Home Download GitHub News Documentation FAQ Tutorial API reference Examples XML Digital Signature XML Encryption XML Canonicalization Reporting Bugs Mailing list Related Authors
# XMLSEC1 Index Return to Main Contents ## NAME ## SYNOPSIS xmlsec,<command> /,<options>/,<files>/ ## DESCRIPTION --help display this help information and exit --help-all display help information for all commands/options and exit --help-<cmd> display help information for command <cmd> and exit --version print version information and exit --keys keys XML file manipulation --sign sign data and output XML document --verify verify signed document --encrypt encrypt data and output XML document --decrypt decrypt data from XML document ## OPTIONS --ignore-manifests do not process <dsig:Manifest> elements --store-references store and print the result of <dsig:Reference/> element processing just before calculating digest --store-signatures store and print the result of <dsig:Signature> processing just before calculating signature --enabled-reference-uris <list> comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the <dsig:Reference> element --enable-visa3d-hack enables Visa3D protocol specific hack for URI attributes processing when we are trying not to use XPath/XPointer engine; this is a hack and I don't know what else might be broken in your application when you use it (also check "--id-attr" option because you might need it) --enable-asn1-signatures-hack enables support for ASN1 signature values generated by some XMLDsig implementations. --hmac-min-out-len <bits> sets minimum HMAC output length to <bits> --binary-data <file> binary <file> to encrypt --xml-data <file> XML <file> to encrypt --enabled-cipher-reference-uris <list> comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the <enc:CipherReference> element --session-key <keyKlass>-<keySize> generate new session <keyKlass> key of <keySize> bits size (for example, "--session des-192" generates a new 192 bits DES key for DES3 encryption) --output <filename> write result document to file <filename>; the <filename> can be a template and include '{inputfile}' which will be repaced with the input filename --print-debug print debug information to stdout --print-xml-debug print debug information to stdout in xml format --dtd-file <file> load the specified file as the DTD --node-id <id> set the operation start point to the node with given <id> --node-name [<namespace-uri>:]<name> set the operation start point to the first node with given <name> and <namespace> URI --node-xpath <expr> set the operation start point to the first node selected by the specified XPath expression --id-attr[:<attr-name>] [<node-namespace-uri>:]<node-name> adds attributes <attr-name> (default value "id") from all nodes with<node-name> and namespace <node-namespace-uri> to the list of known ID attributes; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option) --add-id-attr <id-attribute-name> adds attribute <id-attribute-name> to all nodes in the document; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option) --enabled-key-data <list> comma-separated list of key-data types to enable. Example: rsa,key-value,x509 -> populates <RSAKeyValue> and keeps <X509Data> when <KeyValue/> and <X509Data/> placeholders are present in the template. Use "--list-key-data" to view full list of registered key data klasses. By default, all registered key data are enabled. --enabled-retrieval-method-uris <list> comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the <dsig:RetrievalMethod> element. --enabled-key-info-reference-uris <list> comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the <dsig11:KeyInfoReference> element. --gen-key[:<name>] <keyKlass>-<keySize> generate new <keyKlass> key of <keySize> bits size, set the key name to <name> and add the result to keys manager (for example, "--gen:MyKeyName rsa-1024" generates a new 1024 bits RSA key and sets it's name to "MyKeyName") --keys-file <file> load keys from XML file --privkey-pem[:<name>] <file>[,<cafile>[,<cafile>[...]]] load private key from PEM file and certificates that verify this key --privkey-der[:<name>] <file>[,<cafile>[,<cafile>[...]]] load private key from DER file and certificates that verify this key --pkcs8-pem[:<name>] <file>[,<cafile>[,<cafile>[...]]] load private key from PKCS8 PEM file and PEM certificates that verify this key --pkcs8-der[:<name>] <file>[,<cafile>[,<cafile>[...]]] load private key from PKCS8 DER file and DER certificates that verify this key --privkey-openssl-store[:<name>] <uri> load private key and certs through OpenSSL ossl_store interface (e.g. from HSM) --privkey-openssl-engine[:<name>] <openssl-engine>;<openssl-key-id>[,<crtfile>[,<crtfile>[...]]] load private key by OpenSSL ENGINE interface; specify the name of engine (like with -engine params), the key specs (like with -inkey or -key params) and optionally certificates that verify this key --pubkey-pem[:<name>] <file> load public key from PEM file --pubkey-der[:<name>] <file> load public key from DER file --pubkey-openssl-store[:<name>] <uri> load pubkey key and certs through OpenSSL ossl_store interface (e.g. from HSM) --pubkey-openssl-engine[:<name>] <openssl-engine>;<openssl-key-id>[,<crtfile>[,<crtfile>[...]]] load public key by OpenSSL ENGINE interface; specify the name of engine (like with -engine params), the key specs (like with -inkey or -key params) and optionally certificates that verify this key --pwd <password> the password to use for reading keys and certs --lax-key-search enable lax key search (e.g. by key type like "rsa") vs default strict key search mode using only information from <dsig:KeyInfo/> node (e.g. key name) --verify-keys force verification of public/private keys loaded from the command: keys are required to have a key certificate that will be verified against the certificates in the key store --aes-key[:<name>] <file> load AES key from binary file <file> --camellia-key[:<name>] <file> load Camellia key from binary file <file> --chacha20-key[:<name>] <file> load ChaCha20 key from binary file <file> --concatkdf-key[:<name>] <file> load ConcatKDF key from binary file <file> --des-key[:<name>] <file> load DES key from binary file <file> --hmac-key[:<name>] <file> load HMAC key from binary file <file> --pbkdf2-key[:<name>] <file> load Pbkdf2 key from binary file <file> --hkdf-key[:<name>] <file> load HKDF key (IKM) from binary file <file> --pkcs12[:<name>] <file> load load private key from pkcs12 file <file> --pkcs12-persist persist loaded private key --pubkey-cert-pem[:<name>] <file> load public key from PEM cert file --pubkey-cert-der[:<name>] <file> load public key from DER cert file --trusted-pem <file> load trusted (root) certificate from PEM file <file> --untrusted-pem <file> load untrusted certificate from PEM file <file> --trusted-der <file> load trusted (root) certificate from DER file <file> --untrusted-der <file> load untrusted certificate from DER file <file> --crl-pem <file> load CRLs from PEM file <file> --crl-der <file> load CRLs from DER file <file> --verify-crls force verification of loaded CRLs: CRLs are required to have a valid signature from an issuer certificate in the trusted or untrusted certificate store, and must be within their validity period (thisUpdate/nextUpdate) --verification-time <time> the local time in "YYYY-MM-DD HH:MM:SS" format used certificates verification --verification-gmt-time <time> the GMT time in "YYYY-MM-DD HH:MM:SS" format used certificates verification --X509-skip-time-checks skip time checking of X509 certificates and CLRs --depth <number> maximum certificates chain depth --X509-skip-strict-checks skip strict checking of X509 data --insecure do not verify certificates or CRLs --crypto <name> the name of the crypto engine to use from the following list: openssl, mscrypto, nss, gnutls, gcrypt (if no crypto engine is specified then the default one is used) --crypto-config <path> path to crypto engine configuration --verbose print detailed error messages --print-crypto-library-errors print errors from crypto library (OpenSSL only) --repeat <number> repeat the operation <number> times --base64-line-size <size> sets the max line size for base64 encodings to <size> --transform-binary-chunk-size <size> sets the transforms binary processing chunk size to <size>; increasing chunk size might improve performance at the expense of increased memory usage --xxe enable External Entity resolution. WARNING: this may allow the reading of arbitrary files and URLs, controlled by the input XML document. Use with caution! --url-map:<url> <file> maps a given <url> to the given <file> for loading external resources --help print help information about the command ## AUTHOR aleksey@aleksey.com ## REPORTING BUGS http://www.aleksey.com/xmlsec/bugs.html ## COPYRIGHT aleksey@aleksey.com ## Index NAME SYNOPSIS DESCRIPTION OPTIONS AUTHOR REPORTING BUGS COPYRIGHT man2html