--help | print help information about the command | help + man |
--help-all | display help information for all commands/options and exit | help |
--help- cmd | display help information for command <cmd> and exit | help |
--version | print version information and exit | help |
--keys | keys XML file manipulation | help |
--sign | sign data and output XML document | help |
--verify | verify signed document | help |
--encrypt | encrypt data and output XML document | help |
--decrypt | decrypt data from XML document | help |
--ignore-manifests | do not process <dsig:Manifest> elements (in the manual page but not in --help) | man |
--store-references | store and print the result of <dsig:Reference/> element processing just before calculating digest (in the manual page but not in --help) | man |
--store-signatures | store and print the result of <dsig:Signature> processing just before calculating signature (in the manual page but not in --help) | man |
--enabled-reference-uris list | comma separated list of the following values: "empty", "same-doc", "local", "remote" to restrict possible URI attribute values for the <dsig:Reference> element (in the manual page but not in --help) | man |
--enable-visa3d-hack | enables Visa3D protocol specific hack for URI attributes processing when we are trying not to use XPath/XPointer engine; (in the manual page but not in --help) | man |
--enable-asn1-signatures-hack | enables support for ASN1 signature values generated by some XMLDsig implementations. (in the manual page but not in --help) | man |
--relationship-legacy | use the legacy Relationship transform behaviour: keep foreign namespace declarations (written as a single unprefixed xmlns="...") and do not remove text/comment nodes. (in the manual page but not in --help) | man |
--hmac-min-out-len bits | sets minimum HMAC output length to <bits> (in the manual page but not in --help) | man |
--binary-data file | binary <file> to encrypt (in the manual page but not in --help) | man |
--xml-data file | XML <file> to encrypt (in the manual page but not in --help) | man |
--enabled-cipher-reference-uris list | comma separated list of the following values: "empty", "same-doc", "local", "remote" to restrict possible URI attribute values for the <enc:CipherReference> element (in the manual page but not in --help) | man |
--session-key keyKlass>-<keySize | generate new session <keyKlass> key of <keySize> bits size (for example, "--session des-192" generates a new 192 bits DES key for DES3 encryption) (in the manual page but not in --help) | man |
--output filename | write result document to file <filename>; (in the manual page but not in --help) | man |
--print-debug | print debug information to stdout (in the manual page but not in --help) | man |
--print-xml-debug | print debug information to stdout in xml format (in the manual page but not in --help) | man |
--dtd-file file | load the specified file as the DTD (in the manual page but not in --help) | man |
--node-id id | set the operation start point to the node with given <id> (in the manual page but not in --help) | man |
--node-name namespace-uri>:]<name | set the operation start point to the first node with given <name> and <namespace> URI (in the manual page but not in --help) | man |
--node-xpath expr | set the operation start point to the first node selected by the specified XPath expression (in the manual page but not in --help) | man |
--id-attr :<attr-name | adds attributes <attr-name> (default value "id") from all nodes with <node-name> and namespace <node-namespace-uri> to the list of known ID attributes; (in the manual page but not in --help) | man |
--add-id-attr id-attribute-name | adds attribute <id-attribute-name> to all nodes in the document; (in the manual page but not in --help) | man |
--max-encrypted-key-level level | sets the max depth level when processing encrypted keys, key agreements, etc. (in the manual page but not in --help) | man |
--enabled-key-data list | comma-separated list of key-data types to enable. (in the manual page but not in --help) | man |
--enabled-retrieval-method-uris list | comma separated list of the following values: "empty", "same-doc", "local", "remote" to restrict possible URI attribute values for the <dsig:RetrievalMethod> element. (in the manual page but not in --help) | man |
--enabled-key-info-reference-uris list | comma separated list of the following values: "empty", "same-doc", "local", "remote" to restrict possible URI attribute values for the <dsig11:KeyInfoReference> element. (in the manual page but not in --help) | man |
--gen-key :<name | generate new <keyKlass> key of <keySize> bits size, set the key name to <name> and add the result to keys manager (for example, "--gen:MyKeyName rsa-1024" generates a new 1024 bits RSA key and sets… (in the manual page but not in --help) | man |
--keys-file file | load keys from XML file (in the manual page but not in --help) | man |
--privkey-pem :<name | load private key from PEM file and certificates that verify this key (in the manual page but not in --help) | man |
--privkey-der :<name | load private key from DER file and certificates that verify this key (in the manual page but not in --help) | man |
--pkcs8-pem :<name | load private key from PKCS8 PEM file and PEM certificates that verify this key (in the manual page but not in --help) | man |
--pkcs8-der :<name | load private key from PKCS8 DER file and DER certificates that verify this key (in the manual page but not in --help) | man |
--privkey-openssl-store :<name | load private key and certs through OpenSSL ossl_store interface (e.g. from HSM) (in the manual page but not in --help) | man |
--privkey-openssl-engine :<name | load private key by OpenSSL ENGINE interface; (in the manual page but not in --help) | man |
--pubkey-pem :<name | load public key from PEM file (in the manual page but not in --help) | man |
--pubkey-der :<name | load public key from DER file (in the manual page but not in --help) | man |
--pubkey-openssl-store :<name | load public key and certs through OpenSSL ossl_store interface (e.g. from HSM) (in the manual page but not in --help) | man |
--pubkey-openssl-engine :<name | load public key by OpenSSL ENGINE interface; (in the manual page but not in --help) | man |
--pwd password | the password to use for reading keys and certs (in the manual page but not in --help) | man |
--lax-key-search | enable lax key search (e.g. by key type like "rsa") vs default strict key search mode using only information from <dsig:KeyInfo/> node (e.g. key name) (in the manual page but not in --help) | man |
--verify-keys | force verification of public/private keys loaded from the command: keys are required to have a key certificate that will be verified against the certificates in the key store (in the manual page but not in --help) | man |
--aes-key :<name | load AES key from binary file <file> (in the manual page but not in --help) | man |
--camellia-key :<name | load Camellia key from binary file <file> (in the manual page but not in --help) | man |
--chacha20-key :<name | load ChaCha20 key from binary file <file> (in the manual page but not in --help) | man |
--concatkdf-key :<name | load ConcatKDF key from binary file <file> (in the manual page but not in --help) | man |
--des-key :<name | load DES key from binary file <file> (in the manual page but not in --help) | man |
--hmac-key :<name | load HMAC key from binary file <file> (in the manual page but not in --help) | man |
--pbkdf2-key :<name | load Pbkdf2 key from binary file <file> (in the manual page but not in --help) | man |
--hkdf-key :<name | load HKDF key (IKM) from binary file <file> (in the manual page but not in --help) | man |
--pkcs12 :<name | load private key from pkcs12 file <file> (in the manual page but not in --help) | man |
--pkcs12-persist | persist loaded private key (in the manual page but not in --help) | man |
--pubkey-cert-pem :<name | load public key from PEM cert file (in the manual page but not in --help) | man |
--pubkey-cert-der :<name | load public key from DER cert file (in the manual page but not in --help) | man |
--trusted-pem file | load trusted (root) certificate from PEM file <file> (in the manual page but not in --help) | man |
--untrusted-pem file | load untrusted certificate from PEM file <file> (in the manual page but not in --help) | man |
--trusted-der file | load trusted (root) certificate from DER file <file> (in the manual page but not in --help) | man |
--untrusted-der file | load untrusted certificate from DER file <file> (in the manual page but not in --help) | man |
--crl-pem file | load CRLs from PEM file <file> (in the manual page but not in --help) | man |
--crl-der file | load CRLs from DER file <file> (in the manual page but not in --help) | man |
--verify-crls | force verification of loaded CRLs: CRLs are required to have a valid signature from an issuer certificate in the trusted or untrusted certificate store, and must be within their validity period… (in the manual page but not in --help) | man |
--verification-time time | the local time in "YYYY-MM-DD HH:MM:SS" format used for certificates verification (in the manual page but not in --help) | man |
--verification-gmt-time time | the GMT time in "YYYY-MM-DD HH:MM:SS" format used for certificates verification (in the manual page but not in --help) | man |
--X509-skip-time-checks | skip time checking of X509 certificates and CRLs (in the manual page but not in --help) | man |
--depth number | maximum certificates chain depth (in the manual page but not in --help) | man |
--X509-skip-strict-checks | skip strict checking of X509 data (in the manual page but not in --help) | man |
--insecure | do not verify certificates or CRLs (in the manual page but not in --help) | man |
--crypto name | the name of the crypto engine to use from the following list: openssl, mscrypto, nss, gnutls, gcrypt (if no crypto engine is specified then the default one is used) (in the manual page but not in --help) | man |
--crypto-config path | crypto engine configuration: (in the manual page but not in --help) | man |
--verbose | print detailed error messages (in the manual page but not in --help) | man |
--print-crypto-library-errors | print errors from crypto library (OpenSSL only) (in the manual page but not in --help) | man |
--repeat number | repeat the operation <number> times (in the manual page but not in --help) | man |
--base64-line-size size | sets the max line size for base64 encodings to <size>; (in the manual page but not in --help) | man |
--transform-binary-chunk-size size | sets the transforms binary processing chunk size to <size>; (in the manual page but not in --help) | man |
--transform-max-depth depth | sets the max depth for transforms execution to <depth>; (in the manual page but not in --help) | man |
--xxe | enable External Entity resolution. (in the manual page but not in --help) | man |
--url-map url | maps a given <url> to the given <file> for loading external resources (in the manual page but not in --help) | man |