1=pod 2 3=head1 NAME 4 5openssl-spkac, 6spkac - SPKAC printing and generating utility 7 8=head1 SYNOPSIS 9 10B<openssl> B<spkac> 11[B<-help>] 12[B<-in filename>] 13[B<-out filename>] 14[B<-key keyfile>] 15[B<-keyform PEM|DER|ENGINE>] 16[B<-passin arg>] 17[B<-challenge string>] 18[B<-pubkey>] 19[B<-spkac spkacname>] 20[B<-spksect section>] 21[B<-noout>] 22[B<-verify>] 23[B<-engine id>] 24 25=head1 DESCRIPTION 26 27The B<spkac> command processes Netscape signed public key and challenge 28(SPKAC) files. It can print out their contents, verify the signature and 29produce its own SPKACs from a supplied private key. 30 31=head1 OPTIONS 32 33=over 4 34 35=item B<-help> 36 37Print out a usage message. 38 39=item B<-in filename> 40 41This specifies the input filename to read from or standard input if this 42option is not specified. Ignored if the B<-key> option is used. 43 44=item B<-out filename> 45 46Specifies the output filename to write to or standard output by 47default. 48 49=item B<-key keyfile> 50 51Create an SPKAC file using the private key in B<keyfile>. The 52B<-in>, B<-noout>, B<-spksect> and B<-verify> options are ignored if 53present. 54 55=item B<-keyform PEM|DER|ENGINE> 56 57Whether the key format is PEM, DER, or an engine-backed key. 58The default is PEM. 59 60=item B<-passin password> 61 62The input file password source. For more information about the format of B<arg> 63see L<openssl(1)/Pass Phrase Options>. 64 65=item B<-challenge string> 66 67Specifies the challenge string if an SPKAC is being created. 68 69=item B<-spkac spkacname> 70 71Allows an alternative name form the variable containing the 72SPKAC. The default is "SPKAC". This option affects both 73generated and input SPKAC files. 74 75=item B<-spksect section> 76 77Allows an alternative name form the section containing the 78SPKAC. The default is the default section. 79 80=item B<-noout> 81 82Don't output the text version of the SPKAC (not used if an 83SPKAC is being created). 84 85=item B<-pubkey> 86 87Output the public key of an SPKAC (not used if an SPKAC is 88being created). 89 90=item B<-verify> 91 92Verifies the digital signature on the supplied SPKAC. 93 94=item B<-engine id> 95 96Specifying an engine (by its unique B<id> string) will cause B<spkac> 97to attempt to obtain a functional reference to the specified engine, 98thus initialising it if needed. The engine will then be set as the default 99for all available algorithms. 100 101=back 102 103=head1 EXAMPLES 104 105Print out the contents of an SPKAC: 106 107 openssl spkac -in spkac.cnf 108 109Verify the signature of an SPKAC: 110 111 openssl spkac -in spkac.cnf -noout -verify 112 113Create an SPKAC using the challenge string "hello": 114 115 openssl spkac -key key.pem -challenge hello -out spkac.cnf 116 117Example of an SPKAC, (long lines split up for clarity): 118 119 SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA\ 120 1cCoq2Wa3Ixs47uI7FPVwHVIPDx5yso105Y6zpozam135a\ 121 8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03uPFoQIDAQAB\ 122 FgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJ\ 123 h1bEIYuc2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnD\ 124 dq+NQ3F+X4deMx9AaEglZtULwV4= 125 126=head1 NOTES 127 128A created SPKAC with suitable DN components appended can be fed into 129the B<ca> utility. 130 131SPKACs are typically generated by Netscape when a form is submitted 132containing the B<KEYGEN> tag as part of the certificate enrollment 133process. 134 135The challenge string permits a primitive form of proof of possession 136of private key. By checking the SPKAC signature and a random challenge 137string some guarantee is given that the user knows the private key 138corresponding to the public key being certified. This is important in 139some applications. Without this it is possible for a previous SPKAC 140to be used in a "replay attack". 141 142=head1 SEE ALSO 143 144L<ca(1)> 145 146=head1 COPYRIGHT 147 148Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved. 149 150Licensed under the OpenSSL license (the "License"). You may not use 151this file except in compliance with the License. You can obtain a copy 152in the file LICENSE in the source distribution or at 153L<https://www.openssl.org/source/license.html>. 154 155=cut 156