1X509(1) OpenSSL X509(1)
2
6 openssl-x509, x509 - Certificate display and signing utility
7
9 openssl x509 [-help] [-inform DER|PEM] [-outform DER|PEM] [-keyform
10 DER|PEM|ENGINE] [-CAform DER|PEM] [-CAkeyform DER|PEM] [-in filename]
11 [-out filename] [-serial] [-hash] [-subject_hash] [-issuer_hash]
12 [-ocspid] [-subject] [-issuer] [-nameopt option] [-email] [-ocsp_uri]
13 [-startdate] [-enddate] [-purpose] [-dates] [-checkend num] [-modulus]
14 [-pubkey] [-fingerprint] [-alias] [-noout] [-trustout] [-clrtrust]
15 [-clrreject] [-addtrust arg] [-addreject arg] [-setalias arg] [-days
16 arg] [-set_serial n] [-signkey arg] [-passin arg] [-x509toreq] [-req]
17 [-CA filename] [-CAkey filename] [-CAcreateserial] [-CAserial filename]
18 [-force_pubkey key] [-text] [-ext extensions] [-certopt option] [-C]
19 [-digest] [-clrext] [-extfile filename] [-extensions section] [-sigopt
20 nm:v] [-rand file...] [-writerand file] [-engine id] [-preserve_dates]
21
23 The x509 command is a multi purpose certificate utility. It can be used
24 to display certificate information, convert certificates to various
25 forms, sign certificate requests like a "mini CA" or edit certificate
26 trust settings.
27 Since there are a large number of options they will split up into
29 various sections.
30
32 Input, Output, and General Purpose Options
33 -help
34 Print out a usage message.
35 -inform DER|PEM
37 This specifies the input format normally the command will expect an
38 X509 certificate but this can change if other options such as -req
39 are present. The DER format is the DER encoding of the certificate
40 and PEM is the base64 encoding of the DER encoding with header and
41 footer lines added. The default format is PEM.
42 -outform DER|PEM
44 This specifies the output format, the options have the same meaning
45 and default as the -inform option.
46 -in filename
48 This specifies the input filename to read a certificate from or
49 standard input if this option is not specified.
50 -out filename
52 This specifies the output filename to write to or standard output
53 by default.
54 -digest
56 The digest to use. This affects any signing or display option that
57 uses a message digest, such as the -fingerprint, -signkey and -CA
58 options. Any digest supported by the OpenSSL dgst command can be
59 used. If not specified then SHA1 is used with -fingerprint or the
60 default digest for the signing algorithm is used, typically SHA256.
61 -rand file...
63 A file or files containing random data used to seed the random
64 number generator. Multiple files can be specified separated by an
65 OS-dependent character. The separator is ; for MS-Windows, , for
66 OpenVMS, and : for all others.
67 [-writerand file]
69 Writes random data to the specified file upon exit. This can be
70 used with a subsequent -rand flag.
71 -engine id
73 Specifying an engine (by its unique id string) will cause x509 to
74 attempt to obtain a functional reference to the specified engine,
75 thus initialising it if needed. The engine will then be set as the
76 default for all available algorithms.
77 -preserve_dates
79 When signing a certificate, preserve the "notBefore" and "notAfter"
80 dates instead of adjusting them to current time and duration.
81 Cannot be used with the -days option.
82 Display Options
84 Note: the -alias and -purpose options are also display options but are
85 described in the TRUST SETTINGS section.
86 -text
88 Prints out the certificate in text form. Full details are output
89 including the public key, signature algorithms, issuer and subject
90 names, serial number any extensions present and any trust settings.
91 -ext extensions
93 Prints out the certificate extensions in text form. Extensions are
94 specified with a comma separated string, e.g.,
95 "subjectAltName,subjectKeyIdentifier". See the x509v3_config(5)
96 manual page for the extension names.
97 -certopt option
99 Customise the output format used with -text. The option argument
100 can be a single option or multiple options separated by commas. The
101 -certopt switch may be also be used more than once to set multiple
102 options. See the TEXT OPTIONS section for more information.
103 -noout
105 This option prevents output of the encoded version of the
106 certificate.
107 -pubkey
109 Outputs the certificate's SubjectPublicKeyInfo block in PEM format.
110 -modulus
112 This option prints out the value of the modulus of the public key
113 contained in the certificate.
114 -serial
116 Outputs the certificate serial number.
117 -subject_hash
119 Outputs the "hash" of the certificate subject name. This is used in
120 OpenSSL to form an index to allow certificates in a directory to be
121 looked up by subject name.
122 -issuer_hash
124 Outputs the "hash" of the certificate issuer name.
125 -ocspid
127 Outputs the OCSP hash values for the subject name and public key.
128 -hash
130 Synonym for "-subject_hash" for backward compatibility reasons.
131 -subject_hash_old
133 Outputs the "hash" of the certificate subject name using the older
134 algorithm as used by OpenSSL before version 1.0.0.
135 -issuer_hash_old
137 Outputs the "hash" of the certificate issuer name using the older
138 algorithm as used by OpenSSL before version 1.0.0.
139 -subject
141 Outputs the subject name.
142 -issuer
144 Outputs the issuer name.
145 -nameopt option
147 Option which determines how the subject or issuer names are
148 displayed. The option argument can be a single option or multiple
149 options separated by commas. Alternatively the -nameopt switch may
150 be used more than once to set multiple options. See the NAME
151 OPTIONS section for more information.
152 -email
154 Outputs the email address(es) if any.
155 -ocsp_uri
157 Outputs the OCSP responder address(es) if any.
158 -startdate
160 Prints out the start date of the certificate, that is the notBefore
161 date.
162 -enddate
164 Prints out the expiry date of the certificate, that is the notAfter
165 date.
166 -dates
168 Prints out the start and expiry dates of a certificate.
169 -checkend arg
171 Checks if the certificate expires within the next arg seconds and
172 exits nonzero if yes it will expire or zero if not.
173 -fingerprint
175 Calculates and outputs the digest of the DER encoded version of the
176 entire certificate (see digest options). This is commonly called a
177 "fingerprint". Because of the nature of message digests, the
178 fingerprint of a certificate is unique to that certificate and two
179 certificates with the same fingerprint can be considered to be the
180 same.
181 -C This outputs the certificate in the form of a C source file.
183 Trust Settings
185 A trusted certificate is an ordinary certificate which has several
186 additional pieces of information attached to it such as the permitted
187 and prohibited uses of the certificate and an "alias".
188 Normally when a certificate is being verified at least one certificate
190 must be "trusted". By default a trusted certificate must be stored
191 locally and must be a root CA: any certificate chain ending in this CA
192 is then usable for any purpose.
193 Trust settings currently are only used with a root CA. They allow a
195 finer control over the purposes the root CA can be used for. For
196 example a CA may be trusted for SSL client but not SSL server use.
197 See the description of the verify utility for more information on the
199 meaning of trust settings.
200 Future versions of OpenSSL will recognize trust settings on any
202 certificate: not just root CAs.
203 -trustout
205 This causes x509 to output a trusted certificate. An ordinary or
206 trusted certificate can be input but by default an ordinary
207 certificate is output and any trust settings are discarded. With
208 the -trustout option a trusted certificate is output. A trusted
209 certificate is automatically output if any trust settings are
210 modified.
211 -setalias arg
213 Sets the alias of the certificate. This will allow the certificate
214 to be referred to using a nickname for example "Steve's
215 Certificate".
216 -alias
218 Outputs the certificate alias, if any.
219 -clrtrust
221 Clears all the permitted or trusted uses of the certificate.
222 -clrreject
224 Clears all the prohibited or rejected uses of the certificate.
225 -addtrust arg
227 Adds a trusted certificate use. Any object name can be used here
228 but currently only clientAuth (SSL client use), serverAuth (SSL
229 server use), emailProtection (S/MIME email) and anyExtendedKeyUsage
230 are used. As of OpenSSL 1.1.0, the last of these blocks all
231 purposes when rejected or enables all purposes when trusted. Other
232 OpenSSL applications may define additional uses.
233 -addreject arg
235 Adds a prohibited use. It accepts the same values as the -addtrust
236 option.
237 -purpose
239 This option performs tests on the certificate extensions and
240 outputs the results. For a more complete description see the
241 CERTIFICATE EXTENSIONS section.
242 Signing Options
244 The x509 utility can be used to sign certificates and requests: it can
245 thus behave like a "mini CA".
246 -signkey arg
248 This option causes the input file to be self signed using the
249 supplied private key or engine. The private key's format is
250 specified with the -keyform option.
251 If the input file is a certificate it sets the issuer name to the
253 subject name (i.e. makes it self signed) changes the public key to
254 the supplied value and changes the start and end dates. The start
255 date is set to the current time and the end date is set to a value
256 determined by the -days option. Any certificate extensions are
257 retained unless the -clrext option is supplied; this includes, for
258 example, any existing key identifier extensions.
259 If the input is a certificate request then a self signed
261 certificate is created using the supplied private key using the
262 subject name in the request.
263 -sigopt nm:v
265 Pass options to the signature algorithm during sign or verify
266 operations. Names and values of these options are algorithm-
267 specific.
268 -passin arg
270 The key password source. For more information about the format of
271 arg see "Pass Phrase Options" in openssl(1).
272 -clrext
274 Delete any extensions from a certificate. This option is used when
275 a certificate is being created from another certificate (for
276 example with the -signkey or the -CA options). Normally all
277 extensions are retained.
278 -keyform PEM|DER|ENGINE
280 Specifies the format (DER or PEM) of the private key file used in
281 the -signkey option.
282 -days arg
284 Specifies the number of days to make a certificate valid for. The
285 default is 30 days. Cannot be used with the -preserve_dates option.
286 -x509toreq
288 Converts a certificate into a certificate request. The -signkey
289 option is used to pass the required private key.
290 -req
292 By default a certificate is expected on input. With this option a
293 certificate request is expected instead.
294 -set_serial n
296 Specifies the serial number to use. This option can be used with
297 either the -signkey or -CA options. If used in conjunction with the
298 -CA option the serial number file (as specified by the -CAserial or
299 -CAcreateserial options) is not used.
300 The serial number can be decimal or hex (if preceded by 0x).
302 -CA filename
304 Specifies the CA certificate to be used for signing. When this
305 option is present x509 behaves like a "mini CA". The input file is
306 signed by this CA using this option: that is its issuer name is set
307 to the subject name of the CA and it is digitally signed using the
308 CAs private key.
309 This option is normally combined with the -req option. Without the
311 -req option the input is a certificate which must be self signed.
312 -CAkey filename
314 Sets the CA private key to sign a certificate with. If this option
315 is not specified then it is assumed that the CA private key is
316 present in the CA certificate file.
317 -CAserial filename
319 Sets the CA serial number file to use.
320 When the -CA option is used to sign a certificate it uses a serial
322 number specified in a file. This file consists of one line
323 containing an even number of hex digits with the serial number to
324 use. After each use the serial number is incremented and written
325 out to the file again.
326 The default filename consists of the CA certificate file base name
328 with ".srl" appended. For example if the CA certificate file is
329 called "mycacert.pem" it expects to find a serial number file
330 called "mycacert.srl".
331 -CAcreateserial
333 With this option the CA serial number file is created if it does
334 not exist: it will contain the serial number "02" and the
335 certificate being signed will have the 1 as its serial number. If
336 the -CA option is specified and the serial number file does not
337 exist a random number is generated; this is the recommended
338 practice.
339 -extfile filename
341 File containing certificate extensions to use. If not specified
342 then no extensions are added to the certificate.
343 -extensions section
345 The section to add certificate extensions from. If this option is
346 not specified then the extensions should either be contained in the
347 unnamed (default) section or the default section should contain a
348 variable called "extensions" which contains the section to use. See
349 the x509v3_config(5) manual page for details of the extension
350 section format.
351 -force_pubkey key
353 When a certificate is created set its public key to key instead of
354 the key in the certificate or certificate request. This option is
355 useful for creating certificates where the algorithm can't normally
356 sign requests, for example DH.
357 The format or key can be specified using the -keyform option.
359 Name Options
361 The nameopt command line switch determines how the subject and issuer
362 names are displayed. If no nameopt switch is present the default
363 "oneline" format is used which is compatible with previous versions of
364 OpenSSL. Each option is described in detail below, all options can be
365 preceded by a - to turn the option off. Only the first four will
366 normally be used.
367 compat
369 Use the old format.
370 RFC2253
372 Displays names compatible with RFC2253 equivalent to esc_2253,
373 esc_ctrl, esc_msb, utf8, dump_nostr, dump_unknown, dump_der,
374 sep_comma_plus, dn_rev and sname.
375 oneline
377 A oneline format which is more readable than RFC2253. It is
378 equivalent to specifying the esc_2253, esc_ctrl, esc_msb, utf8,
379 dump_nostr, dump_der, use_quote, sep_comma_plus_space, space_eq and
380 sname options. This is the default of no name options are given
381 explicitly.
382 multiline
384 A multiline format. It is equivalent esc_ctrl, esc_msb,
385 sep_multiline, space_eq, lname and align.
386 esc_2253
388 Escape the "special" characters required by RFC2253 in a field.
389 That is ,+"<>;. Additionally # is escaped at the beginning of a
390 string and a space character at the beginning or end of a string.
391 esc_2254
393 Escape the "special" characters required by RFC2254 in a field.
394 That is the NUL character as well as and ()*.
395 esc_ctrl
397 Escape control characters. That is those with ASCII values less
398 than 0x20 (space) and the delete (0x7f) character. They are escaped
399 using the RFC2253 \XX notation (where XX are two hex digits
400 representing the character value).
401 esc_msb
403 Escape characters with the MSB set, that is with ASCII values
404 larger than 127.
405 use_quote
407 Escapes some characters by surrounding the whole string with "
408 characters, without the option all escaping is done with the \
409 character.
410 utf8
412 Convert all strings to UTF8 format first. This is required by
413 RFC2253. If you are lucky enough to have a UTF8 compatible terminal
414 then the use of this option (and not setting esc_msb) may result in
415 the correct display of multibyte (international) characters. Is
416 this option is not present then multibyte characters larger than
417 0xff will be represented using the format \UXXXX for 16 bits and
418 \WXXXXXXXX for 32 bits. Also if this option is off any UTF8Strings
419 will be converted to their character form first.
420 ignore_type
422 This option does not attempt to interpret multibyte characters in
423 any way. That is their content octets are merely dumped as though
424 one octet represents each character. This is useful for diagnostic
425 purposes but will result in rather odd looking output.
426 show_type
428 Show the type of the ASN1 character string. The type precedes the
429 field contents. For example "BMPSTRING: Hello World".
430 dump_der
432 When this option is set any fields that need to be hexdumped will
433 be dumped using the DER encoding of the field. Otherwise just the
434 content octets will be displayed. Both options use the RFC2253
435 #XXXX... format.
436 dump_nostr
438 Dump non character string types (for example OCTET STRING) if this
439 option is not set then non character string types will be displayed
440 as though each content octet represents a single character.
441 dump_all
443 Dump all fields. This option when used with dump_der allows the DER
444 encoding of the structure to be unambiguously determined.
445 dump_unknown
447 Dump any field whose OID is not recognised by OpenSSL.
448 sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space,
450 sep_multiline
451 These options determine the field separators. The first character
452 is between RDNs and the second between multiple AVAs (multiple AVAs
453 are very rare and their use is discouraged). The options ending in
454 "space" additionally place a space after the separator to make it
455 more readable. The sep_multiline uses a linefeed character for the
456 RDN separator and a spaced + for the AVA separator. It also indents
457 the fields by four characters. If no field separator is specified
458 then sep_comma_plus_space is used by default.
459 dn_rev
461 Reverse the fields of the DN. This is required by RFC2253. As a
462 side effect this also reverses the order of multiple AVAs but this
463 is permissible.
464 nofname, sname, lname, oid
466 These options alter how the field name is displayed. nofname does
467 not display the field at all. sname uses the "short name" form (CN
468 for commonName for example). lname uses the long form. oid
469 represents the OID in numerical form and is useful for diagnostic
470 purpose.
471 align
473 Align field values for a more readable output. Only usable with
474 sep_multiline.
475 space_eq
477 Places spaces round the = character which follows the field name.
478 Text Options
480 As well as customising the name output format, it is also possible to
481 customise the actual fields printed using the certopt options when the
482 text option is present. The default behaviour is to print all fields.
483 compatible
485 Use the old format. This is equivalent to specifying no output
486 options at all.
487 no_header
489 Don't print header information: that is the lines saying
490 "Certificate" and "Data".
491 no_version
493 Don't print out the version number.
494 no_serial
496 Don't print out the serial number.
497 no_signame
499 Don't print out the signature algorithm used.
500 no_validity
502 Don't print the validity, that is the notBefore and notAfter
503 fields.
504 no_subject
506 Don't print out the subject name.
507 no_issuer
509 Don't print out the issuer name.
510 no_pubkey
512 Don't print out the public key.
513 no_sigdump
515 Don't give a hexadecimal dump of the certificate signature.
516 no_aux
518 Don't print out certificate trust information.
519 no_extensions
521 Don't print out any X509V3 extensions.
522 ext_default
524 Retain default extension behaviour: attempt to print out
525 unsupported certificate extensions.
526 ext_error
528 Print an error message for unsupported certificate extensions.
529 ext_parse
531 ASN1 parse unsupported extensions.
532 ext_dump
534 Hex dump unsupported extensions.
535 ca_default
537 The value used by the ca utility, equivalent to no_issuer,
538 no_pubkey, no_header, and no_version.
539
541 Note: in these examples the '\' means the example should be all on one
542 line.
543 Display the contents of a certificate:
545 openssl x509 -in cert.pem -noout -text
547 Display the "Subject Alternative Name" extension of a certificate:
549 openssl x509 -in cert.pem -noout -ext subjectAltName
551 Display more extensions of a certificate:
553 openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType
555 Display the certificate serial number:
557 openssl x509 -in cert.pem -noout -serial
559 Display the certificate subject name:
561 openssl x509 -in cert.pem -noout -subject
563 Display the certificate subject name in RFC2253 form:
565 openssl x509 -in cert.pem -noout -subject -nameopt RFC2253
567 Display the certificate subject name in oneline form on a terminal
569 supporting UTF8:
570 openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb
572 Display the certificate SHA1 fingerprint:
574 openssl x509 -sha1 -in cert.pem -noout -fingerprint
576 Convert a certificate from PEM to DER format:
578 openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
580 Convert a certificate to a certificate request:
582 openssl x509 -x509toreq -in cert.pem -out req.pem -signkey key.pem
584 Convert a certificate request into a self signed certificate using
586 extensions for a CA:
587 openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca \
589 -signkey key.pem -out cacert.pem
590 Sign a certificate request using the CA certificate above and add user
592 certificate extensions:
593 openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr \
595 -CA cacert.pem -CAkey key.pem -CAcreateserial
596 Set a certificate to be trusted for SSL client use and change set its
598 alias to "Steve's Class 1 CA"
599 openssl x509 -in cert.pem -addtrust clientAuth \
601 -setalias "Steve's Class 1 CA" -out trust.pem
602
604 The PEM format uses the header and footer lines:
605 -----BEGIN CERTIFICATE-----
607 -----END CERTIFICATE-----
608 it will also handle files containing:
610 -----BEGIN X509 CERTIFICATE-----
612 -----END X509 CERTIFICATE-----
613 Trusted certificates have the lines
615 -----BEGIN TRUSTED CERTIFICATE-----
617 -----END TRUSTED CERTIFICATE-----
618 The conversion to UTF8 format used with the name options assumes that
620 T61Strings use the ISO8859-1 character set. This is wrong but Netscape
621 and MSIE do this as do many certificates. So although this is incorrect
622 it is more likely to display the majority of certificates correctly.
623 The -email option searches the subject name and the subject alternative
625 name extension. Only unique email addresses will be printed out: it
626 will not print the same address more than once.
627
629 The -purpose option checks the certificate extensions and determines
630 what the certificate can be used for. The actual checks done are rather
631 complex and include various hacks and workarounds to handle broken
632 certificates and software.
633 The same code is used when verifying untrusted certificates in chains
635 so this section is useful if a chain is rejected by the verify code.
636 The basicConstraints extension CA flag is used to determine whether the
638 certificate can be used as a CA. If the CA flag is true then it is a
639 CA, if the CA flag is false then it is not a CA. All CAs should have
640 the CA flag set to true.
641 If the basicConstraints extension is absent then the certificate is
643 considered to be a "possible CA" other extensions are checked according
644 to the intended use of the certificate. A warning is given in this case
645 because the certificate should really not be regarded as a CA: however
646 it is allowed to be a CA to work around some broken software.
647 If the certificate is a V1 certificate (and thus has no extensions) and
649 it is self signed it is also assumed to be a CA but a warning is again
650 given: this is to work around the problem of Verisign roots which are
651 V1 self signed certificates.
652 If the keyUsage extension is present then additional restraints are
654 made on the uses of the certificate. A CA certificate must have the
655 keyCertSign bit set if the keyUsage extension is present.
656 The extended key usage extension places additional restrictions on the
658 certificate uses. If this extension is present (whether critical or
659 not) the key can only be used for the purposes specified.
660 A complete description of each test is given below. The comments about
662 basicConstraints and keyUsage and V1 certificates above apply to all CA
663 certificates.
664 SSL Client
666 The extended key usage extension must be absent or include the "web
667 client authentication" OID. keyUsage must be absent or it must
668 have the digitalSignature bit set. Netscape certificate type must
669 be absent or it must have the SSL client bit set.
670 SSL Client CA
672 The extended key usage extension must be absent or include the "web
673 client authentication" OID. Netscape certificate type must be
674 absent or it must have the SSL CA bit set: this is used as a work
675 around if the basicConstraints extension is absent.
676 SSL Server
678 The extended key usage extension must be absent or include the "web
679 server authentication" and/or one of the SGC OIDs. keyUsage must
680 be absent or it must have the digitalSignature, the keyEncipherment
681 set or both bits set. Netscape certificate type must be absent or
682 have the SSL server bit set.
683 SSL Server CA
685 The extended key usage extension must be absent or include the "web
686 server authentication" and/or one of the SGC OIDs. Netscape
687 certificate type must be absent or the SSL CA bit must be set: this
688 is used as a work around if the basicConstraints extension is
689 absent.
690 Netscape SSL Server
692 For Netscape SSL clients to connect to an SSL server it must have
693 the keyEncipherment bit set if the keyUsage extension is present.
694 This isn't always valid because some cipher suites use the key for
695 digital signing. Otherwise it is the same as a normal SSL server.
696 Common S/MIME Client Tests
698 The extended key usage extension must be absent or include the
699 "email protection" OID. Netscape certificate type must be absent or
700 should have the S/MIME bit set. If the S/MIME bit is not set in
701 Netscape certificate type then the SSL client bit is tolerated as
702 an alternative but a warning is shown: this is because some
703 Verisign certificates don't set the S/MIME bit.
704 S/MIME Signing
706 In addition to the common S/MIME client tests the digitalSignature
707 bit or the nonRepudiation bit must be set if the keyUsage extension
708 is present.
709 S/MIME Encryption
711 In addition to the common S/MIME tests the keyEncipherment bit must
712 be set if the keyUsage extension is present.
713 S/MIME CA
715 The extended key usage extension must be absent or include the
716 "email protection" OID. Netscape certificate type must be absent or
717 must have the S/MIME CA bit set: this is used as a work around if
718 the basicConstraints extension is absent.
719 CRL Signing
721 The keyUsage extension must be absent or it must have the CRL
722 signing bit set.
723 CRL Signing CA
725 The normal CA tests apply. Except in this case the basicConstraints
726 extension must be present.
727
729 Extensions in certificates are not transferred to certificate requests
730 and vice versa.
731 It is possible to produce invalid certificates or requests by
733 specifying the wrong private key or using inconsistent options in some
734 cases: these should be checked.
735 There should be options to explicitly set such things as start and end
737 dates rather than an offset from the current time.
738
740 req(1), ca(1), genrsa(1), gendsa(1), verify(1), x509v3_config(5)
741
743 The hash algorithm used in the -subject_hash and -issuer_hash options
744 before OpenSSL 1.0.0 was based on the deprecated MD5 algorithm and the
745 encoding of the distinguished name. In OpenSSL 1.0.0 and later it is
746 based on a canonical version of the DN using SHA1. This means that any
747 directories using the old form must have their links rebuilt using
748 c_rehash or similar.
749
751 Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
752 Licensed under the OpenSSL license (the "License"). You may not use
754 this file except in compliance with the License. You can obtain a copy
755 in the file LICENSE in the source distribution or at
756 <https://www.openssl.org/source/license.html>.
7571.1.1l 2021-09-15 X509(1)