crypto/des/fcrypt_b.c \
	crypto/des/ede_cbcm_enc.c \
	crypto/des/cfb64ede.c \
	crypto/des/ofb64ede.c \
	crypto/des/set_key.c \
	crypto/des/cbc_cksm.c \
	crypto/sm3/sm3.c \
	crypto/sm4/sm4.c \
	crypto/cms/cms_asn1.c \
	crypto/cms/cms_att.c \
	crypto/cms/cms_cd.c \
	crypto/cms/cms_dd.c \
	crypto/cms/cms_enc.c \
	crypto/cms/cms_env.c \
	crypto/cms/cms_err.c \
	crypto/cms/cms_ess.c \
	crypto/cms/cms_io.c \
	crypto/cms/cms_kari.c \
	crypto/cms/cms_lcl.h \
	crypto/cms/cms_lib.c \
	crypto/cms/cms_pwri.c \
	crypto/cms/cms_sd.c \
	crypto/cms/cms_smime.c

LOCAL_C_INCLUDES := $(LOCAL_PATH)/include \
	$(LOCAL_PATH)/include/compat \
	$(LOCAL_PATH)/crypto \
	$(LOCAL_PATH)/crypto/compat \
	$(LOCAL_PATH)/crypto/asn1 \
	$(LOCAL_PATH)/crypto/bn \

LOCAL_SRC_FILES := \
	ssl/bio_ssl.c \
	ssl/bs_ber.c \
	ssl/bs_cbb.c \
	ssl/bs_cbs.c \
	ssl/d1_both.c \
	ssl/d1_clnt.c \

	ssl/d1_lib.c \
	ssl/d1_pkt.c \
	ssl/d1_srtp.c \
	ssl/d1_srvr.c \
	ssl/pqueue.c \
	ssl/s3_cbc.c \
	ssl/s3_lib.c \

	ssl/ssl_srvr.c \
	ssl/ssl_stat.c \
	ssl/ssl_txt.c \
	ssl/ssl_tlsext.c \
	ssl/ssl_transcript.c \
	ssl/ssl_versions.c \
	ssl/ssl_init.c \
	ssl/ssl_kex.c \
	ssl/t1_enc.c \
	ssl/t1_lib.c \
	ssl/tls13_buffer.c \
	ssl/tls13_client.c \
	ssl/tls13_handshake.c \
	ssl/tls13_handshake_msg.c \
	ssl/tls13_key_schedule.c \
	ssl/tls13_lib.c \
	ssl/tls13_record.c \
	ssl/tls13_record_layer.c \
	ssl/tls13_error.c \
	ssl/tls13_key_share.c \
	ssl/tls13_legacy.c \
	ssl/tls13_server.c

LOCAL_C_INCLUDES := $(LOCAL_PATH)/include \
	$(LOCAL_PATH)/include/compat \
	$(LOCAL_PATH)/ssl \
	$(LOCAL_PATH)/crypto/compat

LOCAL_CFLAGS := \

if(MSVC)
cmake_minimum_required (VERSION 3.16.4)
cmake_policy(SET CMP0091 NEW)
else()
cmake_minimum_required (VERSION 3.0)
endif()
include(CheckFunctionExists)
include(CheckSymbolExists)
include(CheckLibraryExists)
include(CheckIncludeFiles)
include(CheckTypeSize)

set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}" ${CMAKE_MODULE_PATH})

option(LIBRESSL_SKIP_INSTALL "Skip installation" ${LIBRESSL_SKIP_INSTALL})
option(LIBRESSL_APPS "Build apps" ON)
option(LIBRESSL_TESTS "Build tests" ON)
option(ENABLE_ASM "Enable assembly" ON)
option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF)
option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF)
set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE)

option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF)
if(USE_STATIC_MSVC_RUNTIMES)
    set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
endif()

if(NOT LIBRESSL_SKIP_INSTALL)
	set( ENABLE_LIBRESSL_INSTALL ON )
endif(NOT LIBRESSL_SKIP_INSTALL)


set(BUILD_NC true)

The portable bits of the project are largely maintained out-of-tree, and their
history is also available from Git.

	https://github.com/libressl-portable/portable

LibreSSL Portable Release Notes:

3.1.1 - Stable release

	* Improved cipher suite handling to automatically include TLSv1.3
	  cipher suites when they are not explicitly referred to in the
	  cipher string.

	* Improved handling of TLSv1.3 HelloRetryRequests, simplifying
	  state transitions and ensuring that the legacy session identifer
	  retains the same value across the handshake.

	* Provided TLSv1.3 cipher suite aliases to match the names used
	  in RFC 8446.

	* Improved TLSv1.3 client key share handling to allow the use of
	  any groups in our configured NID list.

	* Fixed printing the serialNumber with X509_print_ex() fall back to
	  the colon separated hex bytes in case greater than int value.

	* Fix to disallow setting the AES-GCM IV length to zero.

	* Added -groups option to openssl(1) s_server subcommand.

	* Fix to show TLSv1.3 extension types with openssl(1) -tlsextdebug.

	* Improved portable builds to support the use of static MSVC runtimes.

	* Fixed portable builds to avoid exporting a sleep() symbol.

3.1.0 - Development release

	* Completed initial TLS 1.3 implementation with a completely new state
	  machine and record layer. TLS 1.3 is now enabled by default for the
	  client side, with the server side to be enabled in a future release.
	  Note that the OpenSSL TLS 1.3 API is not yet visible/available.

	* Many more code cleanups, fixes, and improvements to memory handling
	  and protocol parsing.

	* Added RSA-PSS and RSA-OAEP methods from OpenSSL 1.1.1.

	* Ported Cryptographic Message Syntax (CMS) implementation from OpenSSL
	  1.1.1 and enabled by default.

	* Improved compatibility by backporting functionality and documentation
	  from OpenSSL 1.1.1.

	* Added many new additional crypto test vectors.

	* Adjusted EVP_chacha20()'s behavior to match OpenSSL's semantics.

	* Default CA bundle location is now configurable in portable builds.

	* Added cms subcommand to openssl(1).

	* Added -addext option to openssl(1) req subcommand.

3.0.2 - Stable release

	* Use a valid curve when constructing an EC_KEY that looks like X25519.
	  The recent EC group cofactor change results in stricter validation,
	  which causes the EC_GROUP_set_generator() call to fail.
	  Issue reported and fix tested by rsadowski@

Hints
^^^^^

Set LIBRESSL_ROOT_DIR to the root directory of an LibreSSL installation.

]=======================================================================]

INCLUDE(FindPackageHandleStandardArgs)

# Set Hints
set(_LIBRESSL_ROOT_HINTS
    ${LIBRESSL_ROOT_DIR}
    ENV LIBRESSL_ROOT_DIR
)

SUBDIRS = crypto ssl tls include apps man
if ENABLE_TESTS
SUBDIRS += tests
endif
ACLOCAL_AMFLAGS = -I m4

pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = libcrypto.pc libssl.pc libtls.pc openssl.pc

EXTRA_DIST = README.md README.windows VERSION config scripts
EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake

# Makefile.in generated by automake 1.16.2 from Makefile.am.
# @configure_input@

# Copyright (C) 1994-2020 Free Software Foundation, Inc.

# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without

PRE_INSTALL = :
POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
@ENABLE_TESTS_TRUE@am__append_1 = tests
subdir = .
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/check-hardening-options.m4 \
	$(top_srcdir)/m4/check-libc.m4 \
	$(top_srcdir)/m4/check-os-options.m4 \
	$(top_srcdir)/m4/disable-compiler-warnings.m4 \
	$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \

  list='$(am__tagged_files)'; \
  unique=`for i in $$list; do \
    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
  done | $(am__uniquify_input)`
ETAGS = etags
CTAGS = ctags
CSCOPE = cscope
DIST_SUBDIRS = crypto ssl tls include apps man tests
am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/libcrypto.pc.in \
	$(srcdir)/libssl.pc.in $(srcdir)/libtls.pc.in \
	$(srcdir)/openssl.pc.in COPYING ChangeLog INSTALL compile \
	config.guess config.sub depcomp install-sh ltmain.sh missing \
	tap-driver.sh
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
distdir = $(PACKAGE)-$(VERSION)

sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
SUBDIRS = crypto ssl tls include apps man $(am__append_1)
ACLOCAL_AMFLAGS = -I m4
pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = libcrypto.pc libssl.pc libtls.pc openssl.pc
EXTRA_DIST = README.md README.windows VERSION config scripts \
	CMakeLists.txt cmake_export_symbol.cmake \
	cmake_uninstall.cmake.in FindLibreSSL.cmake
all: all-recursive

	tardir=$(distdir) && $(am__tar) | lzip -c $${LZIP_OPT--9} >$(distdir).tar.lz
	$(am__post_remove_distdir)

dist-xz: distdir
	tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz
	$(am__post_remove_distdir)

dist-zstd: distdir
	tardir=$(distdir) && $(am__tar) | zstd -c $${ZSTD_CLEVEL-$${ZSTD_OPT--19}} >$(distdir).tar.zst
	$(am__post_remove_distdir)

dist-tarZ: distdir
	@echo WARNING: "Support for distribution archives compressed with" \
		       "legacy program 'compress' is deprecated." >&2
	@echo WARNING: "It will be removed altogether in Automake 2.0" >&2
	tardir=$(distdir) && $(am__tar) | compress -c >$(distdir).tar.Z
	$(am__post_remove_distdir)

	  xz -dc $(distdir).tar.xz | $(am__untar) ;;\
	*.tar.Z*) \
	  uncompress -c $(distdir).tar.Z | $(am__untar) ;;\
	*.shar.gz*) \
	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
	*.zip*) \
	  unzip $(distdir).zip ;;\
	*.tar.zst*) \
	  zstd -dc $(distdir).tar.zst | $(am__untar) ;;\
	esac
	chmod -R a-w $(distdir)
	chmod u+w $(distdir)
	mkdir $(distdir)/_build $(distdir)/_build/sub $(distdir)/_inst
	chmod a-w $(distdir)
	test -d $(distdir)/_build || exit 0; \
	dc_install_base=`$(am__cd) $(distdir)/_inst && pwd | sed -e 's,^[^:\\/]:[\\/],/,'` \

.MAKE: $(am__recursive_targets) install-am install-strip

.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \
	am--refresh check check-am clean clean-cscope clean-generic \
	clean-libtool cscope cscopelist-am ctags ctags-am dist \
	dist-all dist-bzip2 dist-gzip dist-lzip dist-shar dist-tarZ \
	dist-xz dist-zip dist-zstd distcheck distclean \
	distclean-generic distclean-libtool distclean-tags \
	distcleancheck distdir distuninstallcheck dvi dvi-am html \
	html-am info info-am install install-am install-data \
	install-data-am install-dvi install-dvi-am install-exec \
	install-exec-am install-html install-html-am install-info \
	install-info-am install-man install-pdf install-pdf-am \
	install-pkgconfigDATA install-ps install-ps-am install-strip \

	installcheck installcheck-am installdirs installdirs-am \
	maintainer-clean maintainer-clean-generic mostlyclean \
	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
	tags tags-am uninstall uninstall-am uninstall-pkgconfigDATA

.PRECIOUS: Makefile


.PHONY: install_sw
install_sw: install

# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:

![LibreSSL image](https://www.libressl.org/images/libressl.jpg)
## Official portable version of [LibreSSL](https://www.libressl.org) ##



LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the
[OpenBSD](https://www.openbsd.org) project.  Our goal is to modernize the codebase,
improve security, and apply best practice development processes from OpenBSD.

## Compatibility with OpenSSL: ##

LibreSSL is API compatible with OpenSSL 1.0.1, but does not yet include all

3.1.1

# generated automatically by aclocal 1.16.2 -*- Autoconf -*-

# Copyright (C) 1996-2020 Free Software Foundation, Inc.

# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.

m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
m4_ifndef([AC_AUTOCONF_VERSION],
  [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.69],,
[m4_warning([this file was generated for autoconf 2.69.
You have another version of autoconf.  It may work, but is not guaranteed to.
If you have problems, you may need to regenerate the build system entirely.
To do so, use the procedure documented by the package, typically 'autoreconf'.])])

# Copyright (C) 2002-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_AUTOMAKE_VERSION(VERSION)
# ----------------------------
# Automake X.Y traces this macro to ensure aclocal.m4 has been
# generated from the m4 files accompanying Automake X.Y.
# (This private macro should not be called outside this file.)
AC_DEFUN([AM_AUTOMAKE_VERSION],
[am__api_version='1.16'
dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
dnl require some minimum version.  Point them to the right macro.
m4_if([$1], [1.16.2], [],
      [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
])

# _AM_AUTOCONF_VERSION(VERSION)
# -----------------------------
# aclocal traces this macro to find the Autoconf version.
# This is a private macro too.  Using m4_define simplifies
# the logic in aclocal, which can simply ignore this definition.
m4_define([_AM_AUTOCONF_VERSION], [])

# AM_SET_CURRENT_AUTOMAKE_VERSION
# -------------------------------
# Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
# This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
[AM_AUTOMAKE_VERSION([1.16.2])dnl
m4_ifndef([AC_AUTOCONF_VERSION],
  [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
_AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])

# Figure out how to run the assembler.                      -*- Autoconf -*-

# Copyright (C) 2001-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_PROG_AS
# ----------
AC_DEFUN([AM_PROG_AS],
[# By default we simply use the C compiler to build assembly code.
AC_REQUIRE([AC_PROG_CC])
test "${CCAS+set}" = set || CCAS=$CC
test "${CCASFLAGS+set}" = set || CCASFLAGS=$CFLAGS
AC_ARG_VAR([CCAS],      [assembler compiler command (defaults to CC)])
AC_ARG_VAR([CCASFLAGS], [assembler compiler flags (defaults to CFLAGS)])
_AM_IF_OPTION([no-dependencies],, [_AM_DEPENDENCIES([CCAS])])dnl
])

# AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-

# Copyright (C) 2001-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# For projects using AC_CONFIG_AUX_DIR([foo]), Autoconf sets
# $ac_aux_dir to '$srcdir/foo'.  In other projects, it is set to

[AC_REQUIRE([AC_CONFIG_AUX_DIR_DEFAULT])dnl
# Expand $ac_aux_dir to an absolute path.
am_aux_dir=`cd "$ac_aux_dir" && pwd`
])

# AM_CONDITIONAL                                            -*- Autoconf -*-

# Copyright (C) 1997-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_CONDITIONAL(NAME, SHELL-CONDITION)
# -------------------------------------

fi
AC_CONFIG_COMMANDS_PRE(
[if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then
  AC_MSG_ERROR([[conditional "$1" was never defined.
Usually this means the macro was only invoked conditionally.]])
fi])])

# Copyright (C) 1999-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.


# There are a few dirty hacks below to avoid letting 'AC_PROG_CC' be

_AM_SUBST_NOTMAKE([AMDEPBACKSLASH])dnl
AC_SUBST([am__nodep])dnl
_AM_SUBST_NOTMAKE([am__nodep])dnl
])

# Generate code to set up dependency tracking.              -*- Autoconf -*-

# Copyright (C) 1999-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# _AM_OUTPUT_DEPENDENCY_COMMANDS
# ------------------------------

    am_filepart=`AS_BASENAME(["$am_mf"])`
    AM_RUN_LOG([cd "$am_dirpart" \
      && sed -e '/# am--include-marker/d' "$am_filepart" \
        | $MAKE -f - am--depfiles]) || am_rc=$?
  done
  if test $am_rc -ne 0; then
    AC_MSG_FAILURE([Something went wrong bootstrapping makefile fragments
    for automatic dependency tracking.  If GNU make was not used, consider
    re-running the configure script with MAKE="gmake" (or whatever is
    necessary).  You can also try re-running configure with the
    '--disable-dependency-tracking' option to at least be able to build
    the package (albeit without support for automatic dependency tracking).])
  fi
  AS_UNSET([am_dirpart])
  AS_UNSET([am_filepart])
  AS_UNSET([am_mf])
  AS_UNSET([am_rc])

AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],
[AC_CONFIG_COMMANDS([depfiles],
     [test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS],
     [AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"])])

# Do all the work for Automake.                             -*- Autoconf -*-

# Copyright (C) 1996-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This macro actually does too much.  Some checks are only needed if
# your package does certain things.  But this isn't really a big deal.

      break ;;
    * )
      _am_stamp_count=`expr $_am_stamp_count + 1` ;;
  esac
done
echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count])

# Copyright (C) 2001-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_PROG_INSTALL_SH
# ------------------
# Define $install_sh.
AC_DEFUN([AM_PROG_INSTALL_SH],
[AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl
if test x"${install_sh+set}" != xset; then
  case $am_aux_dir in
  *\ * | *\	*)
    install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;;
  *)
    install_sh="\${SHELL} $am_aux_dir/install-sh"
  esac
fi
AC_SUBST([install_sh])])

# Copyright (C) 2003-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# Check whether the underlying file-system supports filenames
# with a leading dot.  For instance MS-DOS doesn't.
AC_DEFUN([AM_SET_LEADING_DOT],
[rm -rf .tst 2>/dev/null
mkdir .tst 2>/dev/null
if test -d .tst; then
  am__leading_dot=.
else
  am__leading_dot=_
fi
rmdir .tst 2>/dev/null
AC_SUBST([am__leading_dot])])

# Check to see how 'make' treats includes.	            -*- Autoconf -*-

# Copyright (C) 2001-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_MAKE_INCLUDE()
# -----------------

rm -f confinc.* confmf.*
AC_MSG_RESULT([${_am_result}])
AC_SUBST([am__include])])
AC_SUBST([am__quote])])

# Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-

# Copyright (C) 1997-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_MISSING_PROG(NAME, PROGRAM)
# ------------------------------

  am_missing_run=
  AC_MSG_WARN(['missing' script is too old or missing])
fi
])

# Helper functions for option handling.                     -*- Autoconf -*-

# Copyright (C) 2001-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# _AM_MANGLE_OPTION(NAME)
# -----------------------

# _AM_IF_OPTION(OPTION, IF-SET, [IF-NOT-SET])
# -------------------------------------------
# Execute IF-SET if OPTION is set, IF-NOT-SET otherwise.
AC_DEFUN([_AM_IF_OPTION],
[m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])])

# Copyright (C) 1999-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# _AM_PROG_CC_C_O
# ---------------

   CC="$am_aux_dir/compile $CC"
fi
AC_LANG_POP([C])])

# For backward compatibility.
AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])])

# Copyright (C) 2001-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_RUN_LOG(COMMAND)
# -------------------
# Run COMMAND, save the exit status in ac_status, and log it.
# (This has been adapted from Autoconf's _AC_RUN_LOG macro.)
AC_DEFUN([AM_RUN_LOG],
[{ echo "$as_me:$LINENO: $1" >&AS_MESSAGE_LOG_FD
   ($1) >&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD
   ac_status=$?
   echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD
   (exit $ac_status); }])

# Check to make sure that the build environment is sane.    -*- Autoconf -*-

# Copyright (C) 1996-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_SANITY_CHECK
# ---------------

     # Hide warnings about reused PIDs.
     wait $am_sleep_pid 2>/dev/null
   fi
   AC_MSG_RESULT([done])])
rm -f conftest.file
])

# Copyright (C) 2009-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_SILENT_RULES([DEFAULT])
# --------------------------

AM_SUBST_NOTMAKE([AM_DEFAULT_V])dnl
AC_SUBST([AM_DEFAULT_VERBOSITY])dnl
AM_BACKSLASH='\'
AC_SUBST([AM_BACKSLASH])dnl
_AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl
])

# Copyright (C) 2001-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# AM_PROG_INSTALL_STRIP
# ---------------------

dnl Don't test for $cross_compiling = yes, because it might be 'maybe'.
if test "$cross_compiling" != no; then
  AC_CHECK_TOOL([STRIP], [strip], :)
fi
INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
AC_SUBST([INSTALL_STRIP_PROGRAM])])

# Copyright (C) 2006-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# _AM_SUBST_NOTMAKE(VARIABLE)
# ---------------------------
# Prevent Automake from outputting VARIABLE = @VARIABLE@ in Makefile.in.
# This macro is traced by Automake.
AC_DEFUN([_AM_SUBST_NOTMAKE])

# AM_SUBST_NOTMAKE(VARIABLE)
# --------------------------
# Public sister of _AM_SUBST_NOTMAKE.
AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])

# Check how to create a tarball.                            -*- Autoconf -*-

# Copyright (C) 2004-2020 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# _AM_PROG_TAR(FORMAT)
# --------------------

# Makefile.in generated by automake 1.16.2 from Makefile.am.
# @configure_input@

# Copyright (C) 1994-2020 Free Software Foundation, Inc.

# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without

# Makefile.in generated by automake 1.16.2 from Makefile.am.
# @configure_input@

# Copyright (C) 1994-2020 Free Software Foundation, Inc.

# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without

.\"     $OpenBSD: nc.1,v 1.95 2020/02/12 14:46:36 schwarze Exp $
.\"
.\" Copyright (c) 1996 David Sacerdote
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:

.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: February 12 2020 $
.Dt NC 1
.Os
.Sh NAME
.Nm nc
.Nd arbitrary TCP and UDP connections and listens
.Sh SYNOPSIS
.Nm nc

.Op Fl M Ar ttl
.Op Fl m Ar minttl
.Op Fl O Ar length
.Op Fl o Ar staplefile
.Op Fl P Ar proxy_username
.Op Fl p Ar source_port
.Op Fl R Ar CAfile
.Op Fl s Ar sourceaddr
.Op Fl T Ar keyword
.Op Fl V Ar rtable
.Op Fl W Ar recvlimit
.Op Fl w Ar timeout
.Op Fl X Ar proxy_protocol
.Op Fl x Ar proxy_address Ns Op : Ns Ar port
.Op Fl Z Ar peercertfile

Ask the kernel to drop incoming packets whose TTL / hop limit is under
.Ar minttl .
.It Fl N
.Xr shutdown 2
the network socket after EOF on the input.
Some servers require this to finish their work.
.It Fl n
Do not perform domain name resolution.
If a name cannot be resolved without DNS, an error will be reported.
.It Fl O Ar length
Specify the size of the TCP send buffer.
.It Fl o Ar staplefile
During the TLS handshake, load data to be stapled from
.Ar staplefile ,
which is expected to contain an OCSP response from an OCSP server in
DER format.

.Fl c .
.It Fl r
Choose source and/or destination ports randomly
instead of sequentially within a range or in the order that the system
assigns them.
.It Fl S
Enable the RFC 2385 TCP MD5 signature option.
.It Fl s Ar sourceaddr
Set the source address to send packets from,
which is useful on machines with multiple interfaces.

For
.Ux Ns -domain
datagram sockets, specifies the local temporary socket file
to create and use so that datagrams can be received.
Cannot be used together with
.Fl l
or

/* $OpenBSD: netcat.c,v 1.217 2020/02/12 14:46:36 schwarze Exp $ */
/*
 * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
 * Copyright (c) 2015 Bob Beck.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:

void	atelnet(int, unsigned char *, unsigned int);
int	strtoport(char *portstr, int udp);
void	build_ports(char *);
void	help(void) __attribute__((noreturn));
int	local_listen(const char *, const char *, struct addrinfo);
void	readwrite(int, struct tls *);
void	fdpass(int nfd) __attribute__((noreturn));
int	remote_connect(const char *, const char *, struct addrinfo, char *);
int	timeout_tls(int, struct tls *, int (*)(struct tls *));
int	timeout_connect(int, const struct sockaddr *, socklen_t);
int	socks_connect(const char *, const char *, struct addrinfo,
	    const char *, const char *, struct addrinfo, int, const char *);
int	udptest(int);
int	unix_bind(char *, int);
int	unix_connect(char *);

struct tls *tls_setup_server(struct tls *, int, char *);

int
main(int argc, char *argv[])
{
	int ch, s = -1, ret, socksv;
	char *host, *uport;
	char ipaddr[NI_MAXHOST];
	struct addrinfo hints;
	struct servent *sv;
	socklen_t len;
	struct sockaddr_storage cliaddr;
	char *proxy = NULL, *proxyport = NULL;
	const char *errstr;
	struct addrinfo proxyhints;

#ifdef SO_RTABLE
	if (rtableid >= 0)
		if (setrtable(rtableid) == -1)
			err(1, "setrtable");
#endif

	/* Cruft to make sure options are clean, and used properly. */
	if (argc == 1 && family == AF_UNIX) {
		host = argv[0];

	} else if (argc == 1 && lflag) {


		uport = argv[0];

	} else if (argc == 2) {
		host = argv[0];
		uport = argv[1];
	} else
		usage(1);

	if (usetls) {
		if (Cflag && unveil(Cflag, "r") == -1)
			err(1, "unveil");
		if (unveil(Rflag, "r") == -1)
			err(1, "unveil");
		if (Kflag && unveil(Kflag, "r") == -1)
			err(1, "unveil");
		if (oflag && unveil(oflag, "r") == -1)
			err(1, "unveil");
	} else if (family == AF_UNIX && uflag && lflag && !kflag) {
		/*
		 * After recvfrom(2) from client, the server connects
		 * to the client socket.  As the client path is determined
		 * during runtime, we cannot unveil(2).
		 */
	} else {
		if (family == AF_UNIX) {
			if (unveil(host, "rwc") == -1)
				err(1, "unveil");
			if (uflag && !kflag) {
				if (sflag) {
					if (unveil(sflag, "rwc") == -1)
						err(1, "unveil");
				} else {
					if (unveil("/tmp", "rwc") == -1)
						err(1, "unveil");
				}
			}
		} else {
			/* no filesystem visibility */
			if (unveil("/", "") == -1)
				err(1, "unveil");
		}
	}

				if (s != -1)
					close(s);
				s = local_listen(host, uport, hints);
			}
			if (s == -1)
				err(1, NULL);
			if (uflag && kflag) {
				if (family == AF_UNIX) {
					if (pledge("stdio unix", NULL) == -1)
						err(1, "pledge");
				}
				/*
				 * For UDP and -k, don't connect the socket,
				 * let it receive datagrams from multiple
				 * socket pairs.
				 */
				readwrite(s, NULL);
			} else if (uflag && !kflag) {

				if (rv == -1)
					err(1, "recvfrom");

				rv = connect(s, (struct sockaddr *)&z, len);
				if (rv == -1)
					err(1, "connect");

				if (family == AF_UNIX) {
					if (pledge("stdio unix", NULL) == -1)
						err(1, "pledge");
				}
				if (vflag)
					report_sock("Connection received",
					    (struct sockaddr *)&z, len,
					    family == AF_UNIX ? host : NULL);

				readwrite(s, NULL);
			} else {
				struct tls *tls_cctx = NULL;
				int connfd;

				len = sizeof(cliaddr);

					    tls_error(tls_ctx));
			}
			if (xflag)
				s = socks_connect(host, portlist[i], hints,
				    proxy, proxyport, proxyhints, socksv,
				    Pflag);
			else
				s = remote_connect(host, portlist[i], hints,
				    ipaddr);

			if (s == -1)
				continue;

			ret = 0;
			if (vflag || zflag) {
				/* For UDP, make sure we are connected. */

					sv = NULL;
				else {
					sv = getservbyport(
					    ntohs(atoi(portlist[i])),
					    uflag ? "udp" : "tcp");
				}

				fprintf(stderr, "Connection to %s", host);

				/*
				 * if we aren't connecting thru a proxy and
				 * there is something to report, print IP
				 */
				if (!nflag && !xflag
				    && (strcmp(host, ipaddr) != 0))
					fprintf(stderr, " (%s)", ipaddr);

				fprintf(stderr, " %s port [%s/%s] succeeded!\n",
				    portlist[i], uflag ? "udp" : "tcp",
				    sv ? sv->s_name : "*");
			}
			if (Fflag)
				fdpass(s);
			else {
				if (usetls)
					tls_setup_client(tls_ctx, s, host);

	if (timeout_tls(s, tls_ctx, tls_handshake) == -1) {
		if ((errstr = tls_error(tls_ctx)) == NULL)
			errstr = strerror(errno);
		errx(1, "tls handshake failed (%s)", errstr);
	}
	if (vflag)
		report_tls(tls_ctx, host);
	if (tls_expecthash && (tls_peer_cert_hash(tls_ctx) == NULL ||
	    strcmp(tls_expecthash, tls_peer_cert_hash(tls_ctx)) != 0))
		errx(1, "peer certificate is not %s", tls_expecthash);
	if (Zflag) {
		save_peer_cert(tls_ctx, Zflag);
		if (Zflag != stderr && (fclose(Zflag) != 0))
			err(1, "fclose failed saving peer cert");
	}
}

	} else {
		int gotcert = tls_peer_cert_provided(tls_cctx);

		if (vflag && gotcert)
			report_tls(tls_cctx, host);
		if ((TLSopt & TLS_CCERT) && !gotcert)
			warnx("No client certificate provided");
		else if (gotcert && tls_expecthash &&
		    (tls_peer_cert_hash(tls_cctx) == NULL ||
		    strcmp(tls_expecthash, tls_peer_cert_hash(tls_cctx)) != 0))
			warnx("peer certificate is not %s", tls_expecthash);
		else if (gotcert && tls_expectname &&
		    (!tls_peer_cert_contains_name(tls_cctx, tls_expectname)))
			warnx("name (%s) not found in client cert",
			    tls_expectname);
		else {
			return tls_cctx;

/*
 * remote_connect()
 * Returns a socket connected to a remote host. Properly binds to a local
 * port or source address if needed. Returns -1 on failure.
 */
int
remote_connect(const char *host, const char *port, struct addrinfo hints,
    char *ipaddr)
{
	struct addrinfo *res, *res0;
	int s = -1, error, herr, save_errno;
#ifdef SO_BINDANY
	int on = 1;
#endif

	if ((error = getaddrinfo(host, port, &hints, &res0)))
		errx(1, "getaddrinfo for host \"%s\" port %s: %s", host,
		    port, gai_strerror(error));

			if (bind(s, (struct sockaddr *)ares->ai_addr,
			    ares->ai_addrlen) == -1)
				err(1, "bind failed");
			freeaddrinfo(ares);
		}

		set_common_sockopts(s, res->ai_family);

		if (ipaddr != NULL) {
			herr = getnameinfo(res->ai_addr, res->ai_addrlen,
			    ipaddr, NI_MAXHOST, NULL, 0, NI_NUMERICHOST);
			switch (herr) {
			case 0:
				break;
			case EAI_SYSTEM:
				err(1, "getnameinfo");
			default:
				errx(1, "getnameinfo: %s", gai_strerror(herr));
			}
		}

		if (timeout_connect(s, res->ai_addr, res->ai_addrlen) == 0)
			break;

		if (vflag) {
			/* only print IP if there is something to report */
			if (nflag || ipaddr == NULL ||
			    (strncmp(host, ipaddr, NI_MAXHOST) == 0))
				warn("connect to %s port %s (%s) failed", host,
				    port, uflag ? "udp" : "tcp");
			else
				warn("connect to %s (%s) port %s (%s) failed",
				    host, ipaddr, port, uflag ? "udp" : "tcp");
		}

		save_errno = errno;
		close(s);
		errno = save_errno;
		s = -1;
	}

		fprintf(stderr, "%s on %s\n", msg, path);
		return;
	}

	if (nflag)
		flags |= NI_NUMERICHOST;

	herr = getnameinfo(sa, salen, host, sizeof(host), port, sizeof(port),
	    flags);
	switch (herr) {
		case 0:
			break;
		case EAI_SYSTEM:
			err(1, "getnameinfo");
		default:
			errx(1, "getnameinfo: %s", gai_strerror(herr));
	}

	fprintf(stderr, "%s on %s %s\n", msg, host, port);
}

void

	\t-O length	TCP send buffer length\n\
	\t-o staplefile	Staple file\n\
	\t-P proxyuser\tUsername for proxy authentication\n\
	\t-p port\t	Specify local port for remote connects\n\
	\t-R CAfile	CA bundle\n\
	\t-r		Randomize remote ports\n"
#ifdef TCP_MD5SIG

	"\t-S		Enable the TCP MD5 signature option\n"
#endif

	"\t-s sourceaddr	Local source address\n\
	\t-T keyword	TOS value or TLS options\n\
	\t-t		Answer TELNET negotiation\n\
	\t-U		Use UNIX domain socket\n\
	\t-u		UDP mode\n"
#ifdef SO_RTABLE

	"\t-V rtable	Specify alternate routing table\n"
#endif

	"\t-v		Verbose\n\
	\t-W recvlimit	Terminate after receiving a number of packets\n\
	\t-w timeout	Timeout for connects and final net reads\n\
	\t-X proto	Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
	\t-x addr[:port]\tSpecify proxy address and port\n\
	\t-Z		Peer certificate file\n\
	\t-z		Zero-I/O mode [used for scanning]\n\
	Port numbers can be individual or ranges: lo-hi [inclusive]\n");
	exit(1);
}

void
usage(int ret)
{
	fprintf(stderr,
	    "usage: nc [-46cDdFhklNnrStUuvz] [-C certfile] [-e name] "
	    "[-H hash] [-I length]\n"
	    "\t  [-i interval] [-K keyfile] [-M ttl] [-m minttl] [-O length]\n"
	    "\t  [-o staplefile] [-P proxy_username] [-p source_port] "
	    "[-R CAfile]\n"
	    "\t  [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit] "
	    "[-w timeout]\n"
	    "\t  [-X proxy_protocol] [-x proxy_address[:port]] "
	    "[-Z peercertfile]\n"
	    "\t  [destination] [port]\n");
	if (ret)
		exit(1);
}

/*	$OpenBSD: socks.c,v 1.30 2019/11/04 17:33:28 millert Exp $	*/

/*
 * Copyright (c) 1999 Niklas Hallqvist.  All rights reserved.
 * Copyright (c) 2004, 2005 Damien Miller.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions

#define SOCKS_NOAUTH	0
#define SOCKS_NOMETHOD	0xff
#define SOCKS_CONNECT	1
#define SOCKS_IPV4	1
#define SOCKS_DOMAIN	3
#define SOCKS_IPV6	4

int	remote_connect(const char *, const char *, struct addrinfo, char *);
int	socks_connect(const char *, const char *, struct addrinfo,
	    const char *, const char *, struct addrinfo, int,
	    const char *);

static int
decode_addrport(const char *h, const char *p, struct sockaddr *addr,
    socklen_t addrlen, int v4only, int numeric)

		errx(1, "unknown port \"%.64s\"", port);
	serverport = in4->sin_port;

 again:
	if (authretry++ > 3)
		errx(1, "Too many authentication failures");

	proxyfd = remote_connect(proxyhost, proxyport, proxyhints, NULL);

	if (proxyfd < 0)
		return (-1);

	if (socksv == 5) {
		if (decode_addrport(host, port, (struct sockaddr *)&addr,
		    sizeof(addr), 0, 1) == -1)

include $(top_srcdir)/Makefile.am.common

bin_PROGRAMS = ocspcheck

dist_man_MANS = ocspcheck.8

EXTRA_DIST = ocspcheck.8
EXTRA_DIST += CMakeLists.txt

ocspcheck_LDADD = $(abs_top_builddir)/crypto/libcrypto.la
ocspcheck_LDADD += $(abs_top_builddir)/ssl/libssl.la
ocspcheck_LDADD += $(abs_top_builddir)/tls/libtls.la

# Makefile.in generated by automake 1.16.2 from Makefile.am.
# @configure_input@

# Copyright (C) 1994-2020 Free Software Foundation, Inc.

# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without

am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
	$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(noinst_HEADERS) \
	$(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
CONFIG_CLEAN_VPATH_FILES =
am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man8dir)"
PROGRAMS = $(bin_PROGRAMS)
am__ocspcheck_SOURCES_DIST = http.c ocspcheck.c compat/memmem.c
am__dirstamp = $(am__leading_dot)dirstamp
@HAVE_MEMMEM_FALSE@am__objects_1 = compat/memmem.$(OBJEXT)
am_ocspcheck_OBJECTS = http.$(OBJEXT) ocspcheck.$(OBJEXT) \
	$(am__objects_1)
ocspcheck_OBJECTS = $(am_ocspcheck_OBJECTS)

SOURCES = $(ocspcheck_SOURCES)
DIST_SOURCES = $(am__ocspcheck_SOURCES_DIST)
am__can_run_installinfo = \
  case $$AM_UPDATE_INFO_DIR in \
    n|no|NO) false;; \
    *) (install-info --version) >/dev/null 2>&1;; \
  esac
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
    *) f=$$p;; \
  esac;
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
am__install_max = 40
am__nobase_strip_setup = \
  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
am__nobase_strip = \
  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
am__nobase_list = $(am__nobase_strip_setup); \
  for p in $$list; do echo "$$p $$p"; done | \
  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
    if (++n[$$2] == $(am__install_max)) \
      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
    END { for (dir in files) print dir, files[dir] }'
am__base_list = \
  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__uninstall_files_from_dir = { \
  test -z "$$files" \
    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
         $(am__cd) "$$dir" && rm -f $$files; }; \
  }
man8dir = $(mandir)/man8
NROFF = nroff
MANS = $(dist_man_MANS)
HEADERS = $(noinst_HEADERS)
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
# Read a list of newline-separated strings from the standard input,
# and print each of them once, without duplicates.  Input order is
# *not* preserved.
am__uniquify_input = $(AWK) '\
  BEGIN { nonempty = 0; } \
  { items[$$0] = 1; nonempty = 1; } \
  END { if (nonempty) { for (i in items) print i; }; } \
'
# Make sure the list of sources is unique.  This is necessary because,
# e.g., the same source file might be shared among _SOURCES variables
# for different programs/libraries.
am__define_uniq_tagged_files = \
  list='$(am__tagged_files)'; \
  unique=`for i in $$list; do \
    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
  done | $(am__uniquify_input)`
ETAGS = etags
CTAGS = ctags
am__DIST_COMMON = $(dist_man_MANS) $(srcdir)/Makefile.in \
	$(top_srcdir)/Makefile.am.common $(top_srcdir)/depcomp
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = true
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
AR = @AR@
AUTOCONF = true

top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
AM_CFLAGS = 
AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/include/compat \
	-DLIBRESSL_INTERNAL -D__BEGIN_HIDDEN_DECLS= \
	-D__END_HIDDEN_DECLS=
dist_man_MANS = ocspcheck.8
EXTRA_DIST = ocspcheck.8 CMakeLists.txt
ocspcheck_LDADD = $(abs_top_builddir)/crypto/libcrypto.la \
	$(abs_top_builddir)/ssl/libssl.la \
	$(abs_top_builddir)/tls/libtls.la $(PLATFORM_LDADD) \
	$(PROG_LDADD)
ocspcheck_SOURCES = http.c ocspcheck.c $(am__append_1)
noinst_HEADERS = http.h

@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<

mostlyclean-libtool:
	-rm -f *.lo

clean-libtool:
	-rm -rf .libs _libs
install-man8: $(dist_man_MANS)
	@$(NORMAL_INSTALL)
	@list1=''; \
	list2='$(dist_man_MANS)'; \
	test -n "$(man8dir)" \
	  && test -n "`echo $$list1$$list2`" \
	  || exit 0; \
	echo " $(MKDIR_P) '$(DESTDIR)$(man8dir)'"; \
	$(MKDIR_P) "$(DESTDIR)$(man8dir)" || exit 1; \
	{ for i in $$list1; do echo "$$i"; done;  \
	if test -n "$$list2"; then \
	  for i in $$list2; do echo "$$i"; done \
	    | sed -n '/\.8[a-z]*$$/p'; \
	fi; \
	} | while read p; do \
	  if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
	  echo "$$d$$p"; echo "$$p"; \
	done | \
	sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
	sed 'N;N;s,\n, ,g' | { \
	list=; while read file base inst; do \
	  if test "$$base" = "$$inst"; then list="$$list $$file"; else \
	    echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
	    $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst" || exit $$?; \
	  fi; \
	done; \
	for i in $$list; do echo "$$i"; done | $(am__base_list) | \
	while read files; do \
	  test -z "$$files" || { \
	    echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man8dir)'"; \
	    $(INSTALL_DATA) $$files "$(DESTDIR)$(man8dir)" || exit $$?; }; \
	done; }

uninstall-man8:
	@$(NORMAL_UNINSTALL)
	@list=''; test -n "$(man8dir)" || exit 0; \
	files=`{ for i in $$list; do echo "$$i"; done; \
	l2='$(dist_man_MANS)'; for i in $$l2; do echo "$$i"; done | \
	  sed -n '/\.8[a-z]*$$/p'; \
	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
	dir='$(DESTDIR)$(man8dir)'; $(am__uninstall_files_from_dir)

ID: $(am__tagged_files)
	$(am__define_uniq_tagged_files); mkid -fID $$unique
tags: tags-am
TAGS: tags

tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)

	    test -f "$(distdir)/$$file" \
	    || cp -p $$d/$$file "$(distdir)/$$file" \
	    || exit 1; \
	  fi; \
	done
check-am: all-am
check: check-am
all-am: Makefile $(PROGRAMS) $(MANS) $(HEADERS)
installdirs:
	for dir in "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man8dir)"; do \
	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
	done
install: install-am
install-exec: install-exec-am
install-data: install-data-am
uninstall: uninstall-am

html-am:

info: info-am

info-am:

install-data-am: install-man

install-dvi: install-dvi-am

install-dvi-am:

install-exec-am: install-binPROGRAMS

install-html: install-html-am

install-html-am:

install-info: install-info-am

install-info-am:

install-man: install-man8

install-pdf: install-pdf-am

install-pdf-am:

install-ps: install-ps-am

pdf-am:

ps: ps-am

ps-am:

uninstall-am: uninstall-binPROGRAMS uninstall-man

uninstall-man: uninstall-man8

.MAKE: install-am install-strip

.PHONY: CTAGS GTAGS TAGS all all-am am--depfiles check check-am clean \
	clean-binPROGRAMS clean-generic clean-libtool cscopelist-am \
	ctags ctags-am distclean distclean-compile distclean-generic \
	distclean-libtool distclean-tags distdir dvi dvi-am html \
	html-am info info-am install install-am install-binPROGRAMS \
	install-data install-data-am install-dvi install-dvi-am \
	install-exec install-exec-am install-html install-html-am \
	install-info install-info-am install-man install-man8 \
	install-pdf install-pdf-am install-ps install-ps-am \
	install-strip installcheck installcheck-am installdirs \
	maintainer-clean maintainer-clean-generic mostlyclean \
	mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
	pdf pdf-am ps ps-am tags tags-am uninstall uninstall-am \
	uninstall-binPROGRAMS uninstall-man uninstall-man8

.PRECIOUS: Makefile


# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:

/*	$OpenBSD: memmem.c,v 1.5 2020/04/16 12:39:28 claudio Exp $ */

/*
 * Copyright (c) 2005-2020 Rich Felker, et al.
 *
 * Permission is hereby granted, free of charge, to any person obtaining
 * a copy of this software and associated documentation files (the
 * "Software"), to deal in the Software without restriction, including
 * without limitation the rights to use, copy, modify, merge, publish,
 * distribute, sublicense, and/or sell copies of the Software, and to
 * permit persons to whom the Software is furnished to do so, subject to
 * the following conditions:

 *
 * The above copyright notice and this permission notice shall be






 * included in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY



 * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 */

#include <string.h>
#include <stdint.h>

static char *
twobyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
{
	uint16_t nw = n[0]<<8 | n[1], hw = h[0]<<8 | h[1];
	for (h+=2, k-=2; k; k--, hw = hw<<8 | *h++)
		if (hw == nw) return (char *)h-2;
	return hw == nw ? (char *)h-2 : 0;
}

static char *
threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
{
	uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
	uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
	for (h+=3, k-=3; k; k--, hw = (hw|*h++)<<8)
		if (hw == nw) return (char *)h-3;
	return hw == nw ? (char *)h-3 : 0;
}

static char *
fourbyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
{
	uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
	uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
	for (h+=4, k-=4; k; k--, hw = hw<<8 | *h++)
		if (hw == nw) return (char *)h-4;
	return hw == nw ? (char *)h-4 : 0;
}

#define MAX(a,b) ((a)>(b)?(a):(b))
#define MIN(a,b) ((a)<(b)?(a):(b))

#define BITOP(a,b,op) \
 ((a)[(size_t)(b)/(8*sizeof *(a))] op (size_t)1<<((size_t)(b)%(8*sizeof *(a))))

/*
 * Maxime Crochemore and Dominique Perrin, Two-way string-matching,
 * Journal of the ACM, 38(3):651-675, July 1991.
 */
static char *
twoway_memmem(const unsigned char *h, const unsigned char *z,
    const unsigned char *n, size_t l)
{
	size_t i, ip, jp, k, p, ms, p0, mem, mem0;
	size_t byteset[32 / sizeof(size_t)] = { 0 };
	size_t shift[256];

	/* Computing length of needle and fill shift table */
	for (i=0; i<l; i++)
		BITOP(byteset, n[i], |=), shift[n[i]] = i+1;

	/* Compute maximal suffix */
	ip = -1; jp = 0; k = p = 1;
	while (jp+k<l) {
		if (n[ip+k] == n[jp+k]) {
			if (k == p) {
				jp += p;
				k = 1;
			} else k++;
		} else if (n[ip+k] > n[jp+k]) {
			jp += k;
			k = 1;
			p = jp - ip;
		} else {
			ip = jp++;
			k = p = 1;
		}
	}
	ms = ip;
	p0 = p;

	/* And with the opposite comparison */
	ip = -1; jp = 0; k = p = 1;
	while (jp+k<l) {
		if (n[ip+k] == n[jp+k]) {
			if (k == p) {
				jp += p;
				k = 1;
			} else k++;
		} else if (n[ip+k] < n[jp+k]) {
			jp += k;
			k = 1;
			p = jp - ip;
		} else {
			ip = jp++;
			k = p = 1;
		}
	}
	if (ip+1 > ms+1) ms = ip;
	else p = p0;

	/* Periodic needle? */
	if (memcmp(n, n+p, ms+1)) {
		mem0 = 0;
		p = MAX(ms, l-ms-1) + 1;
	} else mem0 = l-p;
	mem = 0;

	/* Search loop */
	for (;;) {
		/* If remainder of haystack is shorter than needle, done */
		if (z-h < l) return 0;

		/* Check last byte first; advance by shift on mismatch */
		if (BITOP(byteset, h[l-1], &)) {
			k = l-shift[h[l-1]];
			if (k) {
				if (k < mem) k = mem;
				h += k;
				mem = 0;
				continue;
			}
		} else {
			h += l;
			mem = 0;
			continue;
		}

		/* Compare right half */
		for (k=MAX(ms+1,mem); k<l && n[k] == h[k]; k++);
		if (k < l) {
			h += k-ms;
			mem = 0;
			continue;
		}
		/* Compare left half */
		for (k=ms+1; k>mem && n[k-1] == h[k-1]; k--);
		if (k <= mem) return (char *)h;
		h += p;
		mem = mem0;
	}
}

void *
memmem(const void *h0, size_t k, const void *n0, size_t l)
{

	const unsigned char *h = h0, *n = n0;


	/* Return immediately on empty needle */

	if (!l) return (void *)h;



	/* Return immediately when needle is longer than haystack */
	if (k<l) return 0;



	/* Use faster algorithms for short needles */
	h = memchr(h0, *n, k);
	if (!h || l==1) return (void *)h;


	k -= h - (const unsigned char *)h0;


	if (k<l) return 0;
	if (l==2) return twobyte_memmem(h, k, n);
	if (l==3) return threebyte_memmem(h, k, n);
	if (l==4) return fourbyte_memmem(h, k, n);

	return twoway_memmem(h, h+k, n, l);
}

/*	$Id: http.c,v 1.13 2020/01/11 17:37:19 sthen Exp $ */
/*
 * Copyright (c) 2016 Kristaps Dzonsons <kristaps@bsd.lv>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *

		    "Host: %s\r\n"
		    "\r\n",
		    http->path, http->host);
	} else {
		c = asprintf(&req,
		    "POST %s HTTP/1.0\r\n"
		    "Host: %s\r\n"
		    "Content-Type: application/ocsp-request\r\n"
		    "Content-Length: %zu\r\n"
		    "\r\n",
		    http->path, http->host, psz);
	}
	if (c == -1) {
		warn("asprintf");
		return NULL;

/* $OpenBSD: ocspcheck.c,v 1.26 2020/01/23 03:53:39 tb Exp $ */

/*
 * Copyright (c) 2017 Bob Beck <beck@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.

		return -1;
	if ((rv = timegm(&tm)) == -1)
		return -1;
	return rv;
}

static X509_STORE *
read_cacerts(const char *file, const char *dir)
{
	X509_STORE *store = NULL;
	X509_LOOKUP *lookup;

	if (file == NULL && dir == NULL) {
		warnx("No CA certs to load");
		goto end;
	}
	if ((store = X509_STORE_new()) == NULL) {
		warnx("Malloc failed");
		goto end;
	}
	if (file != NULL) {
		if ((lookup = X509_STORE_add_lookup(store,
		    X509_LOOKUP_file())) == NULL) {
			warnx("Unable to load CA cert file");
			goto end;
		}

		if (!X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM)) {
			warnx("Unable to load CA certs from file %s", file);
			goto end;
		}


	}
	if (dir != NULL) {
		if ((lookup = X509_STORE_add_lookup(store,
		    X509_LOOKUP_hash_dir())) == NULL) {
			warnx("Unable to load CA cert directory");
			goto end;
		}
		if (!X509_LOOKUP_add_dir(lookup, dir, X509_FILETYPE_PEM)) {
			warnx("Unable to load CA certs from directory %s", dir);
			goto end;
		}
	}
	return store;

end:
	X509_STORE_free(store);
	return NULL;
}

		return NULL;

	issuer = X509_find_by_subject(fullchain, issuer_name);
	return issuer;
}

static ocsp_request *
ocsp_request_new_from_cert(const char *cadir, char *file, int nonce)
{
	X509 *cert = NULL;
	int count = 0;
	OCSP_CERTID *id;
	ocsp_request *request;
	const EVP_MD *cert_id_md = NULL;
	X509 *issuer = NULL;
	STACK_OF(OPENSSL_STRING) *urls;

	if ((request = calloc(1, sizeof(ocsp_request))) == NULL) {
		warn("malloc");
		return NULL;
	}

	if ((request->req = OCSP_REQUEST_new()) == NULL)
		return NULL;

	request->fullchain = read_fullchain(file, &count);
	if (cadir == NULL) {
		/* Drop rpath from pledge, we don't need to read anymore */
		if (pledge("stdio inet dns", NULL) == -1)
			err(1, "pledge");
	}
	if (request->fullchain == NULL)
		return NULL;
	if (count <= 1) {
		warnx("File %s does not contain a cert chain", file);
		return NULL;
	}
	if ((cert = cert_from_chain(request->fullchain)) == NULL) {

	    "[-o staplefile] file\n");
	exit(1);
}

int
main(int argc, char **argv)
{
	const char *cafile = NULL, *cadir = NULL;
	char *host = NULL, *path = "/", *certfile = NULL, *outfile = NULL,
	    *instaple = NULL, *infile = NULL;
	struct addr addrs[MAX_SERVERS_DNS] = {{0}};
	struct source sources[MAX_SERVERS_DNS];
	int i, ch, staplefd = -1, infd = -1, nonce = 1;
	ocsp_request *request = NULL;
	size_t rescount, httphsz = 0, instaplesz = 0;
	struct httphead	*httph = NULL;
	struct httpget *hget;

			infd = STDIN_FILENO;
		else
			infd = open(infile, O_RDONLY);
		if (infd < 0)
			err(1, "Unable to open input file %s", infile);
		nonce = 0; /* Can't validate a nonce on a saved reply */
	}

	if (cafile == NULL) {
		if (access(X509_get_default_cert_file(), R_OK) == 0)
			cafile = X509_get_default_cert_file();
		if (access(X509_get_default_cert_dir(), F_OK) == 0)
			cadir = X509_get_default_cert_dir();
	}

	if (cafile != NULL) {
		if (unveil(cafile, "r") == -1)
			err(1, "unveil");
	}
	if (cadir != NULL) {
		if (unveil(cadir, "r") == -1)
			err(1, "unveil");
	}
	if (unveil(certfile, "r") == -1)
		err(1, "unveil");

	if (pledge("stdio inet rpath dns", NULL) == -1)
		err(1, "pledge");

	/*
	 * Load our certificate and keystore, and build up an
	 * OCSP request based on the full certificate chain
	 * we have been given to check.
	 */
	if ((castore = read_cacerts(cafile, cadir)) == NULL)
		exit(1);
	if ((request = ocsp_request_new_from_cert(cadir, certfile, nonce))
	    == NULL)
		exit(1);

	dspew("Built an %zu byte ocsp request\n", request->size);

	if ((host = url2host(request->url, &port, &path)) == NULL)
		errx(1, "Invalid OCSP url %s from %s", request->url,
		    certfile);

		if (hget == NULL)
			errx(1, "http_get");
		/*
		 * Pledge minimally before fiddling with libcrypto init
		 * routines and parsing untrusted input from someone's OCSP
		 * server.
		 */
		if (cadir == NULL) {
			if (pledge("stdio", NULL) == -1)
				err(1, "pledge");
		} else {
			if (pledge("stdio rpath", NULL) == -1)
				err(1, "pledge");
		}

		dspew("Server at %s returns:\n", host);
		for (i = 0; i < httphsz; i++)
			dspew("	  [%s]=[%s]\n", httph[i].key, httph[i].val);
		dspew("	  [Body]=[%zu bytes]\n", hget->bodypartsz);
		if (hget->bodypartsz <= 0)
			errx(1, "No body in reply from %s", host);

	} else {
		size_t nr = 0;
		instaplesz = 0;

		/*
		 * Pledge minimally before fiddling with libcrypto init
		 */
		if (cadir == NULL) {
			if (pledge("stdio", NULL) == -1)
				err(1, "pledge");
		} else {
			if (pledge("stdio rpath", NULL) == -1)
				err(1, "pledge");
		}

		dspew("Using ocsp response saved in %s:\n", infile);

		/* Use the existing OCSP response saved in infd */
		instaple = calloc(OCSP_MAX_RESPONSE_SIZE, 1);
		if (instaple) {
			while ((nr = read(infd, instaple + instaplesz,

set(
	OPENSSL_SRC
	apps.c
	asn1pars.c
	ca.c
	ciphers.c
	crl.c
	crl2p7.c
	cms.c
	dgst.c
	dh.c
	dhparam.c
	dsa.c
	dsaparam.c
	ec.c
	ecparam.c

openssl_SOURCES = apps.c
openssl_SOURCES += asn1pars.c
openssl_SOURCES += ca.c
openssl_SOURCES += ciphers.c
openssl_SOURCES += crl.c
openssl_SOURCES += crl2p7.c
openssl_SOURCES += cms.c
openssl_SOURCES += dgst.c
openssl_SOURCES += dh.c
openssl_SOURCES += dhparam.c
openssl_SOURCES += dsa.c
openssl_SOURCES += dsaparam.c
openssl_SOURCES += ec.c
openssl_SOURCES += ecparam.c

# Makefile.in generated by automake 1.16.2 from Makefile.am.
# @configure_input@

# Copyright (C) 1994-2020 Free Software Foundation, Inc.

# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without

	$(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
CONFIG_CLEAN_VPATH_FILES =
am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man1dir)"
PROGRAMS = $(bin_PROGRAMS)
am__openssl_SOURCES_DIST = apps.c asn1pars.c ca.c ciphers.c crl.c \
	crl2p7.c cms.c dgst.c dh.c dhparam.c dsa.c dsaparam.c ec.c \
	ecparam.c enc.c errstr.c gendh.c gendsa.c genpkey.c genrsa.c \
	nseq.c ocsp.c openssl.c passwd.c pkcs12.c pkcs7.c pkcs8.c \
	pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c rsa.c \
	rsautl.c s_cb.c s_client.c s_server.c s_socket.c s_time.c \
	sess_id.c smime.c speed.c spkac.c ts.c verify.c version.c \
	x509.c certhash.c certhash_win.c apps_win.c apps_posix.c \
	compat/poll_win.c compat/clock_gettime_osx.c compat/strtonum.c
@BUILD_CERTHASH_TRUE@am__objects_1 = certhash.$(OBJEXT)
@BUILD_CERTHASH_FALSE@am__objects_2 = certhash_win.$(OBJEXT)
@HOST_WIN_TRUE@am__objects_3 = apps_win.$(OBJEXT)
@HOST_WIN_FALSE@am__objects_4 = apps_posix.$(OBJEXT)
am__dirstamp = $(am__leading_dot)dirstamp
@HAVE_POLL_FALSE@@HOST_WIN_TRUE@am__objects_5 =  \
@HAVE_POLL_FALSE@@HOST_WIN_TRUE@	compat/poll_win.$(OBJEXT)
@HAVE_CLOCK_GETTIME_FALSE@@HOST_DARWIN_TRUE@am__objects_6 = compat/clock_gettime_osx.$(OBJEXT)
@HAVE_STRTONUM_FALSE@am__objects_7 = compat/strtonum.$(OBJEXT)
am_openssl_OBJECTS = apps.$(OBJEXT) asn1pars.$(OBJEXT) ca.$(OBJEXT) \
	ciphers.$(OBJEXT) crl.$(OBJEXT) crl2p7.$(OBJEXT) cms.$(OBJEXT) \
	dgst.$(OBJEXT) dh.$(OBJEXT) dhparam.$(OBJEXT) dsa.$(OBJEXT) \
	dsaparam.$(OBJEXT) ec.$(OBJEXT) ecparam.$(OBJEXT) \
	enc.$(OBJEXT) errstr.$(OBJEXT) gendh.$(OBJEXT) \
	gendsa.$(OBJEXT) genpkey.$(OBJEXT) genrsa.$(OBJEXT) \
	nseq.$(OBJEXT) ocsp.$(OBJEXT) openssl.$(OBJEXT) \
	passwd.$(OBJEXT) pkcs12.$(OBJEXT) pkcs7.$(OBJEXT) \
	pkcs8.$(OBJEXT) pkey.$(OBJEXT) pkeyparam.$(OBJEXT) \

DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__maybe_remake_depfiles = depfiles
am__depfiles_remade = ./$(DEPDIR)/apps.Po ./$(DEPDIR)/apps_posix.Po \
	./$(DEPDIR)/apps_win.Po ./$(DEPDIR)/asn1pars.Po \
	./$(DEPDIR)/ca.Po ./$(DEPDIR)/certhash.Po \
	./$(DEPDIR)/certhash_win.Po ./$(DEPDIR)/ciphers.Po \
	./$(DEPDIR)/cms.Po ./$(DEPDIR)/crl.Po ./$(DEPDIR)/crl2p7.Po \
	./$(DEPDIR)/dgst.Po ./$(DEPDIR)/dh.Po ./$(DEPDIR)/dhparam.Po \
	./$(DEPDIR)/dsa.Po ./$(DEPDIR)/dsaparam.Po ./$(DEPDIR)/ec.Po \
	./$(DEPDIR)/ecparam.Po ./$(DEPDIR)/enc.Po \
	./$(DEPDIR)/errstr.Po ./$(DEPDIR)/gendh.Po \
	./$(DEPDIR)/gendsa.Po ./$(DEPDIR)/genpkey.Po \
	./$(DEPDIR)/genrsa.Po ./$(DEPDIR)/nseq.Po ./$(DEPDIR)/ocsp.Po \
	./$(DEPDIR)/openssl.Po ./$(DEPDIR)/passwd.Po \
	./$(DEPDIR)/pkcs12.Po ./$(DEPDIR)/pkcs7.Po \
	./$(DEPDIR)/pkcs8.Po ./$(DEPDIR)/pkey.Po \

	-DLIBRESSL_INTERNAL -D__BEGIN_HIDDEN_DECLS= \
	-D__END_HIDDEN_DECLS=
dist_man_MANS = openssl.1
openssl_LDADD = $(abs_top_builddir)/ssl/libssl.la \
	$(abs_top_builddir)/crypto/libcrypto.la $(PLATFORM_LDADD) \
	$(PROG_LDADD)
openssl_SOURCES = apps.c asn1pars.c ca.c ciphers.c crl.c crl2p7.c \
	cms.c dgst.c dh.c dhparam.c dsa.c dsaparam.c ec.c ecparam.c \
	enc.c errstr.c gendh.c gendsa.c genpkey.c genrsa.c nseq.c \
	ocsp.c openssl.c passwd.c pkcs12.c pkcs7.c pkcs8.c pkey.c \
	pkeyparam.c pkeyutl.c prime.c rand.c req.c rsa.c rsautl.c \
	s_cb.c s_client.c s_server.c s_socket.c s_time.c sess_id.c \
	smime.c speed.c spkac.c ts.c verify.c version.c x509.c \
	$(am__append_1) $(am__append_2) $(am__append_3) \
	$(am__append_4) $(am__append_5) $(am__append_6) \
	$(am__append_7)
noinst_HEADERS = apps.h progs.h s_apps.h testdsa.h testrsa.h \
	timeouts.h
EXTRA_DIST = cert.pem openssl.cnf x509v3.cnf CMakeLists.txt
all: all-am

.SUFFIXES:
.SUFFIXES: .c .lo .o .obj

@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/apps_posix.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/apps_win.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/asn1pars.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ca.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/certhash.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/certhash_win.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ciphers.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/cms.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/crl.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/crl2p7.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dgst.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dh.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dhparam.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dsa.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dsaparam.Po@am__quote@ # am--include-marker

	-rm -f ./$(DEPDIR)/apps_posix.Po
	-rm -f ./$(DEPDIR)/apps_win.Po
	-rm -f ./$(DEPDIR)/asn1pars.Po
	-rm -f ./$(DEPDIR)/ca.Po
	-rm -f ./$(DEPDIR)/certhash.Po
	-rm -f ./$(DEPDIR)/certhash_win.Po
	-rm -f ./$(DEPDIR)/ciphers.Po
	-rm -f ./$(DEPDIR)/cms.Po
	-rm -f ./$(DEPDIR)/crl.Po
	-rm -f ./$(DEPDIR)/crl2p7.Po
	-rm -f ./$(DEPDIR)/dgst.Po
	-rm -f ./$(DEPDIR)/dh.Po
	-rm -f ./$(DEPDIR)/dhparam.Po
	-rm -f ./$(DEPDIR)/dsa.Po
	-rm -f ./$(DEPDIR)/dsaparam.Po

	-rm -f ./$(DEPDIR)/apps_posix.Po
	-rm -f ./$(DEPDIR)/apps_win.Po
	-rm -f ./$(DEPDIR)/asn1pars.Po
	-rm -f ./$(DEPDIR)/ca.Po
	-rm -f ./$(DEPDIR)/certhash.Po
	-rm -f ./$(DEPDIR)/certhash_win.Po
	-rm -f ./$(DEPDIR)/ciphers.Po
	-rm -f ./$(DEPDIR)/cms.Po
	-rm -f ./$(DEPDIR)/crl.Po
	-rm -f ./$(DEPDIR)/crl2p7.Po
	-rm -f ./$(DEPDIR)/dgst.Po
	-rm -f ./$(DEPDIR)/dh.Po
	-rm -f ./$(DEPDIR)/dhparam.Po
	-rm -f ./$(DEPDIR)/dsa.Po
	-rm -f ./$(DEPDIR)/dsaparam.Po

# $OpenBSD: cert.pem,v 1.20 2020/04/10 12:13:17 sthen Exp $
### /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068

=== /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6047274297262753887 (0x53ec3beefbb2485f)

### AC Camerfirma S.A.

=== /C=EU/L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287/O=AC Camerfirma S.A./CN=Chambers of Commerce Root - 2008
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a3:da:42:7e:a4:b1:ae:da
    Signature Algorithm: sha1WithRSAEncryption
        Validity
            Not Before: Aug  1 12:29:50 2008 GMT
            Not After : Jul 31 12:29:50 2038 GMT
        Subject: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008
        X509v3 extensions:
            X509v3 Basic Constraints: critical

OGcEMeyP84LG3rlV8zsxkVrctQgVrXYlCg17LofiDKYGvCYQbTed7N14jHyAxfDZ
d0jQ
-----END CERTIFICATE-----
=== /C=EU/L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287/O=AC Camerfirma S.A./CN=Global Chambersign Root - 2008
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c9:cd:d3:e9:d5:7d:23:ce
    Signature Algorithm: sha1WithRSAEncryption
        Validity
            Not Before: Aug  1 12:31:40 2008 GMT
            Not After : Jul 31 12:31:40 2038 GMT
        Subject: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008
        X509v3 extensions:
            X509v3 Basic Constraints: critical

9i0b2whxIdIA6GO9mif78DluXeo9pcmBqqNbIJhFXRbb/egQbeOc4OO9X4Ri83Bk
M6DLJC9wuoihKqB1+IGuYgbEgds5bimwHvouXKNCMEAwDwYDVR0TAQH/BAUwAwEB
/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFNPsxzplbszh2naaVvuc84ZtV+WB
MAoGCCqGSM49BAMDA2gAMGUCMDqLIfG9fhGt0O9Yli/W651+kI0rz2ZVwyzjKKlw
CkcO8DdZEv8tmZQoTipPNU0zWgIxAOp1AE47xDqUEpHJWEadIRNyp4iciuRMStuW
1KyLa2tJElMzrdfkviT8tQp21KW8EA==
-----END CERTIFICATE-----




### Atos

=== /CN=Atos TrustedRoot 2011/O=Atos/C=DE
Certificate:
    Data:
        Version: 3 (0x2)

dmNKekBlk4f4HoCMhuWG1o8O/FMsYOgWYRqiPkN7zTlgVGr18okmAWiDSKIz6MkE
kbIRNBE+6tBDGR8Dk5AM/1E9V/RBbuHLoL7ryWPNbczk+DaqaJ3tvV2XcEQNtg41
3OEMXbugUZTLfhbrES+jkkXITHHZvMmZUldGL1DPvTVp9D0VzgalLA8+9oG6lLvD
u79leNKGef9JOxqDDPDeeOzI8k1MGt6CKfjBWtrt7uYnXuhF0J0cUahoq0Tj0Itq
4/g7u9xN12TyUb7mqqta6THuBrxzvxNiCp/HuZc=
-----END CERTIFICATE-----














































































































### certSIGN

=== /C=RO/O=certSIGN/OU=certSIGN ROOT CA
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 35210227249154 (0x200605167002)

o2M3IUxExJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS
/jQ6fbjpKdx2qcgw+BRxgMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2z
Gp1iro2C6pSe3VkQw63d4k3jMdXH7OjysP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTE
W9c3rkIO3aQab3yIVMUWbuF6aC74Or8NpDyJO3inTmODBCEIZ43ygknQW/2xzQ+D
hNQ+IIX3Sj0rnP0qCglN6oH4EZw=
-----END CERTIFICATE-----

### Comodo CA Limited

=== /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
    Signature Algorithm: sha1WithRSAEncryption
        Validity
            Not Before: Jan  1 00:00:00 2004 GMT
            Not After : Dec 31 23:59:59 2028 GMT
        Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.comodoca.com/AAACertificateServices.crl

                Full Name:
                  URI:http://crl.comodo.net/AAACertificateServices.crl

SHA1 Fingerprint=D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49
SHA256 Fingerprint=D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4
-----BEGIN CERTIFICATE-----
MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
-----END CERTIFICATE-----

### COMODO CA Limited

=== /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO Certification Authority
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:

jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL
S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb
QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl
0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB
NVOFBkpdn627G190
-----END CERTIFICATE-----
























































### Cybertrust, Inc

=== /O=Cybertrust, Inc/CN=Cybertrust Global Root
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:

3uDx1MYkCenBz1UbtDDZzhr+BlGmFaQt77JLvyAoJUnRpjZ3NOhk31KxEcdzes05
nsKtjHEh8lprr988TlWvsoRlFIm5d8sqMb7Po23Pb0iUMkZv53GMoKaEGTcH8gNF
CSuGdXzfX2lXANtu2KZyIktQ1HWYVt+3GP9DQ1CuekR78HlR10M9p9OB0/DJT7na
xpeG0ILD5EJt/rDiZE4OJudANCa1CInXCGNjOCd1HjPqbqjdn5lPdE2BiYBL3ZqX
KVwvvoFBuYz/6n1gBp7N1z3TLqMVvKjmJuVvw9y4AyHqnxbxLFS1
-----END CERTIFICATE-----













































### Dhimyotis

=== /C=FR/O=Dhimyotis/CN=Certigna
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fe:dc:e3:01:0f:c9:48:ff
    Signature Algorithm: sha1WithRSAEncryption
        Validity
            Not Before: Jun 29 15:13:05 2007 GMT
            Not After : Jun 29 15:13:05 2027 GMT
        Subject: C=FR, O=Dhimyotis, CN=Certigna
        X509v3 extensions:
            X509v3 Basic Constraints: critical

### Disig a.s.

=== /C=SK/L=Bratislava/O=Disig a.s./CN=CA Disig Root R2
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            92:b8:88:db:b0:8a:c1:63
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Jul 19 09:15:30 2012 GMT
            Not After : Jul 19 09:15:30 2042 GMT
        Subject: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2
        X509v3 extensions:
            X509v3 Basic Constraints: critical

FiWnWAjLb1NBnEg4R2gz0dfHj9R0IdTDBZB6/86WiLEVKV0jq9BgoRJP3vQXzTLl
yb/IQ639Lo7xr+L0mPoSHyDYwKcMhcWQ9DstliaxLL5Mq+ux0orJ23gTDx4JnW2P
AJ8C2sH6H3p6CcRK5ogql5+Ji/03X186zjhZhkuvcQu02PJwT58yE+Owp1fl2tpD
y4Q08ijE6m30Ku/Ba3ba+367hTzSU8JNvnHhRdH9I2cNE3X7z2VnIp2usAnRCf8d
NL/+I5c30jn6PQ0GC7TbO6Orb1wdtn7os4I07QZcJA==
-----END CERTIFICATE-----

### eMudhra Inc

=== /C=US/OU=emSign PKI/O=eMudhra Inc/CN=emSign ECC Root CA - C3
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:71:b6:82:56:b8:12:7c:9c:a8
    Signature Algorithm: ecdsa-with-SHA384
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C=US, OU=emSign PKI, O=eMudhra Inc, CN=emSign ECC Root CA - C3
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
SHA1 Fingerprint=B6:AF:43:C2:9B:81:53:7D:F6:EF:6B:C3:1F:1F:60:15:0C:EE:48:66
SHA256 Fingerprint=BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3
-----BEGIN CERTIFICATE-----
MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG
EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx
IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw
MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND
IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci
MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti
sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O
BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c
3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J
0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ==
-----END CERTIFICATE-----
=== /C=US/OU=emSign PKI/O=eMudhra Inc/CN=emSign Root CA - C1
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ae:cf:00:ba:c4:cf:32:f8:43:b2
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C=US, OU=emSign PKI, O=eMudhra Inc, CN=emSign Root CA - C1
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
SHA1 Fingerprint=E7:2E:F1:DF:FC:B2:09:28:CF:5D:D4:D5:67:37:B1:51:CB:86:4F:01
SHA256 Fingerprint=12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F
-----BEGIN CERTIFICATE-----
MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG
A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg
SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw
MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v
dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ
BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ
HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH
3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH
GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c
xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1
aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq
TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87
/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4
kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG
YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT
+xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo
WXzhriKi4gp6D/piq1JM4fHfyr6DDUI=
-----END CERTIFICATE-----

### eMudhra Technologies Limited

=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC Root CA - G3
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:f6:07:a9:68:70:0e:da:8b:84
    Signature Algorithm: ecdsa-with-SHA384
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
SHA1 Fingerprint=30:43:FA:4F:F2:57:DC:A0:C3:80:EE:2E:58:EA:78:B2:3F:E6:BB:C1
SHA256 Fingerprint=86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B
-----BEGIN CERTIFICATE-----
MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
+JbNR6iC8hZVdyR+EhCVBCyj
-----END CERTIFICATE-----
=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign Root CA - G1
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:f5:e4:62:0c:6c:58:ed:d6:d8
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign Root CA - G1
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
SHA1 Fingerprint=8A:C7:AD:8F:73:AC:4E:C1:B5:75:4D:A5:40:F4:FC:CF:7C:B5:8E:8C
SHA256 Fingerprint=40:F6:AF:03:46:A9:9A:A1:CD:1D:55:5A:4E:9C:CE:62:C7:F9:63:46:03:EE:40:66:15:83:3D:C8:C8:D0:03:67
-----BEGIN CERTIFICATE-----
MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD
VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU
ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH
MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO
MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv
Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz
f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO
8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq
d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM
tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt
Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB
o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD
AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x
PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM
wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d
GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH
6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby
RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx
iN66zB+Afko=
-----END CERTIFICATE-----

### Entrust, Inc.

=== /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1246989352 (0x4a538c28)

ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEVDMTB2MBAGByqGSM49AgEGBSuBBAAi
A2IABIQTydC6bUF74mzQ61VfZgIaJPRbiWlH47jCffHyAsWfoPZb1YsGGYZPUxBt
ByQnoaD41UcZYUx9ypMn6nQM72+WCf5j7HBdNq1nd67JnXxVRDqiY1Ef9eNi1KlH
Bz7MIKNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
BBYEFLdj5xrdjekIplWDpOBqUEFlEUJJMAoGCCqGSM49BAMDA2cAMGQCMGF52OVC
R98crlOZF7ZvHH3hvxGU0QOIdeSNiaSKd0bebWHvAvX7td/M/k7//qnmpwIwW5nX
hTcGtXsI/esni0qU+eH6p44mCOh8kmhtc9hvJqwhAriZtyZBWyVgrtBIGu4G
-----END CERTIFICATE-----
=== /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2015 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G4
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d9:b5:43:7f:af:a9:39:0f:00:00:00:00:55:65:ad:58
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: May 27 11:11:16 2015 GMT
            Not After : Dec 27 11:41:16 2037 GMT
        Subject: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2015 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G4
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                9F:38:C4:56:23:C3:39:E8:A0:71:6C:E8:54:4C:E4:E8:3A:B1:BF:67
SHA1 Fingerprint=14:88:4E:86:26:37:B0:26:AF:59:62:5C:40:77:EC:35:29:BA:96:01
SHA256 Fingerprint=DB:35:17:D1:F6:73:2A:2D:5A:B9:7C:53:3E:C7:07:79:EE:32:70:A6:2F:B4:AC:42:38:37:24:60:E6:F0:1E:88
-----BEGIN CERTIFICATE-----
MIIGSzCCBDOgAwIBAgIRANm1Q3+vqTkPAAAAAFVlrVgwDQYJKoZIhvcNAQELBQAw
gb4xCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQL
Ex9TZWUgd3d3LmVudHJ1c3QubmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykg
MjAxNSBFbnRydXN0LCBJbmMuIC0gZm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMjAw
BgNVBAMTKUVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc0
MB4XDTE1MDUyNzExMTExNloXDTM3MTIyNzExNDExNlowgb4xCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1
c3QubmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxNSBFbnRydXN0LCBJ
bmMuIC0gZm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMjAwBgNVBAMTKUVudHJ1c3Qg
Um9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc0MIICIjANBgkqhkiG9w0B
AQEFAAOCAg8AMIICCgKCAgEAsewsQu7i0TD/pZJH4i3DumSXbcr3DbVZwbPLqGgZ
2K+EbTBwXX7zLtJTmeH+H17ZSK9dE43b/2MzTdMAArzE+NEGCJR5WIoV3imz/f3E
T+iq4qA7ec2/a0My3dl0ELn39GjUu9CH1apLiipvKgS1sqbHoHrmSKvS0VnM1n4j
5pds8ELl3FFLFUHtSUrJ3hCX1nbB76W1NhSXNdh4IjVS70O92yfbYVaCNNzLiGAM
C1rlLAHGVK/XqsEQe9IFWrhAnoanw5CGAlZSCXqc0ieCU0plUmr1POeo8pyvi73T
DtTUXm6Hnmo9RR3RXRv06QqsYJn7ibT/mCzPfB3pAqoEmh643IhuJbNsZvc8kPNX
wbMv9W3y+8qh+CmdRouzavbmZwe+LGcKKh9asj5XxNMhIWNlUpEbsZmOeX7m640A
2Vqq6nPopIICR5b+W45UYaPrL0swsIsjdXJ8ITzI9vF01Bx7owVV7rtNOzK+mndm
nqxpkCIHH2E6lr7lmk/MBTwoWdPBDFSoWWG9yHJM6Nyfh3+9nEg2XpWjDrk4JFX8
dWbrAuMINClKxuMrLzOg2qOGpRKX/YAr2hRC45K9PvJdXmd0LhyIRyk0X+IyqJwl
N4y6mACXi0mWHv0liqzc2thddG5msP9E36EYxr5ILzeUePiVSj9/E15dWf10hkNj
c0kCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYD
VR0OBBYEFJ84xFYjwznooHFs6FRM5Og6sb9nMA0GCSqGSIb3DQEBCwUAA4ICAQAS
5UKme4sPDORGpbZgQIeMJX6tuGguW8ZAdjwD+MlZ9POrYs4QjbRaZIxowLByQzTS
Gwv2LFPSypBLhmb8qoMi9IsabyZIrHZ3CL/FmFz0Jomee8O5ZDIBf9PD3Vht7LGr
hFV0d4QEJ1JrhkzO3bll/9bGXp+aEJlLdWr+aumXIOTkdnrG0CSqkM0gkLpHZPt/
B7NTeLUKYvJzQ85BK4FqLoUWlFPUa19yIqtRLULVAJyZv967lDtX/Zr1hstWO1uI
AeV8KEsD+UmDfLJ/fOPtjqF/YFOOVZ1QNBIPt5d7bIdKROf1beyAN/BYGW5KaHbw
H5Lk6rWS02FREAutp9lfx1/cH6NcjKF+m7ee01ZvZl4HliDtC3T7Zk6LERXpgUl+
b7DUUH8i119lAg2m9IUe2K4GS0qn0jFmwvjO5QimpAKWRGhXxNUzzxkvFMSUHHuk
2fCfDrGA4tGeEWSpiBE6doLlYsKA2KSD7ZPvfC+QsDJMlhVoSFLUmQjAJOgc47Ol
IQ6SwJAfzyBfyjs4x7dtOvPmRLgOMWuIjnDrnBdSqEGULoe256YSxXXfW8AKbnuk
5F6G+TaU33fD6Q3AOfF5u0aOq0NZJ7cguyPpVkAh7DE9ZapD8j3fcEThuk0mEDuY
n/PIjhs4ViFqUZPTkcpG2om3PVODLAgfi49T3f+sHw==
-----END CERTIFICATE-----
=== /C=US/O=Entrust, Inc./OU=www.entrust.net/CPS is incorporated by reference/OU=(c) 2006 Entrust, Inc./CN=Entrust Root Certification Authority
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1164660820 (0x456b5054)
    Signature Algorithm: sha1WithRSAEncryption

mEEIjEy82tvuJxuC52pF7BaLT4Wg87JwvVqWuspube5Gi27nKi6Wsxkz67SfqLI3
7piol7Yutmcn1KZJ/RyTZXaeQi/cImyaT/JaFTmxcdcrUehtHJjA2Sr0oYJ71clB
oiMBdDhViw+5LmeiIAQ32pwL0xch4I+XeTRvhEgCIDMb5jREn5Fw9IBehEPCKdJs
EhTkYY2sEJCehFC78JZvRZ+K88psT/oROhUVRsPNH4NbLUES7VBnQRM9IauUiqpO
fMGx+6fWtScvl6tu4B3i0RwsH0Ti/L6RoZz71ilTc4afU9hDDl3WY4JxHYB0yvbi
AmvZWg==
-----END CERTIFICATE-----
=== /C=HK/ST=Hong Kong/L=Hong Kong/O=Hongkong Post/CN=Hongkong Post Root CA 3
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:16:5f:8a:4c:a5:ec:00:c9:93:40:df:c4:c6:ae:23:b8:1c:5a:a4
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Jun  3 02:29:46 2017 GMT
            Not After : Jun  3 02:29:46 2042 GMT
        Subject: C=HK, ST=Hong Kong, L=Hong Kong, O=Hongkong Post, CN=Hongkong Post Root CA 3
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier: 
                keyid:17:9D:CD:1E:8B:D6:39:2B:70:D3:5C:D4:A0:B8:1F:B0:00:FC:C5:61

            X509v3 Subject Key Identifier: 
                17:9D:CD:1E:8B:D6:39:2B:70:D3:5C:D4:A0:B8:1F:B0:00:FC:C5:61
SHA1 Fingerprint=58:A2:D0:EC:20:52:81:5B:C1:F3:F8:64:02:24:4E:C2:8E:02:4B:02
SHA256 Fingerprint=5A:2F:C0:3F:0C:83:B0:90:BB:FA:40:60:4B:09:88:44:6C:76:36:18:3D:F9:84:6E:17:10:1A:44:7F:B8:EF:D6
-----BEGIN CERTIFICATE-----
MIIFzzCCA7egAwIBAgIUCBZfikyl7ADJk0DfxMauI7gcWqQwDQYJKoZIhvcNAQEL
BQAwbzELMAkGA1UEBhMCSEsxEjAQBgNVBAgTCUhvbmcgS29uZzESMBAGA1UEBxMJ
SG9uZyBLb25nMRYwFAYDVQQKEw1Ib25na29uZyBQb3N0MSAwHgYDVQQDExdIb25n
a29uZyBQb3N0IFJvb3QgQ0EgMzAeFw0xNzA2MDMwMjI5NDZaFw00MjA2MDMwMjI5
NDZaMG8xCzAJBgNVBAYTAkhLMRIwEAYDVQQIEwlIb25nIEtvbmcxEjAQBgNVBAcT
CUhvbmcgS29uZzEWMBQGA1UEChMNSG9uZ2tvbmcgUG9zdDEgMB4GA1UEAxMXSG9u
Z2tvbmcgUG9zdCBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
AoICAQCziNfqzg8gTr7m1gNt7ln8wlffKWihgw4+aMdoWJwcYEuJQwy51BWy7sFO
dem1p+/l6TWZ5Mwc50tfjTMwIDNT2aa71T4Tjukfh0mtUC1Qyhi+AViiE3CWu4mI
VoBc+L0sPOFMV4i707mV78vH9toxdCim5lSJ9UExyuUmGs2C4HDaOym71QP1mbpV
9WTRYA6ziUm4ii8F0oRFKHyPaFASePwLtVPLwpgchKOesL4jpNrcyCse2m5FHomY
2vkALgbpDDtw1VAliJnLzXNg99X/NWfFobxeq81KuEXryGgeDQ0URhLj0mRiikKY
vLTGCAj4/ahMZJx2Ab0vqWwzD9g/KLg8aQFChn5pwckGyuV6RmXpwtZQQS4/t+Tt
bNe/JgERohYpSms0BpDsE9K2+2p20jzt8NYt3eEV7KObLyzJPivkaTv/ciWxNoZb
x39ri1UbSsUgYT2uy1DhCDq+sI9jQVMwCFk8mB13umOResoQUGC/8Ne8lYePl8X+
l2oBlKN8W4UdKjk60FSh0Tlxnf0h+bV78OLgAo9uliQlLKAeLKjEiafv7ZkGL7YK
TE/bosw3Gq9HhS2KX8Q0NEwA/RiTZxPRN+ZItIsGxVd7GYYKecsAyVKvQv83j+Gj
Hno9UKtjBucVtT+2RTeUN7F+8kjDf8V1/peNRY8apxpyKBpADwIDAQABo2MwYTAP
BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQXnc0e
i9Y5K3DTXNSguB+wAPzFYTAdBgNVHQ4EFgQUF53NHovWOStw01zUoLgfsAD8xWEw
DQYJKoZIhvcNAQELBQADggIBAFbVe27mIgHSQpsY1Q7XZiNc4/6gx5LS6ZStS6LG
7BJ8dNVI0lkUmcDrudHr9EgwW62nV3OZqdPlt9EuWSRY3GguLmLYauRwCy0gUCCk
MpXRAJi70/33MvJJrsZ64Ee+bs7Lo3I6LWldy8joRTnU+kLBEUx3XZL7av9YROXr
gZ6voJmtvqkBZss4HTzfQx/0TW60uhdG/H39h4F5ag0zD/ov+BS5gLNdTaqX4fnk
GMX41TiMJjz98iji7lpJiCzfeT2OnpA8vUFKOt1b9pq0zj8lMH8yfaIDlNDceqFS
3m6TjRgm/VWsvY+b0s+v54Ysyx8Jb6NvqYTUc79NoXQbTiNg8swOqn+knEwlqLJm
Ozj/2ZQw9nKEvmhVEA/GcywWaZMH/rFF7buiVWqw2rVKAiUnhde3t4ZEFolsgCs+
l6mc1X5VTMbeRRAc6uk7nwNT7u56AQIWeNTowr5GdogTPyK7SBIdUgC0An4hGh6c
JfTzPV4e0hz5sy229zdcxsshTrD3mUcYhcErulWuBurQB7Lcq9CClnXO0lD+mefP
L5/ndtFhKvshuzHQqp9HpLIiyhY6UFfEW0NnxWViA0kB60PZ2Pierc+xYw5F9KBa
LJstxabArahH9CdMOA0uG0k7UvToiIMrVCjU8jVStDKDYmlkDJGcn5fqdBb9HxEG
mpv0
-----END CERTIFICATE-----

### IdenTrust

=== /C=US/O=IdenTrust/CN=IdenTrust Commercial Root CA 1
Certificate:
    Data:
        Version: 3 (0x2)

### Microsec Ltd.

=== /C=HU/L=Budapest/O=Microsec Ltd./CN=Microsec e-Szigno Root CA 2009/emailAddress=info@e-szigno.hu
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c2:7e:43:04:4e:47:3f:19
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Jun 16 11:30:18 2009 GMT
            Not After : Dec 30 11:30:18 2029 GMT
        Subject: C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009/emailAddress=info@e-szigno.hu
        X509v3 extensions:
            X509v3 Basic Constraints: critical

vTY4SUmH9A4U8OmHuD+nT3pajnnUk+S7aFKErGzp85hwVXIy+TSrK0m1zSBi5Dp6
Z2Orltxtrpfs/J92VoguZs9btsmksNcFuuEnL5O7Jiqik7Ab846+HUCjuTaPPoIa
Gl6I6lD4WeKDRikL40Rc4ZW2aZCaFG+XroHPaO+Zmr615+F/+PoTRxZMzG0IQOeL
eG9QgkRQP2YGiqtDhFZKDyAthg710tvSeopLzaXoTvFeJiUBWSOgftL2fiFX1ye8
FVdMpEbB4IMeDExNH08GGeL5qPQ6gqGyeUN51q1veieQA6TqJIc/2b3Z6fJfUEkc
7uzXLg==
-----END CERTIFICATE-----
























































=== /C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G3
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10003001 (0x98a239)
    Signature Algorithm: sha256WithRSAEncryption
        Validity

### SwissSign AG

=== /C=CH/O=SwissSign AG/CN=SwissSign Gold CA - G2
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bb:40:1c:43:f5:5e:4f:b0
    Signature Algorithm: sha1WithRSAEncryption
        Validity
            Not Before: Oct 25 08:30:35 2006 GMT
            Not After : Oct 25 08:30:35 2036 GMT
        Subject: C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2
        X509v3 extensions:
            X509v3 Key Usage: critical

### TrustCor Systems S. de R.L.

=== /C=PA/ST=Panama/L=Panama City/O=TrustCor Systems S. de R.L./OU=TrustCor Certificate Authority/CN=TrustCor ECA-1
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:82:2c:5f:1c:62:d0:40
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Feb  4 12:32:33 2016 GMT
            Not After : Dec 31 17:28:07 2029 GMT
        Subject: C=PA, ST=Panama, L=Panama City, O=TrustCor Systems S. de R.L., OU=TrustCor Certificate Authority, CN=TrustCor ECA-1
        X509v3 extensions:
            X509v3 Subject Key Identifier: 

WJZpTdwHjFGTot+fDz2LYLSCjaoITmJF4PkL0uDgPFveXHEnJcLmA4GLEFPjx1Wi
tJ/X5g==
-----END CERTIFICATE-----
=== /C=PA/ST=Panama/L=Panama City/O=TrustCor Systems S. de R.L./OU=TrustCor Certificate Authority/CN=TrustCor RootCert CA-1
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            da:9b:ec:71:f3:03:b0:19
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Feb  4 12:32:16 2016 GMT
            Not After : Dec 31 17:23:16 2029 GMT
        Subject: C=PA, ST=Panama, L=Panama City, O=TrustCor Systems S. de R.L., OU=TrustCor Certificate Authority, CN=TrustCor RootCert CA-1
        X509v3 extensions:
            X509v3 Subject Key Identifier: 

.\" $OpenBSD: openssl.1,v 1.121 2020/04/25 19:18:40 schwarze Exp $
.\" ====================================================================
.\" Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\"

.\" SUCH DAMAGE.
.\"
.\" The licence and distribution terms for any publically available version or
.\" derivative of this code cannot be changed.  i.e. this code cannot simply be
.\" copied and put under another distribution licence
.\" [including the GNU Public Licence.]
.\"
.Dd $Mdocdate: April 25 2020 $
.Dt OPENSSL 1
.Os
.Sh NAME
.Nm openssl
.Nd OpenSSL command line tool
.Sh SYNOPSIS
.Nm

.Cm no- Ns Ar command
is not able to detect pseudo-commands such as
.Cm quit ,
.Cm list- Ns Ar ... Ns Cm -commands ,
or
.Cm no- Ns Ar command
itself.
.Tg asn1parse
.Sh ASN1PARSE
.Bl -hang -width "openssl asn1parse"
.It Nm openssl asn1parse
.Bk -words
.Op Fl i
.Op Fl dlimit Ar number
.Op Fl dump

.It Fl strparse Ar offset
Parse the content octets of the ASN.1 object starting at
.Ar offset .
This option can be used multiple times to
.Qq drill down
into a nested structure.
.El
.Tg ca
.Sh CA
.Bl -hang -width "openssl ca"
.It Nm openssl ca
.Bk -words
.Op Fl batch
.Op Fl cert Ar file
.Op Fl config Ar file

several valid certificate entries may have the exact same subject.
The default value is
.Cm yes .
.It Cm x509_extensions
The same as
.Fl extensions .
.El
.Tg ciphers
.Sh CIPHERS
.Nm openssl ciphers
.Op Fl hVv
.Op Ar control
.Pp
The
.Nm ciphers

cipher name, and a complete description of protocol version,
key exchange, authentication, encryption, and mac algorithms.
.It Fl v
Like
.Fl V ,
but without cipher suite codes.
.El
.Tg cms
.Sh CMS
.Bl -hang -width "openssl cms"
.It Nm openssl cms
.Bk -words
.Oo
.Fl aes128 | aes192 | aes256 | camellia128 |
.Fl camellia192 | camellia256 | des | des3 |
.Fl rc2-40 | rc2-64 | rc2-128
.Oc
.Op Fl CAfile Ar file
.Op Fl CApath Ar directory
.Op Fl binary
.Op Fl certfile Ar file
.Op Fl certsout Ar file
.Op Fl cmsout
.Op Fl compress
.Op Fl content Ar file
.Op Fl crlfeol
.Op Fl data_create
.Op Fl data_out
.Op Fl debug_decrypt
.Op Fl decrypt
.Op Fl digest_create
.Op Fl digest_verify
.Op Fl econtent_type Ar type
.Op Fl encrypt
.Op Fl EncryptedData_decrypt
.Op Fl EncryptedData_encrypt
.Op Fl from Ar addr
.Op Fl in Ar file
.Op Fl inform Cm der | pem | smime
.Op Fl inkey Ar file
.Op Fl keyform Cm der | pem
.Op Fl keyid
.Op Fl keyopt Ar nm:v
.Op Fl md Ar digest
.Op Fl no_attr_verify
.Op Fl no_content_verify
.Op Fl no_signer_cert_verify
.Op Fl noattr
.Op Fl nocerts
.Op Fl nodetach
.Op Fl nointern
.Op Fl nooldmime
.Op Fl noout
.Op Fl nosigs
.Op Fl nosmimecap
.Op Fl noverify
.Op Fl out Ar file
.Op Fl outform Cm der | pem | smime
.Op Fl passin Ar src
.Op Fl print
.Op Fl pwri_password Ar arg
.Op Fl rctform Cm der | pem | smime
.Op Fl receipt_request_all | receipt_request_first
.Op Fl receipt_request_from Ar addr
.Op Fl receipt_request_print
.Op Fl receipt_request_to Ar addr
.Op Fl recip Ar file
.Op Fl resign
.Op Fl secretkey Ar key
.Op Fl secretkeyid Ar id
.Op Fl sign
.Op Fl sign_receipt
.Op Fl signer Ar file
.Op Fl stream | indef | noindef
.Op Fl subject Ar s
.Op Fl text
.Op Fl to Ar addr
.Op Fl uncompress
.Op Fl verify
.Op Fl verify_receipt Ar file
.Op Fl verify_retcode
.Op Ar cert.pem ...
.Ek
.El
.Pp
The
.Nm cms
command handles S/MIME v3.1 mail.
It can encrypt, decrypt, sign and verify, compress and uncompress S/MIME
messages.
.Pp
The MIME message must be sent without any blank lines between the headers and
the output.
Some mail programs will automatically add a blank line.
Piping the mail directly to sendmail is one way to achieve the correct format.
.Pp
The supplied message to be signed or encrypted must include the necessary MIME
headers or many S/MIME clients won't display it properly (if at all).
You can use the
.Fl text
option to automatically add plain text headers.
.Pp
A "signed and encrypted" message is one where a signed message is then
encrypted.
This can be produced by encrypting an already signed message.
.Pp
There are various operation options that set the type of operation to be
performed.
The meaning of the other options varies according to the operation type.
.Bl -tag -width "XXXX"
.It Fl encrypt
Encrypt mail for the given recipient certificates.
Input file is the message to be encrypted.
The output file is the encrypted mail in MIME format.
The actual CMS type is EnvelopedData.
Note that no revocation check is done for the recipient cert, so if that
key has been compromised, others may be able to decrypt the text.
.It Fl decrypt
Decrypt mail using the supplied certificate and private key.
Expects an encrypted mail message in MIME format for the input file.
The decrypted mail is written to the output file.
.It Fl sign
Sign mail using the supplied certificate and private key.
Input file is the message to be signed.
The signed message in MIME format is written to the output file.
.It Fl verify
Verify signed mail.
Expects a signed mail message on input and outputs the signed data.
Both clear text and opaque signing are supported.
.It Fl cmsout
Take an input message and write out a PEM encoded CMS structure.
.It Fl resign
Resign a message.
Take an existing message and one or more new signers.
This operation uses an existing message digest when adding a new signer.
This means that attributes must be present in at least one existing
signer using the same message digest or this operation will fail.
.It Fl data_create
Create a CMS Data type.
.It Fl data_out
Output a content from the input CMS Data type.
.It Fl digest_create
Create a CMS DigestedData type.
.It Fl digest_verify
Verify a CMS DigestedData type and output the content.
.It Fl compress
Create a CMS CompressedData type.
Must be compiled with zlib support for this option to work.
.It Fl uncompress
Uncompress a CMS CompressedData type and output the content.
Must be compiled with zlib support for this option to work.
.It Fl EncryptedData_encrypt
Encrypt a content using supplied symmetric key and algorithm using a
CMS EncryptedData type.
.It Fl EncryptedData_decrypt
Decrypt a CMS EncryptedData type using supplied symmetric key.
.It Fl sign_receipt
Generate and output a signed receipt for the supplied message.
The input message must contain a signed receipt request.
Functionality is otherwise similar to the
.Fl sign
operation.
.It Xo
.Fl verify_receipt Ar file
.Xc
Verify a signed receipt in file.
The input message must contain the original receipt request.
Functionality is otherwise similar to the
.Fl verify
operation.
.El
.Pp
The remaining options are as follows:
.Bl -tag -width "XXXX"
.It Xo
.Fl aes128 | aes192 | aes256 | camellia128 |
.Fl camellia192 | camellia256 | des | des3 |
.Fl rc2-40 | rc2-64 | rc2-128
.Xc
The encryption algorithm to use.
128-, 192-, or 256-bit AES, 128-, 192-, or 256-bit CAMELLIA,
DES (56 bits), triple DES (168 bits),
or 40-, 64-, or 128-bit RC2, respectively;
if not specified, triple DES is
used.
Only used with
.Fl encrypt
and
.Fl EncryptedData_encrypt
commands.
.It Fl binary
Normally the input message is converted to "canonical" format which is
effectively using CR/LF as end of line, as required by the S/MIME specification.
When this option is present no translation occurs.
This is useful when handling binary data which may not be in MIME format.
.It Fl CAfile Ar file
A file containing trusted CA certificates, used with
.Fl verify
and
.Fl verify_receipt .
.It Fl CApath Ar directory
A directory containing trusted CA certificates, used with
.Fl verify
and
.Fl verify_receipt .
This directory must be a standard certificate directory: that is a hash
of each subject name (using
.Nm x509 Fl hash )
should be linked to each certificate.
.It Ar cert.pem...
One or more certificates of message recipients: used when encrypting a message.
.It Fl certfile Ar file
Allows additional certificates to be specified.
When signing these will be included with the message.
When verifying these will be searched for the signer's certificates.
The certificates should be in PEM format.
.It Fl certsout Ar file
A file that any certificates contained in the message are written to.
.It Xo
.Fl check_ss_sig ,
.Fl crl_check ,
.Fl crl_check_all ,
.Fl extended_crl ,
.Fl ignore_critical ,
.Fl issuer_checks ,
.Fl policy ,
.Fl policy_check ,
.Fl purpose ,
.Fl x509_strict
.Xc
Set various certificate chain validation options.
See the
.Nm verify
command for details.
.It Fl content Ar file
A file containing the detached content.
This is only useful with the
.Fl verify
command.
This is only usable if the CMS structure is using the detached signature
form where the content is not included.
This option will override any content if the input format is S/MIME and
it uses the multipart/signed MIME content type.
.It Fl crlfeol
Output a S/MIME message with CR/LF end of line.
.It Fl debug_decrypt
Set the CMS_DEBUG_DECRYPT flag when decrypting.
This option should be used with caution, since this can be used to disable
the MMA attack protection and return an error if no recipient can be found.
See the
.Xr CMS_decrypt 3
manual page for details of the flag.
.It Xo
.Fl from Ar addr ,
.Fl subject Ar s ,
.Fl to Ar addr
.Xc
The relevant mail headers.
These are included outside the signed portion of a message so they may
be included manually.
If signing then many S/MIME mail clients check the signer's certificate's
email address matches that specified in the From: address.
.It Fl econtent_type Ar type
Set the encapsulated content type, used with
.Fl sign .
If not supplied the Data type is used.
The type argument can be any valid OID name in either text or numerical format.
.It Fl in Ar file
The input message to be encrypted or signed or the message to be decrypted or
verified.
.It Fl inform Cm der | pem | smime
The input format for the CMS structure.
The default is
.Cm smime ,
which reads an S/MIME format message.
.Cm pem
and
.Cm der
format change this to expect PEM and DER format CMS structures instead.
This currently only affects the input format of the CMS structure; if no
CMS structure is being input (for example with
.Fl encrypt
or
.Fl sign )
this option has no effect.
.It Fl inkey Ar file
The private key to use when signing or decrypting.
This must match the corresponding certificate.
If this option is not specified then the private key must be included in
the certificate file specified with the
.Fl recip
or
.Fl signer
file.
When signing this option can be used multiple times to specify successive keys.
.It Fl keyform Cm der | pem
Input private key format.
The default is
.Cm pem .
.It Fl keyid
Use subject key identifier to identify certificates instead of issuer
name and serial number.
The supplied certificate must include a subject key identifier extension.
Supported by
.Fl sign
and
.Fl encrypt
operations.
.It Fl keyopt Ar nm:v
Set customised parameters for the preceding key or certificate
for encryption and signing.
It can currently be used to set RSA-PSS for signing, RSA-OAEP for
encryption or to modify default parameters for ECDH.
This option can be used multiple times.
.It Fl md Ar digest
The digest algorithm to use when signing or resigning.
If not present then the default digest algorithm for the signing key
will be used (usually SHA1).
.It Fl no_attr_verify
Do not verify the signer's attribute of a signature.
.It Fl no_content_verify
Do not verify the content of a signed message.
.It Fl no_signer_cert_verify
Do not verify the signer's certificate of a signed message.
.It Fl noattr
Do not include attributes.
Normally when a message is signed a set of attributes are included which
include the signing time and supported symmetric algorithms.
With this option they are not included.
.It Fl nocerts
Do not include the signer's certificate.
This will reduce the size of the signed message but the verifier must
have a copy of the signer's certificate available locally (passed using
the
.Fl certfile
option for example).
.It Fl nodetach
When signing a message use opaque signing.
This form is more resistant to translation by mail relays but it cannot be
read by mail agents that do not support S/MIME.
Without this option cleartext signing with the MIME type multipart/signed is
used.
.It Fl nointern
Only the certificates specified in the
.Fl certfile
option are used.
When verifying a message normally certificates (if any) included in the
message are searched for the signing certificate.
The supplied certificates can still be used as untrusted CAs however.
.It Fl nooldmime
Output an old S/MIME content type like "application/x-pkcs7-".
.It Fl noout
Do not output the parsed CMS structure for the
.Fl cmsout
operation.
This is useful when combined with the
.Fl print
option or if the syntax of the CMS structure is being checked.
.It Fl nosigs
Do not try to verify the signatures on the message.
.It Fl nosmimecap
Exclude the list of supported algorithms from signed attributes; other
options such as signing time and content type are still included.
.It Fl noverify
Do not verify the signer's certificate of a signed message.
.It Fl out Ar file
The message text that has been decrypted or verified or the output MIME
format message that has been signed or verified.
.It Fl outform Cm der | pem | smime
This specifies the output format for the CMS structure.
The default is
.Cm smime ,
which writes an S/MIME format message.
.Cm pem
and
.Cm der
format change this to write PEM and DER format CMS structures instead.
This currently only affects the output format of the CMS structure; if
no CMS structure is being output (for example with
.Fl verify
or
.Fl decrypt )
this option has no effect.
.It Fl passin Ar src
The private key password source.
.It Fl print
Print out all fields of the CMS structure for the
.Fl cmsout
operation.
This is mainly useful for testing purposes.
.It Fl pwri_password Ar arg
Specify PasswordRecipientInfo (PWRI) password to use.
Supported by the
.Fl encrypt
and
.Fl decrypt
operations.
.It Fl rctform Cm der | pem | smime
Specify the format for a signed receipt for use with the
.Fl receipt_verify
operation.
The default is
.Cm smime .
.It Fl receipt_request_all | receipt_request_first
Indicate requests should be provided by all recipient or first tier
recipients (those mailed directly and not from a mailing list), for the
.Fl sign
operation to include a signed receipt request.
Ignored if
.Fl receipt_request_from
is included.
.It Fl receipt_request_from Ar addr
Add an explicit email address where receipts should be supplied.
.It Fl receipt_request_print
Print out the contents of any signed receipt requests for the
.Fl verify
operation.
.It Fl receipt_request_to Ar addr
Add an explicit email address where signed receipts should be sent to.
This option must be supplied if a signed receipt is requested.
.It Fl recip Ar file
When decrypting a message this specifies the recipient's certificate.
The certificate must match one of the recipients of the message or an
error occurs.
When encrypting a message this option may be used multiple times to
specify each recipient.
This form must be used if customised parameters are required (for example to
specify RSA-OAEP).
Only certificates carrying RSA, Diffie-Hellman or EC keys are supported
by this option.
.It Fl secretkey Ar key
Specify symmetric key to use.
The key must be supplied in hex format and be consistent with the
algorithm used.
Supported by the
.Fl EncryptedData_encrypt ,
.Fl EncryptedData_decrypt ,
.Fl encrypt
and
.Fl decrypt
operations.
When used with
.Fl encrypt
or
.Fl decrypt
the supplied key is used to wrap or unwrap the content encryption key
using an AES key in the KEKRecipientInfo type.
.It Fl secretkeyid Ar id
The key identifier for the supplied symmetric key for KEKRecipientInfo type.
This option must be present if the
.Fl secretkey
option is used with
.Fl encrypt .
With
.Fl decrypt
operations the id is used to locate the relevant key; if it is not supplied
then an attempt is used to decrypt any KEKRecipientInfo structures.
.It Fl signer Ar file
A signing certificate when signing or resigning a message; this option
can be used multiple times if more than one signer is required.
If a message is being verified then the signers certificates will be
written to this file if the verification was successful.
.It Xo
.Fl stream |
.Fl indef |
.Fl noindef
.Xc
The
.Fl stream
and
.Fl indef
options are equivalent and enable streaming I/O for encoding operations.
This permits single pass processing of data without the need to hold the
entire contents in memory, potentially supporting very large files.
Streaming is automatically set for S/MIME signing with detached data if
the output format is
.Cm smime ;
it is currently off by default for all other operations.
.Fl noindef
disable streaming I/O where it would produce an indefinite length
constructed encoding.
This option currently has no effect.
.It Fl text
Add plain text (text/plain) MIME headers to the supplied message if
encrypting or signing.
If decrypting or verifying it strips off text headers: if the decrypted
or verified message is not of MIME type text/plain then an error occurs.
.It Fl verify_retcode
Set verification error code to exit code to indicate what verification error
has occurred.
Supported by
.Fl verify
operation only.
Exit code value minus 32 shows verification error code.
See
.Nm verify
command for the list of verification error code.
.El
.Pp
The exit codes for
.Nm cms
are as follows:
.Pp
.Bl -tag -width "XXXX" -offset 3n -compact
.It 0
The operation was completely successful.
.It 1
An error occurred parsing the command options.
.It 2
One of the input files could not be read.
.It 3
An error occurred creating the CMS file or when reading the MIME message.
.It 4
An error occurred decrypting or verifying the message.
.It 5
The message was verified correctly but an error occurred writing out the
signer's certificates.
.It 6
An error occurred writing the output file.
.It 32+
A verify error occurred while
.Fl verify_retcode
is specified.
.El
.Tg crl
.Sh CRL
.Bl -hang -width "openssl crl"
.It Nm openssl crl
.Bk -words
.Op Fl CAfile Ar file
.Op Fl CApath Ar dir
.Op Fl crlnumber

.It Fl outform Cm der | pem
The output format.
.It Fl text
Print the CRL in plain text.
.It Fl verify
Verify the signature on the CRL.
.El
.Tg crl2pkcs7
.Sh CRL2PKCS7
.Bl -hang -width "openssl crl2pkcs7"
.It Nm openssl crl2pkcs7
.Bk -words
.Op Fl certfile Ar file
.Op Fl in Ar file
.Op Fl inform Cm der | pem

.It Fl out Ar file
Write the PKCS#7 structure to
.Ar file ,
or standard output if not specified.
.It Fl outform Cm der | pem
The output format.
.El
.Tg dgst
.Sh DGST
.Bl -hang -width "openssl dgst"
.It Nm openssl dgst
.Bk -words
.Op Fl cdr
.Op Fl binary
.Op Fl Ar digest

.Qq Verification OK
or
.Qq Verification Failure .
.It Ar
File or files to digest.
If no files are specified then standard input is used.
.El
.Tg dhparam
.Sh DHPARAM
.Bl -hang -width "openssl dhparam"
.It Nm openssl dhparam
.Bk -words
.Op Fl 2 | 5
.Op Fl C
.Op Fl check

Generate a parameter set of size
.Ar numbits .
It must be the last option.
If not present, a value of 2048 is used.
If this value is present, the input file is ignored and
parameters are generated instead.
.El
.Tg dsa
.Sh DSA
.Bl -hang -width "openssl dsa"
.It Nm openssl dsa
.Bk -words
.Oo
.Fl aes128 | aes192 | aes256 |
.Fl des | des3

.Xc
Enable or disable PVK encoding.
The default is
.Fl pvk-strong .
.It Fl text
Print the public/private key in plain text.
.El
.Tg dsaparam
.Sh DSAPARAM
.Bl -hang -width "openssl dsaparam"
.It Nm openssl dsaparam
.Bk -words
.Op Fl C
.Op Fl genkey
.Op Fl in Ar file

.It Fl text
Print the DSA parameters in plain text.
.It Ar numbits
Generate a parameter set of size
.Ar numbits .
If this option is included, the input file is ignored.
.El
.Tg ec
.Sh EC
.Bl -hang -width "openssl ec"
.It Nm openssl ec
.Bk -words
.Op Fl conv_form Ar arg
.Op Fl des
.Op Fl des3

Read in a public key, not a private key.
.It Fl pubout
Output a public key, not a private key.
Automatically set if the input is a public key.
.It Fl text
Print the public/private key in plain text.
.El
.Tg ecparam
.Sh ECPARAM
.Bl -hang -width "openssl ecparam"
.It Nm openssl ecparam
.Bk -words
.Op Fl C
.Op Fl check
.Op Fl conv_form Ar arg

Note: the
.Cm implicitlyCA
alternative, as specified in RFC 3279,
is currently not implemented.
.It Fl text
Print the EC parameters in plain text.
.El
.Tg enc
.Sh ENC
.Bl -hang -width "openssl enc"
.It Nm openssl enc
.Bk -words
.Fl ciphername
.Op Fl AadePpv
.Op Fl base64

Superseded by the
.Fl pass
option.
.It Fl md Ar digest
Use
.Ar digest
to create a key from a pass phrase.
Currently, the default value is



.Cm sha256 .
.It Fl none
Use NULL cipher (no encryption or decryption of input).
.It Fl nopad
Disable standard block padding.
.It Fl nosalt
Don't use a salt in the key derivation routines.
This option should never be used

When the salt is being used
the first eight bytes of the encrypted data are reserved for the salt:
it is randomly generated when encrypting a file and read from the
encrypted file when it is decrypted.
.It Fl v
Print extra details about the processing.
.El
.Tg errstr
.Sh ERRSTR
.Nm openssl errstr
.Op Fl stats
.Ar errno ...
.Pp
The
.Nm errstr

are all ASCII text.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl stats
Print debugging statistics about various aspects of the hash table.
.El
.Tg gendsa
.Sh GENDSA
.Bl -hang -width "openssl gendsa"
.It Nm openssl gendsa
.Bk -words
.Oo
.Fl aes128 | aes192 | aes256 | camellia128 |
.Fl camellia192 | camellia256 | des | des3 | idea

or standard output if not specified.
.It Fl passout Ar arg
The output file password source.
.It Ar paramfile
Specify the DSA parameter file to use.
The parameters in this file determine the size of the private key.
.El
.Tg genpkey
.Sh GENPKEY
.Bl -hang -width "openssl genpkey"
.It Nm openssl genpkey
.Bk -words
.Op Fl algorithm Ar alg
.Op Ar cipher
.Op Fl genparam

.Ar p .
.It dh_paramgen_generator : Ns Ar value
(DH)
The value to use for the generator
.Ar g .
.It ec_paramgen_curve : Ns Ar curve
(EC)
The elliptic curve to use.
.El
.It Fl text
Print the private/public key in plain text.
.El
.Tg genrsa
.Sh GENRSA
.Bl -hang -width "openssl genrsa"
.It Nm openssl genrsa
.Bk -words
.Op Fl 3 | f4
.Oo
.Fl aes128 | aes192 | aes256 | camellia128 |

.It Fl passout Ar arg
The output file password source.
.It Ar numbits
The size of the private key to generate in bits.
This must be the last option specified.
The default is 2048.
.El
.Tg nseq
.Sh NSEQ
.Nm openssl nseq
.Op Fl in Ar file
.Op Fl out Ar file
.Op Fl toseq
.Pp
The

Normally, a Netscape certificate sequence will be input and the output
is the certificates contained in it.
With the
.Fl toseq
option the situation is reversed:
a Netscape certificate sequence is created from a file of certificates.
.El
.Tg ocsp
.Sh OCSP
.Bl -hang -width "openssl ocsp"
.It Nm openssl ocsp
.Bk -words
.Op Fl CA Ar file
.Op Fl CAfile Ar file
.Op Fl CApath Ar directory

which can give details about multiple CAs
and has its own separate certificate chain,
then its root CA can be trusted for OCSP signing.
Alternatively, the responder certificate itself can be explicitly trusted
with the
.Fl VAfile
option.
.Tg passwd
.Sh PASSWD
.Bl -hang -width "openssl passwd"
.It Nm openssl passwd
.Bk -words
.Op Fl 1 | apr1 | crypt
.Op Fl in Ar file
.Op Fl noverify

.Fl noverify .
.It Fl stdin
Read passwords from standard input.
.It Fl table
In the output list, prepend the cleartext password and a TAB character
to each password hash.
.El
.Tg pkcs7
.Sh PKCS7
.Bl -hang -width "openssl pkcs7"
.It Nm openssl pkcs7
.Bk -words
.Op Fl in Ar file
.Op Fl inform Cm der | pem
.Op Fl noout

Print the ASN.1 representation of PKCS#7 structure.
.It Fl print_certs
Print any certificates or CRLs contained in the file,
preceded by their subject and issuer names in a one-line format.
.It Fl text
Print certificate details in full rather than just subject and issuer names.
.El
.Tg pkcs8
.Sh PKCS8
.Bl -hang -width "openssl pkcs8"
.It Nm openssl pkcs8
.Bk -words
.Op Fl in Ar file
.Op Fl inform Cm der | pem
.Op Fl nocrypt

this doesn't matter).
.Pp
.Ar alg
is the encryption algorithm to use;
valid values include des, des3, and rc2.
It is recommended that des3 is used.
.El
.Tg pkcs12
.Sh PKCS12
.Bl -hang -width "openssl pkcs12"
.It Nm openssl pkcs12
.Bk -words
.Oo
.Fl aes128 | aes192 | aes256 | camellia128 |
.Fl camellia192 | camellia256 | des | des3 | idea

is equivalent to
.Fl passout .
Otherwise,
.Fl password
is equivalent to
.Fl passin .
.El
.Tg pkey
.Sh PKEY
.Bl -hang -width "openssl pkey"
.It Nm openssl pkey
.Bk -words
.Op Ar cipher
.Op Fl in Ar file
.Op Fl inform Cm der | pem

Automatically set if the input is a public key.
.It Fl text
Print the public/private key in plain text.
.It Fl text_pub
Print out only public key components
even if a private key is being processed.
.El
.Tg pkeyparam
.Sh PKEYPARAM
.Cm openssl pkeyparam
.Op Fl in Ar file
.Op Fl noout
.Op Fl out Ar file
.Op Fl text
.Pp

Do not output the encoded version of the parameters.
.It Fl out Ar file
The output file to write to,
or standard output if not specified.
.It Fl text
Print the parameters in plain text.
.El
.Tg pkeyutl
.Sh PKEYUTL
.Bl -hang -width "openssl pkeyutl"
.It Nm openssl pkeyutl
.Bk -words
.Op Fl asn1parse
.Op Fl certin
.Op Fl decrypt

This requires a private key.
.It Fl verify
Verify the input data against the signature file and indicate if the
verification succeeded or failed.
.It Fl verifyrecover
Verify the input data and output the recovered data.
.El
.Tg prime
.Sh PRIME
.Cm openssl prime
.Op Fl bits Ar n
.Op Fl checks Ar n
.Op Fl generate
.Op Fl hex
.Op Fl safe

prime numbers
(i.e. a prime p so that (p-1)/2 is also prime).
.It Ar p
Test if number
.Ar p
is prime.
.El
.Tg rand
.Sh RAND
.Bl -hang -width "openssl rand"
.It Nm openssl rand
.Bk -words
.Op Fl base64
.Op Fl hex
.Op Fl out Ar file

Perform base64 encoding on the output.
.It Fl hex
Specify hexadecimal output.
.It Fl out Ar file
The output file to write to,
or standard output if not specified.
.El
.Tg req
.Sh REQ
.Bl -hang -width "openssl req"
.It Nm openssl req
.Bk -words
.Op Fl addext Ar ext
.Op Fl asn1-kludge
.Op Fl batch
.Op Fl config Ar file
.Op Fl days Ar n
.Op Fl extensions Ar section
.Op Fl in Ar file
.Op Fl inform Cm der | pem

command primarily creates and processes certificate requests
in PKCS#10 format.
It can additionally create self-signed certificates,
for use as root CAs, for example.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl addext Ar ext
Add a specific extension to the certificate (if the
.Fl x509
option is present) or certificate request.
The argument must have the form of a key=value pair as it would appear in a
config file.
This option can be given multiple times.
.It Fl asn1-kludge
Produce requests in an invalid format for certain picky CAs.
Very few CAs still require the use of this option.
.It Fl batch
Non-interactive mode.
.It Fl config Ar file
Specify an alternative configuration file.

Additional object identifiers can be defined with the
.Cm oid_file
or
.Cm oid_section
options in the configuration file.
Any additional fields will be treated as though they were a
.Cm DirectoryString .
.Tg rsa
.Sh RSA
.Bl -hang -width "openssl rsa"
.It Nm openssl rsa
.Bk -words
.Op Fl aes128 | aes192 | aes256 | des | des3
.Op Fl check
.Op Fl in Ar file

format is used instead.
.It Fl sgckey
Use the modified NET algorithm used with some versions of Microsoft IIS
and SGC keys.
.It Fl text
Print the public/private key components in plain text.
.El
.Tg rsautl
.Sh RSAUTL
.Bl -hang -width "openssl rsautl"
.It Nm openssl rsautl
.Bk -words
.Op Fl asn1parse
.Op Fl certin
.Op Fl decrypt

Reverse the order of the input buffer.
.It Fl sign
Sign the input data and output the signed result.
This requires an RSA private key.
.It Fl verify
Verify the input data and output the recovered data.
.El
.Tg s_client
.Sh S_CLIENT
.Bl -hang -width "openssl s_client"
.It Nm openssl s_client
.Bk -words
.Op Fl 4 | 6
.Op Fl alpn Ar protocols
.Op Fl bugs
.Op Fl CAfile Ar file
.Op Fl CApath Ar directory
.Op Fl cert Ar file
.Op Fl certform Cm der | pem
.Op Fl check_ss_sig
.Op Fl cipher Ar cipherlist
.Op Fl connect Ar host Ns Op : Ns Ar port
.Op Fl crl_check
.Op Fl crl_check_all
.Op Fl crlf
.Op Fl debug
.Op Fl dtls1
.Op Fl extended_crl
.Op Fl groups Ar list
.Op Fl host Ar host
.Op Fl ign_eof
.Op Fl ignore_critical
.Op Fl issuer_checks
.Op Fl key Ar keyfile
.Op Fl keyform Cm der | pem
.Op Fl keymatexport Ar label
.Op Fl keymatexportlen Ar len
.Op Fl legacy_server_connect
.Op Fl msg
.Op Fl mtu Ar mtu
.Op Fl nbio
.Op Fl nbio_test
.Op Fl no_comp
.Op Fl no_ign_eof
.Op Fl no_legacy_server_connect
.Op Fl no_ticket
.Op Fl no_tls1
.Op Fl no_tls1_1
.Op Fl no_tls1_2
.Op Fl no_tls1_3
.Op Fl pass Ar arg
.Op Fl pause
.Op Fl policy_check
.Op Fl port Ar port
.Op Fl prexit
.Op Fl proxy Ar host : Ns Ar port
.Op Fl quiet
.Op Fl reconnect
.Op Fl servername Ar name
.Op Fl serverpref
.Op Fl sess_in Ar file
.Op Fl sess_out Ar file
.Op Fl showcerts
.Op Fl starttls Ar protocol
.Op Fl state
.Op Fl status
.Op Fl timeout
.Op Fl tls1
.Op Fl tls1_1
.Op Fl tls1_2
.Op Fl tls1_3
.Op Fl tlsextdebug
.Op Fl use_srtp Ar profiles
.Op Fl verify Ar depth
.Op Fl verify_return_error
.Op Fl x509_strict
.Op Fl xmpphost Ar host
.Ek

.It Fl crlf
Translate a line feed from the terminal into CR+LF,
as required by some servers.
.It Fl debug
Print extensive debugging information, including a hex dump of all traffic.
.It Fl dtls1
Permit only DTLS1.0.
.It Fl groups Ar list
Set the supported elliptic curve groups to the colon separated
.Ar list
of group NIDs or names as documented in
.Xr SSL_CTX_set1_groups_list 3 .
.It Fl host Ar host
The
.Ar host
to connect to.
The default is localhost.
.It Fl ign_eof
Inhibit shutting down the connection when end of file is reached in the input.

Test non-blocking I/O.
.It Fl no_ign_eof
Shut down the connection when end of file is reached in the input.
Can be used to override the implicit
.Fl ign_eof
after
.Fl quiet .
.It Fl no_tls1 | no_tls1_1 | no_tls1_2 | no_tls1_3
Disable the use of TLS1.0, 1.1, 1.2 and 1.3 respectively.
.It Fl no_ticket
Disable RFC 4507 session ticket support.
.It Fl pass Ar arg
The private key password source.
.It Fl pause
Pause 1 second between each read and write call.
.It Fl port Ar port

.It Fl state
Print the SSL session states.
.It Fl status
Send a certificate status request to the server (OCSP stapling).
The server response (if any) is printed out.
.It Fl timeout
Enable send/receive timeout on DTLS connections.
.It Fl tls1 | tls1_1 | tls1_2 | tls1_3
Permit only TLS1.0, 1.1, 1.2 or 1.3 respectively.
.It Fl tlsextdebug
Print a hex dump of any TLS extensions received from the server.
.It Fl use_srtp Ar profiles
Offer SRTP key management with a colon-separated profile list.
.It Fl verify Ar depth
Turn on server certificate verification,
with a maximum length of

When used with
.Fl starttls Ar xmpp ,
specify the host for the "to" attribute of the stream element.
If this option is not specified then the host specified with
.Fl connect
will be used.
.El
.Tg s_server
.Sh S_SERVER
.Bl -hang -width "openssl s_server"
.It Nm openssl s_server
.Bk -words
.Op Fl accept Ar port
.Op Fl alpn Ar protocols
.Op Fl bugs

.Op Fl dcertform Cm der | pem
.Op Fl debug
.Op Fl dhparam Ar file
.Op Fl dkey Ar file
.Op Fl dkeyform Cm der | pem
.Op Fl dpass Ar arg
.Op Fl dtls1
.Op Fl groups Ar list
.Op Fl HTTP
.Op Fl id_prefix Ar arg
.Op Fl key Ar keyfile
.Op Fl key2 Ar keyfile
.Op Fl keyform Cm der | pem
.Op Fl keymatexport Ar label
.Op Fl keymatexportlen Ar len

If not specified, an attempt is made to
load the parameters from the server certificate file.
If this fails, a static set of parameters hard coded into the
.Nm s_server
program will be used.
.It Fl dtls1
Permit only DTLS1.0.
.It Fl groups Ar list
Set the supported elliptic curve groups to the colon separated
.Ar list
of group NIDs or names as documented in
.Xr SSL_CTX_set1_groups_list 3 .
.It Fl HTTP
Emulate a simple web server.
Pages are resolved relative to the current directory.
For example if the URL
.Pa https://myhost/page.html
is requested, the file
.Pa ./page.html

Export len bytes of keying material (default 20).
.It Fl msg
Show all protocol messages with hex dump.
.It Fl mtu Ar mtu
Set the link layer MTU.
.It Fl named_curve Ar arg
Specify the elliptic curve name to use for ephemeral ECDH keys.
This option is deprecated; use
.Fl groups
instead.
.It Fl nbio
Turn on non-blocking I/O.
.It Fl nbio_test
Test non-blocking I/O.
.It Fl no_cache
Disable session caching.
.It Fl no_dhe

With
.Fl Verify ,
the client must supply a certificate or an error occurs;
with
.Fl verify ,
a certificate is requested but the client does not have to send one.
.El
.Tg s_time
.Sh S_TIME
.Bl -hang -width "openssl s_time"
.It Nm openssl s_time
.Bk -words
.Op Fl bugs
.Op Fl CAfile Ar file
.Op Fl CApath Ar directory

.Sq /
gets the index.htm[l] page.
If this parameter is not specified,
.Nm s_time
will only perform the handshake to establish SSL connections
but not transfer any payload data.
.El
.Tg sess_id
.Sh SESS_ID
.Bl -hang -width "openssl sess_id"
.It Nm openssl sess_id
.Bk -words
.Op Fl cert
.Op Fl context Ar ID
.Op Fl in Ar file

the contents of an encrypted session using this information.
Therefore appropriate security precautions
should be taken if the information is being output by a
.Qq real
application.
This is, however, strongly discouraged and should only be used for
debugging purposes.
.Tg smime
.Sh SMIME
.Bl -hang -width "openssl smime"
.It Nm openssl smime
.Bk -words
.Oo
.Fl aes128 | aes192 | aes256 | des |
.Fl des3 | rc2-40 | rc2-64 | rc2-128

.It 3
An error occurred creating the file or when reading the message.
.It 4
An error occurred decrypting or verifying the message.
.It 5
An error occurred writing certificates.
.El
.Tg speed
.Sh SPEED
.Bl -hang -width "openssl speed"
.It Nm openssl speed
.Bk -words
.Op Ar algorithm
.Op Fl decrypt
.Op Fl elapsed

.It Fl mr
Produce machine readable output.
.It Fl multi Ar number
Run
.Ar number
benchmarks in parallel.
.El
.Tg spkac
.Sh SPKAC
.Bl -hang -width "openssl spkac"
.It Nm openssl spkac
.Bk -words
.Op Fl challenge Ar string
.Op Fl in Ar file
.Op Fl key Ar keyfile

.It Fl spksect Ar section
An alternative name for the
.Ar section
containing the SPKAC.
.It Fl verify
Verify the digital signature on the supplied SPKAC.
.El
.Tg ts
.Sh TS
.Bk -words
.Bl -hang -width "openssl ts"
.It Nm openssl ts
.Fl query
.Op Fl md4 | md5 | ripemd160 | sha1
.Op Fl cert

.Fl chain
option is specified then the certificate identifiers of the chain will also
be included in the SigningCertificate signed attribute.
If this variable is set to no,
only the signing certificate identifier is included.
The default is no.
.El
.Tg verify
.Sh VERIFY
.Bl -hang -width "openssl verify"
.It Nm openssl verify
.Bk -words
.Op Fl CAfile Ar file
.Op Fl CApath Ar directory
.Op Fl check_ss_sig

The current candidate issuer certificate was rejected because its
.Cm keyUsage
extension does not permit certificate signing.
.It 50 X509_V_ERR_APPLICATION_VERIFICATION
An application specific error.
Unused.
.El
.Tg version
.Sh VERSION
.Nm openssl version
.Op Fl abdfopv
.Pp
The
.Nm version
command is used to print out version information about

.It Fl p
Platform setting.
.It Fl v
The current
.Nm openssl
version.
.El
.Tg x509
.Sh X509
.Bl -hang -width "openssl x509"
.It Nm openssl x509
.Bk -words
.Op Fl C
.Op Fl addreject Ar arg
.Op Fl addtrust Ar arg

/* $OpenBSD: openssl.c,v 1.30 2019/11/04 15:25:54 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *

FUNCTION functions[] = {

	/* General functions. */
	{ FUNC_TYPE_GENERAL, "asn1parse", asn1parse_main },
	{ FUNC_TYPE_GENERAL, "ca", ca_main },
	{ FUNC_TYPE_GENERAL, "certhash", certhash_main },
	{ FUNC_TYPE_GENERAL, "ciphers", ciphers_main },
#ifndef OPENSSL_NO_CMS
	{ FUNC_TYPE_GENERAL, "cms", cms_main },
#endif
	{ FUNC_TYPE_GENERAL, "crl2pkcs7", crl2pkcs7_main },
	{ FUNC_TYPE_GENERAL, "crl", crl_main },
	{ FUNC_TYPE_GENERAL, "dgst", dgst_main },
	{ FUNC_TYPE_GENERAL, "enc", enc_main },
	{ FUNC_TYPE_GENERAL, "errstr", errstr_main },
	{ FUNC_TYPE_GENERAL, "genpkey", genpkey_main },
	{ FUNC_TYPE_GENERAL, "nseq", nseq_main },

/* $OpenBSD: progs.h,v 1.9 2019/11/04 15:25:54 jsing Exp $ */
/* Public domain */

int asn1parse_main(int argc, char **argv);
int ca_main(int argc, char **argv);
int certhash_main(int argc, char **argv);
int ciphers_main(int argc, char **argv);
int cms_main(int argc, char **argv);
int crl2pkcs7_main(int argc, char **argv);
int crl_main(int argc, char **argv);
int dgst_main(int argc, char **argv);
int dh_main(int argc, char **argv);
int dhparam_main(int argc, char **argv);
int dsa_main(int argc, char **argv);
int dsaparam_main(int argc, char **argv);

/* $OpenBSD: req.c,v 1.18 2019/11/06 11:16:16 inoguchi Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *

/* Until the key-gen callbacks are modified to use newer prototypes, we allow
 * deprecated functions for openssl-internal code */
#ifdef OPENSSL_NO_DEPRECATED
#undef OPENSSL_NO_DEPRECATED
#endif

#include <ctype.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

#include "apps.h"

#include <openssl/asn1.h>
#include <openssl/bio.h>

static int add_DN_object(X509_NAME * n, char *text, const char *def, char *value,
    int nid, int n_min, int n_max, unsigned long chtype, int mval);
static int genpkey_cb(EVP_PKEY_CTX * ctx);
static int req_check_len(int len, int n_min, int n_max);
static int check_end(const char *str, const char *end);
static EVP_PKEY_CTX *set_keygen_ctx(BIO * err, const char *gstr, int *pkey_type,
    long *pkeylen, char **palgnam);
static unsigned long ext_name_hash(const OPENSSL_STRING *a);
static int ext_name_cmp(const OPENSSL_STRING *a, const OPENSSL_STRING *b);
static void exts_cleanup(OPENSSL_STRING *x);
static int duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv);
static CONF *req_conf = NULL;
static CONF *addext_conf = NULL;
static int batch = 0;

int
req_main(int argc, char **argv)
{
	unsigned long nmflag = 0, reqflag = 0;
	int ex = 1, x509 = 0, days = 30;
	X509 *x509ss = NULL;
	X509_REQ *req = NULL;
	EVP_PKEY_CTX *genctx = NULL;
	const char *keyalg = NULL;
	char *keyalgstr = NULL;
	STACK_OF(OPENSSL_STRING) * pkeyopts = NULL, *sigopts = NULL;
	LHASH_OF(OPENSSL_STRING) *addexts = NULL;
	EVP_PKEY *pkey = NULL;
	int i = 0, badops = 0, newreq = 0, verbose = 0, pkey_type = -1;
	long newkey = -1;
	BIO *in = NULL, *out = NULL;
	int informat, outformat, verify = 0, noout = 0, text = 0, keyform = FORMAT_PEM;
	int nodes = 0, kludge = 0, newhdr = 0, subject = 0, pubkey = 0;
	char *infile, *outfile, *prog, *keyfile = NULL, *template = NULL,
	*keyout = NULL;
	BIO *addext_bio = NULL;
	char *extensions = NULL;
	char *req_exts = NULL;
	const EVP_CIPHER *cipher = NULL;
	ASN1_INTEGER *serial = NULL;
	int modulus = 0;
	char *passargin = NULL, *passargout = NULL;
	char *passin = NULL, *passout = NULL;

			}
		} else if (strcmp(*argv, "-set_serial") == 0) {
			if (--argc < 1)
				goto bad;
			serial = s2i_ASN1_INTEGER(NULL, *(++argv));
			if (!serial)
				goto bad;
		} else if (strcmp(*argv, "-addext") == 0) {
			if (--argc < 1)
				goto bad;
			p = *(++argv);
			if (addexts == NULL) {
				addexts = (LHASH_OF(OPENSSL_STRING) *)lh_new(
				    (LHASH_HASH_FN_TYPE)ext_name_hash,
				    (LHASH_COMP_FN_TYPE)ext_name_cmp);
				addext_bio = BIO_new(BIO_s_mem());
				if (addexts == NULL || addext_bio == NULL)
					goto bad;
			}
			i = duplicated(addexts, p);
			if (i == 1)
				goto bad;
			if (i < 0 || BIO_printf(addext_bio, "%s\n", p) < 0)
				goto bad;
		} else if (strcmp(*argv, "-extensions") == 0) {
			if (--argc < 1)
				goto bad;
			extensions = *(++argv);
		} else if (strcmp(*argv, "-reqexts") == 0) {
			if (--argc < 1)
				goto bad;

		BIO_printf(bio_err, " -batch         do not ask anything during request generation\n");
		BIO_printf(bio_err, " -x509          output a x509 structure instead of a cert. req.\n");
		BIO_printf(bio_err, " -days          number of days a certificate generated by -x509 is valid for.\n");
		BIO_printf(bio_err, " -set_serial    serial number to use for a certificate generated by -x509.\n");
		BIO_printf(bio_err, " -newhdr        output \"NEW\" in the header lines\n");
		BIO_printf(bio_err, " -asn1-kludge   Output the 'request' in a format that is wrong but some CA's\n");
		BIO_printf(bio_err, "                have been reported as requiring\n");
		BIO_printf(bio_err, " -addext ..     additional cert extension key=value pair (may be given more than once)\n");
		BIO_printf(bio_err, " -extensions .. specify certificate extension section (override value in config file)\n");
		BIO_printf(bio_err, " -reqexts ..    specify request extension section (override value in config file)\n");
		BIO_printf(bio_err, " -utf8          input characters are UTF8 (default ASCII)\n");
		BIO_printf(bio_err, " -nameopt arg    - various certificate name options\n");
		BIO_printf(bio_err, " -reqopt arg    - various request text options\n\n");
		goto end;
	}

	if (!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
		BIO_printf(bio_err, "Error getting passwords\n");
		goto end;
	}
	if (template != NULL) {
		long errline = -1;

		if (verbose)
			BIO_printf(bio_err, "Using configuration from %s\n", template);
		if ((req_conf = NCONF_new(NULL)) == NULL)
			goto end;
		if(!NCONF_load(req_conf, template, &errline)) {

			BIO_printf(bio_err, "error on line %ld of %s\n", errline, template);
			goto end;
		}
	} else {
		req_conf = config;

		if (req_conf == NULL) {
			BIO_printf(bio_err, "Unable to load config info from %s\n", default_config_file);
			if (newreq)
				goto end;
		} else if (verbose)
			BIO_printf(bio_err, "Using configuration from %s\n",
			    default_config_file);
	}

	if (addext_bio != NULL) {
		long errline = -1;
		if (verbose)
			BIO_printf(bio_err,
			    "Using additional configuration from command line\n");
		if ((addext_conf = NCONF_new(NULL)) == NULL)
			goto end;
		if (!NCONF_load_bio(addext_conf, addext_bio, &errline)) {
			BIO_printf(bio_err,
			    "req: Error on line %ld of config input\n",
			    errline);
			goto end;
		}
	}

	if (req_conf != NULL) {
		if (!load_config(bio_err, req_conf))
			goto end;
		p = NCONF_get_string(req_conf, NULL, "oid_file");
		if (p == NULL)
			ERR_clear_error();

		X509V3_set_ctx_test(&ctx);
		X509V3_set_nconf(&ctx, req_conf);
		if (!X509V3_EXT_add_nconf(req_conf, &ctx, extensions, NULL)) {
			BIO_printf(bio_err,
			    "Error Loading extension section %s\n", extensions);
			goto end;
		}
	}
	if (addext_conf != NULL) {
		/* Check syntax of command line extensions */
		X509V3_CTX ctx;
		X509V3_set_ctx_test(&ctx);
		X509V3_set_nconf(&ctx, addext_conf);
		if (!X509V3_EXT_add_nconf(addext_conf, &ctx, "default", NULL)) {
			BIO_printf(bio_err,
			    "Error Loading command line extensions\n");
			goto end;
		}
	}
	if (!passin) {
		passin = NCONF_get_string(req_conf, SECTION, "input_password");
		if (!passin)
			ERR_clear_error();
	}
	if (!passout) {

		if (x509) {
			EVP_PKEY *tmppkey;
			X509V3_CTX ext_ctx;
			if ((x509ss = X509_new()) == NULL)
				goto end;

			/* Set version to V3 */
			if ((extensions != NULL || addext_conf != NULL) &&
			    !X509_set_version(x509ss, 2))
				goto end;
			if (serial) {
				if (!X509_set_serialNumber(x509ss, serial))
					goto end;
			} else {
				if (!rand_serial(NULL,
					X509_get_serialNumber(x509ss)))

			/* Add extensions */
			if (extensions && !X509V3_EXT_add_nconf(req_conf,
				&ext_ctx, extensions, x509ss)) {
				BIO_printf(bio_err,
				    "Error Loading extension section %s\n",
				    extensions);
				goto end;
			}
			if (addext_conf != NULL &&
			    !X509V3_EXT_add_nconf(addext_conf, &ext_ctx,
				    "default", x509ss)) {
				BIO_printf(bio_err,
				    "Error Loading command line extensions\n");
				goto end;
			}
			i = do_X509_sign(bio_err, x509ss, pkey, digest, sigopts);
			if (!i) {
				ERR_print_errors(bio_err);
				goto end;
			}
		} else {

			/* Add extensions */
			if (req_exts && !X509V3_EXT_REQ_add_nconf(req_conf,
				&ext_ctx, req_exts, req)) {
				BIO_printf(bio_err,
				    "Error Loading extension section %s\n",
				    req_exts);
				goto end;
			}
			if (addext_conf != NULL &&
			    !X509V3_EXT_REQ_add_nconf(addext_conf, &ext_ctx,
				    "default", req)) {
				BIO_printf(bio_err,
				    "Error Loading command line extensions\n");
				goto end;
			}
			i = do_X509_REQ_sign(bio_err, req, pkey, digest, sigopts);
			if (!i) {
				ERR_print_errors(bio_err);
				goto end;
			}
		}

	ex = 0;
 end:
	if (ex) {
		ERR_print_errors(bio_err);
	}
	if ((req_conf != NULL) && (req_conf != config))
		NCONF_free(req_conf);
	NCONF_free(addext_conf);
	BIO_free(addext_bio);
	BIO_free(in);
	BIO_free_all(out);
	EVP_PKEY_free(pkey);
	if (genctx)
		EVP_PKEY_CTX_free(genctx);
	if (pkeyopts)
		sk_OPENSSL_STRING_free(pkeyopts);
	if (sigopts)
		sk_OPENSSL_STRING_free(sigopts);
	lh_OPENSSL_STRING_doall(addexts, (LHASH_DOALL_FN_TYPE)exts_cleanup);
	lh_OPENSSL_STRING_free(addexts);
	free(keyalgstr);
	X509_REQ_free(req);
	X509_free(x509ss);
	ASN1_INTEGER_free(serial);
	if (passargin && passin)
		free(passin);
	if (passargout && passout)

	EVP_MD_CTX_init(&mctx);
	rv = do_sign_init(err, &mctx, pkey, md, sigopts);
	if (rv > 0)
		rv = X509_CRL_sign_ctx(x, &mctx);
	EVP_MD_CTX_cleanup(&mctx);
	return rv > 0 ? 1 : 0;
}

static unsigned long
ext_name_hash(const OPENSSL_STRING *a)
{
	return lh_strhash((const char *)a);
}

static int
ext_name_cmp(const OPENSSL_STRING *a, const OPENSSL_STRING *b)
{
	return strcmp((const char *)a, (const char *)b);
}

static void
exts_cleanup(OPENSSL_STRING *x)
{
	free((char *)x);
}

/*
 * Is the |kv| key already duplicated ? This is remarkably tricky to get right.
 * Return 0 if unique, -1 on runtime error; 1 if found or a syntax error.
 */
static int
duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv)
{
	char *p;
	size_t off;

	/* Check syntax. */
	/* Skip leading whitespace, make a copy. */
	while (*kv && isspace(*kv))
		if (*++kv == '\0')
			return 1;
	if ((p = strchr(kv, '=')) == NULL)
		return 1;
	off = p - kv;
	if ((kv = strdup(kv)) == NULL)
		return -1;

	/* Skip trailing space before the equal sign. */
	for (p = kv + off; p > kv; --p)
		if (!isspace(p[-1]))
			break;
	if (p == kv) {
		free(kv);
		return 1;
	}
	*p = '\0';

	/* See if "key" is there by attempting to add it. */
	if ((p = (char *)lh_OPENSSL_STRING_insert(addexts, (OPENSSL_STRING*)kv))
	    != NULL || lh_OPENSSL_STRING_error(addexts)) {
		free(p != NULL ? p : kv);
		return -1;
	}

	return 0;
}

/* $OpenBSD: s_cb.c,v 1.14 2020/04/26 02:09:21 inoguchi Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *

{
	BIO *bio = arg;
	const char *str_write_p, *str_version, *str_content_type = "",
	    *str_details1 = "", *str_details2 = "";

	str_write_p = write_p ? ">>>" : "<<<";

	/* XXX convert to using ssl_get_version */
	switch (version) {
	case SSL2_VERSION:
		str_version = "SSL 2.0";
		break;
	case SSL3_VERSION:
		str_version = "SSL 3.0 ";
		break;
	case TLS1_VERSION:
		str_version = "TLS 1.0 ";
		break;
	case TLS1_1_VERSION:
		str_version = "TLS 1.1 ";
		break;
	case TLS1_2_VERSION:
		str_version = "TLS 1.2 ";
		break;
	case TLS1_3_VERSION:
		str_version = "TLS 1.3 ";
		break;
	case DTLS1_VERSION:
		str_version = "DTLS 1.0 ";
		break;
	default:
		str_version = "???";
	}

	if (version == SSL2_VERSION) {
		str_details1 = "???";

		if (len > 0) {
			/* XXX magic numbers */
			switch (((const unsigned char *) buf)[0]) {
			case 0:
				str_details1 = ", ERROR:";
				str_details2 = " ???";
				if (len >= 3) {
					unsigned err = (((const unsigned char *) buf)[1] << 8) + ((const unsigned char *) buf)[2];

				str_details1 = ", CLIENT-CERTIFICATE";
				break;
			}
		}
	}
	if (version == SSL3_VERSION || version == TLS1_VERSION ||
	    version == TLS1_1_VERSION || version == TLS1_2_VERSION ||
	    version == TLS1_3_VERSION || version == DTLS1_VERSION) {
		/* XXX magic numbers are in ssl3.h */
		switch (content_type) {
		case 20:
			str_content_type = "ChangeCipherSpec";
			break;
		case 21:
			str_content_type = "Alert";
			break;

					break;
				case 2:
					str_details1 = ", ServerHello";
					break;
				case 3:
					str_details1 = ", HelloVerifyRequest";
					break;
				case 4:
					str_details1 = ", NewSessionTicket";
					break;
				case 5:
					str_details1 = ", EndOfEarlyData";
					break;
				case 8:
					str_details1 = ", EncryptedExtensions";
					break;
				case 11:
					str_details1 = ", Certificate";
					break;
				case 12:
					str_details1 = ", ServerKeyExchange";
					break;
				case 13:

					break;
				case 16:
					str_details1 = ", ClientKeyExchange";
					break;
				case 20:
					str_details1 = ", Finished";
					break;
				case 24:
					str_details1 = ", KeyUpdate";
					break;
				}
			}
		}
	}
	BIO_printf(bio, "%s %s%s [length %04lx]%s%s\n", str_write_p,
	    str_version, str_content_type, (unsigned long) len,
	    str_details1, str_details2);

		extname = "use SRTP";
		break;

	case TLSEXT_TYPE_heartbeat:
		extname = "heartbeat";
		break;

	case TLSEXT_TYPE_application_layer_protocol_negotiation:
		extname = "application layer protocol negotiation";
		break;

	case TLSEXT_TYPE_padding:
		extname = "TLS padding";
		break;

	case TLSEXT_TYPE_session_ticket:
		extname = "session ticket";
		break;

#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL)
	case TLSEXT_TYPE_pre_shared_key:
		extname = "pre shared key";
		break;

	case TLSEXT_TYPE_early_data:
		extname = "early data";
		break;

	case TLSEXT_TYPE_supported_versions:
		extname = "supported versions";
		break;

	case TLSEXT_TYPE_cookie:
		extname = "cookie";
		break;

	case TLSEXT_TYPE_psk_key_exchange_modes:
		extname = "PSK key exchange modes";
		break;

	case TLSEXT_TYPE_certificate_authorities:
		extname = "certificate authorities";
		break;

	case TLSEXT_TYPE_oid_filters:
		extname = "OID filters";
		break;

	case TLSEXT_TYPE_post_handshake_auth:
		extname = "post handshake auth";
		break;

	case TLSEXT_TYPE_signature_algorithms_cert:
		extname = "signature algorithms cert";
		break;

	case TLSEXT_TYPE_key_share:
		extname = "key share";
		break;
#endif

	case TLSEXT_TYPE_renegotiate:
		extname = "renegotiation info";
		break;

	default:
		extname = "unknown";
		break;

	}

/* $OpenBSD: s_client.c,v 1.44 2020/04/26 01:59:27 inoguchi Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *

	BIO_printf(bio_err, " -nbio_test    - more ssl protocol testing\n");
	BIO_printf(bio_err, " -state        - print the 'ssl' states\n");
	BIO_printf(bio_err, " -nbio         - Run with non-blocking IO\n");
	BIO_printf(bio_err, " -crlf         - convert LF from terminal into CRLF\n");
	BIO_printf(bio_err, " -quiet        - no s_client output\n");
	BIO_printf(bio_err, " -ign_eof      - ignore input eof (default when -quiet)\n");
	BIO_printf(bio_err, " -no_ign_eof   - don't ignore input eof\n");
	BIO_printf(bio_err, " -tls1_3       - just use TLSv1.3\n");
	BIO_printf(bio_err, " -tls1_2       - just use TLSv1.2\n");
	BIO_printf(bio_err, " -tls1_1       - just use TLSv1.1\n");
	BIO_printf(bio_err, " -tls1         - just use TLSv1\n");
	BIO_printf(bio_err, " -dtls1        - just use DTLSv1\n");
	BIO_printf(bio_err, " -mtu          - set the link layer MTU\n");
	BIO_printf(bio_err, " -no_tls1_3/-no_tls1_2/-no_tls1_1/-no_tls1 - turn off that protocol\n");
	BIO_printf(bio_err, " -bugs         - Switch on all SSL implementation bug workarounds\n");
	BIO_printf(bio_err, " -cipher       - preferred cipher to use, use the 'openssl ciphers'\n");
	BIO_printf(bio_err, "                 command to see what is available\n");
	BIO_printf(bio_err, " -starttls prot - use the STARTTLS command before starting TLS\n");
	BIO_printf(bio_err, "                 for those protocols that support it, where\n");
	BIO_printf(bio_err, "                 'prot' defines which one to assume.  Currently,\n");
	BIO_printf(bio_err, "                 only \"smtp\", \"lmtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
	BIO_printf(bio_err, "                 are supported.\n");
	BIO_printf(bio_err, " -xmpphost host - connect to this virtual host on the xmpp server\n");
	BIO_printf(bio_err, " -sess_out arg - file to write SSL session to\n");
	BIO_printf(bio_err, " -sess_in arg  - file to read SSL session from\n");
	BIO_printf(bio_err, " -servername host  - Set TLS extension servername in ClientHello\n");
	BIO_printf(bio_err, " -tlsextdebug      - hex dump of all TLS extensions received\n");
	BIO_printf(bio_err, " -status           - request certificate status from server\n");
	BIO_printf(bio_err, " -no_ticket        - disable use of RFC4507bis session tickets\n");
	BIO_printf(bio_err, " -alpn arg         - enable ALPN extension, considering named protocols supported (comma-separated list)\n");
	BIO_printf(bio_err, " -groups arg       - specify EC groups (colon-separated list)\n");
#ifndef OPENSSL_NO_SRTP
	BIO_printf(bio_err, " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
#endif
	BIO_printf(bio_err, " -keymatexport label   - Export keying material using label\n");
	BIO_printf(bio_err, " -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
}

};

int
s_client_main(int argc, char **argv)
{
	unsigned int off = 0, clr = 0;
	SSL *con = NULL;
	int s, k, p = 0, pending = 0, state = 0, af = AF_UNSPEC;
	char *cbuf = NULL, *sbuf = NULL, *mbuf = NULL, *pbuf = NULL;
	int cbuf_len, cbuf_off;
	int sbuf_len, sbuf_off;
	int pbuf_len, pbuf_off;
	char *port = PORT_STR;
	int full_log = 1;
	char *host = SSL_HOST_NAME;
	char *xmpphost = NULL;
	char *proxy = NULL, *connect = NULL;
	char *cert_file = NULL, *key_file = NULL;
	int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
	char *passarg = NULL, *pass = NULL;
	X509 *cert = NULL;
	EVP_PKEY *key = NULL;
	char *CApath = NULL, *CAfile = NULL, *cipher = NULL;
	int reconnect = 0, badop = 0, verify = SSL_VERIFY_NONE, bugs = 0;
	int crlf = 0;
	int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending;
	SSL_CTX *ctx = NULL;
	int ret = 1, in_init = 1, i, nbio_test = 0;
	int starttls_proto = PROTO_OFF;
	int prexit = 0;
	int peekaboo = 0;
	X509_VERIFY_PARAM *vpm = NULL;
	int badarg = 0;
	const SSL_METHOD *meth = NULL;
	int socket_type = SOCK_STREAM;
	BIO *sbio;
	int mbuf_len = 0;
	struct timeval timeout;
	const char *errstr = NULL;
	char *servername = NULL;
	tlsextctx tlsextcbp = {NULL, 0};
	const char *alpn_in = NULL;
	const char *groups_in = NULL;
	char *sess_in = NULL;
	char *sess_out = NULL;
	struct sockaddr peer;
	int peerlen = sizeof(peer);
	int enable_timeouts = 0;
	long socket_mtu = 0;
	uint16_t min_version = 0, max_version = 0;

	if (single_execution) {
		if (pledge("stdio cpath wpath rpath inet dns tty", NULL) == -1) {
			perror("pledge");
			exit(1);
		}
	}

	meth = TLS_client_method();

	c_Pause = 0;
	c_quiet = 0;
	c_ign_eof = 0;
	c_debug = 0;
	c_msg = 0;
	c_showcerts = 0;

	if (((cbuf = malloc(BUFSIZZ)) == NULL) ||
	    ((sbuf = malloc(BUFSIZZ)) == NULL) ||
	    ((pbuf = malloc(BUFSIZZ)) == NULL) ||
	    ((mbuf = malloc(BUFSIZZ + 1)) == NULL)) {	/* NUL byte */
		BIO_printf(bio_err, "out of memory\n");
		goto end;
	}
	verify_depth = 0;
	c_nbio = 0;

			if (badarg)
				goto bad;
			continue;
		} else if (strcmp(*argv, "-verify_return_error") == 0)
			verify_return_error = 1;
		else if (strcmp(*argv, "-prexit") == 0)
			prexit = 1;
		else if (strcmp(*argv, "-peekaboo") == 0)
			peekaboo = 1;
		else if (strcmp(*argv, "-crlf") == 0)
			crlf = 1;
		else if (strcmp(*argv, "-quiet") == 0) {
			c_quiet = 1;
			c_ign_eof = 1;
		} else if (strcmp(*argv, "-ign_eof") == 0)
			c_ign_eof = 1;

			c_msg = 1;
		else if (strcmp(*argv, "-showcerts") == 0)
			c_showcerts = 1;
		else if (strcmp(*argv, "-nbio_test") == 0)
			nbio_test = 1;
		else if (strcmp(*argv, "-state") == 0)
			state = 1;
		else if (strcmp(*argv, "-tls1_3") == 0) {
			min_version = TLS1_3_VERSION;
			max_version = TLS1_3_VERSION;
		} else if (strcmp(*argv, "-tls1_2") == 0) {
			min_version = TLS1_2_VERSION;
			max_version = TLS1_2_VERSION;
		} else if (strcmp(*argv, "-tls1_1") == 0) {
			min_version = TLS1_1_VERSION;
			max_version = TLS1_1_VERSION;
		} else if (strcmp(*argv, "-tls1") == 0) {
			min_version = TLS1_VERSION;
			max_version = TLS1_VERSION;
#ifndef OPENSSL_NO_DTLS1
		} else if (strcmp(*argv, "-dtls1") == 0) {
			meth = DTLS_client_method();
			socket_type = SOCK_DGRAM;
		} else if (strcmp(*argv, "-timeout") == 0)
			enable_timeouts = 1;
		else if (strcmp(*argv, "-mtu") == 0) {
			if (--argc < 1)
				goto bad;
			socket_mtu = strtonum(*(++argv), 0, LONG_MAX, &errstr);

			if (--argc < 1)
				goto bad;
			CApath = *(++argv);
		} else if (strcmp(*argv, "-CAfile") == 0) {
			if (--argc < 1)
				goto bad;
			CAfile = *(++argv);
		} else if (strcmp(*argv, "-no_tls1_3") == 0)
			off |= SSL_OP_NO_TLSv1_3;
		else if (strcmp(*argv, "-no_tls1_2") == 0)
			off |= SSL_OP_NO_TLSv1_2;
		else if (strcmp(*argv, "-no_tls1_1") == 0)
			off |= SSL_OP_NO_TLSv1_1;
		else if (strcmp(*argv, "-no_tls1") == 0)
			off |= SSL_OP_NO_TLSv1;
		else if (strcmp(*argv, "-no_ssl3") == 0)
			off |= SSL_OP_NO_SSLv3;

				starttls_proto = PROTO_IMAP;
			else if (strcmp(*argv, "ftp") == 0)
				starttls_proto = PROTO_FTP;
			else if (strcmp(*argv, "xmpp") == 0)
				starttls_proto = PROTO_XMPP;
			else
				goto bad;

		} else if (strcmp(*argv, "-4") == 0) {
			af = AF_INET;
		} else if (strcmp(*argv, "-6") == 0) {
			af = AF_INET6;

		} else if (strcmp(*argv, "-servername") == 0) {
			if (--argc < 1)
				goto bad;
			servername = *(++argv);

		}
#ifndef OPENSSL_NO_SRTP
		else if (strcmp(*argv, "-use_srtp") == 0) {
			if (--argc < 1)
				goto bad;
			srtp_profiles = *(++argv);
		}

	ctx = SSL_CTX_new(meth);
	if (ctx == NULL) {
		ERR_print_errors(bio_err);
		goto end;
	}
	if (vpm)
		SSL_CTX_set1_param(ctx, vpm);

	if (!SSL_CTX_set_min_proto_version(ctx, min_version))
		goto end;
	if (!SSL_CTX_set_max_proto_version(ctx, max_version))
		goto end;

#ifndef OPENSSL_NO_SRTP
	if (srtp_profiles != NULL)
		SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
#endif
	if (bugs)
		SSL_CTX_set_options(ctx, SSL_OP_ALL | off);

	read_ssl = 1;
	write_ssl = 1;

	cbuf_len = 0;
	cbuf_off = 0;
	sbuf_len = 0;
	sbuf_off = 0;
	pbuf_len = 0;
	pbuf_off = 0;

	/* This is an ugly hack that does a lot of assumptions */
	/*
	 * We do have to handle multi-line responses which may come in a
	 * single packet or not. We therefore have to use BIO_gets() which
	 * does need a buffering BIO. So during the initial chitchat we do
	 * push a buffering BIO into the chain that is removed again later on

				static int iiii;
				if (++iiii == 52) {
					SSL_renegotiate(con);
					iiii = 0;
				}
			}
#endif
			if (peekaboo) {
				k = p = SSL_peek(con, pbuf, 1024 /* BUFSIZZ */ );
				pending = SSL_pending(con);
				if (SSL_get_error(con, p) == SSL_ERROR_NONE) {
					if (p <= 0)
						goto end;
					pbuf_off = 0;
					pbuf_len = p;

					k = SSL_read(con, sbuf, p);
				}
			} else {
				k = SSL_read(con, sbuf, 1024 /* BUFSIZZ */ );
			}

			switch (SSL_get_error(con, k)) {
			case SSL_ERROR_NONE:
				if (k <= 0)
					goto end;
				sbuf_off = 0;
				sbuf_len = k;
				if (peekaboo) {
					if (p != pending) {
						ret = -1;
						BIO_printf(bio_err,
						    "peeked %d but pending %d!\n", p, pending);
						goto shut;
					}
					if (k < p) {
						ret = -1;
						BIO_printf(bio_err,
						    "read less than peek!\n");
						goto shut;
					}
					if (p > 0 && (memcmp(sbuf, pbuf, p) != 0)) {
						ret = -1;
						BIO_printf(bio_err,
						    "peek of %d different from read of %d!\n",
						    p, k);
						goto shut;
					}
				}
				read_ssl = 0;
				write_tty = 1;
				break;
			case SSL_ERROR_WANT_WRITE:
				BIO_printf(bio_c_out, "read W BLOCK\n");
				write_ssl = 1;
				read_tty = 0;

/* $OpenBSD: s_server.c,v 1.33 2020/04/19 17:05:55 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *

	BIO_printf(bio_err, " -dcert arg    - second certificate file to use (usually for DSA)\n");
	BIO_printf(bio_err, " -dcertform x  - second certificate format (PEM or DER) PEM default\n");
	BIO_printf(bio_err, " -dkey arg     - second private key file to use (usually for DSA)\n");
	BIO_printf(bio_err, " -dkeyform arg - second key format (PEM or DER) PEM default\n");
	BIO_printf(bio_err, " -dpass arg    - second private key file pass phrase source\n");
	BIO_printf(bio_err, " -dhparam arg  - DH parameter file to use, in cert file if not specified\n");
	BIO_printf(bio_err, "                 or a default set of parameters is used\n");



	BIO_printf(bio_err, " -nbio         - Run with non-blocking IO\n");
	BIO_printf(bio_err, " -nbio_test    - test with the non-blocking test bio\n");
	BIO_printf(bio_err, " -crlf         - convert LF from terminal into CRLF\n");
	BIO_printf(bio_err, " -debug        - Print more output\n");
	BIO_printf(bio_err, " -msg          - Show protocol messages\n");
	BIO_printf(bio_err, " -state        - Print the SSL states\n");
	BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");

	BIO_printf(bio_err, " -servername_fatal - on mismatch send fatal alert (default warning alert)\n");
	BIO_printf(bio_err, " -cert2 arg    - certificate file to use for servername\n");
	BIO_printf(bio_err, "                 (default is %s)\n", TEST_CERT2);
	BIO_printf(bio_err, " -key2 arg     - Private Key file to use for servername, in cert file if\n");
	BIO_printf(bio_err, "                 not specified (default is %s)\n", TEST_CERT2);
	BIO_printf(bio_err, " -tlsextdebug  - hex dump of all TLS extensions received\n");
	BIO_printf(bio_err, " -no_ticket    - disable use of RFC4507bis session tickets\n");
	BIO_printf(bio_err, " -alpn arg     - set the advertised protocols for the ALPN extension (comma-separated list)\n");
	BIO_printf(bio_err, " -groups arg   - specify EC groups (colon-separated list)\n");
#ifndef OPENSSL_NO_SRTP
	BIO_printf(bio_err, " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
#endif
	BIO_printf(bio_err, " -keymatexport label   - Export keying material using label\n");
	BIO_printf(bio_err, " -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
}

	EVP_PKEY *s_key = NULL, *s_dkey = NULL;
	int no_cache = 0;
	const char *errstr = NULL;
	EVP_PKEY *s_key2 = NULL;
	X509 *s_cert2 = NULL;
	tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
	const char *alpn_in = NULL;
	const char *groups_in = NULL;
	tlsextalpnctx alpn_ctx = { NULL, 0 };

	if (single_execution) {
		if (pledge("stdio rpath inet dns tty", NULL) == -1) {
			perror("pledge");
			exit(1);
		}

			if (--argc < 1)
				goto bad;
			passarg = *(++argv);
		} else if (strcmp(*argv, "-dhparam") == 0) {
			if (--argc < 1)
				goto bad;
			dhfile = *(++argv);

		} else if (strcmp(*argv, "-named_curve") == 0) {
			if (--argc < 1)
				goto bad;
			named_curve = *(++argv);

		} else if (strcmp(*argv, "-dcertform") == 0) {
			if (--argc < 1)
				goto bad;
			s_dcert_format = str2fmt(*(++argv));
		} else if (strcmp(*argv, "-dcert") == 0) {
			if (--argc < 1)
				goto bad;
			s_dcert_file = *(++argv);

			if (--argc < 1)
				goto bad;
			++argv;
		} else if (strcmp(*argv,"-alpn") == 0) {
			if (--argc < 1)
				goto bad;
			alpn_in = *(++argv);
		} else if (strcmp(*argv, "-groups") == 0) {
			if (--argc < 1)
				goto bad;
			groups_in = *(++argv);
		}
#ifndef OPENSSL_NO_SRTP
		else if (strcmp(*argv, "-use_srtp") == 0) {
			if (--argc < 1)
				goto bad;
			srtp_profiles = *(++argv);
		}

			ERR_print_errors(bio_err);
		}
		if (vpm)
			SSL_CTX_set1_param(ctx2, vpm);
	}
	if (alpn_ctx.data)
		SSL_CTX_set_alpn_select_cb(ctx, alpn_cb, &alpn_ctx);

	if (groups_in != NULL) {
		if (SSL_CTX_set1_groups_list(ctx, groups_in) != 1) {
			BIO_printf(bio_err, "Failed to set groups '%s'\n",
			    groups_in);
			goto end;
		}
	}

#ifndef OPENSSL_NO_DH
	if (!no_dhe) {
		DH *dh = NULL;

		if (dhfile)
			dh = load_dh_param(dhfile);

				goto end;
			}
		}
		DH_free(dh);
	}
#endif

	if (!no_ecdhe && named_curve != NULL) {
		EC_KEY *ecdh = NULL;
		int nid;


		if ((nid = OBJ_sn2nid(named_curve)) == 0) {


			BIO_printf(bio_err, "unknown curve name (%s)\n",
			    named_curve);
			goto end;
		}
		if ((ecdh = EC_KEY_new_by_curve_name(nid)) == NULL) {

			BIO_printf(bio_err, "unable to create curve (%s)\n",
			    named_curve);
			goto end;
		}


		BIO_printf(bio_s_out, "Setting temp ECDH parameters\n");








		(void) BIO_flush(bio_s_out);

		SSL_CTX_set_tmp_ecdh(ctx, ecdh);
		if (ctx2)
			SSL_CTX_set_tmp_ecdh(ctx2, ecdh);
		EC_KEY_free(ecdh);
	}

#! /bin/sh
# Wrapper for compilers which do not understand '-c -o'.

scriptversion=2018-03-07.03; # UTC

# Copyright (C) 1999-2020 Free Software Foundation, Inc.
# Written by Tom Tromey <tromey@cygnus.com>.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#

    / | /[!/]*) # absolute file, and not a UNC file
      if test -z "$file_conv"; then
	# lazily determine how to convert abs files
	case `uname -s` in
	  MINGW*)
	    file_conv=mingw
	    ;;
	  CYGWIN* | MSYS*)
	    file_conv=cygwin
	    ;;
	  *)
	    file_conv=wine
	    ;;
	esac
      fi
      case $file_conv/,$2, in
	*,$file_conv,*)
	  ;;
	mingw/*)
	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
	  ;;
	cygwin/* | msys/*)
	  file=`cygpath -m "$file" || echo "$file"`
	  ;;
	wine/*)
	  file=`winepath -w "$file" || echo "$file"`
	  ;;
      esac
      ;;

#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for libressl 3.1.1.
#
#
# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
#
#
# This configure script is free software; the Free Software Foundation
# gives unlimited permission to copy, distribute and modify it.

subdirs=
MFLAGS=
MAKEFLAGS=

# Identity of this package.
PACKAGE_NAME='libressl'
PACKAGE_TARNAME='libressl'
PACKAGE_VERSION='3.1.1'
PACKAGE_STRING='libressl 3.1.1'
PACKAGE_BUGREPORT=''
PACKAGE_URL=''

# Factoring default headers for most tests.
ac_includes_default="\
#include <stdio.h>
#ifdef HAVE_SYS_TYPES_H

HOST_ASM_ELF_X86_64_TRUE
HOST_ASM_ELF_ARM_FALSE
HOST_ASM_ELF_ARM_TRUE
OPENSSL_NO_ASM_FALSE
OPENSSL_NO_ASM_TRUE
HOST_CPU_IS_INTEL_FALSE
HOST_CPU_IS_INTEL_TRUE
ENABLE_TESTS_FALSE
ENABLE_TESTS_TRUE
ENABLE_EXTRATESTS_FALSE
ENABLE_EXTRATESTS_TRUE
OPENSSLDIR_DEFINED_FALSE
OPENSSLDIR_DEFINED_TRUE
OPENSSLDIR
HAVE_B64_NTOP_FALSE
HAVE_B64_NTOP_TRUE

HOST_WIN_TRUE
HOST_SOLARIS_FALSE
HOST_SOLARIS_TRUE
HOST_OPENBSD_FALSE
HOST_OPENBSD_TRUE
HOST_NETBSD_FALSE
HOST_NETBSD_TRUE
HOST_MIDIPIX_FALSE
HOST_MIDIPIX_TRUE
HOST_LINUX_FALSE
HOST_LINUX_TRUE
HOST_HPUX_FALSE
HOST_HPUX_TRUE
HOST_FREEBSD_FALSE
HOST_FREEBSD_TRUE
HOST_DARWIN_FALSE

with_sysroot
enable_libtool_lock
enable_nc
enable_hardening
enable_windows_ssp
with_openssldir
enable_extratests
enable_tests
enable_asm
'
      ac_precious_vars='build_alias
host_alias
target_alias
CC
CFLAGS

#
# Report the --help message.
#
if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
\`configure' configures libressl 3.1.1 to adapt to many kinds of systems.

Usage: $0 [OPTION]... [VAR=VALUE]...

To assign environment variables (e.g., CC, CFLAGS...), specify them as
VAR=VALUE.  See below for descriptions of some of the useful variables.

Defaults for the options are specified in brackets.

  --build=BUILD     configure for building on BUILD [guessed]
  --host=HOST       cross-compile to build programs to run on HOST [BUILD]
_ACEOF
fi

if test -n "$ac_init_help"; then
  case $ac_init_help in
     short | recursive ) echo "Configuration of libressl 3.1.1:";;
   esac
  cat <<\_ACEOF

Optional Features:
  --disable-option-checking  ignore unrecognized --enable/--with options
  --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
  --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]

  --enable-nc             Enable installing TLS-enabled nc(1)
  --disable-hardening     Disable options to frustrate memory corruption
                          exploits
  --enable-windows-ssp    Enable building the stack smashing protection on
                          Windows. This currently distributing libssp-0.dll.
  --enable-extratests     Enable extra tests that may be unreliable on some
                          platforms
  --disable-tests         Disable tests [default=enabled]
  --disable-asm           Disable assembly

Optional Packages:
  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
  --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
  --with-pic[=PKGS]       try to use only PIC/non-PIC objects [default=use
                          both]

    cd "$ac_pwd" || { ac_status=$?; break; }
  done
fi

test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
  cat <<\_ACEOF
libressl configure 3.1.1
generated by GNU Autoconf 2.69

Copyright (C) 2012 Free Software Foundation, Inc.
This configure script is free software; the Free Software Foundation
gives unlimited permission to copy, distribute and modify it.
_ACEOF
  exit

  as_fn_set_status $ac_retval

} # ac_fn_c_compute_int
cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.

It was created by libressl $as_me 3.1.1, which was
generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@

_ACEOF
exec 5>>config.log
{

ac_ext=c
ac_cpp='$CPP $CPPFLAGS'
ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
ac_compiler_gnu=$ac_cv_c_compiler_gnu


LIBCRYPTO_VERSION=46:1:0

LIBSSL_VERSION=48:1:0

LIBTLS_VERSION=20:1:0


ac_aux_dir=
for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do
  if test -f "$ac_dir/install-sh"; then
    ac_aux_dir=$ac_dir
    ac_install_sh="$ac_aux_dir/install-sh -c"

    CYGPATH_W=echo
  fi
fi


# Define the identity of the package.
 PACKAGE='libressl'
 VERSION='3.1.1'


cat >>confdefs.h <<_ACEOF
#define PACKAGE "$PACKAGE"
_ACEOF

		CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D__STRICT_ALIGNMENT"
		;;
	*linux*)
		HOST_OS=linux
		HOST_ABI=elf
		CPPFLAGS="$CPPFLAGS -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -D_GNU_SOURCE"
		;;
	*midipix*)
		HOST_OS=midipix
		CPPFLAGS="$CPPFLAGS -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -D_GNU_SOURCE"
		;;
	*netbsd*)
		HOST_OS=netbsd
		HOST_ABI=elf
		cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h.  */

#include <sys/param.h>

	*mingw*)
		HOST_OS=win
		HOST_ABI=mingw64
		BUILD_NC=no
		CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE -D_POSIX -D_POSIX_SOURCE -D__USE_MINGW_ANSI_STDIO"
		CPPFLAGS="$CPPFLAGS -D_REENTRANT -D_POSIX_THREAD_SAFE_FUNCTIONS"
		CPPFLAGS="$CPPFLAGS -DWIN32_LEAN_AND_MEAN"
		CPPFLAGS="$CPPFLAGS"
		PLATFORM_LDADD='-lws2_32'

		;;
	*solaris*)
		HOST_OS=solaris
		HOST_ABI=elf
		CPPFLAGS="$CPPFLAGS -D__EXTENSIONS__ -D_XOPEN_SOURCE=600 -DBSD_COMP"

 if test x$HOST_OS = xlinux; then
  HOST_LINUX_TRUE=
  HOST_LINUX_FALSE='#'
else
  HOST_LINUX_TRUE='#'
  HOST_LINUX_FALSE=
fi

 if test x$HOST_OS = xmidipix; then
  HOST_MIDIPIX_TRUE=
  HOST_MIDIPIX_FALSE='#'
else
  HOST_MIDIPIX_TRUE='#'
  HOST_MIDIPIX_FALSE=
fi

 if test x$HOST_OS = xnetbsd; then
  HOST_NETBSD_TRUE=
  HOST_NETBSD_FALSE='#'
else
  HOST_NETBSD_TRUE='#'
  HOST_NETBSD_FALSE=

  ENABLE_EXTRATESTS_TRUE=
  ENABLE_EXTRATESTS_FALSE='#'
else
  ENABLE_EXTRATESTS_TRUE='#'
  ENABLE_EXTRATESTS_FALSE=
fi


# Check whether --enable-tests was given.
if test "${enable_tests+set}" = set; then :
  enableval=$enable_tests;
        if ! test "x${enable_tests}" = "xyes"; then
		enable_tests="no"
	fi
else
  enable_tests="yes"
fi

 if test "x$enable_tests" = xyes; then
  ENABLE_TESTS_TRUE=
  ENABLE_TESTS_FALSE='#'
else
  ENABLE_TESTS_TRUE='#'
  ENABLE_TESTS_FALSE=
fi


# Add CPU-specific alignment flags
old_cflags=$CFLAGS
CFLAGS="$CFLAGS -I$srcdir/include"
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if BSWAP4 builds without __STRICT_ALIGNMENT" >&5
$as_echo_n "checking if BSWAP4 builds without __STRICT_ALIGNMENT... " >&6; }
cat confdefs.h - <<_ACEOF >conftest.$ac_ext

  as_fn_error $? "conditional \"HOST_HPUX\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${HOST_LINUX_TRUE}" && test -z "${HOST_LINUX_FALSE}"; then
  as_fn_error $? "conditional \"HOST_LINUX\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${HOST_MIDIPIX_TRUE}" && test -z "${HOST_MIDIPIX_FALSE}"; then
  as_fn_error $? "conditional \"HOST_MIDIPIX\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${HOST_NETBSD_TRUE}" && test -z "${HOST_NETBSD_FALSE}"; then
  as_fn_error $? "conditional \"HOST_NETBSD\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${HOST_OPENBSD_TRUE}" && test -z "${HOST_OPENBSD_FALSE}"; then
  as_fn_error $? "conditional \"HOST_OPENBSD\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5

if test -z "${OPENSSLDIR_DEFINED_TRUE}" && test -z "${OPENSSLDIR_DEFINED_FALSE}"; then
  as_fn_error $? "conditional \"OPENSSLDIR_DEFINED\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${ENABLE_EXTRATESTS_TRUE}" && test -z "${ENABLE_EXTRATESTS_FALSE}"; then
  as_fn_error $? "conditional \"ENABLE_EXTRATESTS\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${ENABLE_TESTS_TRUE}" && test -z "${ENABLE_TESTS_FALSE}"; then
  as_fn_error $? "conditional \"ENABLE_TESTS\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${HOST_CPU_IS_INTEL_TRUE}" && test -z "${HOST_CPU_IS_INTEL_FALSE}"; then
  as_fn_error $? "conditional \"HOST_CPU_IS_INTEL\" was never defined.
Usually this means the macro was only invoked conditionally." "$LINENO" 5
fi
if test -z "${OPENSSL_NO_ASM_TRUE}" && test -z "${OPENSSL_NO_ASM_FALSE}"; then
  as_fn_error $? "conditional \"OPENSSL_NO_ASM\" was never defined.

test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1

cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# Save the log message, to keep $0 and so on meaningful, and to
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by libressl $as_me 3.1.1, which was
generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
  CONFIG_HEADERS  = $CONFIG_HEADERS
  CONFIG_LINKS    = $CONFIG_LINKS
  CONFIG_COMMANDS = $CONFIG_COMMANDS
  $ $0 $@

Report bugs to the package provider."

_ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
libressl config.status 3.1.1
configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

Copyright (C) 2012 Free Software Foundation, Inc.
This config.status script is free software; the Free Software Foundation
gives unlimited permission to copy, distribute and modify it."

   echo "$as_me:$LINENO: \$? = $ac_status" >&5
   (exit $ac_status); } || am_rc=$?
  done
  if test $am_rc -ne 0; then
    { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
as_fn_error $? "Something went wrong bootstrapping makefile fragments
    for automatic dependency tracking.  If GNU make was not used, consider
    re-running the configure script with MAKE=\"gmake\" (or whatever is
    necessary).  You can also try re-running configure with the
    '--disable-dependency-tracking' option to at least be able to build
    the package (albeit without support for automatic dependency tracking).
See \`config.log' for more details" "$LINENO" 5; }
  fi
  { am_dirpart=; unset am_dirpart;}
  { am_filepart=; unset am_filepart;}
  { am_mf=; unset am_mf;}

)
AM_CONDITIONAL([OPENSSLDIR_DEFINED], [test x$with_openssldir != x])

AC_ARG_ENABLE([extratests],
	AS_HELP_STRING([--enable-extratests], [Enable extra tests that may be unreliable on some platforms]))
AM_CONDITIONAL([ENABLE_EXTRATESTS], [test "x$enable_extratests" = xyes])

AC_ARG_ENABLE([tests],
       [AS_HELP_STRING([--disable-tests], [Disable tests @<:@default=enabled@:>@])],
       [
        if ! test "x${enable_tests}" = "xyes"; then
		enable_tests="no"
	fi],
       [enable_tests="yes"])
AM_CONDITIONAL([ENABLE_TESTS], [test "x$enable_tests" = xyes])

# Add CPU-specific alignment flags
old_cflags=$CFLAGS
CFLAGS="$CFLAGS -I$srcdir/include"
AC_MSG_CHECKING([if BSWAP4 builds without __STRICT_ALIGNMENT])
AC_TRY_COMPILE([#include "$srcdir/crypto/modes/modes_lcl.h"],
	       [int a = 0; BSWAP4(a);],
	       AC_MSG_RESULT([yes])

	cast/c_enc.c
	cast/c_ofb64.c
	cast/c_skey.c
	chacha/chacha.c
	cmac/cm_ameth.c
	cmac/cm_pmeth.c
	cmac/cmac.c
	cms/cms_asn1.c
	cms/cms_att.c
	cms/cms_cd.c
	cms/cms_dd.c
	cms/cms_enc.c
	cms/cms_env.c
	cms/cms_err.c
	cms/cms_ess.c
	cms/cms_io.c
	cms/cms_kari.c
	cms/cms_lcl.h
	cms/cms_lib.c
	cms/cms_pwri.c
	cms/cms_sd.c
	cms/cms_smime.c
	comp/c_rle.c
	comp/c_zlib.c
	comp/comp_err.c
	comp/comp_lib.c
	conf/conf_api.c
	conf/conf_def.c
	conf/conf_err.c

	set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_rename)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_connect)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_close)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_read)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_write)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_getsockopt)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_setsockopt)

endif()

if(NOT HAVE_ASPRINTF)
	set(CRYPTO_SRC ${CRYPTO_SRC} compat/bsd-asprintf.c)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} asprintf)
	set(EXTRA_EXPORT ${EXTRA_EXPORT} vasprintf)
endif()

		ecdsa
		evp
		modes
		../include/compat
	PUBLIC
		../include)


export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym)
target_link_libraries(crypto ${PLATFORM_LIBS})
if (WIN32)
	set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION})
endif()
set_target_properties(crypto PROPERTIES
	OUTPUT_NAME crypto${CRYPTO_POSTFIX}
	ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX})
set_target_properties(crypto PROPERTIES VERSION
	${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION})


if(ENABLE_LIBRESSL_INSTALL)
	install(
		TARGETS crypto
		ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
	)
endif(ENABLE_LIBRESSL_INSTALL)

# needed for a CMake target
EXTRA_DIST += compat/strcasecmp.c

BUILT_SOURCES = crypto_portable.sym
CLEANFILES = crypto_portable.sym

crypto_portable.sym: crypto.sym  Makefile
	-echo "generating crypto_portable.sym ..."
	-cp $(top_srcdir)/crypto/crypto.sym crypto_portable.sym
	-chmod u+w crypto_portable.sym
if !HAVE_ARC4RANDOM_BUF
	-echo arc4random >> crypto_portable.sym
	-echo arc4random_buf >> crypto_portable.sym
	-echo arc4random_uniform >> crypto_portable.sym

	-echo posix_setsockopt >> crypto_portable.sym
	-echo getuid >> crypto_portable.sym
	-grep -v BIO_s_log crypto_portable.sym > crypto_portable.sym.tmp
	-mv crypto_portable.sym.tmp crypto_portable.sym
endif

libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym
EXTRA_libcrypto_la_DEPENDENCIES = crypto_portable.sym
libcrypto_la_LIBADD = libcompat.la
if !HAVE_EXPLICIT_BZERO
libcrypto_la_LIBADD += libcompatnoopt.la
endif
libcrypto_la_CPPFLAGS = $(AM_CPPFLAGS)
libcrypto_la_CPPFLAGS += -DLIBRESSL_INTERNAL
libcrypto_la_CPPFLAGS += -DOPENSSL_NO_HW_PADLOCK

libcrypto_la_SOURCES += chacha/chacha.c

# cmac
libcrypto_la_SOURCES += cmac/cm_ameth.c
libcrypto_la_SOURCES += cmac/cm_pmeth.c
libcrypto_la_SOURCES += cmac/cmac.c

# cms
libcrypto_la_SOURCES += cms/cms_asn1.c
libcrypto_la_SOURCES += cms/cms_att.c
libcrypto_la_SOURCES += cms/cms_cd.c
libcrypto_la_SOURCES += cms/cms_dd.c
libcrypto_la_SOURCES += cms/cms_enc.c
libcrypto_la_SOURCES += cms/cms_env.c
libcrypto_la_SOURCES += cms/cms_err.c
libcrypto_la_SOURCES += cms/cms_ess.c
libcrypto_la_SOURCES += cms/cms_io.c
libcrypto_la_SOURCES += cms/cms_kari.c
libcrypto_la_SOURCES += cms/cms_lib.c
libcrypto_la_SOURCES += cms/cms_pwri.c
libcrypto_la_SOURCES += cms/cms_sd.c
libcrypto_la_SOURCES += cms/cms_smime.c
noinst_HEADERS += cms/cms_lcl.h

# comp
libcrypto_la_SOURCES += comp/c_rle.c
libcrypto_la_SOURCES += comp/c_zlib.c
libcrypto_la_SOURCES += comp/comp_err.c
libcrypto_la_SOURCES += comp/comp_lib.c

# conf

libcrypto_la_SOURCES += gost/gostr341001.c
libcrypto_la_SOURCES += gost/gostr341001_ameth.c
libcrypto_la_SOURCES += gost/gostr341001_key.c
libcrypto_la_SOURCES += gost/gostr341001_params.c
libcrypto_la_SOURCES += gost/gostr341001_pmeth.c
libcrypto_la_SOURCES += gost/gostr341194.c
libcrypto_la_SOURCES += gost/streebog.c

noinst_HEADERS += gost/gost_asn1.h
noinst_HEADERS += gost/gost_locl.h

# hkdf
libcrypto_la_SOURCES += hkdf/hkdf.c

# hmac

# Makefile.in generated by automake 1.16.2 from Makefile.am.
# @configure_input@

# Copyright (C) 1994-2020 Free Software Foundation, Inc.

# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without

	bn/bn_print.c bn/bn_rand.c bn/bn_recp.c bn/bn_shift.c \
	bn/bn_sqr.c bn/bn_sqrt.c bn/bn_word.c bn/bn_x931p.c \
	buffer/buf_err.c buffer/buf_str.c buffer/buffer.c \
	camellia/cmll_cfb.c camellia/cmll_ctr.c camellia/cmll_ecb.c \
	camellia/cmll_misc.c camellia/cmll_ofb.c cast/c_cfb64.c \
	cast/c_ecb.c cast/c_enc.c cast/c_ofb64.c cast/c_skey.c \
	chacha/chacha.c cmac/cm_ameth.c cmac/cm_pmeth.c cmac/cmac.c \
	cms/cms_asn1.c cms/cms_att.c cms/cms_cd.c cms/cms_dd.c \
	cms/cms_enc.c cms/cms_env.c cms/cms_err.c cms/cms_ess.c \
	cms/cms_io.c cms/cms_kari.c cms/cms_lib.c cms/cms_pwri.c \
	cms/cms_sd.c cms/cms_smime.c comp/c_rle.c comp/c_zlib.c \
	comp/comp_err.c comp/comp_lib.c conf/conf_api.c \
	conf/conf_def.c conf/conf_err.c conf/conf_lib.c \
	conf/conf_mall.c conf/conf_mod.c conf/conf_sap.c \
	curve25519/curve25519-generic.c curve25519/curve25519.c \
	des/cbc_cksm.c des/cbc_enc.c des/cfb64ede.c des/cfb64enc.c \
	des/cfb_enc.c des/des_enc.c des/ecb3_enc.c des/ecb_enc.c \
	des/ede_cbcm_enc.c des/enc_read.c des/enc_writ.c des/fcrypt.c \
	des/fcrypt_b.c des/ofb64ede.c des/ofb64enc.c des/ofb_enc.c \
	des/pcbc_enc.c des/qud_cksm.c des/rand_key.c des/set_key.c \
	des/str2key.c des/xcbc_enc.c dh/dh_ameth.c dh/dh_asn1.c \
	dh/dh_check.c dh/dh_depr.c dh/dh_err.c dh/dh_gen.c dh/dh_key.c \
	dh/dh_lib.c dh/dh_pmeth.c dh/dh_prn.c dsa/dsa_ameth.c \
	dsa/dsa_asn1.c dsa/dsa_depr.c dsa/dsa_err.c dsa/dsa_gen.c \
	dsa/dsa_key.c dsa/dsa_lib.c dsa/dsa_meth.c dsa/dsa_ossl.c \
	dsa/dsa_pmeth.c dsa/dsa_prn.c dsa/dsa_sign.c dsa/dsa_vrf.c \
	dso/dso_dlfcn.c dso/dso_err.c dso/dso_lib.c dso/dso_null.c \

	dso/dso_openssl.c ec/ec2_mult.c ec/ec2_oct.c ec/ec2_smpl.c \
	ec/ec_ameth.c ec/ec_asn1.c ec/ec_check.c ec/ec_curve.c \
	ec/ec_cvt.c ec/ec_err.c ec/ec_key.c ec/ec_kmeth.c ec/ec_lib.c \
	ec/ec_mult.c ec/ec_oct.c ec/ec_pmeth.c ec/ec_print.c \
	ec/eck_prn.c ec/ecp_mont.c ec/ecp_nist.c ec/ecp_oct.c \
	ec/ecp_smpl.c ecdh/ecdh_kdf.c ecdh/ech_err.c ecdh/ech_key.c \
	ecdh/ech_lib.c ecdsa/ecs_asn1.c ecdsa/ecs_err.c \
	ecdsa/ecs_lib.c ecdsa/ecs_ossl.c ecdsa/ecs_sign.c \
	ecdsa/ecs_vrf.c engine/eng_all.c engine/eng_cnf.c \
	engine/eng_ctrl.c engine/eng_dyn.c engine/eng_err.c \
	engine/eng_fat.c engine/eng_init.c engine/eng_lib.c \
	engine/eng_list.c engine/eng_openssl.c engine/eng_pkey.c \
	engine/eng_table.c engine/tb_asnmth.c engine/tb_cipher.c \
	engine/tb_dh.c engine/tb_digest.c engine/tb_dsa.c \
	engine/tb_ecdh.c engine/tb_ecdsa.c engine/tb_eckey.c \
	engine/tb_pkmeth.c engine/tb_rand.c engine/tb_rsa.c \
	engine/tb_store.c err/err.c err/err_all.c err/err_prn.c \
	evp/bio_b64.c evp/bio_enc.c evp/bio_md.c evp/c_all.c \
	evp/digest.c evp/e_aes.c evp/e_aes_cbc_hmac_sha1.c evp/e_bf.c \
	evp/e_camellia.c evp/e_cast.c evp/e_chacha.c \
	evp/e_chacha20poly1305.c evp/e_des.c evp/e_des3.c \
	evp/e_gost2814789.c evp/e_idea.c evp/e_null.c evp/e_old.c \
	evp/e_rc2.c evp/e_rc4.c evp/e_rc4_hmac_md5.c evp/e_sm4.c \
	evp/e_xcbc_d.c evp/encode.c evp/evp_aead.c evp/evp_enc.c \
	evp/evp_err.c evp/evp_key.c evp/evp_lib.c evp/evp_pbe.c \
	evp/evp_pkey.c evp/m_dss.c evp/m_dss1.c evp/m_ecdsa.c \
	evp/m_gost2814789.c evp/m_gostr341194.c evp/m_md4.c \

	camellia/libcrypto_la-cmll_ecb.lo \
	camellia/libcrypto_la-cmll_misc.lo \
	camellia/libcrypto_la-cmll_ofb.lo cast/libcrypto_la-c_cfb64.lo \
	cast/libcrypto_la-c_ecb.lo cast/libcrypto_la-c_enc.lo \
	cast/libcrypto_la-c_ofb64.lo cast/libcrypto_la-c_skey.lo \
	chacha/libcrypto_la-chacha.lo cmac/libcrypto_la-cm_ameth.lo \
	cmac/libcrypto_la-cm_pmeth.lo cmac/libcrypto_la-cmac.lo \
	cms/libcrypto_la-cms_asn1.lo cms/libcrypto_la-cms_att.lo \
	cms/libcrypto_la-cms_cd.lo cms/libcrypto_la-cms_dd.lo \
	cms/libcrypto_la-cms_enc.lo cms/libcrypto_la-cms_env.lo \
	cms/libcrypto_la-cms_err.lo cms/libcrypto_la-cms_ess.lo \
	cms/libcrypto_la-cms_io.lo cms/libcrypto_la-cms_kari.lo \
	cms/libcrypto_la-cms_lib.lo cms/libcrypto_la-cms_pwri.lo \
	cms/libcrypto_la-cms_sd.lo cms/libcrypto_la-cms_smime.lo \
	comp/libcrypto_la-c_rle.lo comp/libcrypto_la-c_zlib.lo \
	comp/libcrypto_la-comp_err.lo comp/libcrypto_la-comp_lib.lo \
	conf/libcrypto_la-conf_api.lo conf/libcrypto_la-conf_def.lo \
	conf/libcrypto_la-conf_err.lo conf/libcrypto_la-conf_lib.lo \
	conf/libcrypto_la-conf_mall.lo conf/libcrypto_la-conf_mod.lo \
	conf/libcrypto_la-conf_sap.lo \
	curve25519/libcrypto_la-curve25519-generic.lo \

	cast/$(DEPDIR)/libcrypto_la-c_ofb64.Plo \
	cast/$(DEPDIR)/libcrypto_la-c_skey.Plo \
	chacha/$(DEPDIR)/libcrypto_la-chacha-merged.Plo \
	chacha/$(DEPDIR)/libcrypto_la-chacha.Plo \
	cmac/$(DEPDIR)/libcrypto_la-cm_ameth.Plo \
	cmac/$(DEPDIR)/libcrypto_la-cm_pmeth.Plo \
	cmac/$(DEPDIR)/libcrypto_la-cmac.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_asn1.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_att.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_cd.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_dd.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_enc.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_env.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_err.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_ess.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_io.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_kari.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_lib.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_pwri.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_sd.Plo \
	cms/$(DEPDIR)/libcrypto_la-cms_smime.Plo \
	comp/$(DEPDIR)/libcrypto_la-c_rle.Plo \
	comp/$(DEPDIR)/libcrypto_la-c_zlib.Plo \
	comp/$(DEPDIR)/libcrypto_la-comp_err.Plo \
	comp/$(DEPDIR)/libcrypto_la-comp_lib.Plo \
	compat/$(DEPDIR)/arc4random.Plo \
	compat/$(DEPDIR)/arc4random_uniform.Plo \
	compat/$(DEPDIR)/bsd-asprintf.Plo \