--- name: "xmlsec1" section: "1" platform: "linux" package: "xmlsec" version: "1.3.12-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/xmlsec1" --- # xmlsec1(1) sign, verify, encrypt and decrypt XML documents ## NAME xmlsec1 - sign, verify, encrypt and decrypt XML documents ## SYNOPSIS **xmlsec** *\* \[*\*\] \[*\*\] ## DESCRIPTION xmlsec is a command line tool for signing, verifying, encrypting and decrypting XML documents. The allowed \ values are: - **--help** display this help information and exit - **--help-all** display help information for all commands/options and exit - **--help-**\ display help information for command \ and exit - **--version** print version information and exit - **--keys** keys XML file manipulation - **--sign** sign data and output XML document - **--verify** verify signed document - **--encrypt** encrypt data and output XML document - **--decrypt** decrypt data from XML document ## OPTIONS **--ignore-manifests** - do not process \ elements **--store-references** - store and print the result of \ element processing just before calculating digest **--store-signatures** - store and print the result of \ processing just before calculating signature **--enabled-reference-uris** \ - comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the \ element **--enable-visa3d-hack** - enables Visa3D protocol specific hack for URI attributes processing when we are trying not to use XPath/XPointer engine; this is a hack and I don't know what else might be broken in your application when you use it (also check "--id-attr" option because you might need it) **--enable-asn1-signatures-hack** - enables support for ASN1 signature values generated by some XMLDsig implementations. **--hmac-min-out-len** \ - sets minimum HMAC output length to \ **--binary-data** \ - binary \ to encrypt **--xml-data** \ - XML \ to encrypt **--enabled-cipher-reference-uris** \ - comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the \ element **--session-key** \-\ - generate new session \ key of \ bits size (for example, "--session des-192" generates a new 192 bits DES key for DES3 encryption) **--output** \ - write result document to file \; the \ can be a template and include '{inputfile}' which will be repaced with the input filename **--print-debug** - print debug information to stdout **--print-xml-debug** - print debug information to stdout in xml format **--dtd-file** \ - load the specified file as the DTD **--node-id** \ - set the operation start point to the node with given \ **--node-name** \[\:\]\ - set the operation start point to the first node with given \ and \ URI **--node-xpath** \ - set the operation start point to the first node selected by the specified XPath expression **--id-attr\[**:\\] \[\:\]\ - adds attributes \ (default value "id") from all nodes with\ and namespace \ to the list of known ID attributes; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option) **--add-id-attr** \ - adds attribute \ to all nodes in the document; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option) **--enabled-key-data** \ - comma-separated list of key-data types to enable. Example: - rsa,key-value,x509 \-\> populates \ and keeps \ - when \ and \ placeholders are present in the template. - Use "--list-key-data" to view full list of registered key data klasses. By default, all registered key data are enabled. **--enabled-retrieval-method-uris** \ - comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the \ element. **--enabled-key-info-reference-uris** \ - comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the \ element. **--gen-key\[**:\\] \-\ - generate new \ key of \ bits size, set the key name to \ and add the result to keys manager (for example, "--gen:MyKeyName rsa-1024" generates a new 1024 bits RSA key and sets it's name to "MyKeyName") **--keys-file** \ - load keys from XML file **--privkey-pem\[**:\\] \\[,\\[,\\[...\]\]\] - load private key from PEM file and certificates that verify this key **--privkey-der\[**:\\] \\[,\\[,\\[...\]\]\] - load private key from DER file and certificates that verify this key **--pkcs8-pem\[**:\\] \\[,\\[,\\[...\]\]\] - load private key from PKCS8 PEM file and PEM certificates that verify this key **--pkcs8-der\[**:\\] \\[,\\[,\\[...\]\]\] - load private key from PKCS8 DER file and DER certificates that verify this key **--privkey-openssl-store\[**:\\] \ - load private key and certs through OpenSSL ossl\_store interface (e.g. from HSM) **--privkey-openssl-engine\[**:\\] \;\\[,\\[,\\[...\]\]\] - load private key by OpenSSL ENGINE interface; specify the name of engine (like with **-engine** params), the key specs (like with **-inkey** or **-key** params) and optionally certificates that verify this key **--pubkey-pem\[**:\\] \ - load public key from PEM file **--pubkey-der\[**:\\] \ - load public key from DER file **--pubkey-openssl-store\[**:\\] \ - load pubkey key and certs through OpenSSL ossl\_store interface (e.g. from HSM) **--pubkey-openssl-engine\[**:\\] \;\\[,\\[,\\[...\]\]\] - load public key by OpenSSL ENGINE interface; specify the name of engine (like with **-engine** params), the key specs (like with **-inkey** or **-key** params) and optionally certificates that verify this key **--pwd** \ - the password to use for reading keys and certs **--lax-key-search** - enable lax key search (e.g. by key type like "rsa") vs default strict key search mode using only information from \ node (e.g. key name) **--verify-keys** - force verification of public/private keys loaded from the command: keys are required to have a key certificate that will be verified against the certificates in the key store **--aes-key\[**:\\] \ - load AES key from binary file \ **--camellia-key\[**:\\] \ - load Camellia key from binary file \ **--chacha20-key\[**:\\] \ - load ChaCha20 key from binary file \ **--concatkdf-key\[**:\\] \ - load ConcatKDF key from binary file \ **--des-key\[**:\\] \ - load DES key from binary file \ **--hmac-key\[**:\\] \ - load HMAC key from binary file \ **--pbkdf2-key\[**:\\] \ - load Pbkdf2 key from binary file \ **--hkdf-key\[**:\\] \ - load HKDF key (IKM) from binary file \ **--pkcs12\[**:\\] \ - load load private key from pkcs12 file \ **--pkcs12-persist** - persist loaded private key **--pubkey-cert-pem\[**:\\] \ - load public key from PEM cert file **--pubkey-cert-der\[**:\\] \ - load public key from DER cert file **--trusted-pem** \ - load trusted (root) certificate from PEM file \ **--untrusted-pem** \ - load untrusted certificate from PEM file \ **--trusted-der** \ - load trusted (root) certificate from DER file \ **--untrusted-der** \ - load untrusted certificate from DER file \ **--crl-pem** \ - load CRLs from PEM file \ **--crl-der** \ - load CRLs from DER file \ **--verify-crls** - force verification of loaded CRLs: CRLs are required to have a valid signature from an issuer certificate in the trusted or untrusted certificate store, and must be within their validity period (thisUpdate/nextUpdate) **--verification-time** \ - the local time in "YYYY-MM-DD HH:MM:SS" format used certificates verification **--verification-gmt-time** \ - the GMT time in "YYYY-MM-DD HH:MM:SS" format used certificates verification **--X509-skip-time-checks** - skip time checking of X509 certificates and CLRs **--depth** \ - maximum certificates chain depth **--X509-skip-strict-checks** - skip strict checking of X509 data **--insecure** - do not verify certificates or CRLs **--crypto** \ - the name of the crypto engine to use from the following list: openssl, mscrypto, nss, gnutls, gcrypt (if no crypto engine is specified then the default one is used) **--crypto-config** \ - path to crypto engine configuration **--verbose** - print detailed error messages **--print-crypto-library-errors** - print errors from crypto library (OpenSSL only) **--repeat** \ - repeat the operation \ times **--base64-line-size** \ - sets the max line size for base64 encodings to \ **--transform-binary-chunk-size** \ - sets the transforms binary processing chunk size to \; increasing chunk size might improve performance at the expense of increased memory usage **--transform-max-depth** \ - sets the max depth for transforms execution to \; set to 0 to disable max depth check **--xxe** - enable External Entity resolution. WARNING: this may allow the reading of arbitrary files and URLs, controlled by the input XML document. Use with caution! **--url-map**:\ \ - maps a given \ to the given \ for loading external resources **--help** - print help information about the command ## AUTHOR Written by Aleksey Sanin \. ## REPORTING BUGS Report bugs to http://www.aleksey.com/xmlsec/bugs.html ## COPYRIGHT Copyright © 2002-2026 Aleksey Sanin \. All Rights Reserved.\ This is free software: see the source for copying information.