mirror of
https://github.com/guanzhi/GmSSL.git
synced 2026-05-13 03:46:26 +08:00
update manuals
This commit is contained in:
@@ -1,18 +1,18 @@
|
||||
|
||||
=pod
|
||||
|
||||
=for comment openssl_manual_section:5
|
||||
=for comment gmssl_manual_section:5
|
||||
|
||||
=head1 NAME
|
||||
|
||||
config - OpenSSL CONF library configuration files
|
||||
config - GmSSL CONF library configuration files
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
The OpenSSL CONF library can be used to read configuration files.
|
||||
It is used for the OpenSSL master configuration file B<openssl.cnf>
|
||||
The GmSSL CONF library can be used to read configuration files.
|
||||
It is used for the GmSSL master configuration file B<openssl.cnf>
|
||||
and in a few other places like B<SPKAC> files and certificate extension
|
||||
files for the B<x509> utility. OpenSSL applications can also use the
|
||||
files for the B<x509> utility. GmSSL applications can also use the
|
||||
CONF library for their own purposes.
|
||||
|
||||
A configuration file is divided into a number of sections. Each section
|
||||
@@ -56,16 +56,16 @@ the sequences B<\n>, B<\r>, B<\b> and B<\t> are recognized.
|
||||
|
||||
=head1 OPENSSL LIBRARY CONFIGURATION
|
||||
|
||||
In OpenSSL 0.9.7 and later applications can automatically configure certain
|
||||
aspects of OpenSSL using the master OpenSSL configuration file, or optionally
|
||||
an alternative configuration file. The B<openssl> utility includes this
|
||||
functionality: any sub command uses the master OpenSSL configuration file
|
||||
In GmSSL 0.9.7 and later applications can automatically configure certain
|
||||
aspects of GmSSL using the master GmSSL configuration file, or optionally
|
||||
an alternative configuration file. The B<gmssl> utility includes this
|
||||
functionality: any sub command uses the master GmSSL configuration file
|
||||
unless an option is used in the sub command to use an alternative configuration
|
||||
file.
|
||||
|
||||
To enable library configuration the default section needs to contain an
|
||||
appropriate line which points to the main configuration section. The default
|
||||
name is B<openssl_conf> which is used by the B<openssl> utility. Other
|
||||
name is B<gmssl_conf> which is used by the B<gmssl> utility. Other
|
||||
applications may use an alternative name such as B<myapplicaton_conf>.
|
||||
|
||||
The configuration section should consist of a set of name value pairs which
|
||||
@@ -74,9 +74,9 @@ the name of the I<configuration module> the meaning of the B<value> is
|
||||
module specific: it may, for example, represent a further configuration
|
||||
section containing configuration module specific information. E.g.
|
||||
|
||||
openssl_conf = openssl_init
|
||||
gmssl_conf = gmssl_init
|
||||
|
||||
[openssl_init]
|
||||
[gmssl_init]
|
||||
|
||||
oid_section = new_oids
|
||||
engines = engine_section
|
||||
@@ -96,9 +96,9 @@ The features of each configuration module are described below.
|
||||
This module has the name B<oid_section>. The value of this variable points
|
||||
to a section containing name value pairs of OIDs: the name is the OID short
|
||||
and long name, the value is the numerical form of the OID. Although some of
|
||||
the B<openssl> utility sub commands already have their own ASN1 OBJECT section
|
||||
the B<gmssl> utility sub commands already have their own ASN1 OBJECT section
|
||||
functionality not all do. By using the ASN1 OBJECT configuration module
|
||||
B<all> the B<openssl> utility sub commands can see the new objects as well
|
||||
B<all> the B<gmssl> utility sub commands can see the new objects as well
|
||||
as any compliant applications. For example:
|
||||
|
||||
[new_oids]
|
||||
@@ -106,7 +106,7 @@ as any compliant applications. For example:
|
||||
some_new_oid = 1.2.3.4
|
||||
some_other_oid = 1.2.3.5
|
||||
|
||||
In OpenSSL 0.9.8 it is also possible to set the value to the long name followed
|
||||
In GmSSL 0.9.8 it is also possible to set the value to the long name followed
|
||||
by a comma and the numerical OID form. For example:
|
||||
|
||||
shortName = some object long name, 1.2.3.4
|
||||
@@ -214,7 +214,7 @@ For example:
|
||||
If a configuration file attempts to expand a variable that doesn't exist
|
||||
then an error is flagged and the file will not load. This can happen
|
||||
if an attempt is made to expand an environment variable that doesn't
|
||||
exist. For example in a previous version of OpenSSL the default OpenSSL
|
||||
exist. For example in a previous version of GmSSL the default GmSSL
|
||||
master configuration file used the value of B<HOME> which may not be
|
||||
defined on non Unix systems and would cause an error.
|
||||
|
||||
@@ -277,13 +277,13 @@ priority and B</tmp> used if neither is defined:
|
||||
# The above value is used if TEMP isn't in the environment
|
||||
tmpfile=${ENV::TEMP}/tmp.filename
|
||||
|
||||
Simple OpenSSL library configuration example to enter FIPS mode:
|
||||
Simple GmSSL library configuration example to enter FIPS mode:
|
||||
|
||||
# Default appname: should match "appname" parameter (if any)
|
||||
# supplied to CONF_modules_load_file et al.
|
||||
openssl_conf = openssl_conf_section
|
||||
gmssl_conf = gmssl_conf_section
|
||||
|
||||
[openssl_conf_section]
|
||||
[gmssl_conf_section]
|
||||
# Configuration module list
|
||||
alg_section = evp_sect
|
||||
|
||||
@@ -292,15 +292,15 @@ Simple OpenSSL library configuration example to enter FIPS mode:
|
||||
fips_mode = yes
|
||||
|
||||
Note: in the above example you will get an error in non FIPS capable versions
|
||||
of OpenSSL.
|
||||
of GmSSL.
|
||||
|
||||
More complex OpenSSL library configuration. Add OID and don't enter FIPS mode:
|
||||
More complex GmSSL library configuration. Add OID and don't enter FIPS mode:
|
||||
|
||||
# Default appname: should match "appname" parameter (if any)
|
||||
# supplied to CONF_modules_load_file et al.
|
||||
openssl_conf = openssl_conf_section
|
||||
gmssl_conf = gmssl_conf_section
|
||||
|
||||
[openssl_conf_section]
|
||||
[gmssl_conf_section]
|
||||
# Configuration module list
|
||||
alg_section = evp_sect
|
||||
oid_section = new_oids
|
||||
@@ -317,12 +317,12 @@ More complex OpenSSL library configuration. Add OID and don't enter FIPS mode:
|
||||
newoid2 = New OID 2 long name, 1.2.3.4.2
|
||||
|
||||
The above examples can be used with with any application supporting library
|
||||
configuration if "openssl_conf" is modified to match the appropriate "appname".
|
||||
configuration if "gmssl_conf" is modified to match the appropriate "appname".
|
||||
|
||||
For example if the second sample file above is saved to "example.cnf" then
|
||||
the command line:
|
||||
|
||||
OPENSSL_CONF=example.cnf openssl asn1parse -genstr OID:1.2.3.4.1
|
||||
OPENSSL_CONF=example.cnf gmssl asn1parse -genstr OID:1.2.3.4.1
|
||||
|
||||
will output:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user