XMLSEC1(1)

📦
version 1.3.12 · 12 versions
, in arch rolling, nixpkgs unstable, ubuntu stonking

✨ NAME ✨

xmlsec1 — sign, verify, encrypt and decrypt XML documents 💖

ngl bestie, that's the whole job description and she does all of it. also hi, you're reading the User Commands manual, section 1. ok let's go 🦋

🌸 SYNOPSIS 🌸

xmlsec <command> [<options>] [<files>]

so like. command first. then options. then files. very demure, very mindful 🎀

💅 DESCRIPTION 💅

ok so xmlsec is a command line tool for signing, verifying, encrypting and decrypting XML documents. that's it, that's the vibe. she's the main character of XML crypto and she knows it 👑

the allowed <command> values are, and I'm gonna list literally all of them because I love a complete list:

  • --help — displays this help information and then exits. iconic, no notes 💫
  • --help-all — displays help information for all commands/options and exits. yes, every single one. she's thorough 💅
  • --help-<cmd> — displays help information for command <cmd> and exits. plug in whichever command you're curious about 🧚
  • --version — prints version information and exits. always worth a peek 💖
  • --keys — keys XML file manipulation. yes bestie, you're messing with the keys file 🔑
  • --sign — sign data and output XML document. go off, sign it ✍️
  • --verify — verify signed document. vibe check on that signature 🔍
  • --encrypt — encrypt data and output XML document. secrets stay secret 🤫
  • --decrypt — decrypt data from XML document. unlock it, queen 🗝️
fr fr, if you're confused literally just run --help and she'll walk you through it 🫶

✨ OPTIONS ✨

okay bestie, deep breath, because this is THE section 💅 it's long, it's iconic, and every single one of these flags is here because someone needed it at 3am. we're going in order, no skips, no shortcuts. drink some water. 🫶

  • --ignore-manifests — do not process <dsig:Manifest> elements. just. leave them alone. 🙈
  • --store-references — store and print the result of <dsig:Reference/> element processing, right before the digest gets calculated. for when you need receipts 📝
  • --store-signatures — store and print the result of <dsig:Signature> processing, right before the signature gets calculated.
  • --enabled-reference-uris <list> — a comma separated list, and it can only be made of these values: "empty", "same-doc", "local", "remote". it restricts the possible URI attribute values for the <dsig:Reference> element. basically a vibe check for URIs ✅
  • --enable-visa3d-hack — enables the Visa3D protocol specific hack for URI attribute processing, for when we're trying not to use the XPath/XPointer engine. and listen: the docs are very honest here — this is a hack and the original dev straight up does not know what else might get broken in your application when you use it 💀 also go check the --id-attr option because you might need it.
  • --enable-asn1-signatures-hack — enables support for ASN1 signature values generated by some XMLDsig implementations.
  • --hmac-min-out-len <bits> — sets the minimum HMAC output length to bits.
  • --binary-data <file> — binary file to encrypt.
  • --xml-data <file> — XML file to encrypt.
  • --enabled-cipher-reference-uris <list> — comma separated list, same vibes as before, values limited to "empty", "same-doc", "local", "remote", and it restricts possible URI attribute values for the <enc:CipherReference> element. 🔐
  • --session-key <keyKlass>-<keySize> — generate a brand new session key of class keyKlass with a size of keySize bits. for example, --session des-192 generates a new 192 bits DES key for DES3 encryption. slay 🔑
  • --output <filename> — write the result document to file filename. the filename can be a template and include '{inputfile}', which will be repaced with the input filename (yes, "repaced", that's the doc's own typo and we love her anyway 🎀).
  • --print-debug — print debug information to stdout.
  • --print-xml-debug — print debug information to stdout in xml format.
  • --dtd-file <file> — load the specified file as the DTD.
  • --node-id <id> — set the operation start point to the node with the given id.
  • --node-name [<namespace-uri>:]<name> — set the operation start point to the first node with the given name and namespace URI.
  • --node-xpath <expr> — set the operation start point to the first node selected by the specified XPath expression. main character node selection, honestly 👑
  • --id-attr[:<attr-name>] [<node-namespace-uri>:]<node-name> — adds the attributes attr-name (default value is "id") from all nodes matching node-name and namespace node-namespace-uri to the list of known ID attributes. heads up: this is a hack, and if you can, you should use DTD or schema to declare ID attributes instead (see the --dtd-file option).
  • --add-id-attr <id-attribute-name> — adds the attribute id-attribute-name to all nodes in the document. also a hack! if you can declare ID attributes with DTD or schema instead, pls do (again: see --dtd-file).
  • --enabled-key-data <list> — a comma-separated list of key-data types to enable. example time ✨:
rsa,key-value,x509
      -> populates <RSAKeyValue> and keeps <X509Data>

when the <KeyValue/> and <X509Data/> placeholders are present in the template. use --list-key-data to view the full list of registered key data klasses. by default, all registered key data are enabled.

  • --enabled-retrieval-method-uris <list> — comma separated list, values: "empty", "same-doc", "local", "remote". restricts possible URI attribute values for the <dsig:RetrievalMethod> element.
  • --enabled-key-info-reference-uris <list> — yep, same list again ("empty", "same-doc", "local", "remote"), this time restricting possible URI attribute values for the <dsig11:KeyInfoReference> element.
  • --gen-key[:<name>] <keyKlass>-<keySize> — generate a new keyKlass key of keySize bits, set the key name to name, and drop the result into the keys manager. for example --gen:MyKeyName rsa-1024 generates a new 1024 bits RSA key and sets its name to "MyKeyName". (yes, the doc example uses --gen: — cute, we're keeping it exactly as written 🫶)
  • --keys-file <file> — load keys from an XML file.
  • --privkey-pem[:<name>] <file>[,<cafile>[,<cafile>[...]]] — load a private key from a PEM file, plus the certificates that verify this key.
  • --privkey-der[:<name>] <file>[,<cafile>[,<cafile>[...]]] — load a private key from a DER file, plus the certificates that verify this key.
  • --pkcs8-pem[:<name>] <file>[,<cafile>[,<cafile>[...]]] — load a private key from a PKCS8 PEM file, plus PEM certificates that verify this key.
  • --pkcs8-der[:<name>] <file>[,<cafile>[,<cafile>[...]]] — load a private key from a PKCS8 DER file, plus DER certificates that verify this key.
  • --privkey-openssl-store[:<name>] <uri> — load a private key and certs through the OpenSSL ossl_store interface (e.g. from an HSM).
  • --privkey-openssl-engine[:<name>] <openssl-engine>;<openssl-key-id>[,<crtfile>[,<crtfile>[...]]] — load a private key via the OpenSSL ENGINE interface. specify the name of the engine (like you would with -engine params), the key specs (like with -inkey or -key params), and optionally certificates that verify this key.
  • --pubkey-pem[:<name>] <file> — load a public key from a PEM file.
  • --pubkey-der[:<name>] <file> — load a public key from a DER file.
  • --pubkey-openssl-store[:<name>] <uri> — load a pubkey key and certs through the OpenSSL ossl_store interface (e.g. from an HSM).
  • --pubkey-openssl-engine[:<name>] <openssl-engine>;<openssl-key-id>[,<crtfile>[,<crtfile>[...]]] — load a public key via the OpenSSL ENGINE interface. name the engine (like with -engine params), the key specs (like with -inkey or -key params), and optionally the certificates that verify this key.
  • --pwd <password> — the password to use for reading keys and certs. 🤫
  • --lax-key-search — enable lax key search (e.g. by key type like "rsa"), as opposed to the default strict key search mode which uses only information from the <dsig:KeyInfo/> node (e.g. the key name).
  • --verify-keys — force verification of public/private keys loaded from the command: keys are required to have a key certificate that will be verified against the certificates in the key store.
  • --aes-key[:<name>] <file> — load an AES key from the binary file file.
  • --camellia-key[:<name>] <file> — load a Camellia key from the binary file file.
  • --chacha20-key[:<name>] <file> — load a ChaCha20 key from the binary file file.
  • --concatkdf-key[:<name>] <file> — load a ConcatKDF key from the binary file file.
  • --des-key[:<name>] <file> — load a DES key from the binary file file.
  • --hmac-key[:<name>] <file> — load an HMAC key from the binary file file.
  • --pbkdf2-key[:<name>] <file> — load a Pbkdf2 key from the binary file file.
  • --hkdf-key[:<name>] <file> — load an HKDF key (IKM) from the binary file file.
  • --pkcs12[:<name>] <file> — load a private key from the pkcs12 file file.
  • --pkcs12-persist — persist the loaded private key.
  • --pubkey-cert-pem[:<name>] <file> — load a public key from a PEM cert file.
  • --pubkey-cert-der[:<name>] <file> — load a public key from a DER cert file.
  • --trusted-pem <file> — load a trusted (root) certificate from the PEM file file.
  • --untrusted-pem <file> — load an untrusted certificate from the PEM file file.
  • --trusted-der <file> — load a trusted (root) certificate from the DER file file.
  • --untrusted-der <file> — load an untrusted certificate from the DER file file.
  • --crl-pem <file> — load CRLs from the PEM file file.
  • --crl-der <file> — load CRLs from the DER file file.
  • --verify-crls — force verification of the loaded CRLs: CRLs are required to have a valid signature from an issuer certificate in the trusted or untrusted certificate store, and must be within their validity period (thisUpdate/nextUpdate).
  • --verification-time <time> — the local time in "YYYY-MM-DD HH:MM:SS" format used for certificate verification.
  • --verification-gmt-time <time> — the GMT time in "YYYY-MM-DD HH:MM:SS" format used for certificate verification.
  • --X509-skip-time-checks — skip time checking of X509 certificates and CLRs.
  • --depth <number> — maximum certificates chain depth.
  • --X509-skip-strict-checks — skip strict checking of X509 data.
  • --insecure — do not verify certificates or CRLs.
ok bestie, the next two lines are giving "yolo" energy and I need you to hear me: --X509-skip-time-checks, --X509-skip-strict-checks and especially --insecure all turn off real security checks. they're right there in the list because sometimes you genuinely need them, and that's between you and your threat model. but do not just sprinkle them on top like glitter ✨
  • --crypto <name> — the name of the crypto engine to use, from this list: openssl, mscrypto, nss, gnutls, gcrypt. if no crypto engine is specified, then the default one is used.
  • --crypto-config <path> — path to crypto engine configuration.
  • --verbose — print detailed error messages. your best friend when everything is on fire 😭
  • --print-crypto-library-errors — print errors from the crypto library (OpenSSL only).
  • --repeat <number> — repeat the operation number times.
  • --base64-line-size <size> — sets the max line size for base64 encodings to size.
  • --transform-binary-chunk-size <size> — sets the transform's binary processing chunk size to size. increasing the chunk size might improve performance, at the expense of increased memory usage. classic tradeoff, no cap ⚖️
  • --transform-max-depth <depth> — sets the max depth for transforms execution to depth. set it to 0 to disable the max depth check.
  • --xxe — enable External Entity resolution.
⚠️ WARNING: this may allow the reading of arbitrary files and URLs, controlled by the input XML document. use with caution! like, genuinely. if you don't know why you'd need this, you don't need this. 🚨
  • --url-map:<url> <file> — maps a given url to the given file for loading external resources.
  • --help — print help information about the command. always valid, always free, always there for you 🫶

📝 AUTHOR

Written by Aleksey Sanin <aleksey@aleksey.com>.

🐛 REPORTING BUGS

Report bugs to http://www.aleksey.com/xmlsec/bugs.html.

Copyright © 2002-2026 Aleksey Sanin <aleksey@aleksey.com>. All Rights Reserved.

This is free software: see the source for copying information.

and that's a wrap on the whole page, bestie 💖 this one came from xmlsec1 1.3.12 (openssl), dated June 2026, and in full manual-page style she's filed under XMLSEC1(1). go forth and sign things correctly 👑✨

📦 where this page comes from