#
# DO NOT EDIT THIS FILE (invoke-certtool.texi)
#
-# It has been AutoGen-ed November 17, 2013 at 12:30:22 PM by AutoGen 5.18
+# It has been AutoGen-ed November 24, 2013 at 09:39:52 AM by AutoGen 5.18.2
# From the definitions ../src/certtool-args.def
# and the template file agtexi-cmd.tpl
@end ignore
- prohibits the option 'infile'
-e, --verify-chain Verify a PEM encoded certificate chain
--verify Verify a PEM encoded certificate chain using a trusted list
- - requires the option 'load-ca-certificate'
--verify-crl Verify a CRL using a trusted list
- requires the option 'load-ca-certificate'
--generate-dh-params Generate PKCS #3 encoded Diffie-Hellman parameters
- requires the option 'load-certificate'
--to-p8 Generate a PKCS #8 structure
-8, --pkcs8 Use PKCS #8 format for private keys
- --rsa Generate RSA key
- --dsa Generate DSA key
- --ecc Generate ECC (ECDSA) key
- --ecdsa an alias for the 'ecc' option
- --hash=str Hash algorithm to use for signing
- --inder Use DER format for input certificates, private keys, and DH parameters
+ -!, --rsa Generate RSA key
+ -", --dsa Generate DSA key
+ -#, --ecc Generate ECC (ECDSA) key
+ -$, --ecdsa an alias for the 'ecc' option
+ -%, --hash=str Hash algorithm to use for signing
+ -&, --inder Use DER format for input certificates, private keys, and DH parameters
- disabled as '--no-inder'
- --inraw an alias for the 'inder' option
- --outder Use DER format for output certificates, private keys, and DH parameters
+ -', --inraw an alias for the 'inder' option
+ -(, --outder Use DER format for output certificates, private keys, and DH parameters
- disabled as '--no-outder'
- --outraw an alias for the 'outder' option
- --bits=num Specify the number of bits for key generate
- --sec-param=str Specify the security level [low, legacy, normal, high, ultra]
- --disable-quick-random No effect
- --template=file Template file to use for non-interactive operation
+ -), --outraw an alias for the 'outder' option
+ -*, --bits=num Specify the number of bits for key generate
+ -+, --sec-param=str Specify the security level [low, legacy, normal, high, ultra]
+ -,, --disable-quick-random No effect
+ --, --template=file Template file to use for non-interactive operation
- file must pre-exist
- --pkcs-cipher=str Cipher to use for PKCS #8 and #12 operations
+ -., --pkcs-cipher=str Cipher to use for PKCS #8 and #12 operations
-v, --version[=arg] output version information and exit
-h, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
@subsubheading debug option (-d)
This is the ``enable debugging'' option.
-This option takes an argument number.
+This option takes a number argument.
Specifies the debug level.
@anchor{certtool generate-request}
@subsubheading generate-request option (-q)
@subsubheading verify option
This is the ``verify a pem encoded certificate chain using a trusted list'' option.
-
-@noindent
-This option has some usage constraints. It:
-@itemize @bullet
-@item
-must appear in combination with the following options:
-load-ca-certificate.
-@end itemize
-
-The trusted certificate list must be loaded with --load-ca-certificate.
+The trusted certificate list can be loaded with --load-ca-certificate. If no
+certificate list is provided, then the system's certificate list is used.
@anchor{certtool verify-crl}
@subsubheading verify-crl option
@subsubheading load-privkey option
This is the ``loads a private key file'' option.
-This option takes an argument string.
+This option takes a string argument.
This can be either a file or a PKCS #11 URL
@anchor{certtool load-pubkey}
@subsubheading load-pubkey option
This is the ``loads a public key file'' option.
-This option takes an argument string.
+This option takes a string argument.
This can be either a file or a PKCS #11 URL
@anchor{certtool load-certificate}
@subsubheading load-certificate option
This is the ``loads a certificate file'' option.
-This option takes an argument string.
+This option takes a string argument.
This can be either a file or a PKCS #11 URL
@anchor{certtool load-ca-privkey}
@subsubheading load-ca-privkey option
This is the ``loads the certificate authority's private key file'' option.
-This option takes an argument string.
+This option takes a string argument.
This can be either a file or a PKCS #11 URL
@anchor{certtool load-ca-certificate}
@subsubheading load-ca-certificate option
This is the ``loads the certificate authority's certificate file'' option.
-This option takes an argument string.
+This option takes a string argument.
This can be either a file or a PKCS #11 URL
@anchor{certtool cprint}
@subsubheading cprint option
@subsubheading hash option
This is the ``hash algorithm to use for signing'' option.
-This option takes an argument string.
+This option takes a string argument.
Available hash functions are SHA1, RMD160, SHA256, SHA384, SHA512.
@anchor{certtool inder}
@subsubheading inder option
This is the ``use der format for input certificates, private keys, and dh parameters '' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-inder.
+@end itemize
+
The input files will be assumed to be in DER or RAW format.
Unlike options that in PEM input would allow multiple input data (e.g. multiple
certificates), when reading in DER format a single data structure is read.
@subsubheading outder option
This is the ``use der format for output certificates, private keys, and dh parameters'' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-outder.
+@end itemize
+
The output will be in DER or RAW format.
@anchor{certtool outraw}
@subsubheading outraw option
@subsubheading sec-param option
This is the ``specify the security level [low, legacy, normal, high, ultra]'' option.
-This option takes an argument string @file{Security parameter}.
+This option takes a string argument @file{Security parameter}.
This is alternative to the bits option.
@anchor{certtool pkcs-cipher}
@subsubheading pkcs-cipher option
This is the ``cipher to use for pkcs #8 and #12 operations'' option.
-This option takes an argument string @file{Cipher}.
+This option takes a string argument @file{Cipher}.
Cipher may be one of 3des, 3des-pkcs12, aes-128, aes-192, aes-256, rc2-40, arcfour.
@anchor{certtool exit status}
@subsubheading certtool exit status
#
# DO NOT EDIT THIS FILE (invoke-danetool.texi)
#
-# It has been AutoGen-ed November 17, 2013 at 12:30:25 PM by AutoGen 5.18
+# It has been AutoGen-ed November 24, 2013 at 09:39:55 AM by AutoGen 5.18.2
# From the definitions ../src/danetool-args.def
# and the template file agtexi-cmd.tpl
@end ignore
@subsubheading debug option (-d)
This is the ``enable debugging'' option.
-This option takes an argument number.
+This option takes a number argument.
Specifies the debug level.
@anchor{danetool load-pubkey}
@subsubheading load-pubkey option
This is the ``loads a public key file'' option.
-This option takes an argument string.
+This option takes a string argument.
This can be either a file or a PKCS #11 URL
@anchor{danetool load-certificate}
@subsubheading load-certificate option
This is the ``loads a certificate file'' option.
-This option takes an argument string.
+This option takes a string argument.
This can be either a file or a PKCS #11 URL
@anchor{danetool dlv}
@subsubheading dlv option
This is the ``sets a dlv file'' option.
-This option takes an argument string.
+This option takes a string argument.
This sets a DLV file to be used for DNSSEC verification.
@anchor{danetool hash}
@subsubheading hash option
This is the ``hash algorithm to use for signing'' option.
-This option takes an argument string.
+This option takes a string argument.
Available hash functions are SHA1, RMD160, SHA256, SHA384, SHA512.
@anchor{danetool check}
@subsubheading check option
This is the ``check a host's dane tlsa entry'' option.
-This option takes an argument string.
+This option takes a string argument.
Obtains the DANE TLSA entry from the given hostname and prints information. Note that the actual certificate of the host has to be provided using --load-certificate.
@anchor{danetool check-ee}
@subsubheading check-ee option
@subsubheading local-dns option
This is the ``use the local dns server for dnssec resolving'' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-local-dns.
+@end itemize
+
This option will use the local DNS server for DNSSEC.
This is disabled by default due to many servers not allowing DNSSEC.
@anchor{danetool inder}
@subsubheading inder option
This is the ``use der format for input certificates and private keys'' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-inder.
+@end itemize
+
The input files will be assumed to be in DER or RAW format.
Unlike options that in PEM input would allow multiple input data (e.g. multiple
certificates), when reading in DER format a single data structure is read.
@subsubheading host option
This is the ``specify the hostname to be used in the dane rr'' option.
-This option takes an argument string @file{Hostname}.
+This option takes a string argument @file{Hostname}.
This command sets the hostname for the DANE RR.
@anchor{danetool proto}
@subsubheading proto option
This is the ``the protocol set for dane data (tcp, udp etc.)'' option.
-This option takes an argument string @file{Protocol}.
+This option takes a string argument @file{Protocol}.
This command specifies the protocol for the service set in the DANE data.
@anchor{danetool ca}
@subsubheading ca option
This option has some usage constraints. It:
@itemize @bullet
@item
-is enabled by default.
+can be disabled with --no-domain.
+@item
+It is enabled by default.
@end itemize
DANE distinguishes certificates and public keys offered via the DNSSEC to trusted and local entities. This flag indicates that this is a domain-issued certificate, meaning that there could be no CA involved.
#
# DO NOT EDIT THIS FILE (invoke-ocsptool.texi)
#
-# It has been AutoGen-ed November 17, 2013 at 12:30:23 PM by AutoGen 5.18
+# It has been AutoGen-ed November 24, 2013 at 09:39:54 AM by AutoGen 5.18.2
# From the definitions ../src/ocsptool-args.def
# and the template file agtexi-cmd.tpl
@end ignore
@subsubheading debug option (-d)
This is the ``enable debugging'' option.
-This option takes an argument number.
+This option takes a number argument.
Specifies the debug level.
@anchor{ocsptool ask}
@subsubheading ask option
This is the ``ask an ocsp/http server on a certificate validity'' option.
-This option takes an optional argument string @file{server name|url}.
+This option takes an optional string argument @file{server name|url}.
@noindent
This option has some usage constraints. It:
#
# DO NOT EDIT THIS FILE (invoke-p11tool.texi)
#
-# It has been AutoGen-ed November 17, 2013 at 12:30:28 PM by AutoGen 5.18
+# It has been AutoGen-ed November 24, 2013 at 09:40:01 AM by AutoGen 5.18.2
# From the definitions ../src/p11tool-args.def
# and the template file agtexi-cmd.tpl
@end ignore
@subsubheading debug option (-d)
This is the ``enable debugging'' option.
-This option takes an argument number.
+This option takes a number argument.
Specifies the debug level.
@anchor{p11tool export-chain}
@subsubheading export-chain option
@subsubheading generate-random option
This is the ``generate random data'' option.
-This option takes an argument number.
+This option takes a number argument.
Asks the token to generate a number of bytes of random bytes.
@anchor{p11tool generate-rsa}
@subsubheading generate-rsa option
This option has some usage constraints. It:
@itemize @bullet
@item
-is enabled by default.
+can be disabled with --no-private.
+@item
+It is enabled by default.
@end itemize
The written object will require a PIN to be used.
@subsubheading sec-param option
This is the ``specify the security level'' option.
-This option takes an argument string @file{Security parameter}.
+This option takes a string argument @file{Security parameter}.
This is alternative to the bits option. Available options are [low, legacy, normal, high, ultra].
@anchor{p11tool inder}
@subsubheading inder option
This is the ``use der/raw format for input'' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-inder.
+@end itemize
+
Use DER/RAW format for input certificates and private keys.
@anchor{p11tool inraw}
@subsubheading inraw option
@subsubheading outder option
This is the ``use der format for output certificates, private keys, and dh parameters'' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-outder.
+@end itemize
+
The output will be in DER or RAW format.
@anchor{p11tool outraw}
@subsubheading outraw option
@subsubheading provider option
This is the ``specify the pkcs #11 provider library'' option.
-This option takes an argument file.
+This option takes a file argument.
This will override the default options in /etc/gnutls/pkcs11.conf
@anchor{p11tool exit status}
@subsubheading p11tool exit status
#
# DO NOT EDIT THIS FILE (invoke-psktool.texi)
#
-# It has been AutoGen-ed November 17, 2013 at 12:30:27 PM by AutoGen 5.18
+# It has been AutoGen-ed November 24, 2013 at 09:39:59 AM by AutoGen 5.18.2
# From the definitions ../src/psk-args.def
# and the template file agtexi-cmd.tpl
@end ignore
@subsubheading debug option (-d)
This is the ``enable debugging'' option.
-This option takes an argument number.
+This option takes a number argument.
Specifies the debug level.
@anchor{psktool exit status}
@subsubheading psktool exit status
#
# DO NOT EDIT THIS FILE (invoke-srptool.texi)
#
-# It has been AutoGen-ed November 17, 2013 at 12:30:26 PM by AutoGen 5.18
+# It has been AutoGen-ed November 24, 2013 at 09:39:57 AM by AutoGen 5.18.2
# From the definitions ../src/srptool-args.def
# and the template file agtexi-cmd.tpl
@end ignore
@subsubheading debug option (-d)
This is the ``enable debugging'' option.
-This option takes an argument number.
+This option takes a number argument.
Specifies the debug level.
@anchor{srptool verify}
@subsubheading verify option
@subsubheading passwd-conf option (-v)
This is the ``specify a password conf file.'' option.
-This option takes an argument string.
+This option takes a string argument.
Specify a filename or a PKCS #11 URL to read the CAs from.
@anchor{srptool create-conf}
@subsubheading create-conf option
This is the ``generate a password configuration file.'' option.
-This option takes an argument string.
+This option takes a string argument.
This generates a password configuration file (tpasswd.conf)
containing the required for TLS parameters.
@anchor{srptool exit status}
#
# DO NOT EDIT THIS FILE (invoke-tpmtool.texi)
#
-# It has been AutoGen-ed November 17, 2013 at 12:30:30 PM by AutoGen 5.18
+# It has been AutoGen-ed November 24, 2013 at 09:40:02 AM by AutoGen 5.18.2
# From the definitions ../src/tpmtool-args.def
# and the template file agtexi-cmd.tpl
@end ignore
@subsubheading debug option (-d)
This is the ``enable debugging'' option.
-This option takes an argument number.
+This option takes a number argument.
Specifies the debug level.
@anchor{tpmtool generate-rsa}
@subsubheading generate-rsa option
@subsubheading sec-param option
This is the ``specify the security level [low, legacy, normal, high, ultra].'' option.
-This option takes an argument string @file{Security parameter}.
+This option takes a string argument @file{Security parameter}.
This is alternative to the bits option. Note however that the
values allowed by the TPM chip are quantized and given values may be rounded up.
@anchor{tpmtool inder}
@subsubheading inder option
This is the ``use the der format for keys.'' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-inder.
+@end itemize
+
The input files will be assumed to be in the portable
DER format of TPM. The default format is a custom format used by various
TPM tools
@subsubheading outder option
This is the ``use der format for output keys'' option.
+
+@noindent
+This option has some usage constraints. It:
+@itemize @bullet
+@item
+can be disabled with --no-outder.
+@end itemize
+
The output will be in the TPM portable DER format.
@anchor{tpmtool exit status}
@subsubheading tpmtool exit status
flag = {
name = verify;
descrip = "Verify a PEM encoded certificate chain using a trusted list";
- doc = "The trusted certificate list must be loaded with --load-ca-certificate.";
- flags-must = load-ca-certificate;
+ doc = "The trusted certificate list can be loaded with --load-ca-certificate. If no
+certificate list is provided, then the system's certificate list is used.";
};
flag = {
uri = get_crl_dist_point_url();
if (uri) {
- result =
- gnutls_x509_crt_set_crl_dist_points(crt,
- GNUTLS_SAN_URI,
- uri,
- 0 /* all reasons */
- );
+ result = gnutls_x509_crt_set_crl_dist_points(crt, GNUTLS_SAN_URI, uri, 0 /* all reasons */
+ );
if (result < 0) {
fprintf(stderr, "crl_dist_points: %s",
gnutls_strerror(result));
tim = get_expiration_date();
- result =
- gnutls_x509_crt_set_expiration_time(crt,
- tim);
+ result = gnutls_x509_crt_set_expiration_time(crt, tim);
if (result < 0) {
fprintf(stderr, "set_expiration: %s",
gnutls_strerror(result));
/* Will verify a certificate chain. If no CA certificates
* are provided, then the last certificate in the certificate
* chain is used as a CA.
+ *
+ * If @system is non-zero then the system's CA will be used.
*/
static int
_verify_x509_mem(const void *cert, int cert_size, const void *ca,
- int ca_size)
+ int ca_size, unsigned system)
{
int ret;
gnutls_datum_t tmp;
exit(1);
}
- if (ca == NULL) {
+ if (system != 0) {
+ ret = gnutls_x509_trust_list_add_system_trust(list, 0, 0);
+ if (ret < 0) {
+ fprintf(stderr, "Error loading system trust: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ x509_ncas = ret;
+
tmp.data = (void *) cert;
tmp.size = cert_size;
+
+ /* ignore errors. CRLs might not be given */
+ ret =
+ gnutls_x509_crt_list_import2(&x509_cert_list,
+ &x509_ncerts, &tmp,
+ GNUTLS_X509_FMT_PEM, 0);
+ if (ret < 0 || x509_ncerts < 1) {
+ fprintf(stderr, "error parsing CRTs: %s",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
} else {
- tmp.data = (void *) ca;
- tmp.size = ca_size;
+ if (ca == NULL) {
+ tmp.data = (void *) cert;
+ tmp.size = cert_size;
+ } else {
+ tmp.data = (void *) ca;
+ tmp.size = ca_size;
+
+ /* Load CAs */
+ ret =
+ gnutls_x509_crt_list_import2(&x509_ca_list,
+ &x509_ncas, &tmp,
+ GNUTLS_X509_FMT_PEM,
+ 0);
+ if (ret < 0 || x509_ncas < 1) {
+ fprintf(stderr, "error parsing CAs: %s",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+ }
+
+ ret =
+ gnutls_x509_crl_list_import2(&x509_crl_list,
+ &x509_ncrls, &tmp,
+ GNUTLS_X509_FMT_PEM, 0);
+ if (ret < 0) {
+ x509_crl_list = NULL;
+ x509_ncrls = 0;
+ }
+
- /* Load CAs */
+ tmp.data = (void *) cert;
+ tmp.size = cert_size;
+
+ /* ignore errors. CRLs might not be given */
ret =
- gnutls_x509_crt_list_import2(&x509_ca_list, &x509_ncas,
- &tmp, GNUTLS_X509_FMT_PEM,
- 0);
- if (ret < 0 || x509_ncas < 1) {
- fprintf(stderr, "error parsing CAs: %s",
+ gnutls_x509_crt_list_import2(&x509_cert_list,
+ &x509_ncerts, &tmp,
+ GNUTLS_X509_FMT_PEM, 0);
+ if (ret < 0 || x509_ncerts < 1) {
+ fprintf(stderr, "error parsing CRTs: %s",
gnutls_strerror(ret));
exit(1);
}
- }
- ret =
- gnutls_x509_crl_list_import2(&x509_crl_list, &x509_ncrls, &tmp,
- GNUTLS_X509_FMT_PEM, 0);
- if (ret < 0) {
- x509_crl_list = NULL;
- x509_ncrls = 0;
- }
+ if (ca == NULL) {
+ x509_ca_list = &x509_cert_list[x509_ncerts - 1];
+ x509_ncas = 1;
+ }
- tmp.data = (void *) cert;
- tmp.size = cert_size;
+ ret =
+ gnutls_x509_trust_list_add_cas(list, x509_ca_list,
+ x509_ncas, 0);
+ if (ret < 0) {
+ fprintf(stderr, "gnutls_x509_trust_add_cas: %s",
+ gnutls_strerror(ret));
+ exit(1);
+ }
- /* ignore errors. CRLs might not be given */
- ret =
- gnutls_x509_crt_list_import2(&x509_cert_list, &x509_ncerts,
- &tmp, GNUTLS_X509_FMT_PEM, 0);
- if (ret < 0 || x509_ncerts < 1) {
- fprintf(stderr, "error parsing CRTs: %s",
- gnutls_strerror(ret));
- exit(1);
- }
+ ret =
+ gnutls_x509_trust_list_add_crls(list, x509_crl_list,
+ x509_ncrls, 0, 0);
+ if (ret < 0) {
+ fprintf(stderr, "gnutls_x509_trust_add_crls: %s",
+ gnutls_strerror(ret));
+ exit(1);
+ }
- if (ca == NULL) {
- x509_ca_list = &x509_cert_list[x509_ncerts - 1];
- x509_ncas = 1;
+ gnutls_free(x509_crl_list);
}
fprintf(stdout, "Loaded %d certificates, %d CAs and %d CRLs\n\n",
x509_ncerts, x509_ncas, x509_ncrls);
- ret =
- gnutls_x509_trust_list_add_cas(list, x509_ca_list, x509_ncas,
- 0);
- if (ret < 0) {
- fprintf(stderr, "gnutls_x509_trust_add_cas: %s",
- gnutls_strerror(ret));
- exit(1);
- }
-
- ret =
- gnutls_x509_trust_list_add_crls(list, x509_crl_list,
- x509_ncrls, 0, 0);
- if (ret < 0) {
- fprintf(stderr, "gnutls_x509_trust_add_crls: %s",
- gnutls_strerror(ret));
- exit(1);
- }
-
- gnutls_free(x509_crl_list);
ret =
gnutls_x509_trust_list_verify_crt(list, x509_cert_list,
buf[size] = 0;
- _verify_x509_mem(buf, size, NULL, 0);
+ _verify_x509_mem(buf, size, NULL, 0, 0);
}
static void verify_certificate(common_info_st * cinfo)
{
char *cert;
- char *cas;
- size_t cert_size, ca_size;
- FILE *ca_file = fopen(cinfo->ca, "r");
-
- if (ca_file == NULL) {
- fprintf(stderr, "opening CA file");
- exit(1);
- }
+ char *cas = NULL;
+ size_t cert_size, ca_size = 0;
+ FILE *ca_file;
cert = (void *) fread_file(infile, &cert_size);
if (cert == NULL) {
exit(1);
}
- cert[cert_size] = 0;
+ if (cinfo->ca != NULL) {
+ ca_file = fopen(cinfo->ca, "r");
+ if (ca_file == NULL) {
+ fprintf(stderr, "Could not open %s\n", cinfo->ca);
+ exit(1);
+ }
- cas = (void *) fread_file(ca_file, &ca_size);
- if (cas == NULL) {
- fprintf(stderr, "reading CA list");
- exit(1);
- }
+ cert[cert_size] = 0;
- cas[ca_size] = 0;
- fclose(ca_file);
+ cas = (void *) fread_file(ca_file, &ca_size);
+ if (cas == NULL) {
+ fprintf(stderr, "reading CA list");
+ exit(1);
+ }
+
+ cas[ca_size] = 0;
+ fclose(ca_file);
+ }
- _verify_x509_mem(cert, cert_size, cas, ca_size);
+ _verify_x509_mem(cert, cert_size, cas, ca_size,
+ (cinfo->ca != NULL) ? 0 : 1);
}
projects / thirdparty / gnutls.git / commitdiff
