mirror of https://github.com/openssl/openssl.git
146 lines
3.7 KiB
Plaintext
146 lines
3.7 KiB
Plaintext
=pod
|
|
|
|
=head1 NAME
|
|
|
|
openssl-format-options - OpenSSL command input and output format options
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
B<openssl>
|
|
I<command>
|
|
[ I<options> ... ]
|
|
[ I<parameters> ... ]
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
Several OpenSSL commands can take input or generate output in a variety
|
|
of formats.
|
|
|
|
Since OpenSSL 3.0 keys, single certificates, and CRLs can be read from
|
|
files in any of the B<DER>, B<PEM> or B<P12> formats. Specifying their input
|
|
format is no more needed and the openssl commands will automatically try all
|
|
the possible formats. However if the B<DER> or B<PEM> input format is specified
|
|
it will be enforced.
|
|
|
|
In order to access a key via an engine the input format B<ENGINE> may be used;
|
|
alternatively the key identifier in the <uri> argument of the respective key
|
|
option may be preceded by C<org.openssl.engine:>.
|
|
See L<openssl(1)/Engine Options> for an example usage of the latter.
|
|
|
|
=head1 OPTIONS
|
|
|
|
=head2 Format Options
|
|
|
|
The options to specify the format are as follows.
|
|
Refer to the individual man page to see which options are accepted.
|
|
|
|
=over 4
|
|
|
|
=item B<-inform> I<format>, B<-outform> I<format>
|
|
|
|
The format of the input or output streams.
|
|
|
|
=item B<-keyform> I<format>
|
|
|
|
Format of a private key input source.
|
|
|
|
=item B<-CRLform> I<format>
|
|
|
|
Format of a CRL input source.
|
|
|
|
=back
|
|
|
|
=head2 Format Option Arguments
|
|
|
|
The possible format arguments are described below.
|
|
Both uppercase and lowercase are accepted.
|
|
|
|
The list of acceptable format arguments, and the default,
|
|
is described in each command documentation.
|
|
|
|
=over 4
|
|
|
|
=item B<DER>
|
|
|
|
A binary format, encoded or parsed according to Distinguished Encoding Rules
|
|
(DER) of the ASN.1 data language.
|
|
|
|
=item B<ENGINE>
|
|
|
|
Used to specify that the cryptographic material is in an OpenSSL B<engine>.
|
|
An engine must be configured or specified using the B<-engine> option.
|
|
A password or PIN may be supplied to the engine using the B<-passin> option.
|
|
|
|
=item B<P12>
|
|
|
|
A DER-encoded file containing a PKCS#12 object.
|
|
It might be necessary to provide a decryption password to retrieve
|
|
the private key.
|
|
|
|
=item B<PEM>
|
|
|
|
A text format defined in IETF RFC 1421 and IETF RFC 7468. Briefly, this is
|
|
a block of base-64 encoding (defined in IETF RFC 4648), with specific
|
|
lines used to mark the start and end:
|
|
|
|
Text before the BEGIN line is ignored.
|
|
----- BEGIN object-type -----
|
|
OT43gQKBgQC/2OHZoko6iRlNOAQ/tMVFNq7fL81GivoQ9F1U0Qr+DH3ZfaH8eIkX
|
|
xT0ToMPJUzWAn8pZv0snA0um6SIgvkCuxO84OkANCVbttzXImIsL7pFzfcwV/ERK
|
|
UM6j0ZuSMFOCr/lGPAoOQU0fskidGEHi1/kW+suSr28TqsyYZpwBDQ==
|
|
----- END object-type -----
|
|
Text after the END line is also ignored
|
|
|
|
The I<object-type> must match the type of object that is expected.
|
|
For example a C<BEGIN X509 CERTIFICATE> will not match if the command
|
|
is trying to read a private key. The types supported include:
|
|
|
|
ANY PRIVATE KEY
|
|
CERTIFICATE
|
|
CERTIFICATE REQUEST
|
|
CMS
|
|
DH PARAMETERS
|
|
DSA PARAMETERS
|
|
DSA PUBLIC KEY
|
|
EC PARAMETERS
|
|
EC PRIVATE KEY
|
|
ECDSA PUBLIC KEY
|
|
ENCRYPTED PRIVATE KEY
|
|
PARAMETERS
|
|
PKCS #7 SIGNED DATA
|
|
PKCS7
|
|
PRIVATE KEY
|
|
PUBLIC KEY
|
|
RSA PRIVATE KEY
|
|
SSL SESSION PARAMETERS
|
|
TRUSTED CERTIFICATE
|
|
X509 CRL
|
|
X9.42 DH PARAMETERS
|
|
|
|
The following legacy I<object-type>'s are also supported for compatibility
|
|
with earlier releases:
|
|
|
|
DSA PRIVATE KEY
|
|
NEW CERTIFICATE REQUEST
|
|
RSA PUBLIC KEY
|
|
X509 CERTIFICATE
|
|
|
|
=item B<SMIME>
|
|
|
|
An S/MIME object as described in IETF RFC 8551.
|
|
Earlier versions were known as CMS and are compatible.
|
|
Note that the parsing is simple and might fail to parse some legal data.
|
|
|
|
=back
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
|
|
|
|
Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file LICENSE in the source distribution or at
|
|
L<https://www.openssl.org/source/license.html>.
|
|
|
|
=cut
|