From 1bc74519a2a57ef8e67484ca92890fa94d3dd66f Mon Sep 17 00:00:00 2001 From: Rich Salz Date: Fri, 20 May 2016 08:11:46 -0400 Subject: [PATCH] Fix nits in pod files. Add doc-nit-check to help find future issues. Make podchecker be almost clean. Remove trailing whitespace. Tab expansion Reviewed-by: Richard Levitte --- doc/apps/CA.pl.pod | 7 +- doc/apps/asn1parse.pod | 26 +-- doc/apps/ca.pod | 31 ++-- doc/apps/cms.pod | 50 ++--- doc/apps/config.pod | 15 +- doc/apps/crl.pod | 2 +- doc/apps/crl2pkcs7.pod | 4 +- doc/apps/dgst.pod | 2 +- doc/apps/dhparam.pod | 4 +- doc/apps/dsa.pod | 4 +- doc/apps/dsaparam.pod | 2 +- doc/apps/ec.pod | 10 +- doc/apps/ecparam.pod | 8 +- doc/apps/enc.pod | 20 +- doc/apps/engine.pod | 2 +- doc/apps/errstr.pod | 4 +- doc/apps/genpkey.pod | 14 +- doc/apps/ocsp.pod | 10 +- doc/apps/openssl.pod | 1 - doc/apps/pkcs12.pod | 3 +- doc/apps/pkcs7.pod | 4 +- doc/apps/pkey.pod | 9 +- doc/apps/pkeyparam.pod | 5 +- doc/apps/pkeyutl.pod | 6 +- doc/apps/req.pod | 93 +++++----- doc/apps/rsa.pod | 9 +- doc/apps/rsautl.pod | 34 ++-- doc/apps/s_client.pod | 5 +- doc/apps/s_server.pod | 1 - doc/apps/s_time.pod | 1 - doc/apps/sess_id.pod | 3 +- doc/apps/smime.pod | 30 +-- doc/apps/ts.pod | 16 +- doc/apps/tsget.pod | 32 ++-- doc/apps/verify.pod | 4 +- doc/apps/x509.pod | 19 +- doc/apps/x509v3_config.pod | 26 +-- doc/crypto/ASN1_STRING_length.pod | 2 - doc/crypto/ASN1_STRING_print_ex.pod | 4 +- doc/crypto/ASN1_TIME_set.pod | 2 +- doc/crypto/ASN1_generate_nconf.pod | 6 +- doc/crypto/ASYNC_start_job.pod | 2 +- doc/crypto/BIO_ctrl.pod | 6 +- doc/crypto/BIO_f_base64.pod | 8 +- doc/crypto/BIO_f_cipher.pod | 6 +- doc/crypto/BIO_f_md.pod | 20 +- doc/crypto/BIO_f_null.pod | 2 +- doc/crypto/BIO_f_ssl.pod | 82 ++++---- doc/crypto/BIO_find_type.pod | 70 +++---- doc/crypto/BIO_get_ex_new_index.pod | 6 +- doc/crypto/BIO_new.pod | 12 +- doc/crypto/BIO_new_CMS.pod | 2 +- doc/crypto/BIO_parse_hostserv.pod | 11 +- doc/crypto/BIO_read.pod | 8 +- doc/crypto/BIO_s_accept.pod | 26 +-- doc/crypto/BIO_s_bio.pod | 6 +- doc/crypto/BIO_s_connect.pod | 18 +- doc/crypto/BIO_s_fd.pod | 8 +- doc/crypto/BIO_s_file.pod | 2 +- doc/crypto/BIO_s_mem.pod | 12 +- doc/crypto/BIO_s_null.pod | 2 +- doc/crypto/BIO_set_callback.pod | 12 +- doc/crypto/BIO_should_retry.pod | 24 +-- doc/crypto/BN_BLINDING_new.pod | 20 +- doc/crypto/BN_generate_prime.pod | 2 +- doc/crypto/CMS_add0_cert.pod | 4 +- doc/crypto/CMS_add1_recipient_cert.pod | 2 +- doc/crypto/CMS_add1_signer.pod | 6 +- doc/crypto/CMS_decrypt.pod | 2 +- doc/crypto/CMS_encrypt.pod | 4 +- doc/crypto/CMS_final.pod | 4 +- doc/crypto/CMS_get0_RecipientInfos.pod | 2 +- doc/crypto/CMS_get0_SignerInfos.pod | 2 +- doc/crypto/CMS_get0_type.pod | 2 +- doc/crypto/CMS_get1_ReceiptRequest.pod | 4 +- doc/crypto/CMS_sign.pod | 4 +- doc/crypto/CMS_sign_receipt.pod | 2 +- doc/crypto/CMS_uncompress.pod | 2 +- doc/crypto/CMS_verify.pod | 8 +- doc/crypto/CMS_verify_receipt.pod | 4 +- doc/crypto/CONF_modules_free.pod | 4 +- doc/crypto/CONF_modules_load_file.pod | 6 +- doc/crypto/CRYPTO_get_ex_new_index.pod | 6 +- doc/crypto/DH_generate_parameters.pod | 3 +- doc/crypto/DSA_do_sign.pod | 2 +- doc/crypto/DSA_generate_parameters.pod | 6 +- doc/crypto/DSA_set_method.pod | 2 +- doc/crypto/DSA_sign.pod | 10 +- doc/crypto/EC_GROUP_copy.pod | 23 ++- doc/crypto/EC_GROUP_new.pod | 8 +- doc/crypto/ERR_load_crypto_strings.pod | 2 +- doc/crypto/EVP_BytesToKey.pod | 2 +- doc/crypto/EVP_CIPHER_meth_new.pod | 49 ++--- doc/crypto/EVP_DigestInit.pod | 14 +- doc/crypto/EVP_DigestSignInit.pod | 6 +- doc/crypto/EVP_DigestVerifyInit.pod | 6 +- doc/crypto/EVP_EncryptInit.pod | 186 +++++++++---------- doc/crypto/EVP_OpenInit.pod | 4 +- doc/crypto/EVP_PKEY_CTX_ctrl.pod | 4 +- doc/crypto/EVP_PKEY_cmp.pod | 2 +- doc/crypto/EVP_PKEY_decrypt.pod | 22 +-- doc/crypto/EVP_PKEY_derive.pod | 14 +- doc/crypto/EVP_PKEY_encrypt.pod | 22 +-- doc/crypto/EVP_PKEY_keygen.pod | 44 ++--- doc/crypto/EVP_PKEY_print_private.pod | 10 +- doc/crypto/EVP_PKEY_sign.pod | 22 +-- doc/crypto/EVP_PKEY_verify.pod | 16 +- doc/crypto/EVP_PKEY_verify_recover.pod | 26 +-- doc/crypto/EVP_SealInit.pod | 4 +- doc/crypto/EVP_SignInit.pod | 4 +- doc/crypto/EVP_VerifyInit.pod | 4 +- doc/crypto/OBJ_nid2obj.pod | 10 +- doc/crypto/OCSP_response_status.pod | 2 +- doc/crypto/OPENSSL_load_builtin_modules.pod | 6 +- doc/crypto/OPENSSL_malloc.pod | 8 +- doc/crypto/OPENSSL_secure_malloc.pod | 2 +- doc/crypto/PEM_write_bio_CMS_stream.pod | 2 +- doc/crypto/PKCS12_create.pod | 4 +- doc/crypto/PKCS5_PBKDF2_HMAC.pod | 6 +- doc/crypto/PKCS7_encrypt.pod | 4 +- doc/crypto/PKCS7_sign.pod | 2 +- doc/crypto/PKCS7_sign_add_signer.pod | 4 +- doc/crypto/PKCS7_verify.pod | 4 +- doc/crypto/RAND_set_rand_method.pod | 2 +- doc/crypto/RSA_private_encrypt.pod | 2 +- doc/crypto/RSA_set_method.pod | 40 ++-- doc/crypto/RSA_sign.pod | 2 +- doc/crypto/SMIME_read_CMS.pod | 2 +- doc/crypto/SMIME_write_CMS.pod | 2 +- doc/crypto/X509_EXTENSION_set_object.pod | 2 + doc/crypto/X509_LOOKUP_hash_dir.pod | 2 +- doc/crypto/X509_NAME_ENTRY_get_object.pod | 12 +- doc/crypto/X509_NAME_add_entry_by_txt.pod | 18 +- doc/crypto/X509_NAME_get_index_by_NID.pod | 24 +-- doc/crypto/X509_NAME_print_ex.pod | 6 +- doc/crypto/X509_STORE_CTX_new.pod | 4 +- doc/crypto/X509_STORE_CTX_set_verify_cb.pod | 144 +++++++------- doc/crypto/X509_STORE_set_verify_cb_func.pod | 10 +- doc/crypto/X509_VERIFY_PARAM_set_flags.pod | 26 +-- doc/crypto/X509_check_host.pod | 6 +- doc/crypto/X509_check_issued.pod | 2 +- doc/crypto/X509_get_pubkey.pod | 6 +- doc/crypto/X509v3_get_ext_by_NID.pod | 2 +- doc/crypto/blowfish.pod | 8 +- doc/crypto/bn.pod | 14 +- doc/crypto/bn_internal.pod | 4 +- doc/crypto/buffer.pod | 4 +- doc/crypto/crypto.pod | 2 - doc/crypto/d2i_DSAPublicKey.pod | 2 +- doc/crypto/d2i_ECPKParameters.pod | 8 +- doc/crypto/d2i_PKCS8PrivateKey.pod | 16 +- doc/crypto/d2i_RSAPublicKey.pod | 4 +- doc/crypto/d2i_X509.pod | 18 +- doc/crypto/d2i_X509_NAME.pod | 4 +- doc/crypto/des.pod | 36 ++-- doc/crypto/des_modes.pod | 10 +- doc/crypto/dh.pod | 24 +-- doc/crypto/dsa.pod | 62 +++---- doc/crypto/ec.pod | 44 ++--- doc/crypto/engine.pod | 26 +-- doc/crypto/err.pod | 2 +- doc/crypto/evp.pod | 2 +- doc/crypto/hmac.pod | 2 +- doc/crypto/i2d_CMS_bio_stream.pod | 2 +- doc/crypto/lhash.pod | 40 ++-- doc/crypto/md5.pod | 2 +- doc/crypto/mdc2.pod | 2 +- doc/crypto/pem.pod | 8 +- doc/crypto/rand.pod | 4 +- doc/crypto/ripemd.pod | 2 +- doc/crypto/rsa.pod | 4 +- doc/crypto/sha.pod | 2 +- doc/crypto/threads.pod | 12 +- doc/crypto/ui.pod | 26 +-- doc/ssl/SSL_CONF_CTX_set1_prefix.pod | 2 +- doc/ssl/SSL_CTX_add_session.pod | 2 +- doc/ssl/SSL_CTX_flush_sessions.pod | 4 +- doc/ssl/SSL_CTX_sess_set_get_cb.pod | 8 +- doc/ssl/SSL_CTX_set1_curves.pod | 4 +- doc/ssl/SSL_CTX_set1_verify_cert_store.pod | 2 +- doc/ssl/SSL_CTX_set_cert_store.pod | 2 +- doc/ssl/SSL_CTX_set_cert_verify_callback.pod | 6 +- doc/ssl/SSL_CTX_set_client_CA_list.pod | 4 +- doc/ssl/SSL_CTX_set_custom_cli_ext.pod | 38 ++-- doc/ssl/SSL_CTX_set_generate_session_id.pod | 2 +- doc/ssl/SSL_CTX_set_info_callback.pod | 68 +++---- doc/ssl/SSL_CTX_set_psk_client_callback.pod | 12 +- doc/ssl/SSL_CTX_set_security_level.pod | 8 +- doc/ssl/SSL_CTX_set_session_cache_mode.pod | 2 +- doc/ssl/SSL_CTX_set_tlsext_ticket_key_cb.pod | 32 ++-- doc/ssl/SSL_CTX_set_verify.pod | 4 +- doc/ssl/SSL_CTX_use_certificate.pod | 12 +- doc/ssl/SSL_CTX_use_psk_identity_hint.pod | 9 +- doc/ssl/SSL_CTX_use_serverinfo.pod | 11 +- doc/ssl/SSL_SESSION_get_time.pod | 2 +- doc/ssl/SSL_accept.pod | 2 +- doc/ssl/SSL_alert_type_string.pod | 2 +- doc/ssl/SSL_connect.pod | 2 +- doc/ssl/SSL_get_client_CA_list.pod | 2 +- doc/ssl/SSL_get_current_cipher.pod | 2 +- doc/ssl/SSL_get_psk_identity.pod | 1 - doc/ssl/SSL_library_init.pod | 2 +- doc/ssl/SSL_load_client_CA_file.pod | 2 +- doc/ssl/SSL_read.pod | 4 +- doc/ssl/SSL_set1_host.pod | 6 +- doc/ssl/SSL_shutdown.pod | 4 +- doc/ssl/SSL_write.pod | 4 +- doc/ssl/ssl.pod | 3 - util/doc-nit-check.pl | 42 +++++ 209 files changed, 1263 insertions(+), 1295 deletions(-) create mode 100644 util/doc-nit-check.pl diff --git a/doc/apps/CA.pl.pod b/doc/apps/CA.pl.pod index be56e0adf4..a84083af0b 100644 --- a/doc/apps/CA.pl.pod +++ b/doc/apps/CA.pl.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -103,7 +102,7 @@ B, B, or B. =item B<-verify> verifies certificates against the CA certificate for "demoCA". If no certificates -are specified on the command line it tries to verify the file "newcert.pem". +are specified on the command line it tries to verify the file "newcert.pem". =item B @@ -148,7 +147,7 @@ enter cacert.pem when prompted for the CA file name. Create a DSA certificate request and private key (a different set of parameters can optionally be created first): - openssl req -out newreq.pem -newkey dsa:dsap.pem + openssl req -out newreq.pem -newkey dsa:dsap.pem Sign the request: @@ -169,7 +168,7 @@ be wrong. In this case the command: perl -S CA.pl -can be used and the B environment variable changed to point to +can be used and the B environment variable changed to point to the correct path of the configuration file "openssl.cnf". The script is intended as a simple front end for the B program for use diff --git a/doc/apps/asn1parse.pod b/doc/apps/asn1parse.pod index cd30797eb9..e231a93548 100644 --- a/doc/apps/asn1parse.pod +++ b/doc/apps/asn1parse.pod @@ -92,7 +92,7 @@ L format. If B only is present then the string is obtained from the default section using the name B. The encoded data is passed through the ASN1 parser and printed out as though it came from a file, the contents can thus be examined and written to a -file using the B option. +file using the B option. =item B<-strictpem> @@ -108,20 +108,20 @@ END marker in a PEM file. The output will typically contain lines like this: - 0:d=0 hl=4 l= 681 cons: SEQUENCE + 0:d=0 hl=4 l= 681 cons: SEQUENCE ..... 229:d=3 hl=3 l= 141 prim: BIT STRING - 373:d=2 hl=3 l= 162 cons: cont [ 3 ] - 376:d=3 hl=3 l= 159 cons: SEQUENCE - 379:d=4 hl=2 l= 29 cons: SEQUENCE + 373:d=2 hl=3 l= 162 cons: cont [ 3 ] + 376:d=3 hl=3 l= 159 cons: SEQUENCE + 379:d=4 hl=2 l= 29 cons: SEQUENCE 381:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier - 386:d=5 hl=2 l= 22 prim: OCTET STRING - 410:d=4 hl=2 l= 112 cons: SEQUENCE + 386:d=5 hl=2 l= 22 prim: OCTET STRING + 410:d=4 hl=2 l= 112 cons: SEQUENCE 412:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier - 417:d=5 hl=2 l= 105 prim: OCTET STRING - 524:d=4 hl=2 l= 12 cons: SEQUENCE + 417:d=5 hl=2 l= 105 prim: OCTET STRING + 524:d=4 hl=2 l= 12 cons: SEQUENCE ..... @@ -133,27 +133,27 @@ the contents octets. The B<-i> option can be used to make the output more readable. -Some knowledge of the ASN.1 structure is needed to interpret the output. +Some knowledge of the ASN.1 structure is needed to interpret the output. In this example the BIT STRING at offset 229 is the certificate public key. The contents octets of this will contain the public key information. This can be examined using the option B<-strparse 229> to yield: - 0:d=0 hl=3 l= 137 cons: SEQUENCE + 0:d=0 hl=3 l= 137 cons: SEQUENCE 3:d=1 hl=3 l= 129 prim: INTEGER :E5D21E1F5C8D208EA7A2166C7FAF9F6BDF2059669C60876DDB70840F1A5AAFA59699FE471F379F1DD6A487E7D5409AB6A88D4A9746E24B91D8CF55DB3521015460C8EDE44EE8A4189F7A7BE77D6CD3A9AF2696F486855CF58BF0EDF2B4068058C7A947F52548DDF7E15E96B385F86422BEA9064A3EE9E1158A56E4A6F47E5897 135:d=1 hl=2 l= 3 prim: INTEGER :010001 =head1 NOTES If an OID is not part of OpenSSL's internal table it will be represented in -numerical form (for example 1.2.3.4). The file passed to the B<-oid> option +numerical form (for example 1.2.3.4). The file passed to the B<-oid> option allows additional OIDs to be included. Each line consists of three columns, the first column is the OID in numerical format and should be followed by white space. The second column is the "short name" which is a single word followed by white space. The final column is the rest of the line and is the "long name". B displays the long name. Example: -C<1.2.3.4 shortName A long name> +C<1.2.3.4 shortName A long name> =head1 EXAMPLES diff --git a/doc/apps/ca.pod b/doc/apps/ca.pod index 6c2948501c..de3744e302 100644 --- a/doc/apps/ca.pod +++ b/doc/apps/ca.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -101,7 +100,7 @@ section for information on the required input and output format. =item B<-infiles> if present this should be the last option, all subsequent arguments -are taken as the names of files containing certificate requests. +are taken as the names of files containing certificate requests. =item B<-out filename> @@ -195,7 +194,7 @@ need this option. =item B<-preserveDN> Normally the DN order of a certificate is the same as the order of the -fields in the relevant policy section. When this option is set the order +fields in the relevant policy section. When this option is set the order is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll. @@ -245,7 +244,7 @@ characters may be escaped by \ (backslash), no spaces are skipped. =item B<-utf8> -this option causes field values to be interpreted as UTF8 strings, by +this option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings. @@ -366,7 +365,7 @@ any) used. This specifies a file containing additional B. Each line of the file should consist of the numerical form of the object identifier followed by white space then the short name followed -by white space and finally the long name. +by white space and finally the long name. =item B @@ -398,7 +397,7 @@ an EGD socket (see L). =item B the same as the B<-days> option. The number of days to certify -a certificate for. +a certificate for. =item B @@ -521,7 +520,7 @@ this can be regarded more of a quirk than intended behaviour. The input to the B<-spkac> command line option is a Netscape signed public key and challenge. This will usually come from -the B tag in an HTML form to create a new private key. +the B tag in an HTML form to create a new private key. It is however possible to create SPKACs using the B utility. The file should contain the variable SPKAC set to the value of @@ -581,18 +580,18 @@ A sample configuration file with the relevant sections for B: [ ca ] default_ca = CA_default # The default ca section - + [ CA_default ] dir = ./demoCA # top dir database = $dir/index.txt # index file. - new_certs_dir = $dir/newcerts # new certs dir - + new_certs_dir = $dir/newcerts # new certs dir + certificate = $dir/cacert.pem # The CA cert serial = $dir/serial # serial no file private_key = $dir/private/cakey.pem# CA private key RANDFILE = $dir/private/.rand # random number file - + default_days = 365 # how long to certify for default_crl_days= 30 # how long before next CRL default_md = md5 # md to use @@ -600,9 +599,9 @@ A sample configuration file with the relevant sections for B: policy = policy_any # default policy email_in_dn = no # Don't add the email into cert DN - name_opt = ca_default # Subject name display option - cert_opt = ca_default # Certificate display option - copy_extensions = none # Don't copy extensions from request + name_opt = ca_default # Subject name display option + cert_opt = ca_default # Certificate display option + copy_extensions = none # Don't copy extensions from request [ policy_any ] countryName = supplied @@ -636,7 +635,7 @@ be overridden by the B<-config> command line option. =head1 RESTRICTIONS -The text database index file is a critical part of the process and +The text database index file is a critical part of the process and if corrupted it can be difficult to fix. It is theoretically possible to rebuild the index file from all the issued certificates and a current CRL: however there is no option to do this. @@ -704,7 +703,7 @@ then even if a certificate is issued with CA:TRUE it will not be valid. =head1 SEE ALSO L, L, L, L, -L, L +L, L =cut diff --git a/doc/apps/cms.pod b/doc/apps/cms.pod index 4876ef1521..2552f220ba 100644 --- a/doc/apps/cms.pod +++ b/doc/apps/cms.pod @@ -186,13 +186,13 @@ B type and output the content. =item B<-sign_receipt> -Generate and output a signed receipt for the supplied message. The input +Generate and output a signed receipt for the supplied message. The input message B contain a signed receipt request. Functionality is otherwise similar to the B<-sign> operation. =item B<-verify_receipt receipt> -Verify a signed receipt in filename B. The input message B +Verify a signed receipt in filename B. The input message B contain the original receipt request. Functionality is otherwise similar to the B<-verify> operation. @@ -256,7 +256,7 @@ is S/MIME and it uses the multipart/signed MIME content type. this option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips -off text headers: if the decrypted or verified message is not of MIME +off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs. =item B<-noout> @@ -298,11 +298,11 @@ default digest algorithm for the signing key will be used (usually SHA1). the encryption algorithm to use. For example triple DES (168 bits) - B<-des3> or 256 bit AES - B<-aes256>. Any standard algorithm name (as used by the -EVP_get_cipherbyname() function) can also be used preceded by a dash, for +EVP_get_cipherbyname() function) can also be used preceded by a dash, for example B<-aes-128-cbc>. See L|enc(1)> for a list of ciphers supported by your version of OpenSSL. -If not specified triple DES is used. Only used with B<-encrypt> and +If not specified triple DES is used. Only used with B<-encrypt> and B<-EncryptedData_create> commands. =item B<-nointern> @@ -408,7 +408,7 @@ address where receipts should be supplied. =item B<-receipt_request_to emailaddress> -Add an explicit email address where signed receipts should be sent to. This +Add an explicit email address where signed receipts should be sent to. This option B but supplied if a signed receipt it requested. =item B<-receipt_request_print> @@ -436,7 +436,7 @@ B structures. set the encapsulated content type to B if not supplied the B type is used. The B argument can be any valid OID name in either text or -numerical format. +numerical format. =item B<-inkey file> @@ -469,7 +469,7 @@ all others. =item B one or more certificates of message recipients: used when encrypting -a message. +a message. =item B<-to, -from, -subject> @@ -534,7 +534,7 @@ attempt is made to locate the recipient by trying each potential recipient in turn using the supplied private key. To thwart the MMA attack (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) all recipients are tried whether they succeed or not and if no recipients match the message -is "decrypted" using a random key which will typically output garbage. +is "decrypted" using a random key which will typically output garbage. The B<-debug_decrypt> option can be used to disable the MMA attack protection and return an error if no recipient can be found: this option should be used with caution. For a fuller description see L). @@ -598,29 +598,29 @@ be processed by the older B command. Create a cleartext signed message: openssl cms -sign -in message.txt -text -out mail.msg \ - -signer mycert.pem + -signer mycert.pem Create an opaque signed message openssl cms -sign -in message.txt -text -out mail.msg -nodetach \ - -signer mycert.pem + -signer mycert.pem Create a signed message, include some additional certificates and read the private key from another file: openssl cms -sign -in in.txt -text -out mail.msg \ - -signer mycert.pem -inkey mykey.pem -certfile mycerts.pem + -signer mycert.pem -inkey mykey.pem -certfile mycerts.pem Create a signed message with two signers, use key identifier: openssl cms -sign -in message.txt -text -out mail.msg \ - -signer mycert.pem -signer othercert.pem -keyid + -signer mycert.pem -signer othercert.pem -keyid Send a signed message under Unix directly to sendmail, including headers: openssl cms -sign -in in.txt -text -signer mycert.pem \ - -from steve@openssl.org -to someone@somewhere \ - -subject "Signed message" | sendmail someone@somewhere + -from steve@openssl.org -to someone@somewhere \ + -subject "Signed message" | sendmail someone@somewhere Verify a message and extract the signer's certificate if successful: @@ -629,15 +629,15 @@ Verify a message and extract the signer's certificate if successful: Send encrypted mail using triple DES: openssl cms -encrypt -in in.txt -from steve@openssl.org \ - -to someone@somewhere -subject "Encrypted message" \ - -des3 user.pem -out mail.msg + -to someone@somewhere -subject "Encrypted message" \ + -des3 user.pem -out mail.msg Sign and encrypt mail: openssl cms -sign -in ml.txt -signer my.pem -text \ - | openssl cms -encrypt -out mail.msg \ - -from steve@openssl.org -to someone@somewhere \ - -subject "Signed and Encrypted message" -des3 user.pem + | openssl cms -encrypt -out mail.msg \ + -from steve@openssl.org -to someone@somewhere \ + -subject "Signed and Encrypted message" -des3 user.pem Note: the encryption command does not include the B<-text> option because the message being encrypted already has MIME headers. @@ -654,7 +654,7 @@ it with: -----BEGIN PKCS7----- -----END PKCS7----- -and using the command, +and using the command, openssl cms -verify -inform PEM -in signature.pem -content content.txt @@ -673,17 +673,17 @@ Add a signer to an existing message: Sign mail using RSA-PSS: openssl cms -sign -in message.txt -text -out mail.msg \ - -signer mycert.pem -keyopt rsa_padding_mode:pss + -signer mycert.pem -keyopt rsa_padding_mode:pss Create encrypted mail using RSA-OAEP: openssl cms -encrypt -in plain.txt -out mail.msg \ - -recip cert.pem -keyopt rsa_padding_mode:oaep + -recip cert.pem -keyopt rsa_padding_mode:oaep Use SHA256 KDF with an ECDH certificate: openssl cms -encrypt -in plain.txt -out mail.msg \ - -recip ecdhcert.pem -keyopt ecdh_kdf_md:sha256 + -recip ecdhcert.pem -keyopt ecdh_kdf_md:sha256 =head1 BUGS @@ -715,7 +715,7 @@ The B option was first added in OpenSSL 1.1.0 The use of B<-recip> to specify the recipient when encrypting mail was first added to OpenSSL 1.1.0 -Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.1.0. +Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.1.0. The use of non-RSA keys with B<-encrypt> and B<-decrypt> was first added to OpenSSL 1.1.0. diff --git a/doc/apps/config.pod b/doc/apps/config.pod index baa886b5ae..499bc9e11a 100644 --- a/doc/apps/config.pod +++ b/doc/apps/config.pod @@ -1,4 +1,3 @@ - =pod =for comment openssl_manual_section:5 @@ -63,14 +62,14 @@ functionality: any sub command uses the master OpenSSL configuration file unless an option is used in the sub command to use an alternative configuration file. -To enable library configuration the default section needs to contain an +To enable library configuration the default section needs to contain an appropriate line which points to the main configuration section. The default name is B which is used by the B utility. Other applications may use an alternative name such as B. The configuration section should consist of a set of name value pairs which contain specific module configuration information. The B represents -the name of the I the meaning of the B is +the name of the I the meaning of the B is module specific: it may, for example, represent a further configuration section containing configuration module specific information. E.g. @@ -102,7 +101,7 @@ B the B utility sub commands can see the new objects as well as any compliant applications. For example: [new_oids] - + some_new_oid = 1.2.3.4 some_other_oid = 1.2.3.5 @@ -141,7 +140,7 @@ For example: [bar_section] ... "bar" ENGINE specific commands ... -The command B is used to give the ENGINE name. If used this +The command B is used to give the ENGINE name. If used this command must be first. For example: [engine_section] @@ -168,7 +167,7 @@ The command B sets the default algorithms an ENGINE will supply using the functions ENGINE_set_default_string(). If the name matches none of the above command names it is assumed to be a -ctrl command which is sent to the ENGINE. The value of the command is the +ctrl command which is sent to the ENGINE. The value of the command is the argument to the ctrl command. If the value is the string B then no value is sent to the command. @@ -266,7 +265,7 @@ Here is a sample configuration file using some of the features mentioned above. # This is the default section. - + HOME=/temp RANDFILE= ${ENV::HOME}/.rnd configdir=$ENV::HOME/config @@ -296,7 +295,7 @@ the B or B environment variables but they may not be set to any value at all. If you just include the environment variable names and the variable doesn't exist then this will cause an error when an attempt is made to load the configuration file. By making use of the -default section both values can be looked up with B taking +default section both values can be looked up with B taking priority and B used if neither is defined: TMP=/tmp diff --git a/doc/apps/crl.pod b/doc/apps/crl.pod index bb1092c750..cb5969ad83 100644 --- a/doc/apps/crl.pod +++ b/doc/apps/crl.pod @@ -42,7 +42,7 @@ the DER form with header and footer lines. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> diff --git a/doc/apps/crl2pkcs7.pod b/doc/apps/crl2pkcs7.pod index f32940273d..26ec889549 100644 --- a/doc/apps/crl2pkcs7.pod +++ b/doc/apps/crl2pkcs7.pod @@ -74,8 +74,8 @@ Create a PKCS#7 structure from a certificate and CRL: Creates a PKCS#7 structure in DER format with no CRL from several different certificates: - openssl crl2pkcs7 -nocrl -certfile newcert.pem - -certfile demoCA/cacert.pem -outform DER -out p7.der + openssl crl2pkcs7 -nocrl -certfile newcert.pem + -certfile demoCA/cacert.pem -outform DER -out p7.der =head1 NOTES diff --git a/doc/apps/dgst.pod b/doc/apps/dgst.pod index ce26a5607d..75b8ad9b1e 100644 --- a/doc/apps/dgst.pod +++ b/doc/apps/dgst.pod @@ -156,7 +156,7 @@ a file or files containing random data used to seed the random number generator, or an EGD socket (see L). Multiple files can be specified separated by an OS-dependent character. The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for -all others. +all others. =item B<-fips-fingerprint> diff --git a/doc/apps/dhparam.pod b/doc/apps/dhparam.pod index b72ca7ec14..771ef1b0ad 100644 --- a/doc/apps/dhparam.pod +++ b/doc/apps/dhparam.pod @@ -44,7 +44,7 @@ additional header and footer lines. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in> I @@ -123,7 +123,7 @@ for all available algorithms. The program B combines the functionality of the programs B and B in previous versions of OpenSSL. The B and B -programs are retained for now but may have different purposes in future +programs are retained for now but may have different purposes in future versions of OpenSSL. =head1 NOTES diff --git a/doc/apps/dsa.pod b/doc/apps/dsa.pod index 1f0e5ddc42..3a244cf3b0 100644 --- a/doc/apps/dsa.pod +++ b/doc/apps/dsa.pod @@ -59,7 +59,7 @@ PKCS#8 format is also accepted. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> @@ -149,7 +149,7 @@ To encrypt a private key using triple DES: openssl dsa -in key.pem -des3 -out keyout.pem -To convert a private key from PEM to DER format: +To convert a private key from PEM to DER format: openssl dsa -in key.pem -outform DER -out keyout.der diff --git a/doc/apps/dsaparam.pod b/doc/apps/dsaparam.pod index 0a3727a32b..753f3b19d5 100644 --- a/doc/apps/dsaparam.pod +++ b/doc/apps/dsaparam.pod @@ -41,7 +41,7 @@ of the B format base64 encoded with additional header and footer lines. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> diff --git a/doc/apps/ec.pod b/doc/apps/ec.pod index 738b718dfd..c1b6bb0714 100644 --- a/doc/apps/ec.pod +++ b/doc/apps/ec.pod @@ -31,7 +31,7 @@ B B =head1 DESCRIPTION The B command processes EC keys. They can be converted between various -forms and their components printed out. B OpenSSL uses the +forms and their components printed out. B OpenSSL uses the private key format specified in 'SEC 1: Elliptic Curve Cryptography' (http://www.secg.org/). To convert an OpenSSL EC private key into the PKCS#8 private key format use the B command. @@ -55,7 +55,7 @@ PKCS#8 format is also accepted. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> @@ -83,7 +83,7 @@ see the B section in L. =item B<-des|-des3|-idea> -These options encrypt the private key with the DES, triple DES, IDEA or +These options encrypt the private key with the DES, triple DES, IDEA or any other cipher supported by OpenSSL before outputting it. A pass phrase is prompted for. If none of these options is specified the key is written in plain text. This @@ -130,7 +130,7 @@ the preprocessor macro B at compile time. This specifies how the elliptic curve parameters are encoded. Possible value are: B, i.e. the ec parameters are specified by an OID, or B where the ec parameters are -explicitly given (see RFC 3279 for the definition of the +explicitly given (see RFC 3279 for the definition of the EC parameters structures). The default value is B. B the B alternative ,as specified in RFC 3279, is currently not implemented in OpenSSL. @@ -170,7 +170,7 @@ To encrypt a private key using triple DES: openssl ec -in key.pem -des3 -out keyout.pem -To convert a private key from PEM to DER format: +To convert a private key from PEM to DER format: openssl ec -in key.pem -outform DER -out keyout.der diff --git a/doc/apps/ecparam.pod b/doc/apps/ecparam.pod index fb0181ff95..a41e005625 100644 --- a/doc/apps/ecparam.pod +++ b/doc/apps/ecparam.pod @@ -41,12 +41,12 @@ Print out a usage message. This specifies the input format. The B option uses an ASN.1 DER encoded form compatible with RFC 3279 EcpkParameters. The PEM form is the default -format: it consists of the B format base64 encoded with additional +format: it consists of the B format base64 encoded with additional header and footer lines. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> @@ -102,7 +102,7 @@ the preprocessor macro B at compile time. This specifies how the elliptic curve parameters are encoded. Possible value are: B, i.e. the ec parameters are specified by an OID, or B where the ec parameters are -explicitly given (see RFC 3279 for the definition of the +explicitly given (see RFC 3279 for the definition of the EC parameters structures). The default value is B. B the B alternative ,as specified in RFC 3279, is currently not implemented in OpenSSL. @@ -141,7 +141,7 @@ PEM format EC parameters use the header and footer lines: -----END EC PARAMETERS----- OpenSSL is currently not able to generate new groups and therefore -B can only create EC parameters from known (named) curves. +B can only create EC parameters from known (named) curves. =head1 EXAMPLES diff --git a/doc/apps/enc.pod b/doc/apps/enc.pod index 3b58aebebd..7abd980065 100644 --- a/doc/apps/enc.pod +++ b/doc/apps/enc.pod @@ -257,7 +257,7 @@ authentication tag. desx DESX algorithm. gost89 GOST 28147-89 in CFB mode (provided by ccgost engine) - gost89-cnt `GOST 28147-89 in CNT mode (provided by ccgost engine) + gost89-cnt `GOST 28147-89 in CNT mode (provided by ccgost engine) idea-cbc IDEA algorithm in CBC mode idea same as idea-cbc @@ -283,13 +283,13 @@ authentication tag. rc5-ecb RC5 cipher in ECB mode rc5-ofb RC5 cipher in OFB mode - aes-[128|192|256]-cbc 128/192/256 bit AES in CBC mode - aes[128|192|256] Alias for aes-[128|192|256]-cbc - aes-[128|192|256]-cfb 128/192/256 bit AES in 128 bit CFB mode - aes-[128|192|256]-cfb1 128/192/256 bit AES in 1 bit CFB mode - aes-[128|192|256]-cfb8 128/192/256 bit AES in 8 bit CFB mode - aes-[128|192|256]-ecb 128/192/256 bit AES in ECB mode - aes-[128|192|256]-ofb 128/192/256 bit AES in OFB mode + aes-[128|192|256]-cbc 128/192/256 bit AES in CBC mode + aes[128|192|256] Alias for aes-[128|192|256]-cbc + aes-[128|192|256]-cfb 128/192/256 bit AES in 128 bit CFB mode + aes-[128|192|256]-cfb1 128/192/256 bit AES in 1 bit CFB mode + aes-[128|192|256]-cfb8 128/192/256 bit AES in 8 bit CFB mode + aes-[128|192|256]-ecb 128/192/256 bit AES in ECB mode + aes-[128|192|256]-ofb 128/192/256 bit AES in OFB mode =head1 EXAMPLES @@ -299,11 +299,11 @@ Just base64 encode a binary file: Decode the same file - openssl base64 -d -in file.b64 -out file.bin + openssl base64 -d -in file.b64 -out file.bin Encrypt a file using triple DES in CBC mode using a prompted password: - openssl des3 -salt -in file.txt -out file.des3 + openssl des3 -salt -in file.txt -out file.des3 Decrypt a file using a supplied password: diff --git a/doc/apps/engine.pod b/doc/apps/engine.pod index 59c4234408..32274df4cb 100644 --- a/doc/apps/engine.pod +++ b/doc/apps/engine.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -52,6 +51,7 @@ Tests if each specified engine is available, and displays the answer. Displays an error trace for any unavailable engine. =item B<-pre> I + =item B<-post> I Command-line configuration of engines. diff --git a/doc/apps/errstr.pod b/doc/apps/errstr.pod index 4349de1458..fea95f85ba 100644 --- a/doc/apps/errstr.pod +++ b/doc/apps/errstr.pod @@ -11,7 +11,7 @@ B =head1 DESCRIPTION Sometimes an application will not load error message and only -numerical forms will be available. The B utility can be used to +numerical forms will be available. The B utility can be used to display the meaning of the hex code. The hex code is the hex digits after the second colon. @@ -22,7 +22,7 @@ The error code: 27594:error:2006D080:lib(32):func(109):reason(128):bss_file.c:107: can be displayed with: - + openssl errstr 2006D080 to produce the error message: diff --git a/doc/apps/genpkey.pod b/doc/apps/genpkey.pod index 204ab2a580..5d61b73d53 100644 --- a/doc/apps/genpkey.pod +++ b/doc/apps/genpkey.pod @@ -213,12 +213,12 @@ Encrypt output private key using 128 bit AES and the passphrase "hello": Generate a 2048 bit RSA key using 3 as the public exponent: openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048 \ - -pkeyopt rsa_keygen_pubexp:3 + -pkeyopt rsa_keygen_pubexp:3 Generate 1024 bit DSA parameters: openssl genpkey -genparam -algorithm DSA -out dsap.pem \ - -pkeyopt dsa_paramgen_bits:1024 + -pkeyopt dsa_paramgen_bits:1024 Generate DSA key from parameters: @@ -227,7 +227,7 @@ Generate DSA key from parameters: Generate 1024 bit DH parameters: openssl genpkey -genparam -algorithm DH -out dhp.pem \ - -pkeyopt dh_paramgen_prime_len:1024 + -pkeyopt dh_paramgen_prime_len:1024 Output RFC5114 2048 bit DH parameters with 224 bit subgroup: @@ -240,8 +240,8 @@ Generate DH key from parameters: Generate EC parameters: openssl genpkey -genparam -algorithm EC -out ecp.pem \ - -pkeyopt ec_paramgen_curve:secp384r1 \ - -pkeyopt ec_param_enc:named_curve + -pkeyopt ec_paramgen_curve:secp384r1 \ + -pkeyopt ec_param_enc:named_curve Generate EC key from parameters: @@ -250,8 +250,8 @@ Generate EC key from parameters: Generate EC key directly: openssl genpkey -algorithm EC -out eckey.pem \ - -pkeyopt ec_paramgen_curve:P-384 \ - -pkeyopt ec_param_enc:named_curve + -pkeyopt ec_paramgen_curve:P-384 \ + -pkeyopt ec_param_enc:named_curve =head1 HISTORY diff --git a/doc/apps/ocsp.pod b/doc/apps/ocsp.pod index 1d50d4b349..60047947a1 100644 --- a/doc/apps/ocsp.pod +++ b/doc/apps/ocsp.pod @@ -337,13 +337,13 @@ option. =item B<-nrequest number> -The OCSP server will exit after receiving B requests, default unlimited. +The OCSP server will exit after receiving B requests, default unlimited. =item B<-nmin minutes>, B<-ndays days> Number of minutes or days when fresh revocation information is available: used in the -B field. If neither option is present then the B field is -omitted meaning fresh revocation information is immediately available. +B field. If neither option is present then the B field +is omitted meaning fresh revocation information is immediately available. =back @@ -413,7 +413,7 @@ Create an OCSP request and write it to a file: openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem -reqout req.der -Send a query to an OCSP responder with URL http://ocsp.myhost.com/ save the +Send a query to an OCSP responder with URL http://ocsp.myhost.com/ save the response to a file, print it out in text form, and verify the response: openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \ @@ -427,7 +427,7 @@ OCSP server on port 8888 using a standard B configuration, and a separate responder certificate. All requests and responses are printed to a file. openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem - -text -out log.txt + -text -out log.txt As above but exit after processing one request: diff --git a/doc/apps/openssl.pod b/doc/apps/openssl.pod index a3bb8f093f..46d0bb108d 100644 --- a/doc/apps/openssl.pod +++ b/doc/apps/openssl.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME diff --git a/doc/apps/pkcs12.pod b/doc/apps/pkcs12.pod index f64669ce45..012d09c72a 100644 --- a/doc/apps/pkcs12.pod +++ b/doc/apps/pkcs12.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -337,7 +336,7 @@ Output only client certificates to a file: openssl pkcs12 -in file.p12 -clcerts -out file.pem Don't encrypt the private key: - + openssl pkcs12 -in file.p12 -out file.pem -nodes Print some info about a PKCS#12 file: diff --git a/doc/apps/pkcs7.pod b/doc/apps/pkcs7.pod index 81354e2c33..abbcab2bef 100644 --- a/doc/apps/pkcs7.pod +++ b/doc/apps/pkcs7.pod @@ -37,7 +37,7 @@ the DER form with header and footer lines. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> @@ -100,7 +100,7 @@ For compatibility with some CAs it will also accept: There is no option to print out all the fields of a PKCS#7 file. -This PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC2315 they +This PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC2315 they cannot currently parse, for example, the new CMS as described in RFC2630. =head1 SEE ALSO diff --git a/doc/apps/pkey.pod b/doc/apps/pkey.pod index ddc2b58692..fd564c443f 100644 --- a/doc/apps/pkey.pod +++ b/doc/apps/pkey.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -42,7 +41,7 @@ This specifies the input format DER or PEM. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> @@ -76,7 +75,7 @@ name accepted by EVP_get_cipherbyname() is acceptable such as B. =item B<-text> prints out the various public or private key components in -plain text in addition to the encoded version. +plain text in addition to the encoded version. =item B<-text_pub> @@ -116,7 +115,7 @@ To encrypt a private key using triple DES: openssl pkey -in key.pem -des3 -out keyout.pem -To convert a private key from PEM to DER format: +To convert a private key from PEM to DER format: openssl pkey -in key.pem -outform DER -out keyout.der @@ -135,7 +134,7 @@ To just output the public part of a private key: =head1 SEE ALSO L, L, L, -L, L, L +L, L, L =cut diff --git a/doc/apps/pkeyparam.pod b/doc/apps/pkeyparam.pod index 153871db4d..7472de03ce 100644 --- a/doc/apps/pkeyparam.pod +++ b/doc/apps/pkeyparam.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -40,7 +39,7 @@ this option is not specified. =item B<-text> -prints out the parameters in plain text in addition to the encoded version. +prints out the parameters in plain text in addition to the encoded version. =item B<-noout> @@ -69,7 +68,7 @@ PEM format is supported because the key type is determined by the PEM headers. =head1 SEE ALSO L, L, L, -L, L, L +L, L, L =cut diff --git a/doc/apps/pkeyutl.pod b/doc/apps/pkeyutl.pod index e937a87736..73818db278 100644 --- a/doc/apps/pkeyutl.pod +++ b/doc/apps/pkeyutl.pod @@ -84,11 +84,11 @@ the peer key format PEM, DER or ENGINE. Default is PEM. =item B<-pubin> -the input file is a public key. +the input file is a public key. =item B<-certin> -the input is a certificate containing a public key. +the input is a certificate containing a public key. =item B<-rev> @@ -198,7 +198,7 @@ This sets the RSA padding mode. Acceptable values for B are B for PKCS#1 padding, B for SSLv23 padding, B for no padding, B for B mode, B for X9.31 mode and B for PSS. -In PKCS#1 padding if the message digest is not set then the supplied data is +In PKCS#1 padding if the message digest is not set then the supplied data is signed or verified directly instead of using a B structure. If a digest is set then the a B structure is used and its the length must correspond to the digest type. diff --git a/doc/apps/req.pod b/doc/apps/req.pod index acfbb25aeb..e98d3a40b5 100644 --- a/doc/apps/req.pod +++ b/doc/apps/req.pod @@ -1,4 +1,3 @@ - =pod =head1 NAME @@ -70,7 +69,7 @@ footer lines. =item B<-outform DER|PEM> -This specifies the output format, the options have the same meaning as the +This specifies the output format, the options have the same meaning as the B<-inform> option. =item B<-in filename> @@ -257,7 +256,7 @@ a variety of purposes. =item B<-utf8> -this option causes field values to be interpreted as UTF8 strings, by +this option causes field values to be interpreted as UTF8 strings, by default they are interpreted as ASCII. This means that the field values, whether prompted from a terminal or obtained from a configuration file, must be valid UTF8 strings. @@ -272,7 +271,7 @@ set multiple options. See the L manual page for details. =item B<-reqopt> customise the output format used with B<-text>. The B