<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN"
       	"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" [
<!ENTITY authors  SYSTEM "authors.sgml">
<!ENTITY bugzilla SYSTEM "bugzilla.sgml">
<!ENTITY license  SYSTEM "license.sgml">
<!ENTITY links    SYSTEM "links.sgml">
]>

<refentry id='vomsproxyfake1'>
<refmeta>
<refentrytitle>voms-proxy-fake</refentrytitle>
<manvolnum>1</manvolnum>
<refmiscinfo class='source'>VOMS Client</refmiscinfo>
</refmeta>

<refnamediv id='name'>
<refname>voms-proxy-fake</refname>
<refpurpose>create a proxy with VOMS extensions</refpurpose>
</refnamediv>

<refsynopsisdiv id='synopsis'>
<cmdsynopsis>
<command>voms-proxy-fake</command>
<arg choice='opt'><arg choice='plain'>options</arg></arg>
</cmdsynopsis>
</refsynopsisdiv>

<refsect1 id='description'><title>Description</title>

<para>The voms-proxy-fake generates a proxy containing arbitrary attributes
without contacting the VOMS server.</para>

</refsect1>

<refsect1 id='options'><title>Options</title>

<para>Options may be specified indifferently with either a "-" or "--" prefix.  
</para>

<para><option>-help</option>
Displays usage.</para>

<para><option>-version</option>
Displays version.</para>

<para><option>-debug</option>
Enables extra debug output.</para>

<para><option>-q</option>
Quiet mode, minimal output.</para>

<para><option>-verify</option>
Verifies certificate to make proxy for.</para>

<para><option>-pwstdin</option>
Allows passphrase from stdin.</para>

<para><option>-limited</option>
Creates a limited proxy.</para>

<para><option>-hours</option> <replaceable>H</replaceable>
Proxy is valid for <emphasis remap='I'>H</emphasis> hours (default:12).</para>

<para><option>-vomslife</option> <replaceable>H</replaceable>
Tries to get an AC with information valid for <emphasis remap='I'>H</emphasis> hours. The
default is "as long as the proxy certificate". The special value <literal>0</literal> means
as long as the server will allow.</para>

<para><option>-bits</option> <replaceable>B</replaceable>
Number of bits in key {0|512|1024|2048|4096}.  0 is a special value
which means: same number of bits as in the issuing certificate.</para>

<para><option>-cert</option> <replaceable>certfile</replaceable>
Non-standard location of user certificate</para>

<para><option>-key</option> <replaceable>keyfile</replaceable>
Non-standard location of user key</para>

<para><option>-certdir</option> <replaceable>certdir</replaceable>
Location of trusted certificates dir</para>

<para><option>-out</option> <replaceable>proxyfile</replaceable>
Location of new proxy cert</para>

<para><option>-voms</option> <replaceable>voms[:command]</replaceable>
Specifies the fake VOMS server that will appear in the attribute certificate.  
command is ignored and is present for compatibility with voms-proxy-init.</para>

<para><option>-include</option> <replaceable>file</replaceable>
Includes <emphasis remap='I'>file</emphasis> in the certificate (in a non
critical extension)</para>

<para><option>-conf</option> <replaceable>file</replaceable>
Read options from <emphasis remap='I'>file</emphasis>.</para>

<para><option>-policy</option>
The file containing the policy expression.</para>

<para><option>-policy-language</option><replaceable> pl</replaceable>
The language in which the policy is expressed. Default is IMPERSONATION_PROXY.</para>

<para><option>-path-length</option>
Maximum depth of proxy certfificate that can be signed from this.</para>

<para><option>-globus</option> <replaceable>version</replaceable>
This option is obsolete and only present for backwards compatibility
  with old installations.  Currently, its value is ignored.</para>

<para><option>-proxyver</option>
Version of the proxy certificate to create. May be 2 or 3.
Default value is decided upon underlying globus version.</para>

<para><option>-separate</option> <replaceable>file</replaceable>
Saves the voms credential on file <emphasis remap='I'>file</emphasis>.</para>

<para><option>-hostcert</option> <replaceable>file</replaceable>
The cert that will be used to sign the AC.</para>

<para><option>-hostkey</option> <replaceable>file</replaceable>
The key thet will be used to sign the AC.</para>

<para><option>-fqan</option> <replaceable>file</replaceable>
The string that will be included in the AC as the granted FQAN.</para>

<para><option>-newformat</option></para>
<para>This forces the server to generate ACs in the new (correct) format.  This is meant
as a compatibility feature to ease migration while the servers upgrade to the new version.</para>

<para><option>-newsubject</option> <replaceable>newdn</replaceable></para>
<para>The created proxy will have <emphasis remap='I'>newdn</emphasis> as
subject rather  than what is would normally have depending on the
specific version of proxy created. Non-printable characters may be specified
via the '\XX' encoding, where XX are two hexadecimal characters.</para>

<para><option>-newissuer</option> <replaceable>newdn</replaceable></para>
<para>The created proxy will have <emphasis remap='I'>newdn</emphasis> as
issuer rather  than what is would normally have depending on the
specific version of proxy created. Non-printable characters may be specified
via the '\XX' encoding, where XX are two hexadecimal characters.</para>

<para><option>-newserial</option> <replaceable>newserial</replaceable></para>
<para>The created proxy will have
  the <emphasis remap='I'>newserial</emphasis> as its serial number.
  The new serial number will have to be specified as an hex
  representation.  Any length is possible.  If this option is not
  specified, voms-proxy-fake will choose the serial number.</para>

<para><option>-pastac</option> <replaceable>timespec</replaceable></para>
<para>
The created AC will have its validity start in the past, as specified
by <emphasis remap='I'>timespec</emphasis>.</para>

<para>The format
of <emphasis remap='I'>timespec</emphasis> is one
of: <emphasis remap='I'>seconds</emphasis>, <emphasis remap='I'>hours:minutes</emphasis>, 
<emphasis remap='I'>hours:minutes:seconds</emphasis></para>

<para><option>-pastproxy</option> <replaceable>timespec</replaceable></para>
<para>The created proxy will have its validity start in the past as
  specified by <emphasis remap='I'>timespec</emphasis></para>

<para>The format
of <emphasis remap='I'>timespec</emphasis> is one
of: <emphasis remap='I'>seconds</emphasis>, <emphasis remap='I'>hours:minutes</emphasis>, 
<emphasis remap='I'>hours:minutes:seconds</emphasis></para>

<para><option>-nscert</option> <replaceable>bit,...,bit</replaceable></para>
<para>The created proxy will have the specified bits in the Netscape
  Certificate Extension.  Acceptable values
  for <emphasis remap='I'>bit</emphasis> are: client, server, email,
  objsign, sslCA, emailCA, objCA.  The default value is not to have
  this extension.</para>

<para><option>-extkeyusage</option> <replaceable>bit,...,bit</replaceable></para>
<para>The created proxy will have the specified bits in the Extended
  Key Usage Extension. Acceptable values
  for <emphasis remap='I'>bit</emphasis> are: serverAuth, clientAuth,
  codeSigning, emailProtection, timeStamping, msCodeInd, msCodeCom,
  msCTLSign, msSGC, msEFS, nsSGC, deltaCRL.  The default value is not
  to have this extensions.</para>

<para><option>-keyusage</option> <replaceable>bit,...,bit</replaceable></para>
<para>The created proxy will have the specified bits in the Key Usage
  Extensions. Acceptable values for <emphasis remap='I'>bit</emphasis>
  are: digitalSignature, nonRepudiation, keyEncipherment,
  dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly,
  decipherOnly.  The default value is to copy this extensions from the
  issuer certificate while removing the keyCertSign and nonRepudiation
  bits if present.</para>

<para><option>-selfsigned</option></para>
<para>The created certificate will be a self-signed certificate and
  have a CA=true bit in the Basic constraints Exception.</para>

<para><option>-extension</option> <replaceable>oid[/criticality]value</replaceable></para>
<para>This option allows one to specify additional extensions to be put
  in the created certificate.</para>
<para><emphasis remap='I'>oid</emphasis> is the Object Identifier of
  the extensions.  Any OID may be used even if it is not already known
  in advance.  This must always be specified.  There is no
  default.</para> 
<para><emphasis remap='I'>criticality</emphasis> specifies whether the
  extensions is critical or not, and it must be
  either <emphasis remap='I'>true</emphasis>
  or <emphasis remap='I'>false</emphasis>.  If absent, it defaults to
  <emphasis remap='I'>false</emphasis>.</para>
<para><emphasis remap='I'>value</emphasis> is the value of the
  extensions. It is composed by two
  subfields, <emphasis remap='I'>type</emphasis>
  and <emphasis remap='I'>content</emphasis>. <emphasis remap='I'>type</emphasis>
  is a single character, and specifies how
  the <emphasis remap='I'>content</emphasis> is interpreted.  ':'
  means that <emphasis remap='I'>content</emphasis> is a text string
  to be included as is. '~' means
  that <emphasis remap='I'>content</emphasis> is an hex representation
  of the string.  '+' means
  that <emphasis remap='I'>content</emphasis> is the name of a file
  which will contain the actual data.</para>  

<para><option>-acextension</option> <replaceable>oid[/criticality]value</replaceable></para>
<para>This option allows one to specify additional extensions to be put
  in the created attribute certificate.</para>
<para><emphasis remap='I'>oid</emphasis> is the Object Identifier of
  the extensions.  Any OID may be used even if it is not already known
  in advance.  This must always be specified.  There is no
  default.</para> 
<para><emphasis remap='I'>criticality</emphasis> specifies whether the
  extensions is critical or not, and it must be
  either <emphasis remap='I'>true</emphasis>
  or <emphasis remap='I'>false</emphasis>.  If absent, it defaults to
  <emphasis remap='I'>false</emphasis>.</para>
<para><emphasis remap='I'>value</emphasis> is the value of the
  extensions. It is composed by two
  subfields, <emphasis remap='I'>type</emphasis>
  and <emphasis remap='I'>content</emphasis>. <emphasis remap='I'>type</emphasis>
  is a single character, and specifies how
  the <emphasis remap='I'>content</emphasis> is interpreted.  ':'
  means that <emphasis remap='I'>content</emphasis> is a text string
  to be included as is. '~' means
  that <emphasis remap='I'>content</emphasis> is an hex representation
  of the string. '+' means that <emphasis remap='I'>content</emphasis>
  is the name of a file which will contain the actual data.</para>

<para><option>-ga</option> <replaceable>id</replaceable> = <replaceable>value</replaceable> <replaceable>[(qualifier)]</replaceable></para>

<para>This option adds the generic attribute specified to the AC generated.  Please note that spaces before and after the  '=' char are swallowed in the command line.</para>

<para><option>-voinfo</option> <replaceable>file</replaceable></para>

<para>
The file <emphasis remap='I'>file</emphasis> contains information for
  additional ACs that should be included in the created proxy.  ACs
  specified via the -voinfo option shall be added before ACs specified
  via the command line options.</para>

<para>The format of the file is the following:</para>


<para>[<emphasis remap='I'>voname</emphasis>]</para>
<para><emphasis remap='I'>parameter</emphasis>=<emphasis remap='I'>value</emphasis></para>
<para><emphasis remap='I'>parameter</emphasis>=<emphasis remap='I'>value</emphasis></para>
<para><emphasis remap='I'>...</emphasis></para>


</refsect1>

&bugzilla;

<refsect1 id='seealso'><title>See also</title>

<para>voms-proxy-fake(1), voms-proxy-init(1), voms-proxy-info(1), voms-proxy-destroy(1)</para>

&links;

</refsect1>

&authors;

&license;

</refentry>
