summaryrefslogtreecommitdiff
path: root/openvpn/doc/management-notes.txt
diff options
context:
space:
mode:
authorarne@gaia.fritz.box <arne@gaia.fritz.box>2012-12-25 23:22:13 +0100
committerarne@gaia.fritz.box <arne@gaia.fritz.box>2012-12-25 23:22:13 +0100
commit3018f292ff635d7ec61b3cd02a1e13659819683f (patch)
tree32de630e310e6055124ee92a0d5788a76f6cd94d /openvpn/doc/management-notes.txt
parent83dfeaa842bd42840698bdce9a91207a75395b3e (diff)
parent80d073d5fd79e0c57e33e708e6917e9f36c9bebc (diff)
Merge local changes with repository
Diffstat (limited to 'openvpn/doc/management-notes.txt')
-rw-r--r--openvpn/doc/management-notes.txt28
1 files changed, 28 insertions, 0 deletions
diff --git a/openvpn/doc/management-notes.txt b/openvpn/doc/management-notes.txt
index a07a5142..ef39b855 100644
--- a/openvpn/doc/management-notes.txt
+++ b/openvpn/doc/management-notes.txt
@@ -750,6 +750,34 @@ To accept connecting to the host and port directly, use this command:
proxy NONE
+COMMAND -- rsa-sig (OpenVPN 2.3 or higher)
+------------------------------------------
+Provides support for external storage of the private key. Requires the
+--management-external-key option. This option can be used instead of "key"
+in client mode, and allows the client to run without the need to load the
+actual private key. When the SSL protocol needs to perform an RSA sign
+operation, the data to be signed will be sent to the management interface
+via a notification as follows:
+
+>RSA_SIGN:[BASE64_DATA]
+
+The management interface client should then sign BASE64_DATA
+using the private key and return the SSL signature as follows:
+
+rsa-sig
+[BASE64_SIG_LINE]
+.
+.
+.
+END
+
+Base64 encoded output of RSA_sign(NID_md5_sha1,... will provide a
+correct signature.
+
+This capability is intended to allow the use of arbitrary cryptographic
+service providers with OpenVPN via the management interface.
+
+
OUTPUT FORMAT
-------------