OPENSSL-STOREUTL(1ossl)

💾 OPENSSL-STOREUTL 💾

okay so bestie, welcome to openssl-storeutl from the 1ossl manual section — literally the STORE command, and it's giving "let me show you what's inside that URI" energy ✨

---

🌸 SYNOPSIS 🌸

openssl storeutl [-help] [-out file] [-noout] [-passin arg] [-text arg]
[-r] [-certs] [-keys] [-crls] [-subject arg] [-issuer arg] [-serial arg]
[-alias arg] [-fingerprint arg] [-digest] [-engine id] [-provider name]
[-provider-path path] [-provparam [name:]key=value] [-propquery propq]
uri

---

💖 DESCRIPTION 💖

This command displays the contents fetched from the given URI — after decryption as the case may be 👀. That's it, that's the whole vibe. It opens the thing, decrypts if it needs to, and shows you what's in there. Iconic.

---

✨ OPTIONS ✨

• -help — prints a usage message. classic, helpful, we stan 🫶
• -out filename — specifies the output file to write to. If you don't pass this, standard output gets it 💅. The output file can be the same as the input, which leads to replacing the file contents. ⚠️ Note that file I/O is not atomic — the output file is truncated and then written. So yeah, no take-backsies 😭
• -noout — this option prevents output of the PEM data. lowkey the "don't @ me" of flags 🙈
• -passin arg — the key password source. For more info about the format of arg, check openssl-passphrase-options(1) 🔑
• -text — prints out the objects in text form, similarly to the -text output from openssl-x509(1), openssl-pkey(1), etc. human-readable slay ✨
• -r — fetch objects recursively when possible. it's giving "and what else is in there" 🔥
• -certs, -keys, -crls — only select the certificates, keys or CRLs from the given URI. However, if this URI would return a set of names (URIs), those are always returned.

Note that all options must be given before the uri argument. important!! 🎀

Note -keys selects exclusively private keys — there is no selector for public keys only. just so you know 💀

• -subject arg — search for an object having the subject name arg.

The arg must be formatted as /type0=value0/type1=value1/type2=.... Special characters may be escaped by \ (backslash), whitespace is retained. Empty values are permitted but are ignored for the search — that is, a search with an empty value will have the same effect as not specifying the type at all. Giving a single / will lead to an empty sequence of RDNs (a NULL-DN). Multi-valued RDNs can be formed by placing a + character instead of a / between the AttributeValueAssertions (AVAs) that specify the members of the set 🧚

Example:

"/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe"

• -issuer arg, -serial arg — search for an object having the given issuer name and serial number. These two options must be used together 👯‍♀️. The issuer arg must be formatted as /type0=value0/type1=value1/type2=..., characters may be escaped by \ (backslash), no spaces are skipped. The serial arg may be specified as a decimal value or a hex value if preceded by 0x 🔢
• -alias arg — search for an object having the given alias. nicknames but make it cryptography 💅
• -fingerprint arg — search for an object having the given fingerprint. the fingerprint of the object, not yours, bestie 🫶
• -digest — the digest that was used to compute the fingerprint given with -fingerprint. they're a package deal, iykyk ✨
• -engine id — see "Engine Options" in openssl(1). This option is deprecated. ⚠️ old news, we've moved on 💀
• -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). the whole provider squad, all accounted for 🦋

---

🔍 SEE ALSO 🔍

• openssl(1)

---

📜 HISTORY 📜

• This command was added in OpenSSL 1.1.1. a legend was born 👑
• The -engine option was deprecated in OpenSSL 3.0. rip bozo, respectfully 💐

---

⭐ COPYRIGHT ⭐

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page bestie, no cap, every flag and caveat intact 🌈

and a lil sign-off for the credits at the bottom: this is 3.5.0, dated 2026-09-25, and it lives under the name OPENSSL-STOREUTL(1ossl) 💖 go forth and inspect those URIs 🎀