1*0a6a1f1dSLionel Sambuc=pod 2*0a6a1f1dSLionel Sambuc 3*0a6a1f1dSLionel Sambuc=for comment 4*0a6a1f1dSLionel SambucOriginal text by James Westby, contributed under the OpenSSL license. 5*0a6a1f1dSLionel Sambuc 6*0a6a1f1dSLionel Sambuc=head1 NAME 7*0a6a1f1dSLionel Sambuc 8*0a6a1f1dSLionel Sambucc_rehash - Create symbolic links to files named by the hash values 9*0a6a1f1dSLionel Sambuc 10*0a6a1f1dSLionel Sambuc=head1 SYNOPSIS 11*0a6a1f1dSLionel Sambuc 12*0a6a1f1dSLionel SambucB<c_rehash> 13*0a6a1f1dSLionel Sambuc[ I<directory>...] 14*0a6a1f1dSLionel Sambuc 15*0a6a1f1dSLionel Sambuc=head1 DESCRIPTION 16*0a6a1f1dSLionel Sambuc 17*0a6a1f1dSLionel SambucB<c_rehash> scans directories and calculates a hash value of each C<.pem> 18*0a6a1f1dSLionel Sambucfile in the specified directory list and creates symbolic links 19*0a6a1f1dSLionel Sambucfor each file, where the name of the link is the hash value. 20*0a6a1f1dSLionel SambucThis utility is useful as many programs that use OpenSSL require 21*0a6a1f1dSLionel Sambucdirectories to be set up like this in order to find certificates. 22*0a6a1f1dSLionel Sambuc 23*0a6a1f1dSLionel SambucIf any directories are named on the command line, then those are 24*0a6a1f1dSLionel Sambucprocessed in turn. If not, then the B<SSL_CERT_DIR> environment variable 25*0a6a1f1dSLionel Sambucis consulted; this shold be a colon-separated list of directories, 26*0a6a1f1dSLionel Sambuclike the Unix B<PATH> variable. 27*0a6a1f1dSLionel SambucIf that is not set then the default directory (installation-specific 28*0a6a1f1dSLionel Sambucbut often B</usr/local/ssl/certs>) is processed. 29*0a6a1f1dSLionel Sambuc 30*0a6a1f1dSLionel SambucIn order for a directory to be processed, the user must have write 31*0a6a1f1dSLionel Sambucpermissions on that directory, otherwise it will be skipped. 32*0a6a1f1dSLionel SambucThe links created are of the form C<HHHHHHHH.D>, where each B<H> 33*0a6a1f1dSLionel Sambucis a hexadecimal character and B<D> is a single decimal digit. 34*0a6a1f1dSLionel SambucWhen processing a directory, B<c_rehash> will first remove all links 35*0a6a1f1dSLionel Sambucthat have a name in that syntax. If you have links in that format 36*0a6a1f1dSLionel Sambucused for other purposes, they will be removed. 37*0a6a1f1dSLionel SambucHashes for CRL's look similar except the letter B<r> appears after 38*0a6a1f1dSLionel Sambucthe period, like this: C<HHHHHHHH.rD>. 39*0a6a1f1dSLionel Sambuc 40*0a6a1f1dSLionel SambucMultiple objects may have the same hash; they will be indicated by 41*0a6a1f1dSLionel Sambucincrementing the B<D> value. Duplicates are found by comparing the 42*0a6a1f1dSLionel Sambucfull SHA-1 fingerprint. A warning will be displayed if a duplicate 43*0a6a1f1dSLionel Sambucis found. 44*0a6a1f1dSLionel Sambuc 45*0a6a1f1dSLionel SambucA warning will also be displayed if there are B<.pem> files that 46*0a6a1f1dSLionel Sambuccannot be parsed as either a certificate or a CRL. 47*0a6a1f1dSLionel Sambuc 48*0a6a1f1dSLionel SambucThe program uses the B<openssl> program to compute the hashes and 49*0a6a1f1dSLionel Sambucfingerprints. If not found in the user's B<PATH>, then set the 50*0a6a1f1dSLionel SambucB<OPENSSL> environment variable to the full pathname. 51*0a6a1f1dSLionel SambucAny program can be used, it will be invoked as follows for either 52*0a6a1f1dSLionel Sambuca certificate or CRL: 53*0a6a1f1dSLionel Sambuc 54*0a6a1f1dSLionel Sambuc $OPENSSL x509 -hash -fingerprint -noout -in FFFFFF 55*0a6a1f1dSLionel Sambuc $OPENSSL crl -hash -fingerprint -noout -in FFFFFF 56*0a6a1f1dSLionel Sambuc 57*0a6a1f1dSLionel Sambucwhere B<FFFFFF> is the filename. It must output the hash of the 58*0a6a1f1dSLionel Sambucfile on the first line, and the fingerprint on the second, 59*0a6a1f1dSLionel Sambucoptionally prefixed with some text and an equals sign. 60*0a6a1f1dSLionel Sambuc 61*0a6a1f1dSLionel Sambuc=head1 ENVIRONMENT 62*0a6a1f1dSLionel Sambuc 63*0a6a1f1dSLionel Sambuc=over 64*0a6a1f1dSLionel Sambuc 65*0a6a1f1dSLionel Sambuc=item B<OPENSSL> 66*0a6a1f1dSLionel Sambuc 67*0a6a1f1dSLionel SambucThe path to an executable to use to generate hashes and 68*0a6a1f1dSLionel Sambucfingerprints (see above). 69*0a6a1f1dSLionel Sambuc 70*0a6a1f1dSLionel Sambuc=item B<SSL_CERT_DIR> 71*0a6a1f1dSLionel Sambuc 72*0a6a1f1dSLionel SambucColon separated list of directories to operate on. 73*0a6a1f1dSLionel SambucIgnored if directories are listed on the command line. 74*0a6a1f1dSLionel Sambuc 75*0a6a1f1dSLionel Sambuc=back 76*0a6a1f1dSLionel Sambuc 77*0a6a1f1dSLionel Sambuc=head1 SEE ALSO 78*0a6a1f1dSLionel Sambuc 79*0a6a1f1dSLionel SambucL<openssl(1)|openssl(1)>, 80*0a6a1f1dSLionel SambucL<crl(1)|crl(1)>. 81*0a6a1f1dSLionel SambucL<x509(1)|x509(1)>. 82