Home | History | Annotate | Line # | Download | only in man1 
      1 =pod
      2 
      3 =head1 NAME
      4 
      5 openssl-spkac,
      6 spkac - SPKAC printing and generating utility
      7 
      8 =head1 SYNOPSIS
      9 
     10 B<openssl> B<spkac>
     11 [B<-help>]
     12 [B<-in filename>]
     13 [B<-out filename>]
     14 [B<-key keyfile>]
     15 [B<-keyform PEM|DER|ENGINE>]
     16 [B<-passin arg>]
     17 [B<-challenge string>]
     18 [B<-pubkey>]
     19 [B<-spkac spkacname>]
     20 [B<-spksect section>]
     21 [B<-noout>]
     22 [B<-verify>]
     23 [B<-engine id>]
     24 
     25 =head1 DESCRIPTION
     26 
     27 The B<spkac> command processes Netscape signed public key and challenge
     28 (SPKAC) files. It can print out their contents, verify the signature and
     29 produce its own SPKACs from a supplied private key.
     30 
     31 =head1 OPTIONS
     32 
     33 =over 4
     34 
     35 =item B<-help>
     36 
     37 Print out a usage message.
     38 
     39 =item B<-in filename>
     40 
     41 This specifies the input filename to read from or standard input if this
     42 option is not specified. Ignored if the B<-key> option is used.
     43 
     44 =item B<-out filename>
     45 
     46 Specifies the output filename to write to or standard output by
     47 default.
     48 
     49 =item B<-key keyfile>
     50 
     51 Create an SPKAC file using the private key in B<keyfile>. The
     52 B<-in>, B<-noout>, B<-spksect> and B<-verify> options are ignored if
     53 present.
     54 
     55 =item B<-keyform PEM|DER|ENGINE>
     56 
     57 Whether the key format is PEM, DER, or an engine-backed key.
     58 The default is PEM.
     59 
     60 =item B<-passin password>
     61 
     62 The input file password source. For more information about the format of B<arg>
     63 see L<openssl(1)/Pass Phrase Options>.
     64 
     65 =item B<-challenge string>
     66 
     67 Specifies the challenge string if an SPKAC is being created.
     68 
     69 =item B<-spkac spkacname>
     70 
     71 Allows an alternative name form the variable containing the
     72 SPKAC. The default is "SPKAC". This option affects both
     73 generated and input SPKAC files.
     74 
     75 =item B<-spksect section>
     76 
     77 Allows an alternative name form the section containing the
     78 SPKAC. The default is the default section.
     79 
     80 =item B<-noout>
     81 
     82 Don't output the text version of the SPKAC (not used if an
     83 SPKAC is being created).
     84 
     85 =item B<-pubkey>
     86 
     87 Output the public key of an SPKAC (not used if an SPKAC is
     88 being created).
     89 
     90 =item B<-verify>
     91 
     92 Verifies the digital signature on the supplied SPKAC.
     93 
     94 =item B<-engine id>
     95 
     96 Specifying an engine (by its unique B<id> string) will cause B<spkac>
     97 to attempt to obtain a functional reference to the specified engine,
     98 thus initialising it if needed. The engine will then be set as the default
     99 for all available algorithms.
    100 
    101 =back
    102 
    103 =head1 EXAMPLES
    104 
    105 Print out the contents of an SPKAC:
    106 
    107  openssl spkac -in spkac.cnf
    108 
    109 Verify the signature of an SPKAC:
    110 
    111  openssl spkac -in spkac.cnf -noout -verify
    112 
    113 Create an SPKAC using the challenge string "hello":
    114 
    115  openssl spkac -key key.pem -challenge hello -out spkac.cnf
    116 
    117 Example of an SPKAC, (long lines split up for clarity):
    118 
    119  SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA\
    120  1cCoq2Wa3Ixs47uI7FPVwHVIPDx5yso105Y6zpozam135a\
    121  8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03uPFoQIDAQAB\
    122  FgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJ\
    123  h1bEIYuc2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnD\
    124  dq+NQ3F+X4deMx9AaEglZtULwV4=
    125 
    126 =head1 NOTES
    127 
    128 A created SPKAC with suitable DN components appended can be fed into
    129 the B<ca> utility.
    130 
    131 SPKACs are typically generated by Netscape when a form is submitted
    132 containing the B<KEYGEN> tag as part of the certificate enrollment
    133 process.
    134 
    135 The challenge string permits a primitive form of proof of possession
    136 of private key. By checking the SPKAC signature and a random challenge
    137 string some guarantee is given that the user knows the private key
    138 corresponding to the public key being certified. This is important in
    139 some applications. Without this it is possible for a previous SPKAC
    140 to be used in a "replay attack".
    141 
    142 =head1 SEE ALSO
    143 
    144 L<ca(1)>
    145 
    146 =head1 COPYRIGHT
    147 
    148 Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
    149 
    150 Licensed under the OpenSSL license (the "License").  You may not use
    151 this file except in compliance with the License.  You can obtain a copy
    152 in the file LICENSE in the source distribution or at
    153 L<https://www.openssl.org/source/license.html>.
    154 
    155 =cut
    156