security/nss/doc/nroff/vfychain.1@b8a032363ba2 (annotated)
security/nss/doc/nroff/vfychain.1
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | '\" t |
| michael@0 | 2 | .\" Title: VFYCHAIN |
| michael@0 | 3 | .\" Author: [see the "Authors" section] |
| michael@0 | 4 | .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> |
| michael@0 | 5 | .\" Date: 5 June 2014 |
| michael@0 | 6 | .\" Manual: NSS Security Tools |
| michael@0 | 7 | .\" Source: nss-tools |
| michael@0 | 8 | .\" Language: English |
| michael@0 | 9 | .\" |
| michael@0 | 10 | .TH "VFYCHAIN" "1" "5 June 2014" "nss-tools" "NSS Security Tools" |
| michael@0 | 11 | .\" ----------------------------------------------------------------- |
| michael@0 | 12 | .\" * Define some portability stuff |
| michael@0 | 13 | .\" ----------------------------------------------------------------- |
| michael@0 | 14 | .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| michael@0 | 15 | .\" http://bugs.debian.org/507673 |
| michael@0 | 16 | .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html |
| michael@0 | 17 | .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| michael@0 | 18 | .ie \n(.g .ds Aq \(aq |
| michael@0 | 19 | .el .ds Aq ' |
| michael@0 | 20 | .\" ----------------------------------------------------------------- |
| michael@0 | 21 | .\" * set default formatting |
| michael@0 | 22 | .\" ----------------------------------------------------------------- |
| michael@0 | 23 | .\" disable hyphenation |
| michael@0 | 24 | .nh |
| michael@0 | 25 | .\" disable justification (adjust text to left margin only) |
| michael@0 | 26 | .ad l |
| michael@0 | 27 | .\" ----------------------------------------------------------------- |
| michael@0 | 28 | .\" * MAIN CONTENT STARTS HERE * |
| michael@0 | 29 | .\" ----------------------------------------------------------------- |
| michael@0 | 30 | .SH "NAME" |
| michael@0 | 31 | vfychain_ \- vfychain [options] [revocation options] certfile [[options] certfile] \&.\&.\&. |
| michael@0 | 32 | .SH "SYNOPSIS" |
| michael@0 | 33 | .HP \w'\fBvfychain\fR\ 'u |
| michael@0 | 34 | \fBvfychain\fR |
| michael@0 | 35 | .SH "STATUS" |
| michael@0 | 36 | .PP |
| michael@0 | 37 | This documentation is still work in progress\&. Please contribute to the initial review in |
| michael@0 | 38 | \m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2 |
| michael@0 | 39 | .SH "DESCRIPTION" |
| michael@0 | 40 | .PP |
| michael@0 | 41 | The verification Tool, |
| michael@0 | 42 | \fBvfychain\fR, verifies certificate chains\&. |
| michael@0 | 43 | \fBmodutil\fR |
| michael@0 | 44 | can add and delete PKCS #11 modules, change passwords on security databases, set defaults, list module contents, enable or disable slots, enable or disable FIPS 140\-2 compliance, and assign default providers for cryptographic operations\&. This tool can also create certificate, key, and module security database files\&. |
| michael@0 | 45 | .PP |
| michael@0 | 46 | The tasks associated with security module database management are part of a process that typically also involves managing key databases and certificate databases\&. |
| michael@0 | 47 | .SH "OPTIONS" |
| michael@0 | 48 | .PP |
| michael@0 | 49 | \fB\-a\fR |
| michael@0 | 50 | .RS 4 |
| michael@0 | 51 | the following certfile is base64 encoded |
| michael@0 | 52 | .RE |
| michael@0 | 53 | .PP |
| michael@0 | 54 | \fB\-b \fR \fIYYMMDDHHMMZ\fR |
| michael@0 | 55 | .RS 4 |
| michael@0 | 56 | Validate date (default: now) |
| michael@0 | 57 | .RE |
| michael@0 | 58 | .PP |
| michael@0 | 59 | \fB\-d \fR \fIdirectory\fR |
| michael@0 | 60 | .RS 4 |
| michael@0 | 61 | database directory |
| michael@0 | 62 | .RE |
| michael@0 | 63 | .PP |
| michael@0 | 64 | \fB\-f \fR |
| michael@0 | 65 | .RS 4 |
| michael@0 | 66 | Enable cert fetching from AIA URL |
| michael@0 | 67 | .RE |
| michael@0 | 68 | .PP |
| michael@0 | 69 | \fB\-o \fR \fIoid\fR |
| michael@0 | 70 | .RS 4 |
| michael@0 | 71 | Set policy OID for cert validation(Format OID\&.1\&.2\&.3) |
| michael@0 | 72 | .RE |
| michael@0 | 73 | .PP |
| michael@0 | 74 | \fB\-p \fR |
| michael@0 | 75 | .RS 4 |
| michael@0 | 76 | Use PKIX Library to validate certificate by calling: |
| michael@0 | 77 | .sp |
| michael@0 | 78 | * CERT_VerifyCertificate if specified once, |
| michael@0 | 79 | .sp |
| michael@0 | 80 | * CERT_PKIXVerifyCert if specified twice and more\&. |
| michael@0 | 81 | .RE |
| michael@0 | 82 | .PP |
| michael@0 | 83 | \fB\-r \fR |
| michael@0 | 84 | .RS 4 |
| michael@0 | 85 | Following certfile is raw binary DER (default) |
| michael@0 | 86 | .RE |
| michael@0 | 87 | .PP |
| michael@0 | 88 | \fB\-t\fR |
| michael@0 | 89 | .RS 4 |
| michael@0 | 90 | Following cert is explicitly trusted (overrides db trust) |
| michael@0 | 91 | .RE |
| michael@0 | 92 | .PP |
| michael@0 | 93 | \fB\-u \fR \fIusage\fR |
| michael@0 | 94 | .RS 4 |
| michael@0 | 95 | 0=SSL client, 1=SSL server, 2=SSL StepUp, 3=SSL CA, 4=Email signer, 5=Email recipient, 6=Object signer, 9=ProtectedObjectSigner, 10=OCSP responder, 11=Any CA |
| michael@0 | 96 | .RE |
| michael@0 | 97 | .PP |
| michael@0 | 98 | \fB\-T \fR |
| michael@0 | 99 | .RS 4 |
| michael@0 | 100 | Trust both explicit trust anchors (\-t) and the database\&. (Without this option, the default is to only trust certificates marked \-t, if there are any, or to trust the database if there are certificates marked \-t\&.) |
| michael@0 | 101 | .RE |
| michael@0 | 102 | .PP |
| michael@0 | 103 | \fB\-v \fR |
| michael@0 | 104 | .RS 4 |
| michael@0 | 105 | Verbose mode\&. Prints root cert subject(double the argument for whole root cert info) |
| michael@0 | 106 | .RE |
| michael@0 | 107 | .PP |
| michael@0 | 108 | \fB\-w \fR \fIpassword\fR |
| michael@0 | 109 | .RS 4 |
| michael@0 | 110 | Database password |
| michael@0 | 111 | .RE |
| michael@0 | 112 | .PP |
| michael@0 | 113 | \fB\-W \fR \fIpwfile\fR |
| michael@0 | 114 | .RS 4 |
| michael@0 | 115 | Password file |
| michael@0 | 116 | .RE |
| michael@0 | 117 | .PP |
| michael@0 | 118 | .RS 4 |
| michael@0 | 119 | Revocation options for PKIX API (invoked with \-pp options) is a collection of the following flags: [\-g type [\-h flags] [\-m type [\-s flags]] \&.\&.\&.] \&.\&.\&. |
| michael@0 | 120 | .sp |
| michael@0 | 121 | Where: |
| michael@0 | 122 | .RE |
| michael@0 | 123 | .PP |
| michael@0 | 124 | \fB\-g \fR \fItest\-type\fR |
| michael@0 | 125 | .RS 4 |
| michael@0 | 126 | Sets status checking test type\&. Possible values are "leaf" or "chain" |
| michael@0 | 127 | .RE |
| michael@0 | 128 | .PP |
| michael@0 | 129 | \fB\-g \fR \fItest type\fR |
| michael@0 | 130 | .RS 4 |
| michael@0 | 131 | Sets status checking test type\&. Possible values are "leaf" or "chain"\&. |
| michael@0 | 132 | .RE |
| michael@0 | 133 | .PP |
| michael@0 | 134 | \fB\-h \fR \fItest flags\fR |
| michael@0 | 135 | .RS 4 |
| michael@0 | 136 | Sets revocation flags for the test type it follows\&. Possible flags: "testLocalInfoFirst" and "requireFreshInfo"\&. |
| michael@0 | 137 | .RE |
| michael@0 | 138 | .PP |
| michael@0 | 139 | \fB\-m \fR \fImethod type\fR |
| michael@0 | 140 | .RS 4 |
| michael@0 | 141 | Sets method type for the test type it follows\&. Possible types are "crl" and "ocsp"\&. |
| michael@0 | 142 | .RE |
| michael@0 | 143 | .PP |
| michael@0 | 144 | \fB\-s \fR \fImethod flags\fR |
| michael@0 | 145 | .RS 4 |
| michael@0 | 146 | Sets revocation flags for the method it follows\&. Possible types are "doNotUse", "forbidFetching", "ignoreDefaultSrc", "requireInfo" and "failIfNoInfo"\&. |
| michael@0 | 147 | .RE |
| michael@0 | 148 | .SH "ADDITIONAL RESOURCES" |
| michael@0 | 149 | .PP |
| michael@0 | 150 | For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at |
| michael@0 | 151 | \m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&. |
| michael@0 | 152 | .PP |
| michael@0 | 153 | Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto |
| michael@0 | 154 | .PP |
| michael@0 | 155 | IRC: Freenode at #dogtag\-pki |
| michael@0 | 156 | .SH "AUTHORS" |
| michael@0 | 157 | .PP |
| michael@0 | 158 | The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&. |
| michael@0 | 159 | .PP |
| michael@0 | 160 | Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&. |
| michael@0 | 161 | .SH "LICENSE" |
| michael@0 | 162 | .PP |
| michael@0 | 163 | Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&. |
| michael@0 | 164 | .SH "NOTES" |
| michael@0 | 165 | .IP " 1." 4 |
| michael@0 | 166 | Mozilla NSS bug 836477 |
| michael@0 | 167 | .RS 4 |
| michael@0 | 168 | \%https://bugzilla.mozilla.org/show_bug.cgi?id=836477 |
| michael@0 | 169 | .RE |
