update manuals

This commit is contained in:
Zhi Guan
2017-01-19 21:02:29 +08:00
parent 17a14fd40f
commit cceb2acfca
49 changed files with 487 additions and 454 deletions

View File

@@ -1,18 +1,18 @@
=pod
=for comment openssl_manual_section:5
=for comment gmssl_manual_section:5
=head1 NAME
config - OpenSSL CONF library configuration files
config - GmSSL CONF library configuration files
=head1 DESCRIPTION
The OpenSSL CONF library can be used to read configuration files.
It is used for the OpenSSL master configuration file B<openssl.cnf>
The GmSSL CONF library can be used to read configuration files.
It is used for the GmSSL master configuration file B<openssl.cnf>
and in a few other places like B<SPKAC> files and certificate extension
files for the B<x509> utility. OpenSSL applications can also use the
files for the B<x509> utility. GmSSL applications can also use the
CONF library for their own purposes.
A configuration file is divided into a number of sections. Each section
@@ -56,16 +56,16 @@ the sequences B<\n>, B<\r>, B<\b> and B<\t> are recognized.
=head1 OPENSSL LIBRARY CONFIGURATION
In OpenSSL 0.9.7 and later applications can automatically configure certain
aspects of OpenSSL using the master OpenSSL configuration file, or optionally
an alternative configuration file. The B<openssl> utility includes this
functionality: any sub command uses the master OpenSSL configuration file
In GmSSL 0.9.7 and later applications can automatically configure certain
aspects of GmSSL using the master GmSSL configuration file, or optionally
an alternative configuration file. The B<gmssl> utility includes this
functionality: any sub command uses the master GmSSL configuration file
unless an option is used in the sub command to use an alternative configuration
file.
To enable library configuration the default section needs to contain an
appropriate line which points to the main configuration section. The default
name is B<openssl_conf> which is used by the B<openssl> utility. Other
name is B<gmssl_conf> which is used by the B<gmssl> utility. Other
applications may use an alternative name such as B<myapplicaton_conf>.
The configuration section should consist of a set of name value pairs which
@@ -74,9 +74,9 @@ the name of the I<configuration module> the meaning of the B<value> is
module specific: it may, for example, represent a further configuration
section containing configuration module specific information. E.g.
openssl_conf = openssl_init
gmssl_conf = gmssl_init
[openssl_init]
[gmssl_init]
oid_section = new_oids
engines = engine_section
@@ -96,9 +96,9 @@ The features of each configuration module are described below.
This module has the name B<oid_section>. The value of this variable points
to a section containing name value pairs of OIDs: the name is the OID short
and long name, the value is the numerical form of the OID. Although some of
the B<openssl> utility sub commands already have their own ASN1 OBJECT section
the B<gmssl> utility sub commands already have their own ASN1 OBJECT section
functionality not all do. By using the ASN1 OBJECT configuration module
B<all> the B<openssl> utility sub commands can see the new objects as well
B<all> the B<gmssl> utility sub commands can see the new objects as well
as any compliant applications. For example:
[new_oids]
@@ -106,7 +106,7 @@ as any compliant applications. For example:
some_new_oid = 1.2.3.4
some_other_oid = 1.2.3.5
In OpenSSL 0.9.8 it is also possible to set the value to the long name followed
In GmSSL 0.9.8 it is also possible to set the value to the long name followed
by a comma and the numerical OID form. For example:
shortName = some object long name, 1.2.3.4
@@ -214,7 +214,7 @@ For example:
If a configuration file attempts to expand a variable that doesn't exist
then an error is flagged and the file will not load. This can happen
if an attempt is made to expand an environment variable that doesn't
exist. For example in a previous version of OpenSSL the default OpenSSL
exist. For example in a previous version of GmSSL the default GmSSL
master configuration file used the value of B<HOME> which may not be
defined on non Unix systems and would cause an error.
@@ -277,13 +277,13 @@ priority and B</tmp> used if neither is defined:
# The above value is used if TEMP isn't in the environment
tmpfile=${ENV::TEMP}/tmp.filename
Simple OpenSSL library configuration example to enter FIPS mode:
Simple GmSSL library configuration example to enter FIPS mode:
# Default appname: should match "appname" parameter (if any)
# supplied to CONF_modules_load_file et al.
openssl_conf = openssl_conf_section
gmssl_conf = gmssl_conf_section
[openssl_conf_section]
[gmssl_conf_section]
# Configuration module list
alg_section = evp_sect
@@ -292,15 +292,15 @@ Simple OpenSSL library configuration example to enter FIPS mode:
fips_mode = yes
Note: in the above example you will get an error in non FIPS capable versions
of OpenSSL.
of GmSSL.
More complex OpenSSL library configuration. Add OID and don't enter FIPS mode:
More complex GmSSL library configuration. Add OID and don't enter FIPS mode:
# Default appname: should match "appname" parameter (if any)
# supplied to CONF_modules_load_file et al.
openssl_conf = openssl_conf_section
gmssl_conf = gmssl_conf_section
[openssl_conf_section]
[gmssl_conf_section]
# Configuration module list
alg_section = evp_sect
oid_section = new_oids
@@ -317,12 +317,12 @@ More complex OpenSSL library configuration. Add OID and don't enter FIPS mode:
newoid2 = New OID 2 long name, 1.2.3.4.2
The above examples can be used with with any application supporting library
configuration if "openssl_conf" is modified to match the appropriate "appname".
configuration if "gmssl_conf" is modified to match the appropriate "appname".
For example if the second sample file above is saved to "example.cnf" then
the command line:
OPENSSL_CONF=example.cnf openssl asn1parse -genstr OID:1.2.3.4.1
OPENSSL_CONF=example.cnf gmssl asn1parse -genstr OID:1.2.3.4.1
will output: