FM / man1

/opt/cpanel/ea-openssl11/share/doc/openssl/html/man1/

/opt/cpanel/ea-openssl11/share/doc/openssl/html/man1

Name	Size	Mode	Actions
asn1parse.html	8419	0644	edit dl rm
ca.html	31650	0644	edit dl rm
CA.pl.html	9569	0644	edit dl rm
ciphers.html	35949	0644	edit dl rm
cms.html	30560	0644	edit dl rm
crl.html	4812	0644	edit dl rm
crl2pkcs7.html	4309	0644	edit dl rm
c_rehash.html	5813	0644	edit dl rm
dgst.html	9028	0644	edit dl rm
dhparam.html	6362	0644	edit dl rm
dsa.html	7202	0644	edit dl rm
dsaparam.html	5022	0644	edit dl rm
ec.html	8069	0644	edit dl rm
ecparam.html	7302	0644	edit dl rm
enc.html	17001	0644	edit dl rm
engine.html	4368	0644	edit dl rm
errstr.html	1929	0644	edit dl rm
gendsa.html	4129	0644	edit dl rm
genpkey.html	14114	0644	edit dl rm
genrsa.html	5275	0644	edit dl rm
list.html	3486	0644	edit dl rm
nseq.html	3341	0644	edit dl rm
ocsp.html	21358	0644	edit dl rm
openssl-asn1parse.html	8419	0644	edit dl rm
openssl-ca.html	31650	0644	edit dl rm
openssl-ciphers.html	35949	0644	edit dl rm
openssl-cms.html	30560	0644	edit dl rm
openssl-crl.html	4812	0644	edit dl rm
openssl-crl2pkcs7.html	4309	0644	edit dl rm
openssl-c_rehash.html	5813	0644	edit dl rm
openssl-dgst.html	9028	0644	edit dl rm
openssl-dhparam.html	6362	0644	edit dl rm
openssl-dsa.html	7202	0644	edit dl rm
openssl-dsaparam.html	5022	0644	edit dl rm
openssl-ec.html	8069	0644	edit dl rm
openssl-ecparam.html	7302	0644	edit dl rm
openssl-enc.html	17001	0644	edit dl rm
openssl-engine.html	4368	0644	edit dl rm
openssl-errstr.html	1929	0644	edit dl rm
openssl-gendsa.html	4129	0644	edit dl rm
openssl-genpkey.html	14114	0644	edit dl rm
openssl-genrsa.html	5275	0644	edit dl rm
openssl-list.html	3486	0644	edit dl rm
openssl-nseq.html	3341	0644	edit dl rm
openssl-ocsp.html	21358	0644	edit dl rm
openssl-passwd.html	4359	0644	edit dl rm
openssl-pkcs7.html	4314	0644	edit dl rm
openssl-pkcs8.html	13521	0644	edit dl rm
openssl-pkcs12.html	15875	0644	edit dl rm
openssl-pkey.html	6340	0644	edit dl rm
openssl-pkeyparam.html	3465	0644	edit dl rm
openssl-pkeyutl.html	14144	0644	edit dl rm
openssl-prime.html	2361	0644	edit dl rm
openssl-rand.html	3955	0644	edit dl rm
openssl-rehash.html	5813	0644	edit dl rm
openssl-req.html	28754	0644	edit dl rm
openssl-rsa.html	7927	0644	edit dl rm
openssl-rsautl.html	8045	0644	edit dl rm
openssl-sess_id.html	6128	0644	edit dl rm
openssl-smime.html	21223	0644	edit dl rm
openssl-speed.html	4059	0644	edit dl rm
openssl-spkac.html	5754	0644	edit dl rm
openssl-srp.html	2756	0644	edit dl rm
openssl-storeutl.html	4739	0644	edit dl rm
openssl-s_client.html	35485	0644	edit dl rm
openssl-s_server.html	33490	0644	edit dl rm
openssl-s_time.html	9726	0644	edit dl rm
openssl-ts.html	27227	0644	edit dl rm
openssl-tsget.html	8475	0644	edit dl rm
openssl-verify.html	32603	0644	edit dl rm
openssl-version.html	2398	0644	edit dl rm
openssl-x509.html	37404	0644	edit dl rm
openssl.html	21512	0644	edit dl rm
passwd.html	4359	0644	edit dl rm
pkcs7.html	4314	0644	edit dl rm
pkcs8.html	13521	0644	edit dl rm
pkcs12.html	15875	0644	edit dl rm
pkey.html	6340	0644	edit dl rm
pkeyparam.html	3465	0644	edit dl rm
pkeyutl.html	14144	0644	edit dl rm
prime.html	2361	0644	edit dl rm
rand.html	3955	0644	edit dl rm
rehash.html	5813	0644	edit dl rm
req.html	28754	0644	edit dl rm
rsa.html	7927	0644	edit dl rm
rsautl.html	8045	0644	edit dl rm
sess_id.html	6128	0644	edit dl rm
smime.html	21223	0644	edit dl rm
speed.html	4059	0644	edit dl rm
spkac.html	5754	0644	edit dl rm
srp.html	2756	0644	edit dl rm
storeutl.html	4739	0644	edit dl rm
s_client.html	35485	0644	edit dl rm
s_server.html	33490	0644	edit dl rm
s_time.html	9726	0644	edit dl rm
ts.html	27227	0644	edit dl rm
tsget.html	8475	0644	edit dl rm
verify.html	32603	0644	edit dl rm
version.html	2398	0644	edit dl rm
x509.html	37404	0644	edit dl rm

Edit: /opt/cpanel/ea-openssl11/share/doc/openssl/html/man1/CA.pl.html (9569B)

<?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>CA.pl</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>

<ul id="index">
 <li><a href="#NAME">NAME</a></li>
 <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
 <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
 <li><a href="#OPTIONS">OPTIONS</a></li>
 <li><a href="#EXAMPLES">EXAMPLES</a></li>
 <li><a href="#DSA-CERTIFICATES">DSA CERTIFICATES</a></li>
 <li><a href="#NOTES">NOTES</a></li>
 <li><a href="#SEE-ALSO">SEE ALSO</a></li>
 <li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>

CA.pl - friendlier interface for OpenSSL certificate programs

<h1 id="SYNOPSIS">SYNOPSIS</h1>

CA.pl -? | -h | -help

CA.pl -pkcs12 [-extra-pkcs12 extra-params] [certname]

CA.pl -verify [-extra-verify extra-params] certfile...

CA.pl -revoke [-extra-ca extra-params] certfile [reason]

<h1 id="DESCRIPTION">DESCRIPTION</h1>

The CA.pl script is a perl script that supplies the relevant command line arguments to the openssl command for some common certificate operations. It is intended to simplify the process of certificate creation and management by the use of some simple options.

<h1 id="OPTIONS">OPTIONS</h1>

<dl>

Prints a usage message.

</dd>
<dt id="newcert">-newcert</dt>
<dd>

Creates a new self signed certificate. The private key is written to the file &quot;newkey.pem&quot; and the request written to the file &quot;newreq.pem&quot;. This argument invokes openssl req command.

</dd>
<dt id="newreq">-newreq</dt>
<dd>

Creates a new certificate request. The private key is written to the file &quot;newkey.pem&quot; and the request written to the file &quot;newreq.pem&quot;. Executes openssl req command below the hood.

</dd>
<dt id="newreq-nodes">-newreq-nodes</dt>
<dd>

Is like -newreq except that the private key will not be encrypted. Uses openssl req command.

</dd>
<dt id="newca">-newca</dt>
<dd>

Creates a new CA hierarchy for use with the ca program (or the -signcert and -xsign options). The user is prompted to enter the filename of the CA certificates (which should also contain the private key) or by hitting ENTER details of the CA will be prompted for. The relevant files and directories are created in a directory called &quot;demoCA&quot; in the current directory. openssl req and openssl ca commands are get invoked.

</dd>
<dt id="pkcs12">-pkcs12</dt>
<dd>

Create a PKCS#12 file containing the user certificate, private key and CA certificate. It expects the user certificate and private key to be in the file &quot;newcert.pem&quot; and the CA certificate to be in the file demoCA/cacert.pem, it creates a file &quot;newcert.p12&quot;. This command can thus be called after the -sign option. The PKCS#12 file can be imported directly into a browser. If there is an additional argument on the command line it will be used as the &quot;friendly name&quot; for the certificate (which is typically displayed in the browser list box), otherwise the name &quot;My Certificate&quot; is used. Delegates work to openssl pkcs12 command.

</dd>
<dt id="sign--signcert--xsign">-sign, -signcert, -xsign</dt>
<dd>

Calls the ca program to sign a certificate request. It expects the request to be in the file &quot;newreq.pem&quot;. The new certificate is written to the file &quot;newcert.pem&quot; except in the case of the -xsign option when it is written to standard output. Leverages openssl ca command.

</dd>
<dt id="signCA">-signCA</dt>
<dd>

This option is the same as the -sign option except it uses the configuration file section v3_ca and so makes the signed request a valid CA certificate. This is useful when creating intermediate CA from a root CA. Extra params are passed on to openssl ca command.

</dd>
<dt id="signcert">-signcert</dt>
<dd>

This option is the same as -sign except it expects a self signed certificate to be present in the file &quot;newreq.pem&quot;. Extra params are passed on to openssl x509 and openssl ca commands.

</dd>
<dt id="crl">-crl</dt>
<dd>

Generate a CRL. Executes openssl ca command.

</dd>
<dt id="revoke-certfile-reason">-revoke certfile [reason]</dt>
<dd>

Revoke the certificate contained in the specified certfile. An optional reason may be specified, and must be one of: unspecified, keyCompromise, CACompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, or removeFromCRL. Leverages openssl ca command.

</dd>
<dt id="verify">-verify</dt>
<dd>

Verifies certificates against the CA certificate for &quot;demoCA&quot;. If no certificates are specified on the command line it tries to verify the file &quot;newcert.pem&quot;. Invokes openssl verify command.

</dd>
<dt id="extra-req--extra-ca--extra-pkcs12--extra-x509--extra-verify-extra-params">-extra-req | -extra-ca | -extra-pkcs12 | -extra-x509 | -extra-verify &lt;extra-params&gt;</dt>
<dd>

The purpose of these parameters is to allow optional parameters to be supplied to openssl that this command executes. The -extra-cmd are specific to the option being used and the openssl command getting invoked. For example when this command invokes openssl req extra parameters can be passed on with the -extra-req parameter. The openssl commands being invoked per option are documented below. Users should consult openssl command documentation for more information.

</dd>
</dl>

<h1 id="EXAMPLES">EXAMPLES</h1>

Create a CA hierarchy:

<pre><code> CA.pl -newca</code></pre>

Complete certificate creation example: create a CA, create a request, sign the request and finally create a PKCS#12 file containing it.

<pre><code> CA.pl -newca
 CA.pl -newreq
 CA.pl -sign
 CA.pl -pkcs12 &quot;My Test Certificate&quot;</code></pre>

<h1 id="DSA-CERTIFICATES">DSA CERTIFICATES</h1>

Although the CA.pl creates RSA CAs and requests it is still possible to use it with DSA certificates and requests using the <a href="../man1/req.html">req(1)</a> command directly. The following example shows the steps that would typically be taken.

Create some DSA parameters:

<pre><code> openssl dsaparam -out dsap.pem 1024</code></pre>

Create a DSA CA certificate and private key:

<pre><code> openssl req -x509 -newkey dsa:dsap.pem -keyout cacert.pem -out cacert.pem</code></pre>

Create the CA directories and files:

<pre><code> CA.pl -newca</code></pre>

enter cacert.pem when prompted for the CA filename.

Create a DSA certificate request and private key (a different set of parameters can optionally be created first):

<pre><code> openssl req -out newreq.pem -newkey dsa:dsap.pem</code></pre>

Sign the request:

<h1 id="NOTES">NOTES</h1>

Most of the filenames mentioned can be modified by editing the CA.pl script.

If the demoCA directory already exists then the -newca command will not overwrite it and will do nothing. This can happen if a previous call using the -newca option terminated abnormally. To get the correct behaviour delete the demoCA directory if it already exists.

Under some environments it may not be possible to run the CA.pl script directly (for example Win32) and the default configuration file location may be wrong. In this case the command:

can be used and the OPENSSL_CONF environment variable changed to point to the correct path of the configuration file.

The script is intended as a simple front end for the openssl program for use by a beginner. Its behaviour isn&#39;t always what is wanted. For more control over the behaviour of the certificate commands call the openssl command directly.

<a href="../man1/x509.html">x509(1)</a>, <a href="../man1/ca.html">ca(1)</a>, <a href="../man1/req.html">req(1)</a>, <a href="../man1/pkcs12.html">pkcs12(1)</a>, <a href="../man5/config.html">config(5)</a>

<h1 id="COPYRIGHT">COPYRIGHT</h1>

Licensed under the OpenSSL license (the &quot;License&quot;). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.

</body>

</html>

cmd: