1*2175Sjp161948=pod 2*2175Sjp161948 3*2175Sjp161948=head1 NAME 4*2175Sjp161948 5*2175Sjp161948spkac - SPKAC printing and generating utility 6*2175Sjp161948 7*2175Sjp161948=head1 SYNOPSIS 8*2175Sjp161948 9*2175Sjp161948B<openssl> B<spkac> 10*2175Sjp161948[B<-in filename>] 11*2175Sjp161948[B<-out filename>] 12*2175Sjp161948[B<-key keyfile>] 13*2175Sjp161948[B<-passin arg>] 14*2175Sjp161948[B<-challenge string>] 15*2175Sjp161948[B<-pubkey>] 16*2175Sjp161948[B<-spkac spkacname>] 17*2175Sjp161948[B<-spksect section>] 18*2175Sjp161948[B<-noout>] 19*2175Sjp161948[B<-verify>] 20*2175Sjp161948[B<-engine id>] 21*2175Sjp161948 22*2175Sjp161948=head1 DESCRIPTION 23*2175Sjp161948 24*2175Sjp161948The B<spkac> command processes Netscape signed public key and challenge 25*2175Sjp161948(SPKAC) files. It can print out their contents, verify the signature and 26*2175Sjp161948produce its own SPKACs from a supplied private key. 27*2175Sjp161948 28*2175Sjp161948=head1 COMMAND OPTIONS 29*2175Sjp161948 30*2175Sjp161948=over 4 31*2175Sjp161948 32*2175Sjp161948=item B<-in filename> 33*2175Sjp161948 34*2175Sjp161948This specifies the input filename to read from or standard input if this 35*2175Sjp161948option is not specified. Ignored if the B<-key> option is used. 36*2175Sjp161948 37*2175Sjp161948=item B<-out filename> 38*2175Sjp161948 39*2175Sjp161948specifies the output filename to write to or standard output by 40*2175Sjp161948default. 41*2175Sjp161948 42*2175Sjp161948=item B<-key keyfile> 43*2175Sjp161948 44*2175Sjp161948create an SPKAC file using the private key in B<keyfile>. The 45*2175Sjp161948B<-in>, B<-noout>, B<-spksect> and B<-verify> options are ignored if 46*2175Sjp161948present. 47*2175Sjp161948 48*2175Sjp161948=item B<-passin password> 49*2175Sjp161948 50*2175Sjp161948the input file password source. For more information about the format of B<arg> 51*2175Sjp161948see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>. 52*2175Sjp161948 53*2175Sjp161948=item B<-challenge string> 54*2175Sjp161948 55*2175Sjp161948specifies the challenge string if an SPKAC is being created. 56*2175Sjp161948 57*2175Sjp161948=item B<-spkac spkacname> 58*2175Sjp161948 59*2175Sjp161948allows an alternative name form the variable containing the 60*2175Sjp161948SPKAC. The default is "SPKAC". This option affects both 61*2175Sjp161948generated and input SPKAC files. 62*2175Sjp161948 63*2175Sjp161948=item B<-spksect section> 64*2175Sjp161948 65*2175Sjp161948allows an alternative name form the section containing the 66*2175Sjp161948SPKAC. The default is the default section. 67*2175Sjp161948 68*2175Sjp161948=item B<-noout> 69*2175Sjp161948 70*2175Sjp161948don't output the text version of the SPKAC (not used if an 71*2175Sjp161948SPKAC is being created). 72*2175Sjp161948 73*2175Sjp161948=item B<-pubkey> 74*2175Sjp161948 75*2175Sjp161948output the public key of an SPKAC (not used if an SPKAC is 76*2175Sjp161948being created). 77*2175Sjp161948 78*2175Sjp161948=item B<-verify> 79*2175Sjp161948 80*2175Sjp161948verifies the digital signature on the supplied SPKAC. 81*2175Sjp161948 82*2175Sjp161948=item B<-engine id> 83*2175Sjp161948 84*2175Sjp161948specifying an engine (by it's unique B<id> string) will cause B<req> 85*2175Sjp161948to attempt to obtain a functional reference to the specified engine, 86*2175Sjp161948thus initialising it if needed. The engine will then be set as the default 87*2175Sjp161948for all available algorithms. 88*2175Sjp161948 89*2175Sjp161948=back 90*2175Sjp161948 91*2175Sjp161948=head1 EXAMPLES 92*2175Sjp161948 93*2175Sjp161948Print out the contents of an SPKAC: 94*2175Sjp161948 95*2175Sjp161948 openssl spkac -in spkac.cnf 96*2175Sjp161948 97*2175Sjp161948Verify the signature of an SPKAC: 98*2175Sjp161948 99*2175Sjp161948 openssl spkac -in spkac.cnf -noout -verify 100*2175Sjp161948 101*2175Sjp161948Create an SPKAC using the challenge string "hello": 102*2175Sjp161948 103*2175Sjp161948 openssl spkac -key key.pem -challenge hello -out spkac.cnf 104*2175Sjp161948 105*2175Sjp161948Example of an SPKAC, (long lines split up for clarity): 106*2175Sjp161948 107*2175Sjp161948 SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA1cCoq2Wa3Ixs47uI7F\ 108*2175Sjp161948 PVwHVIPDx5yso105Y6zpozam135a8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03u\ 109*2175Sjp161948 PFoQIDAQABFgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJh1bEIYuc\ 110*2175Sjp161948 2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnDdq+NQ3F+X4deMx9AaEglZtULwV\ 111*2175Sjp161948 4= 112*2175Sjp161948 113*2175Sjp161948=head1 NOTES 114*2175Sjp161948 115*2175Sjp161948A created SPKAC with suitable DN components appended can be fed into 116*2175Sjp161948the B<ca> utility. 117*2175Sjp161948 118*2175Sjp161948SPKACs are typically generated by Netscape when a form is submitted 119*2175Sjp161948containing the B<KEYGEN> tag as part of the certificate enrollment 120*2175Sjp161948process. 121*2175Sjp161948 122*2175Sjp161948The challenge string permits a primitive form of proof of possession 123*2175Sjp161948of private key. By checking the SPKAC signature and a random challenge 124*2175Sjp161948string some guarantee is given that the user knows the private key 125*2175Sjp161948corresponding to the public key being certified. This is important in 126*2175Sjp161948some applications. Without this it is possible for a previous SPKAC 127*2175Sjp161948to be used in a "replay attack". 128*2175Sjp161948 129*2175Sjp161948=head1 SEE ALSO 130*2175Sjp161948 131*2175Sjp161948L<ca(1)|ca(1)> 132*2175Sjp161948 133*2175Sjp161948=cut 134