mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-09 06:30:06 +08:00
Code Issues Packages Projects Releases Wiki Activity
a8c773845f
curl/docs/mk-ca-bundle.1

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

121 lines
4.7 KiB
Groff
Raw Normal View History

mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.\" **************************************************************************
.\" * _ _ ____ _
.\" * Project ___| | | | _ \| |
.\" * / __| | | | |_) | |
.\" * | (__| |_| | _ <| |___
.\" * \___|\___/|_| \_\_____|
.\" *
copyright: update all copyright lines and remove year ranges - they are mostly pointless in all major jurisdictions - many big corporations and projects already don't use them - saves us from pointless churn - git keeps history for us - the year range is kept in COPYING checksrc is updated to allow non-year using copyright statements Closes #10205
2023-01-02 20:51:48 +08:00
.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.\" *
.\" * This software is licensed as described in the file COPYING, which
.\" * you should have received as part of this distribution. The terms
curl.se: new home Closes #6172
2020-11-04 21:02:01 +08:00
.\" * are also available at https://curl.se/docs/copyright.html.
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.\" *
.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
.\" * copies of the Software, and permit persons to whom the Software is
.\" * furnished to do so, under the terms of the COPYING file.
.\" *
.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
.\" * KIND, either express or implied.
.\" *
.\" * SPDX-License-Identifier: curl
copyright: make repository REUSE compliant Add licensing and copyright information for all files in this repository. This either happens in the file itself as a comment header or in the file `.reuse/dep5`. This commit also adds a Github workflow to check pull requests and adapts copyright.pl to the changes. Closes #8869
2022-05-17 17:16:50 +08:00
.\" *
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.\" **************************************************************************
.\"
man pages: simplify the .TH sections - remove the version numbers - simplify the texts The date and version number will be put there for releases when maketgz runs the updatemanpages.pl script. Closes #11029
2023-04-26 14:58:35 +08:00
.TH mk-ca-bundle 1 "24 Oct 2016" mk-ca-bundle mk-ca-bundle
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.SH NAME
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
mk-ca-bundle \- convert Mozilla's certificate bundle to PEM format
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.SH SYNOPSIS
mk-ca-bundle.1: document -k Brought in 1ad2bdcf110266c. Now does HTTPS by default and needs -k to fall back to plain HTTP.
2016-10-24 16:24:27 +08:00
mk-ca-bundle [options]
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.I [outputfile]
.SH DESCRIPTION
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
The mk-ca-bundle tool downloads the \fIcertdata.txt\fP file from Mozilla's
source tree over HTTPS, then parses \fIcertdata.txt\fP and extracts
certificates into PEM format. By default, only CA root certificates trusted to
issue SSL server authentication certificates are extracted. These are then
processed with the OpenSSL command line tool to produce the final ca-bundle
file.
mk-ca-bundle.1: mention new -f, fix outputfile output also edited a few sentences to become more verbose
2013-01-06 06:49:29 +08:00
The default \fIoutputfile\fP name is \fBca-bundle.crt\fP. By setting it to '-'
(a single dash) you will get the output sent to STDOUT instead of a file.
The PEM format this scripts uses for output makes the result readily available
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
for use by just about all OpenSSL or GnuTLS powered applications, such as curl
and others.
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.SH OPTIONS
The following options are supported:
.IP -b
backup an existing version of \fIoutputfilename\fP
docs: man page indentation and syntax fixes
2015-06-08 19:14:18 +08:00
.IP "-d [name]"
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
specify which Mozilla tree to pull \fIcertdata.txt\fP from (or a custom
URL). Valid names are: aurora, beta, central, Mozilla, nss, release
(default). They are shortcuts for which source tree to get the certificates
data from.
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -f
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
force rebuild even if \fIcertdata.txt\fP is current (Added in version 1.17)
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -i
add a manual page for mk-ca-bundle
2012-04-28 01:49:40 +08:00
print version info about used modules
mk-ca-bundle.1: document -k Brought in 1ad2bdcf110266c. Now does HTTPS by default and needs -k to fall back to plain HTTP.
2016-10-24 16:24:27 +08:00
.IP -k
Allow insecure data transfer. By default (since 1.27) this command will fail
if the HTTPS transfer fails. This overrides that decision (and opens for
man-in-the-middle attacks).
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -l
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
print license info about \fIcertdata.txt\fP
mk-ca-bundle.1: document -m, added in 1.26
2016-08-11 14:21:33 +08:00
.IP -m
(Added in 1.26) Include meta data comments in the output. The meta data is
specific information about each certificate that is stored in the original
file as comments and using this option will make those comments get passed on
to the output file. The meta data is not parsed in any way by mk-ca-bundle.
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -n
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
no download of \fIcertdata.txt\fP (to use existing)
mk-ca-bundle: added -p -p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-05-08 17:37:45 +08:00
.IP "-p [purposes]:[levels]"
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
list of Mozilla trust purposes and levels for certificates to include in
output. Takes the form of a comma separated list of purposes, a colon, and a
comma separated list of levels. The default is to include all certificates
trusted to issue SSL Server certificates
(\fISERVER_AUTH:TRUSTED_DELEGATOR\fP).
mk-ca-bundle: added -p -p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-05-08 17:37:45 +08:00
(Added in version 1.21, Perl only)
Valid purposes are:
.RS
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
\fIALL\fP, \fIDIGITAL_SIGNATURE\fP, \fINON_REPUDIATION\fP,
\fIKEY_ENCIPHERMENT\fP, \fIDATA_ENCIPHERMENT\fP, \fIKEY_AGREEMENT\fP,
\fIKEY_CERT_SIGN\fP, \fICRL_SIGN\fP, \fISERVER_AUTH\fP (default),
\fICLIENT_AUTH\fP, \fICODE_SIGNING\fP, \fIEMAIL_PROTECTION\fP,
\fIIPSEC_END_SYSTEM\fP, \fIIPSEC_TUNNEL\fP, \fIIPSEC_USER\fP,
\fITIME_STAMPING\fP, \fISTEP_UP_APPROVED\fP
mk-ca-bundle: added -p -p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-05-08 17:37:45 +08:00
.RE
docs: man page indentation and syntax fixes
2015-06-08 19:14:18 +08:00
.IP
mk-ca-bundle: added -p -p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-05-08 17:37:45 +08:00
Valid trust levels are:
.RS
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
\fIALL\fP, \fITRUSTED_DELEGATOR\fP (default), \fINOT_TRUSTED\fP, \fIMUST_VERIFY_TRUST\fP, \fITRUSTED\fP
mk-ca-bundle: added -p -p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-05-08 17:37:45 +08:00
.RE
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -q
add a manual page for mk-ca-bundle
2012-04-28 01:49:40 +08:00
be really quiet (no progress output at all)
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -t
add a manual page for mk-ca-bundle
2012-04-28 01:49:40 +08:00
include plain text listing of certificates
mk-ca-bundle: added -p -p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-05-08 17:37:45 +08:00
.IP "-s [algorithms]"
comma separated list of signature algorithms with which to hash/fingerprint
each certificate and output when run in plain text mode.
(Added in version 1.21, Perl only)
Valid algorithms are:
.RS
mk-ca-bundle: added SHA-384 signature algorithm Certificates based on SHA-1 are being phased out[1]. So we should expect a rise in certificates based on SHA-2. Adding SHA-384 as a valid signature algorithm. [1] https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/ Signed-off-by: Bruno Thomsen <bth@kamstrup.dk>
2014-10-15 18:48:27 +08:00
ALL, NONE, MD5 (default), SHA1, SHA256, SHA384, SHA512
mk-ca-bundle: added -p -p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-05-08 17:37:45 +08:00
.RE
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -u
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
unlink (remove) \fIcertdata.txt\fP after processing
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.IP -v
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
be verbose and print out processed certificate authorities
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.SH EXIT STATUS
Returns 0 on success. Returns 1 if it fails to download data.
docs: spellfixes Pointed by the new CI job
2022-09-21 05:30:19 +08:00
.SH FILE FORMAT
The file format used by Mozilla for this trust information is documented here:
mk-ca-bundle.1: point out certdata.txt format docs
2013-07-17 06:05:29 +08:00
.nf
docs/comments: Update to secure URL versions Closes #1741
2017-08-09 03:22:34 +08:00
https://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-existing.html
mk-ca-bundle.1: point out certdata.txt format docs
2013-07-17 06:05:29 +08:00
.fi
mk-ca-bundle.1: convert syntax to what's used elsewhere ... mostly to make sure roffit works better on it, but also to make our man pages use a more unified style.
2013-01-06 07:15:36 +08:00
.SH SEE ALSO
.BR curl (1)
Reference in New Issue Copy Permalink