1b077aed3SPierre Pronchery=pod 2b077aed3SPierre Pronchery 3b077aed3SPierre Pronchery=head1 NAME 4b077aed3SPierre Pronchery 5b077aed3SPierre Proncheryopenssl-env - OpenSSL environment variables 6b077aed3SPierre Pronchery 7b077aed3SPierre Pronchery=head1 DESCRIPTION 8b077aed3SPierre Pronchery 9b077aed3SPierre ProncheryThe OpenSSL libraries use environment variables to override the 10b077aed3SPierre Proncherycompiled-in default paths for various data. 11b077aed3SPierre ProncheryTo avoid security risks, the environment is usually not consulted when 12b077aed3SPierre Proncherythe executable is set-user-ID or set-group-ID. 13b077aed3SPierre Pronchery 14b077aed3SPierre Pronchery=over 4 15b077aed3SPierre Pronchery 16b077aed3SPierre Pronchery=item B<CTLOG_FILE> 17b077aed3SPierre Pronchery 18b077aed3SPierre ProncherySpecifies the path to a certificate transparency log list. 19b077aed3SPierre ProncherySee L<CTLOG_STORE_new(3)>. 20b077aed3SPierre Pronchery 21b077aed3SPierre Pronchery=item B<OPENSSL> 22b077aed3SPierre Pronchery 23b077aed3SPierre ProncherySpecifies the path to the B<openssl> executable. Used by 24b077aed3SPierre Proncherythe B<rehash> script (see L<openssl-rehash(1)/Script Configuration>) 25b077aed3SPierre Proncheryand by the B<CA.pl> script (see L<CA.pl(1)/NOTES> 26b077aed3SPierre Pronchery 27b077aed3SPierre Pronchery=item B<OPENSSL_CONF>, B<OPENSSL_CONF_INCLUDE> 28b077aed3SPierre Pronchery 29b077aed3SPierre ProncherySpecifies the path to a configuration file and the directory for 30b077aed3SPierre Proncheryincluded files. 31b077aed3SPierre ProncherySee L<config(5)>. 32b077aed3SPierre Pronchery 33b077aed3SPierre Pronchery=item B<OPENSSL_CONFIG> 34b077aed3SPierre Pronchery 35b077aed3SPierre ProncherySpecifies a configuration option and filename for the B<req> and B<ca> 36b077aed3SPierre Proncherycommands invoked by the B<CA.pl> script. 37b077aed3SPierre ProncherySee L<CA.pl(1)>. 38b077aed3SPierre Pronchery 39b077aed3SPierre Pronchery=item B<OPENSSL_ENGINES> 40b077aed3SPierre Pronchery 41b077aed3SPierre ProncherySpecifies the directory from which dynamic engines are loaded. 42b077aed3SPierre ProncherySee L<openssl-engine(1)>. 43b077aed3SPierre Pronchery 44b077aed3SPierre Pronchery=item B<OPENSSL_MALLOC_FD>, B<OPENSSL_MALLOC_FAILURES> 45b077aed3SPierre Pronchery 46b077aed3SPierre ProncheryIf built with debugging, this allows memory allocation to fail. 47b077aed3SPierre ProncherySee L<OPENSSL_malloc(3)>. 48b077aed3SPierre Pronchery 49b077aed3SPierre Pronchery=item B<OPENSSL_MODULES> 50b077aed3SPierre Pronchery 51b077aed3SPierre ProncherySpecifies the directory from which cryptographic providers are loaded. 52b077aed3SPierre ProncheryEquivalently, the generic B<-provider-path> command-line option may be used. 53b077aed3SPierre Pronchery 54*0d0c8621SEnji Cooper=item B<OPENSSL_TRACE> 55*0d0c8621SEnji Cooper 56*0d0c8621SEnji CooperBy default the OpenSSL trace feature is disabled statically. 57*0d0c8621SEnji CooperTo enable it, OpenSSL must be built with tracing support, 58*0d0c8621SEnji Cooperwhich may be configured like this: C<./config enable-trace> 59*0d0c8621SEnji Cooper 60*0d0c8621SEnji CooperUnless OpenSSL tracing support is generally disabled, 61*0d0c8621SEnji Cooperenable trace output of specific parts of OpenSSL libraries, by name. 62*0d0c8621SEnji CooperThis output usually makes sense only if you know OpenSSL internals well. 63*0d0c8621SEnji Cooper 64*0d0c8621SEnji CooperThe value of this environment varialble is a comma-separated list of names, 65*0d0c8621SEnji Cooperwith the following available: 66*0d0c8621SEnji Cooper 67*0d0c8621SEnji Cooper=over 4 68*0d0c8621SEnji Cooper 69*0d0c8621SEnji Cooper=item B<TRACE> 70*0d0c8621SEnji Cooper 71*0d0c8621SEnji CooperTraces the OpenSSL trace API itself. 72*0d0c8621SEnji Cooper 73*0d0c8621SEnji Cooper=item B<INIT> 74*0d0c8621SEnji Cooper 75*0d0c8621SEnji CooperTraces OpenSSL library initialization and cleanup. 76*0d0c8621SEnji Cooper 77*0d0c8621SEnji Cooper=item B<TLS> 78*0d0c8621SEnji Cooper 79*0d0c8621SEnji CooperTraces the TLS/SSL protocol. 80*0d0c8621SEnji Cooper 81*0d0c8621SEnji Cooper=item B<TLS_CIPHER> 82*0d0c8621SEnji Cooper 83*0d0c8621SEnji CooperTraces the ciphers used by the TLS/SSL protocol. 84*0d0c8621SEnji Cooper 85*0d0c8621SEnji Cooper=item B<CONF> 86*0d0c8621SEnji Cooper 87*0d0c8621SEnji CooperShow details about provider and engine configuration. 88*0d0c8621SEnji Cooper 89*0d0c8621SEnji Cooper=item B<ENGINE_TABLE> 90*0d0c8621SEnji Cooper 91*0d0c8621SEnji CooperThe function that is used by RSA, DSA (etc) code to select registered 92*0d0c8621SEnji CooperENGINEs, cache defaults and functional references (etc), will generate 93*0d0c8621SEnji Cooperdebugging summaries. 94*0d0c8621SEnji Cooper 95*0d0c8621SEnji Cooper=item B<ENGINE_REF_COUNT> 96*0d0c8621SEnji Cooper 97*0d0c8621SEnji CooperReference counts in the ENGINE structure will be monitored with a line 98*0d0c8621SEnji Cooperof generated for each change. 99*0d0c8621SEnji Cooper 100*0d0c8621SEnji Cooper=item B<PKCS5V2> 101*0d0c8621SEnji Cooper 102*0d0c8621SEnji CooperTraces PKCS#5 v2 key generation. 103*0d0c8621SEnji Cooper 104*0d0c8621SEnji Cooper=item B<PKCS12_KEYGEN> 105*0d0c8621SEnji Cooper 106*0d0c8621SEnji CooperTraces PKCS#12 key generation. 107*0d0c8621SEnji Cooper 108*0d0c8621SEnji Cooper=item B<PKCS12_DECRYPT> 109*0d0c8621SEnji Cooper 110*0d0c8621SEnji CooperTraces PKCS#12 decryption. 111*0d0c8621SEnji Cooper 112*0d0c8621SEnji Cooper=item B<X509V3_POLICY> 113*0d0c8621SEnji Cooper 114*0d0c8621SEnji CooperGenerates the complete policy tree at various points during X.509 v3 115*0d0c8621SEnji Cooperpolicy evaluation. 116*0d0c8621SEnji Cooper 117*0d0c8621SEnji Cooper=item B<BN_CTX> 118*0d0c8621SEnji Cooper 119*0d0c8621SEnji CooperTraces BIGNUM context operations. 120*0d0c8621SEnji Cooper 121*0d0c8621SEnji Cooper=item B<CMP> 122*0d0c8621SEnji Cooper 123*0d0c8621SEnji CooperTraces CMP client and server activity. 124*0d0c8621SEnji Cooper 125*0d0c8621SEnji Cooper=item B<STORE> 126*0d0c8621SEnji Cooper 127*0d0c8621SEnji CooperTraces STORE operations. 128*0d0c8621SEnji Cooper 129*0d0c8621SEnji Cooper=item B<DECODER> 130*0d0c8621SEnji Cooper 131*0d0c8621SEnji CooperTraces decoder operations. 132*0d0c8621SEnji Cooper 133*0d0c8621SEnji Cooper=item B<ENCODER> 134*0d0c8621SEnji Cooper 135*0d0c8621SEnji CooperTraces encoder operations. 136*0d0c8621SEnji Cooper 137*0d0c8621SEnji Cooper=item B<REF_COUNT> 138*0d0c8621SEnji Cooper 139*0d0c8621SEnji CooperTraces decrementing certain ASN.1 structure references. 140*0d0c8621SEnji Cooper 141*0d0c8621SEnji Cooper=item B<HTTP> 142*0d0c8621SEnji Cooper 143*0d0c8621SEnji CooperTraces the HTTP client and server, such as messages being sent and received. 144*0d0c8621SEnji Cooper 145*0d0c8621SEnji Cooper=back 146*0d0c8621SEnji Cooper 147b077aed3SPierre Pronchery=item B<OPENSSL_WIN32_UTF8> 148b077aed3SPierre Pronchery 149b077aed3SPierre ProncheryIf set, then L<UI_OpenSSL(3)> returns UTF-8 encoded strings, rather than 150b077aed3SPierre Proncheryones encoded in the current code page, and 151b077aed3SPierre Proncherythe L<openssl(1)> program also transcodes the command-line parameters 152b077aed3SPierre Proncheryfrom the current code page to UTF-8. 153b077aed3SPierre ProncheryThis environment variable is only checked on Microsoft Windows platforms. 154b077aed3SPierre Pronchery 155b077aed3SPierre Pronchery=item B<RANDFILE> 156b077aed3SPierre Pronchery 157b077aed3SPierre ProncheryThe state file for the random number generator. 158b077aed3SPierre ProncheryThis should not be needed in normal use. 159b077aed3SPierre ProncherySee L<RAND_load_file(3)>. 160b077aed3SPierre Pronchery 161b077aed3SPierre Pronchery=item B<SSL_CERT_DIR>, B<SSL_CERT_FILE> 162b077aed3SPierre Pronchery 163b077aed3SPierre ProncherySpecify the default directory or file containing CA certificates. 164b077aed3SPierre ProncherySee L<SSL_CTX_load_verify_locations(3)>. 165b077aed3SPierre Pronchery 166b077aed3SPierre Pronchery=item B<TSGET> 167b077aed3SPierre Pronchery 168b077aed3SPierre ProncheryAdditional arguments for the L<tsget(1)> command. 169b077aed3SPierre Pronchery 170b077aed3SPierre Pronchery=item B<OPENSSL_ia32cap>, B<OPENSSL_sparcv9cap>, B<OPENSSL_ppccap>, B<OPENSSL_armcap>, B<OPENSSL_s390xcap> 171b077aed3SPierre Pronchery 172b077aed3SPierre ProncheryOpenSSL supports a number of different algorithm implementations for 173b077aed3SPierre Proncheryvarious machines and, by default, it determines which to use based on the 174b077aed3SPierre Proncheryprocessor capabilities and run time feature enquiry. These environment 175b077aed3SPierre Proncheryvariables can be used to exert more control over this selection process. 176b077aed3SPierre ProncherySee L<OPENSSL_ia32cap(3)>, L<OPENSSL_s390xcap(3)>. 177b077aed3SPierre Pronchery 178b077aed3SPierre Pronchery=item B<NO_PROXY>, B<HTTPS_PROXY>, B<HTTP_PROXY> 179b077aed3SPierre Pronchery 180b077aed3SPierre ProncherySpecify a proxy hostname. 181b077aed3SPierre ProncherySee L<OSSL_HTTP_parse_url(3)>. 182b077aed3SPierre Pronchery 183b077aed3SPierre Pronchery=back 184b077aed3SPierre Pronchery 185b077aed3SPierre Pronchery=head1 COPYRIGHT 186b077aed3SPierre Pronchery 187b077aed3SPierre ProncheryCopyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. 188b077aed3SPierre Pronchery 189b077aed3SPierre ProncheryLicensed under the Apache License 2.0 (the "License"). You may not use 190b077aed3SPierre Proncherythis file except in compliance with the License. You can obtain a copy 191b077aed3SPierre Proncheryin the file LICENSE in the source distribution or at 192b077aed3SPierre ProncheryL<https://www.openssl.org/source/license.html>. 193b077aed3SPierre Pronchery 194b077aed3SPierre Pronchery=cut 195