# XML Security Library: Command Line Utility

# NAME

xmlsec1 - sign, verify, encrypt and decrypt XML documents

# SYNOPSIS

**xmlsec** *\<command\> *\[*\<options\>*\] \[*\<files\>*\]

# DESCRIPTION

xmlsec is a command line tool for signing, verifying, encrypting and
decrypting XML documents. The allowed \<command\> values are:

**\--help**

:   display this help information and exit

**\--help-all**

:   display help information for all commands/options and exit

**\--help-**\<cmd\>

:   display help information for command \<cmd\> and exit

**\--version**

:   print version information and exit

**\--keys**

:   keys XML file manipulation

**\--sign**

:   sign data and output XML document

**\--verify**

:   verify signed document

**\--encrypt**

:   encrypt data and output XML document

**\--decrypt**

:   decrypt data from XML document

# OPTIONS

**\--ignore-manifests**

> do not process \<dsig:Manifest\> elements

**\--store-references**

> store and print the result of \<dsig:Reference/\> element processing
> just before calculating digest

**\--store-signatures**

> store and print the result of \<dsig:Signature\> processing just
> before calculating signature

**\--enabled-reference-uris** \<list\>

> comma separated list of of the following values: \"empty\",
> \"same-doc\", \"local\",\"remote\" to restrict possible URI attribute
> values for the \<dsig:Reference\> element

**\--enable-visa3d-hack**

> enables Visa3D protocol specific hack for URI attributes processing
> when we are trying not to use XPath/XPointer engine; this is a hack
> and I don\'t know what else might be broken in your application when
> you use it (also check \"\--id-attr\" option because you might need
> it)

**\--enable-asn1-signatures-hack**

> enables support for ASN1 signature values generated by some XMLDsig
> implementations.

**\--hmac-min-out-len** \<bits\>

> sets minimum HMAC output length to \<bits\>

**\--binary-data** \<file\>

> binary \<file\> to encrypt

**\--xml-data** \<file\>

> XML \<file\> to encrypt

**\--enabled-cipher-reference-uris** \<list\>

> comma separated list of of the following values: \"empty\",
> \"same-doc\", \"local\",\"remote\" to restrict possible URI attribute
> values for the \<enc:CipherReference\> element

**\--session-key** \<keyKlass\>-\<keySize\>

> generate new session \<keyKlass\> key of \<keySize\> bits size (for
> example, \"\--session des-192\" generates a new 192 bits DES key for
> DES3 encryption)

**\--output** \<filename\>

> write result document to file \<filename\>; the \<filename\> can be a
> template and include \'{inputfile}\' which will be repaced with the
> input filename

**\--print-debug**

> print debug information to stdout

**\--print-xml-debug**

> print debug information to stdout in xml format

**\--dtd-file** \<file\>

> load the specified file as the DTD

**\--node-id** \<id\>

> set the operation start point to the node with given \<id\>

**\--node-name** \[\<namespace-uri\>:\]\<name\>

> set the operation start point to the first node with given \<name\>
> and \<namespace\> URI

**\--node-xpath** \<expr\>

> set the operation start point to the first node selected by the
> specified XPath expression

**\--id-attr\[**:\<attr-name\>\]
\[\<node-namespace-uri\>:\]\<node-name\>

> adds attributes \<attr-name\> (default value \"id\") from all nodes
> with\<node-name\> and namespace \<node-namespace-uri\> to the list of
> known ID attributes; this is a hack and if you can use DTD or schema
> to declare ID attributes instead (see \"\--dtd-file\" option)

**\--add-id-attr** \<id-attribute-name\>

> adds attribute \<id-attribute-name\> to all nodes in the document;
> this is a hack and if you can use DTD or schema to declare ID
> attributes instead (see \"\--dtd-file\" option)

**\--enabled-key-data** \<list\>

> comma-separated list of key-data types to enable. Example:

rsa,key-value,x509

:   -\> populates \<RSAKeyValue\> and keeps \<X509Data\>

when \<KeyValue/\> and \<X509Data/\> placeholders

:   are present in the template.

    Use \"\--list-key-data\" to view full list of registered key data
    klasses. By default, all registered key data are enabled.

**\--enabled-retrieval-method-uris** \<list\>

> comma separated list of of the following values: \"empty\",
> \"same-doc\", \"local\",\"remote\" to restrict possible URI attribute
> values for the \<dsig:RetrievalMethod\> element.

**\--enabled-key-info-reference-uris** \<list\>

> comma separated list of of the following values: \"empty\",
> \"same-doc\", \"local\",\"remote\" to restrict possible URI attribute
> values for the \<dsig11:KeyInfoReference\> element.

**\--gen-key\[**:\<name\>\] \<keyKlass\>-\<keySize\>

> generate new \<keyKlass\> key of \<keySize\> bits size, set the key
> name to \<name\> and add the result to keys manager (for example,
> \"\--gen:MyKeyName rsa-1024\" generates a new 1024 bits RSA key and
> sets it\'s name to \"MyKeyName\")

**\--keys-file** \<file\>

> load keys from XML file

**\--privkey-pem\[**:\<name\>\]
\<file\>\[,\<cafile\>\[,\<cafile\>\[\...\]\]\]

> load private key from PEM file and certificates that verify this key

**\--privkey-der\[**:\<name\>\]
\<file\>\[,\<cafile\>\[,\<cafile\>\[\...\]\]\]

> load private key from DER file and certificates that verify this key

**\--pkcs8-pem\[**:\<name\>\]
\<file\>\[,\<cafile\>\[,\<cafile\>\[\...\]\]\]

> load private key from PKCS8 PEM file and PEM certificates that verify
> this key

**\--pkcs8-der\[**:\<name\>\]
\<file\>\[,\<cafile\>\[,\<cafile\>\[\...\]\]\]

> load private key from PKCS8 DER file and DER certificates that verify
> this key

**\--privkey-openssl-store\[**:\<name\>\] \<uri\>

> load private key and certs through OpenSSL ossl_store interface (e.g.
> from HSM)

**\--privkey-openssl-engine\[**:\<name\>\]
\<openssl-engine\>;\<openssl-key-id\>\[,\<crtfile\>\[,\<crtfile\>\[\...\]\]\]

> load private key by OpenSSL ENGINE interface; specify the name of
> engine (like with **-engine** params), the key specs (like with
> **-inkey** or **-key** params) and optionally certificates that verify
> this key

**\--pubkey-pem\[**:\<name\>\] \<file\>

> load public key from PEM file

**\--pubkey-der\[**:\<name\>\] \<file\>

> load public key from DER file

**\--pubkey-openssl-store\[**:\<name\>\] \<uri\>

> load pubkey key and certs through OpenSSL ossl_store interface (e.g.
> from HSM)

**\--pubkey-openssl-engine\[**:\<name\>\]
\<openssl-engine\>;\<openssl-key-id\>\[,\<crtfile\>\[,\<crtfile\>\[\...\]\]\]

> load public key by OpenSSL ENGINE interface; specify the name of
> engine (like with **-engine** params), the key specs (like with
> **-inkey** or **-key** params) and optionally certificates that verify
> this key

**\--pwd** \<password\>

> the password to use for reading keys and certs

**\--lax-key-search**

> enable lax key search (e.g. by key type like \"rsa\") vs default
> strict key search mode using only information from \<dsig:KeyInfo/\>
> node (e.g. key name)

**\--verify-keys**

> force verification of public/private keys loaded from the command:
> keys are required to have a key certificate that will be verified
> against the certificates in the key store

**\--aes-key\[**:\<name\>\] \<file\>

> load AES key from binary file \<file\>

**\--camellia-key\[**:\<name\>\] \<file\>

> load Camellia key from binary file \<file\>

**\--chacha20-key\[**:\<name\>\] \<file\>

> load ChaCha20 key from binary file \<file\>

**\--concatkdf-key\[**:\<name\>\] \<file\>

> load ConcatKDF key from binary file \<file\>

**\--des-key\[**:\<name\>\] \<file\>

> load DES key from binary file \<file\>

**\--hmac-key\[**:\<name\>\] \<file\>

> load HMAC key from binary file \<file\>

**\--pbkdf2-key\[**:\<name\>\] \<file\>

> load Pbkdf2 key from binary file \<file\>

**\--hkdf-key\[**:\<name\>\] \<file\>

> load HKDF key (IKM) from binary file \<file\>

**\--pkcs12\[**:\<name\>\] \<file\>

> load load private key from pkcs12 file \<file\>

**\--pkcs12-persist**

> persist loaded private key

**\--pubkey-cert-pem\[**:\<name\>\] \<file\>

> load public key from PEM cert file

**\--pubkey-cert-der\[**:\<name\>\] \<file\>

> load public key from DER cert file

**\--trusted-pem** \<file\>

> load trusted (root) certificate from PEM file \<file\>

**\--untrusted-pem** \<file\>

> load untrusted certificate from PEM file \<file\>

**\--trusted-der** \<file\>

> load trusted (root) certificate from DER file \<file\>

**\--untrusted-der** \<file\>

> load untrusted certificate from DER file \<file\>

**\--crl-pem** \<file\>

> load CRLs from PEM file \<file\>

**\--crl-der** \<file\>

> load CRLs from DER file \<file\>

**\--verify-crls**

> force verification of loaded CRLs: CRLs are required to have a valid
> signature from an issuer certificate in the trusted or untrusted
> certificate store, and must be within their validity period
> (thisUpdate/nextUpdate)

**\--verification-time** \<time\>

> the local time in \"YYYY-MM-DD HH:MM:SS\" format used certificates
> verification

**\--verification-gmt-time** \<time\>

> the GMT time in \"YYYY-MM-DD HH:MM:SS\" format used certificates
> verification

**\--X509-skip-time-checks**

> skip time checking of X509 certificates and CLRs

**\--depth** \<number\>

> maximum certificates chain depth

**\--X509-skip-strict-checks**

> skip strict checking of X509 data

**\--insecure**

> do not verify certificates or CRLs

**\--crypto** \<name\>

> the name of the crypto engine to use from the following list: openssl,
> mscrypto, nss, gnutls, gcrypt (if no crypto engine is specified then
> the default one is used)

**\--crypto-config** \<path\>

> path to crypto engine configuration

**\--verbose**

> print detailed error messages

**\--print-crypto-library-errors**

> print errors from crypto library (OpenSSL only)

**\--repeat** \<number\>

> repeat the operation \<number\> times

**\--base64-line-size** \<size\>

> sets the max line size for base64 encodings to \<size\>

**\--transform-binary-chunk-size** \<size\>

> sets the transforms binary processing chunk size to \<size\>;
> increasing chunk size might improve performance at the expense of
> increased memory usage

**\--xxe**

> enable External Entity resolution. WARNING: this may allow the reading
> of arbitrary files and URLs, controlled by the input XML document. Use
> with caution!

**\--url-map**:\<url\> \<file\>

> maps a given \<url\> to the given \<file\> for loading external
> resources

**\--help**

> print help information about the command

# AUTHOR

Written by Aleksey Sanin \<aleksey@aleksey.com\>.

# REPORTING BUGS

Report bugs to http://www.aleksey.com/xmlsec/bugs.html

# COPYRIGHT

Copyright © 2002-2026 Aleksey Sanin \<aleksey@aleksey.com\>. All Rights
Reserved.\
This is free software: see the source for copying information.