Table of Contents for

Network Security with OpenSSL

Specify the name of a file to be used as a configuration file. If omitted, the system-wide default configuration file is used. Use of this option overrides the OPENSSL_CONF environment variable.

Cause more information to be displayed than normal.

Specify the name of a section in the configuration file being used that contains the default settings for the CA. The default is to use the section specified by the default_ca key in the ca section of the configuration file.

Specify the name of a file containing a certificate request to be signed by the CA, causing a certificate to be created.

Specify the name of a file containing a self-signed certificate to be signed by the CA.

Specify the name of a file containing a Netscape Signed Public Key and Challenge.

If this option is present, it must be the last option on the command line. Each argument after it is assumed to be a file containing a certificate request to be signed by the CA, and certificates will be created for each one.

Specify the name of a file to write the certificate or certificates created by the CA to. The default is to write certificates to stdout. If the gencrl option is used, this option specifies the name of the file to which the generated certificate revocation list will be written.

Specify the directory where certificates will be written. Each certificate that is issued will be written with a filename composed of the certificates serial number in hexadecimal and an extension of “.pem”. This option overrides the configuration file’s new_certs_dir key.

Specify the name of the file containing the CA’s certificate. This option overrides the configuration file’s certificate key.

Specify the name of the file containing the CA’s private key. This option overrides the configuration file’s private_key key.

Specify the password that is required to decrypt the CA’s private key. This option does not conform to the guidelines outlined in Chapter 2 for passwords and passphrases. Use of this option is not recommended. The passin option should be used instead.

Specify the password or passphrase that is required to decrypt the CA’s private key. The password or passphrase specified with this option follows the guidelines outlined in Chapter 2.

Cause the text form of a certificate to be excluded from the output file.

Specify the start date on which the issued certificate or certificates will be valid. If this option is omitted, the default is to use the current system time. This option overrides the configuration file’s default_startdate key.

Specify the end date on which the issued certificate or certificates will be valid. If this option is omitted, the default is to use the start date plus the number of days specified with the days option. Use of this option will override the days option if both are used. This option overrides the configuration file’s default_enddate key.

Specify the number of days for which issued certificates will be valid. This option overrides the configuration file’s default_days key.

Specify the message digest algorithm to use. The default is to use MD5, but valid options include MD5, SHA1, and MDC2. This option overrides the configuration file’s default_md key.

Specify the name of a section in the configuration file being used that contains a policy definition to be used. This option overrides the configuration file’s policy key.

Specify this option if you need to issue certificates that will work with very old versions of the Internet Explorer certificate enrollment control “certenr3”. Avoid using this option unless you know that you absolutely need it.

Cause the order and components of the distinguished name from a certificate request to be preserved in the issued certificate. Ordinarily, the certificate will be created using only the components from the policy that is in use by the CA.

Cause verification prompts to be suppressed, allowing the command to do its work without any human intervention.

Specify the name of a section in the configuration file being used that contains the extensions to be added to certificates that are issued. If no extension section is used, an X.509v1 format certificate will be issued; otherwise, an X.509v3 certificate will be issued. This option overrides the configuration file’s x509_extensions key.

Cause a certificate revocation list to be generated.

Specify the number of days before the next certificate revocation list will be generated. This option is used to compute the date that is used to fill in the nextUpdate field. This option overrides the configuration file’s default_crl_days key.

Specify the number of hours before the next certificate revocation list will be generated. This option computes the date that is used to fill in the nextUpdate field. This option may be used in combination with the crldays option. This option overrides the configuration file’s default_crl_hours key.

Specify the name of a file containing a certificate that will be revoked.

Specify the name of a section in the configuration file being used that contains the extensions to be added to the certificate revocation list that is issued. If no extension section is used, a v1 CRL is created; otherwise, a v2 CRL is created. This option overrides the configuration file’s crl_extensions key.

Specify the name of a file that contains object identifier definitions. The format of this file is one definition per line, each line consisting of three columns. The first column is the numerical representation of the OID. The second column is the OID’s short name, which should be a single word composed of only upper- and lowercase letters. The third column is the OID’s long name, which may be composed of multiple words and characters other than letters.

Specify the name of a section that contains object identifier definitions. Key names in the section should be the OID’s short name, and the corresponding value should be the OID’s numerical representation. Long names are the same as short names for OIDs that are defined in this manner.

Specify the directory where issued certificates will be stored. This is the same as the outdir command-line option.

Specify the name of a file containing the CA’s certificate. This is the same as the cert command-line option.

Specify the name of a file containing the CA’s private key. This is the same as the keyfile command-line option.

Specify the name of a file that will be used to seed the PRNG. On Unix systems, the filename may be the name of an EGD socket.

Specify the number of days for which issued certificates will be valid. This is the same as the days command-line option.

Specify the default starting date for which issued certificates will be valid. This is the same as the startdate command-line option.

Specify the default ending date for which issued certificates will be valid. This is the same as the enddate command-line option.

Specify the default number of days until a new certificate revocation list is generated. This is the same as the crldays command-line option.

Specify the default number of hours until a new certificate revocation list is generated. This is the same as the crlhours command-line option.

Specify the default message digest to be used for signing certificates and certificate revocation lists. This is the same as the md command-line option.

Specify the name of a file that will be used to keep track of certificates that are issued by the CA. This setting is mandatory and has no corresponding command-line option.

Specify the name of a file that will be used to keep track of the next serial number that will be assigned to a certificate when it is issued. This setting is mandatory and has no corresponding command-line option.

Specify the name of a section in the configuration file that contains the set of extensions to be included in certificates that are issued by the CA. This is the same as the extensions command-line option.

Specify the name of a section in the configuration file that contains the set of extensions to be included in certificate revocation lists that are issued by the CA. This is the same as the crlexts command-line option.

If this is set to yes, the order and components of the distinguished name contained in a certificate request will be preserved in the issued certificate. This is the same as the preserveDN command-line option.

If this is set to yes, certificates that are issued will work with very old versions of the Internet Explorer certificate enrollment control “certenr3”. Avoid using this option unless you know that you absolutely need it.

Specify the name of a section in the configuration file that defines the policy for this CA. This option is the same as the policy command-line option.