OPENSSL-SPKAC(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💅 openssl-spkac(1SSL) — the SPKAC printing & generating command

okay bestie so this is openssl-spkac, a page from the OpenSSL manual set, and it's literally all about SPKAC stuff — printing them, generating them, verifying them. Netscape-era energy but make it useful. 🦋

✨ SYNOPSIS ✨

openssl spkac [-help] [-in filename] [-out filename] [-digest digest]
[-key filename|uri] [-keyform DER|PEM|P12] [-passin arg] [-challenge
string] [-pubkey] [-spkac spkacname] [-spksect section] [-noout]
[-verify] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq]

🌸 DESCRIPTION 🌸

This command handles Netscape signed public key and challenge (SPKAC) files. It can do three (3) whole things and it eats every time:

  • print out their contents 😌
  • verify the signature 🔍
  • produce its own SPKACs from a private key you hand it 🔑

it's giving "small command, big responsibilities" fr fr.

🎀 OPTIONS 🎀

  • -help — prints out a usage message. classic. the little "hey here's how u use me" moment 💖
  • -in filename — tells it which input filename to read from. no option specified? it reads from standard input instead, no stress. heads up tho: this gets ignored if you use the -key option.
  • -out filename — which output filename to write to. default is standard output, so if u say nothing it just talks to ur terminal 🫶
  • -digest digest — use the specified digest to sign a created SPKAC file. the default digest algorithm is MD5 (yes bestie, MD5, we said what we said) 😭
  • -key filename|uri — create an SPKAC file using the private key specified by filename or uri. and real talk: the -in, -noout, -spksect and -verify options are ignored if they're present alongside it. they simply do not get a turn 💀
  • -keyform DER|PEM|P12 — the key format. unspecified by default. see openssl-format-options(1) for details ✨
  • -passin arg — the input file password source. for more info about the format of arg, see openssl-passphrase-options(1) 🔐
  • -challenge string — specifies the challenge string, if an SPKAC is being created. this is ur little "prove it's u" note 🎤
  • -spkac spkacname — lets you use an alternative name for the variable containing the SPKAC. the default is "SPKAC". and no cap, this option affects both generated and input SPKAC files 👑
  • -spksect section — allows an alternative name for the section containing the SPKAC. the default is the default section.
  • -noout — don't output the text version of the SPKAC. (not used if an SPKAC is being created, soz) 🙈
  • -pubkey — output the public key of an SPKAC. (also not used if an SPKAC is being created, same vibe) 🔑
  • -verify — verifies the digital signature on the supplied SPKAC. the vibe check for signatures, basically ✅
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). that's the whole lore drop, go read those 🧚

🌈 EXAMPLES 🌈

Print out the contents of an SPKAC:

openssl spkac -in spkac.cnf

Verify the signature of an SPKAC:

openssl spkac -in spkac.cnf -noout -verify

Create an SPKAC using the challenge string "hello":

openssl spkac -key key.pem -challenge hello -out spkac.cnf

Example of an SPKAC, (long lines split up for clarity):

SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA\
1cCoq2Wa3Ixs47uI7FPVwHVIPDx5yso105Y6zpozam135a\
8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03uPFoQIDAQAB\
FgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJ\
h1bEIYuc2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnD\
dq+NQ3F+X4deMx9AaEglZtULwV4=

💜 NOTES 💜

A created SPKAC with suitable DN components appended can be fed to openssl-ca(1). (yes, it's a whole pipeline, slay)

SPKACs are typically generated by Netscape when a form is submitted containing the KEYGEN tag as part of the certificate enrollment process. history class but make it crypto 📜

The challenge string permits a primitive form of proof of possession of the private key. by checking the SPKAC signature and a random challenge string, some guarantee is given that the user knows the private key corresponding to the public key being certified. this is important in some applications. without this, it's possible for a previous SPKAC to be used in a "replay attack". so like... don't skip the challenge, bestie. that's the whole point 😭

🫶 SEE ALSO 🫶

openssl(1), openssl-ca(1)

⭐ HISTORY ⭐

  • The -digest option was added in OpenSSL 3.0 ✨
  • The -engine option was removed in OpenSSL 4.0. it's gone bestie, we don't talk about it 💀

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. (yes that's a link, go read it, it's the law and also it's giving responsible 🌸)

and that's the whole page, bestie!! this lovely little writeup is from OpenSSL 4.0.3, dated 2026-09-29, and it lives under the manual name OPENSSL-SPKAC(1SSL). go forth and process those SPKACs 💖✨🎀

📦 where this page comes from