.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.49.3. .TH XMLSEC1 "1" "March 2024" "xmlsec1 1.3.4 (openssl)" "User Commands" .SH NAME xmlsec1 \- sign, verify, encrypt and decrypt XML documents .SH SYNOPSIS .B xmlsec \fI\, \/\fR[\fI\,\/\fR] [\fI\,\/\fR] .SH DESCRIPTION xmlsec is a command line tool for signing, verifying, encrypting and decrypting XML documents. The allowed values are: .TP \fB\-\-help\fR display this help information and exit .TP \fB\-\-help\-all\fR display help information for all commands/options and exit .TP \fB\-\-help\-\fR display help information for command and exit .TP \fB\-\-version\fR print version information and exit .TP \fB\-\-keys\fR keys XML file manipulation .TP \fB\-\-sign\fR sign data and output XML document .TP \fB\-\-verify\fR verify signed document .TP \fB\-\-sign\-tmpl\fR create and sign dynamicaly generated signature template .TP \fB\-\-encrypt\fR encrypt data and output XML document .TP \fB\-\-decrypt\fR decrypt data from XML document .SH OPTIONS .HP \fB\-\-ignore\-manifests\fR .IP do not process elements .HP \fB\-\-store\-references\fR .IP store and print the result of element processing just before calculating digest .HP \fB\-\-store\-signatures\fR .IP store and print the result of processing just before calculating signature .HP \fB\-\-enabled\-reference\-uris\fR .IP comma separated list of of the following values: "empty", "same\-doc", "local","remote" to restrict possible URI attribute values for the element .HP \fB\-\-enable\-visa3d\-hack\fR .IP enables Visa3D protocol specific hack for URI attributes processing when we are trying not to use XPath/XPointer engine; this is a hack and I don't know what else might be broken in your application when you use it (also check "\-\-id\-attr" option because you might need it) .HP \fB\-\-hmac\-min\-out\-len\fR .IP sets minimum HMAC output length to .HP \fB\-\-binary\-data\fR .IP binary to encrypt .HP \fB\-\-xml\-data\fR .IP XML to encrypt .HP \fB\-\-enabled\-cipher\-reference\-uris\fR .IP comma separated list of of the following values: "empty", "same\-doc", "local","remote" to restrict possible URI attribute values for the element .HP \fB\-\-session\-key\fR \- .IP generate new session key of bits size (for example, "\-\-session des\-192" generates a new 192 bits DES key for DES3 encryption) .HP \fB\-\-output\fR .IP write result document to file ; the can be a template and include '{inputfile}' which will be repaced with the input filename .HP \fB\-\-print\-debug\fR .IP print debug information to stdout .HP \fB\-\-print\-xml\-debug\fR .IP print debug information to stdout in xml format .HP \fB\-\-dtd\-file\fR .IP load the specified file as the DTD .HP \fB\-\-node\-id\fR .IP set the operation start point to the node with given .HP \fB\-\-node\-name\fR [:] .IP set the operation start point to the first node with given and URI .HP \fB\-\-node\-xpath\fR .IP set the operation start point to the first node selected by the specified XPath expression .HP \fB\-\-id\-attr[\fR:] [:] .IP adds attributes (default value "id") from all nodes with and namespace to the list of known ID attributes; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "\-\-dtd\-file" option), I don't know what else might be broken in your application when you use this hack .HP \fB\-\-enabled\-key\-data\fR .IP comma separated list of enabled key data (list of registered key data klasses is available with "\-\-list\-key\-data" command); by default, all registered key data are enabled .HP \fB\-\-enabled\-retrieval\-method\-uris\fR .IP comma separated list of of the following values: "empty", "same\-doc", "local","remote" to restrict possible URI attribute values for the element. .HP \fB\-\-enabled\-key\-info\-reference\-uris\fR .IP comma separated list of of the following values: "empty", "same\-doc", "local","remote" to restrict possible URI attribute values for the element. .HP \fB\-\-gen\-key[\fR:] \- .IP generate new key of bits size, set the key name to and add the result to keys manager (for example, "\-\-gen:mykey rsa\-1024" generates a new 1024 bits RSA key and sets it's name to "mykey") .HP \fB\-\-keys\-file\fR .IP load keys from XML file .HP \fB\-\-privkey\-pem[\fR:] [,[,[...]]] .IP load private key from PEM file and certificates that verify this key .HP \fB\-\-privkey\-der[\fR:] [,[,[...]]] .IP load private key from DER file and certificates that verify this key .HP \fB\-\-pkcs8\-pem[\fR:] [,[,[...]]] .IP load private key from PKCS8 PEM file and PEM certificates that verify this key .HP \fB\-\-pkcs8\-der[\fR:] [,[,[...]]] .IP load private key from PKCS8 DER file and DER certificates that verify this key .HP \fB\-\-privkey\-openssl\-store[\fR:] .IP load private key and certs through OpenSSL ossl_store interface (e.g. from HSM) .HP \fB\-\-privkey\-openssl\-engine[\fR:] ;[,[,[...]]] .IP load private key by OpenSSL ENGINE interface; specify the name of engine (like with \fB\-engine\fR params), the key specs (like with \fB\-inkey\fR or \fB\-key\fR params) and optionally certificates that verify this key .HP \fB\-\-pubkey\-pem[\fR:] .IP load public key from PEM file .HP \fB\-\-pubkey\-der[\fR:] .IP load public key from DER file .HP \fB\-\-pubkey\-openssl\-store[\fR:] .IP load pubkey key and certs through OpenSSL ossl_store interface (e.g. from HSM) .HP \fB\-\-pubkey\-openssl\-engine[\fR:] ;[,[,[...]]] .IP load public key by OpenSSL ENGINE interface; specify the name of engine (like with \fB\-engine\fR params), the key specs (like with \fB\-inkey\fR or \fB\-key\fR params) and optionally certificates that verify this key .HP \fB\-\-pwd\fR .IP the password to use for reading keys and certs .HP \fB\-\-lax\-key\-search\fR .IP enable lax key search (e.g. by key type like "rsa") vs default strict key search mode using only information from node (e.g. key name) .HP \fB\-\-verify\-keys\fR .IP force verification of public/private keys loaded from the command: keys are required to have a key certificate that will be verified against the certificates in the key store .HP \fB\-\-aes\-key[\fR:] .IP load AES key from binary file .HP \fB\-\-concatkdf\-key[\fR:] .IP load ConcatKDF key from binary file .HP \fB\-\-des\-key[\fR:] .IP load DES key from binary file .HP \fB\-\-hmac\-key[\fR:] .IP load HMAC key from binary file .HP \fB\-\-pbkdf2\-key[\fR:] .IP load Pbkdf2 key from binary file .HP \fB\-\-pkcs12[\fR:] .IP load load private key from pkcs12 file .HP \fB\-\-pkcs12\-persist\fR .IP persist loaded private key .HP \fB\-\-pubkey\-cert\-pem[\fR:] .IP load public key from PEM cert file .HP \fB\-\-pubkey\-cert\-der[\fR:] .IP load public key from DER cert file .HP \fB\-\-trusted\-pem\fR .IP load trusted (root) certificate from PEM file .HP \fB\-\-untrusted\-pem\fR .IP load untrusted certificate from PEM file .HP \fB\-\-trusted\-der\fR .IP load trusted (root) certificate from DER file .HP \fB\-\-untrusted\-der\fR .IP load untrusted certificate from DER file .HP \fB\-\-crl\-pem\fR .IP load CRLs from PEM file .HP \fB\-\-crl\-der\fR .IP load CRLs from DER file .HP \fB\-\-verification\-time\fR