security/nss/doc/vfychain.xml@b8a032363ba2 (annotated)
security/nss/doc/vfychain.xml
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | <?xml version="1.0" encoding="UTF-8"?> |
| michael@0 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" |
| michael@0 | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ |
| michael@0 | 4 | <!ENTITY date SYSTEM "date.xml"> |
| michael@0 | 5 | <!ENTITY version SYSTEM "version.xml"> |
| michael@0 | 6 | ]> |
| michael@0 | 7 | |
| michael@0 | 8 | <refentry id="vfychain"> |
| michael@0 | 9 | |
| michael@0 | 10 | <refentryinfo> |
| michael@0 | 11 | <date>&date;</date> |
| michael@0 | 12 | <title>NSS Security Tools</title> |
| michael@0 | 13 | <productname>nss-tools</productname> |
| michael@0 | 14 | <productnumber>&version;</productnumber> |
| michael@0 | 15 | </refentryinfo> |
| michael@0 | 16 | |
| michael@0 | 17 | <refmeta> |
| michael@0 | 18 | <refentrytitle>VFYCHAIN</refentrytitle> |
| michael@0 | 19 | <manvolnum>1</manvolnum> |
| michael@0 | 20 | </refmeta> |
| michael@0 | 21 | |
| michael@0 | 22 | <refnamediv> |
| michael@0 | 23 | <refname>vfychain </refname> |
| michael@0 | 24 | <refpurpose>vfychain [options] [revocation options] certfile [[options] certfile] ...</refpurpose> |
| michael@0 | 25 | </refnamediv> |
| michael@0 | 26 | |
| michael@0 | 27 | <refsynopsisdiv> |
| michael@0 | 28 | <cmdsynopsis> |
| michael@0 | 29 | <command>vfychain</command> |
| michael@0 | 30 | </cmdsynopsis> |
| michael@0 | 31 | </refsynopsisdiv> |
| michael@0 | 32 | |
| michael@0 | 33 | <refsection> |
| michael@0 | 34 | <title>STATUS</title> |
| michael@0 | 35 | <para>This documentation is still work in progress. Please contribute to the initial review in <ulink url="https://bugzilla.mozilla.org/show_bug.cgi?id=836477">Mozilla NSS bug 836477</ulink> |
| michael@0 | 36 | </para> |
| michael@0 | 37 | </refsection> |
| michael@0 | 38 | |
| michael@0 | 39 | <refsection id="description"> |
| michael@0 | 40 | <title>Description</title> |
| michael@0 | 41 | <para>The verification Tool, <command>vfychain</command>, verifies certificate chains. <command>modutil</command> can add and delete PKCS #11 modules, change passwords on security databases, set defaults, list module contents, enable or disable slots, enable or disable FIPS 140-2 compliance, and assign default providers for cryptographic operations. This tool can also create certificate, key, and module security database files.</para> |
| michael@0 | 42 | |
| michael@0 | 43 | <para>The tasks associated with security module database management are part of a process that typically also involves managing key databases and certificate databases.</para> |
| michael@0 | 44 | </refsection> |
| michael@0 | 45 | |
| michael@0 | 46 | <refsection id="options"> |
| michael@0 | 47 | <title>Options</title> |
| michael@0 | 48 | |
| michael@0 | 49 | <variablelist> |
| michael@0 | 50 | |
| michael@0 | 51 | <varlistentry> |
| michael@0 | 52 | <term><option>-a</option></term> |
| michael@0 | 53 | <listitem> |
| michael@0 | 54 | <simpara>the following certfile is base64 encoded</simpara> |
| michael@0 | 55 | </listitem> |
| michael@0 | 56 | </varlistentry> |
| michael@0 | 57 | |
| michael@0 | 58 | <varlistentry> |
| michael@0 | 59 | <term><option>-b </option> <replaceable>YYMMDDHHMMZ</replaceable></term> |
| michael@0 | 60 | <listitem> |
| michael@0 | 61 | <simpara>Validate date (default: now)</simpara> |
| michael@0 | 62 | </listitem> |
| michael@0 | 63 | </varlistentry> |
| michael@0 | 64 | |
| michael@0 | 65 | <varlistentry> |
| michael@0 | 66 | <term><option>-d </option> <replaceable>directory</replaceable></term> <listitem> |
| michael@0 | 67 | <simpara>database directory</simpara> |
| michael@0 | 68 | </listitem> |
| michael@0 | 69 | </varlistentry> |
| michael@0 | 70 | |
| michael@0 | 71 | <varlistentry> |
| michael@0 | 72 | <term><option>-f </option> </term> |
| michael@0 | 73 | <listitem> |
| michael@0 | 74 | <simpara>Enable cert fetching from AIA URL</simpara> |
| michael@0 | 75 | </listitem> |
| michael@0 | 76 | </varlistentry> |
| michael@0 | 77 | |
| michael@0 | 78 | <varlistentry> |
| michael@0 | 79 | <term><option>-o </option> <replaceable>oid</replaceable></term> |
| michael@0 | 80 | <listitem> |
| michael@0 | 81 | <simpara>Set policy OID for cert validation(Format OID.1.2.3)</simpara> |
| michael@0 | 82 | </listitem> |
| michael@0 | 83 | </varlistentry> |
| michael@0 | 84 | |
| michael@0 | 85 | <varlistentry> |
| michael@0 | 86 | <term><option>-p </option></term> |
| michael@0 | 87 | <listitem> |
| michael@0 | 88 | <simpara>Use PKIX Library to validate certificate by calling:</simpara> |
| michael@0 | 89 | <simpara> * CERT_VerifyCertificate if specified once,</simpara> |
| michael@0 | 90 | <simpara> * CERT_PKIXVerifyCert if specified twice and more.</simpara> |
| michael@0 | 91 | </listitem> |
| michael@0 | 92 | </varlistentry> |
| michael@0 | 93 | |
| michael@0 | 94 | <varlistentry> |
| michael@0 | 95 | <term><option>-r </option></term> |
| michael@0 | 96 | <listitem> |
| michael@0 | 97 | <simpara>Following certfile is raw binary DER (default)</simpara> |
| michael@0 | 98 | </listitem> |
| michael@0 | 99 | </varlistentry> |
| michael@0 | 100 | |
| michael@0 | 101 | <varlistentry> |
| michael@0 | 102 | <term><option>-t</option></term> |
| michael@0 | 103 | <listitem> |
| michael@0 | 104 | <simpara>Following cert is explicitly trusted (overrides db trust)</simpara> |
| michael@0 | 105 | </listitem> |
| michael@0 | 106 | </varlistentry> |
| michael@0 | 107 | |
| michael@0 | 108 | <varlistentry> |
| michael@0 | 109 | <term><option>-u </option> <replaceable>usage</replaceable></term> |
| michael@0 | 110 | <listitem> |
| michael@0 | 111 | <para> |
| michael@0 | 112 | 0=SSL client, 1=SSL server, 2=SSL StepUp, 3=SSL CA, |
| michael@0 | 113 | 4=Email signer, 5=Email recipient, 6=Object signer, |
| michael@0 | 114 | 9=ProtectedObjectSigner, 10=OCSP responder, 11=Any CA |
| michael@0 | 115 | </para> |
| michael@0 | 116 | </listitem> |
| michael@0 | 117 | </varlistentry> |
| michael@0 | 118 | |
| michael@0 | 119 | <varlistentry> |
| michael@0 | 120 | <term><option>-T </option></term> |
| michael@0 | 121 | <listitem> |
| michael@0 | 122 | <simpara>Trust both explicit trust anchors (-t) and the database. (Without this option, the default is to only trust certificates marked -t, if there are any, or to trust the database if there are certificates marked -t.) |
| michael@0 | 123 | </simpara> |
| michael@0 | 124 | </listitem> |
| michael@0 | 125 | </varlistentry> |
| michael@0 | 126 | |
| michael@0 | 127 | <varlistentry> |
| michael@0 | 128 | <term><option>-v </option></term> |
| michael@0 | 129 | <listitem> |
| michael@0 | 130 | <simpara>Verbose mode. Prints root cert subject(double the |
| michael@0 | 131 | argument for whole root cert info) |
| michael@0 | 132 | </simpara> |
| michael@0 | 133 | </listitem> |
| michael@0 | 134 | </varlistentry> |
| michael@0 | 135 | |
| michael@0 | 136 | <varlistentry> |
| michael@0 | 137 | <term><option>-w </option> <replaceable>password</replaceable></term> |
| michael@0 | 138 | <listitem> |
| michael@0 | 139 | <simpara>Database password</simpara> |
| michael@0 | 140 | </listitem> |
| michael@0 | 141 | </varlistentry> |
| michael@0 | 142 | |
| michael@0 | 143 | <varlistentry> |
| michael@0 | 144 | <term><option>-W </option> <replaceable>pwfile</replaceable></term> |
| michael@0 | 145 | <listitem> |
| michael@0 | 146 | <simpara>Password file</simpara> |
| michael@0 | 147 | </listitem> |
| michael@0 | 148 | </varlistentry> |
| michael@0 | 149 | |
| michael@0 | 150 | <varlistentry> |
| michael@0 | 151 | <term><option></option></term> |
| michael@0 | 152 | <listitem> |
| michael@0 | 153 | <simpara>Revocation options for PKIX API (invoked with -pp options) is a |
| michael@0 | 154 | collection of the following flags: |
| michael@0 | 155 | [-g type [-h flags] [-m type [-s flags]] ...] ...</simpara> |
| michael@0 | 156 | <simpara>Where: </simpara> |
| michael@0 | 157 | </listitem> |
| michael@0 | 158 | </varlistentry> |
| michael@0 | 159 | |
| michael@0 | 160 | <varlistentry> |
| michael@0 | 161 | <term><option>-g </option> <replaceable>test-type</replaceable></term> |
| michael@0 | 162 | <listitem> |
| michael@0 | 163 | <simpara>Sets status checking test type. Possible values |
| michael@0 | 164 | are "leaf" or "chain" |
| michael@0 | 165 | </simpara> |
| michael@0 | 166 | </listitem> |
| michael@0 | 167 | </varlistentry> |
| michael@0 | 168 | |
| michael@0 | 169 | <varlistentry> |
| michael@0 | 170 | <term><option>-g </option> <replaceable>test type</replaceable></term> |
| michael@0 | 171 | <listitem> |
| michael@0 | 172 | <simpara>Sets status checking test type. Possible values |
| michael@0 | 173 | are "leaf" or "chain". |
| michael@0 | 174 | </simpara> |
| michael@0 | 175 | </listitem> |
| michael@0 | 176 | </varlistentry> |
| michael@0 | 177 | |
| michael@0 | 178 | <varlistentry> |
| michael@0 | 179 | <term><option>-h </option> <replaceable>test flags</replaceable></term> |
| michael@0 | 180 | <listitem> |
| michael@0 | 181 | <simpara>Sets revocation flags for the test type it |
| michael@0 | 182 | follows. Possible flags: "testLocalInfoFirst" and |
| michael@0 | 183 | "requireFreshInfo". |
| michael@0 | 184 | </simpara> |
| michael@0 | 185 | </listitem> |
| michael@0 | 186 | </varlistentry> |
| michael@0 | 187 | |
| michael@0 | 188 | <varlistentry> |
| michael@0 | 189 | <term><option>-m </option> <replaceable>method type</replaceable></term> |
| michael@0 | 190 | <listitem> |
| michael@0 | 191 | <simpara>Sets method type for the test type it follows. |
| michael@0 | 192 | Possible types are "crl" and "ocsp". |
| michael@0 | 193 | </simpara> |
| michael@0 | 194 | </listitem> |
| michael@0 | 195 | </varlistentry> |
| michael@0 | 196 | <varlistentry> |
| michael@0 | 197 | <term><option>-s </option> <replaceable>method flags</replaceable></term> |
| michael@0 | 198 | <listitem> |
| michael@0 | 199 | <simpara>Sets revocation flags for the method it follows. |
| michael@0 | 200 | Possible types are "doNotUse", "forbidFetching", |
| michael@0 | 201 | "ignoreDefaultSrc", "requireInfo" and "failIfNoInfo". |
| michael@0 | 202 | </simpara> |
| michael@0 | 203 | </listitem> |
| michael@0 | 204 | </varlistentry> |
| michael@0 | 205 | </variablelist> |
| michael@0 | 206 | </refsection> |
| michael@0 | 207 | |
| michael@0 | 208 | <!-- don't change --> |
| michael@0 | 209 | <refsection id="resources"> |
| michael@0 | 210 | <title>Additional Resources</title> |
| michael@0 | 211 | <para>For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at <ulink url="http://www.mozilla.org/projects/security/pki/nss/">http://www.mozilla.org/projects/security/pki/nss/</ulink>. The NSS site relates directly to NSS code changes and releases.</para> |
| michael@0 | 212 | <para>Mailing lists: https://lists.mozilla.org/listinfo/dev-tech-crypto</para> |
| michael@0 | 213 | <para>IRC: Freenode at #dogtag-pki</para> |
| michael@0 | 214 | </refsection> |
| michael@0 | 215 | |
| michael@0 | 216 | <!-- fill in your name first; keep the other names for reference --> |
| michael@0 | 217 | <refsection id="authors"> |
| michael@0 | 218 | <title>Authors</title> |
| michael@0 | 219 | <para>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para> |
| michael@0 | 220 | <para> |
| michael@0 | 221 | Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>. |
| michael@0 | 222 | </para> |
| michael@0 | 223 | </refsection> |
| michael@0 | 224 | |
| michael@0 | 225 | <!-- don't change --> |
| michael@0 | 226 | <refsection id="license"> |
| michael@0 | 227 | <title>LICENSE</title> |
| michael@0 | 228 | <para>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/. |
| michael@0 | 229 | </para> |
| michael@0 | 230 | </refsection> |
| michael@0 | 231 | |
| michael@0 | 232 | </refentry> |
