diff options
Diffstat (limited to 'src/_openssl')
| -rw-r--r-- | src/_openssl | 501 |
1 files changed, 259 insertions, 242 deletions
diff --git a/src/_openssl b/src/_openssl index 605297f..c2f8340 100644 --- a/src/_openssl +++ b/src/_openssl @@ -28,7 +28,7 @@ # Description # ----------- # -# Completion script for OpenSSL 3.5.3 (https://www.openssl-library.org/) +# Completion script for OpenSSL 4.0.0 (https://www.openssl-library.org/) # # ------------------------------------------------------------------------------ # Authors @@ -70,7 +70,7 @@ _openssl() { '-xcert[extra certificate file]:file:_files' '-xchain[extra certificate chain file]:file:_files' '-xchain_build[build the certificate chain for the extra certificates]' - '-xcertform[extra certificate format]:format[DER PEM P12]' + '-xcertform[extra certificate format]:format:(DER PEM P12)' ) local -a openssl_supported_commands_flags=( @@ -348,55 +348,55 @@ _openssl_subcommands() { 'chacha20:Chacha20 Cipher' - 'des:DES Ciper' - 'des-cbc:DES CBC Ciper' - 'des-cfb:DES CFB Ciper' - 'des-ecb:DES ECB Ciper' - 'des-ede:DES EDE Ciper' - 'des-ede-cbc:DES EDE CBC Ciper' - 'des-ede-cfb:DES EDE CFB Ciper' - 'des-ede-ofb:DES EDE OFB Ciper' - 'des-ofb:DES OFB Ciper' + 'des:DES Cipher' + 'des-cbc:DES CBC Cipher' + 'des-cfb:DES CFB Cipher' + 'des-ecb:DES ECB Cipher' + 'des-ede:DES EDE Cipher' + 'des-ede-cbc:DES EDE CBC Cipher' + 'des-ede-cfb:DES EDE CFB Cipher' + 'des-ede-ofb:DES EDE OFB Cipher' + 'des-ofb:DES OFB Cipher' - 'des3:Triple-DES Ciper' - 'desx:Triple-DES X Ciper' - 'des-ede3:Triple-DES EDE Ciper' - 'des-ede3-cbc:Triple-DES EDE CBC Ciper' - 'des-ede3-cfb:Triple-DES EDE CFB Ciper' - 'des-ede3-ofb:Triple-DES EDE OFB Ciper' + 'des3:Triple-DES Cipher' + 'desx:Triple-DES X Cipher' + 'des-ede3:Triple-DES EDE Cipher' + 'des-ede3-cbc:Triple-DES EDE CBC Cipher' + 'des-ede3-cfb:Triple-DES EDE CFB Cipher' + 'des-ede3-ofb:Triple-DES EDE OFB Cipher' - 'idea:IDEA Ciper' - 'idea-cbc:IDEA CBC Ciper' - 'idea-cfb:IDEA CFB Ciper' - 'idea-ecb:IDEA ECB Ciper' - 'idea-ofb:IDEA OFB Ciper' + 'idea:IDEA Cipher' + 'idea-cbc:IDEA CBC Cipher' + 'idea-cfb:IDEA CFB Cipher' + 'idea-ecb:IDEA ECB Cipher' + 'idea-ofb:IDEA OFB Cipher' - 'rc2:RC2 Ciper' - 'rc2-cbc:RC2 CBC Ciper' - 'rc2-cfb:RC2 CFB Ciper' - 'rc2-ecb:RC2 ECB Ciper' - 'rc2-ofb:RC2 OFB Ciper' + 'rc2:RC2 Cipher' + 'rc2-cbc:RC2 CBC Cipher' + 'rc2-cfb:RC2 CFB Cipher' + 'rc2-ecb:RC2 ECB Cipher' + 'rc2-ofb:RC2 OFB Cipher' - 'rc4:RC4 Ciper' + 'rc4:RC4 Cipher' - 'rc5:RC5 Ciper' - 'rc5-cbc:RC5 CBC Ciper' - 'rc5-cfb:RC5 CFB Ciper' - 'rc5-ecb:RC5 ECB Ciper' - 'rc5-ofb:RC5 OFB Ciper' + 'rc5:RC5 Cipher' + 'rc5-cbc:RC5 CBC Cipher' + 'rc5-cfb:RC5 CFB Cipher' + 'rc5-ecb:RC5 ECB Cipher' + 'rc5-ofb:RC5 OFB Cipher' - 'seed:SEED Ciper' - 'seed-cbc:SEED CBC Ciper' - 'seed-cfb:SEED CFB Ciper' - 'seed-ecb:SEED ECB Ciper' - 'seed-ofb:SEED OFB Ciper' + 'seed:SEED Cipher' + 'seed-cbc:SEED CBC Cipher' + 'seed-cfb:SEED CFB Cipher' + 'seed-ecb:SEED ECB Cipher' + 'seed-ofb:SEED OFB Cipher' - 'sm4:SM4 Ciper' - 'sm4-cbc:SM4 CBC Ciper' - 'sm4-cfb:SM4 CFB Ciper' - 'sm4-ctr:SM4 CTR Ciper' - 'sm4-ecb:SM4 ECB Ciper' - 'sm4-ofb:SM4 OFB Ciper' + 'sm4:SM4 Cipher' + 'sm4-cbc:SM4 CBC Cipher' + 'sm4-cfb:SM4 CFB Cipher' + 'sm4-ctr:SM4 CTR Cipher' + 'sm4-ecb:SM4 ECB Cipher' + 'sm4-ofb:SM4 OFB Cipher' ) _describe -t commands 'command' commands "$@" @@ -582,7 +582,7 @@ _openssl_cmp() { '-extracerts[certificates files or URIs to append in extraCerts field]:file_or_uri:_files' \ '-unprotected_errors[send request messages without CMP-level protection]' \ '-certform[file format to use when saving a certificate]:format:(PEM DER)' \ - '-crlform[file format to use when saving a CRL]:format(PEM DER)' \ + '-crlform[file format to use when saving a CRL]:format:(PEM DER)' \ '-keyform[format of the key input]:format:(PEM DER P12 ENGINE)' \ '-otherpass[pass phrase source for certificate]:source:_openssl_pass_phrase_options' \ $openssl_provider_options[@] \ @@ -844,6 +844,8 @@ _openssl_dgst() { '-prverify[private key file to verify the signature]:file:_files' \ '-signature[actual signature file to verify]:file:_files' \ '-hmac[key to create a hashed MAC]:key' \ + '-hmac-env[create a hashed MAC using a key from the given environment variable]:var:_parameters -g "*export*"' \ + '-hmac-stdin[create a hashed MAC using a key obtained from the standard input]' \ '-mac[MAC algorithm]:alg:_openssl_mac_algorithms' \ '-macopt[options of MAC algorithm]:options' \ '-fips-fingerprint[compute HMAC using a specific key for certain OpenSSL-FIPS operations]' \ @@ -1029,7 +1031,7 @@ _openssl_fipsinstall() { '(- *)-help[print help message]' \ '-module[file name of the FIPS module]:file:_files' \ '-out[file name to output configuration data to]:file:_files' \ - '-in[input file name to load configuration data from]:_files' \ + '-in[input file name to load configuration data from]:file:_files' \ '-verify[verify the input configuration file]' \ '-provider_name[name of the provider inside the configuration file(default: "fips")]:name' \ '-section_name[name of the section inside the configuration file(default: "fips_sect")]:name' \ @@ -1112,22 +1114,22 @@ _openssl_genpkey() { done _arguments \ - '(- *)-help[print help message]' \ - '-out[output private key file]:file:_files' \ - '-outpubkey[output public key file]:file:_files' \ - '-outform[output format]:format:(DER PEM)' \ - '-verbose[output "status dots" while generating keys]' \ - '-quiet[do not output "status dots" while generating keys]' \ - '-pass[output file password source]:source:_openssl_pass_phrase_options' \ - $cipher_flags[@] \ - '-algorithm[public key algorithm]:alg:(($builtin_algorithms))' \ - '-pkeyopt[public key algorithm option]:option' \ - '-genparam[generate a set of parameters instead of a private key]' \ - '-paramfile[file to supply public key parameters]:file:_files' \ - '-text[print an (unencrypted) text representation of private and public keys and parameters]' \ - $openssl_random_state_options[@] \ - $openssl_provider_options[@] \ - '-config[configuration file]:file:_files' + '(- *)-help[print help message]' \ + '-out[output private key file]:file:_files' \ + '-outpubkey[output public key file]:file:_files' \ + '-outform[output format]:format:(DER PEM)' \ + '-verbose[output "status dots" while generating keys]' \ + '-quiet[do not output "status dots" while generating keys]' \ + '-pass[output file password source]:source:_openssl_pass_phrase_options' \ + $cipher_flags[@] \ + '-algorithm[public key algorithm]:alg:(($builtin_algorithms))' \ + '-pkeyopt[public key algorithm option]:option' \ + '-genparam[generate a set of parameters instead of a private key]' \ + '-paramfile[file to supply public key parameters]:file:_files' \ + '-text[print an (unencrypted) text representation of private and public keys and parameters]' \ + $openssl_random_state_options[@] \ + $openssl_provider_options[@] \ + '-config[configuration file]:file:_files' } _openssl_genrsa() { @@ -1441,17 +1443,17 @@ _openssl_pkcs12() { _openssl_pkcs7() { _arguments \ - '(- *)-help[print help message]' \ - '-inform[input format]:format:(DER PEM)' \ - '-outform[output format]:format:(DER PEM)' \ - '-in[input file name]:file:_files' \ - '-out[output file name]:file:_files' \ - '-print[print out the full PKCS7 object]' \ - '-print_certs[print out any certificates or CRLs contained in the file]' \ - '-quiet[print out just the PEM-encoded certificates without any other output]' \ - '-text[print out certificate details in full]' \ - '-noout[do not output the encoded version of the PKCS#7 structure]' \ - $openssl_provider_options[@] + '(- *)-help[print help message]' \ + '-inform[input format]:format:(DER PEM)' \ + '-outform[output format]:format:(DER PEM)' \ + '-in[input file name]:file:_files' \ + '-out[output file name]:file:_files' \ + '-print[print out the full PKCS7 object]' \ + '-print_certs[print out any certificates or CRLs contained in the file]' \ + '-quiet[print out just the PEM-encoded certificates without any other output]' \ + '-text[print out certificate details in full]' \ + '-noout[do not output the encoded version of the PKCS#7 structure]' \ + $openssl_provider_options[@] } _openssl_pkcs8() { @@ -1460,51 +1462,51 @@ _openssl_pkcs8() { ) _arguments \ - '(- *)-help[print help message]' \ - '-topk8[read a private key and write a PkCS#8 format key]' \ - '-inform[input format]:format:(DER PEM)' \ - '-outform[output format]:format:(DER PEM)' \ - '-traditional[traditional format]' \ - '-in[input file name]:file:_files' \ - '-passin[input password source]:source:_openssl_pass_phrase_options' \ - '-passout[output password source]:source:_openssl_pass_phrase_options' \ - '-out[output file name]:files:_files' \ - '-iter[number of iterations to create PKCS#8 containers]:count' \ - '-noiter[use 1 as iteration count]' \ - '-nocrypt[output unencrypted PrivateKeyInfo structure]' \ - '-v2[algorithm for PKCS#5 v2.0]:alg:_openssl_cipher_algorithms' \ - '-v2prf[PRF algorithm to use with PKCS#5 v2.0]:alg:(($prf_algorithms))' \ - '-v1[algorithm for PKCS#5 v1.5 or PKCS#12]:alg:_openssl_cipher_algorithms' \ - '-scrypt[use the script algorithm for private key encryption]' \ - '-scrypt_N[scrypt "N" parameter]:n' \ - '-scrypt_r[scrypt "r" parameter]:r' \ - '-scrypt_p[scrypt "p" parameter]:p' \ - '-saltlen[length of the salt to use for the PBE algorithm]:length' \ - $openssl_random_state_options[@] \ - $openssl_provider_options[@] + '(- *)-help[print help message]' \ + '-topk8[read a private key and write a PkCS#8 format key]' \ + '-inform[input format]:format:(DER PEM)' \ + '-outform[output format]:format:(DER PEM)' \ + '-traditional[traditional format]' \ + '-in[input file name]:file:_files' \ + '-passin[input password source]:source:_openssl_pass_phrase_options' \ + '-passout[output password source]:source:_openssl_pass_phrase_options' \ + '-out[output file name]:files:_files' \ + '-iter[number of iterations to create PKCS#8 containers]:count' \ + '-noiter[use 1 as iteration count]' \ + '-nocrypt[output unencrypted PrivateKeyInfo structure]' \ + '-v2[algorithm for PKCS#5 v2.0]:alg:_openssl_cipher_algorithms' \ + '-v2prf[PRF algorithm to use with PKCS#5 v2.0]:alg:(($prf_algorithms))' \ + '-v1[algorithm for PKCS#5 v1.5 or PKCS#12]:alg:_openssl_cipher_algorithms' \ + '-scrypt[use the script algorithm for private key encryption]' \ + '-scrypt_N[scrypt "N" parameter]:n' \ + '-scrypt_r[scrypt "r" parameter]:r' \ + '-scrypt_p[scrypt "p" parameter]:p' \ + '-saltlen[length of the salt to use for the PBE algorithm]:length' \ + $openssl_random_state_options[@] \ + $openssl_provider_options[@] } _openssl_pkey() { _arguments \ - '(- *)-help[print help message]' \ - $openssl_provider_options[@] \ - '-check[check the consistency of a key pair for both public and private components]' \ - '-pubcheck[check the correctness of either a public key or the public components of a key pair]' \ - '-in[input file or URI]:file_or_uri:_files' \ - '-inform[key input format]:format:(DER PEM P12 ENGINE)' \ - '-passin[password source for the key input]:source:_openssl_pass_phrase_options' \ - '-pubin[read public key instead of private key]' \ - '-out[output file name]' \ - '-outform[key output format]:format:(DER PEM)' \ - '-cipher[cipher to encrypt the PEM encoded private key]:cipher:_openssl_ciphers' \ - '-passout[password source for the output file]:source:_openssl_pass_phrase_options' \ - '-traditional[use older "traditional" format]' \ - '-pubout[output the public components]' \ - '-noout[do not output the key in encoded form]' \ - '-text[output the various key components in plain text]' \ - '-text_pub[output only the public key components in text form]' \ - '-ec_conv_form[specify how the points on the elliptic-curve curve are converted into octet strings]:type:(compressed uncompressed hybrid)' \ - '-ec_param_enc[specify how the elliptic curve parameters are encoded]:type:(named_curve explicit)' + '(- *)-help[print help message]' \ + $openssl_provider_options[@] \ + '-check[check the consistency of a key pair for both public and private components]' \ + '-pubcheck[check the correctness of either a public key or the public components of a key pair]' \ + '-in[input file or URI]:file_or_uri:_files' \ + '-inform[key input format]:format:(DER PEM P12 ENGINE)' \ + '-passin[password source for the key input]:source:_openssl_pass_phrase_options' \ + '-pubin[read public key instead of private key]' \ + '-out[output file name]' \ + '-outform[key output format]:format:(DER PEM)' \ + '-cipher[cipher to encrypt the PEM encoded private key]:cipher:_openssl_ciphers' \ + '-passout[password source for the output file]:source:_openssl_pass_phrase_options' \ + '-traditional[use older "traditional" format]' \ + '-pubout[output the public components]' \ + '-noout[do not output the key in encoded form]' \ + '-text[output the various key components in plain text]' \ + '-text_pub[output only the public key components in text form]' \ + '-ec_conv_form[specify how the points on the elliptic-curve curve are converted into octet strings]:type:(compressed uncompressed hybrid)' \ + '-ec_param_enc[specify how the elliptic curve parameters are encoded]:type:(named_curve explicit)' } _openssl_pkeyparam() { @@ -1721,8 +1723,8 @@ _openssl_s_client() { local tls_start_protocols=(smtp pop3 imap ftp xmpp xmpp-server irc postgres mysql lmtp nntp sieve ldap) _arguments \ - '(- *)-help[print help message]' \ - '-ssl_config[section of the configuration file to configure the SSL_CTX object]:section' \ + '(- *)-help[print help message]' \ + '-ssl_config[section of the configuration file to configure the SSL_CTX object]:section' \ '-connect[host and optional port to connect to]:host_port' \ '-host[host to connect to]:host' \ '-port[port to connect to]:port' \ @@ -1830,134 +1832,149 @@ _openssl_s_client() { $openssl_verification_options[@] \ '-enable_server_rpk[enable support for receiving raw public keys from the server]' \ '-enable_client_rpk[enable support for sending raw public keys to the server]' \ + '*-expected-rpks[specify public keys expected from the remote peer used to authenticate the connection]:file:_files' \ + '-ech_outer_alpn[specify ALPN values to use in the outer ClientHello]:protocol' \ + '-ech_grease[emit a GREASE value]' \ + '-ech_grease_suite[specify ECH ciphersuites to use when -ech_grease is specified]:suite' \ + '-ech_grease_type[specify a GREASEd ECH value]:type' \ + '-ech_ignore_cid[use random value for ECH]' \ + '-ech_outer_sni[specify a subject name indication value to use in hte outer ClientHello]:value' \ + '-ech_no_outer_sni[no SNI will be emitted in the outer ClientHello]' \ + '-ech_select[specify which ECHConfigList to use using a zero-based index]:index' \ '*::host_port' } _openssl_s_server() { _arguments \ - '(- *)-help[print help message]' \ - '-port[TCP port to listen on for connections(default: 4433)]:port' \ - '-accept[optional TCP host and port to listen on for connections(default: *:4433)]:host_port' \ - '-unix[Unix domain socket path]:path:_files' \ - '(-4 -6)-4[use IPv4 only]' \ - '(-4 -6)-6[use IPv6 only]' \ - '-unlink[for -unix, unlink any existing socket first]' \ - '-context[SSL context ID]:id' \ - '(-verify -Verify)'{-verify,-Verify}'[verify depth]:depth' \ - '-cert[certificate file]:file:_files' \ - '-cert2[certificate file to use for servername(default: server2.pem)]:file:_files' \ - '-certform[server certificate file format]:format:(DER PEM P12)' \ - '-cert_chain[file or URI of untrusted certificates to build the certificate chain]:file_or_uri:_files' \ - '-build_chain[application should build the server certificate chain]' \ - '-serverinfo[file containing one or more blocks of PEM data]:file:_files' \ - '-key[private key file or URI]:file_or_uri:_files' \ - '-key2[private key file or URI to use for servername]:file_or_uri:_files' \ - '-keyform[key format]:format:(DER PEM P12 ENGINE)' \ - '-pass[private key and certificate file password source]:source:_openssl_pass_phrase_options' \ - '-dcert[additional certificate file]:file:_files' \ - '-dkey[additional private key file or URI]:file_or_uri:_files' \ - '-dcert_chain[file or URI of untrusted certificates to build the server certificate chain]:file_or_uri:_files' \ - '-dcertform[format of the additional certificate file]:format:(DER PEM P12)' \ - '-dkeyform[format of the additional private key]:format:(DER PEM P12 ENGINE)' \ - '-dpass[passphrase for the additional private key and certificate]:pass:_openssl_pass_phrase_options' \ - '-nbio_test[test non blocking I/O]' \ - '-crlf[translate a line feed from the terminal into CR+LF]' \ - '-debug[print extensive debugging information including a hex dump of all traffic]' \ - '-security_debug[print output from SSL/TLS security framework]' \ - '-security_debug_verbose[print more output from SSL/TLS security framework]' \ - '-msg[show all protocol messages with hex dump]' \ - '-msgfile[file to send output of -msg or -trace to]:file:_files' \ - '-state[print the SSL session states]' \ - '-CRL[CRL file]:file:_files' \ - '-CRLform[CRL file format]:format:(DER PEM)' \ - '-crl_download[download CRLs from distribution points]' \ - '-verifyCAfile[file in PEM format CA containing trusted certificates to verify client certificates]:file:_files' \ - '-verifyCApath[directory containing trusted certificates to verify client certificates]:dir:_files -/' \ - '-verifyCAstore[URI of a store containing trusted certificates to verify client certificates]:uri:_urls' \ - '-chainCAfile[file in PEM format containing trusted certificates to build the server certificate chain]:file:_files' \ - '-chainCApath[directory containing trusted certificates for building server certificate chain]:dir:_files -/' \ - '-chainCAstore[URI of a store containing trusted certificates for building server certificate chain]:uri:_urls' \ - '-nocert[no certificate is used]' \ - '-quiet[inhibit printing of session and certificate information]' \ - '-no_resume_ephemeral[disable caching and tickets if ephemeral (EC)DH is used]' \ - '-tlsextdebug[print a hex dump of any TLS extensions received from the server]' \ - '-www[send a status message back to the client when it connects]' \ - '(-WWW -HTTP)'{-WWW,-HTTP}'[emulate a simple web server]' \ - '-http_server_binmode[acting as web-server open files in binary mode]' \ - '-no_ca_names[disable TLS Extension CA Names]' \ - '-ignore_unexpected_eof[peer does not need to send the close_notify alert]' \ - '-servername[servername for HostName TLS extension]' \ - '-servername_fatal[send fatal alert on servername mismatch]' \ - '-id_prefix[generate SSL/TLS session IDs prefixed by this ID]:id' \ - '-keymatexport[export keying material using label]:label' \ - '-keymatexportlen[export the given number of bytes of keying material(default: 20)]:length' \ - '-no_cache[disable session cache]' \ - '-ext_cache[disable internal cache]' \ - '-verify_return_error[close the connection when verification errors occur]' \ - '-verify_quiet[no verify output except verify errors]' \ - '(-no_ign_eof -ign_eof)-ign_eof[ignore input EOF]' \ - '(-no_ign_eof -ign_eof)-no_ign_eof[do not ignore input EOF]' \ - '-no_ems[disable Extended master secret negotiation]' \ - '-status[enable certificate status request support]' \ - '-status_verbose[enable certificate status request support and verbose output of OCSP response]' \ - '-status_timeout[set the timeout for OCSP reponse to the given seconds]:seconds' \ - '-proxy[HTTP(S) proxy server]:proxy' \ - '-no_proxy[list of IP addresses and/or DNS names not to use an HTTP(S) proxy for]:addresses' \ - '-status_url[set a fallback responder URL]:url:_urls' \ - '-status_file[status file]:file:_files' \ - '-ssl_config[configure SSL_CTX using the given configure value]:config' \ - '-trace[show verbose trace output of protocol messages]' \ - '-brief[provide a brief summary of connection parameters]' \ - '-rev[simple echo server that sends back received text reserved]' \ - '-async[switch on asynchronous mode]' \ - '-max_send_frag[maximum size of data fragment to send]:size' \ - '-split_send_frag[size used to split data for encrypt pipelines]:size' \ - '-max_pipelines[maximum number of encrypt/decrypt pipelines]:number' \ - '-naccept[server will exit after receiving the specified number of connections(default: unlimited)]:number' \ - '-read_buf[default read buffer size for connections]:size' \ - '-no_tx_cert_comp[disable support for sending TLSv1.3 compressed certificates]' \ - '-no_rx_cert_comp[disable support for receiving TLSv1.3 compressed certificates]' \ - '-no_comp[disable negotiation of TLS compression]' \ - '-num_tickets[control the number of tickets that will be sent to the client after a full handshake in TLSv1.3]' \ - '-dhparam[DH parameter file to use]:file:_files' \ - '-nbio[turn on non blocking I/O]' \ - '-timeout[enable timeout]' \ - '-mtu[set link-layer MTU]:size' \ - '-psk_identity[PSK identify when using a PSK cipher suite]:id' \ - '-psk_hint[PSK identity hint when using a PSK cipher suite]:hint' \ - '-psk[PSK key when using a PSK cipher suite]:key' \ - '-psk_session[file contains pem encoded SSL_SESSION data]:file:_files' \ - '-srpvfile[verifier file for SRP]:file:_files' \ - '-listen[listen on a UDP port for incoming connections]' \ - '-sctp[use SCTP for the transport protocol instead of UDP in DTLS]' \ - '-sctp_label_bug[allow communication with older broken implementations]' \ - '-use_srtp[offer SRTP key management with a colon-separated profile list]:list' \ - '-no_dhe[no DH parameters will be loaded]' \ - '-alpn[enable the Application-Layer Protocol Negotiation extension]:protocol' \ - '-nextprotoneg[enable the Next Protocol Negotiation extension]:protocol' \ - '-ktls[enable kernel TLS for sending and receiving]' \ - '-sendfile[SSL_sendfile will be used instead of BIO_write to send response]' \ - '-zerocopy_sendfile[SSL_sendfile will use the zerocopy TX mode]' \ - '-keylogfile[append TLS secrets to the specified keylog file]:file:_files' \ - '-max_early_data[change the default maximum early data bytes for new sessions and incoming early data]:size' \ - '-recv_max_early_data[hard limit on the maximum number of early data bytes that will be accepted]:bytes' \ - '-early_data[accept early data where possible]' \ - '-stateless[require TLSv1.3 cookies]' \ - '(-anti_replay -no_anti_replay)-anti_replay[switch replay protection on]' \ - '(-anti_replay -no_anti_replay)-no_anti_replay[switch replay protection off]' \ - '-tfo[enable acceptance of TCP fast Open connections]' \ - '-cert_comp[pre-compresses certificates that will be sent during the handshake]' \ - '-nameopt[how the subject or issuer names are displayed]:how:_openssl_name_display_options' \ - $openssl_tls_flags[@] \ - $openssl_dtls_flags[@] \ - $openssl_supported_commands_flags[@] \ - $openssl_extended_verification_flags[@] \ - $openssl_trusted_certificate_options[@] \ - $openssl_random_state_options[@] \ - $openssl_provider_options[@] \ - $openssl_verification_options[@] \ - '-enable_server_rpk[enable support for sending raw public keys to the client]' \ - '-enable_client_rpk[enable support for receiving raw public keys from the client]' + '(- *)-help[print help message]' \ + '-port[TCP port to listen on for connections(default: 4433)]:port' \ + '-accept[optional TCP host and port to listen on for connections(default: *:4433)]:host_port' \ + '-unix[Unix domain socket path]:path:_files' \ + '(-4 -6)-4[use IPv4 only]' \ + '(-4 -6)-6[use IPv6 only]' \ + '-unlink[for -unix, unlink any existing socket first]' \ + '-context[SSL context ID]:id' \ + '(-verify -Verify)'{-verify,-Verify}'[verify depth]:depth' \ + '-cert[certificate file]:file:_files' \ + '-cert2[certificate file to use for servername(default: server2.pem)]:file:_files' \ + '-certform[server certificate file format]:format:(DER PEM P12)' \ + '-cert_chain[file or URI of untrusted certificates to build the certificate chain]:file_or_uri:_files' \ + '-build_chain[application should build the server certificate chain]' \ + '-serverinfo[file containing one or more blocks of PEM data]:file:_files' \ + '-key[private key file or URI]:file_or_uri:_files' \ + '-key2[private key file or URI to use for servername]:file_or_uri:_files' \ + '-keyform[key format]:format:(DER PEM P12 ENGINE)' \ + '-pass[private key and certificate file password source]:source:_openssl_pass_phrase_options' \ + '-dcert[additional certificate file]:file:_files' \ + '-dkey[additional private key file or URI]:file_or_uri:_files' \ + '-dcert_chain[file or URI of untrusted certificates to build the server certificate chain]:file_or_uri:_files' \ + '-dcertform[format of the additional certificate file]:format:(DER PEM P12)' \ + '-dkeyform[format of the additional private key]:format:(DER PEM P12 ENGINE)' \ + '-dpass[passphrase for the additional private key and certificate]:pass:_openssl_pass_phrase_options' \ + '-nbio_test[test non blocking I/O]' \ + '-crlf[translate a line feed from the terminal into CR+LF]' \ + '-debug[print extensive debugging information including a hex dump of all traffic]' \ + '-security_debug[print output from SSL/TLS security framework]' \ + '-security_debug_verbose[print more output from SSL/TLS security framework]' \ + '-msg[show all protocol messages with hex dump]' \ + '-msgfile[file to send output of -msg or -trace to]:file:_files' \ + '-state[print the SSL session states]' \ + '-CRL[CRL file]:file:_files' \ + '-CRLform[CRL file format]:format:(DER PEM)' \ + '-crl_download[download CRLs from distribution points]' \ + '-verifyCAfile[file in PEM format CA containing trusted certificates to verify client certificates]:file:_files' \ + '-verifyCApath[directory containing trusted certificates to verify client certificates]:dir:_files -/' \ + '-verifyCAstore[URI of a store containing trusted certificates to verify client certificates]:uri:_urls' \ + '-chainCAfile[file in PEM format containing trusted certificates to build the server certificate chain]:file:_files' \ + '-chainCApath[directory containing trusted certificates for building server certificate chain]:dir:_files -/' \ + '-chainCAstore[URI of a store containing trusted certificates for building server certificate chain]:uri:_urls' \ + '-nocert[no certificate is used]' \ + '-quiet[inhibit printing of session and certificate information]' \ + '-no_resume_ephemeral[disable caching and tickets if ephemeral (EC)DH is used]' \ + '-tlsextdebug[print a hex dump of any TLS extensions received from the server]' \ + '-www[send a status message back to the client when it connects]' \ + '(-WWW -HTTP)'{-WWW,-HTTP}'[emulate a simple web server]' \ + '-http_server_binmode[acting as web-server open files in binary mode]' \ + '-no_ca_names[disable TLS Extension CA Names]' \ + '-ignore_unexpected_eof[peer does not need to send the close_notify alert]' \ + '-servername[servername for HostName TLS extension]' \ + '-servername_fatal[send fatal alert on servername mismatch]' \ + '-id_prefix[generate SSL/TLS session IDs prefixed by this ID]:id' \ + '-keymatexport[export keying material using label]:label' \ + '-keymatexportlen[export the given number of bytes of keying material(default: 20)]:length' \ + '-no_cache[disable session cache]' \ + '-ext_cache[disable internal cache]' \ + '-verify_return_error[close the connection when verification errors occur]' \ + '-verify_quiet[no verify output except verify errors]' \ + '(-no_ign_eof -ign_eof)-ign_eof[ignore input EOF]' \ + '(-no_ign_eof -ign_eof)-no_ign_eof[do not ignore input EOF]' \ + '-no_ems[disable Extended master secret negotiation]' \ + '-status[enable certificate status request support]' \ + '-status_verbose[enable certificate status request support and verbose output of OCSP response]' \ + '-status_timeout[set the timeout for OCSP reponse to the given seconds]:seconds' \ + '-proxy[HTTP(S) proxy server]:proxy' \ + '-no_proxy[list of IP addresses and/or DNS names not to use an HTTP(S) proxy for]:addresses' \ + '-status_url[set a fallback responder URL]:url:_urls' \ + '-status_file[status file]:file:_files' \ + '-ssl_config[configure SSL_CTX using the given configure value]:config' \ + '-trace[show verbose trace output of protocol messages]' \ + '-brief[provide a brief summary of connection parameters]' \ + '-rev[simple echo server that sends back received text reserved]' \ + '-async[switch on asynchronous mode]' \ + '-max_send_frag[maximum size of data fragment to send]:size' \ + '-split_send_frag[size used to split data for encrypt pipelines]:size' \ + '-max_pipelines[maximum number of encrypt/decrypt pipelines]:number' \ + '-naccept[server will exit after receiving the specified number of connections(default: unlimited)]:number' \ + '-read_buf[default read buffer size for connections]:size' \ + '-no_tx_cert_comp[disable support for sending TLSv1.3 compressed certificates]' \ + '-no_rx_cert_comp[disable support for receiving TLSv1.3 compressed certificates]' \ + '-no_comp[disable negotiation of TLS compression]' \ + '-num_tickets[control the number of tickets that will be sent to the client after a full handshake in TLSv1.3]' \ + '-dhparam[DH parameter file to use]:file:_files' \ + '-nbio[turn on non blocking I/O]' \ + '-timeout[enable timeout]' \ + '-mtu[set link-layer MTU]:size' \ + '-psk_identity[PSK identify when using a PSK cipher suite]:id' \ + '-psk_hint[PSK identity hint when using a PSK cipher suite]:hint' \ + '-psk[PSK key when using a PSK cipher suite]:key' \ + '-psk_session[file contains pem encoded SSL_SESSION data]:file:_files' \ + '-srpvfile[verifier file for SRP]:file:_files' \ + '-listen[listen on a UDP port for incoming connections]' \ + '-sctp[use SCTP for the transport protocol instead of UDP in DTLS]' \ + '-sctp_label_bug[allow communication with older broken implementations]' \ + '-use_srtp[offer SRTP key management with a colon-separated profile list]:list' \ + '-no_dhe[no DH parameters will be loaded]' \ + '-alpn[enable the Application-Layer Protocol Negotiation extension]:protocol' \ + '-nextprotoneg[enable the Next Protocol Negotiation extension]:protocol' \ + '-ktls[enable kernel TLS for sending and receiving]' \ + '-sendfile[SSL_sendfile will be used instead of BIO_write to send response]' \ + '-zerocopy_sendfile[SSL_sendfile will use the zerocopy TX mode]' \ + '-keylogfile[append TLS secrets to the specified keylog file]:file:_files' \ + '-max_early_data[change the default maximum early data bytes for new sessions and incoming early data]:size' \ + '-recv_max_early_data[hard limit on the maximum number of early data bytes that will be accepted]:bytes' \ + '-early_data[accept early data where possible]' \ + '-stateless[require TLSv1.3 cookies]' \ + '(-anti_replay -no_anti_replay)-anti_replay[switch replay protection on]' \ + '(-anti_replay -no_anti_replay)-no_anti_replay[switch replay protection off]' \ + '-tfo[enable acceptance of TCP fast Open connections]' \ + '-cert_comp[pre-compresses certificates that will be sent during the handshake]' \ + '-nameopt[how the subject or issuer names are displayed]:how:_openssl_name_display_options' \ + $openssl_tls_flags[@] \ + $openssl_dtls_flags[@] \ + $openssl_supported_commands_flags[@] \ + $openssl_extended_verification_flags[@] \ + $openssl_trusted_certificate_options[@] \ + $openssl_random_state_options[@] \ + $openssl_provider_options[@] \ + $openssl_verification_options[@] \ + '-enable_server_rpk[enable support for sending raw public keys to the client]' \ + '-enable_client_rpk[enable support for receiving raw public keys from the client]' \ + '*-expected-rpks[specify public keys expected from the remote peer used to authenticate the connection]:file:_files' \ + '-ech_key[load one Encrypted Client Hello(ECH) key pair]:file:_files' \ + '-ech_dir[load an ECH key pair from every file in the named directory]:dir:_files -/' \ + '-ech_noretry_dir[load an ECH key pair from every file in the named directory. not return in "retry_configs"]:file:_files -/' \ + '-ech_trialdecrypt[ECH config_id is used to match against the loaded ECH private keys and decryption is only attempted]' \ + '-ech_greaseretries[servers will add GREASEy ECHConfigList values to those sent in retry_configs]' } _openssl_s_time() { @@ -2012,13 +2029,13 @@ _openssl_smime() { '-in[input message file]:file:_files' \ '-out[output file name]:file:_files' \ '-inform[input format]:format:(DER PEM SMIME)' \ - '-outform[output format]:format(DER PEM SMIME)' \ + '-outform[output format]:format:(DER PEM SMIME)' \ '-keyform[key format]:format:(DER PEM P12 ENGINE)' \ '(-stream -indef)'{-stream,-indef}'[enable streaming I/O for encoding operations]' \ '-noindef[disable streaming I/O]' \ '-content[file containing the detached content]:file:_files' \ '-text[add plain text MIME headers to the supplied message]' \ - '-md[digest algorithm to use when signing or resigning]:digest:(sha256 sha1 md5' \ + '-md[digest algorithm to use when signing or resigning]:digest:(sha256 sha1 md5)' \ $cipher_flags[@] \ '-nointern[use only the certificate in the -certificate]' \ '-noverify[do not verify the signers certificate of a signed message]' \ @@ -2069,7 +2086,7 @@ _openssl_speed() { '(- *)-help[print help message]' \ '-config[configuration file]:file:_files' \ '-elapsed[use wall-clock time instead of CPU user time as divisor]' \ - '-evp[use specified cipher or message digest algorithm via the EVP interface]:alg: _alternative "ciphers\:cipher\:_openssl_digests" "digests\:digest\:_openssl_cipher_algorithms"' \ + '-evp[use specified cipher or message digest algorithm via the EVP interface]:alg: _alternative "ciphers\:cipher\:_openssl_cipher_algorithms" "digests\:digest\:_openssl_digests"' \ '-multi[run multiple operations in parallel]:number' \ '-async_jobs[enable async mode and start specified number of jobs]:number' \ '-misalign[misalign the buffers by the specified number of bytes]:number' \ |