$dcmtk: dcmsign v3.7.1 2026-10-15 $ dcmsign: Sign and Verify DICOM Files usage: dcmsign [options] dcmfile-in [dcmfile-out] parameters: dcmfile-in DICOM input filename to be processed ("-" for stdin) dcmfile-out DICOM output filename ("-" for stdout) general options: -h --help print this help text and exit --version print version information and exit --arguments print expanded command line arguments -q --quiet quiet mode, print no warnings and errors -v --verbose verbose mode, print processing details -d --debug debug mode, print debug information -ll --log-level [l]evel: string constant (fatal, error, warn, info, debug, trace) use level l for the logger -lc --log-config [f]ilename: string use config file f for the logger input options: input file format: +f --read-file read file format or data set (default) +fo --read-file-only read file format only -f --read-dataset read data set without file meta information input transfer syntax: -t= --read-xfer-auto use TS recognition (default) -td --read-xfer-detect ignore TS specified in the file meta header -te --read-xfer-little read with explicit VR little endian TS -tb --read-xfer-big read with explicit VR big endian TS -ti --read-xfer-implicit read with implicit VR little endian TS handling of defined length UN elements: -uc --retain-un retain elements as UN (default) +uc --convert-un convert to real VR if known signature commands: --verify verify all signatures (default) +s --sign [p]rivate key file, [c]ertificate file: string create signature in main object +si --sign-item [k]eyfile, [c]ertfile, [i]tem location: string create signature in sequence item +t --insert-timestamp ts[q]file, ts[r]file [u]idfile: string insert certified timestamp from ts response r from timestamp query q at signature UID u +r --remove [s]ignature UID: string remove signature +ra --remove-all remove all signatures from data set general signature options: key and certificate file format: -pem --pem-keys read keys/certificates as PEM file (default) -der --der-keys read keys/certificates as DER file signature format: -fn --format-new use correct DICOM signature format (default) -fo --format-old use old (pre-3.5.4) DCMTK signature format signature verification options (only with --verify): signature verification: +rv --verify-if-present verify signatures if present, pass otherwise (default) +rg --require-sig fail if no signature at all is present +rc --require-creator fail if no creator RSA signature is present +ru --require-auth fail if no auth RSA signature is present +rs --require-sr fail if no SR RSA signature is present timestamp verification: +tv --verify-ts verify certified timestamp if present (default) -tv --ignore-ts ignore certified timestamps +tr --require-ts fail if no certified timestamp is present certification authority: +cf --add-cert-file [f]ilename: string add trusted certificate file to cert store +uf --add-ucert-file [f]ilename: string add untrusted intermediate certificate file +cd --add-cert-dir [d]irectory: string add certificates in d to cert store +cr --add-crl-file [f]ilename: string add certificate revocation list file (implies --enable-crl-vfy) +cl --enable-crl-vfy enable CRL verification signature creation options (only with --sign or --sign-item): private key password: +ps --std-passwd prompt user to type password on stdin (default) +pw --use-passwd [p]assword: string use specified password -pw --null-passwd use empty string as password digital signature profile: -pf --profile-none don't enforce any signature profile (default) +pb --profile-base enforce base RSA signature profile +pc --profile-creator enforce creator RSA signature profile +pa --profile-auth enforce authorization signature profile +pr --profile-sr enforce SR RSA signature profile +pv --profile-srv enforce SR RSA signature profile (verification) MAC algorithm: +mr --mac-ripemd160 use RIPEMD 160 (default) +ms --mac-sha1 use SHA-1 (not recommended) +mm --mac-md5 use MD5 (not recommended) +m2 --mac-sha256 use SHA-256 +m3 --mac-sha384 use SHA-384 +m5 --mac-sha512 use SHA-512 signature purpose: +lp --list-purposes show list of signature purpose codes and exit -sp --no-sig-purpose do not add signature purpose (default) +sp --sig-purpose [p]urpose code: integer (1..18) add digital signature purpose code p tag selection: -t --tag [t]ag: "gggg,eeee" or dictionary name sign only specified tag (this option can be specified multiple times) -tf --tag-file [f]ilename: string read list of tags from text file timestamp creation options (only with --sign or --sign-item): timestamp creation: -ts --timestamp-off do not create timestamp (default) +ts --timestamp-file [t]sq-filename, [u]id-filename: string create timestamp query file t and uid file u timestamp MAC algorithm (only with --timestamp-file): +tm2 --ts-mac-sha256 use SHA-256 (default) +tm3 --ts-mac-sha384 use SHA-384 +tm5 --ts-mac-sha512 use SHA-512 +tmr --ts-mac-ripemd160 use RIPEMD 160 +tms --ts-mac-sha1 use SHA-1 (not recommended) +tmm --ts-mac-md5 use MD5 (not recommended) timestamp query nonce options (only with --timestamp-file): +tn --ts-use-nonce include random nonce (default) -tn --ts-no-nonce do not include nonce timestamp certificate inclusion options (only with --timestamp-file): +tc --ts-request-cert request TSA certificate in timestamp (default) -tc --ts-no-cert do not request TSA certificate in timestamp timestamp policy options (only with --timestamp-file): -tp --ts-no-policy do not specify ts policy (default) +tp --ts-policy [p]olicy-OID: string request timestamp policy p output options: output transfer syntax: +t= --write-xfer-same write with same TS as input (default) +te --write-xfer-little write with explicit VR little endian TS +tb --write-xfer-big write with explicit VR big endian TS +ti --write-xfer-implicit write with implicit VR little endian TS length encoding in sequences and items: +e --length-explicit write with explicit lengths (default) -e --length-undefined write with undefined lengths other output options: +d --dump [f]ilename: string dump byte stream fed into the MAC codec to file (only with --sign or --sign-item)