1*b077aed3SPierre Pronchery=pod 2*b077aed3SPierre Pronchery{- OpenSSL::safe::output_do_not_edit_headers(); -} 3*b077aed3SPierre Pronchery 4*b077aed3SPierre Pronchery=for comment 5*b077aed3SPierre ProncheryOriginal text by James Westby. 6*b077aed3SPierre Pronchery 7*b077aed3SPierre Pronchery=head1 NAME 8*b077aed3SPierre Pronchery 9*b077aed3SPierre Proncheryopenssl-rehash, c_rehash - Create symbolic links to files named by the hash 10*b077aed3SPierre Proncheryvalues 11*b077aed3SPierre Pronchery 12*b077aed3SPierre Pronchery=head1 SYNOPSIS 13*b077aed3SPierre Pronchery 14*b077aed3SPierre ProncheryB<openssl> 15*b077aed3SPierre ProncheryB<rehash> 16*b077aed3SPierre Pronchery[B<-h>] 17*b077aed3SPierre Pronchery[B<-help>] 18*b077aed3SPierre Pronchery[B<-old>] 19*b077aed3SPierre Pronchery[B<-compat>] 20*b077aed3SPierre Pronchery[B<-n>] 21*b077aed3SPierre Pronchery[B<-v>] 22*b077aed3SPierre Pronchery{- $OpenSSL::safe::opt_provider_synopsis -} 23*b077aed3SPierre Pronchery[I<directory>] ... 24*b077aed3SPierre Pronchery 25*b077aed3SPierre ProncheryB<c_rehash> 26*b077aed3SPierre Pronchery[B<-h>] 27*b077aed3SPierre Pronchery[B<-help>] 28*b077aed3SPierre Pronchery[B<-old>] 29*b077aed3SPierre Pronchery[B<-n>] 30*b077aed3SPierre Pronchery[B<-v>] 31*b077aed3SPierre Pronchery{- $OpenSSL::safe::opt_provider_synopsis -} 32*b077aed3SPierre Pronchery[I<directory>] ... 33*b077aed3SPierre Pronchery 34*b077aed3SPierre Pronchery=head1 DESCRIPTION 35*b077aed3SPierre Pronchery 36*b077aed3SPierre ProncheryThis command is generally equivalent to the external 37*b077aed3SPierre Proncheryscript B<c_rehash>, 38*b077aed3SPierre Proncheryexcept for minor differences noted below. 39*b077aed3SPierre Pronchery 40*b077aed3SPierre ProncheryB<openssl rehash> scans directories and calculates a hash value of 41*b077aed3SPierre Proncheryeach F<.pem>, F<.crt>, F<.cer>, or F<.crl> 42*b077aed3SPierre Proncheryfile in the specified directory list and creates symbolic links 43*b077aed3SPierre Proncheryfor each file, where the name of the link is the hash value. 44*b077aed3SPierre Pronchery(If the platform does not support symbolic links, a copy is made.) 45*b077aed3SPierre ProncheryThis command is useful as many programs that use OpenSSL require 46*b077aed3SPierre Proncherydirectories to be set up like this in order to find certificates. 47*b077aed3SPierre Pronchery 48*b077aed3SPierre ProncheryIf any directories are named on the command line, then those are 49*b077aed3SPierre Proncheryprocessed in turn. If not, then the B<SSL_CERT_DIR> environment variable 50*b077aed3SPierre Proncheryis consulted; this should be a colon-separated list of directories, 51*b077aed3SPierre Proncherylike the Unix B<PATH> variable. 52*b077aed3SPierre ProncheryIf that is not set then the default directory (installation-specific 53*b077aed3SPierre Proncherybut often F</usr/local/ssl/certs>) is processed. 54*b077aed3SPierre Pronchery 55*b077aed3SPierre ProncheryIn order for a directory to be processed, the user must have write 56*b077aed3SPierre Proncherypermissions on that directory, otherwise an error will be generated. 57*b077aed3SPierre Pronchery 58*b077aed3SPierre ProncheryThe links created are of the form I<HHHHHHHH.D>, where each I<H> 59*b077aed3SPierre Proncheryis a hexadecimal character and I<D> is a single decimal digit. 60*b077aed3SPierre ProncheryWhen a directory is processed, all links in it that have a name 61*b077aed3SPierre Proncheryin that syntax are first removed, even if they are being used for 62*b077aed3SPierre Proncherysome other purpose. 63*b077aed3SPierre ProncheryTo skip the removal step, use the B<-n> flag. 64*b077aed3SPierre ProncheryHashes for CRL's look similar except the letter B<r> appears after 65*b077aed3SPierre Proncherythe period, like this: I<HHHHHHHH.>B<r>I<D>. 66*b077aed3SPierre Pronchery 67*b077aed3SPierre ProncheryMultiple objects may have the same hash; they will be indicated by 68*b077aed3SPierre Proncheryincrementing the I<D> value. Duplicates are found by comparing the 69*b077aed3SPierre Proncheryfull SHA-1 fingerprint. A warning will be displayed if a duplicate 70*b077aed3SPierre Proncheryis found. 71*b077aed3SPierre Pronchery 72*b077aed3SPierre ProncheryA warning will also be displayed if there are files that 73*b077aed3SPierre Proncherycannot be parsed as either a certificate or a CRL or if 74*b077aed3SPierre Proncherymore than one such object appears in the file. 75*b077aed3SPierre Pronchery 76*b077aed3SPierre Pronchery=head2 Script Configuration 77*b077aed3SPierre Pronchery 78*b077aed3SPierre ProncheryThe B<c_rehash> script 79*b077aed3SPierre Proncheryuses the B<openssl> program to compute the hashes and 80*b077aed3SPierre Proncheryfingerprints. If not found in the user's B<PATH>, then set the 81*b077aed3SPierre ProncheryB<OPENSSL> environment variable to the full pathname. 82*b077aed3SPierre ProncheryAny program can be used, it will be invoked as follows for either 83*b077aed3SPierre Proncherya certificate or CRL: 84*b077aed3SPierre Pronchery 85*b077aed3SPierre Pronchery $OPENSSL x509 -hash -fingerprint -noout -in FILENAME 86*b077aed3SPierre Pronchery $OPENSSL crl -hash -fingerprint -noout -in FILENAME 87*b077aed3SPierre Pronchery 88*b077aed3SPierre Proncherywhere I<FILENAME> is the filename. It must output the hash of the 89*b077aed3SPierre Proncheryfile on the first line, and the fingerprint on the second, 90*b077aed3SPierre Proncheryoptionally prefixed with some text and an equals sign. 91*b077aed3SPierre Pronchery 92*b077aed3SPierre Pronchery=head1 OPTIONS 93*b077aed3SPierre Pronchery 94*b077aed3SPierre Pronchery=over 4 95*b077aed3SPierre Pronchery 96*b077aed3SPierre Pronchery=item B<-help> B<-h> 97*b077aed3SPierre Pronchery 98*b077aed3SPierre ProncheryDisplay a brief usage message. 99*b077aed3SPierre Pronchery 100*b077aed3SPierre Pronchery=item B<-old> 101*b077aed3SPierre Pronchery 102*b077aed3SPierre ProncheryUse old-style hashing (MD5, as opposed to SHA-1) for generating 103*b077aed3SPierre Proncherylinks to be used for releases before 1.0.0. 104*b077aed3SPierre ProncheryNote that current versions will not use the old style. 105*b077aed3SPierre Pronchery 106*b077aed3SPierre Pronchery=item B<-n> 107*b077aed3SPierre Pronchery 108*b077aed3SPierre ProncheryDo not remove existing links. 109*b077aed3SPierre ProncheryThis is needed when keeping new and old-style links in the same directory. 110*b077aed3SPierre Pronchery 111*b077aed3SPierre Pronchery=item B<-compat> 112*b077aed3SPierre Pronchery 113*b077aed3SPierre ProncheryGenerate links for both old-style (MD5) and new-style (SHA1) hashing. 114*b077aed3SPierre ProncheryThis allows releases before 1.0.0 to use these links along-side newer 115*b077aed3SPierre Proncheryreleases. 116*b077aed3SPierre Pronchery 117*b077aed3SPierre Pronchery=item B<-v> 118*b077aed3SPierre Pronchery 119*b077aed3SPierre ProncheryPrint messages about old links removed and new links created. 120*b077aed3SPierre ProncheryBy default, this command only lists each directory as it is processed. 121*b077aed3SPierre Pronchery 122*b077aed3SPierre Pronchery{- $OpenSSL::safe::opt_provider_item -} 123*b077aed3SPierre Pronchery 124*b077aed3SPierre Pronchery=back 125*b077aed3SPierre Pronchery 126*b077aed3SPierre Pronchery=head1 ENVIRONMENT 127*b077aed3SPierre Pronchery 128*b077aed3SPierre Pronchery=over 4 129*b077aed3SPierre Pronchery 130*b077aed3SPierre Pronchery=item B<OPENSSL> 131*b077aed3SPierre Pronchery 132*b077aed3SPierre ProncheryThe path to an executable to use to generate hashes and 133*b077aed3SPierre Proncheryfingerprints (see above). 134*b077aed3SPierre Pronchery 135*b077aed3SPierre Pronchery=item B<SSL_CERT_DIR> 136*b077aed3SPierre Pronchery 137*b077aed3SPierre ProncheryColon separated list of directories to operate on. 138*b077aed3SPierre ProncheryIgnored if directories are listed on the command line. 139*b077aed3SPierre Pronchery 140*b077aed3SPierre Pronchery=back 141*b077aed3SPierre Pronchery 142*b077aed3SPierre Pronchery=head1 SEE ALSO 143*b077aed3SPierre Pronchery 144*b077aed3SPierre ProncheryL<openssl(1)>, 145*b077aed3SPierre ProncheryL<openssl-crl(1)>, 146*b077aed3SPierre ProncheryL<openssl-x509(1)> 147*b077aed3SPierre Pronchery 148*b077aed3SPierre Pronchery=head1 COPYRIGHT 149*b077aed3SPierre Pronchery 150*b077aed3SPierre ProncheryCopyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved. 151*b077aed3SPierre Pronchery 152*b077aed3SPierre ProncheryLicensed under the Apache License 2.0 (the "License"). You may not use 153*b077aed3SPierre Proncherythis file except in compliance with the License. You can obtain a copy 154*b077aed3SPierre Proncheryin the file LICENSE in the source distribution or at 155*b077aed3SPierre ProncheryL<https://www.openssl.org/source/license.html>. 156*b077aed3SPierre Pronchery 157*b077aed3SPierre Pronchery=cut 158