/usr/bin/dcmsign

$dcmtk: dcmsign v3.7.1 2026-10-15 $

dcmsign: Sign and Verify DICOM Files
usage: dcmsign [options] dcmfile-in [dcmfile-out]

parameters:
  dcmfile-in                     DICOM input filename to be processed
                                 ("-" for stdin)
  dcmfile-out                    DICOM output filename
                                 ("-" for stdout)

general options:
  -h      --help                 print this help text and exit
          --version              print version information and exit
          --arguments            print expanded command line arguments
  -q      --quiet                quiet mode, print no warnings and errors
  -v      --verbose              verbose mode, print processing details
  -d      --debug                debug mode, print debug information
  -ll     --log-level            [l]evel: string constant
                                 (fatal, error, warn, info, debug, trace)
                                 use level l for the logger
  -lc     --log-config           [f]ilename: string
                                 use config file f for the logger
input options:
  input file format:
    +f    --read-file            read file format or data set (default)
    +fo   --read-file-only       read file format only
    -f    --read-dataset         read data set without file meta information
  input transfer syntax:
    -t=   --read-xfer-auto       use TS recognition (default)
    -td   --read-xfer-detect     ignore TS specified in the file meta header
    -te   --read-xfer-little     read with explicit VR little endian TS
    -tb   --read-xfer-big        read with explicit VR big endian TS
    -ti   --read-xfer-implicit   read with implicit VR little endian TS
  handling of defined length UN elements:
    -uc   --retain-un            retain elements as UN (default)
    +uc   --convert-un           convert to real VR if known
signature commands:
          --verify               verify all signatures (default)
  +s      --sign                 [p]rivate key file, [c]ertificate file: string
                                 create signature in main object
  +si     --sign-item            [k]eyfile, [c]ertfile, [i]tem location: string
                                 create signature in sequence item
  +t      --insert-timestamp     ts[q]file, ts[r]file [u]idfile: string
                                 insert certified timestamp from ts response r
                                 from timestamp query q at signature UID u
  +r      --remove               [s]ignature UID: string
                                 remove signature
  +ra     --remove-all           remove all signatures from data set
general signature options:
  key and certificate file format:
    -pem  --pem-keys             read keys/certificates as PEM file (default)
    -der  --der-keys             read keys/certificates as DER file
  signature format:
    -fn   --format-new           use correct DICOM signature format (default)
    -fo   --format-old           use old (pre-3.5.4) DCMTK signature format
signature verification options (only with --verify):
  signature verification:
    +rv   --verify-if-present    verify signatures if present, pass otherwise
                                 (default)
    +rg   --require-sig          fail if no signature at all is present
    +rc   --require-creator      fail if no creator RSA signature is present
    +ru   --require-auth         fail if no auth RSA signature is present
    +rs   --require-sr           fail if no SR RSA signature is present
  timestamp verification:
    +tv   --verify-ts            verify certified timestamp if present (default)
    -tv   --ignore-ts            ignore certified timestamps
    +tr   --require-ts           fail if no certified timestamp is present
  certification authority:
    +cf   --add-cert-file        [f]ilename: string
                                 add trusted certificate file to cert store
    +uf   --add-ucert-file       [f]ilename: string
                                 add untrusted intermediate certificate file
    +cd   --add-cert-dir         [d]irectory: string
                                 add certificates in d to cert store
    +cr   --add-crl-file         [f]ilename: string
                                 add certificate revocation list file
                                 (implies --enable-crl-vfy)
    +cl   --enable-crl-vfy       enable CRL verification
signature creation options (only with --sign or --sign-item):
  private key password:
    +ps   --std-passwd           prompt user to type password on stdin (default)
    +pw   --use-passwd           [p]assword: string
                                 use specified password
    -pw   --null-passwd          use empty string as password
  digital signature profile:
    -pf   --profile-none         don't enforce any signature profile (default)
    +pb   --profile-base         enforce base RSA signature profile
    +pc   --profile-creator      enforce creator RSA signature profile
    +pa   --profile-auth         enforce authorization signature profile
    +pr   --profile-sr           enforce SR RSA signature profile
    +pv   --profile-srv          enforce SR RSA signature profile (verification)
  MAC algorithm:
    +mr   --mac-ripemd160        use RIPEMD 160 (default)
    +ms   --mac-sha1             use SHA-1 (not recommended)
    +mm   --mac-md5              use MD5 (not recommended)
    +m2   --mac-sha256           use SHA-256
    +m3   --mac-sha384           use SHA-384
    +m5   --mac-sha512           use SHA-512
  signature purpose:
    +lp   --list-purposes        show list of signature purpose codes and exit
    -sp   --no-sig-purpose       do not add signature purpose (default)
    +sp   --sig-purpose          [p]urpose code: integer (1..18)
                                 add digital signature purpose code p
  tag selection:
    -t    --tag                  [t]ag: "gggg,eeee" or dictionary name
                                 sign only specified tag
                                 (this option can be specified multiple times)
    -tf   --tag-file             [f]ilename: string
                                 read list of tags from text file
timestamp creation options (only with --sign or --sign-item):
  timestamp creation:
    -ts   --timestamp-off        do not create timestamp (default)
    +ts   --timestamp-file       [t]sq-filename, [u]id-filename: string
                                 create timestamp query file t and uid file u
  timestamp MAC algorithm (only with --timestamp-file):
    +tm2  --ts-mac-sha256        use SHA-256 (default)
    +tm3  --ts-mac-sha384        use SHA-384
    +tm5  --ts-mac-sha512        use SHA-512
    +tmr  --ts-mac-ripemd160     use RIPEMD 160
    +tms  --ts-mac-sha1          use SHA-1 (not recommended)
    +tmm  --ts-mac-md5           use MD5 (not recommended)
  timestamp query nonce options (only with --timestamp-file):
    +tn   --ts-use-nonce         include random nonce (default)
    -tn   --ts-no-nonce          do not include nonce
  timestamp certificate inclusion options (only with --timestamp-file):
    +tc   --ts-request-cert      request TSA certificate in timestamp (default)
    -tc   --ts-no-cert           do not request TSA certificate in timestamp
  timestamp policy options (only with --timestamp-file):
    -tp   --ts-no-policy         do not specify ts policy (default)
    +tp   --ts-policy            [p]olicy-OID: string
                                 request timestamp policy p
output options:
  output transfer syntax:
    +t=   --write-xfer-same      write with same TS as input (default)
    +te   --write-xfer-little    write with explicit VR little endian TS
    +tb   --write-xfer-big       write with explicit VR big endian TS
    +ti   --write-xfer-implicit  write with implicit VR little endian TS
  length encoding in sequences and items:
    +e    --length-explicit      write with explicit lengths (default)
    -e    --length-undefined     write with undefined lengths
  other output options:
    +d    --dump                 [f]ilename: string
                                 dump byte stream fed into the MAC codec to file
                                 (only with --sign or --sign-item)