Document man agent-external-key

Adapt commit message from cf69617bbea45a15423c4188daa9386debcbe1ec for man
page and management documentation.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1349082318-985-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7081
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 75b6f4bd84302d225a301f4ed87e2bb27908b972)

diff --git a/doc/management-notes.txt b/doc/management-notes.txt
index a07a514230400ac91b7292659e7ad7739deea4cf..79e71ad21a8b10d0f3a90e3de5736966c3e6c4c6 100644 (file)
--- a/doc/management-notes.txt
+++ b/doc/management-notes.txt
@@ -750,6 +750,34 @@ To accept connecting to the host and port directly, use this command:
 
   proxy NONE
 
+COMMAND -- rsa-sig (OpenVPN 2.3 or higher)
+------------------------------------------
+Provides support for external storage of the private key. Requires the
+--management-external-key option. This option can be used instead of "key"
+in client mode, and allows the client to run without the need to load the
+actual private key. When the SSL protocol needs to perform an RSA sign
+operation, the data to be signed will be sent to the management interface
+via a notification as follows:
+
+>RSA_SIGN:[BASE64_DATA]
+
+The management interface client should then sign BASE64_DATA
+using the private key and return the SSL signature as follows:
+
+rsa-sig
+[BASE64_SIG_LINE]
+.
+.
+.
+END
+
+Base64 encoded output of RSA_sign(NID_md5_sha1,... will provide a
+correct signature.
+
+This capability is intended to allow the use of arbitrarycryptographic
+service providers with OpenVPN via the management interface.
+
+
 OUTPUT FORMAT
 -------------
 

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index da1c0f9e9781c10b074820d9cae42da5a7de3dfb..aa653ec21ab83b8a49ce25074b4b6eaebb0632a0 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -2464,6 +2464,11 @@ Allow management interface to override
 .B \-\-remote
 directives (client-only).
 .\"*********************************************************
+.B \-\-management-external-key
+Allows usage for external private key file instead of
+.B \-\-key
+option (client-only).
+.\"*********************************************************
 .TP
 .B \-\-management-forget-disconnect
 Make OpenVPN forget passwords when management session