Annotation of embedaddon/strongswan/src/scepclient/scepclient.8, revision 1.1.1.1
1.1 misho 1: .\"
2: .TH "IPSEC_SCEPCLIENT" "8" "2012-05-11" "strongSwan" ""
3: .SH "NAME"
4: ipsec scepclient \- Client for the SCEP protocol
5: .SH "SYNOPSIS"
6: .B ipsec scepclient [argument ...]
7: .sp
8: .B ipsec scepclient
9: .B \-\-help
10: .br
11: .B ipsec scepclient
12: .B \-\-version
13: .SH "DESCRIPTION"
14: .BR scepclient
15: is a client implementation of Cisco System's Simple Certificate Enrollment Protocol (SCEP) written for Linux strongSwan <http://www.strongswan.org>.
16: .BR scepclient
17: is designed to be used for certificate enrollment on machines using the OpenSource IPsec solution
18: .I strongSwan.
19: .SH "FEATURES"
20: .BR scepclient
21: implements the following features of SCEP:
22: .br
23: .IP "\-" 4
24: Automatic enrollment of client certificate using a preshared secret
25: .IP "\-" 4
26: Manual enrollment of client certificate. Offline fingerprint check required!
27: .IP "\-" 4
28: Acquisition of CA certificate(s)
29: .SH "OPTIONS"
30: .SS Basic Startup Options
31: .B \-v, \-\-version
32: .RS 4
33: Display the version of ipsec scepclient.
34: .PP
35: .RE
36: .B \-h, \-\-help
37: .RS 4
38: Display usage of ipsec scepclient.
39: .RE
40:
41: .SS General Options
42: .B \-u, \-\-url \fIurl\fP
43: .RS 4
44: Full HTTP URL of the SCEP server to be used for certificate enrollment and CA certificate acquisition.
45: .RE
46: .PP
47: .B \-+, \-\-optionsfrom \fIfilename\fP
48: .RS 4
49: Reads additional options from \fIfilename\fP.
50: .RE
51: .PP
52: .B \-f, \-\-force
53: .RS 4
54: Overwrite existing output file[s].
55: .RE
56: .PP
57: .B \-q, \-\-quiet
58: .RS 4
59: Do not write log output to stderr.
60: .RE
61:
62: .SS Options for CA Certificate Acquisition
63: .B \-o, \-\-out cacert[=\fIfilename\fP]
64: .RS 4
65: Output file of acquired CA certificate. If more then one CA certificate is
66: available, \fIfilename\fP is used as prefix for the resulting files (refer to
67: EXAMPLES below for details).
68: .br
69: The default \fIfilename\fP is $CONFDIR/ipsec.d/cacerts/caCert.der.
70: .RE
71:
72: .SS Options For Certificate Enrollment
73: .B \-i, \-\-in \fItype\fP[=\fIfilename\fP]
74: .RS 4
75: Input file for certificate enrollment. This option can be specified multiple times to specify input files for every \fItype\fP.
76: Input files can be either DER or PEM encoded.
77: .PP
78: Supported values for \fItype\fP:
79: .IP "\fBpkcs1\fP" 12
80: RSA private key in PKCS#1 file format. If no input of this type is specified, a RSA key gets generated.
81: .br
82: The default \fIfilename\fP is $CONFDIR/ipsec.d/private/myKey.der.
83: .IP "\fBpkcs10\fP" 12
84: PKCS#10 certificate request to be used in the SCEP request. If no input of this type is specified, a request is generated.
85: .br
86: The default \fIfilename\fP is $CONFDIR/ipsec.d/req/myReq.der.
87: .IP "\fBcacert\-enc\fP" 12
88: CA certificate to encrypt the SCEP request. Has to be specified for certificate enrollment.
89: .br
90: The default \fIfilename\fP is $CONFDIR/ipsec.d/cacerts/caCert.der.
91: .IP "\fBcacert\-sig\fP" 12
92: CA certificate to check signature of SCEP reply. Has to be specified for certificate enrollment.
93: .br
94: The default \fIfilename\fP is $CONFDIR/ipsec.d/cacerts/caCert.der.
95: .IP "\fBcert-self\fP" 12
96: Certificate to be used in the SCEP request. If it is not specified a
97: self-signed certificate is generated automatically.
98: .br
99: The default \fIfilename\fP is $CONFDIR/ipsec.d/certs/selfCert.der.
100: .RE
101: .PP
102: .B \-k, \-\-keylength \fIbits\fP
103: .RS 4
104: sets the key length for RSA key generation. The default length for a generated rsa key is set to 2048 bit.
105: .RE
106: .PP
107: .B \-D, \-\-days \fIdays\fP
108: .RS 4
109: Validity of the self-signed X.509 certificate in days. The default is 1825 days (5 years).
110: .RE
111: .PP
112: .B \-S, \-\-startdate \fIYYMMDDHHMMSS\fPZ
113: .RS 4
114: defines the \fBnotBefore\fP date when the X.509 certificate becomes valid.
115: The date has the format \fIYYMMDDHHMMSS\fP and must be specified in UTC (Zulu time).
116: If the \fB--startdate\fP option is not specified then the current date is taken as a default.
117: .RE
118: .PP
119: .B \-E, \-\-enddate \fIYYMMDDHHMMSS\fPZ
120: .RS 4
121: defines the \fBnotAfter\fP date when the X.509 certificate will expire.
122: The date has the format \fIYYMMDDHHMMSS\fP and must be specified in UTC (Zulu time).
123: If the \fB--enddate\fP option is not specified then the default \fBnotAfter\fP value is computed by
124: adding the validity interval specified by the \fB--days\fP option to the \fBnotBefore\fP date.
125: .RE
126: .PP
127: .B \-d, \-\-dn \fIdn\fP
128: .RS 4
129: Distinguished name as comma separated list of relative distinguished names. Use quotation marks for a distinguished name containing spaces. If the \fB\-\-dn\fP parameter is missing then the default "C=CH, O=Linux strongSwan, CN=\fIhostname\fP"
130: is used with \fIhostname\fP being the return value of the \fIgethostname\fP() function.
131: .RE
132: .PP
133: .B \-s, \-\-subjectAltName \fItype\fP=\fIvalue\fP
134: .RS 4
135: Include subjectAltName in certificate request. This option can be specified multiple times to specify a subjectAltName
136: for every \fItype\fP.
137: .PP
138: Supported values for \fItype\fP:
139: .IP "\fBemail\fP" 12
140: subjectAltName is a email address.
141: .IP "\fBdns\fP" 12
142: subjectAltName is a hostname.
143: .IP "\fBip\fP" 12
144: subjectAltName is a IP address.
145: .RE
146: .PP
147: .B \-p, \-\-password \fIpw\fP
148: .RS 4
149: Password to be included as a \fIchallenge password\fP in SCEP request.
150: If \fIpw\fP is \fB%prompt\fP', the password gets prompted for on the command line.
151: .IP
152: \- In automatic mode, this password corresponds to the preshared secret for the given enrollment.
153: .IP
154: \- In manual mode, this password can be used to later revoke the corresponding certificate.
155: .RE
156: .PP
157: .B \-a, \-\-algorithm [\fItype\fP=]\fIalgo\fP
158: .RS 4
159: Change the algorithms to be used when generating and transporting (PKCS#7)
160: certificate requests (PKCS#10).
161: .PP
162: Supported values for \fItype\fP:
163: .IP "\fBenc\fP" 12
164: symmetric encryption algorithm in PKCS#7
165: .IP "\fBdgst\fP" 12
166: hash algorithm for message digest in PKCS#7
167: .IP "\fBsig\fP" 12
168: hash algorithm for the signature in PKCS#10
169: .PP
170: If \fItype\fP is not specified \fBenc\fP is assumed.
171: .PP
172: Supported values for \fIalgo\fP (\fBenc\fP):
173: .IP "\fBdes\fP" 12
174: DES-CBC encryption (key size = 56 bit). Default.
175: .IP "\fB3des\fP" 12
176: Triple DES-EDE-CBC encryption (key size = 168 bit).
177: .IP "\fBaes128\fP" 12
178: AES-CBC encryption (key size = 128 bit).
179: .IP "\fBaes192\fP" 12
180: AES-CBC encryption (key size = 192 bit).
181: .IP "\fBaes256\fP" 12
182: AES-CBC encryption (key size = 256 bit).
183: .IP "\fBcamellia128\fP" 12
184: Camellia-CBC encryption (key size = 128 bit).
185: .IP "\fBcamellia192\fP" 12
186: Camellia-CBC encryption (key size = 192 bit).
187: .IP "\fBcamellia256\fP" 12
188: Camellia-CBC encryption (key size = 256 bit).
189: .PP
190: Supported values for \fIalgo\fP (\fBdgst\fP or \fBsig\fP):
191: .PP
192: \fBmd5\fP (default), \fBsha1\fP, \fBsha256\fP, \fBsha384\fP, \fBsha512\fP
193: .RE
194: .PP
195: .B \-o, \-\-out \fItype\fP[=\fIfilename\fP]
196: .RS 4
197: Output file for certificate enrollment. This option can be specified multiple times to specify output files for every \fItype\fP.
198: .PP
199: Supported values for \fItype\fP:
200: .IP "\fBpkcs1\fP" 12
201: RSA private key in PKCS#1 file format. If specified, the RSA key used for enrollment is stored in file \fIfilename\fP.
202: If none of the \fItypes\fP listed below are specified, \fBscepclient\fP will stop after outputting this file.
203: .br
204: The default \fIfilename\fP is $CONFDIR/ipsec.d/private/myKey.der.
205: .IP "\fBpkcs10\fP" 12
206: PKCS#10 certificate request. If specified, the PKCS#10 request used or certificate enrollment is stored in file \fIfilename\fP.
207: If none of the \fItypes\fP listed below are specified, \fBscepclient\fP will stop after outputting this file.
208: .br
209: The default \fIfilename\fP is $CONFDIR/ipsec.d/req/myReq.der.
210: .IP "\fBpkcs7\fP" 12
211: PKCS#7 SCEP request as it is sent using HTTP to the SCEP server. If specified, this SCEP request is stored in file \fIfilename\fP.
212: If none of \fItypes\fP listed below is not specified, \fBscepclient\fP will stop after outputting this file.
213: .br
214: The default \fIfilename\fP is $CONFDIR/ipsec.d/req/pkcs7.der.
215: .IP "\fBcert-self\fP" 12
216: Self-signed certificate. If specified the self-signed certificate is stored in file \fIfilename\fP.
217: .br
218: The default \fIfilename\fP is $CONFDIR/ipsec.d/certs/selfCert.der.
219: .IP "\fBcert\fP" 12
220: Enrolled certificate. This \fItype\fP must be specified for certificate enrollment.
221: The enrolled certificate is stored in file \fIfilename\fP.
222: .br
223: The default \fIfilename\fP is set to $CONFDIR/ipsec.d/certs/myCert.der.
224: .RE
225: .PP
226: .B \-m, \-\-method \fImethod\fP
227: .RS 4
228: Change HTTP request method for certificate enrollment. Default is \fBget\fP.
229: .PP
230: Supported values for \fImethod\fP:
231: .IP "\fBpost\fP" 12
232: Certificate enrollment using HTTP POST. Must be supported by the given SCEP server.
233: .IP "\fBget\fP" 12
234: Certificate enrollment using HTTP GET.
235: .RE
236: .PP
237: .B \-t, \-\-interval \fIseconds\fP
238: .RS 4
239: Set interval time in seconds when polling in manual mode.
240: The default interval is set to 5 seconds.
241: .RE
242: .PP
243: .B \-x, \-\-maxpolltime \fIseconds\fP
244: .RS 4
245: Set max time in seconds to poll in manual mode.
246: The default max time is set to unlimited.
247: .RE
248:
249: .SS Debugging Output Options:
250: .B \-l, \-\-debug \fIlevel\fP
251: .RS 4
252: Changes the log level (-1..4, default: 1)
253: .RE
254: .SH "EXAMPLES"
255: .B ipsec scepclient \-\-out caCert \-\-url http://scepserver/cgi\-bin/pkiclient.exe \-f
256: .RS 4
257: Acquire CA certificate from SCEP server and store it in the default file $CONFDIR/ipsec.d/cacerts/caCert.der.
258: If more then one CA certificate is returned, store them in files named
259: \'caCert\-1.der\', \'caCert\-2.der\', etc.
260: If an RA certificate is returned, store it in a file named \'caCert\-ra.der\'.
261: If more than one RA certificate is returned, store them in files named
262: \'caCert\-ra\-1.der\', \'caCert\-ra\-2.der\', etc.
263: .RE
264: .PP
265: .B ipsec scepclient \-\-out pkcs1=joeKey.der \-k 1024
266: .RS 4
267: Generate RSA private key with key length of 1024 bit and store it in file joeKey.der.
268: .RE
269: .PP
270: .B ipsec scepclient \-\-in pkcs1=joeKey.der \-\-out pkcs10=joeReq.der \e
271: .br
272: .B \-\-dn \*(rqC=AT, CN=John Doe\*(rq \-s email=john@doe.com \-p mypassword
273: .RS 4
274: Generate a PKCS#10 request and store it in file joeReq.der. Use the RSA private key joeKey.der
275: created earlier to sign the PKCS#10\-Request. In addition to the distinguished name include a
276: email\-subjectAltName and a challenge password in the request.
277: .RE
278: .PP
279: .B ipsec scepclient \-\-out pkcs1=joeKey.der \-\-out cert==joeCert.der \e
280: .br
281: .B \-\-dn \*(rqC=CH, CN=John Doe\*(rq \-k 512 \-p 5xH2pnT7wq \e
282: .br
283: .B \-\-url http://scep.hsr.ch/cgi\-bin/pkiclient.exe \e
284: .br
285: .B \-\-in cacert\-enc=caCert.der \-\-in cacert\-sig=caCert.der
286: .RS 4
287: Generate a new RSA key for the request and store it in joeKey.der. Then enroll a certificate and store as joeCert.der.
288: The challenge password is '5xH2pnT7wq'. The encryption and signature check has to be made with the same CA certificate
289: caCert.der.
290: .RE
291:
292: .SH "BUGS"
293: \fB\-\-optionsfrom\fP seems to have parsing problems reading option files containing strings in quotation marks.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to scepclient.8 CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / scepclient