XMLSEC1(1) User Commands XMLSEC1(1)

# [NAME](#NAME)

xmlsec1 - sign, verify, encrypt and decrypt XML documents

# [SYNOPSIS](#SYNOPSIS)

**xmlsec** *&lt;command&gt;* \[*&lt;options&gt;*] \[*&lt;files&gt;*]

# [DESCRIPTION](#DESCRIPTION)

xmlsec is a command line tool for signing, verifying, encrypting and decrypting XML documents. The allowed &lt;command&gt; values are:

[**--help**](#help)

display this help information and exit

[**--help-all**](#help~2)

display help information for all commands/options and exit

[**--help-**&lt;cmd&gt;](#help~3)

display help information for command &lt;cmd&gt; and exit

[**--version**](#version)

print version information and exit

[**--keys**](#keys)

keys XML file manipulation

[**--sign**](#sign)

sign data and output XML document

[**--verify**](#verify)

verify signed document

[**--encrypt**](#encrypt)

encrypt data and output XML document

[**--decrypt**](#decrypt)

decrypt data from XML document

# [OPTIONS](#OPTIONS)

**--ignore-manifests**

do not process &lt;dsig:Manifest&gt; elements

**--store-references**

store and print the result of &lt;dsig:Reference/&gt; element processing just before calculating digest

**--store-signatures**

store and print the result of &lt;dsig:Signature&gt; processing just before calculating signature

**--enabled-reference-uris** &lt;list&gt;

comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the &lt;dsig:Reference&gt; element

**--enable-visa3d-hack**

enables Visa3D protocol specific hack for URI attributes processing when we are trying not to use XPath/XPointer engine; this is a hack and I don't know what else might be broken in your application when you use it (also check "--id-attr" option because you might need it)

**--enable-asn1-signatures-hack**

enables support for ASN1 signature values generated by some XMLDsig implementations.

**--hmac-min-out-len** &lt;bits&gt;

sets minimum HMAC output length to &lt;bits&gt;

**--binary-data** &lt;file&gt;

binary &lt;file&gt; to encrypt

**--xml-data** &lt;file&gt;

XML &lt;file&gt; to encrypt

**--enabled-cipher-reference-uris** &lt;list&gt;

comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the &lt;enc:CipherReference&gt; element

**--session-key** &lt;keyKlass&gt;-&lt;keySize&gt;

generate new session &lt;keyKlass&gt; key of &lt;keySize&gt; bits size (for example, "--session des-192" generates a new 192 bits DES key for DES3 encryption)

**--output** &lt;filename&gt;

write result document to file &lt;filename&gt;; the &lt;filename&gt; can be a template and include '{inputfile}' which will be repaced with the input filename

**--print-debug**

print debug information to stdout

**--print-xml-debug**

print debug information to stdout in xml format

**--dtd-file** &lt;file&gt;

load the specified file as the DTD

**--node-id** &lt;id&gt;

set the operation start point to the node with given &lt;id&gt;

**--node-name** \[&lt;namespace-uri&gt;:]&lt;name&gt;

set the operation start point to the first node with given &lt;name&gt; and &lt;namespace&gt; URI

**--node-xpath** &lt;expr&gt;

set the operation start point to the first node selected by the specified XPath expression

**--id-attr\[**:&lt;attr-name&gt;] \[&lt;node-namespace-uri&gt;:]&lt;node-name&gt;

adds attributes &lt;attr-name&gt; (default value "id") from all nodes with&lt;node-name&gt; and namespace &lt;node-namespace-uri&gt; to the list of known ID attributes; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option)

**--add-id-attr** &lt;id-attribute-name&gt;

adds attribute &lt;id-attribute-name&gt; to all nodes in the document; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option)

**--enabled-key-data** &lt;list&gt;

comma-separated list of key-data types to enable. Example:

[rsa,key-value,x509](#rsa,key)

-&gt; populates &lt;RSAKeyValue&gt; and keeps &lt;X509Data&gt;

[when &lt;KeyValue/&gt; and &lt;X509Data/&gt; placeholders](#when)

are present in the template.

Use "--list-key-data" to view full list of registered key data klasses. By default, all registered key data are enabled.

**--enabled-retrieval-method-uris** &lt;list&gt;

comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the &lt;dsig:RetrievalMethod&gt; element.

**--enabled-key-info-reference-uris** &lt;list&gt;

comma separated list of of the following values: "empty", "same-doc", "local","remote" to restrict possible URI attribute values for the &lt;dsig11:KeyInfoReference&gt; element.

**--gen-key\[**:&lt;name&gt;] &lt;keyKlass&gt;-&lt;keySize&gt;

generate new &lt;keyKlass&gt; key of &lt;keySize&gt; bits size, set the key name to &lt;name&gt; and add the result to keys manager (for example, "--gen:MyKeyName rsa-1024" generates a new 1024 bits RSA key and sets it's name to "MyKeyName")

**--keys-file** &lt;file&gt;

load keys from XML file

**--privkey-pem\[**:&lt;name&gt;] &lt;file&gt;\[,&lt;cafile&gt;\[,&lt;cafile&gt;\[...]]]

load private key from PEM file and certificates that verify this key

**--privkey-der\[**:&lt;name&gt;] &lt;file&gt;\[,&lt;cafile&gt;\[,&lt;cafile&gt;\[...]]]

load private key from DER file and certificates that verify this key

**--pkcs8-pem\[**:&lt;name&gt;] &lt;file&gt;\[,&lt;cafile&gt;\[,&lt;cafile&gt;\[...]]]

load private key from PKCS8 PEM file and PEM certificates that verify this key

**--pkcs8-der\[**:&lt;name&gt;] &lt;file&gt;\[,&lt;cafile&gt;\[,&lt;cafile&gt;\[...]]]

load private key from PKCS8 DER file and DER certificates that verify this key

**--privkey-openssl-store\[**:&lt;name&gt;] &lt;uri&gt;

load private key and certs through OpenSSL ossl\_store interface (e.g. from HSM)

**--privkey-openssl-engine\[**:&lt;name&gt;] &lt;openssl-engine&gt;;&lt;openssl-key-id&gt;\[,&lt;crtfile&gt;\[,&lt;crtfile&gt;\[...]]]

load private key by OpenSSL ENGINE interface; specify the name of engine (like with **-engine** params), the key specs (like with **-inkey** or **-key** params) and optionally certificates that verify this key

**--pubkey-pem\[**:&lt;name&gt;] &lt;file&gt;

load public key from PEM file

**--pubkey-der\[**:&lt;name&gt;] &lt;file&gt;

load public key from DER file

**--pubkey-openssl-store\[**:&lt;name&gt;] &lt;uri&gt;

load pubkey key and certs through OpenSSL ossl\_store interface (e.g. from HSM)

**--pubkey-openssl-engine\[**:&lt;name&gt;] &lt;openssl-engine&gt;;&lt;openssl-key-id&gt;\[,&lt;crtfile&gt;\[,&lt;crtfile&gt;\[...]]]

load public key by OpenSSL ENGINE interface; specify the name of engine (like with **-engine** params), the key specs (like with **-inkey** or **-key** params) and optionally certificates that verify this key

**--pwd** &lt;password&gt;

the password to use for reading keys and certs

**--lax-key-search**

enable lax key search (e.g. by key type like "rsa") vs default strict key search mode using only information from &lt;dsig:KeyInfo/&gt; node (e.g. key name)

**--verify-keys**

force verification of public/private keys loaded from the command: keys are required to have a key certificate that will be verified against the certificates in the key store

**--aes-key\[**:&lt;name&gt;] &lt;file&gt;

load AES key from binary file &lt;file&gt;

**--camellia-key\[**:&lt;name&gt;] &lt;file&gt;

load Camellia key from binary file &lt;file&gt;

**--chacha20-key\[**:&lt;name&gt;] &lt;file&gt;

load ChaCha20 key from binary file &lt;file&gt;

**--concatkdf-key\[**:&lt;name&gt;] &lt;file&gt;

load ConcatKDF key from binary file &lt;file&gt;

**--des-key\[**:&lt;name&gt;] &lt;file&gt;

load DES key from binary file &lt;file&gt;

**--hmac-key\[**:&lt;name&gt;] &lt;file&gt;

load HMAC key from binary file &lt;file&gt;

**--pbkdf2-key\[**:&lt;name&gt;] &lt;file&gt;

load Pbkdf2 key from binary file &lt;file&gt;

**--hkdf-key\[**:&lt;name&gt;] &lt;file&gt;

load HKDF key (IKM) from binary file &lt;file&gt;

**--pkcs12\[**:&lt;name&gt;] &lt;file&gt;

load load private key from pkcs12 file &lt;file&gt;

**--pkcs12-persist**

persist loaded private key

**--pubkey-cert-pem\[**:&lt;name&gt;] &lt;file&gt;

load public key from PEM cert file

**--pubkey-cert-der\[**:&lt;name&gt;] &lt;file&gt;

load public key from DER cert file

**--trusted-pem** &lt;file&gt;

load trusted (root) certificate from PEM file &lt;file&gt;

**--untrusted-pem** &lt;file&gt;

load untrusted certificate from PEM file &lt;file&gt;

**--trusted-der** &lt;file&gt;

load trusted (root) certificate from DER file &lt;file&gt;

**--untrusted-der** &lt;file&gt;

load untrusted certificate from DER file &lt;file&gt;

**--crl-pem** &lt;file&gt;

load CRLs from PEM file &lt;file&gt;

**--crl-der** &lt;file&gt;

load CRLs from DER file &lt;file&gt;

**--verify-crls**

force verification of loaded CRLs: CRLs are required to have a valid signature from an issuer certificate in the trusted or untrusted certificate store, and must be within their validity period (thisUpdate/nextUpdate)

**--verification-time** &lt;time&gt;

the local time in "YYYY-MM-DD HH:MM:SS" format used certificates verification

**--verification-gmt-time** &lt;time&gt;

the GMT time in "YYYY-MM-DD HH:MM:SS" format used certificates verification

**--X509-skip-time-checks**

skip time checking of X509 certificates and CLRs

**--depth** &lt;number&gt;

maximum certificates chain depth

**--X509-skip-strict-checks**

skip strict checking of X509 data

**--insecure**

do not verify certificates or CRLs

**--crypto** &lt;name&gt;

the name of the crypto engine to use from the following list: openssl, mscrypto, nss, gnutls, gcrypt (if no crypto engine is specified then the default one is used)

**--crypto-config** &lt;path&gt;

path to crypto engine configuration

**--verbose**

print detailed error messages

**--print-crypto-library-errors**

print errors from crypto library (OpenSSL only)

**--repeat** &lt;number&gt;

repeat the operation &lt;number&gt; times

**--base64-line-size** &lt;size&gt;

sets the max line size for base64 encodings to &lt;size&gt;

**--transform-binary-chunk-size** &lt;size&gt;

sets the transforms binary processing chunk size to &lt;size&gt;; increasing chunk size might improve performance at the expense of increased memory usage

**--transform-max-depth** &lt;depth&gt;

sets the max depth for transforms execution to &lt;depth&gt;; set to 0 to disable max depth check

**--xxe**

enable External Entity resolution. WARNING: this may allow the reading of arbitrary files and URLs, controlled by the input XML document. Use with caution!

**--url-map**:&lt;url&gt; &lt;file&gt;

maps a given &lt;url&gt; to the given &lt;file&gt; for loading external resources

**--help**

print help information about the command

# [AUTHOR](#AUTHOR)

Written by Aleksey Sanin &lt;aleksey@aleksey.com&gt;.

# [REPORTING BUGS](#REPORTING_BUGS)

Report bugs to http://www.aleksey.com/xmlsec/bugs.html

# [COPYRIGHT](#COPYRIGHT)

Copyright © 2002-2026 Aleksey Sanin &lt;aleksey@aleksey.com&gt;. All Rights Reserved.  
This is free software: see the source for copying information.

October 2026 xmlsec1 1.3.12 (openssl)

---

Document: xmlsec1(1) from xmlsec 1.3.12-r5 (Chainguard OS)
Source: https://github.com/lsh123/xmlsec