--- name: "openssl" section: "1" platform: "linux" package: "openssl" version: "0.9.6c-2.woody.7" release: "Debian 3.0 (Woody)" platforms: ["linux", "openbsd"] url: "https://new.carta.tech/openssl" --- # openssl(1) openssl - OpenSSL command line tool **openssl** *command* \[ *command\_opts* \] \[ *command\_args* \] **openssl** \[ **list-standard-commands** ⎪ **list-message-digest-commands** ⎪ **list-cipher-commands** \] **openssl** **no-***XXX* \[ *arbitrary options* \] OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them. The **openssl** program is a command line tool for using the various cryptography functions of OpenSSL's **crypto** library from the shell. It can be used for ``` o Creation of RSA, DH and DSA key parameters o Creation of X.509 certificates, CSRs and CRLs o Calculation of Message Digests o Encryption and Decryption with Ciphers o SSL/TLS Client and Server Tests o Handling of S/MIME signed or encrypted mail ``` The **openssl** program provides a rich variety of commands (*command* in the SYNOPSIS above), each of which often has a wealth of options and arguments (*command\_opts* and *command\_args* in the SYNOPSIS). The pseudo-commands **list-standard-commands**, **list-message-digest-commands**, and **list-cipher-commands** output a list (one entry per line) of the names of all standard commands, message digest commands, or cipher commands, respectively, that are available in the present **openssl** utility. The pseudo-command **no-***XXX* tests whether a command of the specified name is available. If no command named *XXX* exists, it returns 0 (success) and prints **no-***XXX*; otherwise it returns 1 and prints *XXX*. In both cases, the output goes to **stdout** and nothing is printed to **stderr**. Additional command line arguments are always ignored. Since for each cipher there is a command of the same name, this provides an easy way for shell scripts to test for the availability of ciphers in the **openssl** program. (**no-***XXX* is not able to detect pseudo-commands such as **quit**, **list-***...***-commands**, or **no-***XXX* itself.)\ **STANDARD COMMANDS** Parse an ASN.1 sequence. Certificate Authority (CA) Management. Cipher Suite Description Determination. Certificate Revocation List (CRL) Management. CRL to PKCS#7 Conversion. Message Digest Calculation. Diffie-Hellman Parameter Management. Obsoleted by **dhparam**. DSA Data Management. DSA Parameter Generation. Encoding with Ciphers. Error Number to Error String Conversion. Generation and Management of Diffie-Hellman Parameters. Generation of Diffie-Hellman Parameters. Obsoleted by **dhparam**. Generation of DSA Parameters. Generation of RSA Parameters. Generation of hashed passwords. PKCS#12 Data Management. PKCS#7 Data Management. Generate pseudo-random bytes. X.509 Certificate Signing Request (CSR) Management. RSA Data Management. RSA utility for signing, verification, encryption, and decryption. This implements a generic SSL/TLS client which can establish a transparent connection to a remote server speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL **ssl** library. This implements a generic SSL/TLS server which accepts connections from remote clients speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL **ssl** library. It provides both an own command line oriented protocol for testing SSL functions and a simple HTTP response facility to emulate an SSL/TLS-aware webserver. SSL Connection Timer. SSL Session Data Management. S/MIME mail processing. Algorithm Speed Measurement. X.509 Certificate Verification. OpenSSL Version Information. X.509 Certificate Data Management.\ **MESSAGE DIGEST COMMANDS** MD2 Digest MD5 Digest MDC2 Digest RMD-160 Digest SHA Digest SHA-1 Digest\ **ENCODING AND CIPHER COMMANDS** Base64 Encoding Blowfish Cipher CAST Cipher CAST5 Cipher DES Cipher Triple-DES Cipher IDEA Cipher RC2 Cipher RC4 Cipher RC5 Cipher Several commands accept password arguments, typically using **-passin** and **-passout** for input and output passwords respectively. These allow the password to be obtained from a variety of sources. Both of these options take a single argument whose format is described below. If no password argument is given and a password is required then the user is prompted to enter one: this will typically be read from the current terminal with echoing turned off. the actual password is **password**. Since the password is visible to utilities (like 'ps' under Unix) this form should only be used where security is not important. obtain the password from the environment variable **var**. Since the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes) this option should be used with caution. the first line of **pathname** is the password. If the same **pathname** argument is supplied to **-passin** and **-passout** arguments then the first line will be used for the input password and the next line for the output password. **pathname** need not refer to a regular file: it could for example refer to a device or named pipe. read the password from the file descriptor **number**. This can be used to send the data via a pipe for example. read the password from standard input. *asn1parse*(1), *ca*(1), [*config*(5)](/config/5.md), *crl*(1), *crl2pkcs7*(1), *dgst*(1), *dhparam*(1), *dsa*(1), *dsaparam*(1), *enc*(1), *gendsa*(1), *genrsa*(1), *nseq*(1), [*openssl*(1)](/openssl/1.md), [*passwd*(1)](/passwd/1.md), *pkcs12*(1), *pkcs7*(1), *pkcs8*(1), [*rand*(1)](/rand/1.md), *req*(1), *rsa*(1), *rsautl*(1), *s\_client*(1), *s\_server*(1), *smime*(1), *spkac*(1), [*verify*(1)](/verify/1.md), *version*(1), *x509*(1), [*crypto*(3)](/crypto/3.md), [*ssl*(3)](/ssl/3.md) The [*openssl*(1)](/openssl/1.md) document appeared in OpenSSL 0.9.2. The **list-***XXX***-commands** pseudo-commands were added in OpenSSL 0.9.3; the **no-***XXX* pseudo-commands were added in OpenSSL 0.9.5a. For notes on the availability of other commands, see their individual manual pages.