & >.');
print "\n<br><br>\n";
/**
* building XML declaration
*/
print 'building XML declaration:<br>';
print htmlspecialchars(XML_Util::getXMLDeclaration());
print "\n<br><br>\n";
print 'building XML declaration with additional attributes:<br>';
print htmlspecialchars(XML_Util::getXMLDeclaration('1.0', 'UTF-8', true));
print "\n<br><br>\n";
/**
* building document type declaration
*/
print 'building DocType declaration:<br>';
print htmlspecialchars(XML_Util::getDocTypeDeclaration('package',
'http://pear.php.net/dtd/package-1.0'));
print "\n<br><br>\n";
print 'building DocType declaration with public ID (does not exist):<br>';
print htmlspecialchars(XML_Util::getDocTypeDeclaration('package',
array('uri' => 'http://pear.php.net/dtd/package-1.0',
'id' => '-//PHP//PEAR/DTD PACKAGE 0.1')));
print "\n<br><br>\n";
print 'building DocType declaration with internal DTD:<br>';
print '<pre>';
print htmlspecialchars(XML_Util::getDocTypeDeclaration('package',
'http://pear.php.net/dtd/package-1.0',
'<!ELEMENT additionalInfo (#PCDATA)>'));
print '</pre>';
print "\n<br><br>\n";
/**
* creating an attribute string
*/
$att = array(
'foo' => 'bar',
'argh' => 'tomato'
);
print 'converting array to string:<br>';
print XML_Util::attributesToString($att);
print "\n<br><br>\n";
/**
* creating an attribute string with linebreaks
*/
$att = array(
'foo' => 'bar',
'argh' => 'tomato'
);
print 'converting array to string (including line breaks):<br>';
print '<pre>';
print XML_Util::attributesToString($att, true, true);
print '</pre>';
print "\n<br><br>\n";
/**
* splitting a qualified tag name
*/
print 'splitting qualified tag name:<br>';
print '<pre>';
print_r(XML_Util::splitQualifiedName('xslt:stylesheet'));
print '</pre>';
print "\n<br>\n";
/**
* splitting a qualified tag name (no namespace)
*/
print 'splitting qualified tag name (no namespace):<br>';
print '<pre>';
print_r(XML_Util::splitQualifiedName('foo'));
print '</pre>';
print "\n<br>\n";
/**
* splitting a qualified tag name (no namespace, but default namespace specified)
*/
print 'splitting qualified tag name '
. '(no namespace, but default namespace specified):<br>';
print '<pre>';
print_r(XML_Util::splitQualifiedName('foo', 'bar'));
print '</pre>';
print "\n<br>\n";
/**
* verifying XML names
*/
print 'verifying \'My private tag\':<br>';
print '<pre>';
print_r(XML_Util::isValidname('My Private Tag'));
print '</pre>';
print "\n<br><br>\n";
print 'verifying \'-MyTag\':<br>';
print '<pre>';
print_r(XML_Util::isValidname('-MyTag'));
print '</pre>';
print "\n<br><br>\n";
/**
* creating an XML tag
*/
$tag = array(
'namespace' => 'foo',
'localPart' => 'bar',
'attributes' => array('key' => 'value', 'argh' => 'fruit&vegetable'),
'content' => 'I\'m inside the tag'
);
print 'creating a tag with namespace and local part:<br>';
print htmlentities(XML_Util::createTagFromArray($tag));
print "\n<br><br>\n";
/**
* creating an XML tag
*/
$tag = array(
'qname' => 'foo:bar',
'namespaceUri' => 'http://foo.com',
'attributes' => array('key' => 'value', 'argh' => 'fruit&vegetable'),
'content' => 'I\'m inside the tag'
);
print 'creating a tag with qualified name and namespaceUri:<br>';
print htmlentities(XML_Util::createTagFromArray($tag));
print "\n<br><br>\n";
/**
* creating an XML tag
*/
$tag = array(
'qname' => 'bar',
'namespaceUri' => 'http://foo.com',
'attributes' => array('key' => 'value', 'argh' => 'fruit&vegetable')
);
print 'creating an empty tag without namespace but namespace Uri:<br>';
print htmlentities(XML_Util::createTagFromArray($tag));
print "\n<br><br>\n";
/**
* creating an XML tag with more namespaces
*/
$tag = array(
'namespace' => 'foo',
'localPart' => 'bar',
'attributes' => array('key' => 'value', 'argh' => 'fruit&vegetable'),
'content' => 'I\'m inside the tag',
'namespaces' => array(
'bar' => 'http://bar.com',
'pear' => 'http://pear.php.net',
)
);
print 'creating an XML tag with more namespaces:<br />';
print htmlentities(XML_Util::createTagFromArray($tag));
print "\n<br><br>\n";
/**
* creating an XML tag with a CData Section
*/
$tag = array(
'qname' => 'foo',
'attributes' => array('key' => 'value', 'argh' => 'fruit&vegetable'),
'content' => 'I\'m inside the tag'
);
print 'creating a tag with CData section:<br>';
print htmlentities(XML_Util::createTagFromArray($tag, XML_UTIL_CDATA_SECTION));
print "\n<br><br>\n";
/**
* creating an XML tag with a CData Section
*/
$tag = array(
'qname' => 'foo',
'attributes' => array('key' => 'value', 'argh' => 't�t�'),
'content' =>
'Also XHTML-tags can be created '
. 'and HTML entities can be replaced � � � � <>.'
);
print 'creating a tag with HTML entities:<br>';
print htmlentities(XML_Util::createTagFromArray($tag, XML_UTIL_ENTITIES_HTML));
print "\n<br><br>\n";
/**
* creating an XML tag with createTag
*/
print 'creating a tag with createTag:<br>';
print htmlentities(XML_Util::createTag('myNs:myTag',
array('foo' => 'bar'),
'This is inside the tag',
'http://www.w3c.org/myNs#'));
print "\n<br><br>\n";
/**
* trying to create an XML tag with an array as content
*/
$tag = array(
'qname' => 'bar',
'content' => array('foo' => 'bar')
);
print 'trying to create an XML tag with an array as content:<br>';
print '<pre>';
print_r(XML_Util::createTagFromArray($tag));
print '</pre>';
print "\n<br><br>\n";
/**
* trying to create an XML tag without a name
*/
$tag = array(
'attributes' => array('foo' => 'bar'),
);
print 'trying to create an XML tag without a name:<br>';
print '<pre>';
print_r(XML_Util::createTagFromArray($tag));
print '</pre>';
print "\n<br><br>\n";
?>
PK ;K]� r¦J �J % pear/Archive_Tar/docs/Archive_Tar.txtnu �[��� Documentation for class Archive_Tar
===================================
Last update : 2001-08-15
Overview :
----------
The Archive_Tar class helps in creating and managing GNU TAR format
files compressed by GNU ZIP or not.
The class offers basic functions like creating an archive, adding
files in the archive, extracting files from the archive and listing
the archive content.
It also provide advanced functions that allow the adding and
extraction of files with path manipulation.
Sample :
--------
// ----- Creating the object (uncompressed archive)
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->setErrorHandling(PEAR_ERROR_PRINT);
// ----- Creating the archive
$v_list[0]="file.txt";
$v_list[1]="data/";
$v_list[2]="file.log";
$tar_object->create($v_list);
// ----- Adding files
$v_list[0]="dev/file.txt";
$v_list[1]="dev/data/";
$v_list[2]="log/file.log";
$tar_object->add($v_list);
// ----- Adding more files
$tar_object->add("release/newfile.log release/readme.txt");
// ----- Listing the content
if (($v_list = $tar_object->listContent()) != 0)
for ($i=0; $i<sizeof($v_list); $i++)
{
echo "Filename :'".$v_list[$i][filename]."'<br>";
echo " .size :'".$v_list[$i][size]."'<br>";
echo " .mtime :'".$v_list[$i][mtime]."' (".date("l dS of F Y h:i:s A", $v_list[$i][mtime]).")<br>";
echo " .mode :'".$v_list[$i][mode]."'<br>";
echo " .uid :'".$v_list[$i][uid]."'<br>";
echo " .gid :'".$v_list[$i][gid]."'<br>";
echo " .typeflag :'".$v_list[$i][typeflag]."'<br>";
}
// ----- Extracting the archive in directory "install"
$tar_object->extract("install");
Public arguments :
------------------
None
Public Methods :
----------------
Method : Archive_Tar($p_tarname, $compress = null)
Description :
Archive_Tar Class constructor. This flavour of the constructor only
declare a new Archive_Tar object, identifying it by the name of the
tar file.
If the compress argument is set the tar will be read or created as a
gzip or bz2 compressed TAR file.
Arguments :
$p_tarname : A valid filename for the tar archive file.
$p_compress : can be null, 'gz' or 'bz2'. For
compatibility reason it can also be true. This
parameter indicates if gzip or bz2 compression
is required.
Return value :
The Archive_Tar object.
Sample :
$tar_object = new Archive_Tar("tarname.tar");
$tar_object_compressed = new Archive_Tar("tarname.tgz", true);
How it works :
Initialize the object.
Method : create($p_filelist)
Description :
This method creates the archive file and add the files / directories
that are listed in $p_filelist.
If the file already exists and is writable, it is replaced by the
new tar. It is a create and not an add. If the file exists and is
read-only or is a directory it is not replaced. The method return
false and a PEAR error text.
The $p_filelist parameter can be an array of string, each string
representing a filename or a directory name with their path if
needed. It can also be a single string with names separated by a
single blank.
See also createModify() method for more details.
Arguments :
$p_filelist : An array of filenames and directory names, or a single
string with names separated by a single blank space.
Return value :
true on success, false on error.
Sample 1 :
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->setErrorHandling(PEAR_ERROR_PRINT); // Optional error handling
$v_list[0]="file.txt";
$v_list[1]="data/"; (Optional '/' at the end)
$v_list[2]="file.log";
$tar_object->create($v_list);
Sample 2 :
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->setErrorHandling(PEAR_ERROR_PRINT); // Optional error handling
$tar_object->create("file.txt data/ file.log");
How it works :
Just calling the createModify() method with the right parameters.
Method : createModify($p_filelist, $p_add_dir, $p_remove_dir = "")
Description :
This method creates the archive file and add the files / directories
that are listed in $p_filelist.
If the file already exists and is writable, it is replaced by the
new tar. It is a create and not an add. If the file exists and is
read-only or is a directory it is not replaced. The method return
false and a PEAR error text.
The $p_filelist parameter can be an array of string, each string
representing a filename or a directory name with their path if
needed. It can also be a single string with names separated by a
single blank.
The path indicated in $p_remove_dir will be removed from the
memorized path of each file / directory listed when this path
exists. By default nothing is removed (empty path "")
The path indicated in $p_add_dir will be added at the beginning of
the memorized path of each file / directory listed. However it can
be set to empty "". The adding of a path is done after the removing
of path.
The path add/remove ability enables the user to prepare an archive
for extraction in a different path than the origin files are.
See also addModify() method for file adding properties.
Arguments :
$p_filelist : An array of filenames and directory names, or a single
string with names separated by a single blank space.
$p_add_dir : A string which contains a path to be added to the
memorized path of each element in the list.
$p_remove_dir : A string which contains a path to be removed from
the memorized path of each element in the list, when
relevant.
Return value :
true on success, false on error.
Sample 1 :
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->setErrorHandling(PEAR_ERROR_PRINT); // Optional error handling
$v_list[0]="file.txt";
$v_list[1]="data/"; (Optional '/' at the end)
$v_list[2]="file.log";
$tar_object->createModify($v_list, "install");
// files are stored in the archive as :
// install/file.txt
// install/data
// install/data/file1.txt
// install/data/... all the files and sub-dirs of data/
// install/file.log
Sample 2 :
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->setErrorHandling(PEAR_ERROR_PRINT); // Optional error handling
$v_list[0]="dev/file.txt";
$v_list[1]="dev/data/"; (Optional '/' at the end)
$v_list[2]="log/file.log";
$tar_object->createModify($v_list, "install", "dev");
// files are stored in the archive as :
// install/file.txt
// install/data
// install/data/file1.txt
// install/data/... all the files and sub-dirs of data/
// install/log/file.log
How it works :
Open the file in write mode (erasing the existing one if one),
call the _addList() method for adding the files in an empty archive,
add the tar footer (512 bytes block), close the tar file.
Method : addModify($p_filelist, $p_add_dir, $p_remove_dir="")
Description :
This method add the files / directories listed in $p_filelist at the
end of the existing archive. If the archive does not yet exists it
is created.
The $p_filelist parameter can be an array of string, each string
representing a filename or a directory name with their path if
needed. It can also be a single string with names separated by a
single blank.
The path indicated in $p_remove_dir will be removed from the
memorized path of each file / directory listed when this path
exists. By default nothing is removed (empty path "")
The path indicated in $p_add_dir will be added at the beginning of
the memorized path of each file / directory listed. However it can
be set to empty "". The adding of a path is done after the removing
of path.
The path add/remove ability enables the user to prepare an archive
for extraction in a different path than the origin files are.
If a file/dir is already in the archive it will only be added at the
end of the archive. There is no update of the existing archived
file/dir. However while extracting the archive, the last file will
replace the first one. This results in a none optimization of the
archive size.
If a file/dir does not exist the file/dir is ignored. However an
error text is send to PEAR error.
If a file/dir is not readable the file/dir is ignored. However an
error text is send to PEAR error.
If the resulting filename/dirname (after the add/remove option or
not) string is greater than 99 char, the file/dir is
ignored. However an error text is send to PEAR error.
Arguments :
$p_filelist : An array of filenames and directory names, or a single
string with names separated by a single blank space.
$p_add_dir : A string which contains a path to be added to the
memorized path of each element in the list.
$p_remove_dir : A string which contains a path to be removed from
the memorized path of each element in the list, when
relevant.
Return value :
true on success, false on error.
Sample 1 :
$tar_object = new Archive_Tar("tarname.tar");
[...]
$v_list[0]="dev/file.txt";
$v_list[1]="dev/data/"; (Optional '/' at the end)
$v_list[2]="log/file.log";
$tar_object->addModify($v_list, "install");
// files are stored in the archive as :
// install/file.txt
// install/data
// install/data/file1.txt
// install/data/... all the files and sub-dirs of data/
// install/file.log
Sample 2 :
$tar_object = new Archive_Tar("tarname.tar");
[...]
$v_list[0]="dev/file.txt";
$v_list[1]="dev/data/"; (Optional '/' at the end)
$v_list[2]="log/file.log";
$tar_object->addModify($v_list, "install", "dev");
// files are stored in the archive as :
// install/file.txt
// install/data
// install/data/file1.txt
// install/data/... all the files and sub-dirs of data/
// install/log/file.log
How it works :
If the archive does not exists it create it and add the files.
If the archive does exists and is not compressed, it open it, jump
before the last empty 512 bytes block (tar footer) and add the files
at this point.
If the archive does exists and is compressed, a temporary copy file
is created. This temporary file is then 'gzip' read block by block
until the last empty block. The new files are then added in the
compressed file.
The adding of files is done by going through the file/dir list,
adding files per files, in a recursive way through the
directory. Each time a path need to be added/removed it is done
before writing the file header in the archive.
Method : add($p_filelist)
Description :
This method add the files / directories listed in $p_filelist at the
end of the existing archive. If the archive does not yet exists it
is created.
The $p_filelist parameter can be an array of string, each string
representing a filename or a directory name with their path if
needed. It can also be a single string with names separated by a
single blank.
See addModify() method for details and limitations.
Arguments :
$p_filelist : An array of filenames and directory names, or a single
string with names separated by a single blank space.
Return value :
true on success, false on error.
Sample 1 :
$tar_object = new Archive_Tar("tarname.tar");
[...]
$v_list[0]="dev/file.txt";
$v_list[1]="dev/data/"; (Optional '/' at the end)
$v_list[2]="log/file.log";
$tar_object->add($v_list);
Sample 2 :
$tar_object = new Archive_Tar("tarname.tgz", true);
[...]
$v_list[0]="dev/file.txt";
$v_list[1]="dev/data/"; (Optional '/' at the end)
$v_list[2]="log/file.log";
$tar_object->add($v_list);
How it works :
Simply call the addModify() method with the right parameters.
Method : addString($p_filename, $p_string, $p_datetime, $p_params)
Description :
This method add a single string as a file at the
end of the existing archive. If the archive does not yet exists it
is created.
Arguments :
$p_filename : A string which contains the full filename path
that will be associated with the string.
$p_string : The content of the file added in the archive.
$p_datetime : (Optional) Timestamp of the file (default = now)
$p_params : (Optional) Various file metadata:
stamp - As above, timestamp of the file
mode - UNIX-style permissions (default 0600)
type - Is this a regular file or link (see TAR
format spec for how to create a hard/symlink)
uid - UNIX-style user ID (default 0 = root)
gid - UNIX-style group ID (default 0 = root)
Return value :
true on success, false on error.
Sample 1 :
$v_archive = & new Archive_Tar($p_filename);
$v_archive->setErrorHandling(PEAR_ERROR_PRINT);
$v_result = $v_archive->addString('data/test.txt', 'This is the text of the string');
$v_result = $v_archive->addString(
'data/test.sh',
"#!/bin/sh\necho 'Hello'",
time(),
array( "mode" => 0755, "uid" => 34 )
);
Method : extract($p_path = "")
Description :
This method extract all the content of the archive in the directory
indicated by $p_path.If $p_path is optional, if not set the archive
is extracted in the current directory.
While extracting a file, if the directory path does not exists it is
created.
See extractModify() for details and limitations.
Arguments :
$p_path : Optional path where the files/dir need to by extracted.
Return value :
true on success, false on error.
Sample :
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->extract();
How it works :
Simply call the extractModify() method with appropriate parameters.
Method : extractModify($p_path, $p_remove_path)
Description :
This method extract all the content of the archive in the directory
indicated by $p_path. When relevant the memorized path of the
files/dir can be modified by removing the $p_remove_path path at the
beginning of the file/dir path.
While extracting a file, if the directory path does not exists it is
created.
While extracting a file, if the file already exists it is replaced
without looking for last modification date.
While extracting a file, if the file already exists and is write
protected, the extraction is aborted.
While extracting a file, if a directory with the same name already
exists, the extraction is aborted.
While extracting a directory, if a file with the same name already
exists, the extraction is aborted.
While extracting a file/directory if the destination directory exist
and is write protected, or does not exist but can not be created,
the extraction is aborted.
If after extraction an extracted file does not show the correct
stored file size, the extraction is aborted.
When the extraction is aborted, a PEAR error text is set and false
is returned. However the result can be a partial extraction that may
need to be manually cleaned.
Arguments :
$p_path : The path of the directory where the files/dir need to by
extracted.
$p_remove_path : Part of the memorized path that can be removed if
present at the beginning of the file/dir path.
Return value :
true on success, false on error.
Sample :
// Imagine tarname.tar with files :
// dev/data/file.txt
// dev/data/log.txt
// readme.txt
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->extractModify("install", "dev");
// Files will be extracted there :
// install/data/file.txt
// install/data/log.txt
// install/readme.txt
How it works :
Open the archive and call a more generic function that can extract
only a part of the archive or all the archive.
See extractList() method for more details.
Method : extractInString($p_filename)
Description :
This method extract from the archive one file identified by $p_filename.
The return value is a string with the file content, or NULL on error.
Arguments :
$p_filename : The path of the file to extract in a string.
Return value :
a string with the file content or NULL.
Sample :
// Imagine tarname.tar with files :
// dev/data/file.txt
// dev/data/log.txt
// dev/readme.txt
$v_archive = & new Archive_Tar('tarname.tar');
$v_archive->setErrorHandling(PEAR_ERROR_PRINT);
$v_string = $v_archive->extractInString('dev/readme.txt');
echo $v_string;
Method : listContent()
Description :
This method returns an array of arrays that describe each
file/directory present in the archive.
The array is not sorted, so it show the position of the file in the
archive.
The file informations are :
$file[filename] : Name and path of the file/dir.
$file[mode] : File permissions (result of fileperms())
$file[uid] : user id
$file[gid] : group id
$file[size] : filesize
$file[mtime] : Last modification time (result of filemtime())
$file[typeflag] : "" for file, "5" for directory
Arguments :
Return value :
An array of arrays or 0 on error.
Sample :
$tar_object = new Archive_Tar("tarname.tar");
if (($v_list = $tar_object->listContent()) != 0)
for ($i=0; $i<sizeof($v_list); $i++)
{
echo "Filename :'".$v_list[$i][filename]."'<br>";
echo " .size :'".$v_list[$i][size]."'<br>";
echo " .mtime :'".$v_list[$i][mtime]."' (".
date("l dS of F Y h:i:s A", $v_list[$i][mtime]).")<br>";
echo " .mode :'".$v_list[$i][mode]."'<br>";
echo " .uid :'".$v_list[$i][uid]."'<br>";
echo " .gid :'".$v_list[$i][gid]."'<br>";
echo " .typeflag :'".$v_list[$i][typeflag]."'<br>";
}
How it works :
Call the same function as an extract however with a flag to only go
through the archive without extracting the files.
Method : extractList($p_filelist, $p_path = "", $p_remove_path = "")
Description :
This method extract from the archive only the files indicated in the
$p_filelist. These files are extracted in the current directory or
in the directory indicated by the optional $p_path parameter.
If indicated the $p_remove_path can be used in the same way as it is
used in extractModify() method.
Arguments :
$p_filelist : An array of filenames and directory names, or a single
string with names separated by a single blank space.
$p_path : The path of the directory where the files/dir need to by
extracted.
$p_remove_path : Part of the memorized path that can be removed if
present at the beginning of the file/dir path.
Return value :
true on success, false on error.
Sample :
// Imagine tarname.tar with files :
// dev/data/file.txt
// dev/data/log.txt
// readme.txt
$tar_object = new Archive_Tar("tarname.tar");
$tar_object->extractList("dev/data/file.txt readme.txt", "install",
"dev");
// Files will be extracted there :
// install/data/file.txt
// install/readme.txt
How it works :
Go through the archive and extract only the files present in the
list.
PK ;K]�E �� � pear/PEAR/README.rstnu �[��� *************************
PEAR - The PEAR Installer
*************************
.. image:: https://travis-ci.org/pear/pear-core.svg?branch=stable
:target: https://travis-ci.org/pear/pear-core
=========================================
What is the PEAR Installer? What is PEAR?
=========================================
PEAR is the PHP Extension and Application Repository, found at
http://pear.php.net.
The **PEAR Installer** is this software, which contains executable
files and PHP code that is used to **download and install** PEAR code
from pear.php.net.
PEAR contains useful **software libraries and applications** such as
MDB2 (database abstraction), HTML_QuickForm (HTML forms management),
PhpDocumentor (auto-documentation generator), DB_DataObject
(Data Access Abstraction), and many hundreds more.
Browse all available packages at http://pear.php.net, the list is
constantly growing and updating to reflect improvements in the PHP language.
.. warning::
Do not run PEAR without installing it - if you downloaded this
tarball manually, you MUST install it. Read the instructions in INSTALL
prior to use.
=============
Documentation
=============
Documentation for PEAR can be found at http://pear.php.net/manual/.
Installation documentation can be found in the INSTALL file included
in this tarball.
=====
Tests
=====
Run the tests without installation as follows::
$ ./scripts/pear.sh run-tests -r tests
You should have the ``Text_Diff`` package installed to get nicer error output.
To run the tests with another PHP version, modify ``php_bin`` and set the
``PHP_PEAR_PHP_BIN`` environment variable::
$ pear config-set php_bin /usr/local/bin/php7
$ PHP_PEAR_PHP_BIN=/usr/local/bin/php7 ./scripts/pear.sh run-tests -r tests
Happy PHPing, we hope PEAR will be a great tool for your development work!
Test dependencies
=================
* ``zlib``
=========
Releasing
=========
Create a PEAR package, as well as phars for pear-less installation,
simply run ``build-release.sh``).
``go-pear.phar`` contains the PEAR installer installer that asks where to install it.
It is available from http://pear.php.net/go-pear.phar.
``install-pear-nozlib.phar`` installs PEAR automatically without asking anything.
It is shipped with PHP itself.
PK ;K]�u��� � pear/PEAR/LICENSEnu �[��� Copyright (c) 1997-2009,
Stig Bakken <ssb@php.net>,
Gregory Beaver <cellog@php.net>,
Helgi Þormar Þorbjörnsson <helgi@php.net>,
Tomas V.V.Cox <cox@idecnet.com>,
Martin Jansen <mj@php.net>.
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
PK ;K]� ��x x pear/PEAR/INSTALLnu �[��� PEAR - The PEAR Installer
=========================
Installing the PEAR Installer.
You should install PEAR on a local development machine first. Installing
PEAR on a remote production machine should only be done after you are
familiar with PEAR and have tested code using PEAR on your development
machine.
There are two methods of installing PEAR
- PEAR bundled in PHP
- go-pear
We will first examine how to install PEAR that is bundled with PHP.
Microsoft Windows
=================
If you are running PHP 5.2.0 or newer, simply download and
run the windows installer (.msi) and PEAR can be automatically
installed.
Otherwise, for older PHP versions, download the .zip of windows,
there is a script included with your PHP distribution that is called
"go-pear". You must open a command box in order to run it. Click
"start" then click "Run..." and type "cmd.exe" to open a command box.
Use "cd" to change directory to the location of PHP where you unzipped it,
and run the go-pear command.
Unix
====
When compiling PHP from source, you simply need to include the
--with-pear directive on the "./configure" command. This is "on"
by default in most PHP versions, but it doesn't hurt to list it
explicitly. You should also consider enabling the zlib extension via
--enable-zlib, so that the PEAR installer will be able to handle gzipped
files (i.e. smaller package files for faster downloads). Later, when you
run "make install" to install PHP itself, part of the process will be
prompts that ask you where you want PEAR to be installed.
go-pear
=======
For users who cannot perform the above steps, or who wish to obtain the
latest PEAR with a slightly higher risk of failure, use go-pear. go-pear
is obtained by downloading http://pear.php.net/go-pear and saving it as go-pear.php.
After downloading, simply run "php go-pear.php" or open it in a web browser
(windows only) to download and install PEAR.
You can always ask general installation questions on pear-general@lists.php.net,
a public mailing list devoted to support for PEAR packages and installation-
related issues.
Happy PHPing, we hope PEAR will be a great tool for your development work!
PK ;K]DG�e� � pear/Structures_Graph/LICENSEnu �[��� GNU LESSER GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
This version of the GNU Lesser General Public License incorporates
the terms and conditions of version 3 of the GNU General Public
License, supplemented by the additional permissions listed below.
0. Additional Definitions.
As used herein, "this License" refers to version 3 of the GNU Lesser
General Public License, and the "GNU GPL" refers to version 3 of the GNU
General Public License.
"The Library" refers to a covered work governed by this License,
other than an Application or a Combined Work as defined below.
An "Application" is any work that makes use of an interface provided
by the Library, but which is not otherwise based on the Library.
Defining a subclass of a class defined by the Library is deemed a mode
of using an interface provided by the Library.
A "Combined Work" is a work produced by combining or linking an
Application with the Library. The particular version of the Library
with which the Combined Work was made is also called the "Linked
Version".
The "Minimal Corresponding Source" for a Combined Work means the
Corresponding Source for the Combined Work, excluding any source code
for portions of the Combined Work that, considered in isolation, are
based on the Application, and not on the Linked Version.
The "Corresponding Application Code" for a Combined Work means the
object code and/or source code for the Application, including any data
and utility programs needed for reproducing the Combined Work from the
Application, but excluding the System Libraries of the Combined Work.
1. Exception to Section 3 of the GNU GPL.
You may convey a covered work under sections 3 and 4 of this License
without being bound by section 3 of the GNU GPL.
2. Conveying Modified Versions.
If you modify a copy of the Library, and, in your modifications, a
facility refers to a function or data to be supplied by an Application
that uses the facility (other than as an argument passed when the
facility is invoked), then you may convey a copy of the modified
version:
a) under this License, provided that you make a good faith effort to
ensure that, in the event an Application does not supply the
function or data, the facility still operates, and performs
whatever part of its purpose remains meaningful, or
b) under the GNU GPL, with none of the additional permissions of
this License applicable to that copy.
3. Object Code Incorporating Material from Library Header Files.
The object code form of an Application may incorporate material from
a header file that is part of the Library. You may convey such object
code under terms of your choice, provided that, if the incorporated
material is not limited to numerical parameters, data structure
layouts and accessors, or small macros, inline functions and templates
(ten or fewer lines in length), you do both of the following:
a) Give prominent notice with each copy of the object code that the
Library is used in it and that the Library and its use are
covered by this License.
b) Accompany the object code with a copy of the GNU GPL and this license
document.
4. Combined Works.
You may convey a Combined Work under terms of your choice that,
taken together, effectively do not restrict modification of the
portions of the Library contained in the Combined Work and reverse
engineering for debugging such modifications, if you also do each of
the following:
a) Give prominent notice with each copy of the Combined Work that
the Library is used in it and that the Library and its use are
covered by this License.
b) Accompany the Combined Work with a copy of the GNU GPL and this license
document.
c) For a Combined Work that displays copyright notices during
execution, include the copyright notice for the Library among
these notices, as well as a reference directing the user to the
copies of the GNU GPL and this license document.
d) Do one of the following:
0) Convey the Minimal Corresponding Source under the terms of this
License, and the Corresponding Application Code in a form
suitable for, and under terms that permit, the user to
recombine or relink the Application with a modified version of
the Linked Version to produce a modified Combined Work, in the
manner specified by section 6 of the GNU GPL for conveying
Corresponding Source.
1) Use a suitable shared library mechanism for linking with the
Library. A suitable mechanism is one that (a) uses at run time
a copy of the Library already present on the user's computer
system, and (b) will operate properly with a modified version
of the Library that is interface-compatible with the Linked
Version.
e) Provide Installation Information, but only if you would otherwise
be required to provide such information under section 6 of the
GNU GPL, and only to the extent that such information is
necessary to install and execute a modified version of the
Combined Work produced by recombining or relinking the
Application with a modified version of the Linked Version. (If
you use option 4d0, the Installation Information must accompany
the Minimal Corresponding Source and Corresponding Application
Code. If you use option 4d1, you must provide the Installation
Information in the manner specified by section 6 of the GNU GPL
for conveying Corresponding Source.)
5. Combined Libraries.
You may place library facilities that are a work based on the
Library side by side in a single library together with other library
facilities that are not Applications and are not covered by this
License, and convey such a combined library under terms of your
choice, if you do both of the following:
a) Accompany the combined library with a copy of the same work based
on the Library, uncombined with any other library facilities,
conveyed under the terms of this License.
b) Give prominent notice with the combined library that part of it
is a work based on the Library, and explaining where to find the
accompanying uncombined form of the same work.
6. Revised Versions of the GNU Lesser General Public License.
The Free Software Foundation may publish revised and/or new versions
of the GNU Lesser General Public License from time to time. Such new
versions will be similar in spirit to the present version, but may
differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the
Library as you received it specifies that a certain numbered version
of the GNU Lesser General Public License "or any later version"
applies to it, you have the option of following the terms and
conditions either of that published version or of any later version
published by the Free Software Foundation. If the Library as you
received it does not specify a version number of the GNU Lesser
General Public License, you may choose any version of the GNU Lesser
General Public License ever published by the Free Software Foundation.
If the Library as you received it specifies that a proxy can decide
whether future versions of the GNU Lesser General Public License shall
apply, that proxy's public statement of acceptance of any version is
permanent authorization for you to choose that version for the
Library.
PK ;K]x� �� � J pear/Structures_Graph/docs/tutorials/Structures_Graph/Structures_Graph.pkgnu �[��� <refentry id="{@id package.database.structures_graph.tutorial}">
<refnamediv>
<refname><classname>Structures_Graph</classname> Tutorial</refname>
<refpurpose>A first tour of graph datastructure manipulation</refpurpose>
</refnamediv>
<refsect1 id="{@id package.database.structures_graph.tutorial.intro}">
<title>Introduction</title>
<para>
Structures_Graph is a package for creating and manipulating graph datastructures. A graph is a set of objects, called nodes, connected by arcs. When used as a datastructure, usually nodes contain data, and arcs represent relationships between nodes. When arcs have a direction, and can be travelled only one way, graphs are said to be directed. When arcs have no direction, and can always be travelled both ways, graphs are said to be non directed.
</para>
<para>
Structures_Graph provides an object oriented API to create and directly query a graph, as well as a set of Manipulator classes to extract information from the graph.
</para>
</refsect1>
<refsect1 id="{@id package.database.structures_graph.tutorial.creation}">
<title>Creating a Graph</title>
<para>
Creating a graph is done using the simple constructor:
<programlisting>
<![CDATA[
require_once 'Structures/Graph.php';
$directedGraph =& new Structures_Graph(true);
$nonDirectedGraph =& new Structures_Graph(false);
]]>
</programlisting>
and passing the constructor a flag telling it whether the graph should be directed. A directed graph will always be directed during its lifetime. It's a permanent characteristic.
</para>
<para>
To fill out the graph, we'll need to create some nodes, and then call Graph::addNode.
<programlisting>
<![CDATA[
require_once 'Structures/Graph/Node.php';
$nodeOne =& new Structures_Graph_Node();
$nodeTwo =& new Structures_Graph_Node();
$nodeThree =& new Structures_Graph_Node();
$directedGraph->addNode(&$nodeOne);
$directedGraph->addNode(&$nodeTwo);
$directedGraph->addNode(&$nodeThree);
]]>
</programlisting>
and then setup the arcs:
<programlisting>
<![CDATA[
$nodeOne->connectTo($nodeTwo);
$nodeOne->connectTo($nodeThree);
]]>
</programlisting>
Note that arcs can only be created after the nodes have been inserted into the graph.
</para>
</refsect1>
<refsect1 id="{@id package.database.structures_graph.tutorial.nodesanddata}">
<title>Associating Data</title>
<para>
Graphs are only useful as datastructures if they can hold data. Structure_Graph stores data in nodes. Each node contains a setter and a getter for its data.
<programlisting>
<![CDATA[
$nodeOne->setData("Node One's Data is a String");
$nodeTwo->setData(1976);
$nodeThree->setData('Some other string');
print("NodeTwo's Data is an integer: " . $nodeTwo->getData());
]]>
</programlisting>
</para>
<para>
Structure_Graph nodes can also store metadata, alongside with the main data. Metadata differs from regular data just because it is stored under a key, making it possible to store more than one data reference per node. The metadata getter and setter need the key to perform the operation:
<programlisting>
<![CDATA[
$nodeOne->setMetadata('example key', "Node One's Sample Metadata");
print("Metadata stored under key 'example key' in node one: " . $nodeOne->getMetadata('example key'));
$nodeOne->unsetMetadata('example key');
]]>
</programlisting>
</para>
</refsect1>
<refsect1 id="{@id package.database.structures_graph.tutorial.querying}">
<title>Querying a Graph</title>
<para>
Structures_Graph provides for basic querying of the graph:
<programlisting>
<![CDATA[
// Nodes are able to calculate their indegree and outdegree
print("NodeOne's inDegree: " . $nodeOne->inDegree());
print("NodeOne's outDegree: " . $nodeOne->outDegree());
// and naturally, nodes can report on their arcs
$arcs = $nodeOne->getNeighbours();
for ($i=0;$i<sizeof($arcs);$i++) {
print("NodeOne has an arc to " . $arcs[$i]->getData());
}
]]>
</programlisting>
</para>
</refsect1>
</refentry>
PK ;K]��-�l �l % ea-php82-php-mbstring/libmbfl_LICENSEnu ȯ�� GNU LESSER GENERAL PUBLIC LICENSE
Version 2.1, February 1999
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
[This is the first released version of the Lesser GPL. It also counts
as the successor of the GNU Library Public License, version 2, hence
the version number 2.1.]
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
Licenses are intended to guarantee your freedom to share and change
free software--to make sure the software is free for all its users.
This license, the Lesser General Public License, applies to some
specially designated software packages--typically libraries--of the
Free Software Foundation and other authors who decide to use it. You
can use it too, but we suggest you first think carefully about whether
this license or the ordinary General Public License is the better
strategy to use in any particular case, based on the explanations below.
When we speak of free software, we are referring to freedom of use,
not price. Our General Public Licenses are designed to make sure that
you have the freedom to distribute copies of free software (and charge
for this service if you wish); that you receive source code or can get
it if you want it; that you can change the software and use pieces of
it in new free programs; and that you are informed that you can do
these things.
To protect your rights, we need to make restrictions that forbid
distributors to deny you these rights or to ask you to surrender these
rights. These restrictions translate to certain responsibilities for
you if you distribute copies of the library or if you modify it.
For example, if you distribute copies of the library, whether gratis
or for a fee, you must give the recipients all the rights that we gave
you. You must make sure that they, too, receive or can get the source
code. If you link other code with the library, you must provide
complete object files to the recipients, so that they can relink them
with the library after making changes to the library and recompiling
it. And you must show them these terms so they know their rights.
We protect your rights with a two-step method: (1) we copyright the
library, and (2) we offer you this license, which gives you legal
permission to copy, distribute and/or modify the library.
To protect each distributor, we want to make it very clear that
there is no warranty for the free library. Also, if the library is
modified by someone else and passed on, the recipients should know
that what they have is not the original version, so that the original
author's reputation will not be affected by problems that might be
introduced by others.
Finally, software patents pose a constant threat to the existence of
any free program. We wish to make sure that a company cannot
effectively restrict the users of a free program by obtaining a
restrictive license from a patent holder. Therefore, we insist that
any patent license obtained for a version of the library must be
consistent with the full freedom of use specified in this license.
Most GNU software, including some libraries, is covered by the
ordinary GNU General Public License. This license, the GNU Lesser
General Public License, applies to certain designated libraries, and
is quite different from the ordinary General Public License. We use
this license for certain libraries in order to permit linking those
libraries into non-free programs.
When a program is linked with a library, whether statically or using
a shared library, the combination of the two is legally speaking a
combined work, a derivative of the original library. The ordinary
General Public License therefore permits such linking only if the
entire combination fits its criteria of freedom. The Lesser General
Public License permits more lax criteria for linking other code with
the library.
We call this license the "Lesser" General Public License because it
does Less to protect the user's freedom than the ordinary General
Public License. It also provides other free software developers Less
of an advantage over competing non-free programs. These disadvantages
are the reason we use the ordinary General Public License for many
libraries. However, the Lesser license provides advantages in certain
special circumstances.
For example, on rare occasions, there may be a special need to
encourage the widest possible use of a certain library, so that it becomes
a de-facto standard. To achieve this, non-free programs must be
allowed to use the library. A more frequent case is that a free
library does the same job as widely used non-free libraries. In this
case, there is little to gain by limiting the free library to free
software only, so we use the Lesser General Public License.
In other cases, permission to use a particular library in non-free
programs enables a greater number of people to use a large body of
free software. For example, permission to use the GNU C Library in
non-free programs enables many more people to use the whole GNU
operating system, as well as its variant, the GNU/Linux operating
system.
Although the Lesser General Public License is Less protective of the
users' freedom, it does ensure that the user of a program that is
linked with the Library has the freedom and the wherewithal to run
that program using a modified version of the Library.
The precise terms and conditions for copying, distribution and
modification follow. Pay close attention to the difference between a
"work based on the library" and a "work that uses the library". The
former contains code derived from the library, whereas the latter must
be combined with the library in order to run.
GNU LESSER GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License Agreement applies to any software library or other
program which contains a notice placed by the copyright holder or
other authorized party saying it may be distributed under the terms of
this Lesser General Public License (also called "this License").
Each licensee is addressed as "you".
A "library" means a collection of software functions and/or data
prepared so as to be conveniently linked with application programs
(which use some of those functions and data) to form executables.
The "Library", below, refers to any such software library or work
which has been distributed under these terms. A "work based on the
Library" means either the Library or any derivative work under
copyright law: that is to say, a work containing the Library or a
portion of it, either verbatim or with modifications and/or translated
straightforwardly into another language. (Hereinafter, translation is
included without limitation in the term "modification".)
"Source code" for a work means the preferred form of the work for
making modifications to it. For a library, complete source code means
all the source code for all modules it contains, plus any associated
interface definition files, plus the scripts used to control compilation
and installation of the library.
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running a program using the Library is not restricted, and output from
such a program is covered only if its contents constitute a work based
on the Library (independent of the use of the Library in a tool for
writing it). Whether that is true depends on what the Library does
and what the program that uses the Library does.
1. You may copy and distribute verbatim copies of the Library's
complete source code as you receive it, in any medium, provided that
you conspicuously and appropriately publish on each copy an
appropriate copyright notice and disclaimer of warranty; keep intact
all the notices that refer to this License and to the absence of any
warranty; and distribute a copy of this License along with the
Library.
You may charge a fee for the physical act of transferring a copy,
and you may at your option offer warranty protection in exchange for a
fee.
2. You may modify your copy or copies of the Library or any portion
of it, thus forming a work based on the Library, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) The modified work must itself be a software library.
b) You must cause the files modified to carry prominent notices
stating that you changed the files and the date of any change.
c) You must cause the whole of the work to be licensed at no
charge to all third parties under the terms of this License.
d) If a facility in the modified Library refers to a function or a
table of data to be supplied by an application program that uses
the facility, other than as an argument passed when the facility
is invoked, then you must make a good faith effort to ensure that,
in the event an application does not supply such function or
table, the facility still operates, and performs whatever part of
its purpose remains meaningful.
(For example, a function in a library to compute square roots has
a purpose that is entirely well-defined independent of the
application. Therefore, Subsection 2d requires that any
application-supplied function or table used by this function must
be optional: if the application does not supply it, the square
root function must still compute square roots.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Library,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Library, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote
it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Library.
In addition, mere aggregation of another work not based on the Library
with the Library (or with a work based on the Library) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may opt to apply the terms of the ordinary GNU General Public
License instead of this License to a given copy of the Library. To do
this, you must alter all the notices that refer to this License, so
that they refer to the ordinary GNU General Public License, version 2,
instead of to this License. (If a newer version than version 2 of the
ordinary GNU General Public License has appeared, then you can specify
that version instead if you wish.) Do not make any other change in
these notices.
Once this change is made in a given copy, it is irreversible for
that copy, so the ordinary GNU General Public License applies to all
subsequent copies and derivative works made from that copy.
This option is useful when you wish to copy part of the code of
the Library into a program that is not a library.
4. You may copy and distribute the Library (or a portion or
derivative of it, under Section 2) in object code or executable form
under the terms of Sections 1 and 2 above provided that you accompany
it with the complete corresponding machine-readable source code, which
must be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange.
If distribution of object code is made by offering access to copy
from a designated place, then offering equivalent access to copy the
source code from the same place satisfies the requirement to
distribute the source code, even though third parties are not
compelled to copy the source along with the object code.
5. A program that contains no derivative of any portion of the
Library, but is designed to work with the Library by being compiled or
linked with it, is called a "work that uses the Library". Such a
work, in isolation, is not a derivative work of the Library, and
therefore falls outside the scope of this License.
However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library". The executable is therefore covered by this License.
Section 6 states terms for distribution of such executables.
When a "work that uses the Library" uses material from a header file
that is part of the Library, the object code for the work may be a
derivative work of the Library even though the source code is not.
Whether this is true is especially significant if the work can be
linked without the Library, or if the work is itself a library. The
threshold for this to be true is not precisely defined by law.
If such an object file uses only numerical parameters, data
structure layouts and accessors, and small macros and small inline
functions (ten lines or less in length), then the use of the object
file is unrestricted, regardless of whether it is legally a derivative
work. (Executables containing this object code plus portions of the
Library will still fall under Section 6.)
Otherwise, if the work is a derivative of the Library, you may
distribute the object code for the work under the terms of Section 6.
Any executables containing that work also fall under Section 6,
whether or not they are linked directly with the Library itself.
6. As an exception to the Sections above, you may also combine or
link a "work that uses the Library" with the Library to produce a
work containing portions of the Library, and distribute that work
under terms of your choice, provided that the terms permit
modification of the work for the customer's own use and reverse
engineering for debugging such modifications.
You must give prominent notice with each copy of the work that the
Library is used in it and that the Library and its use are covered by
this License. You must supply a copy of this License. If the work
during execution displays copyright notices, you must include the
copyright notice for the Library among them, as well as a reference
directing the user to the copy of this License. Also, you must do one
of these things:
a) Accompany the work with the complete corresponding
machine-readable source code for the Library including whatever
changes were used in the work (which must be distributed under
Sections 1 and 2 above); and, if the work is an executable linked
with the Library, with the complete machine-readable "work that
uses the Library", as object code and/or source code, so that the
user can modify the Library and then relink to produce a modified
executable containing the modified Library. (It is understood
that the user who changes the contents of definitions files in the
Library will not necessarily be able to recompile the application
to use the modified definitions.)
b) Use a suitable shared library mechanism for linking with the
Library. A suitable mechanism is one that (1) uses at run time a
copy of the library already present on the user's computer system,
rather than copying library functions into the executable, and (2)
will operate properly with a modified version of the library, if
the user installs one, as long as the modified version is
interface-compatible with the version that the work was made with.
c) Accompany the work with a written offer, valid for at
least three years, to give the same user the materials
specified in Subsection 6a, above, for a charge no more
than the cost of performing this distribution.
d) If distribution of the work is made by offering access to copy
from a designated place, offer equivalent access to copy the above
specified materials from the same place.
e) Verify that the user has already received a copy of these
materials or that you have already sent this user a copy.
For an executable, the required form of the "work that uses the
Library" must include any data and utility programs needed for
reproducing the executable from it. However, as a special exception,
the materials to be distributed need not include anything that is
normally distributed (in either source or binary form) with the major
components (compiler, kernel, and so on) of the operating system on
which the executable runs, unless that component itself accompanies
the executable.
It may happen that this requirement contradicts the license
restrictions of other proprietary libraries that do not normally
accompany the operating system. Such a contradiction means you cannot
use both them and the Library together in an executable that you
distribute.
7. You may place library facilities that are a work based on the
Library side-by-side in a single library together with other library
facilities not covered by this License, and distribute such a combined
library, provided that the separate distribution of the work based on
the Library and of the other library facilities is otherwise
permitted, and provided that you do these two things:
a) Accompany the combined library with a copy of the same work
based on the Library, uncombined with any other library
facilities. This must be distributed under the terms of the
Sections above.
b) Give prominent notice with the combined library of the fact
that part of it is a work based on the Library, and explaining
where to find the accompanying uncombined form of the same work.
8. You may not copy, modify, sublicense, link with, or distribute
the Library except as expressly provided under this License. Any
attempt otherwise to copy, modify, sublicense, link with, or
distribute the Library is void, and will automatically terminate your
rights under this License. However, parties who have received copies,
or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.
9. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Library or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Library (or any work based on the
Library), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Library or works based on it.
10. Each time you redistribute the Library (or any work based on the
Library), the recipient automatically receives a license from the
original licensor to copy, distribute, link with or modify the Library
subject to these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties with
this License.
11. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Library at all. For example, if a patent
license would not permit royalty-free redistribution of the Library by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Library.
If any portion of this section is held invalid or unenforceable under any
particular circumstance, the balance of the section is intended to apply,
and the section as a whole is intended to apply in other circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
12. If the distribution and/or use of the Library is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Library under this License may add
an explicit geographical distribution limitation excluding those countries,
so that distribution is permitted only in or among countries not thus
excluded. In such case, this License incorporates the limitation as if
written in the body of this License.
13. The Free Software Foundation may publish revised and/or new
versions of the Lesser General Public License from time to time.
Such new versions will be similar in spirit to the present version,
but may differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Library
specifies a version number of this License which applies to it and
"any later version", you have the option of following the terms and
conditions either of that version or of any later version published by
the Free Software Foundation. If the Library does not specify a
license version number, you may choose any version ever published by
the Free Software Foundation.
14. If you wish to incorporate parts of the Library into other free
programs whose distribution conditions are incompatible with these,
write to the author to ask for permission. For software which is
copyrighted by the Free Software Foundation, write to the Free
Software Foundation; we sometimes make exceptions for this. Our
decision will be guided by the two goals of preserving the free status
of all derivatives of our free software and of promoting the sharing
and reuse of software generally.
NO WARRANTY
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
END OF TERMS AND CONDITIONS
"streamable kanji code filter and converter"
Copyright (c) 1998,1999,2000,2001 HappySize, Inc. All rights reserved.
This software is released under the GNU Lesser General Public License.
(Version 2.1, February 1999)
Please read the following detail of the licence (in japanese).
◆使用許諾条件◆
このソフトウェアは株式会社ハッピーサイズによって開発されました。株式会社ハッ
ピーサイズは、著作権法および万国著作権条約の定めにより、このソフトウェアに関
するすべての権利を留保する権利を持ち、ここに行使します。株式会社ハッピーサイ
ズは以下に明記した条件に従って、このソフトウェアを使用する排他的ではない権利
をお客様に許諾します。何人たりとも、以下の条件に反してこのソフトウェアを使用
することはできません。
このソフトウェアを「GNU Lesser General Public License (Version 2.1, February
1999)」に示された条件で使用することを、全ての方に許諾します。「GNU Lesser
General Public License」を満たさない使用には、株式会社ハッピーサイズから書面
による許諾を得る必要があります。
「GNU Lesser General Public License」の全文は以下のウェブページから取得でき
ます。「GNU Lesser General Public License」とは、これまでLibrary General
Public Licenseと呼ばれていたものです。
http://www.gnu.org/ --- GNUウェブサイト
http://www.gnu.org/copyleft/lesser.html --- ライセンス文面
このライセンスの内容がわからない方、守れない方には使用を許諾しません。
しかしながら、当社とGNUプロジェクトとの特定の関係を示唆または主張するもので
はありません。
◆保証内容◆
このソフトウェアは、期待された動作・機能・性能を持つことを目標として設計され
開発されていますが、これを保証するものではありません。このソフトウェアは「こ
のまま」の状態で提供されており、たとえばこのソフトウェアの有用性ないし特定の
目的に合致することといった、何らかの保証内容が、明示されたり暗黙に示されてい
る場合であっても、その保証は無効です。このソフトウェアを使用した結果ないし使
用しなかった結果によって、直接あるいは間接に受けた身体的な傷害、財産上の損害
、データの損失あるいはその他の全ての損害については、その損害の可能性が使用者
、当社あるいは第三者によって警告されていた場合であっても、当社はその損害の賠
償および補填を行いません。この規定は他の全ての、書面上または書面に無い保証・
契約・規定に優先します。
◆著作権者の連絡先および使用条件についての問い合わせ先◆
〒102-0073
東京都千代田区九段北1-13-5日本地所第一ビル4F
株式会社ハッピーサイズ
Phone: 03-3512-3655, Fax: 03-3512-3656
Email: sales@happysize.co.jp
Web: http://happysize.com/
◆著者◆
金本 茂 <sgk@happysize.co.jp>
PK ;K]�g{� � ea-php82-runtime/LICENSEnu �[��� --------------------------------------------------------------------
The PHP License, version 3.01
Copyright (c) 1999 - 2021 The PHP Group. All rights reserved.
--------------------------------------------------------------------
Redistribution and use in source and binary forms, with or without
modification, is permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
3. The name "PHP" must not be used to endorse or promote products
derived from this software without prior written permission. For
written permission, please contact group@php.net.
4. Products derived from this software may not be called "PHP", nor
may "PHP" appear in their name, without prior written permission
from group@php.net. You may indicate that your software works in
conjunction with PHP by saying "Foo for PHP" instead of calling
it "PHP Foo" or "phpfoo"
5. The PHP Group may publish revised and/or new versions of the
license from time to time. Each version will be given a
distinguishing version number.
Once covered code has been published under a particular version
of the license, you may always continue to use it under the terms
of that version. You may also choose to use such covered code
under the terms of any subsequent version of the license
published by the PHP Group. No one other than the PHP Group has
the right to modify the terms applicable to covered code created
under this License.
6. Redistributions of any form whatsoever must retain the following
acknowledgment:
"This product includes PHP software, freely available from
<http://www.php.net/software/>".
THIS SOFTWARE IS PROVIDED BY THE PHP DEVELOPMENT TEAM ``AS IS'' AND
ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE PHP
DEVELOPMENT TEAM OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.
--------------------------------------------------------------------
This software consists of voluntary contributions made by many
individuals on behalf of the PHP Group.
The PHP Group can be contacted via Email at group@php.net.
For more information on the PHP Group and the PHP project,
please see <http://www.php.net>.
PHP includes the Zend Engine, freely available at
<http://www.zend.com>.
PK ;K]�E �� � ea-php82-pear/README.rstnu �[��� *************************
PEAR - The PEAR Installer
*************************
.. image:: https://travis-ci.org/pear/pear-core.svg?branch=stable
:target: https://travis-ci.org/pear/pear-core
=========================================
What is the PEAR Installer? What is PEAR?
=========================================
PEAR is the PHP Extension and Application Repository, found at
http://pear.php.net.
The **PEAR Installer** is this software, which contains executable
files and PHP code that is used to **download and install** PEAR code
from pear.php.net.
PEAR contains useful **software libraries and applications** such as
MDB2 (database abstraction), HTML_QuickForm (HTML forms management),
PhpDocumentor (auto-documentation generator), DB_DataObject
(Data Access Abstraction), and many hundreds more.
Browse all available packages at http://pear.php.net, the list is
constantly growing and updating to reflect improvements in the PHP language.
.. warning::
Do not run PEAR without installing it - if you downloaded this
tarball manually, you MUST install it. Read the instructions in INSTALL
prior to use.
=============
Documentation
=============
Documentation for PEAR can be found at http://pear.php.net/manual/.
Installation documentation can be found in the INSTALL file included
in this tarball.
=====
Tests
=====
Run the tests without installation as follows::
$ ./scripts/pear.sh run-tests -r tests
You should have the ``Text_Diff`` package installed to get nicer error output.
To run the tests with another PHP version, modify ``php_bin`` and set the
``PHP_PEAR_PHP_BIN`` environment variable::
$ pear config-set php_bin /usr/local/bin/php7
$ PHP_PEAR_PHP_BIN=/usr/local/bin/php7 ./scripts/pear.sh run-tests -r tests
Happy PHPing, we hope PEAR will be a great tool for your development work!
Test dependencies
=================
* ``zlib``
=========
Releasing
=========
Create a PEAR package, as well as phars for pear-less installation,
simply run ``build-release.sh``).
``go-pear.phar`` contains the PEAR installer installer that asks where to install it.
It is available from http://pear.php.net/go-pear.phar.
``install-pear-nozlib.phar`` installs PEAR automatically without asking anything.
It is shipped with PHP itself.
PK )]�y���% �% openssl/html/man1/s_time.htmlnu �[��� PK )]+V�y *& openssl/html/man1/gendsa.htmlnu �[��� PK )])��� �� x6 openssl/html/man1/s_server.htmlnu �[��� PK )]��m� m� t� openssl/html/man1/ciphers.htmlnu �[��� PK )]�I��� � /E openssl/html/man1/rehash.htmlnu �[��� PK )]�`
\ openssl/html/man1/prime.htmlnu �[��� PK )]n%�� � re openssl/html/man1/nseq.htmlnu �[��� PK )]9�z�o �o �r openssl/html/man1/req.htmlnu �[��� PK )]d=Z��A �A �� openssl/html/man1/enc.htmlnu �[��� PK )]߮��9 9 �$ openssl/html/man1/verify.htmlnu �[��� PK )]O4�c c a� openssl/html/man1/storeutl.htmlnu �[��� PK )]��DE� � � openssl/html/man1/speed.htmlnu �[��� PK )]uS �h
h
� openssl/html/man1/pkeyparam.htmlnu �[��� PK )]S<�
� � �� openssl/html/man1/asn1parse.htmlnu �[��� PK )]T�z�4 �4 �� openssl/html/man1/pkcs8.htmlnu �[��� PK )]�?{ �6 �6 �* openssl/html/man1/genpkey.htmlnu �[��� PK )]T��`� `� �a openssl/html/man1/s_client.htmlnu �[��� PK )]y��[ [ �� openssl/html/man1/ec.htmlnu �[��� PK )]+3ƕAS AS < openssl/html/man1/ocsp.htmlnu �[��� PK )]=���> > �_ openssl/html/man1/version.htmlnu �[��� PK )]����R �R Ti openssl/html/man1/smime.htmlnu �[��� PK )]3Pu�S �S M� openssl/html/man1/openssl.htmlnu �[��� PK )]D��)� � z openssl/html/man1/dhparam.htmlnu �[��� PK )]T���� � �) openssl/html/man1/dsa.htmlnu �[��� PK )]����~
~
�E openssl/html/man1/list.htmlnu �[��� PK )][��� � �S openssl/html/man1/sess_id.htmlnu �[��� PK )]�w �
�
�k openssl/html/man1/srp.htmlnu �[��� PK )]{� W� � �v openssl/html/man1/x509.htmlnu �[��� PK )]��H�| | � openssl/html/man1/dsaparam.htmlnu �[��� PK )]�J��$# $# � openssl/html/man1/dgst.htmlnu �[��� PK )]ʉ�� � �? openssl/html/man1/crl2pkcs7.htmlnu �[��� PK )]���� � �P openssl/html/man1/passwd.htmlnu �[��� PK )]'�TS{ S{ b openssl/html/man1/ca.htmlnu �[��� PK )]��8Y{ { �� openssl/html/man1/genrsa.htmlnu �[��� PK )]�,�-f f �� openssl/html/man1/errstr.htmlnu �[��� PK )]�ڳ�X X 4� openssl/html/man1/ecparam.htmlnu �[��� PK )]��7�� � � openssl/html/man1/engine.htmlnu �[��� PK )]
.r� � ( openssl/html/man1/crl.htmlnu �[��� PK )]m;��# # �: openssl/html/man1/rsautl.htmlnu �[��� PK )]?=��6% 6% dZ openssl/html/man1/CA.pl.htmlnu �[��� PK )]7+*��= �= � openssl/html/man1/pkcs12.htmlnu �[��� PK )]��S S � openssl/html/man1/rand.htmlnu �[��� PK )]�:k� w w �� openssl/html/man1/cms.htmlnu �[��� PK )](��L� � E openssl/html/man1/pkey.htmlnu �[��� PK )]!�N>� � ^ openssl/html/man1/pkcs7.htmlnu �[��� PK )]�n�Q Q o openssl/html/man1/spkac.htmlnu �[��� PK )]���� � �� openssl/html/man1/tsget.htmlnu �[��� PK )]r��j j �� openssl/html/man1/ts.htmlnu �[��� PK )]���� � � openssl/html/man1/rsa.htmlnu �[��� PK )]�Ӻ7 7 �/ openssl/html/man1/pkeyutl.htmlnu �[��� PK )]376�aU aU $ ]g openssl/html/man5/x509v3_config.htmlnu �[��� PK )]'3)�mH mH � openssl/html/man5/config.htmlnu �[��� PK ;K]l��
�
�
ea-php82-php-common/ZEND_LICENSEnu ȯ�� PK ;K]��N(� �
ea-php82-php-common/README.mdnu ȯ�� PK ;K]ʱ!E� � $ .%
ea-php82-php-common/libmagic_LICENSEnu ȯ�� PK ;K]I� � ,
ea-php82-php-common/LICENSEnu ȯ�� PK ;K]M�r" " �8
ea-php82-php-common/TSRM_LICENSEnu ȯ�� PK ;K] ��)_ )_ J>
ea-php82-php-common/EXTENSIONSnu ȯ�� PK ;K]�ɽo �o ��
ea-php82-php-common/NEWSnu ȯ�� PK ;K] J�� � ' �
ea-php82-php-common/php.ini-developmentnu ȯ�� PK ;K]���q+ q+ ' .
ea-php82-php-common/CODING_STANDARDS.mdnu ȯ�� PK ;K]`/� v v & �Y
ea-php82-php-common/README.REDIST.BINSnu ȯ�� PK ;K]$�-�� � & 7�
ea-php82-php-common/php.ini-productionnu ȯ�� PK ;K]� ;? ? % � ea-php82-php-fpm/php-fpm.conf.defaultnu ȯ�� PK ;K]�f� � # � pear/XML_Util/examples/example2.phpnu �[��� PK ;K]5k��# �# " � pear/XML_Util/examples/example.phpnu �[��� PK ;K]� r¦J �J % > pear/Archive_Tar/docs/Archive_Tar.txtnu �[��� PK ;K]�E �� � � pear/PEAR/README.rstnu �[��� PK ;K]�u��� � (� pear/PEAR/LICENSEnu �[��� PK ;K]� ��x x .� pear/PEAR/INSTALLnu �[��� PK ;K]DG�e� � � pear/Structures_Graph/LICENSEnu �[��� PK ;K]x� �� � J � pear/Structures_Graph/docs/tutorials/Structures_Graph/Structures_Graph.pkgnu �[��� PK ;K]��-�l �l % O� ea-php82-php-mbstring/libmbfl_LICENSEnu ȯ�� PK ;K]�g{� � $< ea-php82-runtime/LICENSEnu �[��� PK ;K]�E �� � �H ea-php82-pear/README.rstnu �[��� PK K K z R