From 8250fc10e81d112f2f41f65bf8812b285d2b56f8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 31 Jul 2013 17:30:40 +0200 Subject: [PATCH 01/16] Build generated man pages via configure script --- configure.ac | 12 ++++++++++++ man/.gitignore | 4 +--- man/Makefile.am | 17 +++++------------ man/ipsec.conf.5.in | 2 +- man/ipsec.secrets.5.in | 2 +- man/strongswan.conf.5.in | 12 ++++++------ src/charon-cmd/Makefile.am | 11 ++--------- src/charon-cmd/charon-cmd.8.in | 2 +- 8 files changed, 29 insertions(+), 33 deletions(-) diff --git a/configure.ac b/configure.ac index 9469ddbb7..768cb87d1 100644 --- a/configure.ac +++ b/configure.ac @@ -1482,6 +1482,18 @@ AC_CONFIG_FILES([ scripts/Makefile testing/Makefile ]) + +# ================= +# build man pages +# ================= + +AC_CONFIG_FILES([ + man/ipsec.conf.5 + man/ipsec.secrets.5 + man/strongswan.conf.5 + src/charon-cmd/charon-cmd.8 +]) + AC_OUTPUT # ======================== diff --git a/man/.gitignore b/man/.gitignore index 2767ce80f..5d06cd466 100644 --- a/man/.gitignore +++ b/man/.gitignore @@ -1,3 +1 @@ -ipsec.conf.5 -ipsec.secrets.5 -strongswan.conf.5 +*.5 diff --git a/man/Makefile.am b/man/Makefile.am index 0becd24c7..266ef7d3a 100644 --- a/man/Makefile.am +++ b/man/Makefile.am @@ -1,13 +1,6 @@ -dist_man_MANS = ipsec.conf.5 ipsec.secrets.5 strongswan.conf.5 -EXTRA_DIST = ipsec.conf.5.in ipsec.secrets.5.in strongswan.conf.5.in -CLEANFILES = ipsec.conf.5 ipsec.secrets.5 strongswan.conf.5 +man_MANS = \ + ipsec.conf.5 \ + ipsec.secrets.5 \ + strongswan.conf.5 -SUFFIXES = .in - -.in: - $(AM_V_GEN) \ - sed \ - -e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \ - -e "s:@DEV_URANDOM@:$(urandom_device):" \ - -e "s:@DEV_RANDOM@:$(random_device):" \ - $(srcdir)/$@.in > $@ +CLEANFILES = $(man_MANS) diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in index b85172923..a62d68aae 100644 --- a/man/ipsec.conf.5.in +++ b/man/ipsec.conf.5.in @@ -1,4 +1,4 @@ -.TH IPSEC.CONF 5 "2012-06-26" "@IPSEC_VERSION@" "strongSwan" +.TH IPSEC.CONF 5 "2012-06-26" "@PACKAGE_VERSION@" "strongSwan" .SH NAME ipsec.conf \- IPsec configuration and connections .SH DESCRIPTION diff --git a/man/ipsec.secrets.5.in b/man/ipsec.secrets.5.in index ee20c9670..15e36faff 100644 --- a/man/ipsec.secrets.5.in +++ b/man/ipsec.secrets.5.in @@ -1,4 +1,4 @@ -.TH IPSEC.SECRETS 5 "2011-12-14" "@IPSEC_VERSION@" "strongSwan" +.TH IPSEC.SECRETS 5 "2011-12-14" "@PACKAGE_VERSION@" "strongSwan" .SH NAME ipsec.secrets \- secrets for IKE/IPsec authentication .SH DESCRIPTION diff --git a/man/strongswan.conf.5.in b/man/strongswan.conf.5.in index 3ccc43867..a509bd004 100644 --- a/man/strongswan.conf.5.in +++ b/man/strongswan.conf.5.in @@ -1,4 +1,4 @@ -.TH STRONGSWAN.CONF 5 "2013-07-22" "@IPSEC_VERSION@" "strongSwan" +.TH STRONGSWAN.CONF 5 "2013-07-22" "@PACKAGE_VERSION@" "strongSwan" .SH NAME strongswan.conf \- strongSwan configuration file .SH DESCRIPTION @@ -852,11 +852,11 @@ keys not stored on tokens .BR libstrongswan.plugins.pkcs11.use_rng " [no]" Whether the PKCS#11 modules should be used as RNG .TP -.BR libstrongswan.plugins.random.random " [@DEV_RANDOM@]" -File to read random bytes from, instead of @DEV_RANDOM@ +.BR libstrongswan.plugins.random.random " [@random_device@]" +File to read random bytes from, instead of @random_device@ .TP -.BR libstrongswan.plugins.random.urandom " [@DEV_URANDOM@]" -File to read pseudo random bytes from, instead of @DEV_URANDOM@ +.BR libstrongswan.plugins.random.urandom " [@urandom_device@]" +File to read pseudo random bytes from, instead of @urandom_device@ .TP .BR libstrongswan.plugins.unbound.resolv_conf " [/etc/resolv.conf]" File to read DNS resolver configuration from @@ -970,7 +970,7 @@ Send open listening ports without being prompted .BR libimcv.plugins.imv-scanner.remediation_uri URI pointing to scanner remediation instructions .TP -.BR libimcv.plugins.imc-swid.swid_directory "[$(prefix)/share]" +.BR libimcv.plugins.imc-swid.swid_directory " [@prefix@/share]" Directory where SWID tags are located .TP .BR libimcv.plugins.imc-test.additional_ids " [0]" diff --git a/src/charon-cmd/Makefile.am b/src/charon-cmd/Makefile.am index 9ed82be5e..73df45072 100644 --- a/src/charon-cmd/Makefile.am +++ b/src/charon-cmd/Makefile.am @@ -1,7 +1,6 @@ sbin_PROGRAMS = charon-cmd -CLEANFILES = charon-cmd.8 -dist_man8_MANS = charon-cmd.8 -EXTRA_DIST = charon-cmd.8.in +man8_MANS = charon-cmd.8 +CLEANFILES = $(man8_MANS) charon_cmd_SOURCES = \ cmd/cmd_options.h cmd/cmd_options.c \ @@ -24,9 +23,3 @@ charon_cmd_LDADD = \ $(top_builddir)/src/libhydra/libhydra.la \ $(top_builddir)/src/libcharon/libcharon.la \ -lm $(PTHREADLIB) $(DLLIB) - -charon-cmd.8 : charon-cmd.8.in - $(AM_V_GEN) \ - sed \ - -e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \ - $(srcdir)/$@.in > $@ diff --git a/src/charon-cmd/charon-cmd.8.in b/src/charon-cmd/charon-cmd.8.in index c9d52c92f..25d706995 100644 --- a/src/charon-cmd/charon-cmd.8.in +++ b/src/charon-cmd/charon-cmd.8.in @@ -1,4 +1,4 @@ -.TH CHARON\-CMD 8 "2013-06-21" "@IPSEC_VERSION@" "strongSwan" +.TH CHARON\-CMD 8 "2013-06-21" "@PACKAGE_VERSION@" "strongSwan" .SH "NAME" charon\-cmd \- Simple IKE client (IPsec VPN client) .SH SYNOPSIS From b07aee496a567b9ab996e6ba620713c9e313ee57 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 15:13:20 +0200 Subject: [PATCH 02/16] strongswan.conf: Use configured piddir for UNIX sockets --- man/strongswan.conf.5.in | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/man/strongswan.conf.5.in b/man/strongswan.conf.5.in index a509bd004..9ee82f594 100644 --- a/man/strongswan.conf.5.in +++ b/man/strongswan.conf.5.in @@ -386,7 +386,7 @@ DHCP server unicast or broadcast IP address .BR charon.plugins.duplicheck.enable " [yes]" Enable duplicheck plugin (if loaded) .TP -.BR charon.plugins.duplicheck.socket " [unix://${piddir}/charon.dck]" +.BR charon.plugins.duplicheck.socket " [unix://@piddir@/charon.dck]" Socket provided by the duplicheck plugin .TP .BR charon.plugins.eap-aka.request_identity " [yes]" @@ -571,7 +571,7 @@ Start phase2 EAP TNC protocol after successful client authentication .BR charon.plugins.eap-ttls.request_peer_auth " [no]" Request peer authentication based on a client certificate .TP -.BR charon.plugins.error-notify.socket " [unix://${piddir}/charon.enfy]" +.BR charon.plugins.error-notify.socket " [unix://@piddir@/charon.enfy]" Socket provided by the error-notify plugin .TP .BR charon.plugins.ha.autobalance " [0]" @@ -632,7 +632,7 @@ Time in ms to wait until virtual IP addresses appear/disappear before failing. .BR charon.plugins.load-tester Section to configure the load-tester plugin, see LOAD TESTS .TP -.BR charon.plugins.lookip.socket " [unix://${piddir}/charon.lkp]" +.BR charon.plugins.lookip.socket " [unix://@piddir@/charon.lkp]" Socket provided by the lookip plugin .TP .BR charon.plugins.radattr.dir @@ -673,7 +673,7 @@ certificates even if they don't contain a CA basic constraint. .BR charon.plugins.stroke.max_concurrent " [4]" Maximum number of stroke messages handled concurrently .TP -.BR charon.plugins.stroke.socket " [unix://${piddir}/charon.ctl]" +.BR charon.plugins.stroke.socket " [unix://@piddir@/charon.ctl]" Socket provided by the stroke plugin .TP .BR charon.plugins.stroke.timeout " [0]" @@ -744,7 +744,7 @@ plugins, like resolve) .BR charon.plugins.whitelist.enable " [yes]" Enable loaded whitelist plugin .TP -.BR charon.plugins.whitelist.socket " [unix://${piddir}/charon.wlst]" +.BR charon.plugins.whitelist.socket " [unix://@piddir@/charon.wlst]" Socket provided by the whitelist plugin .TP .BR charon.plugins.xauth-eap.backend " [radius]" @@ -1511,7 +1511,7 @@ Request an INTERNAL_IPV4_ADDR from the server .BR charon.plugins.load-tester.shutdown_when_complete " [no]" Shutdown the daemon after all IKE_SAs have been established .TP -.BR charon.plugins.load-tester.socket " [unix://${piddir}/charon.ldt]" +.BR charon.plugins.load-tester.socket " [unix://@piddir@/charon.ldt]" Socket provided by the load-tester plugin .TP .BR charon.plugins.load-tester.version " [0]" From 34cff9349b422d455f5d51577849fea8b4d7b192 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 31 Jul 2013 18:05:10 +0200 Subject: [PATCH 03/16] pki: Add ipsec-pki(8) man page Can be opened either with "man ipsec pki" or "man ipsec-pki". Since man(1) only supports one level of subpages, the forthcoming man pages for each command will have to be opened with "man pki --". --- configure.ac | 2 ++ src/pki/Makefile.am | 2 ++ src/pki/man/.gitignore | 1 + src/pki/man/Makefile.am | 4 +++ src/pki/man/ipsec-pki.8.in | 72 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 81 insertions(+) create mode 100644 src/pki/man/.gitignore create mode 100644 src/pki/man/Makefile.am create mode 100644 src/pki/man/ipsec-pki.8.in diff --git a/configure.ac b/configure.ac index 768cb87d1..196137a40 100644 --- a/configure.ac +++ b/configure.ac @@ -1471,6 +1471,7 @@ AC_CONFIG_FILES([ src/openac/Makefile src/scepclient/Makefile src/pki/Makefile + src/pki/man/Makefile src/dumm/Makefile src/dumm/ext/extconf.rb src/libfast/Makefile @@ -1492,6 +1493,7 @@ AC_CONFIG_FILES([ man/ipsec.secrets.5 man/strongswan.conf.5 src/charon-cmd/charon-cmd.8 + src/pki/man/ipsec-pki.8 ]) AC_OUTPUT diff --git a/src/pki/Makefile.am b/src/pki/Makefile.am index e07938284..783515249 100644 --- a/src/pki/Makefile.am +++ b/src/pki/Makefile.am @@ -1,3 +1,5 @@ +SUBDIRS = man + ipsec_PROGRAMS = pki pki_SOURCES = pki.c pki.h command.c command.h \ diff --git a/src/pki/man/.gitignore b/src/pki/man/.gitignore new file mode 100644 index 000000000..44b27a64b --- /dev/null +++ b/src/pki/man/.gitignore @@ -0,0 +1 @@ +*.8 \ No newline at end of file diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am new file mode 100644 index 000000000..ba4aac89b --- /dev/null +++ b/src/pki/man/Makefile.am @@ -0,0 +1,4 @@ +man8_MANS = \ + ipsec-pki.8 + +CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in new file mode 100644 index 000000000..1f81f680f --- /dev/null +++ b/src/pki/man/ipsec-pki.8.in @@ -0,0 +1,72 @@ +.TH IPSEC\-PKI 8 "2013-07-30" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +ipsec pki \- Simple public key infrastructure (PKI) management tool +. +.SH "SYNOPSIS" +. +.SY "ipsec pki" +.I command +.RI [ option\~ .\|.\|.] +.YS +. +.SY "ipsec pki" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +.B ipsec pki +is a suite of commands that allow you to manage a simple public key +infrastructure (PKI). +.P +Generate RSA and ECDSA key pairs, create PKCS#10 certificate requests +containing subjectAltNames, create X.509 self-signed end-entity and root CA +certificates, issue end-entity and intermediate CA certificates signed by the +private key of a CA and containing subjectAltNames, CRL distribution points +and URIs of OCSP servers. You can also extract raw public keys from private +keys, certificate requests and certificates and compute two kinds of SHA-1-based +key IDs. +. +.SH "COMMANDS" +. +.TP +.B "\-h, \-\-help" +Prints usage information and a short summary of the available commands. +.TP +.B "\-g, \-\-gen" +Generate a new private key. +.TP +.B "\-s, \-\-self" +Create a self-signed certificate. +.TP +.B "\-i, \-\-issue" +Issue a certificate using a CA certificate and key. +.TP +.B "\-c, \-\-signcrl" +Issue a CRL using a CA certificate and key. +.TP +.B "\-r, \-\-req" +Create a PKCS#10 certificate request. +.TP +.B "\-7, \-\-pkcs7" +Provides PKCS#7 wrap/unwrap functions. +.TP +.B "\-k, \-\-keyid" +Calculate key identifiers of a key or certificate. +.TP +.B "\-a, \-\-print" +Print a credential (key, certificate etc.) in human readable form. +.TP +.B "\-p, \-\-pub" +Extract a public key from a private key or certificate. +.TP +.B "\-v, \-\-verify" +Verify a certificate using a CA certificate. +. +.SH "SEE ALSO" +. +.BR ipsec (8) From a612f6e338ef2e70c1dd4b6c6dafb941212582d8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 31 Jul 2013 19:19:08 +0200 Subject: [PATCH 04/16] pki: Add pki --gen man page Can be opened with "man pki --gen". --- configure.ac | 1 + src/pki/commands/gen.c | 4 +- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---gen.8.in | 112 +++++++++++++++++++++++++++++++++++++ 5 files changed, 119 insertions(+), 4 deletions(-) create mode 100644 src/pki/man/pki---gen.8.in diff --git a/configure.ac b/configure.ac index 196137a40..d4b198b80 100644 --- a/configure.ac +++ b/configure.ac @@ -1494,6 +1494,7 @@ AC_CONFIG_FILES([ man/strongswan.conf.5 src/charon-cmd/charon-cmd.8 src/pki/man/ipsec-pki.8 + src/pki/man/pki---gen.8 ]) AC_OUTPUT diff --git a/src/pki/commands/gen.c b/src/pki/commands/gen.c index e3602f0c3..b74be7d98 100644 --- a/src/pki/commands/gen.c +++ b/src/pki/commands/gen.c @@ -151,7 +151,7 @@ static void __attribute__ ((constructor))reg() command_register((command_t) { gen, 'g', "gen", "generate a new private key", {" [--type rsa|ecdsa] [--size bits] [--safe-primes]", - "[--shares n] [--threshold l] [--outform der|pem|pgp]"}, + "[--shares n] [--threshold l] [--outform der|pem]"}, { {"help", 'h', 0, "show usage information"}, {"type", 't', 1, "type of key, default: rsa"}, @@ -159,7 +159,7 @@ static void __attribute__ ((constructor))reg() {"safe-primes", 'p', 0, "generate rsa safe primes"}, {"shares", 'n', 1, "number of private rsa key shares"}, {"threshold", 'l', 1, "minimum number of participating rsa key shares"}, - {"outform", 'f', 1, "encoding of generated private key"}, + {"outform", 'f', 1, "encoding of generated private key, default: der"}, } }); } diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index ba4aac89b..4b33a30c7 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -1,4 +1,5 @@ man8_MANS = \ - ipsec-pki.8 + ipsec-pki.8 \ + pki---gen.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 1f81f680f..0c1d427b0 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -69,4 +69,5 @@ Verify a certificate using a CA certificate. . .SH "SEE ALSO" . -.BR ipsec (8) +.BR ipsec (8), +.BR pki\ \-\-gen (8) diff --git a/src/pki/man/pki---gen.8.in b/src/pki/man/pki---gen.8.in new file mode 100644 index 000000000..9590046cc --- /dev/null +++ b/src/pki/man/pki---gen.8.in @@ -0,0 +1,112 @@ +.TH "PKI \-\-GEN" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-gen \- Generate a new RSA or ECDSA private key +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-gen +.OP \-\-type type +.OP \-\-size bits +.OP \-\-safe\-primes +.OP \-\-shares n +.OP \-\-threshold l +.OP \-\-outform encoding +.OP \-\-debug level +.YS +. +.SY pki\ \-\-gen +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-gen" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +is used to generate a new RSA or ECDSA private key. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-t, \-\-type " type +Type of key to generate. Either \fIrsa\fR or \fIecdsa\fR, defaults to \fIrsa\fR. +.TP +.BI "\-s, \-\-size " bits +Key length in bits. Defaults to 2048 for \fIrsa\fR and 384 for \fIecdsa\fR. +For \fIecdsa\fR only three values are currently supported: 256, 384 and 521. +.TP +.BI "\-p, \-\-safe\-primes" +Generate RSA safe primes. +.TP +.BI "\-f, \-\-outform " encoding +Encoding of the generated private key. Either \fIder\fR (ASN.1 DER) or \fIpem\fR +(Base64 PEM), defaults +to \fIder\fR. +.PP +.SS "RSA Threshold Cryptography" +.TP +.BI "\-n, \-\-shares " +Number of private RSA key shares. +.TP +.BI "\-l, \-\-threshold " +Minimum number of participating RSA key shares. +. +.SH "PROBLEMS ON HOSTS WITH LOW ENTROPY" +. +If the +.I gmp +plugin is used to generate RSA private keys the key material is read from +.I /dev/random +(via the +.I random +plugin). Therefore, the command may block if the system's entropy pool is empty. +To avoid this, either use a hardware random number generator to feed +.I /dev/random +or use OpenSSL (via the +.I openssl +plugin or the command line) which is not as strict in regards to the quality of +the key material (it reads from +.I /dev/urandom +if necessary). It is also possible to configure the devices used by the +.I random +plugin in +.BR strongswan.conf (5). +Setting +.B libstrongswan.plugins.random.random +to +.I /dev/urandom +forces the plugin to treat bytes read from +.I /dev/urandom +as high grade random data, thus avoiding the blocking. Of +course, this doesn't change the fact that the key material generated this way is +of lower quality. +. +.SH "EXAMPLES" +. +.TP +.B ipsec pki \-\-gen \-\-size 3072 > rsa_key.der +Generates a 3072-bit RSA private key. +. +.TP +.B ipsec pki \-\-gen \-\-type ecdsa \-\-size 256 > ecdsa_key.der +Generates a 256-bit ECDSA private key. +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From 3a643b8901ea6e87ffa3834a1f5358baf644b6b4 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 31 Jul 2013 19:48:45 +0200 Subject: [PATCH 05/16] pki: Add pki --self man page Can be opened with "man pki --self". --- configure.ac | 1 + src/pki/commands/self.c | 4 +- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---self.8.in | 148 ++++++++++++++++++++++++++++++++++++ 5 files changed, 155 insertions(+), 4 deletions(-) create mode 100644 src/pki/man/pki---self.8.in diff --git a/configure.ac b/configure.ac index d4b198b80..19ee2d77b 100644 --- a/configure.ac +++ b/configure.ac @@ -1495,6 +1495,7 @@ AC_CONFIG_FILES([ src/charon-cmd/charon-cmd.8 src/pki/man/ipsec-pki.8 src/pki/man/pki---gen.8 + src/pki/man/pki---self.8 ]) AC_OUTPUT diff --git a/src/pki/commands/self.c b/src/pki/commands/self.c index 448360821..a1f17c8f9 100644 --- a/src/pki/commands/self.c +++ b/src/pki/commands/self.c @@ -378,14 +378,14 @@ static void __attribute__ ((constructor))reg() command_register((command_t) { self, 's', "self", "create a self signed certificate", - {"[--in file | --keyid hex] [--type rsa|ecdsa]", + {" [--in file|--keyid hex] [--type rsa|ecdsa]", " --dn distinguished-name [--san subjectAltName]+", "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+", "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+", "[--nc-permitted name] [--nc-excluded name]", - "[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+", "[--policy-map issuer-oid:subject-oid]", "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]", + "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+", "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"}, { {"help", 'h', 0, "show usage information"}, diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index 4b33a30c7..addcee957 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -1,5 +1,6 @@ man8_MANS = \ ipsec-pki.8 \ - pki---gen.8 + pki---gen.8 \ + pki---self.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 0c1d427b0..446a4a10f 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -70,4 +70,5 @@ Verify a certificate using a CA certificate. .SH "SEE ALSO" . .BR ipsec (8), -.BR pki\ \-\-gen (8) +.BR pki\ \-\-gen (8), +.BR pki\ \-\-self (8) diff --git a/src/pki/man/pki---self.8.in b/src/pki/man/pki---self.8.in new file mode 100644 index 000000000..ad0c35c64 --- /dev/null +++ b/src/pki/man/pki---self.8.in @@ -0,0 +1,148 @@ +.TH "PKI \-\-SELF" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-self \- Create a self-signed certificate +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-self +.RB [ \-\-in +.IR file | \fB\-\-keyid\fR +.IR hex ] +.OP \-\-type t +.BI \-\-dn\~ distinguished-name +.OP \-\-san subjectAltName +.OP \-\-lifetime days +.OP \-\-serial hex +.OP \-\-flag flag +.OP \-\-digest digest +.OP \-\-ca +.OP \-\-ocsp uri +.OP \-\-pathlen len +.OP \-\-nc-permitted name +.OP \-\-nc-excluded name +.OP \-\-policy\-mapping mapping +.OP \-\-policy\-explicit len +.OP \-\-policy\-inhibit len +.OP \-\-policy\-any len +.OP \-\-cert\-policy oid\ \fR[\fB\-\-cps\-uri\ \fIuri\fR]\ \fR[\fB\-\-user\-notice\ \fItext\fR] +.OP \-\-outform encoding +.OP \-\-debug level +.YS +. +.SY pki\ \-\-self +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-self" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +is used to create a self-signed certificate. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-i, \-\-in " file +Private key input file. If not given the key is read from \fISTDIN\fR. +.TP +.BI "\-x, \-\-keyid " hex +Key ID of a private key on a smartcard. +.TP +.BI "\-t, \-\-type " type +Type of the input key. Either \fIrsa\fR or \fIecdsa\fR, defaults to \fIrsa\fR. +.TP +.BI "\-d, \-\-dn " distinguished-name +Subject and issuer distinguished name (DN). Required. +.TP +.BI "\-a, \-\-san " subjectAltName +subjectAltName extension to include in certificate. Can be used multiple times. +.TP +.BI "\-l, \-\-lifetime " days +Days the certificate is valid, default: 1095. +.TP +.BI "\-s, \-\-serial " hex +Serial number in hex. It is randomly allocated by default. +.TP +.BI "\-e, \-\-flag " flag +Add extendedKeyUsage flag. One of \fIserverAuth\fR, \fIclientAuth\fR, +\fIcrlSign\fR, or \fIocspSigning\fR. Can be used multiple times. +.TP +.BI "\-g, \-\-digest " digest +Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR, +\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to +\fIsha1\fR. +.TP +.BI "\-f, \-\-outform " encoding +Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or +\fIpem\fR (Base64 PEM), defaults to \fIder\fR. +.TP +.BI "\-b, \-\-ca" +Include CA basicConstraint extension in certificate. +.TP +.BI "\-o, \-\-ocsp " uri +OCSP AuthorityInfoAccess URI to include in certificate. Can be used multiple +times. +.TP +.BI "\-p, \-\-pathlen " len +Set path length constraint. +.TP +.BI "\-n, \-\-nc-permitted " name +Add permitted NameConstraint extension to certificate. +.TP +.BI "\-N, \-\-nc-excluded " name +Add excluded NameConstraint extension to certificate. +.TP +.BI "\-M, \-\-policy-mapping " issuer-oid:subject-oid +Add policyMapping from issuer to subject OID. +.TP +.BI "\-E, \-\-policy-explicit " len +Add requireExplicitPolicy constraint. +.TP +.BI "\-H, \-\-policy-inhibit " len +Add inhibitPolicyMapping constraint. +.TP +.BI "\-A, \-\-policy-any " len +Add inhibitAnyPolicy constraint. +.PP +.SS "Certificate Policy" +Multiple certificatePolicy extensions can be added. Each with the following +information: +.TP +.BI "\-P, \-\-cert-policy " oid +OID to include in certificatePolicy extension. Required. +.TP +.BI "\-C, \-\-cps-uri " uri +Certification Practice statement URI for certificatePolicy. +.TP +.BI "\-U, \-\-user-notice " text +User notice for certificatePolicy. +. +.SH "EXAMPLES" +. +Generate a self-signed certificate using the given RSA key: +.PP +.EX + ipsec pki \-\-self \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ + \-\-san moon.strongswan.org > cert.der +.EE +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From 42e3a21e249e87f94d98fa5d8197fc89e1eeb733 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 16:06:42 +0200 Subject: [PATCH 06/16] pki: Add pki --issue man page --- configure.ac | 1 + src/pki/commands/issue.c | 12 +-- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---issue.8.in | 179 +++++++++++++++++++++++++++++++++++ 5 files changed, 190 insertions(+), 8 deletions(-) create mode 100644 src/pki/man/pki---issue.8.in diff --git a/configure.ac b/configure.ac index 19ee2d77b..20f503301 100644 --- a/configure.ac +++ b/configure.ac @@ -1495,6 +1495,7 @@ AC_CONFIG_FILES([ src/charon-cmd/charon-cmd.8 src/pki/man/ipsec-pki.8 src/pki/man/pki---gen.8 + src/pki/man/pki---issue.8 src/pki/man/pki---self.8 ]) diff --git a/src/pki/commands/issue.c b/src/pki/commands/issue.c index 5f098ba41..9d669dfdd 100644 --- a/src/pki/commands/issue.c +++ b/src/pki/commands/issue.c @@ -514,14 +514,14 @@ static void __attribute__ ((constructor))reg() command_register((command_t) { issue, 'i', "issue", "issue a certificate using a CA certificate and key", - {"[--in file] [--type pub|pkcs10] --cakey file | --cakeyid hex", + {"[--in file] [--type pub|pkcs10] --cakey file|--cakeyid hex", " --cacert file [--dn subject-dn] [--san subjectAltName]+", - "[--lifetime days] [--serial hex] [--crl uri [--crlissuer i] ]+ [--ocsp uri]+", - "[--ca] [--pathlen len] [--flag serverAuth|clientAuth|crlSign|ocspSigning]+", - "[--nc-permitted name] [--nc-excluded name]", - "[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+", - "[--policy-map issuer-oid:subject-oid]", + "[--lifetime days] [--serial hex] [--ca] [--pathlen len]", + "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+", + "[--crl uri [--crlissuer i]]+ [--ocsp uri]+ [--nc-permitted name]", + "[--nc-excluded name] [--policy-mapping issuer-oid:subject-oid]", "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]", + "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+", "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"}, { {"help", 'h', 0, "show usage information"}, diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index addcee957..74363aed7 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -1,6 +1,7 @@ man8_MANS = \ ipsec-pki.8 \ pki---gen.8 \ - pki---self.8 + pki---self.8 \ + pki---issue.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 446a4a10f..fdfb9284c 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -71,4 +71,5 @@ Verify a certificate using a CA certificate. . .BR ipsec (8), .BR pki\ \-\-gen (8), -.BR pki\ \-\-self (8) +.BR pki\ \-\-self (8), +.BR pki\ \-\-issue (8) diff --git a/src/pki/man/pki---issue.8.in b/src/pki/man/pki---issue.8.in new file mode 100644 index 000000000..6c9f85e17 --- /dev/null +++ b/src/pki/man/pki---issue.8.in @@ -0,0 +1,179 @@ +.TH "PKI \-\-ISSUE" 8 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-issue \- Issue a certificate using a CA certificate and key +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-issue +.OP \-\-in file +.OP \-\-type type +.BI \-\-cakey\~ file |\-\-cakeyid\~ hex +.BI \-\-cacert\~ file +.OP \-\-dn subject-dn +.OP \-\-san subjectAltName +.OP \-\-lifetime days +.OP \-\-serial hex +.OP \-\-flag flag +.OP \-\-digest digest +.OP \-\-ca +.OP \-\-crl uri\ \fR[\fB\-\-crlissuer\ \fIissuer\fR] +.OP \-\-ocsp uri +.OP \-\-pathlen len +.OP \-\-nc-permitted name +.OP \-\-nc-excluded name +.OP \-\-policy\-mapping mapping +.OP \-\-policy\-explicit len +.OP \-\-policy\-inhibit len +.OP \-\-policy\-any len +.OP \-\-cert\-policy oid\ \fR[\fB\-\-cps\-uri\ \fIuri\fR]\ \fR[\fB\-\-user\-notice\ \fItext\fR] +.OP \-\-outform encoding +.OP \-\-debug level +.YS +. +.SY pki\ \-\-issue +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-issue" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +is used to issue a certificate using a CA certificate and private key. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-i, \-\-in " file +Public key or PKCS#10 certificate request file to issue. If not given the +key/request is read from \fISTDIN\fR. +.TP +.BI "\-t, \-\-type " type +Type of the input. Either \fIpub\fR for a public key, or \fIpkcs10\fR for a +PKCS#10 certificate request, defaults to \fIpub\fR. +.TP +.BI "\-k, \-\-cakey " file +CA private key file. Either this or +.B \-\-cakeyid +is required. +.TP +.BI "\-x, \-\-cakeyid " hex +Key ID of a CA private key on a smartcard. Either this or +.B \-\-cakey +is required. +.TP +.BI "\-c, \-\-cacert " file +CA certificate file. Required. +.TP +.BI "\-d, \-\-dn " subject-dn +Subject distinguished name (DN) of the issued certificate. +.TP +.BI "\-a, \-\-san " subjectAltName +subjectAltName extension to include in certificate. Can be used multiple times. +.TP +.BI "\-l, \-\-lifetime " days +Days the certificate is valid, default: 1095. +.TP +.BI "\-s, \-\-serial " hex +Serial number in hex. It is randomly allocated by default. +.TP +.BI "\-e, \-\-flag " flag +Add extendedKeyUsage flag. One of \fIserverAuth\fR, \fIclientAuth\fR, +\fIcrlSign\fR, or \fIocspSigning\fR. Can be used multiple times. +.TP +.BI "\-g, \-\-digest " digest +Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR, +\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to +\fIsha1\fR. +.TP +.BI "\-f, \-\-outform " encoding +Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or +\fIpem\fR (Base64 PEM), defaults to \fIder\fR. +.TP +.BI "\-b, \-\-ca" +Include CA basicConstraint extension in certificate. +.TP +.BI "\-u, \-\-crl " uri +CRL distribution point URI to include in certificate. Can be used multiple +times. +.TP +.BI "\-I, \-\-crlissuer " issuer +Optional CRL issuer for the CRL at the preceding distribution point. +.TP +.BI "\-o, \-\-ocsp " uri +OCSP AuthorityInfoAccess URI to include in certificate. Can be used multiple +times. +.TP +.BI "\-p, \-\-pathlen " len +Set path length constraint. +.TP +.BI "\-n, \-\-nc-permitted " name +Add permitted NameConstraint extension to certificate. +.TP +.BI "\-N, \-\-nc-excluded " name +Add excluded NameConstraint extension to certificate. +.TP +.BI "\-M, \-\-policy-mapping " issuer-oid:subject-oid +Add policyMapping from issuer to subject OID. +.TP +.BI "\-E, \-\-policy-explicit " len +Add requireExplicitPolicy constraint. +.TP +.BI "\-H, \-\-policy-inhibit " len +Add inhibitPolicyMapping constraint. +.TP +.BI "\-A, \-\-policy-any " len +Add inhibitAnyPolicy constraint. +.PP +.SS "Certificate Policy" +Multiple certificatePolicy extensions can be added. Each with the following +information: +.TP +.BI "\-P, \-\-cert-policy " oid +OID to include in certificatePolicy extension. Required. +.TP +.BI "\-C, \-\-cps-uri " uri +Certification Practice statement URI for certificatePolicy. +.TP +.BI "\-U, \-\-user-notice " text +User notice for certificatePolicy. +. +.SH "EXAMPLES" +. +To save repetitive typing, command line options can be stored in files. +Lets assume +.I pki.opt +contains the following contents: +.PP +.EX + --cacert ca_cert.der --cakey ca_key.der --digest sha256 + --flag serverAuth --lifetime 1460 --type pkcs10 +.EE +.PP +Then the following command can be used to issue a certificate based on a +given PKCS#10 certificate request and the options above: +.PP +.EX + ipsec pki --issue --options pki.opt --in req.der > cert.der +.EE +.PP +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From 96aa5a1dddacc6fb618e391b3bb5506806dadd53 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 16:39:21 +0200 Subject: [PATCH 07/16] pki: Add pki --signcrl man page --- configure.ac | 1 + src/pki/commands/signcrl.c | 12 ++-- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---signcrl.8.in | 124 +++++++++++++++++++++++++++++++++ 5 files changed, 135 insertions(+), 8 deletions(-) create mode 100644 src/pki/man/pki---signcrl.8.in diff --git a/configure.ac b/configure.ac index 20f503301..108c22380 100644 --- a/configure.ac +++ b/configure.ac @@ -1497,6 +1497,7 @@ AC_CONFIG_FILES([ src/pki/man/pki---gen.8 src/pki/man/pki---issue.8 src/pki/man/pki---self.8 + src/pki/man/pki---signcrl.8 ]) AC_OUTPUT diff --git a/src/pki/commands/signcrl.c b/src/pki/commands/signcrl.c index f9746cca7..4f9dd291d 100644 --- a/src/pki/commands/signcrl.c +++ b/src/pki/commands/signcrl.c @@ -429,13 +429,13 @@ static void __attribute__ ((constructor))reg() command_register((command_t) { sign_crl, 'c', "signcrl", "issue a CRL using a CA certificate and key", - {"--cacert file --cakey file | --cakeyid hex --lifetime days", - "[--lastcrl crl] [--basecrl crl] [--crluri uri ]+", - "[ [--reason key-compromise|ca-compromise|affiliation-changed|", + {"--cacert file --cakey file|--cakeyid hex [--lifetime days]", + " [--lastcrl crl] [--basecrl crl] [--crluri uri]+", + " [[--reason key-compromise|ca-compromise|affiliation-changed|", " superseded|cessation-of-operation|certificate-hold]", - " [--date timestamp]", - " --cert file | --serial hex ]*", - "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"}, + " [--date timestamp] --cert file|--serial hex]*", + " [--digest md5|sha1|sha224|sha256|sha384|sha512]", + " [--outform der|pem]"}, { {"help", 'h', 0, "show usage information"}, {"cacert", 'c', 1, "CA certificate file"}, diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index 74363aed7..df71614fe 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -2,6 +2,7 @@ man8_MANS = \ ipsec-pki.8 \ pki---gen.8 \ pki---self.8 \ - pki---issue.8 + pki---issue.8 \ + pki---signcrl.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index fdfb9284c..49499bd39 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -72,4 +72,5 @@ Verify a certificate using a CA certificate. .BR ipsec (8), .BR pki\ \-\-gen (8), .BR pki\ \-\-self (8), -.BR pki\ \-\-issue (8) +.BR pki\ \-\-issue (8), +.BR pki\ \-\-signcrl (8) diff --git a/src/pki/man/pki---signcrl.8.in b/src/pki/man/pki---signcrl.8.in new file mode 100644 index 000000000..7d67c4945 --- /dev/null +++ b/src/pki/man/pki---signcrl.8.in @@ -0,0 +1,124 @@ +.TH "PKI \-\-SIGNCRL" 8 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-signcrl \- Issue a Certificate Revocation List (CRL) using a CA certificate and key +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-signcrl +.BI \-\-cakey\~ file |\-\-cakeyid\~ hex +.BI \-\-cacert\~ file +.OP \-\-lifetime days +.OP \-\-lastcrl crl +.OP \-\-basecrl crl +.OP \-\-crluri uri +.OP \-\-digest digest +.OP \fR[\fB\-\-reason\ \fIreason\fR]\ \fR[\fB\-\-date\ \fIts\fR]\ \fB\-\-cert\ \fIfile\fB|\-\-serial\ \fIhex\fR +.OP \-\-outform encoding +.OP \-\-debug level +.YS +. +.SY pki\ \-\-signcrl +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-signcrl" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +is used to issue a Certificate Revocation List (CRL) using a CA certificate and +private key. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-k, \-\-cakey " file +CA private key file. Either this or +.B \-\-cakeyid +is required. +.TP +.BI "\-x, \-\-cakeyid " hex +Key ID of a CA private key on a smartcard. Either this or +.B \-\-cakey +is required. +.TP +.BI "\-c, \-\-cacert " file +CA certificate file. Required. +.TP +.BI "\-l, \-\-lifetime " days +Days until the CRL gets a nextUpdate, default: 15. +.TP +.BI "\-a, \-\-lastcrl " crl +CRL of lastUpdate to copy revocations from. +.TP +.BI "\-b, \-\-basecrl " crl +Base CRL to create a delta CRL for. +.TP +.BI "\-u, \-\-crluri " uri +Freshest delta CRL URI to include in CRL. Can be used multiple times. +.TP +.BI "\-g, \-\-digest " digest +Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR, +\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to +\fIsha1\fR. +.TP +.BI "\-f, \-\-outform " encoding +Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or +\fIpem\fR (Base64 PEM), defaults to \fIder\fR. +.PP +.SS "Revoked Certificates" +Multiple revoked certificates can be added to the CRL by either providing the +certificate file or the respective serial number directly. +A reason and a timestamp can be configured for each revocation (they have to be +given before each certificate/serial on the command line). +.TP +.BI "\-r, \-\-reason " reason +The reason why the certificate was revoked. One of \fIkey\-compromise\fR, +\fIca\-compromise\fR, \fIaffiliation\-changed\fR, \fIsuperseded\fR, +\fIcessation\-of\-operation\fR, or \fIcertificate\-hold\fR. +.TP +.BI "\-d, \-\-date " ts +Revocation date as Unix timestamp. Defaults to the current time. +.TP +.BI "\-z, \-\-cert " file +Certificate file to revoke. +.TP +.BI "\-s, \-\-serial " hex +Hexadecimal encoded serial number of the certificate to revoke. +. +.SH "EXAMPLES" +. +Revoke a certificate: +.PP +.EX + ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ + \-\-reason superseded \-\-cert cert.der > crl.der +.EE +.PP +Update an existing CRL with two new revocations, using the certificate's serial +number, but no reason: +.PP +.EX + ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ + \-\-lastcrl old_crl.der \-\-serial 0123 \-\-serial 0345 > crl.der +.EE +.PP +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From bb8e2e1759d9746622024ad20b7488f4f797fa14 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 16:49:13 +0200 Subject: [PATCH 08/16] pki: Add pki --req man page --- configure.ac | 1 + src/pki/commands/req.c | 5 +-- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---req.8.in | 91 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 98 insertions(+), 5 deletions(-) create mode 100644 src/pki/man/pki---req.8.in diff --git a/configure.ac b/configure.ac index 108c22380..3dc1a467b 100644 --- a/configure.ac +++ b/configure.ac @@ -1496,6 +1496,7 @@ AC_CONFIG_FILES([ src/pki/man/ipsec-pki.8 src/pki/man/pki---gen.8 src/pki/man/pki---issue.8 + src/pki/man/pki---req.8 src/pki/man/pki---self.8 src/pki/man/pki---signcrl.8 ]) diff --git a/src/pki/commands/req.c b/src/pki/commands/req.c index d90ddc251..e269f64ea 100644 --- a/src/pki/commands/req.c +++ b/src/pki/commands/req.c @@ -174,9 +174,8 @@ static void __attribute__ ((constructor))reg() command_register((command_t) { req, 'r', "req", "create a PKCS#10 certificate request", - {"[--in file] [--type rsa|ecdsa]", - " --dn distinguished-name [--san subjectAltName]+", - "[--password challengePassword]", + {" [--in file] [--type rsa|ecdsa] --dn distinguished-name", + "[--san subjectAltName]+ [--password challengePassword]", "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"}, { {"help", 'h', 0, "show usage information"}, diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index df71614fe..1a7f62119 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -3,6 +3,7 @@ man8_MANS = \ pki---gen.8 \ pki---self.8 \ pki---issue.8 \ - pki---signcrl.8 + pki---signcrl.8 \ + pki---req.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 49499bd39..8f664bb0b 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -73,4 +73,5 @@ Verify a certificate using a CA certificate. .BR pki\ \-\-gen (8), .BR pki\ \-\-self (8), .BR pki\ \-\-issue (8), -.BR pki\ \-\-signcrl (8) +.BR pki\ \-\-signcrl (8), +.BR pki\ \-\-req (8) diff --git a/src/pki/man/pki---req.8.in b/src/pki/man/pki---req.8.in new file mode 100644 index 000000000..9986f7feb --- /dev/null +++ b/src/pki/man/pki---req.8.in @@ -0,0 +1,91 @@ +.TH "PKI \-\-REQ" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-req \- Create a PKCS#10 certificate request +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-req +.OP \-\-in file +.OP \-\-type type +.BI \-\-dn\~ distinguished-name +.OP \-\-san subjectAltName +.OP \-\-password password +.OP \-\-digest digest +.OP \-\-outform encoding +.OP \-\-debug level +.YS +. +.SY pki\ \-\-req +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-req" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +is used to create a PKCS#10 certificate request. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-i, \-\-in " file +Private key input file. If not given the key is read from \fISTDIN\fR. +.TP +.BI "\-t, \-\-type " type +Type of the input key. Either \fIrsa\fR or \fIecdsa\fR, defaults to \fIrsa\fR. +.TP +.BI "\-d, \-\-dn " distinguished-name +Subject distinguished name (DN). Required. +.TP +.BI "\-a, \-\-san " subjectAltName +subjectAltName extension to include in request. Can be used multiple times. +.TP +.BI "\-p, \-\-password " password +The challengePassword to include in the certificate request. +.TP +.BI "\-g, \-\-digest " digest +Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR, +\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to +\fIsha1\fR. +.TP +.BI "\-f, \-\-outform " encoding +Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or +\fIpem\fR (Base64 PEM), defaults to \fIder\fR. +. +.SH "EXAMPLES" +. +Generate a certificate request for an RSA key, with a subjectAltName extension: +.PP +.EX + ipsec pki \-\-req \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ + \-\-san moon@strongswan.org > req.der +.EE +.PP +Generate a certificate request for an ECDSA key and a different digest: +.PP +.EX + ipsec pki \-\-req \-\-in key.der \-\-type ecdsa \-\-digest sha256 \\ + \-\-dn "C=CH, O=strongSwan, CN=carol" > req.der +.EE +.PP +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From 558771400e0828cdcded8962d4a82abc85073a45 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 17:04:28 +0200 Subject: [PATCH 09/16] pki: Add pki --pkcs7 man page --- configure.ac | 1 + src/pki/commands/pkcs7.c | 8 ++-- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---pkcs7.8.in | 79 ++++++++++++++++++++++++++++++++++++ 5 files changed, 88 insertions(+), 6 deletions(-) create mode 100644 src/pki/man/pki---pkcs7.8.in diff --git a/configure.ac b/configure.ac index 3dc1a467b..7ddb2746a 100644 --- a/configure.ac +++ b/configure.ac @@ -1496,6 +1496,7 @@ AC_CONFIG_FILES([ src/pki/man/ipsec-pki.8 src/pki/man/pki---gen.8 src/pki/man/pki---issue.8 + src/pki/man/pki---pkcs7.8 src/pki/man/pki---req.8 src/pki/man/pki---self.8 src/pki/man/pki---signcrl.8 diff --git a/src/pki/commands/pkcs7.c b/src/pki/commands/pkcs7.c index 790656c62..6c75693ab 100644 --- a/src/pki/commands/pkcs7.c +++ b/src/pki/commands/pkcs7.c @@ -445,8 +445,8 @@ static void __attribute__ ((constructor))reg() { command_register((command_t) { pkcs7, '7', "pkcs7", "PKCS#7 wrap/unwrap functions", - {"--sign | --verify | --encrypt | --decrypt", - "--certificate+ [--key]"}, + {"--sign|--verify|--encrypt|--decrypt|--show", + "[--in file] [--cert file]+ [--key file]"}, { {"help", 'h', 0, "show usage information"}, {"sign", 's', 0, "create PKCS#7 signed-data"}, @@ -455,8 +455,8 @@ static void __attribute__ ((constructor))reg() {"decrypt", 'd', 0, "decrypt PKCS#7 enveloped-data"}, {"show", 'p', 0, "show info about PKCS#7, print certificates"}, {"in", 'i', 1, "input file, default: stdin"}, - {"key", 'k', 1, "path to private key for sign/decryp"}, - {"cert", 'c', 1, "path to certificate for sign/verify/encryp"}, + {"key", 'k', 1, "path to private key for sign/decrypt"}, + {"cert", 'c', 1, "path to certificate for sign/verify/encrypt"}, } }); } diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index 1a7f62119..e88230a92 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -4,6 +4,7 @@ man8_MANS = \ pki---self.8 \ pki---issue.8 \ pki---signcrl.8 \ - pki---req.8 + pki---req.8 \ + pki---pkcs7.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 8f664bb0b..c41ea0bea 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -74,4 +74,5 @@ Verify a certificate using a CA certificate. .BR pki\ \-\-self (8), .BR pki\ \-\-issue (8), .BR pki\ \-\-signcrl (8), -.BR pki\ \-\-req (8) +.BR pki\ \-\-req (8), +.BR pki\ \-\-pkcs7 (8) diff --git a/src/pki/man/pki---pkcs7.8.in b/src/pki/man/pki---pkcs7.8.in new file mode 100644 index 000000000..c500ca288 --- /dev/null +++ b/src/pki/man/pki---pkcs7.8.in @@ -0,0 +1,79 @@ +.TH "PKI \-\-PKCS7" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-pkcs7 \- Provides PKCS#7 wrap/unwrap functions +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-pkcs7 +.BR \-\-sign | \-\-verify | \-\-encrypt | \-\-decrypt | \-\-show +.OP \-\-in file +.OP \-\-cert file +.OP \-\-key file +.OP \-\-debug level +.YS +. +.SY pki\ \-\-pkcs7 +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-pkcs7" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +provides functions to wrap/unwrap PKCS#7 containers. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-s, \-\-sign" +Create PKCS#7 signed-data. +.TP +.BI "\-u, \-\-verify" +Verify PKCS#7 signed-data. +.TP +.BI "\-e, \-\-encrypt" +Create PKCS#7 enveloped-data. +.TP +.BI "\-e, \-\-decrypt" +Decrypt PKCS#7 enveloped-data. +.TP +.BI "\-p, \-\-show" +Show information about PKCS#7 container, list certificates. +.TP +.BI "\-i, \-\-in " file +PKCS#7 input file. If not given the input is read from \fISTDIN\fR. +.TP +.BI "\-k, \-\-key " file +Private key used for +.B \-\-sign +and +.BR \-\-decrypt. +.TP +.BI "\-c, \-\-cert " file +Certificate for +.BR \-\-sign , +.B \-\-verify +and +.BR \-\-encrypt. +Can be used multiple times. +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From e69fd305382ba4577d9b11cfec3bc9084bc15001 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 17:14:17 +0200 Subject: [PATCH 10/16] pki: Add pki --keyid man page --- configure.ac | 1 + src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---keyid.8.in | 72 ++++++++++++++++++++++++++++++++++++ 4 files changed, 77 insertions(+), 2 deletions(-) create mode 100644 src/pki/man/pki---keyid.8.in diff --git a/configure.ac b/configure.ac index 7ddb2746a..4d0eb8eae 100644 --- a/configure.ac +++ b/configure.ac @@ -1496,6 +1496,7 @@ AC_CONFIG_FILES([ src/pki/man/ipsec-pki.8 src/pki/man/pki---gen.8 src/pki/man/pki---issue.8 + src/pki/man/pki---keyid.8 src/pki/man/pki---pkcs7.8 src/pki/man/pki---req.8 src/pki/man/pki---self.8 diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index e88230a92..7918975d2 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -5,6 +5,7 @@ man8_MANS = \ pki---issue.8 \ pki---signcrl.8 \ pki---req.8 \ - pki---pkcs7.8 + pki---pkcs7.8 \ + pki---keyid.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index c41ea0bea..5faa321be 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -75,4 +75,5 @@ Verify a certificate using a CA certificate. .BR pki\ \-\-issue (8), .BR pki\ \-\-signcrl (8), .BR pki\ \-\-req (8), -.BR pki\ \-\-pkcs7 (8) +.BR pki\ \-\-pkcs7 (8), +.BR pki\ \-\-keyid (8) diff --git a/src/pki/man/pki---keyid.8.in b/src/pki/man/pki---keyid.8.in new file mode 100644 index 000000000..a4a6c9d4a --- /dev/null +++ b/src/pki/man/pki---keyid.8.in @@ -0,0 +1,72 @@ +.TH "PKI \-\-KEYID" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-keyid \- Calculate key identifiers of a key or certificate +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-keyid +.OP \-\-in file +.OP \-\-type type +.OP \-\-debug level +.YS +. +.SY pki\ \-\-keyid +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-keyid" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +calculates key identifiers of private keys and certificates. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-i, \-\-in " file +Input file. If not given the input is read from \fISTDIN\fR. +.TP +.BI "\-t, \-\-type " type +Type of input. One of \fIrsa-priv\fR (RSA private key), \fIecdsa-priv\fR (ECDSA +private key), \fIpub\fR (public key), \fIpkcs10\fR (PKCS#10 certificate +request), \fIx509\fR (X.509 certificate), defaults to \fIrsa-priv\fR. +. +.SH "EXAMPLES" +. +Calculate key identifiers of an RSA private key: +.PP +.EX + ipsec pki --keyid --in key.der + subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1... + subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1... +.EE +.PP +Calculate key identifiers of an X.509 certificate: +.PP +.EX + ipsec pki --keyid --in cert.der --type x509 + subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1... + subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1... +.EE +.PP +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From a319eff80d34424db5897de0869381f4000a131b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 17:21:49 +0200 Subject: [PATCH 11/16] pki: Add pki --print man page --- configure.ac | 1 + src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---print.8.in | 53 ++++++++++++++++++++++++++++++++++++ 4 files changed, 58 insertions(+), 2 deletions(-) create mode 100644 src/pki/man/pki---print.8.in diff --git a/configure.ac b/configure.ac index 4d0eb8eae..af8a34b33 100644 --- a/configure.ac +++ b/configure.ac @@ -1498,6 +1498,7 @@ AC_CONFIG_FILES([ src/pki/man/pki---issue.8 src/pki/man/pki---keyid.8 src/pki/man/pki---pkcs7.8 + src/pki/man/pki---print.8 src/pki/man/pki---req.8 src/pki/man/pki---self.8 src/pki/man/pki---signcrl.8 diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index 7918975d2..7b6106543 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -6,6 +6,7 @@ man8_MANS = \ pki---signcrl.8 \ pki---req.8 \ pki---pkcs7.8 \ - pki---keyid.8 + pki---keyid.8 \ + pki---print.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 5faa321be..1a6a24c51 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -76,4 +76,5 @@ Verify a certificate using a CA certificate. .BR pki\ \-\-signcrl (8), .BR pki\ \-\-req (8), .BR pki\ \-\-pkcs7 (8), -.BR pki\ \-\-keyid (8) +.BR pki\ \-\-keyid (8), +.BR pki\ \-\-print (8) diff --git a/src/pki/man/pki---print.8.in b/src/pki/man/pki---print.8.in new file mode 100644 index 000000000..7242c5301 --- /dev/null +++ b/src/pki/man/pki---print.8.in @@ -0,0 +1,53 @@ +.TH "PKI \-\-PRINT" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-print \- Print a credential (key, certificate etc.) in human readable form +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-print +.OP \-\-in file +.OP \-\-type type +.OP \-\-debug level +.YS +. +.SY pki\ \-\-print +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-print" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +prints credentials (keys, certificates etc.) in human readable form. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-i, \-\-in " file +Input file. If not given the input is read from \fISTDIN\fR. +.TP +.BI "\-t, \-\-type " type +Type of input. One of \fIrsa-priv\fR (RSA private key), \fIecdsa-priv\fR (ECDSA +private key), \fIpub\fR (public key), \fIx509\fR (X.509 certificate), \fIcrl\fR +(Certificate Revocation List, CRL), defaults to \fIx509\fR. +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From 4adeaa5eb96346582c237fde181252e9f07ce683 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 17:46:40 +0200 Subject: [PATCH 12/16] pki: Add pki --pub man page --- configure.ac | 1 + src/pki/commands/pub.c | 4 +- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---pub.8.in | 75 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 82 insertions(+), 4 deletions(-) create mode 100644 src/pki/man/pki---pub.8.in diff --git a/configure.ac b/configure.ac index af8a34b33..beca13c80 100644 --- a/configure.ac +++ b/configure.ac @@ -1499,6 +1499,7 @@ AC_CONFIG_FILES([ src/pki/man/pki---keyid.8 src/pki/man/pki---pkcs7.8 src/pki/man/pki---print.8 + src/pki/man/pki---pub.8 src/pki/man/pki---req.8 src/pki/man/pki---self.8 src/pki/man/pki---signcrl.8 diff --git a/src/pki/commands/pub.c b/src/pki/commands/pub.c index 9912061f4..5a658afec 100644 --- a/src/pki/commands/pub.c +++ b/src/pki/commands/pub.c @@ -158,13 +158,13 @@ static void __attribute__ ((constructor))reg() pub, 'p', "pub", "extract the public key from a private key/certificate", {"[--in file|--keyid hex] [--type rsa|ecdsa|pkcs10|x509]", - "[--outform der|pem|pgp|dnskey]"}, + "[--outform der|pem|dnskey]"}, { {"help", 'h', 0, "show usage information"}, {"in", 'i', 1, "input file, default: stdin"}, {"keyid", 'x', 1, "keyid on smartcard of private key"}, {"type", 't', 1, "type of credential, default: rsa"}, - {"outform", 'f', 1, "encoding of extracted public key"}, + {"outform", 'f', 1, "encoding of extracted public key, default: der"}, } }); } diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index 7b6106543..a4c092bb3 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -7,6 +7,7 @@ man8_MANS = \ pki---req.8 \ pki---pkcs7.8 \ pki---keyid.8 \ - pki---print.8 + pki---print.8 \ + pki---pub.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 1a6a24c51..cea88a3a9 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -77,4 +77,5 @@ Verify a certificate using a CA certificate. .BR pki\ \-\-req (8), .BR pki\ \-\-pkcs7 (8), .BR pki\ \-\-keyid (8), -.BR pki\ \-\-print (8) +.BR pki\ \-\-print (8), +.BR pki\ \-\-pub (8) diff --git a/src/pki/man/pki---pub.8.in b/src/pki/man/pki---pub.8.in new file mode 100644 index 000000000..38e751655 --- /dev/null +++ b/src/pki/man/pki---pub.8.in @@ -0,0 +1,75 @@ +.TH "PKI \-\-PUB" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-pub \- Extract a public key from a private key or certificate +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-pub +.RB [ \-\-in +.IR file | \fB\-\-keyid\fR +.IR hex ] +.OP \-\-type type +.OP \-\-outform encoding +.OP \-\-debug level +.YS +. +.SY pki\ \-\-pub +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-pub" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +extracts public keys from a private keys and certificates. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-i, \-\-in " file +Input file. If not given the input is read from \fISTDIN\fR. +.TP +.BI "\-t, \-\-type " type +Type of input. One of \fIrsa\fR (RSA private key), \fIecdsa\fR (ECDSA +private key), \fIpkcs10\fR (PKCS#10 certificate request), \fIx509\fR (X.509 +certificate), defaults to \fIrsa\fR. +.TP +.BI "\-f, \-\-outform " encoding +Encoding of the extracted public key. One of \fIder\fR (ASN.1 DER), \fIpem\fR +(Base64 PEM), or \fIdnskey\fR (RFC 3110 DNS key), defaults to \fIder\fR. +. +.SH "EXAMPLES" +. +Extract the public key from an RSA private key: +.PP +.EX + ipsec pki --pub --in key.der > pub.der +.EE +.PP +Extract the public key from an X.509 certificate: +.PP +.EX + ipsec pki --pub --in cert.der --type x509 > pub.der +.EE +.PP +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From b068c4ec9de71acddf4f339b222a87410b000a56 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Aug 2013 17:52:28 +0200 Subject: [PATCH 13/16] pki: Add pki --verify man page --- configure.ac | 1 + src/pki/commands/verify.c | 3 +- src/pki/man/Makefile.am | 3 +- src/pki/man/ipsec-pki.8.in | 3 +- src/pki/man/pki---verify.8.in | 56 +++++++++++++++++++++++++++++++++++ 5 files changed, 62 insertions(+), 4 deletions(-) create mode 100644 src/pki/man/pki---verify.8.in diff --git a/configure.ac b/configure.ac index beca13c80..9b5a81826 100644 --- a/configure.ac +++ b/configure.ac @@ -1503,6 +1503,7 @@ AC_CONFIG_FILES([ src/pki/man/pki---req.8 src/pki/man/pki---self.8 src/pki/man/pki---signcrl.8 + src/pki/man/pki---verify.8 ]) AC_OUTPUT diff --git a/src/pki/commands/verify.c b/src/pki/commands/verify.c index 3e983d3ec..11c596d78 100644 --- a/src/pki/commands/verify.c +++ b/src/pki/commands/verify.c @@ -125,7 +125,7 @@ static void __attribute__ ((constructor))reg() command_register((command_t) { verify, 'v', "verify", "verify a certificate using the CA certificate", - {"[--in file] [--ca file]"}, + {"[--in file] [--cacert file]"}, { {"help", 'h', 0, "show usage information"}, {"in", 'i', 1, "X.509 certificate to verify, default: stdin"}, @@ -133,4 +133,3 @@ static void __attribute__ ((constructor))reg() } }); } - diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index a4c092bb3..769f05287 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -8,6 +8,7 @@ man8_MANS = \ pki---pkcs7.8 \ pki---keyid.8 \ pki---print.8 \ - pki---pub.8 + pki---pub.8 \ + pki---verify.8 CLEANFILES = $(man8_MANS) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index cea88a3a9..787a35037 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -78,4 +78,5 @@ Verify a certificate using a CA certificate. .BR pki\ \-\-pkcs7 (8), .BR pki\ \-\-keyid (8), .BR pki\ \-\-print (8), -.BR pki\ \-\-pub (8) +.BR pki\ \-\-pub (8), +.BR pki\ \-\-verify (8) diff --git a/src/pki/man/pki---verify.8.in b/src/pki/man/pki---verify.8.in new file mode 100644 index 000000000..39c46e6cb --- /dev/null +++ b/src/pki/man/pki---verify.8.in @@ -0,0 +1,56 @@ +.TH "PKI \-\-VERIFY" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +. +.SH "NAME" +. +pki \-\-verify \- Verify a certificate using a CA certificate +. +.SH "SYNOPSIS" +. +.SY pki\ \-\-verify +.OP \-\-in file +.OP \-\-cacert file +.OP \-\-debug level +.YS +. +.SY pki\ \-\-verify +.BI \-\-options\~ file +.YS +. +.SY "pki \-\-verify" +.B \-h +| +.B \-\-help +.YS +. +.SH "DESCRIPTION" +. +This sub-command of +.BR ipsec\-pki (8) +verifies a certificate using an optional CA certificate. +. +.SH "OPTIONS" +. +.TP +.B "\-h, \-\-help" +Print usage information with a summary of the available options. +.TP +.BI "\-v, \-\-debug " level +Set debug level, default: 1. +.TP +.BI "\-+, \-\-options " file +Read command line options from \fIfile\fR. +.TP +.BI "\-i, \-\-in " file +X.509 certificate to verify. If not given it is read from \fISTDIN\fR. +.TP +.BI "\-c, \-\-cacert " file +CA certificate to use. If not given the certificate is assumed to be +self-signed. +. +.SH "EXIT STATUS" +The exit status is 0 if the certificate was verified successfully, and 2 if +the verification failed. +. +.SH "SEE ALSO" +. +.BR ipsec\-pki (8) \ No newline at end of file From 1a8ffea3150039bb858c875889e0610c40e00173 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 14 Aug 2013 16:00:28 +0200 Subject: [PATCH 14/16] pki: Add example commands to setup a simple CA --- src/pki/man/ipsec-pki.8.in | 75 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/ipsec-pki.8.in index 787a35037..9962250d9 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/ipsec-pki.8.in @@ -67,6 +67,81 @@ Extract a public key from a private key or certificate. .B "\-v, \-\-verify" Verify a certificate using a CA certificate. . +.SH "EXAMPLES" +. +.SS "Generating a CA Certificate" +. +The first step is to generate a private key using the +.B \-\-gen +command. By default this generates a 2048-bit RSA key. +.PP +.EX + ipsec pki \-\-gen > ca_key.der +.EE +.PP +This key is used to create the self-signed CA certificate, using the +.B \-\-self +command. The distinguished name should be adjusted to your needs. +.PP +.EX + ipsec pki \-\-self \-\-ca \-\-in ca_key.der \\ + \-\-dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der +.EE +.PP +. +.SS "Generating End-Entity Certificates" +. +With the root CA certificate and key at hand end-entity certificates for clients +and servers can be issued. Similarly intermediate CA certificates can be issued, +which in turn can issue other certificates. +To generate a certificate for a server, we start by generating a private key. +.PP +.EX + ipsec pki \-\-gen > server_key.der +.EE +.PP +The public key will be included in the certificate so lets extract that from the +private key. +.PP +.EX + ipsec pki \-\-pub \-\-in server_key.der > server_pub.der +.EE +.PP +The following command will use the CA certificate and private key to issue the +certificate for this server. Adjust the distinguished name, subjectAltName(s) +and flags as needed (check +.BR pki\ \-\-issue (8) +for more options). +.PP +.EX + ipsec pki \-\-issue \-\-in server_pub.der \-\-cacert ca_cert.der \\ + \-\-cakey ca_key.der \-\-dn "C=CH, O=strongSwan, CN=VPN Server" \\ + \-\-san vpn.strongswan.org \-\-flag serverAuth > server_cert.der +.EE +.PP +Instead of storing the public key in a separate +file, the output of +.B \-\-pub +may also be piped directly into the above command. +. +.SS "Generating Certificate Revocation Lists (CRL)" +. +If end-entity certificates have to be revoked, CRLs may be generated using +the +.B \-\-signcrl +command. +.PP +.EX + ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ + \-\-reason superseded \-\-cert server_cert.der > crl.der +.EE +.PP +The certificate given with \-\-cacert must be either a CA certificate or a +certificate with the +.I crlSign +extended key usage (\-\-flag crlSign). URIs to CRLs may be included in issued +certificates with the \-\-crl option. +. .SH "SEE ALSO" . .BR ipsec (8), From 0dc8ba87794503d312e60b770e5320626a129cf3 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 13 Sep 2013 14:52:14 +0200 Subject: [PATCH 15/16] pki: Install pki(1) as utility directly in $prefix/bin ipsec pki is maintained as alias. --- configure.ac | 22 ++++---- src/ipsec/Android.mk | 1 + src/ipsec/Makefile.am | 1 + src/ipsec/_ipsec.in | 9 +++- src/pki/Makefile.am | 2 +- src/pki/man/Makefile.am | 26 +++++----- .../man/{pki---gen.8.in => pki---gen.1.in} | 10 ++-- .../{pki---issue.8.in => pki---issue.1.in} | 6 +-- .../{pki---keyid.8.in => pki---keyid.1.in} | 10 ++-- .../{pki---pkcs7.8.in => pki---pkcs7.1.in} | 6 +-- .../{pki---print.8.in => pki---print.1.in} | 6 +-- .../man/{pki---pub.8.in => pki---pub.1.in} | 10 ++-- .../man/{pki---req.8.in => pki---req.1.in} | 14 ++--- .../man/{pki---self.8.in => pki---self.1.in} | 10 ++-- ...{pki---signcrl.8.in => pki---signcrl.1.in} | 14 ++--- .../{pki---verify.8.in => pki---verify.1.in} | 6 +-- src/pki/man/{ipsec-pki.8.in => pki.1.in} | 51 +++++++++---------- 17 files changed, 105 insertions(+), 99 deletions(-) rename src/pki/man/{pki---gen.8.in => pki---gen.1.in} (91%) rename src/pki/man/{pki---issue.8.in => pki---issue.1.in} (97%) rename src/pki/man/{pki---keyid.8.in => pki---keyid.1.in} (88%) rename src/pki/man/{pki---pkcs7.8.in => pki---pkcs7.1.in} (92%) rename src/pki/man/{pki---print.8.in => pki---print.1.in} (90%) rename src/pki/man/{pki---pub.8.in => pki---pub.1.in} (87%) rename src/pki/man/{pki---req.8.in => pki---req.1.in} (83%) rename src/pki/man/{pki---self.8.in => pki---self.1.in} (93%) rename src/pki/man/{pki---signcrl.8.in => pki---signcrl.1.in} (88%) rename src/pki/man/{pki---verify.8.in => pki---verify.1.in} (90%) rename src/pki/man/{ipsec-pki.8.in => pki.1.in} (74%) diff --git a/configure.ac b/configure.ac index 9b5a81826..2d1762c77 100644 --- a/configure.ac +++ b/configure.ac @@ -1493,17 +1493,17 @@ AC_CONFIG_FILES([ man/ipsec.secrets.5 man/strongswan.conf.5 src/charon-cmd/charon-cmd.8 - src/pki/man/ipsec-pki.8 - src/pki/man/pki---gen.8 - src/pki/man/pki---issue.8 - src/pki/man/pki---keyid.8 - src/pki/man/pki---pkcs7.8 - src/pki/man/pki---print.8 - src/pki/man/pki---pub.8 - src/pki/man/pki---req.8 - src/pki/man/pki---self.8 - src/pki/man/pki---signcrl.8 - src/pki/man/pki---verify.8 + src/pki/man/pki.1 + src/pki/man/pki---gen.1 + src/pki/man/pki---issue.1 + src/pki/man/pki---keyid.1 + src/pki/man/pki---pkcs7.1 + src/pki/man/pki---print.1 + src/pki/man/pki---pub.1 + src/pki/man/pki---req.1 + src/pki/man/pki---self.1 + src/pki/man/pki---signcrl.1 + src/pki/man/pki---verify.1 ]) AC_OUTPUT diff --git a/src/ipsec/Android.mk b/src/ipsec/Android.mk index c25be3ebc..3936f7af9 100644 --- a/src/ipsec/Android.mk +++ b/src/ipsec/Android.mk @@ -19,6 +19,7 @@ $(GEN) : PRIVATE_CUSTOM_TOOL = sed \ -e "s:@IPSEC_DISTRO@::" \ -e "s:@IPSEC_DIR@:$(strongswan_DIR):" \ -e "s:@IPSEC_SCRIPT@:ipsec:" \ + -e "s:@IPSEC_BINDIR@:$(strongswan_DIR):" \ -e "s:@IPSEC_SBINDIR@:$(strongswan_SBINDIR):" \ -e "s:@IPSEC_CONFDIR@:$(strongswan_CONFDIR):" \ -e "s:@IPSEC_PIDDIR@:$(strongswan_PIDDIR):" \ diff --git a/src/ipsec/Makefile.am b/src/ipsec/Makefile.am index 73427c0fa..71f2d150b 100644 --- a/src/ipsec/Makefile.am +++ b/src/ipsec/Makefile.am @@ -20,6 +20,7 @@ _ipsec : _ipsec.in -e "s:@IPSEC_DISTRO@::" \ -e "s:@IPSEC_DIR@:$(ipsecdir):" \ -e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \ + -e "s:@IPSEC_BINDIR@:$(bindir):" \ -e "s:@IPSEC_SBINDIR@:$(sbindir):" \ -e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \ -e "s:@IPSEC_PIDDIR@:$(piddir):" \ diff --git a/src/ipsec/_ipsec.in b/src/ipsec/_ipsec.in index 03ddb744d..3c1f99825 100644 --- a/src/ipsec/_ipsec.in +++ b/src/ipsec/_ipsec.in @@ -15,7 +15,7 @@ # for more details. # define a minimum PATH environment in case it is not set -PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@" +PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@:@IPSEC_BINDIR@" export PATH # set daemon name @@ -28,6 +28,7 @@ IPSEC_VERSION="U@IPSEC_VERSION@/K`uname -r`" # where the private directory and the config files are IPSEC_DIR="@IPSEC_DIR@" +IPSEC_BINDIR="@IPSEC_BINDIR@" IPSEC_SBINDIR="@IPSEC_SBINDIR@" IPSEC_CONFDIR="@IPSEC_CONFDIR@" IPSEC_PIDDIR="@IPSEC_PIDDIR@" @@ -39,7 +40,7 @@ IPSEC_CHARON_PID="${IPSEC_PIDDIR}/${DAEMON_NAME}.pid" IPSEC_STROKE="${IPSEC_DIR}/stroke" IPSEC_STARTER="${IPSEC_DIR}/starter" -export IPSEC_DIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID +export IPSEC_DIR IPSEC_BINDIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID IPSEC_DISTRO="Institute for Internet Technologies and Applications\nUniversity of Applied Sciences Rapperswil, Switzerland" @@ -313,6 +314,10 @@ update) exit 7 fi ;; +pki) + shift + exec $IPSEC_BINDIR/pki "$@" + ;; version|--version) printf "$OS_NAME $IPSEC_NAME $IPSEC_VERSION\n" printf "$IPSEC_DISTRO\n" diff --git a/src/pki/Makefile.am b/src/pki/Makefile.am index 783515249..efbed9b2b 100644 --- a/src/pki/Makefile.am +++ b/src/pki/Makefile.am @@ -1,6 +1,6 @@ SUBDIRS = man -ipsec_PROGRAMS = pki +bin_PROGRAMS = pki pki_SOURCES = pki.c pki.h command.c command.h \ commands/gen.c \ diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am index 769f05287..618bd4093 100644 --- a/src/pki/man/Makefile.am +++ b/src/pki/man/Makefile.am @@ -1,14 +1,14 @@ -man8_MANS = \ - ipsec-pki.8 \ - pki---gen.8 \ - pki---self.8 \ - pki---issue.8 \ - pki---signcrl.8 \ - pki---req.8 \ - pki---pkcs7.8 \ - pki---keyid.8 \ - pki---print.8 \ - pki---pub.8 \ - pki---verify.8 +man1_MANS = \ + pki.1 \ + pki---gen.1 \ + pki---self.1 \ + pki---issue.1 \ + pki---signcrl.1 \ + pki---req.1 \ + pki---pkcs7.1 \ + pki---keyid.1 \ + pki---print.1 \ + pki---pub.1 \ + pki---verify.1 -CLEANFILES = $(man8_MANS) +CLEANFILES = $(man1_MANS) diff --git a/src/pki/man/pki---gen.8.in b/src/pki/man/pki---gen.1.in similarity index 91% rename from src/pki/man/pki---gen.8.in rename to src/pki/man/pki---gen.1.in index 9590046cc..138ab6122 100644 --- a/src/pki/man/pki---gen.8.in +++ b/src/pki/man/pki---gen.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-GEN" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-GEN" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -29,7 +29,7 @@ pki \-\-gen \- Generate a new RSA or ECDSA private key .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) is used to generate a new RSA or ECDSA private key. . .SH "OPTIONS" @@ -100,13 +100,13 @@ of lower quality. .SH "EXAMPLES" . .TP -.B ipsec pki \-\-gen \-\-size 3072 > rsa_key.der +.B pki \-\-gen \-\-size 3072 > rsa_key.der Generates a 3072-bit RSA private key. . .TP -.B ipsec pki \-\-gen \-\-type ecdsa \-\-size 256 > ecdsa_key.der +.B pki \-\-gen \-\-type ecdsa \-\-size 256 > ecdsa_key.der Generates a 256-bit ECDSA private key. . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) diff --git a/src/pki/man/pki---issue.8.in b/src/pki/man/pki---issue.1.in similarity index 97% rename from src/pki/man/pki---issue.8.in rename to src/pki/man/pki---issue.1.in index 6c9f85e17..9effd9b15 100644 --- a/src/pki/man/pki---issue.8.in +++ b/src/pki/man/pki---issue.1.in @@ -45,7 +45,7 @@ pki \-\-issue \- Issue a certificate using a CA certificate and key .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) is used to issue a certificate using a CA certificate and private key. . .SH "OPTIONS" @@ -170,10 +170,10 @@ Then the following command can be used to issue a certificate based on a given PKCS#10 certificate request and the options above: .PP .EX - ipsec pki --issue --options pki.opt --in req.der > cert.der + pki --issue --options pki.opt --in req.der > cert.der .EE .PP . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---keyid.8.in b/src/pki/man/pki---keyid.1.in similarity index 88% rename from src/pki/man/pki---keyid.8.in rename to src/pki/man/pki---keyid.1.in index a4a6c9d4a..490f7afea 100644 --- a/src/pki/man/pki---keyid.8.in +++ b/src/pki/man/pki---keyid.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-KEYID" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-KEYID" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -25,7 +25,7 @@ pki \-\-keyid \- Calculate key identifiers of a key or certificate .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) calculates key identifiers of private keys and certificates. . .SH "OPTIONS" @@ -53,7 +53,7 @@ request), \fIx509\fR (X.509 certificate), defaults to \fIrsa-priv\fR. Calculate key identifiers of an RSA private key: .PP .EX - ipsec pki --keyid --in key.der + pki --keyid --in key.der subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1... subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1... .EE @@ -61,7 +61,7 @@ Calculate key identifiers of an RSA private key: Calculate key identifiers of an X.509 certificate: .PP .EX - ipsec pki --keyid --in cert.der --type x509 + pki --keyid --in cert.der --type x509 subjectKeyIdentifier: 6a:9c:74:d1:f8:89:79:89:f6:5a:94:e9:89:f1... subjectPublicKeyInfo hash: 6e:55:dc:7e:9c:a5:58:d9:5b:e3:c7:13:14:e1... .EE @@ -69,4 +69,4 @@ Calculate key identifiers of an X.509 certificate: . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---pkcs7.8.in b/src/pki/man/pki---pkcs7.1.in similarity index 92% rename from src/pki/man/pki---pkcs7.8.in rename to src/pki/man/pki---pkcs7.1.in index c500ca288..38186cf70 100644 --- a/src/pki/man/pki---pkcs7.8.in +++ b/src/pki/man/pki---pkcs7.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-PKCS7" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-PKCS7" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -27,7 +27,7 @@ pki \-\-pkcs7 \- Provides PKCS#7 wrap/unwrap functions .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) provides functions to wrap/unwrap PKCS#7 containers. . .SH "OPTIONS" @@ -76,4 +76,4 @@ Can be used multiple times. . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---print.8.in b/src/pki/man/pki---print.1.in similarity index 90% rename from src/pki/man/pki---print.8.in rename to src/pki/man/pki---print.1.in index 7242c5301..8d3345edc 100644 --- a/src/pki/man/pki---print.8.in +++ b/src/pki/man/pki---print.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-PRINT" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-PRINT" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -25,7 +25,7 @@ pki \-\-print \- Print a credential (key, certificate etc.) in human readable fo .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) prints credentials (keys, certificates etc.) in human readable form. . .SH "OPTIONS" @@ -50,4 +50,4 @@ private key), \fIpub\fR (public key), \fIx509\fR (X.509 certificate), \fIcrl\fR . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---pub.8.in b/src/pki/man/pki---pub.1.in similarity index 87% rename from src/pki/man/pki---pub.8.in rename to src/pki/man/pki---pub.1.in index 38e751655..d588ae732 100644 --- a/src/pki/man/pki---pub.8.in +++ b/src/pki/man/pki---pub.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-PUB" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-PUB" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -28,7 +28,7 @@ pki \-\-pub \- Extract a public key from a private key or certificate .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) extracts public keys from a private keys and certificates. . .SH "OPTIONS" @@ -60,16 +60,16 @@ Encoding of the extracted public key. One of \fIder\fR (ASN.1 DER), \fIpem\fR Extract the public key from an RSA private key: .PP .EX - ipsec pki --pub --in key.der > pub.der + pki --pub --in key.der > pub.der .EE .PP Extract the public key from an X.509 certificate: .PP .EX - ipsec pki --pub --in cert.der --type x509 > pub.der + pki --pub --in cert.der --type x509 > pub.der .EE .PP . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---req.8.in b/src/pki/man/pki---req.1.in similarity index 83% rename from src/pki/man/pki---req.8.in rename to src/pki/man/pki---req.1.in index 9986f7feb..ab144ce2a 100644 --- a/src/pki/man/pki---req.8.in +++ b/src/pki/man/pki---req.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-REQ" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-REQ" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -30,7 +30,7 @@ pki \-\-req \- Create a PKCS#10 certificate request .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) is used to create a PKCS#10 certificate request. . .SH "OPTIONS" @@ -74,18 +74,18 @@ Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or Generate a certificate request for an RSA key, with a subjectAltName extension: .PP .EX - ipsec pki \-\-req \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ - \-\-san moon@strongswan.org > req.der + pki \-\-req \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ + \-\-san moon@strongswan.org > req.der .EE .PP Generate a certificate request for an ECDSA key and a different digest: .PP .EX - ipsec pki \-\-req \-\-in key.der \-\-type ecdsa \-\-digest sha256 \\ - \-\-dn "C=CH, O=strongSwan, CN=carol" > req.der + pki \-\-req \-\-in key.der \-\-type ecdsa \-\-digest sha256 \\ + \-\-dn "C=CH, O=strongSwan, CN=carol" > req.der .EE .PP . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---self.8.in b/src/pki/man/pki---self.1.in similarity index 93% rename from src/pki/man/pki---self.8.in rename to src/pki/man/pki---self.1.in index ad0c35c64..ee42cf9a0 100644 --- a/src/pki/man/pki---self.8.in +++ b/src/pki/man/pki---self.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-SELF" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-SELF" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -44,7 +44,7 @@ pki \-\-self \- Create a self-signed certificate .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) is used to create a self-signed certificate. . .SH "OPTIONS" @@ -139,10 +139,10 @@ User notice for certificatePolicy. Generate a self-signed certificate using the given RSA key: .PP .EX - ipsec pki \-\-self \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ - \-\-san moon.strongswan.org > cert.der + pki \-\-self \-\-in key.der \-\-dn "C=CH, O=strongSwan, CN=moon" \\ + \-\-san moon.strongswan.org > cert.der .EE . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---signcrl.8.in b/src/pki/man/pki---signcrl.1.in similarity index 88% rename from src/pki/man/pki---signcrl.8.in rename to src/pki/man/pki---signcrl.1.in index 7d67c4945..6ba96f6bc 100644 --- a/src/pki/man/pki---signcrl.8.in +++ b/src/pki/man/pki---signcrl.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-SIGNCRL" 8 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-SIGNCRL" 1 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -32,7 +32,7 @@ pki \-\-signcrl \- Issue a Certificate Revocation List (CRL) using a CA certific .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) is used to issue a Certificate Revocation List (CRL) using a CA certificate and private key. . @@ -107,18 +107,18 @@ Hexadecimal encoded serial number of the certificate to revoke. Revoke a certificate: .PP .EX - ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ - \-\-reason superseded \-\-cert cert.der > crl.der + pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ + \-\-reason superseded \-\-cert cert.der > crl.der .EE .PP Update an existing CRL with two new revocations, using the certificate's serial number, but no reason: .PP .EX - ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ - \-\-lastcrl old_crl.der \-\-serial 0123 \-\-serial 0345 > crl.der + pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ + \-\-lastcrl old_crl.der \-\-serial 0123 \-\-serial 0345 > crl.der .EE .PP .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/pki---verify.8.in b/src/pki/man/pki---verify.1.in similarity index 90% rename from src/pki/man/pki---verify.8.in rename to src/pki/man/pki---verify.1.in index 39c46e6cb..de34acad4 100644 --- a/src/pki/man/pki---verify.8.in +++ b/src/pki/man/pki---verify.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-VERIFY" 8 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-VERIFY" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -25,7 +25,7 @@ pki \-\-verify \- Verify a certificate using a CA certificate .SH "DESCRIPTION" . This sub-command of -.BR ipsec\-pki (8) +.BR pki (1) verifies a certificate using an optional CA certificate. . .SH "OPTIONS" @@ -53,4 +53,4 @@ the verification failed. . .SH "SEE ALSO" . -.BR ipsec\-pki (8) \ No newline at end of file +.BR pki (1) \ No newline at end of file diff --git a/src/pki/man/ipsec-pki.8.in b/src/pki/man/pki.1.in similarity index 74% rename from src/pki/man/ipsec-pki.8.in rename to src/pki/man/pki.1.in index 9962250d9..8dfc53af3 100644 --- a/src/pki/man/ipsec-pki.8.in +++ b/src/pki/man/pki.1.in @@ -1,17 +1,17 @@ -.TH IPSEC\-PKI 8 "2013-07-30" "@PACKAGE_VERSION@" "strongSwan" +.TH PKI 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . -ipsec pki \- Simple public key infrastructure (PKI) management tool +pki \- Simple public key infrastructure (PKI) management tool . .SH "SYNOPSIS" . -.SY "ipsec pki" +.SY "pki" .I command .RI [ option\~ .\|.\|.] .YS . -.SY "ipsec pki" +.SY "pki" .B \-h | .B \-\-help @@ -19,7 +19,7 @@ ipsec pki \- Simple public key infrastructure (PKI) management tool . .SH "DESCRIPTION" . -.B ipsec pki +.B pki is a suite of commands that allow you to manage a simple public key infrastructure (PKI). .P @@ -76,7 +76,7 @@ The first step is to generate a private key using the command. By default this generates a 2048-bit RSA key. .PP .EX - ipsec pki \-\-gen > ca_key.der + pki \-\-gen > ca_key.der .EE .PP This key is used to create the self-signed CA certificate, using the @@ -84,8 +84,8 @@ This key is used to create the self-signed CA certificate, using the command. The distinguished name should be adjusted to your needs. .PP .EX - ipsec pki \-\-self \-\-ca \-\-in ca_key.der \\ - \-\-dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der + pki \-\-self \-\-ca \-\-in ca_key.der \\ + \-\-dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der .EE .PP . @@ -97,14 +97,14 @@ which in turn can issue other certificates. To generate a certificate for a server, we start by generating a private key. .PP .EX - ipsec pki \-\-gen > server_key.der + pki \-\-gen > server_key.der .EE .PP The public key will be included in the certificate so lets extract that from the private key. .PP .EX - ipsec pki \-\-pub \-\-in server_key.der > server_pub.der + pki \-\-pub \-\-in server_key.der > server_pub.der .EE .PP The following command will use the CA certificate and private key to issue the @@ -114,9 +114,9 @@ and flags as needed (check for more options). .PP .EX - ipsec pki \-\-issue \-\-in server_pub.der \-\-cacert ca_cert.der \\ - \-\-cakey ca_key.der \-\-dn "C=CH, O=strongSwan, CN=VPN Server" \\ - \-\-san vpn.strongswan.org \-\-flag serverAuth > server_cert.der + pki \-\-issue \-\-in server_pub.der \-\-cacert ca_cert.der \\ + \-\-cakey ca_key.der \-\-dn "C=CH, O=strongSwan, CN=VPN Server" \\ + \-\-san vpn.strongswan.org \-\-flag serverAuth > server_cert.der .EE .PP Instead of storing the public key in a separate @@ -132,8 +132,8 @@ the command. .PP .EX - ipsec pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ - \-\-reason superseded \-\-cert server_cert.der > crl.der + pki \-\-signcrl \-\-cacert ca_cert.der \-\-cakey ca_key.der \\ + \-\-reason superseded \-\-cert server_cert.der > crl.der .EE .PP The certificate given with \-\-cacert must be either a CA certificate or a @@ -144,14 +144,13 @@ certificates with the \-\-crl option. . .SH "SEE ALSO" . -.BR ipsec (8), -.BR pki\ \-\-gen (8), -.BR pki\ \-\-self (8), -.BR pki\ \-\-issue (8), -.BR pki\ \-\-signcrl (8), -.BR pki\ \-\-req (8), -.BR pki\ \-\-pkcs7 (8), -.BR pki\ \-\-keyid (8), -.BR pki\ \-\-print (8), -.BR pki\ \-\-pub (8), -.BR pki\ \-\-verify (8) +.BR pki\ \-\-gen (1), +.BR pki\ \-\-self (1), +.BR pki\ \-\-issue (1), +.BR pki\ \-\-signcrl (1), +.BR pki\ \-\-req (1), +.BR pki\ \-\-pkcs7 (1), +.BR pki\ \-\-keyid (1), +.BR pki\ \-\-print (1), +.BR pki\ \-\-pub (1), +.BR pki\ \-\-verify (1) From ed56c86ec1098d62f65580bb4889fb10cc1998cf Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 13 Sep 2013 15:14:00 +0200 Subject: [PATCH 16/16] pki: Don't print an error if no arguments are given --- src/pki/command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pki/command.c b/src/pki/command.c index a5e5b8528..984da59b4 100644 --- a/src/pki/command.c +++ b/src/pki/command.c @@ -258,6 +258,6 @@ int command_dispatch(int c, char *v[]) return cmds[i].call(); } } - return command_usage("invalid operation"); + return command_usage(c > 1 ? "invalid operation" : NULL); }