sort the options in verify man page alphabetically
just making sure the options are listed in the alphabetical order both in SYNOPSIS and DESCRIPTION, no text changes
This commit is contained in:
Hubert Kario
Matt Caswell
parent
cd028c8e66
commit
2866441a90
@ -7,37 +7,37 @@ verify - Utility to verify certificates.
|
||||
=head1 SYNOPSIS
|
||||
|
||||
B<openssl> B<verify>
|
||||
[B<-CApath directory>]
|
||||
[B<-CAfile file>]
|
||||
[B<-CApath directory>]
|
||||
[B<-attime timestamp>]
|
||||
[B<-check_ss_sig>]
|
||||
[B<-trusted_first>]
|
||||
[B<-purpose purpose>]
|
||||
[B<-policy arg>]
|
||||
[B<-ignore_critical>]
|
||||
[B<-crl_check>]
|
||||
[B<-crl_check_all>]
|
||||
[B<-policy_check>]
|
||||
[B<-explicit_policy>]
|
||||
[B<-extended_crl>]
|
||||
[B<-help>]
|
||||
[B<-ignore_critical>]
|
||||
[B<-inhibit_any>]
|
||||
[B<-inhibit_map>]
|
||||
[B<-x509_strict>]
|
||||
[B<-extended_crl>]
|
||||
[B<-use_deltas>]
|
||||
[B<-policy_print>]
|
||||
[B<-untrusted file>]
|
||||
[B<-help>]
|
||||
[B<-issuer_checks>]
|
||||
[B<-attime timestamp>]
|
||||
[B<-partial_chain>]
|
||||
[B<-policy arg>]
|
||||
[B<-policy_check>]
|
||||
[B<-policy_print>]
|
||||
[B<-purpose purpose>]
|
||||
[B<-suiteB_128>]
|
||||
[B<-suiteB_128_only>]
|
||||
[B<-suiteB_192>]
|
||||
[B<-trusted_first>]
|
||||
[B<-untrusted file>]
|
||||
[B<-use_deltas>]
|
||||
[B<-verbose>]
|
||||
[B<-verify_depth num>]
|
||||
[B<-verify_email email>]
|
||||
[B<-verify_hostname hostname>]
|
||||
[B<-verify_ip ip>]
|
||||
[B<-verify_name name>]
|
||||
[B<-x509_strict>]
|
||||
[B<->]
|
||||
[certificates]
|
||||
|
||||
@ -50,6 +50,11 @@ The B<verify> command verifies certificate chains.
|
||||
|
||||
=over 4
|
||||
|
||||
=item B<-CAfile file>
|
||||
|
||||
A file of trusted certificates. The file should contain multiple certificates
|
||||
in PEM format concatenated together.
|
||||
|
||||
=item B<-CApath directory>
|
||||
|
||||
A directory of trusted certificates. The certificates should have names
|
||||
@ -58,77 +63,16 @@ form ("hash" is the hashed certificate subject name: see the B<-hash> option
|
||||
of the B<x509> utility). Under Unix the B<c_rehash> script will automatically
|
||||
create symbolic links to a directory of certificates.
|
||||
|
||||
=item B<-CAfile file>
|
||||
|
||||
A file of trusted certificates. The file should contain multiple certificates
|
||||
in PEM format concatenated together.
|
||||
|
||||
=item B<-untrusted file>
|
||||
|
||||
A file of untrusted certificates. The file should contain multiple certificates
|
||||
in PEM format concatenated together.
|
||||
|
||||
=item B<-trusted_first>
|
||||
|
||||
Use certificates in CA file or CA directory before certificates in untrusted
|
||||
file when building the trust chain to verify certificates.
|
||||
This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
|
||||
|
||||
=item B<-purpose purpose>
|
||||
|
||||
The intended use for the certificate. If this option is not specified,
|
||||
B<verify> will not consider certificate purpose during chain verification.
|
||||
Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
|
||||
B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
|
||||
information.
|
||||
|
||||
=item B<-help>
|
||||
|
||||
Print out a usage message.
|
||||
|
||||
=item B<-verbose>
|
||||
|
||||
Print extra information about the operations being performed.
|
||||
|
||||
=item B<-issuer_checks>
|
||||
|
||||
Print out diagnostics relating to searches for the issuer certificate of the
|
||||
current certificate. This shows why each candidate issuer certificate was
|
||||
rejected. The presence of rejection messages does not itself imply that
|
||||
anything is wrong; during the normal verification process, several
|
||||
rejections may take place.
|
||||
|
||||
=item B<-attime timestamp>
|
||||
|
||||
Perform validation checks using time specified by B<timestamp> and not
|
||||
current system time. B<timestamp> is the number of seconds since
|
||||
01.01.1970 (UNIX time).
|
||||
|
||||
=item B<-policy arg>
|
||||
=item B<-check_ss_sig>
|
||||
|
||||
Enable policy processing and add B<arg> to the user-initial-policy-set (see
|
||||
RFC5280). The policy B<arg> can be an object name an OID in numeric form.
|
||||
This argument can appear more than once.
|
||||
|
||||
=item B<-policy_check>
|
||||
|
||||
Enables certificate policy processing.
|
||||
|
||||
=item B<-explicit_policy>
|
||||
|
||||
Set policy variable require-explicit-policy (see RFC5280).
|
||||
|
||||
=item B<-inhibit_any>
|
||||
|
||||
Set policy variable inhibit-any-policy (see RFC5280).
|
||||
|
||||
=item B<-inhibit_map>
|
||||
|
||||
Set policy variable inhibit-policy-mapping (see RFC5280).
|
||||
|
||||
=item B<-policy_print>
|
||||
|
||||
Print out diagnostics related to policy processing.
|
||||
Verify the signature on the self-signed root CA. This is disabled by default
|
||||
because it doesn't add any security.
|
||||
|
||||
=item B<-crl_check>
|
||||
|
||||
@ -140,35 +84,67 @@ If a valid CRL cannot be found an error occurs.
|
||||
Checks the validity of B<all> certificates in the chain by attempting
|
||||
to look up valid CRLs.
|
||||
|
||||
=item B<-ignore_critical>
|
||||
=item B<-explicit_policy>
|
||||
|
||||
Normally if an unhandled critical extension is present which is not
|
||||
supported by OpenSSL the certificate is rejected (as required by RFC5280).
|
||||
If this option is set critical extensions are ignored.
|
||||
|
||||
=item B<-x509_strict>
|
||||
|
||||
For strict X.509 compliance, disable non-compliant workarounds for broken
|
||||
certificates.
|
||||
Set policy variable require-explicit-policy (see RFC5280).
|
||||
|
||||
=item B<-extended_crl>
|
||||
|
||||
Enable extended CRL features such as indirect CRLs and alternate CRL
|
||||
signing keys.
|
||||
|
||||
=item B<-use_deltas>
|
||||
=item B<-help>
|
||||
|
||||
Enable support for delta CRLs.
|
||||
Print out a usage message.
|
||||
|
||||
=item B<-check_ss_sig>
|
||||
=item B<-ignore_critical>
|
||||
|
||||
Verify the signature on the self-signed root CA. This is disabled by default
|
||||
because it doesn't add any security.
|
||||
Normally if an unhandled critical extension is present which is not
|
||||
supported by OpenSSL the certificate is rejected (as required by RFC5280).
|
||||
If this option is set critical extensions are ignored.
|
||||
|
||||
=item B<-inhibit_any>
|
||||
|
||||
Set policy variable inhibit-any-policy (see RFC5280).
|
||||
|
||||
=item B<-inhibit_map>
|
||||
|
||||
Set policy variable inhibit-policy-mapping (see RFC5280).
|
||||
|
||||
=item B<-issuer_checks>
|
||||
|
||||
Print out diagnostics relating to searches for the issuer certificate of the
|
||||
current certificate. This shows why each candidate issuer certificate was
|
||||
rejected. The presence of rejection messages does not itself imply that
|
||||
anything is wrong; during the normal verification process, several
|
||||
rejections may take place.
|
||||
|
||||
=item B<-partial_chain>
|
||||
|
||||
Allow partial certificate chain if at least one certificate is in trusted store.
|
||||
|
||||
=item B<-policy arg>
|
||||
|
||||
Enable policy processing and add B<arg> to the user-initial-policy-set (see
|
||||
RFC5280). The policy B<arg> can be an object name an OID in numeric form.
|
||||
This argument can appear more than once.
|
||||
|
||||
=item B<-policy_check>
|
||||
|
||||
Enables certificate policy processing.
|
||||
|
||||
=item B<-policy_print>
|
||||
|
||||
Print out diagnostics related to policy processing.
|
||||
|
||||
=item B<-purpose purpose>
|
||||
|
||||
The intended use for the certificate. If this option is not specified,
|
||||
B<verify> will not consider certificate purpose during chain verification.
|
||||
Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
|
||||
B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
|
||||
information.
|
||||
|
||||
=item B<-suiteB_128_only>, B<-suiteB_128>, B<-suiteB_192>
|
||||
|
||||
enable the Suite B mode operation at 128 bit Level of Security, 128 bit or
|
||||
@ -177,6 +153,25 @@ See RFC6460 for details. In particular the supported signature algorithms are
|
||||
reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves
|
||||
P-256 and P-384.
|
||||
|
||||
=item B<-trusted_first>
|
||||
|
||||
Use certificates in CA file or CA directory before certificates in untrusted
|
||||
file when building the trust chain to verify certificates.
|
||||
This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
|
||||
|
||||
=item B<-untrusted file>
|
||||
|
||||
A file of untrusted certificates. The file should contain multiple certificates
|
||||
in PEM format concatenated together.
|
||||
|
||||
=item B<-use_deltas>
|
||||
|
||||
Enable support for delta CRLs.
|
||||
|
||||
=item B<-verbose>
|
||||
|
||||
Print extra information about the operations being performed.
|
||||
|
||||
=item B<-verify_depth num>
|
||||
|
||||
Limit the maximum depth of the certificate chain to B<num> certificates.
|
||||
@ -202,6 +197,11 @@ Use default verification options like trust model and required certificate
|
||||
policies identified by B<name>.
|
||||
Supported usages include: default, pkcs7, smime_sign, ssl_client, ssl_server.
|
||||
|
||||
=item B<-x509_strict>
|
||||
|
||||
For strict X.509 compliance, disable non-compliant workarounds for broken
|
||||
certificates.
|
||||
|
||||
=item B<->
|
||||
|
||||
Indicates the last option. All arguments following this are assumed to be
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user