1*b077aed3SPierre Pronchery=pod 2*b077aed3SPierre Pronchery 3*b077aed3SPierre Pronchery=begin comment 4*b077aed3SPierre Pronchery{- join("\n", @autowarntext) -} 5*b077aed3SPierre Pronchery 6*b077aed3SPierre Pronchery=end comment 7*b077aed3SPierre Pronchery 8*b077aed3SPierre Pronchery=head1 NAME 9*b077aed3SPierre Pronchery 10*b077aed3SPierre Proncheryopenssl-spkac - SPKAC printing and generating command 11*b077aed3SPierre Pronchery 12*b077aed3SPierre Pronchery=head1 SYNOPSIS 13*b077aed3SPierre Pronchery 14*b077aed3SPierre ProncheryB<openssl> B<spkac> 15*b077aed3SPierre Pronchery[B<-help>] 16*b077aed3SPierre Pronchery[B<-in> I<filename>] 17*b077aed3SPierre Pronchery[B<-out> I<filename>] 18*b077aed3SPierre Pronchery[B<-digest> I<digest>] 19*b077aed3SPierre Pronchery[B<-key> I<filename>|I<uri>] 20*b077aed3SPierre Pronchery[B<-keyform> B<DER>|B<PEM>|B<P12>|B<ENGINE>] 21*b077aed3SPierre Pronchery[B<-passin> I<arg>] 22*b077aed3SPierre Pronchery[B<-challenge> I<string>] 23*b077aed3SPierre Pronchery[B<-pubkey>] 24*b077aed3SPierre Pronchery[B<-spkac> I<spkacname>] 25*b077aed3SPierre Pronchery[B<-spksect> I<section>] 26*b077aed3SPierre Pronchery[B<-noout>] 27*b077aed3SPierre Pronchery[B<-verify>] 28*b077aed3SPierre Pronchery{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} 29*b077aed3SPierre Pronchery 30*b077aed3SPierre Pronchery=head1 DESCRIPTION 31*b077aed3SPierre Pronchery 32*b077aed3SPierre ProncheryThis command processes Netscape signed public key and challenge 33*b077aed3SPierre Pronchery(SPKAC) files. It can print out their contents, verify the signature and 34*b077aed3SPierre Proncheryproduce its own SPKACs from a supplied private key. 35*b077aed3SPierre Pronchery 36*b077aed3SPierre Pronchery=head1 OPTIONS 37*b077aed3SPierre Pronchery 38*b077aed3SPierre Pronchery=over 4 39*b077aed3SPierre Pronchery 40*b077aed3SPierre Pronchery=item B<-help> 41*b077aed3SPierre Pronchery 42*b077aed3SPierre ProncheryPrint out a usage message. 43*b077aed3SPierre Pronchery 44*b077aed3SPierre Pronchery=item B<-in> I<filename> 45*b077aed3SPierre Pronchery 46*b077aed3SPierre ProncheryThis specifies the input filename to read from or standard input if this 47*b077aed3SPierre Proncheryoption is not specified. Ignored if the B<-key> option is used. 48*b077aed3SPierre Pronchery 49*b077aed3SPierre Pronchery=item B<-out> I<filename> 50*b077aed3SPierre Pronchery 51*b077aed3SPierre ProncherySpecifies the output filename to write to or standard output by 52*b077aed3SPierre Proncherydefault. 53*b077aed3SPierre Pronchery 54*b077aed3SPierre Pronchery=item B<-digest> I<digest> 55*b077aed3SPierre Pronchery 56*b077aed3SPierre ProncheryUse the specified I<digest> to sign a created SPKAC file. 57*b077aed3SPierre ProncheryThe default digest algorithm is MD5. 58*b077aed3SPierre Pronchery 59*b077aed3SPierre Pronchery=item B<-key> I<filename>|I<uri> 60*b077aed3SPierre Pronchery 61*b077aed3SPierre ProncheryCreate an SPKAC file using the private key specified by I<filename> or I<uri>. 62*b077aed3SPierre ProncheryThe B<-in>, B<-noout>, B<-spksect> and B<-verify> options are ignored if 63*b077aed3SPierre Proncherypresent. 64*b077aed3SPierre Pronchery 65*b077aed3SPierre Pronchery=item B<-keyform> B<DER>|B<PEM>|B<P12>|B<ENGINE> 66*b077aed3SPierre Pronchery 67*b077aed3SPierre ProncheryThe key format; unspecified by default. 68*b077aed3SPierre ProncherySee L<openssl-format-options(1)> for details. 69*b077aed3SPierre Pronchery 70*b077aed3SPierre Pronchery=item B<-passin> I<arg> 71*b077aed3SPierre Pronchery 72*b077aed3SPierre ProncheryThe input file password source. For more information about the format of I<arg> 73*b077aed3SPierre Proncherysee L<openssl-passphrase-options(1)>. 74*b077aed3SPierre Pronchery 75*b077aed3SPierre Pronchery=item B<-challenge> I<string> 76*b077aed3SPierre Pronchery 77*b077aed3SPierre ProncherySpecifies the challenge string if an SPKAC is being created. 78*b077aed3SPierre Pronchery 79*b077aed3SPierre Pronchery=item B<-spkac> I<spkacname> 80*b077aed3SPierre Pronchery 81*b077aed3SPierre ProncheryAllows an alternative name form the variable containing the 82*b077aed3SPierre ProncherySPKAC. The default is "SPKAC". This option affects both 83*b077aed3SPierre Proncherygenerated and input SPKAC files. 84*b077aed3SPierre Pronchery 85*b077aed3SPierre Pronchery=item B<-spksect> I<section> 86*b077aed3SPierre Pronchery 87*b077aed3SPierre ProncheryAllows an alternative name form the section containing the 88*b077aed3SPierre ProncherySPKAC. The default is the default section. 89*b077aed3SPierre Pronchery 90*b077aed3SPierre Pronchery=item B<-noout> 91*b077aed3SPierre Pronchery 92*b077aed3SPierre ProncheryDon't output the text version of the SPKAC (not used if an 93*b077aed3SPierre ProncherySPKAC is being created). 94*b077aed3SPierre Pronchery 95*b077aed3SPierre Pronchery=item B<-pubkey> 96*b077aed3SPierre Pronchery 97*b077aed3SPierre ProncheryOutput the public key of an SPKAC (not used if an SPKAC is 98*b077aed3SPierre Proncherybeing created). 99*b077aed3SPierre Pronchery 100*b077aed3SPierre Pronchery=item B<-verify> 101*b077aed3SPierre Pronchery 102*b077aed3SPierre ProncheryVerifies the digital signature on the supplied SPKAC. 103*b077aed3SPierre Pronchery 104*b077aed3SPierre Pronchery{- $OpenSSL::safe::opt_engine_item -} 105*b077aed3SPierre Pronchery 106*b077aed3SPierre Pronchery{- $OpenSSL::safe::opt_provider_item -} 107*b077aed3SPierre Pronchery 108*b077aed3SPierre Pronchery=back 109*b077aed3SPierre Pronchery 110*b077aed3SPierre Pronchery=head1 EXAMPLES 111*b077aed3SPierre Pronchery 112*b077aed3SPierre ProncheryPrint out the contents of an SPKAC: 113*b077aed3SPierre Pronchery 114*b077aed3SPierre Pronchery openssl spkac -in spkac.cnf 115*b077aed3SPierre Pronchery 116*b077aed3SPierre ProncheryVerify the signature of an SPKAC: 117*b077aed3SPierre Pronchery 118*b077aed3SPierre Pronchery openssl spkac -in spkac.cnf -noout -verify 119*b077aed3SPierre Pronchery 120*b077aed3SPierre ProncheryCreate an SPKAC using the challenge string "hello": 121*b077aed3SPierre Pronchery 122*b077aed3SPierre Pronchery openssl spkac -key key.pem -challenge hello -out spkac.cnf 123*b077aed3SPierre Pronchery 124*b077aed3SPierre ProncheryExample of an SPKAC, (long lines split up for clarity): 125*b077aed3SPierre Pronchery 126*b077aed3SPierre Pronchery SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA\ 127*b077aed3SPierre Pronchery 1cCoq2Wa3Ixs47uI7FPVwHVIPDx5yso105Y6zpozam135a\ 128*b077aed3SPierre Pronchery 8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03uPFoQIDAQAB\ 129*b077aed3SPierre Pronchery FgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJ\ 130*b077aed3SPierre Pronchery h1bEIYuc2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnD\ 131*b077aed3SPierre Pronchery dq+NQ3F+X4deMx9AaEglZtULwV4= 132*b077aed3SPierre Pronchery 133*b077aed3SPierre Pronchery=head1 NOTES 134*b077aed3SPierre Pronchery 135*b077aed3SPierre ProncheryA created SPKAC with suitable DN components appended can be fed to 136*b077aed3SPierre ProncheryL<openssl-ca(1)>. 137*b077aed3SPierre Pronchery 138*b077aed3SPierre ProncherySPKACs are typically generated by Netscape when a form is submitted 139*b077aed3SPierre Proncherycontaining the B<KEYGEN> tag as part of the certificate enrollment 140*b077aed3SPierre Proncheryprocess. 141*b077aed3SPierre Pronchery 142*b077aed3SPierre ProncheryThe challenge string permits a primitive form of proof of possession 143*b077aed3SPierre Proncheryof private key. By checking the SPKAC signature and a random challenge 144*b077aed3SPierre Proncherystring some guarantee is given that the user knows the private key 145*b077aed3SPierre Proncherycorresponding to the public key being certified. This is important in 146*b077aed3SPierre Proncherysome applications. Without this it is possible for a previous SPKAC 147*b077aed3SPierre Proncheryto be used in a "replay attack". 148*b077aed3SPierre Pronchery 149*b077aed3SPierre Pronchery=head1 SEE ALSO 150*b077aed3SPierre Pronchery 151*b077aed3SPierre ProncheryL<openssl(1)>, 152*b077aed3SPierre ProncheryL<openssl-ca(1)> 153*b077aed3SPierre Pronchery 154*b077aed3SPierre Pronchery=head1 HISTORY 155*b077aed3SPierre Pronchery 156*b077aed3SPierre ProncheryThe B<-engine> option was deprecated in OpenSSL 3.0. 157*b077aed3SPierre Pronchery 158*b077aed3SPierre ProncheryThe B<-digest> option was added in OpenSSL 3.0. 159*b077aed3SPierre Pronchery 160*b077aed3SPierre Pronchery=head1 COPYRIGHT 161*b077aed3SPierre Pronchery 162*b077aed3SPierre ProncheryCopyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved. 163*b077aed3SPierre Pronchery 164*b077aed3SPierre ProncheryLicensed under the Apache License 2.0 (the "License"). You may not use 165*b077aed3SPierre Proncherythis file except in compliance with the License. You can obtain a copy 166*b077aed3SPierre Proncheryin the file LICENSE in the source distribution or at 167*b077aed3SPierre ProncheryL<https://www.openssl.org/source/license.html>. 168*b077aed3SPierre Pronchery 169*b077aed3SPierre Pronchery=cut 170