NAME

       ipsec_openac - Generation of X.509 attribute certificates

SYNOPSIS

       ipsec openac [ --help ] [ --version ] [ --optionsfrom filename ]
          [ --quiet ] [ --debug level ]
          [ --days days ] [ --hours hours ]
          [ --startdate YYYYMMDDHHMMSSZ ] [ --stopdate YYYYMMDDHHMMSSZ ]
          --cert certfile --key keyfile [ --password password ]
          --usercert certfile --groups attr1,attr2,...  --out filename

DESCRIPTION

       openac  is  intended  to  be used by an Authorization Authority (AA) to generate and sign X.509 attribute
       certificates. Currently only the inclusion of one ore several group attributes is supported. An attribute
       certificate is linked to a holder by including the  issuer  and  serial  number  of  the  holder's  X.509
       certificate.

OPTIONS

       --help display the usage message.

       --version
              display the version of openac.

       --optionsfrom filename
              adds  the contents of the file to the argument list.  If filename is a relative path then the file
              is searched in the directory /etc/openac.

       --quiet
              By default openac logs all control output both to syslog and stderr.  With the --quiet  option  no
              output is written to stderr.

       --days days
              Validity  of  the X.509 attribute certificate in days. If neiter the --days nor the --hours option
              is specified then a default validity interval of 1 day  is  assumed.   The  --days option  can  be
              combined with the --hours option.

       --hours hours
              Validity  of the X.509 attribute certificate in hours. If neiter the --hours nor the --days option
              is specified then a default validity interval of 24 hours is assumed.  The --hours option  can  be
              combined with the --days option.

       --startdate YYYYMMDDHHMMSSZ
              defines  the  notBefore  date  when  the  X.509  attribute  certificate  becomes  valid.  The date
              YYYYMMDDHHMMSS must be specified in UTC (Zulu time).  If the --startdate option is  not  specified
              then the current date is taken as a default.

       --stopdate YYYYMMDDHHMMSSZ
              defines   the  notAfter  date  when  the  X.509  attribute  certificate  will  expire.   The  date
              YYYYMMDDHHMMSS must be specified in UTC (Zulu time).  If the --stopdate option  is  not  specified
              then  the  default  notAfter  value  is  computed by adding the validity interval specified by the
              --days and/or --days options to the notBefore date.

       --cert certfile
              specifies the  file  containing  the  X.509  certificate  of  the  Authorization  Authority.   The
              certificate is stored either in PEM or DER format.

       --key keyfile
              specifies  the  encrypted file containing the private RSA key of the Authoritzation Authority. The
              private key is stored in PKCS#1 format.

       --password password
              specifies the password with which the private RSA keyfile defined by the  --key  option  has  been
              protected. If the option is missing then the password is prompted for on the command line.

       --usercert certfile
              specifies  file  containing  the  X.509  certificate  of the user to which the generated attribute
              certificate will apply. The certificate file is stored either in PEM or DER format.

       --groups attr1,attr2
              specifies a comma-separated list of group  attributes  that  will  go  into  the  X.509  attribute
              certificate.

       --out filename
              specifies the file where the generated X.509 attribute certificate will be stored to.

   Debugging
       openac  produces  a  prodigious  amount  of  debugging  information.   To do so, it must be compiled with
       -DDEBUG.  There are several classes of debugging  output,  and  openac  may  be  directed  to  produce  a
       selection of them.  All lines of debugging output are prefixed with ``| '' to distinguish them from error
       messages.

       When  openac  is  invoked,  it  may  be  given arguments to specify which classes to output.  The current
       options are:

       --debug level
              sets the debug level to 0 (none), 1 (normal), 2 (more), 3 (raw),  and  4  (private),  the  default
              level being 1.

EXIT STATUS

       The execution of openac terminates with one of the following two exit codes:

       0      means that the attribute certificate was successfully generated and stored.

       1      means that something went wrong.

FILES

       /etc/openac/serial   serial number of latest attribute certificate

SEE ALSO

       The  X.509  attribute certificates generated with openac can be used to enforce group policies defined by
       ipsec.conf(5). Use ipsec_auto(8) to load and list X.509 attribute certificates.

       For more information on X.509 attribute certificates, refer to the following IETF RFC:

              RFC 3281 An Internet Attribute Certificate Profile for Authorization

HISTORY

       The openac program was originally written by Ariane Seiler and Ueli Galizzi.  The software was recoded by
       Andreas Steffen using strongSwan's X.509 library and  the  ASN.1  code  synthesis  functions  written  by
       Christoph  Gysin  and Christoph Zwahlen.  All authors were with the Zurich University of Applied Sciences
       in Winterthur, Switzerland.

BUGS

       Bugs should be reported to the <users@lists.strongswan.org> mailing list.

                                                22 September 2007                                IPSEC_OPENAC(8)