Invoking ntp-keygen
===================

This program has no explanation.

If there is no new host key, look for an existing one. If one is not found, create it.

This section was generated by AutoGen, the aginfo template and the option descriptions for the ntp-keygen program.  It documents the ntp-keygen usage text and option meanings.

This software is released under a specialized copyright license.

ntp-keygen usage help (-?)
--------------------------

This is the automatically generated usage text for ntp-keygen:

     Using OpenSSL version 90704f
     ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.6
     USAGE:  ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
       Flg Arg Option-Name    Description
        -c Str certificate    certificate scheme
        -d no  debug-level    Increase output debug message level
                                     - may appear multiple times
        -D Str set-debug-level Set the output debug message level
                                     - may appear multiple times
        -e no  id-key         Write IFF or GQ identity keys
        -G no  gq-params      Generate GQ parameters and keys
        -H no  host-key       generate RSA host key
        -I no  iffkey         generate IFF parameters
        -i Str issuer-name    set issuer name
        -M no  md5key         generate MD5 keys
        -m Num modulus        modulus
                                     - it must be:  256 to 2048
        -P no  pvt-cert       generate PC private certificate
        -p Str pvt-passwd     output private password
        -q Str get-pvt-passwd input private password
        -S Str sign-key       generate sign key (RSA or DSA)
        -s Str subject-name   set subject name
        -T no  trusted-cert   trusted certificate (TC scheme)
        -V Num mv-params      generate <num> MV parameters
        -v Num mv-keys        update <num> MV keys
           opt version        Output version information and exit
        -? no  help           Display extended usage information and exit
        -! no  more-help      Extended usage information passed thru pager
        -> opt save-opts      Save the option state to a config file
        -< Str load-opts      Load options from a config file
                                     - disabled as --no-load-opts
                                     - may appear multiple times

     Options are specified by doubled hyphens and their name
     or by a single hyphen and the flag character.

     The following option preset mechanisms are supported:
      - reading file /users/stenn/.ntprc
      - reading file /deacon/backroom/snaps/ntp-stable/util/.ntprc
      - examining environment variables named NTP_KEYGEN_*

     If there is no new host key, look for an existing one.
     If one is not found, create it.

     please send bug reports to:  http://bugs.ntp.org, bugs@ntp.org

certificate option (-c)
-----------------------

This is the ``certificate scheme'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

scheme is one of RSA-MD2, RSA-MD5, RSA-SHA, RSA-SHA1, RSA-MDC2, RSA-RIPEMD160, DSA-SHA, or DSA-SHA1.

Select the certificate message digest/signature encryption scheme. Note that RSA schemes must be used with a RSA sign key and DSA schemes must be used with a DSA sign key.  The default without this option is RSA-MD5.

debug-level option (-d)
-----------------------

This is the ``increase output debug message level'' option.

This option has some usage constraints.  It:

  * may appear an unlimited number of times.

Increase the debugging message output level.

set-debug-level option (-D)
---------------------------

This is the ``set the output debug message level'' option.

This option has some usage constraints.  It:

  * may appear an unlimited number of times.

Set the output debugging level.  Can be supplied multiple times, but each overrides the previous value(s).

id-key option (-e)
------------------

This is the ``write iff or gq identity keys'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Write the IFF or GQ client keys to the standard output.  This is intended for automatic key distribution by mail.

gq-params option (-G)
---------------------

This is the ``generate gq parameters and keys'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Generate parameters and keys for the GQ identification scheme, obsoleting any that may exist.

host-key option (-H)
--------------------

This is the ``generate rsa host key'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Generate new host keys, obsoleting any that may exist.

iffkey option (-I)
------------------

This is the ``generate iff parameters'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Generate parameters for the IFF identification scheme, obsoleting any that may exist.

issuer-name option (-i)
-----------------------

This is the ``set issuer name'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Set the suject name to name.  This is used as the subject field in certificates and in the file name for host and sign keys.

md5key option (-M)
------------------

This is the ``generate md5 keys'' option. Generate MD5 keys, obsoleting any that may exist.

modulus option (-m)
-------------------

This is the ``modulus'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

The number of bits in the prime modulus.  The default is 512.

pvt-cert option (-P)
--------------------

This is the ``generate pc private certificate'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Generate a private certificate.  By default, the program generates public certificates.

pvt-passwd option (-p)
----------------------

This is the ``output private password'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Encrypt generated files containing private data with the specified password and the DES-CBC algorithm.

get-pvt-passwd option (-q)
--------------------------

This is the ``input private password'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Set the password for reading files to the specified password.

sign-key option (-S)
--------------------

This is the ``generate sign key (rsa or dsa)'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Generate a new sign key of the designated type, obsoleting any that may exist.  By default, the program uses the host key as the sign key.

subject-name option (-s)
------------------------

This is the ``set subject name'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Set the issuer name to name.  This is used for the issuer field in certificates and in the file name for identity files.

trusted-cert option (-T)
------------------------

This is the ``trusted certificate (tc scheme)'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Generate a trusted certificate.  By default, the program generates a non-trusted certificate.

mv-params option (-V)
---------------------

This is the ``generate <num> mv parameters'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

Generate parameters and keys for the Mu-Varadharajan (MV) identification scheme.

mv-keys option (-v)
-------------------

This is the ``update <num> mv keys'' option.

This option has some usage constraints.  It:

  * must be compiled in by defining OPENSSL during the compilation.

This option has no doc documentation.