IPSEC_OPENAC(8)IPSEC_OPENAC(8)NAME
ipsec openac - Generation of X.509 attribute certificates
SYNOPSIS
ipsec openac [ --help ] [ --version ] [ --optionsfrom filename ]
[ --quiet ] [ --debug level ]
[ --days days ] [ --hours hours ]
[ --startdate YYYYMMDDHHMMSSZ ] [ --stopdate YYYYMMDDHHMMSSZ ]
--cert certfile --key keyfile [ --password password ]
--usercert certfile --groups attr1,attr2,... --out filename
DESCRIPTIONopenac is intended to be used by an Authorization Authority (AA) to
generate and sign X.509 attribute certificates. Currently only the
inclusion of one ore several group attributes is supported. An
attribute certificate is linked to a holder by including the issuer and
serial number of the holder's X.509 certificate.
OPTIONS--help display the usage message.
--version
display the version of openac.
--optionsfrom filename
adds the contents of the file to the argument list. If filename
is a relative path then the file is searched in the directory
/etc/openac.
--quiet
By default openac logs all control output both to syslog and
stderr. With the --quiet option no output is written to stderr.
--days days
Validity of the X.509 attribute certificate in days. If neiter
the --days nor the --hours option is specified then a default
validity interval of 1 day is assumed. The --days option can be
combined with the --hours option.
--hours hours
Validity of the X.509 attribute certificate in hours. If neiter
the --hours nor the --days option is specified then a default
validity interval of 24 hours is assumed. The --hours option
can be combined with the --days option.
--startdate YYYYMMDDHHMMSSZ
defines the notBefore date when the X.509 attribute certificate
becomes valid. The date YYYYMMDDHHMMSS must be specified in UTC
(Zulu time). If the --startdate option is not specified then
the current date is taken as a default.
--stopdate YYYYMMDDHHMMSSZ
defines the notAfter date when the X.509 attribute certificate
will expire. The date YYYYMMDDHHMMSS must be specified in UTC
(Zulu time). If the --stopdate option is not specified then the
default notAfter value is computed by adding the validity inter‐
val specified by the --days and/or --days options to the notBe‐
fore date.
--cert certfile
specifies the file containing the X.509 certificate of the
Authorization Authority. The certificate is stored either in
PEM or DER format.
--key keyfile
specifies the encrypted file containing the private RSA key of
the Authoritzation Authority. The private key is stored in
PKCS#1 format.
--password password
specifies the password with which the private RSA keyfile
defined by the --key option has been protected. If the option is
missing then the password is prompted for on the command line.
--usercert certfile
specifies file containing the X.509 certificate of the user to
which the generated attribute certificate will apply. The cer‐
tificate file is stored either in PEM or DER format.
--groups attr1,attr2
specifies a comma-separated list of group attributes that will
go into the X.509 attribute certificate.
--out filename
specifies the file where the generated X.509 attribute certifi‐
cate will be stored to.
Debugging
openac produces a prodigious amount of debugging information. To do
so, it must be compiled with -DDEBUG. There are several classes of
debugging output, and openac may be directed to produce a selection of
them. All lines of debugging output are prefixed with ``| '' to dis‐
tinguish them from error messages.
When openac is invoked, it may be given arguments to specify which
classes to output. The current options are:
--debug level
sets the debug level to 0 (none), 1 (normal), 2 (more), 3 (raw),
and 4 (private), the default level being 1.
EXIT STATUS
The execution of openac terminates with one of the following two exit
codes:
0 means that the attribute certificate was successfully generated
and stored.
1 means that something went wrong.
FILES
/etc/openac/serial serial number of latest attribute certificate
SEE ALSO
The X.509 attribute certificates generated with openac can be used to
enforce group policies defined by ipsec.conf(5). Use ipsec_auto(8) to
load and list X.509 attribute certificates.
For more information on X.509 attribute certificates, refer to the fol‐
lowing IETF RFC:
RFC 3281 An Internet Attribute Certificate Profile for Autho‐
rization
HISTORY
The openac program was originally written by Ariane Seiler and Ueli
Galizzi. The software was recoded by Andreas Steffen using
strongSwan's X.509 library and the ASN.1 code synthesis functions writ‐
ten by Christoph Gysin and Christoph Zwahlen. All authors were with
the Zurich University of Applied Sciences in Winterthur, Switzerland.
BUGS
Bugs should be reported to the <users@lists.strongswan.org> mailing
list.
22 September 2007 IPSEC_OPENAC(8)
