denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'man-pki'

Browse Source 
This adds man pages for all pki sub-commands and promotes pki to a
regular program installed in $prefix/bin.

The usage output of several commands was fixed too.
This commit is contained in:
Tobias Brunner
2013-09-13 15:17:04 +02:00
parent f5dcb38ead ed56c86ec1
commit d6c43847be
34 changed files with 1245 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+24
View File
@@ -1471,6 +1471,7 @@ AC_CONFIG_FILES([
src/openac/Makefile
src/scepclient/Makefile
src/pki/Makefile
src/pki/man/Makefile
src/dumm/Makefile
src/dumm/ext/extconf.rb
src/libfast/Makefile
@@ -1482,6 +1483,29 @@ AC_CONFIG_FILES([
scripts/Makefile
testing/Makefile
])
# =================
# build man pages
# =================
AC_CONFIG_FILES([
man/ipsec.conf.5
man/ipsec.secrets.5
man/strongswan.conf.5
src/charon-cmd/charon-cmd.8
src/pki/man/pki.1
src/pki/man/pki---gen.1
src/pki/man/pki---issue.1
src/pki/man/pki---keyid.1
src/pki/man/pki---pkcs7.1
src/pki/man/pki---print.1
src/pki/man/pki---pub.1
src/pki/man/pki---req.1
src/pki/man/pki---self.1
src/pki/man/pki---signcrl.1
src/pki/man/pki---verify.1
])
AC_OUTPUT
# ========================
man/.gitignore
+1 -3
View File
@@ -1,3 +1 @@
ipsec.conf.5
ipsec.secrets.5
strongswan.conf.5
*.5
man/Makefile.am
+5 -12
View File
@@ -1,13 +1,6 @@
dist_man_MANS = ipsec.conf.5 ipsec.secrets.5 strongswan.conf.5
EXTRA_DIST = ipsec.conf.5.in ipsec.secrets.5.in strongswan.conf.5.in
CLEANFILES = ipsec.conf.5 ipsec.secrets.5 strongswan.conf.5
man_MANS = \
ipsec.conf.5 \
ipsec.secrets.5 \
strongswan.conf.5
SUFFIXES = .in
.in:
$(AM_V_GEN) \
sed \
-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
-e "s:@DEV_URANDOM@:$(urandom_device):" \
-e "s:@DEV_RANDOM@:$(random_device):" \
$(srcdir)/$@.in > $@
CLEANFILES = $(man_MANS)
man/ipsec.conf.5.in
+1 -1
View File
@@ -1,4 +1,4 @@
.TH IPSEC.CONF 5 "2012-06-26" "@IPSEC_VERSION@" "strongSwan"
.TH IPSEC.CONF 5 "2012-06-26" "@PACKAGE_VERSION@" "strongSwan"
.SH NAME
ipsec.conf \- IPsec configuration and connections
.SH DESCRIPTION
man/ipsec.secrets.5.in
+1 -1
View File
@@ -1,4 +1,4 @@
.TH IPSEC.SECRETS 5 "2011-12-14" "@IPSEC_VERSION@" "strongSwan"
.TH IPSEC.SECRETS 5 "2011-12-14" "@PACKAGE_VERSION@" "strongSwan"
.SH NAME
ipsec.secrets \- secrets for IKE/IPsec authentication
.SH DESCRIPTION
man/strongswan.conf.5.in
+12 -12
View File
@@ -1,4 +1,4 @@
.TH STRONGSWAN.CONF 5 "2013-07-22" "@IPSEC_VERSION@" "strongSwan"
.TH STRONGSWAN.CONF 5 "2013-07-22" "@PACKAGE_VERSION@" "strongSwan"
.SH NAME
strongswan.conf \- strongSwan configuration file
.SH DESCRIPTION
@@ -386,7 +386,7 @@ DHCP server unicast or broadcast IP address
.BR charon.plugins.duplicheck.enable " [yes]"
Enable duplicheck plugin (if loaded)
.TP
.BR charon.plugins.duplicheck.socket " [unix://${piddir}/charon.dck]"
.BR charon.plugins.duplicheck.socket " [unix://@piddir@/charon.dck]"
Socket provided by the duplicheck plugin
.TP
.BR charon.plugins.eap-aka.request_identity " [yes]"
@@ -571,7 +571,7 @@ Start phase2 EAP TNC protocol after successful client authentication
.BR charon.plugins.eap-ttls.request_peer_auth " [no]"
Request peer authentication based on a client certificate
.TP
.BR charon.plugins.error-notify.socket " [unix://${piddir}/charon.enfy]"
.BR charon.plugins.error-notify.socket " [unix://@piddir@/charon.enfy]"
Socket provided by the error-notify plugin
.TP
.BR charon.plugins.ha.autobalance " [0]"
@@ -632,7 +632,7 @@ Time in ms to wait until virtual IP addresses appear/disappear before failing.
.BR charon.plugins.load-tester
Section to configure the load-tester plugin, see LOAD TESTS
.TP
.BR charon.plugins.lookip.socket " [unix://${piddir}/charon.lkp]"
.BR charon.plugins.lookip.socket " [unix://@piddir@/charon.lkp]"
Socket provided by the lookip plugin
.TP
.BR charon.plugins.radattr.dir
@@ -673,7 +673,7 @@ certificates even if they don't contain a CA basic constraint.
.BR charon.plugins.stroke.max_concurrent " [4]"
Maximum number of stroke messages handled concurrently
.TP
.BR charon.plugins.stroke.socket " [unix://${piddir}/charon.ctl]"
.BR charon.plugins.stroke.socket " [unix://@piddir@/charon.ctl]"
Socket provided by the stroke plugin
.TP
.BR charon.plugins.stroke.timeout " [0]"
@@ -744,7 +744,7 @@ plugins, like resolve)
.BR charon.plugins.whitelist.enable " [yes]"
Enable loaded whitelist plugin
.TP
.BR charon.plugins.whitelist.socket " [unix://${piddir}/charon.wlst]"
.BR charon.plugins.whitelist.socket " [unix://@piddir@/charon.wlst]"
Socket provided by the whitelist plugin
.TP
.BR charon.plugins.xauth-eap.backend " [radius]"
@@ -852,11 +852,11 @@ keys not stored on tokens
.BR libstrongswan.plugins.pkcs11.use_rng " [no]"
Whether the PKCS#11 modules should be used as RNG
.TP
.BR libstrongswan.plugins.random.random " [@DEV_RANDOM@]"
File to read random bytes from, instead of @DEV_RANDOM@
.BR libstrongswan.plugins.random.random " [@random_device@]"
File to read random bytes from, instead of @random_device@
.TP
.BR libstrongswan.plugins.random.urandom " [@DEV_URANDOM@]"
File to read pseudo random bytes from, instead of @DEV_URANDOM@
.BR libstrongswan.plugins.random.urandom " [@urandom_device@]"
File to read pseudo random bytes from, instead of @urandom_device@
.TP
.BR libstrongswan.plugins.unbound.resolv_conf " [/etc/resolv.conf]"
File to read DNS resolver configuration from
@@ -970,7 +970,7 @@ Send open listening ports without being prompted
.BR libimcv.plugins.imv-scanner.remediation_uri
URI pointing to scanner remediation instructions
.TP
.BR libimcv.plugins.imc-swid.swid_directory "[$(prefix)/share]"
.BR libimcv.plugins.imc-swid.swid_directory " [@prefix@/share]"
Directory where SWID tags are located
.TP
.BR libimcv.plugins.imc-test.additional_ids " [0]"
@@ -1511,7 +1511,7 @@ Request an INTERNAL_IPV4_ADDR from the server
.BR charon.plugins.load-tester.shutdown_when_complete " [no]"
Shutdown the daemon after all IKE_SAs have been established
.TP
.BR charon.plugins.load-tester.socket " [unix://${piddir}/charon.ldt]"
.BR charon.plugins.load-tester.socket " [unix://@piddir@/charon.ldt]"
Socket provided by the load-tester plugin
.TP
.BR charon.plugins.load-tester.version " [0]"
src/charon-cmd/Makefile.am
+2 -9
View File
@@ -1,7 +1,6 @@
sbin_PROGRAMS = charon-cmd
CLEANFILES = charon-cmd.8
dist_man8_MANS = charon-cmd.8
EXTRA_DIST = charon-cmd.8.in
man8_MANS = charon-cmd.8
CLEANFILES = $(man8_MANS)
charon_cmd_SOURCES = \
cmd/cmd_options.h cmd/cmd_options.c \
@@ -24,9 +23,3 @@ charon_cmd_LDADD = \
$(top_builddir)/src/libhydra/libhydra.la \
$(top_builddir)/src/libcharon/libcharon.la \
-lm $(PTHREADLIB) $(DLLIB)
charon-cmd.8 : charon-cmd.8.in
$(AM_V_GEN) \
sed \
-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
$(srcdir)/$@.in > $@
src/charon-cmd/charon-cmd.8.in
+1 -1
View File
@@ -1,4 +1,4 @@
.TH CHARON\-CMD 8 "2013-06-21" "@IPSEC_VERSION@" "strongSwan"
.TH CHARON\-CMD 8 "2013-06-21" "@PACKAGE_VERSION@" "strongSwan"
.SH "NAME"
charon\-cmd \- Simple IKE client (IPsec VPN client)
.SH SYNOPSIS
src/ipsec/Android.mk
+1
View File
@@ -19,6 +19,7 @@ $(GEN) : PRIVATE_CUSTOM_TOOL = sed \
-e "s:@IPSEC_DISTRO@::" \
-e "s:@IPSEC_DIR@:$(strongswan_DIR):" \
-e "s:@IPSEC_SCRIPT@:ipsec:" \
-e "s:@IPSEC_BINDIR@:$(strongswan_DIR):" \
-e "s:@IPSEC_SBINDIR@:$(strongswan_SBINDIR):" \
-e "s:@IPSEC_CONFDIR@:$(strongswan_CONFDIR):" \
-e "s:@IPSEC_PIDDIR@:$(strongswan_PIDDIR):" \
src/ipsec/Makefile.am
+1
View File
@@ -20,6 +20,7 @@ _ipsec : _ipsec.in
-e "s:@IPSEC_DISTRO@::" \
-e "s:@IPSEC_DIR@:$(ipsecdir):" \
-e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \
-e "s:@IPSEC_BINDIR@:$(bindir):" \
-e "s:@IPSEC_SBINDIR@:$(sbindir):" \
-e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \
-e "s:@IPSEC_PIDDIR@:$(piddir):" \
src/ipsec/_ipsec.in
+7 -2
View File
@@ -15,7 +15,7 @@
# for more details.
# define a minimum PATH environment in case it is not set
PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@"
PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@:@IPSEC_BINDIR@"
export PATH
# set daemon name
@@ -28,6 +28,7 @@ IPSEC_VERSION="U@IPSEC_VERSION@/K`uname -r`"
# where the private directory and the config files are
IPSEC_DIR="@IPSEC_DIR@"
IPSEC_BINDIR="@IPSEC_BINDIR@"
IPSEC_SBINDIR="@IPSEC_SBINDIR@"
IPSEC_CONFDIR="@IPSEC_CONFDIR@"
IPSEC_PIDDIR="@IPSEC_PIDDIR@"
@@ -39,7 +40,7 @@ IPSEC_CHARON_PID="${IPSEC_PIDDIR}/${DAEMON_NAME}.pid"
IPSEC_STROKE="${IPSEC_DIR}/stroke"
IPSEC_STARTER="${IPSEC_DIR}/starter"
export IPSEC_DIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID
export IPSEC_DIR IPSEC_BINDIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID
IPSEC_DISTRO="Institute for Internet Technologies and Applications\nUniversity of Applied Sciences Rapperswil, Switzerland"
@@ -313,6 +314,10 @@ update)
exit 7
fi
;;
pki)
shift
exec $IPSEC_BINDIR/pki "$@"
;;
version|--version)
printf "$OS_NAME $IPSEC_NAME $IPSEC_VERSION\n"
printf "$IPSEC_DISTRO\n"
src/pki/Makefile.am
+3 -1
View File
@@ -1,4 +1,6 @@
ipsec_PROGRAMS = pki
SUBDIRS = man
bin_PROGRAMS = pki
pki_SOURCES = pki.c pki.h command.c command.h \
commands/gen.c \
src/pki/command.c
+1 -1
View File
@@ -258,6 +258,6 @@ int command_dispatch(int c, char *v[])
return cmds[i].call();
}
}
return command_usage("invalid operation");
return command_usage(c > 1 ? "invalid operation" : NULL);
}
src/pki/commands/gen.c
+2 -2
View File
@@ -151,7 +151,7 @@ static void __attribute__ ((constructor))reg()
command_register((command_t) {
gen, 'g', "gen", "generate a new private key",
{" [--type rsa|ecdsa] [--size bits] [--safe-primes]",
"[--shares n] [--threshold l] [--outform der|pem|pgp]"},
"[--shares n] [--threshold l] [--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
{"type", 't', 1, "type of key, default: rsa"},
@@ -159,7 +159,7 @@ static void __attribute__ ((constructor))reg()
{"safe-primes", 'p', 0, "generate rsa safe primes"},
{"shares", 'n', 1, "number of private rsa key shares"},
{"threshold", 'l', 1, "minimum number of participating rsa key shares"},
{"outform", 'f', 1, "encoding of generated private key"},
{"outform", 'f', 1, "encoding of generated private key, default: der"},
}
});
}
src/pki/commands/issue.c
+6 -6
View File
@@ -514,14 +514,14 @@ static void __attribute__ ((constructor))reg()
command_register((command_t) {
issue, 'i', "issue",
"issue a certificate using a CA certificate and key",
{"[--in file] [--type pub|pkcs10] --cakey file | --cakeyid hex",
{"[--in file] [--type pub|pkcs10] --cakey file|--cakeyid hex",
" --cacert file [--dn subject-dn] [--san subjectAltName]+",
"[--lifetime days] [--serial hex] [--crl uri [--crlissuer i] ]+ [--ocsp uri]+",
"[--ca] [--pathlen len] [--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
"[--nc-permitted name] [--nc-excluded name]",
"[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+",
"[--policy-map issuer-oid:subject-oid]",
"[--lifetime days] [--serial hex] [--ca] [--pathlen len]",
"[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
"[--crl uri [--crlissuer i]]+ [--ocsp uri]+ [--nc-permitted name]",
"[--nc-excluded name] [--policy-mapping issuer-oid:subject-oid]",
"[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
"[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
"[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
src/pki/commands/pkcs7.c
+4 -4
View File
@@ -445,8 +445,8 @@ static void __attribute__ ((constructor))reg()
{
command_register((command_t) {
pkcs7, '7', "pkcs7", "PKCS#7 wrap/unwrap functions",
{"--sign | --verify | --encrypt | --decrypt",
"--certificate+ [--key]"},
{"--sign|--verify|--encrypt|--decrypt|--show",
"[--in file] [--cert file]+ [--key file]"},
{
{"help", 'h', 0, "show usage information"},
{"sign", 's', 0, "create PKCS#7 signed-data"},
@@ -455,8 +455,8 @@ static void __attribute__ ((constructor))reg()
{"decrypt", 'd', 0, "decrypt PKCS#7 enveloped-data"},
{"show", 'p', 0, "show info about PKCS#7, print certificates"},
{"in", 'i', 1, "input file, default: stdin"},
{"key", 'k', 1, "path to private key for sign/decryp"},
{"cert", 'c', 1, "path to certificate for sign/verify/encryp"},
{"key", 'k', 1, "path to private key for sign/decrypt"},
{"cert", 'c', 1, "path to certificate for sign/verify/encrypt"},
}
});
}
src/pki/commands/pub.c
+2 -2
View File
@@ -158,13 +158,13 @@ static void __attribute__ ((constructor))reg()
pub, 'p', "pub",
"extract the public key from a private key/certificate",
{"[--in file|--keyid hex] [--type rsa|ecdsa|pkcs10|x509]",
"[--outform der|pem|pgp|dnskey]"},
"[--outform der|pem|dnskey]"},
{
{"help", 'h', 0, "show usage information"},
{"in", 'i', 1, "input file, default: stdin"},
{"keyid", 'x', 1, "keyid on smartcard of private key"},
{"type", 't', 1, "type of credential, default: rsa"},
{"outform", 'f', 1, "encoding of extracted public key"},
{"outform", 'f', 1, "encoding of extracted public key, default: der"},
}
});
}
src/pki/commands/req.c
+2 -3
View File
@@ -174,9 +174,8 @@ static void __attribute__ ((constructor))reg()
command_register((command_t) {
req, 'r', "req",
"create a PKCS#10 certificate request",
{"[--in file] [--type rsa|ecdsa]",
" --dn distinguished-name [--san subjectAltName]+",
"[--password challengePassword]",
{" [--in file] [--type rsa|ecdsa] --dn distinguished-name",
"[--san subjectAltName]+ [--password challengePassword]",
"[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
src/pki/commands/self.c
+2 -2
View File
@@ -378,14 +378,14 @@ static void __attribute__ ((constructor))reg()
command_register((command_t) {
self, 's', "self",
"create a self signed certificate",
{"[--in file | --keyid hex] [--type rsa|ecdsa]",
{" [--in file|--keyid hex] [--type rsa|ecdsa]",
" --dn distinguished-name [--san subjectAltName]+",
"[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
"[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
"[--nc-permitted name] [--nc-excluded name]",
"[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+",
"[--policy-map issuer-oid:subject-oid]",
"[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
"[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
"[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
src/pki/commands/signcrl.c
+6 -6
View File
@@ -429,13 +429,13 @@ static void __attribute__ ((constructor))reg()
command_register((command_t) {
sign_crl, 'c', "signcrl",
"issue a CRL using a CA certificate and key",
{"--cacert file --cakey file | --cakeyid hex --lifetime days",
"[--lastcrl crl] [--basecrl crl] [--crluri uri ]+",
"[ [--reason key-compromise|ca-compromise|affiliation-changed|",
{"--cacert file --cakey file|--cakeyid hex [--lifetime days]",
" [--lastcrl crl] [--basecrl crl] [--crluri uri]+",
" [[--reason key-compromise|ca-compromise|affiliation-changed|",
" superseded|cessation-of-operation|certificate-hold]",
" [--date timestamp]",
" --cert file | --serial hex ]*",
"[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
" [--date timestamp] --cert file|--serial hex]*",
" [--digest md5|sha1|sha224|sha256|sha384|sha512]",
" [--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
{"cacert", 'c', 1, "CA certificate file"},
src/pki/commands/verify.c
+1 -2
View File
@@ -125,7 +125,7 @@ static void __attribute__ ((constructor))reg()
command_register((command_t) {
verify, 'v', "verify",
"verify a certificate using the CA certificate",
{"[--in file] [--ca file]"},
{"[--in file] [--cacert file]"},
{
{"help", 'h', 0, "show usage information"},
{"in", 'i', 1, "X.509 certificate to verify, default: stdin"},
@@ -133,4 +133,3 @@ static void __attribute__ ((constructor))reg()
}
});
}
src/pki/man/.gitignore
+1
View File
@@ -0,0 +1 @@
*.8
src/pki/man/Makefile.am
+14
View File
@@ -0,0 +1,14 @@
man1_MANS = \
pki.1 \
pki---gen.1 \
pki---self.1 \
pki---issue.1 \
pki---signcrl.1 \
pki---req.1 \
pki---pkcs7.1 \
pki---keyid.1 \
pki---print.1 \
pki---pub.1 \
pki---verify.1
CLEANFILES = $(man1_MANS)
src/pki/man/pki---gen.1.in
+112
View File
@@ -0,0 +1,112 @@
.TH "PKI \-\-GEN" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-gen \- Generate a new RSA or ECDSA private key
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-gen
.OP \-\-type type
.OP \-\-size bits
.OP \-\-safe\-primes
.OP \-\-shares n
.OP \-\-threshold l
.OP \-\-outform encoding
.OP \-\-debug level
.YS
.
.SY pki\ \-\-gen
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-gen"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
is used to generate a new RSA or ECDSA private key.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-t, \-\-type " type
Type of key to generate. Either \fIrsa\fR or \fIecdsa\fR, defaults to \fIrsa\fR.
.TP
.BI "\-s, \-\-size " bits
Key length in bits. Defaults to 2048 for \fIrsa\fR and 384 for \fIecdsa\fR.
For \fIecdsa\fR only three values are currently supported: 256, 384 and 521.
.TP
.BI "\-p, \-\-safe\-primes"
Generate RSA safe primes.
.TP
.BI "\-f, \-\-outform " encoding
Encoding of the generated private key. Either \fIder\fR (ASN.1 DER) or \fIpem\fR
(Base64 PEM), defaults
to \fIder\fR.
.PP
.SS "RSA Threshold Cryptography"
.TP
.BI "\-n, \-\-shares " <n>
Number of private RSA key shares.
.TP
.BI "\-l, \-\-threshold " <l>
Minimum number of participating RSA key shares.
.
.SH "PROBLEMS ON HOSTS WITH LOW ENTROPY"
.
If the
.I gmp
plugin is used to generate RSA private keys the key material is read from
.I /dev/random
(via the
.I random
plugin). Therefore, the command may block if the system's entropy pool is empty.
To avoid this, either use a hardware random number generator to feed
.I /dev/random
or use OpenSSL (via the
.I openssl
plugin or the command line) which is not as strict in regards to the quality of
the key material (it reads from
.I /dev/urandom
if necessary). It is also possible to configure the devices used by the
.I random
plugin in
.BR strongswan.conf (5).
Setting
.B libstrongswan.plugins.random.random
to
.I /dev/urandom
forces the plugin to treat bytes read from
.I /dev/urandom
as high grade random data, thus avoiding the blocking. Of
course, this doesn't change the fact that the key material generated this way is
of lower quality.
.
.SH "EXAMPLES"
.
.TP
.B pki \-\-gen \-\-size 3072 > rsa_key.der
Generates a 3072-bit RSA private key.
.
.TP
.B pki \-\-gen \-\-type ecdsa \-\-size 256 > ecdsa_key.der
Generates a 256-bit ECDSA private key.
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---issue.1.in
+179
View File
@@ -0,0 +1,179 @@
.TH "PKI \-\-ISSUE" 8 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-issue \- Issue a certificate using a CA certificate and key
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-issue
.OP \-\-in file
.OP \-\-type type
.BI \-\-cakey\~ file |\-\-cakeyid\~ hex
.BI \-\-cacert\~ file
.OP \-\-dn subject-dn
.OP \-\-san subjectAltName
.OP \-\-lifetime days
.OP \-\-serial hex
.OP \-\-flag flag
.OP \-\-digest digest
.OP \-\-ca
.OP \-\-crl uri\ \fR[\fB\-\-crlissuer\ \fIissuer\fR]
.OP \-\-ocsp uri
.OP \-\-pathlen len
.OP \-\-nc-permitted name
.OP \-\-nc-excluded name
.OP \-\-policy\-mapping mapping
.OP \-\-policy\-explicit len
.OP \-\-policy\-inhibit len
.OP \-\-policy\-any len
.OP \-\-cert\-policy oid\ \fR[\fB\-\-cps\-uri\ \fIuri\fR]\ \fR[\fB\-\-user\-notice\ \fItext\fR]
.OP \-\-outform encoding
.OP \-\-debug level
.YS
.
.SY pki\ \-\-issue
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-issue"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
is used to issue a certificate using a CA certificate and private key.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-i, \-\-in " file
Public key or PKCS#10 certificate request file to issue. If not given the
key/request is read from \fISTDIN\fR.
.TP
.BI "\-t, \-\-type " type
Type of the input. Either \fIpub\fR for a public key, or \fIpkcs10\fR for a
PKCS#10 certificate request, defaults to \fIpub\fR.
.TP
.BI "\-k, \-\-cakey " file
CA private key file. Either this or
.B \-\-cakeyid
is required.
.TP
.BI "\-x, \-\-cakeyid " hex
Key ID of a CA private key on a smartcard. Either this or
.B \-\-cakey
is required.
.TP
.BI "\-c, \-\-cacert " file
CA certificate file. Required.
.TP
.BI "\-d, \-\-dn " subject-dn
Subject distinguished name (DN) of the issued certificate.
.TP
.BI "\-a, \-\-san " subjectAltName
subjectAltName extension to include in certificate. Can be used multiple times.
.TP
.BI "\-l, \-\-lifetime " days
Days the certificate is valid, default: 1095.
.TP
.BI "\-s, \-\-serial " hex
Serial number in hex. It is randomly allocated by default.
.TP
.BI "\-e, \-\-flag " flag
Add extendedKeyUsage flag. One of \fIserverAuth\fR, \fIclientAuth\fR,
\fIcrlSign\fR, or \fIocspSigning\fR. Can be used multiple times.
.TP
.BI "\-g, \-\-digest " digest
Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
\fIsha1\fR.
.TP
.BI "\-f, \-\-outform " encoding
Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or
\fIpem\fR (Base64 PEM), defaults to \fIder\fR.
.TP
.BI "\-b, \-\-ca"
Include CA basicConstraint extension in certificate.
.TP
.BI "\-u, \-\-crl " uri
CRL distribution point URI to include in certificate. Can be used multiple
times.
.TP
.BI "\-I, \-\-crlissuer " issuer
Optional CRL issuer for the CRL at the preceding distribution point.
.TP
.BI "\-o, \-\-ocsp " uri
OCSP AuthorityInfoAccess URI to include in certificate. Can be used multiple
times.
.TP
.BI "\-p, \-\-pathlen " len
Set path length constraint.
.TP
.BI "\-n, \-\-nc-permitted " name
Add permitted NameConstraint extension to certificate.
.TP
.BI "\-N, \-\-nc-excluded " name
Add excluded NameConstraint extension to certificate.
.TP
.BI "\-M, \-\-policy-mapping " issuer-oid:subject-oid
Add policyMapping from issuer to subject OID.
.TP
.BI "\-E, \-\-policy-explicit " len
Add requireExplicitPolicy constraint.
.TP
.BI "\-H, \-\-policy-inhibit " len
Add inhibitPolicyMapping constraint.
.TP
.BI "\-A, \-\-policy-any " len
Add inhibitAnyPolicy constraint.
.PP
.SS "Certificate Policy"
Multiple certificatePolicy extensions can be added. Each with the following
information:
.TP
.BI "\-P, \-\-cert-policy " oid
OID to include in certificatePolicy extension. Required.
.TP
.BI "\-C, \-\-cps-uri " uri
Certification Practice statement URI for certificatePolicy.
.TP
.BI "\-U, \-\-user-notice " text
User notice for certificatePolicy.
.
.SH "EXAMPLES"
.
To save repetitive typing, command line options can be stored in files.
Lets assume
.I pki.opt
contains the following contents:
.PP
.EX
--cacert ca_cert.der --cakey ca_key.der --digest sha256
--flag serverAuth --lifetime 1460 --type pkcs10
.EE
.PP
Then the following command can be used to issue a certificate based on a
given PKCS#10 certificate request and the options above:
.PP
.EX
pki --issue --options pki.opt --in req.der > cert.der
.EE
.PP
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---keyid.1.in
+72
View File
@@ -0,0 +1,72 @@
.TH "PKI \-\-KEYID" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-keyid \- Calculate key identifiers of a key or certificate
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-keyid
.OP \-\-in file
.OP \-\-type type
.OP \-\-debug level
.YS
.
.SY pki\ \-\-keyid
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-keyid"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
calculates key identifiers of private keys and certificates.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-i, \-\-in " file
Input file. If not given the input is read from \fISTDIN\fR.
.TP
.BI "\-t, \-\-type " type
Type of input. One of \fIrsa-priv\fR (RSA private key), \fIecdsa-priv\fR (ECDSA
private key), \fIpub\fR (public key), \fIpkcs10\fR (PKCS#10 certificate
request), \fIx509\fR (X.509 certificate), defaults to \fIrsa-priv\fR.
.
.SH "EXAMPLES"
.
Calculate key identifiers of an RSA private key:
.PP
.EX
pki --keyid --in key.der
subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1...
subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1...
.EE
.PP
Calculate key identifiers of an X.509 certificate:
.PP
.EX
pki --keyid --in cert.der --type x509
subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1...
subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1...
.EE
.PP
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---pkcs7.1.in
+79
View File
@@ -0,0 +1,79 @@
.TH "PKI \-\-PKCS7" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-pkcs7 \- Provides PKCS#7 wrap/unwrap functions
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-pkcs7
.BR \-\-sign | \-\-verify | \-\-encrypt | \-\-decrypt | \-\-show
.OP \-\-in file
.OP \-\-cert file
.OP \-\-key file
.OP \-\-debug level
.YS
.
.SY pki\ \-\-pkcs7
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-pkcs7"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
provides functions to wrap/unwrap PKCS#7 containers.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-s, \-\-sign"
Create PKCS#7 signed-data.
.TP
.BI "\-u, \-\-verify"
Verify PKCS#7 signed-data.
.TP
.BI "\-e, \-\-encrypt"
Create PKCS#7 enveloped-data.
.TP
.BI "\-e, \-\-decrypt"
Decrypt PKCS#7 enveloped-data.
.TP
.BI "\-p, \-\-show"
Show information about PKCS#7 container, list certificates.
.TP
.BI "\-i, \-\-in " file
PKCS#7 input file. If not given the input is read from \fISTDIN\fR.
.TP
.BI "\-k, \-\-key " file
Private key used for
.B \-\-sign
and
.BR \-\-decrypt.
.TP
.BI "\-c, \-\-cert " file
Certificate for
.BR \-\-sign ,
.B \-\-verify
and
.BR \-\-encrypt.
Can be used multiple times.
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---print.1.in
+53
View File
@@ -0,0 +1,53 @@
.TH "PKI \-\-PRINT" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-print \- Print a credential (key, certificate etc.) in human readable form
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-print
.OP \-\-in file
.OP \-\-type type
.OP \-\-debug level
.YS
.
.SY pki\ \-\-print
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-print"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
prints credentials (keys, certificates etc.) in human readable form.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-i, \-\-in " file
Input file. If not given the input is read from \fISTDIN\fR.
.TP
.BI "\-t, \-\-type " type
Type of input. One of \fIrsa-priv\fR (RSA private key), \fIecdsa-priv\fR (ECDSA
private key), \fIpub\fR (public key), \fIx509\fR (X.509 certificate), \fIcrl\fR
(Certificate Revocation List, CRL), defaults to \fIx509\fR.
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---pub.1.in
+75
View File
@@ -0,0 +1,75 @@
.TH "PKI \-\-PUB" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-pub \- Extract a public key from a private key or certificate
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-pub
.RB [ \-\-in
.IR file | \fB\-\-keyid\fR
.IR hex ]
.OP \-\-type type
.OP \-\-outform encoding
.OP \-\-debug level
.YS
.
.SY pki\ \-\-pub
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-pub"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
extracts public keys from a private keys and certificates.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-i, \-\-in " file
Input file. If not given the input is read from \fISTDIN\fR.
.TP
.BI "\-t, \-\-type " type
Type of input. One of \fIrsa\fR (RSA private key), \fIecdsa\fR (ECDSA
private key), \fIpkcs10\fR (PKCS#10 certificate request), \fIx509\fR (X.509
certificate), defaults to \fIrsa\fR.
.TP
.BI "\-f, \-\-outform " encoding
Encoding of the extracted public key. One of \fIder\fR (ASN.1 DER), \fIpem\fR
(Base64 PEM), or \fIdnskey\fR (RFC 3110 DNS key), defaults to \fIder\fR.
.
.SH "EXAMPLES"
.
Extract the public key from an RSA private key:
.PP
.EX
pki --pub --in key.der > pub.der
.EE
.PP
Extract the public key from an X.509 certificate:
.PP
.EX
pki --pub --in cert.der --type x509 > pub.der
.EE
.PP
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---req.1.in
+91
View File
@@ -0,0 +1,91 @@
.TH "PKI \-\-REQ" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-req \- Create a PKCS#10 certificate request
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-req
.OP \-\-in file
.OP \-\-type type
.BI \-\-dn\~ distinguished-name
.OP \-\-san subjectAltName
.OP \-\-password password
.OP \-\-digest digest
.OP \-\-outform encoding
.OP \-\-debug level
.YS
.
.SY pki\ \-\-req
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-req"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
is used to create a PKCS#10 certificate request.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-i, \-\-in " file
Private key input file. If not given the key is read from \fISTDIN\fR.
.TP
.BI "\-t, \-\-type " type
Type of the input key. Either \fIrsa\fR or \fIecdsa\fR, defaults to \fIrsa\fR.
.TP
.BI "\-d, \-\-dn " distinguished-name
Subject distinguished name (DN). Required.
.TP
.BI "\-a, \-\-san " subjectAltName
subjectAltName extension to include in request. Can be used multiple times.
.TP
.BI "\-p, \-\-password " password
The challengePassword to include in the certificate request.
.TP
.BI "\-g, \-\-digest " digest
Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
\fIsha1\fR.
.TP
.BI "\-f, \-\-outform " encoding
Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or
\fIpem\fR (Base64 PEM), defaults to \fIder\fR.
.
.SH "EXAMPLES"
.
Generate a certificate request for an RSA key, with a subjectAltName extension:
.PP
.EX
pki \-\-req \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\
\-\-san [email protected] > req.der
.EE
.PP
Generate a certificate request for an ECDSA key and a different digest:
.PP
.EX
pki \-\-req \-\-in key.der \-\-type ecdsa \-\-digest sha256 \\
\-\-dn "C=CH, O=strongSwan, CN=carol" > req.der
.EE
.PP
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---self.1.in
+148
View File
@@ -0,0 +1,148 @@
.TH "PKI \-\-SELF" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-self \- Create a self-signed certificate
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-self
.RB [ \-\-in
.IR file | \fB\-\-keyid\fR
.IR hex ]
.OP \-\-type t
.BI \-\-dn\~ distinguished-name
.OP \-\-san subjectAltName
.OP \-\-lifetime days
.OP \-\-serial hex
.OP \-\-flag flag
.OP \-\-digest digest
.OP \-\-ca
.OP \-\-ocsp uri
.OP \-\-pathlen len
.OP \-\-nc-permitted name
.OP \-\-nc-excluded name
.OP \-\-policy\-mapping mapping
.OP \-\-policy\-explicit len
.OP \-\-policy\-inhibit len
.OP \-\-policy\-any len
.OP \-\-cert\-policy oid\ \fR[\fB\-\-cps\-uri\ \fIuri\fR]\ \fR[\fB\-\-user\-notice\ \fItext\fR]
.OP \-\-outform encoding
.OP \-\-debug level
.YS
.
.SY pki\ \-\-self
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-self"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
is used to create a self-signed certificate.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-i, \-\-in " file
Private key input file. If not given the key is read from \fISTDIN\fR.
.TP
.BI "\-x, \-\-keyid " hex
Key ID of a private key on a smartcard.
.TP
.BI "\-t, \-\-type " type
Type of the input key. Either \fIrsa\fR or \fIecdsa\fR, defaults to \fIrsa\fR.
.TP
.BI "\-d, \-\-dn " distinguished-name
Subject and issuer distinguished name (DN). Required.
.TP
.BI "\-a, \-\-san " subjectAltName
subjectAltName extension to include in certificate. Can be used multiple times.
.TP
.BI "\-l, \-\-lifetime " days
Days the certificate is valid, default: 1095.
.TP
.BI "\-s, \-\-serial " hex
Serial number in hex. It is randomly allocated by default.
.TP
.BI "\-e, \-\-flag " flag
Add extendedKeyUsage flag. One of \fIserverAuth\fR, \fIclientAuth\fR,
\fIcrlSign\fR, or \fIocspSigning\fR. Can be used multiple times.
.TP
.BI "\-g, \-\-digest " digest
Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
\fIsha1\fR.
.TP
.BI "\-f, \-\-outform " encoding
Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or
\fIpem\fR (Base64 PEM), defaults to \fIder\fR.
.TP
.BI "\-b, \-\-ca"
Include CA basicConstraint extension in certificate.
.TP
.BI "\-o, \-\-ocsp " uri
OCSP AuthorityInfoAccess URI to include in certificate. Can be used multiple
times.
.TP
.BI "\-p, \-\-pathlen " len
Set path length constraint.
.TP
.BI "\-n, \-\-nc-permitted " name
Add permitted NameConstraint extension to certificate.
.TP
.BI "\-N, \-\-nc-excluded " name
Add excluded NameConstraint extension to certificate.
.TP
.BI "\-M, \-\-policy-mapping " issuer-oid:subject-oid
Add policyMapping from issuer to subject OID.
.TP
.BI "\-E, \-\-policy-explicit " len
Add requireExplicitPolicy constraint.
.TP
.BI "\-H, \-\-policy-inhibit " len
Add inhibitPolicyMapping constraint.
.TP
.BI "\-A, \-\-policy-any " len
Add inhibitAnyPolicy constraint.
.PP
.SS "Certificate Policy"
Multiple certificatePolicy extensions can be added. Each with the following
information:
.TP
.BI "\-P, \-\-cert-policy " oid
OID to include in certificatePolicy extension. Required.
.TP
.BI "\-C, \-\-cps-uri " uri
Certification Practice statement URI for certificatePolicy.
.TP
.BI "\-U, \-\-user-notice " text
User notice for certificatePolicy.
.
.SH "EXAMPLES"
.
Generate a self-signed certificate using the given RSA key:
.PP
.EX
pki \-\-self \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\
\-\-san moon.strongswan.org > cert.der
.EE
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---signcrl.1.in
+124
View File
@@ -0,0 +1,124 @@
.TH "PKI \-\-SIGNCRL" 1 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-signcrl \- Issue a Certificate Revocation List (CRL) using a CA certificate and key
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-signcrl
.BI \-\-cakey\~ file |\-\-cakeyid\~ hex
.BI \-\-cacert\~ file
.OP \-\-lifetime days
.OP \-\-lastcrl crl
.OP \-\-basecrl crl
.OP \-\-crluri uri
.OP \-\-digest digest
.OP \fR[\fB\-\-reason\ \fIreason\fR]\ \fR[\fB\-\-date\ \fIts\fR]\ \fB\-\-cert\ \fIfile\fB|\-\-serial\ \fIhex\fR
.OP \-\-outform encoding
.OP \-\-debug level
.YS
.
.SY pki\ \-\-signcrl
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-signcrl"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
is used to issue a Certificate Revocation List (CRL) using a CA certificate and
private key.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-k, \-\-cakey " file
CA private key file. Either this or
.B \-\-cakeyid
is required.
.TP
.BI "\-x, \-\-cakeyid " hex
Key ID of a CA private key on a smartcard. Either this or
.B \-\-cakey
is required.
.TP
.BI "\-c, \-\-cacert " file
CA certificate file. Required.
.TP
.BI "\-l, \-\-lifetime " days
Days until the CRL gets a nextUpdate, default: 15.
.TP
.BI "\-a, \-\-lastcrl " crl
CRL of lastUpdate to copy revocations from.
.TP
.BI "\-b, \-\-basecrl " crl
Base CRL to create a delta CRL for.
.TP
.BI "\-u, \-\-crluri " uri
Freshest delta CRL URI to include in CRL. Can be used multiple times.
.TP
.BI "\-g, \-\-digest " digest
Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
\fIsha1\fR.
.TP
.BI "\-f, \-\-outform " encoding
Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or
\fIpem\fR (Base64 PEM), defaults to \fIder\fR.
.PP
.SS "Revoked Certificates"
Multiple revoked certificates can be added to the CRL by either providing the
certificate file or the respective serial number directly.
A reason and a timestamp can be configured for each revocation (they have to be
given before each certificate/serial on the command line).
.TP
.BI "\-r, \-\-reason " reason
The reason why the certificate was revoked. One of \fIkey\-compromise\fR,
\fIca\-compromise\fR, \fIaffiliation\-changed\fR, \fIsuperseded\fR,
\fIcessation\-of\-operation\fR, or \fIcertificate\-hold\fR.
.TP
.BI "\-d, \-\-date " ts
Revocation date as Unix timestamp. Defaults to the current time.
.TP
.BI "\-z, \-\-cert " file
Certificate file to revoke.
.TP
.BI "\-s, \-\-serial " hex
Hexadecimal encoded serial number of the certificate to revoke.
.
.SH "EXAMPLES"
.
Revoke a certificate:
.PP
.EX
pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\
\-\-reason superseded \-\-cert cert.der > crl.der
.EE
.PP
Update an existing CRL with two new revocations, using the certificate's serial
number, but no reason:
.PP
.EX
pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\
\-\-lastcrl old_crl.der \-\-serial 0123 \-\-serial 0345 > crl.der
.EE
.PP
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki---verify.1.in
+56
View File
@@ -0,0 +1,56 @@
.TH "PKI \-\-VERIFY" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \-\-verify \- Verify a certificate using a CA certificate
.
.SH "SYNOPSIS"
.
.SY pki\ \-\-verify
.OP \-\-in file
.OP \-\-cacert file
.OP \-\-debug level
.YS
.
.SY pki\ \-\-verify
.BI \-\-options\~ file
.YS
.
.SY "pki \-\-verify"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
This sub-command of
.BR pki (1)
verifies a certificate using an optional CA certificate.
.
.SH "OPTIONS"
.
.TP
.B "\-h, \-\-help"
Print usage information with a summary of the available options.
.TP
.BI "\-v, \-\-debug " level
Set debug level, default: 1.
.TP
.BI "\-+, \-\-options " file
Read command line options from \fIfile\fR.
.TP
.BI "\-i, \-\-in " file
X.509 certificate to verify. If not given it is read from \fISTDIN\fR.
.TP
.BI "\-c, \-\-cacert " file
CA certificate to use. If not given the certificate is assumed to be
self-signed.
.
.SH "EXIT STATUS"
The exit status is 0 if the certificate was verified successfully, and 2 if
the verification failed.
.
.SH "SEE ALSO"
.
.BR pki (1)
src/pki/man/pki.1.in
+156
View File
@@ -0,0 +1,156 @@
.TH PKI 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
pki \- Simple public key infrastructure (PKI) management tool
.
.SH "SYNOPSIS"
.
.SY "pki"
.I command
.RI [ option\~ .\|.\|.]
.YS
.
.SY "pki"
.B \-h
|
.B \-\-help
.YS
.
.SH "DESCRIPTION"
.
.B pki
is a suite of commands that allow you to manage a simple public key
infrastructure (PKI).
.P
Generate RSA and ECDSA key pairs, create PKCS#10 certificate requests
containing subjectAltNames, create X.509 self-signed end-entity and root CA
certificates, issue end-entity and intermediate CA certificates signed by the
private key of a CA and containing subjectAltNames, CRL distribution points
and URIs of OCSP servers. You can also extract raw public keys from private
keys, certificate requests and certificates and compute two kinds of SHA-1-based
key IDs.
.
.SH "COMMANDS"
.
.TP
.B "\-h, \-\-help"
Prints usage information and a short summary of the available commands.
.TP
.B "\-g, \-\-gen"
Generate a new private key.
.TP
.B "\-s, \-\-self"
Create a self-signed certificate.
.TP
.B "\-i, \-\-issue"
Issue a certificate using a CA certificate and key.
.TP
.B "\-c, \-\-signcrl"
Issue a CRL using a CA certificate and key.
.TP
.B "\-r, \-\-req"
Create a PKCS#10 certificate request.
.TP
.B "\-7, \-\-pkcs7"
Provides PKCS#7 wrap/unwrap functions.
.TP
.B "\-k, \-\-keyid"
Calculate key identifiers of a key or certificate.
.TP
.B "\-a, \-\-print"
Print a credential (key, certificate etc.) in human readable form.
.TP
.B "\-p, \-\-pub"
Extract a public key from a private key or certificate.
.TP
.B "\-v, \-\-verify"
Verify a certificate using a CA certificate.
.
.SH "EXAMPLES"
.
.SS "Generating a CA Certificate"
.
The first step is to generate a private key using the
.B \-\-gen
command. By default this generates a 2048-bit RSA key.
.PP
.EX
pki \-\-gen > ca_key.der
.EE
.PP
This key is used to create the self-signed CA certificate, using the
.B \-\-self
command. The distinguished name should be adjusted to your needs.
.PP
.EX
pki \-\-self \-\-ca \-\-in ca_key.der \\
\-\-dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der
.EE
.PP
.
.SS "Generating End-Entity Certificates"
.
With the root CA certificate and key at hand end-entity certificates for clients
and servers can be issued. Similarly intermediate CA certificates can be issued,
which in turn can issue other certificates.
To generate a certificate for a server, we start by generating a private key.
.PP
.EX
pki \-\-gen > server_key.der
.EE
.PP
The public key will be included in the certificate so lets extract that from the
private key.
.PP
.EX
pki \-\-pub \-\-in server_key.der > server_pub.der
.EE
.PP
The following command will use the CA certificate and private key to issue the
certificate for this server. Adjust the distinguished name, subjectAltName(s)
and flags as needed (check
.BR pki\ \-\-issue (8)
for more options).
.PP
.EX
pki \-\-issue \-\-in server_pub.der \-\-cacert ca_cert.der \\
\-\-cakey ca_key.der \-\-dn "C=CH, O=strongSwan, CN=VPN Server" \\
\-\-san vpn.strongswan.org \-\-flag serverAuth > server_cert.der
.EE
.PP
Instead of storing the public key in a separate
file, the output of
.B \-\-pub
may also be piped directly into the above command.
.
.SS "Generating Certificate Revocation Lists (CRL)"
.
If end-entity certificates have to be revoked, CRLs may be generated using
the
.B \-\-signcrl
command.
.PP
.EX
pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\
\-\-reason superseded \-\-cert server_cert.der > crl.der
.EE
.PP
The certificate given with \-\-cacert must be either a CA certificate or a
certificate with the
.I crlSign
extended key usage (\-\-flag crlSign). URIs to CRLs may be included in issued
certificates with the \-\-crl option.
.
.SH "SEE ALSO"
.
.BR pki\ \-\-gen (1),
.BR pki\ \-\-self (1),
.BR pki\ \-\-issue (1),
.BR pki\ \-\-signcrl (1),
.BR pki\ \-\-req (1),
.BR pki\ \-\-pkcs7 (1),
.BR pki\ \-\-keyid (1),
.BR pki\ \-\-print (1),
.BR pki\ \-\-pub (1),
.BR pki\ \-\-verify (1)