.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.49.3. .TH XMLSEC1 "1" "February 2024" "xmlsec1 1.2.39 (openssl)" "User Commands" .SH NAME xmlsec1 \- sign, verify, encrypt and decrypt XML documents .SH SYNOPSIS .B xmlsec \fI\, \/\fR[\fI\,\/\fR] [\fI\,\/\fR] .SH DESCRIPTION xmlsec is a command line tool for signing, verifying, encrypting and decrypting XML documents. The allowed values are: .TP \fB\-\-help\fR display this help information and exit .TP \fB\-\-help\-all\fR display help information for all commands/options and exit .TP \fB\-\-help\-\fR display help information for command and exit .TP \fB\-\-version\fR print version information and exit .TP \fB\-\-keys\fR keys XML file manipulation .TP \fB\-\-sign\fR sign data and output XML document .TP \fB\-\-verify\fR verify signed document .TP \fB\-\-sign\-tmpl\fR create and sign dynamicaly generated signature template .TP \fB\-\-encrypt\fR encrypt data and output XML document .TP \fB\-\-decrypt\fR decrypt data from XML document .SH OPTIONS .HP \fB\-\-ignore\-manifests\fR .IP do not process elements .HP \fB\-\-store\-references\fR .IP store and print the result of element processing just before calculating digest .HP \fB\-\-store\-signatures\fR .IP store and print the result of processing just before calculating signature .HP \fB\-\-enabled\-reference\-uris\fR .IP comma separated list of of the following values: "empty", "same\-doc", "local","remote" to restrict possible URI attribute values for the element .HP \fB\-\-enable\-visa3d\-hack\fR .IP enables Visa3D protocol specific hack for URI attributes processing when we are trying not to use XPath/XPointer engine; this is a hack and I don't know what else might be broken in your application when you use it (also check "\-\-id\-attr" option because you might need it) .HP \fB\-\-binary\-data\fR .IP binary to encrypt .HP \fB\-\-xml\-data\fR .IP XML to encrypt .HP \fB\-\-enabled\-cipher\-reference\-uris\fR .IP comma separated list of of the following values: "empty", "same\-doc", "local","remote" to restrict possible URI attribute values for the element .HP \fB\-\-session\-key\fR \- .IP generate new session key of bits size (for example, "\-\-session des\-192" generates a new 192 bits DES key for DES3 encryption) .HP \fB\-\-output\fR .IP write result document to file .HP \fB\-\-print\-debug\fR .IP print debug information to stdout .HP \fB\-\-print\-xml\-debug\fR .IP print debug information to stdout in xml format .HP \fB\-\-dtd\-file\fR .IP load the specified file as the DTD .HP \fB\-\-node\-id\fR .IP set the operation start point to the node with given .HP \fB\-\-node\-name\fR [:] .IP set the operation start point to the first node with given and URI .HP \fB\-\-node\-xpath\fR .IP set the operation start point to the first node selected by the specified XPath expression .HP \fB\-\-id\-attr[\fR:] [:] .IP adds attributes (default value "id") from all nodes with and namespace to the list of known ID attributes; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "\-\-dtd\-file" option), I don't know what else might be broken in your application when you use this hack .HP \fB\-\-enabled\-key\-data\fR .IP comma separated list of enabled key data (list of registered key data klasses is available with "\-\-list\-key\-data" command); by default, all registered key data are enabled .HP \fB\-\-enabled\-retrieval\-uris\fR .IP comma separated list of of the following values: "empty", "same\-doc", "local","remote" to restrict possible URI attribute values for the element. .HP \fB\-\-gen\-key[\fR:] \- .IP generate new key of bits size, set the key name to and add the result to keys manager (for example, "\-\-gen:mykey rsa\-1024" generates a new 1024 bits RSA key and sets it's name to "mykey") .HP \fB\-\-keys\-file\fR .IP load keys from XML file .HP \fB\-\-privkey\-pem[\fR:] [,[,[...]]] .IP load private key from PEM file and certificates that verify this key .HP \fB\-\-privkey\-der[\fR:] [,[,[...]]] .IP load private key from DER file and certificates that verify this key .HP \fB\-\-pkcs8\-pem[\fR:] [,[,[...]]] .IP load private key from PKCS8 PEM file and PEM certificates that verify this key .HP \fB\-\-pkcs8\-der[\fR:] [,[,[...]]] .IP load private key from PKCS8 DER file and DER certificates that verify this key .HP \fB\-\-pubkey\-pem[\fR:] .IP load public key from PEM file .HP \fB\-\-pubkey\-der[\fR:] .IP load public key from DER file .HP \fB\-\-aeskey[\fR:] .IP load AES key from binary file .HP \fB\-\-deskey[\fR:] .IP load DES key from binary file .HP \fB\-\-hmackey[\fR:] .IP load HMAC key from binary file .HP \fB\-\-pwd\fR .IP the password to use for reading keys and certs .HP \fB\-\-pkcs12[\fR:] .IP load load private key from pkcs12 file .HP \fB\-\-pkcs12\-persist\fR .IP persist loaded private key .HP \fB\-\-pubkey\-cert\-pem[\fR:] .IP load public key from PEM cert file .HP \fB\-\-pubkey\-cert\-der[\fR:] .IP load public key from DER cert file .HP \fB\-\-trusted\-pem\fR .IP load trusted (root) certificate from PEM file .HP \fB\-\-untrusted\-pem\fR .IP load untrusted certificate from PEM file .HP \fB\-\-trusted\-der\fR .IP load trusted (root) certificate from DER file .HP \fB\-\-untrusted\-der\fR .IP load untrusted certificate from DER file .HP \fB\-\-verification\-time\fR