mirror of
https://github.com/guanzhi/GmSSL.git
synced 2026-05-13 03:46:26 +08:00
update manuals
This commit is contained in:
@@ -7,7 +7,7 @@ req - PKCS#10 certificate request and certificate generating utility.
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
B<openssl> B<req>
|
||||
B<gmssl> B<req>
|
||||
[B<-inform PEM|DER>]
|
||||
[B<-outform PEM|DER>]
|
||||
[B<-in filename>]
|
||||
@@ -80,7 +80,7 @@ options (B<-new> and B<-newkey>) are not specified.
|
||||
=item B<-passin arg>
|
||||
|
||||
the input file password source. For more information about the format of B<arg>
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<gmssl(1)|gmssl(1)>.
|
||||
|
||||
=item B<-out filename>
|
||||
|
||||
@@ -90,7 +90,7 @@ default.
|
||||
=item B<-passout arg>
|
||||
|
||||
the output file password source. For more information about the format of B<arg>
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<gmssl(1)|gmssl(1)>.
|
||||
|
||||
=item B<-text>
|
||||
|
||||
@@ -225,7 +225,7 @@ characters may be escaped by \ (backslash), no spaces are skipped.
|
||||
this option causes the -subj argument to be interpreted with full
|
||||
support for multivalued RDNs. Example:
|
||||
|
||||
I</DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe>
|
||||
I</DC=org/DC=GmSSL/DC=users/UID=123456+CN=John Doe>
|
||||
|
||||
If -multi-rdn is not used then the UID value is I<123456+CN=John Doe>.
|
||||
|
||||
@@ -436,7 +436,7 @@ configuration file, must be valid UTF8 strings.
|
||||
this specifies the section containing any request attributes: its format
|
||||
is the same as B<distinguished_name>. Typically these may contain the
|
||||
challengePassword or unstructuredName types. They are currently ignored
|
||||
by OpenSSL's request signing utilities but some CAs might want them.
|
||||
by GmSSL's request signing utilities but some CAs might want them.
|
||||
|
||||
=item B<distinguished_name>
|
||||
|
||||
@@ -488,7 +488,7 @@ they will be ignored. So for example a second organizationName can
|
||||
be input by calling it "1.organizationName".
|
||||
|
||||
The actual permitted field names are any object identifier short or
|
||||
long names. These are compiled into OpenSSL and include the usual
|
||||
long names. These are compiled into GmSSL and include the usual
|
||||
values such as commonName, countryName, localityName, organizationName,
|
||||
organizationUnitName, stateOrProvinceName. Additionally emailAddress
|
||||
is include as well as name, surname, givenName initials and dnQualifier.
|
||||
@@ -502,20 +502,20 @@ will be treated as though they were a DirectoryString.
|
||||
|
||||
Examine and verify certificate request:
|
||||
|
||||
openssl req -in req.pem -text -verify -noout
|
||||
gmssl req -in req.pem -text -verify -noout
|
||||
|
||||
Create a private key and then generate a certificate request from it:
|
||||
|
||||
openssl genrsa -out key.pem 1024
|
||||
openssl req -new -key key.pem -out req.pem
|
||||
gmssl genrsa -out key.pem 1024
|
||||
gmssl req -new -key key.pem -out req.pem
|
||||
|
||||
The same but just using req:
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout key.pem -out req.pem
|
||||
gmssl req -newkey rsa:1024 -keyout key.pem -out req.pem
|
||||
|
||||
Generate a self signed root certificate:
|
||||
|
||||
openssl req -x509 -newkey rsa:1024 -keyout key.pem -out req.pem
|
||||
gmssl req -x509 -newkey rsa:1024 -keyout key.pem -out req.pem
|
||||
|
||||
Example of a file pointed to by the B<oid_file> option:
|
||||
|
||||
@@ -654,13 +654,13 @@ environment variable serves the same purpose but its use is discouraged.
|
||||
|
||||
=head1 BUGS
|
||||
|
||||
OpenSSL's handling of T61Strings (aka TeletexStrings) is broken: it effectively
|
||||
GmSSL's handling of T61Strings (aka TeletexStrings) is broken: it effectively
|
||||
treats them as ISO-8859-1 (Latin 1), Netscape and MSIE have similar behaviour.
|
||||
This can cause problems if you need characters that aren't available in
|
||||
PrintableStrings and you don't want to or can't use BMPStrings.
|
||||
|
||||
As a consequence of the T61String handling the only correct way to represent
|
||||
accented characters in OpenSSL is to use a BMPString: unfortunately Netscape
|
||||
accented characters in GmSSL is to use a BMPString: unfortunately Netscape
|
||||
currently chokes on these. If you have to use accented characters with Netscape
|
||||
and MSIE then you currently need to use the invalid T61String form.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user