denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pki: Install pki(1) as utility directly in $prefix/bin

Browse Source 
ipsec pki is maintained as alias.
This commit is contained in:
Tobias Brunner
2013-09-13 15:07:36 +02:00
parent 1a8ffea315
commit 0dc8ba8779
17 changed files with 105 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+11 -11
View File
@@ -1493,17 +1493,17 @@ AC_CONFIG_FILES([
man/ipsec.secrets.5 man/ipsec.secrets.5
man/strongswan.conf.5 man/strongswan.conf.5
src/charon-cmd/charon-cmd.8 src/charon-cmd/charon-cmd.8
src/pki/man/ipsec-pki.8 src/pki/man/pki.1
src/pki/man/pki---gen.8 src/pki/man/pki---gen.1
src/pki/man/pki---issue.8 src/pki/man/pki---issue.1
src/pki/man/pki---keyid.8 src/pki/man/pki---keyid.1
src/pki/man/pki---pkcs7.8 src/pki/man/pki---pkcs7.1
src/pki/man/pki---print.8 src/pki/man/pki---print.1
src/pki/man/pki---pub.8 src/pki/man/pki---pub.1
src/pki/man/pki---req.8 src/pki/man/pki---req.1
src/pki/man/pki---self.8 src/pki/man/pki---self.1
src/pki/man/pki---signcrl.8 src/pki/man/pki---signcrl.1
src/pki/man/pki---verify.8 src/pki/man/pki---verify.1
]) ])
AC_OUTPUT AC_OUTPUT
src/ipsec/Android.mk
+1
View File
@@ -19,6 +19,7 @@ $(GEN) : PRIVATE_CUSTOM_TOOL = sed \
-e "s:@IPSEC_DISTRO@::" \ -e "s:@IPSEC_DISTRO@::" \
-e "s:@IPSEC_DIR@:$(strongswan_DIR):" \ -e "s:@IPSEC_DIR@:$(strongswan_DIR):" \
-e "s:@IPSEC_SCRIPT@:ipsec:" \ -e "s:@IPSEC_SCRIPT@:ipsec:" \
-e "s:@IPSEC_BINDIR@:$(strongswan_DIR):" \
-e "s:@IPSEC_SBINDIR@:$(strongswan_SBINDIR):" \ -e "s:@IPSEC_SBINDIR@:$(strongswan_SBINDIR):" \
-e "s:@IPSEC_CONFDIR@:$(strongswan_CONFDIR):" \ -e "s:@IPSEC_CONFDIR@:$(strongswan_CONFDIR):" \
-e "s:@IPSEC_PIDDIR@:$(strongswan_PIDDIR):" \ -e "s:@IPSEC_PIDDIR@:$(strongswan_PIDDIR):" \
src/ipsec/Makefile.am
+1
View File
@@ -20,6 +20,7 @@ _ipsec : _ipsec.in
-e "s:@IPSEC_DISTRO@::" \ -e "s:@IPSEC_DISTRO@::" \
-e "s:@IPSEC_DIR@:$(ipsecdir):" \ -e "s:@IPSEC_DIR@:$(ipsecdir):" \
-e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \ -e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \
-e "s:@IPSEC_BINDIR@:$(bindir):" \
-e "s:@IPSEC_SBINDIR@:$(sbindir):" \ -e "s:@IPSEC_SBINDIR@:$(sbindir):" \
-e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \ -e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \
-e "s:@IPSEC_PIDDIR@:$(piddir):" \ -e "s:@IPSEC_PIDDIR@:$(piddir):" \
src/ipsec/_ipsec.in
+7 -2
View File
@@ -15,7 +15,7 @@
# for more details. # for more details.
# define a minimum PATH environment in case it is not set # define a minimum PATH environment in case it is not set
PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@" PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@:@IPSEC_BINDIR@"
export PATH export PATH
# set daemon name # set daemon name
@@ -28,6 +28,7 @@ IPSEC_VERSION="U@IPSEC_VERSION@/K`uname -r`"
# where the private directory and the config files are # where the private directory and the config files are
IPSEC_DIR="@IPSEC_DIR@" IPSEC_DIR="@IPSEC_DIR@"
IPSEC_BINDIR="@IPSEC_BINDIR@"
IPSEC_SBINDIR="@IPSEC_SBINDIR@" IPSEC_SBINDIR="@IPSEC_SBINDIR@"
IPSEC_CONFDIR="@IPSEC_CONFDIR@" IPSEC_CONFDIR="@IPSEC_CONFDIR@"
IPSEC_PIDDIR="@IPSEC_PIDDIR@" IPSEC_PIDDIR="@IPSEC_PIDDIR@"
@@ -39,7 +40,7 @@ IPSEC_CHARON_PID="${IPSEC_PIDDIR}/${DAEMON_NAME}.pid"
IPSEC_STROKE="${IPSEC_DIR}/stroke" IPSEC_STROKE="${IPSEC_DIR}/stroke"
IPSEC_STARTER="${IPSEC_DIR}/starter" IPSEC_STARTER="${IPSEC_DIR}/starter"
export IPSEC_DIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID export IPSEC_DIR IPSEC_BINDIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID
IPSEC_DISTRO="Institute for Internet Technologies and Applications\nUniversity of Applied Sciences Rapperswil, Switzerland" IPSEC_DISTRO="Institute for Internet Technologies and Applications\nUniversity of Applied Sciences Rapperswil, Switzerland"
@@ -313,6 +314,10 @@ update)
exit 7 exit 7
fi fi
;; ;;
pki)
shift
exec $IPSEC_BINDIR/pki "$@"
;;
version|--version) version|--version)
printf "$OS_NAME $IPSEC_NAME $IPSEC_VERSION\n" printf "$OS_NAME $IPSEC_NAME $IPSEC_VERSION\n"
printf "$IPSEC_DISTRO\n" printf "$IPSEC_DISTRO\n"
src/pki/Makefile.am
+1 -1
View File
@@ -1,6 +1,6 @@
SUBDIRS = man SUBDIRS = man
ipsec_PROGRAMS = pki bin_PROGRAMS = pki
pki_SOURCES = pki.c pki.h command.c command.h \ pki_SOURCES = pki.c pki.h command.c command.h \
commands/gen.c \ commands/gen.c \
src/pki/man/Makefile.am
+13 -13
View File
@@ -1,14 +1,14 @@
man8_MANS = \ man1_MANS = \
ipsec-pki.8 \ pki.1 \
pki---gen.8 \ pki---gen.1 \
pki---self.8 \ pki---self.1 \
pki---issue.8 \ pki---issue.1 \
pki---signcrl.8 \ pki---signcrl.1 \
pki---req.8 \ pki---req.1 \
pki---pkcs7.8 \ pki---pkcs7.1 \
pki---keyid.8 \ pki---keyid.1 \
pki---print.8 \ pki---print.1 \
pki---pub.8 \ pki---pub.1 \
pki---verify.8 pki---verify.1
CLEANFILES = $(man8_MANS) CLEANFILES = $(man1_MANS)
src/pki/man/pki---gen.8.in → src/pki/man/pki---gen.1.in
+5 -5
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-GEN" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-GEN" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -29,7 +29,7 @@ pki \-\-gen \- Generate a new RSA or ECDSA private key
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
is used to generate a new RSA or ECDSA private key. is used to generate a new RSA or ECDSA private key.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -100,13 +100,13 @@ of lower quality.
.SH "EXAMPLES" .SH "EXAMPLES"
. .
.TP .TP
.B ipsec pki \-\-gen \-\-size 3072 > rsa_key.der .B pki \-\-gen \-\-size 3072 > rsa_key.der
Generates a 3072-bit RSA private key. Generates a 3072-bit RSA private key.
. .
.TP .TP
.B ipsec pki \-\-gen \-\-type ecdsa \-\-size 256 > ecdsa_key.der .B pki \-\-gen \-\-type ecdsa \-\-size 256 > ecdsa_key.der
Generates a 256-bit ECDSA private key. Generates a 256-bit ECDSA private key.
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---issue.8.in → src/pki/man/pki---issue.1.in
+3 -3
View File
@@ -45,7 +45,7 @@ pki \-\-issue \- Issue a certificate using a CA certificate and key
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
is used to issue a certificate using a CA certificate and private key. is used to issue a certificate using a CA certificate and private key.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -170,10 +170,10 @@ Then the following command can be used to issue a certificate based on a
given PKCS#10 certificate request and the options above: given PKCS#10 certificate request and the options above:
.PP .PP
.EX .EX
ipsec pki --issue --options pki.opt --in req.der > cert.der pki --issue --options pki.opt --in req.der > cert.der
.EE .EE
.PP .PP
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---keyid.8.in → src/pki/man/pki---keyid.1.in
+5 -5
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-KEYID" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-KEYID" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -25,7 +25,7 @@ pki \-\-keyid \- Calculate key identifiers of a key or certificate
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
calculates key identifiers of private keys and certificates. calculates key identifiers of private keys and certificates.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -53,7 +53,7 @@ request), \fIx509\fR (X.509 certificate), defaults to \fIrsa-priv\fR.
Calculate key identifiers of an RSA private key: Calculate key identifiers of an RSA private key:
.PP .PP
.EX .EX
ipsec pki --keyid --in key.der pki --keyid --in key.der
subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1... subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1...
subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1... subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1...
.EE .EE
@@ -61,7 +61,7 @@ Calculate key identifiers of an RSA private key:
Calculate key identifiers of an X.509 certificate: Calculate key identifiers of an X.509 certificate:
.PP .PP
.EX .EX
ipsec pki --keyid --in cert.der --type x509 pki --keyid --in cert.der --type x509
subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1... subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1...
subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1... subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1...
.EE .EE
@@ -69,4 +69,4 @@ Calculate key identifiers of an X.509 certificate:
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---pkcs7.8.in → src/pki/man/pki---pkcs7.1.in
+3 -3
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-PKCS7" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-PKCS7" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -27,7 +27,7 @@ pki \-\-pkcs7 \- Provides PKCS#7 wrap/unwrap functions
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
provides functions to wrap/unwrap PKCS#7 containers. provides functions to wrap/unwrap PKCS#7 containers.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -76,4 +76,4 @@ Can be used multiple times.
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---print.8.in → src/pki/man/pki---print.1.in
+3 -3
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-PRINT" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-PRINT" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -25,7 +25,7 @@ pki \-\-print \- Print a credential (key, certificate etc.) in human readable fo
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
prints credentials (keys, certificates etc.) in human readable form. prints credentials (keys, certificates etc.) in human readable form.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -50,4 +50,4 @@ private key), \fIpub\fR (public key), \fIx509\fR (X.509 certificate), \fIcrl\fR
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---pub.8.in → src/pki/man/pki---pub.1.in
+5 -5
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-PUB" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-PUB" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -28,7 +28,7 @@ pki \-\-pub \- Extract a public key from a private key or certificate
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
extracts public keys from a private keys and certificates. extracts public keys from a private keys and certificates.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -60,16 +60,16 @@ Encoding of the extracted public key. One of \fIder\fR (ASN.1 DER), \fIpem\fR
Extract the public key from an RSA private key: Extract the public key from an RSA private key:
.PP .PP
.EX .EX
ipsec pki --pub --in key.der > pub.der pki --pub --in key.der > pub.der
.EE .EE
.PP .PP
Extract the public key from an X.509 certificate: Extract the public key from an X.509 certificate:
.PP .PP
.EX .EX
ipsec pki --pub --in cert.der --type x509 > pub.der pki --pub --in cert.der --type x509 > pub.der
.EE .EE
.PP .PP
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---req.8.in → src/pki/man/pki---req.1.in
+7 -7
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-REQ" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-REQ" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -30,7 +30,7 @@ pki \-\-req \- Create a PKCS#10 certificate request
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
is used to create a PKCS#10 certificate request. is used to create a PKCS#10 certificate request.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -74,18 +74,18 @@ Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or
Generate a certificate request for an RSA key, with a subjectAltName extension: Generate a certificate request for an RSA key, with a subjectAltName extension:
.PP .PP
.EX .EX
ipsec pki \-\-req \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ pki \-\-req \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\
\-\-san [email protected] > req.der \-\-san [email protected] > req.der
.EE .EE
.PP .PP
Generate a certificate request for an ECDSA key and a different digest: Generate a certificate request for an ECDSA key and a different digest:
.PP .PP
.EX .EX
ipsec pki \-\-req \-\-in key.der \-\-type ecdsa \-\-digest sha256 \\ pki \-\-req \-\-in key.der \-\-type ecdsa \-\-digest sha256 \\
\-\-dn "C=CH, O=strongSwan, CN=carol" > req.der \-\-dn "C=CH, O=strongSwan, CN=carol" > req.der
.EE .EE
.PP .PP
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---self.8.in → src/pki/man/pki---self.1.in
+5 -5
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-SELF" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-SELF" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -44,7 +44,7 @@ pki \-\-self \- Create a self-signed certificate
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
is used to create a self-signed certificate. is used to create a self-signed certificate.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -139,10 +139,10 @@ User notice for certificatePolicy.
Generate a self-signed certificate using the given RSA key: Generate a self-signed certificate using the given RSA key:
.PP .PP
.EX .EX
ipsec pki \-\-self \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ pki \-\-self \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\
\-\-san moon.strongswan.org > cert.der \-\-san moon.strongswan.org > cert.der
.EE .EE
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---signcrl.8.in → src/pki/man/pki---signcrl.1.in
+7 -7
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-SIGNCRL" 8 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-SIGNCRL" 1 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -32,7 +32,7 @@ pki \-\-signcrl \- Issue a Certificate Revocation List (CRL) using a CA certific
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
is used to issue a Certificate Revocation List (CRL) using a CA certificate and is used to issue a Certificate Revocation List (CRL) using a CA certificate and
private key. private key.
. .
@@ -107,18 +107,18 @@ Hexadecimal encoded serial number of the certificate to revoke.
Revoke a certificate: Revoke a certificate:
.PP .PP
.EX .EX
ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\
\-\-reason superseded \-\-cert cert.der > crl.der \-\-reason superseded \-\-cert cert.der > crl.der
.EE .EE
.PP .PP
Update an existing CRL with two new revocations, using the certificate's serial Update an existing CRL with two new revocations, using the certificate's serial
number, but no reason: number, but no reason:
.PP .PP
.EX .EX
ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\
\-\-lastcrl old_crl.der \-\-serial 0123 \-\-serial 0345 > crl.der \-\-lastcrl old_crl.der \-\-serial 0123 \-\-serial 0345 > crl.der
.EE .EE
.PP .PP
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/pki---verify.8.in → src/pki/man/pki---verify.1.in
+3 -3
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-VERIFY" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-VERIFY" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -25,7 +25,7 @@ pki \-\-verify \- Verify a certificate using a CA certificate
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
This sub-command of This sub-command of
.BR ipsec\-pki (8) .BR pki (1)
verifies a certificate using an optional CA certificate. verifies a certificate using an optional CA certificate.
. .
.SH "OPTIONS" .SH "OPTIONS"
@@ -53,4 +53,4 @@ the verification failed.
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec\-pki (8) .BR pki (1)
src/pki/man/ipsec-pki.8.in → src/pki/man/pki.1.in
+25 -26
View File
@@ -1,17 +1,17 @@
.TH IPSEC\-PKI 8 "2013-07-30" "@PACKAGE_VERSION@" "strongSwan" .TH PKI 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
ipsec pki \- Simple public key infrastructure (PKI) management tool pki \- Simple public key infrastructure (PKI) management tool
. .
.SH "SYNOPSIS" .SH "SYNOPSIS"
. .
.SY "ipsec pki" .SY "pki"
.I command .I command
.RI [ option\~ .\|.\|.] .RI [ option\~ .\|.\|.]
.YS .YS
. .
.SY "ipsec pki" .SY "pki"
.B \-h .B \-h
| |
.B \-\-help .B \-\-help
@@ -19,7 +19,7 @@ ipsec pki \- Simple public key infrastructure (PKI) management tool
. .
.SH "DESCRIPTION" .SH "DESCRIPTION"
. .
.B ipsec pki .B pki
is a suite of commands that allow you to manage a simple public key is a suite of commands that allow you to manage a simple public key
infrastructure (PKI). infrastructure (PKI).
.P .P
@@ -76,7 +76,7 @@ The first step is to generate a private key using the
command. By default this generates a 2048-bit RSA key. command. By default this generates a 2048-bit RSA key.
.PP .PP
.EX .EX
ipsec pki \-\-gen > ca_key.der pki \-\-gen > ca_key.der
.EE .EE
.PP .PP
This key is used to create the self-signed CA certificate, using the This key is used to create the self-signed CA certificate, using the
@@ -84,8 +84,8 @@ This key is used to create the self-signed CA certificate, using the
command. The distinguished name should be adjusted to your needs. command. The distinguished name should be adjusted to your needs.
.PP .PP
.EX .EX
ipsec pki \-\-self \-\-ca \-\-in ca_key.der \\ pki \-\-self \-\-ca \-\-in ca_key.der \\
\-\-dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der \-\-dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der
.EE .EE
.PP .PP
. .
@@ -97,14 +97,14 @@ which in turn can issue other certificates.
To generate a certificate for a server, we start by generating a private key. To generate a certificate for a server, we start by generating a private key.
.PP .PP
.EX .EX
ipsec pki \-\-gen > server_key.der pki \-\-gen > server_key.der
.EE .EE
.PP .PP
The public key will be included in the certificate so lets extract that from the The public key will be included in the certificate so lets extract that from the
private key. private key.
.PP .PP
.EX .EX
ipsec pki \-\-pub \-\-in server_key.der > server_pub.der pki \-\-pub \-\-in server_key.der > server_pub.der
.EE .EE
.PP .PP
The following command will use the CA certificate and private key to issue the The following command will use the CA certificate and private key to issue the
@@ -114,9 +114,9 @@ and flags as needed (check
for more options). for more options).
.PP .PP
.EX .EX
ipsec pki \-\-issue \-\-in server_pub.der \-\-cacert ca_cert.der \\ pki \-\-issue \-\-in server_pub.der \-\-cacert ca_cert.der \\
\-\-cakey ca_key.der \-\-dn "C=CH, O=strongSwan, CN=VPN Server" \\ \-\-cakey ca_key.der \-\-dn "C=CH, O=strongSwan, CN=VPN Server" \\
\-\-san vpn.strongswan.org \-\-flag serverAuth > server_cert.der \-\-san vpn.strongswan.org \-\-flag serverAuth > server_cert.der
.EE .EE
.PP .PP
Instead of storing the public key in a separate Instead of storing the public key in a separate
@@ -132,8 +132,8 @@ the
command. command.
.PP .PP
.EX .EX
ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\
\-\-reason superseded \-\-cert server_cert.der > crl.der \-\-reason superseded \-\-cert server_cert.der > crl.der
.EE .EE
.PP .PP
The certificate given with \-\-cacert must be either a CA certificate or a The certificate given with \-\-cacert must be either a CA certificate or a
@@ -144,14 +144,13 @@ certificates with the \-\-crl option.
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .
.BR ipsec (8), .BR pki\ \-\-gen (1),
.BR pki\ \-\-gen (8), .BR pki\ \-\-self (1),
.BR pki\ \-\-self (8), .BR pki\ \-\-issue (1),
.BR pki\ \-\-issue (8), .BR pki\ \-\-signcrl (1),
.BR pki\ \-\-signcrl (8), .BR pki\ \-\-req (1),
.BR pki\ \-\-req (8), .BR pki\ \-\-pkcs7 (1),
.BR pki\ \-\-pkcs7 (8), .BR pki\ \-\-keyid (1),
.BR pki\ \-\-keyid (8), .BR pki\ \-\-print (1),
.BR pki\ \-\-print (8), .BR pki\ \-\-pub (1),
.BR pki\ \-\-pub (8), .BR pki\ \-\-verify (1)
.BR pki\ \-\-verify (8)