Restored ability to decrypt PKCS #8 and #12 keys with a NULL password. Certtool now accepts the option --null-password.

1 files changed, 291 insertions, 268 deletions

diff --git a/src/certtool-args.c b/src/certtool-args.c
index 58e045fe07..269adc5138 100644
--- a/src/certtool-args.c
+++ b/src/certtool-args.c
@@ -2,7 +2,7 @@
  *  
  *  DO NOT EDIT THIS FILE   (certtool-args.c)
  *  
- *  It has been AutoGen-ed  June 25, 2012 at 07:39:02 PM by AutoGen 5.16
+ *  It has been AutoGen-ed  August  4, 2012 at 12:13:08 PM by AutoGen 5.16
  *  From the definitions    certtool-args.def
  *  and the template file   options
  *
@@ -67,7 +67,7 @@ extern FILE * option_usage_fp;
 /*
  *  certtool option static const strings
  */
-static char const certtool_opt_strs[4606] =
+static char const certtool_opt_strs[4658] =
 /*     0 */ "certtool @VERSION@\n"
             "Copyright (C) 2000-2012 Free Software Foundation, all rights reserved.\n"
             "This is free software. It is licensed for use, modification and\n"
@@ -153,112 +153,115 @@ static char const certtool_opt_strs[4606] =
 /*  2257 */ "Password to use\0"
 /*  2273 */ "PASSWORD\0"
 /*  2282 */ "password\0"
-/*  2291 */ "Print information on the given certificate\0"
-/*  2334 */ "CERTIFICATE_INFO\0"
-/*  2351 */ "certificate-info\0"
-/*  2368 */ "Print certificate's public key\0"
-/*  2399 */ "CERTIFICATE_PUBKEY\0"
-/*  2418 */ "certificate-pubkey\0"
-/*  2437 */ "Print information on the given OpenPGP certificate\0"
-/*  2488 */ "PGP_CERTIFICATE_INFO\0"
-/*  2509 */ "pgp-certificate-info\0"
-/*  2530 */ "Print information on the given OpenPGP keyring structure\0"
-/*  2587 */ "PGP_RING_INFO\0"
-/*  2601 */ "pgp-ring-info\0"
-/*  2615 */ "Print information on the given CRL structure\0"
-/*  2660 */ "CRL_INFO\0"
-/*  2669 */ "crl-info\0"
-/*  2678 */ "Print information on the given certificate request\0"
-/*  2729 */ "CRQ_INFO\0"
-/*  2738 */ "crq-info\0"
-/*  2747 */ "Do not use extensions in certificate requests\0"
-/*  2793 */ "NO_CRQ_EXTENSIONS\0"
-/*  2811 */ "no-crq-extensions\0"
-/*  2829 */ "Print information on a PKCS #12 structure\0"
-/*  2871 */ "P12_INFO\0"
-/*  2880 */ "p12-info\0"
-/*  2889 */ "Print information on a PKCS #7 structure\0"
-/*  2930 */ "P7_INFO\0"
-/*  2938 */ "p7-info\0"
-/*  2946 */ "Convert S/MIME to PKCS #7 structure\0"
-/*  2982 */ "SMIME_TO_P7\0"
-/*  2994 */ "smime-to-p7\0"
-/*  3006 */ "Print information on a private key\0"
-/*  3041 */ "KEY_INFO\0"
-/*  3050 */ "key-info\0"
-/*  3059 */ "Print information on an OpenPGP private key\0"
-/*  3103 */ "PGP_KEY_INFO\0"
-/*  3116 */ "pgp-key-info\0"
-/*  3129 */ "Print information on a public key\0"
-/*  3163 */ "PUBKEY_INFO\0"
-/*  3175 */ "pubkey-info\0"
-/*  3187 */ "Generate an X.509 version 1 certificate (with no extensions)\0"
-/*  3248 */ "V1\0"
-/*  3251 */ "v1\0"
-/*  3254 */ "Generate a PKCS #12 structure\0"
-/*  3284 */ "TO_P12\0"
-/*  3291 */ "to-p12\0"
-/*  3298 */ "Generate a PKCS #8 structure\0"
-/*  3327 */ "TO_P8\0"
-/*  3333 */ "to-p8\0"
-/*  3339 */ "Use PKCS #8 format for private keys\0"
-/*  3375 */ "PKCS8\0"
-/*  3381 */ "pkcs8\0"
-/*  3387 */ "Generate RSA key\0"
-/*  3404 */ "RSA\0"
-/*  3408 */ "rsa\0"
-/*  3412 */ "Generate DSA key\0"
-/*  3429 */ "DSA\0"
-/*  3433 */ "dsa\0"
-/*  3437 */ "Generate ECC (ECDSA) key\0"
-/*  3462 */ "ECC\0"
-/*  3466 */ "ecc\0"
-/*  3470 */ "Hash algorithm to use for signing.\0"
-/*  3505 */ "HASH\0"
-/*  3510 */ "hash\0"
-/*  3515 */ "Use DER format for input certificates and private keys.\0"
-/*  3571 */ "INDER\0"
-/*  3577 */ "no-inder\0"
-/*  3586 */ "no\0"
-/*  3589 */ "This is an alias for 'inder'\0"
-/*  3618 */ "inraw\0"
-/*  3624 */ "Use DER format for output certificates and private keys\0"
-/*  3680 */ "OUTDER\0"
-/*  3687 */ "no-outder\0"
-/*  3697 */ "This is an alias for 'outder'\0"
-/*  3727 */ "outraw\0"
-/*  3734 */ "Specify the number of bits for key generate\0"
-/*  3778 */ "BITS\0"
-/*  3783 */ "bits\0"
-/*  3788 */ "Specify the security level [low, legacy, normal, high, ultra].\0"
-/*  3851 */ "SEC_PARAM\0"
-/*  3861 */ "sec-param\0"
-/*  3871 */ "No effect\0"
-/*  3881 */ "DISABLE_QUICK_RANDOM\0"
-/*  3902 */ "disable-quick-random\0"
-/*  3923 */ "Template file to use for non-interactive operation\0"
-/*  3974 */ "TEMPLATE\0"
-/*  3983 */ "template\0"
-/*  3992 */ "Cipher to use for PKCS #8 and #12 operations\0"
-/*  4037 */ "PKCS_CIPHER\0"
-/*  4049 */ "pkcs-cipher\0"
-/*  4061 */ "Display extended usage information and exit\0"
-/*  4105 */ "help\0"
-/*  4110 */ "Extended usage information passed thru pager\0"
-/*  4155 */ "more-help\0"
-/*  4165 */ "Output version information and exit\0"
-/*  4201 */ "version\0"
-/*  4209 */ "CERTTOOL\0"
-/*  4218 */ "certtool - GnuTLS PKCS #11 tool - Ver. @VERSION@\n"
+/*  2291 */ "Enforce a NULL password\0"
+/*  2315 */ "NULL_PASSWORD\0"
+/*  2329 */ "null-password\0"
+/*  2343 */ "Print information on the given certificate\0"
+/*  2386 */ "CERTIFICATE_INFO\0"
+/*  2403 */ "certificate-info\0"
+/*  2420 */ "Print certificate's public key\0"
+/*  2451 */ "CERTIFICATE_PUBKEY\0"
+/*  2470 */ "certificate-pubkey\0"
+/*  2489 */ "Print information on the given OpenPGP certificate\0"
+/*  2540 */ "PGP_CERTIFICATE_INFO\0"
+/*  2561 */ "pgp-certificate-info\0"
+/*  2582 */ "Print information on the given OpenPGP keyring structure\0"
+/*  2639 */ "PGP_RING_INFO\0"
+/*  2653 */ "pgp-ring-info\0"
+/*  2667 */ "Print information on the given CRL structure\0"
+/*  2712 */ "CRL_INFO\0"
+/*  2721 */ "crl-info\0"
+/*  2730 */ "Print information on the given certificate request\0"
+/*  2781 */ "CRQ_INFO\0"
+/*  2790 */ "crq-info\0"
+/*  2799 */ "Do not use extensions in certificate requests\0"
+/*  2845 */ "NO_CRQ_EXTENSIONS\0"
+/*  2863 */ "no-crq-extensions\0"
+/*  2881 */ "Print information on a PKCS #12 structure\0"
+/*  2923 */ "P12_INFO\0"
+/*  2932 */ "p12-info\0"
+/*  2941 */ "Print information on a PKCS #7 structure\0"
+/*  2982 */ "P7_INFO\0"
+/*  2990 */ "p7-info\0"
+/*  2998 */ "Convert S/MIME to PKCS #7 structure\0"
+/*  3034 */ "SMIME_TO_P7\0"
+/*  3046 */ "smime-to-p7\0"
+/*  3058 */ "Print information on a private key\0"
+/*  3093 */ "KEY_INFO\0"
+/*  3102 */ "key-info\0"
+/*  3111 */ "Print information on an OpenPGP private key\0"
+/*  3155 */ "PGP_KEY_INFO\0"
+/*  3168 */ "pgp-key-info\0"
+/*  3181 */ "Print information on a public key\0"
+/*  3215 */ "PUBKEY_INFO\0"
+/*  3227 */ "pubkey-info\0"
+/*  3239 */ "Generate an X.509 version 1 certificate (with no extensions)\0"
+/*  3300 */ "V1\0"
+/*  3303 */ "v1\0"
+/*  3306 */ "Generate a PKCS #12 structure\0"
+/*  3336 */ "TO_P12\0"
+/*  3343 */ "to-p12\0"
+/*  3350 */ "Generate a PKCS #8 structure\0"
+/*  3379 */ "TO_P8\0"
+/*  3385 */ "to-p8\0"
+/*  3391 */ "Use PKCS #8 format for private keys\0"
+/*  3427 */ "PKCS8\0"
+/*  3433 */ "pkcs8\0"
+/*  3439 */ "Generate RSA key\0"
+/*  3456 */ "RSA\0"
+/*  3460 */ "rsa\0"
+/*  3464 */ "Generate DSA key\0"
+/*  3481 */ "DSA\0"
+/*  3485 */ "dsa\0"
+/*  3489 */ "Generate ECC (ECDSA) key\0"
+/*  3514 */ "ECC\0"
+/*  3518 */ "ecc\0"
+/*  3522 */ "Hash algorithm to use for signing.\0"
+/*  3557 */ "HASH\0"
+/*  3562 */ "hash\0"
+/*  3567 */ "Use DER format for input certificates and private keys.\0"
+/*  3623 */ "INDER\0"
+/*  3629 */ "no-inder\0"
+/*  3638 */ "no\0"
+/*  3641 */ "This is an alias for 'inder'\0"
+/*  3670 */ "inraw\0"
+/*  3676 */ "Use DER format for output certificates and private keys\0"
+/*  3732 */ "OUTDER\0"
+/*  3739 */ "no-outder\0"
+/*  3749 */ "This is an alias for 'outder'\0"
+/*  3779 */ "outraw\0"
+/*  3786 */ "Specify the number of bits for key generate\0"
+/*  3830 */ "BITS\0"
+/*  3835 */ "bits\0"
+/*  3840 */ "Specify the security level [low, legacy, normal, high, ultra].\0"
+/*  3903 */ "SEC_PARAM\0"
+/*  3913 */ "sec-param\0"
+/*  3923 */ "No effect\0"
+/*  3933 */ "DISABLE_QUICK_RANDOM\0"
+/*  3954 */ "disable-quick-random\0"
+/*  3975 */ "Template file to use for non-interactive operation\0"
+/*  4026 */ "TEMPLATE\0"
+/*  4035 */ "template\0"
+/*  4044 */ "Cipher to use for PKCS #8 and #12 operations\0"
+/*  4089 */ "PKCS_CIPHER\0"
+/*  4101 */ "pkcs-cipher\0"
+/*  4113 */ "Display extended usage information and exit\0"
+/*  4157 */ "help\0"
+/*  4162 */ "Extended usage information passed thru pager\0"
+/*  4207 */ "more-help\0"
+/*  4217 */ "Output version information and exit\0"
+/*  4253 */ "version\0"
+/*  4261 */ "CERTTOOL\0"
+/*  4270 */ "certtool - GnuTLS PKCS #11 tool - Ver. @VERSION@\n"
             "USAGE:  %s [ -<flag> [<val>] | --<name>[{=| }<val>] ]...\n\0"
-/*  4325 */ "bug-gnutls@gnu.org\0"
-/*  4344 */ "\n\n\0"
-/*  4347 */ "\n"
+/*  4377 */ "bug-gnutls@gnu.org\0"
+/*  4396 */ "\n\n\0"
+/*  4399 */ "\n"
             "Tool to parse and generate X.509 certificates, requests and private keys.\n"
             "It can be used interactively or non interactively by specifying the\n"
             "template command line option.\n\0"
-/*  4521 */ "certtool @VERSION@\0"
-/*  4540 */ "certtool [options] [url]\n"
+/*  4573 */ "certtool @VERSION@\0"
+/*  4592 */ "certtool [options] [url]\n"
             "certtool --help for usage instructions.\n";
 
 /*
@@ -462,124 +465,132 @@ static int const aVerify_CrlMustList[] = {
         | OPTST_SET_ARGTYPE(OPARG_TYPE_STRING))
 
 /*
+ *  null-password option description:
+ */
+#define NULL_PASSWORD_DESC      (certtool_opt_strs+2291)
+#define NULL_PASSWORD_NAME      (certtool_opt_strs+2315)
+#define NULL_PASSWORD_name      (certtool_opt_strs+2329)
+#define NULL_PASSWORD_FLAGS     (OPTST_DISABLED)
+
+/*
  *  certificate-info option description:
  */
-#define CERTIFICATE_INFO_DESC      (certtool_opt_strs+2291)
-#define CERTIFICATE_INFO_NAME      (certtool_opt_strs+2334)
-#define CERTIFICATE_INFO_name      (certtool_opt_strs+2351)
+#define CERTIFICATE_INFO_DESC      (certtool_opt_strs+2343)
+#define CERTIFICATE_INFO_NAME      (certtool_opt_strs+2386)
+#define CERTIFICATE_INFO_name      (certtool_opt_strs+2403)
 #define CERTIFICATE_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  certificate-pubkey option description:
  */
-#define CERTIFICATE_PUBKEY_DESC      (certtool_opt_strs+2368)
-#define CERTIFICATE_PUBKEY_NAME      (certtool_opt_strs+2399)
-#define CERTIFICATE_PUBKEY_name      (certtool_opt_strs+2418)
+#define CERTIFICATE_PUBKEY_DESC      (certtool_opt_strs+2420)
+#define CERTIFICATE_PUBKEY_NAME      (certtool_opt_strs+2451)
+#define CERTIFICATE_PUBKEY_name      (certtool_opt_strs+2470)
 #define CERTIFICATE_PUBKEY_FLAGS     (OPTST_DISABLED)
 
 /*
  *  pgp-certificate-info option description:
  */
-#define PGP_CERTIFICATE_INFO_DESC      (certtool_opt_strs+2437)
-#define PGP_CERTIFICATE_INFO_NAME      (certtool_opt_strs+2488)
-#define PGP_CERTIFICATE_INFO_name      (certtool_opt_strs+2509)
+#define PGP_CERTIFICATE_INFO_DESC      (certtool_opt_strs+2489)
+#define PGP_CERTIFICATE_INFO_NAME      (certtool_opt_strs+2540)
+#define PGP_CERTIFICATE_INFO_name      (certtool_opt_strs+2561)
 #define PGP_CERTIFICATE_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  pgp-ring-info option description:
  */
-#define PGP_RING_INFO_DESC      (certtool_opt_strs+2530)
-#define PGP_RING_INFO_NAME      (certtool_opt_strs+2587)
-#define PGP_RING_INFO_name      (certtool_opt_strs+2601)
+#define PGP_RING_INFO_DESC      (certtool_opt_strs+2582)
+#define PGP_RING_INFO_NAME      (certtool_opt_strs+2639)
+#define PGP_RING_INFO_name      (certtool_opt_strs+2653)
 #define PGP_RING_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  crl-info option description:
  */
-#define CRL_INFO_DESC      (certtool_opt_strs+2615)
-#define CRL_INFO_NAME      (certtool_opt_strs+2660)
-#define CRL_INFO_name      (certtool_opt_strs+2669)
+#define CRL_INFO_DESC      (certtool_opt_strs+2667)
+#define CRL_INFO_NAME      (certtool_opt_strs+2712)
+#define CRL_INFO_name      (certtool_opt_strs+2721)
 #define CRL_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  crq-info option description:
  */
-#define CRQ_INFO_DESC      (certtool_opt_strs+2678)
-#define CRQ_INFO_NAME      (certtool_opt_strs+2729)
-#define CRQ_INFO_name      (certtool_opt_strs+2738)
+#define CRQ_INFO_DESC      (certtool_opt_strs+2730)
+#define CRQ_INFO_NAME      (certtool_opt_strs+2781)
+#define CRQ_INFO_name      (certtool_opt_strs+2790)
 #define CRQ_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  no-crq-extensions option description:
  */
-#define NO_CRQ_EXTENSIONS_DESC      (certtool_opt_strs+2747)
-#define NO_CRQ_EXTENSIONS_NAME      (certtool_opt_strs+2793)
-#define NO_CRQ_EXTENSIONS_name      (certtool_opt_strs+2811)
+#define NO_CRQ_EXTENSIONS_DESC      (certtool_opt_strs+2799)
+#define NO_CRQ_EXTENSIONS_NAME      (certtool_opt_strs+2845)
+#define NO_CRQ_EXTENSIONS_name      (certtool_opt_strs+2863)
 #define NO_CRQ_EXTENSIONS_FLAGS     (OPTST_DISABLED)
 
 /*
  *  p12-info option description:
  */
-#define P12_INFO_DESC      (certtool_opt_strs+2829)
-#define P12_INFO_NAME      (certtool_opt_strs+2871)
-#define P12_INFO_name      (certtool_opt_strs+2880)
+#define P12_INFO_DESC      (certtool_opt_strs+2881)
+#define P12_INFO_NAME      (certtool_opt_strs+2923)
+#define P12_INFO_name      (certtool_opt_strs+2932)
 #define P12_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  p7-info option description:
  */
-#define P7_INFO_DESC      (certtool_opt_strs+2889)
-#define P7_INFO_NAME      (certtool_opt_strs+2930)
-#define P7_INFO_name      (certtool_opt_strs+2938)
+#define P7_INFO_DESC      (certtool_opt_strs+2941)
+#define P7_INFO_NAME      (certtool_opt_strs+2982)
+#define P7_INFO_name      (certtool_opt_strs+2990)
 #define P7_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  smime-to-p7 option description:
  */
-#define SMIME_TO_P7_DESC      (certtool_opt_strs+2946)
-#define SMIME_TO_P7_NAME      (certtool_opt_strs+2982)
-#define SMIME_TO_P7_name      (certtool_opt_strs+2994)
+#define SMIME_TO_P7_DESC      (certtool_opt_strs+2998)
+#define SMIME_TO_P7_NAME      (certtool_opt_strs+3034)
+#define SMIME_TO_P7_name      (certtool_opt_strs+3046)
 #define SMIME_TO_P7_FLAGS     (OPTST_DISABLED)
 
 /*
  *  key-info option description:
  */
-#define KEY_INFO_DESC      (certtool_opt_strs+3006)
-#define KEY_INFO_NAME      (certtool_opt_strs+3041)
-#define KEY_INFO_name      (certtool_opt_strs+3050)
+#define KEY_INFO_DESC      (certtool_opt_strs+3058)
+#define KEY_INFO_NAME      (certtool_opt_strs+3093)
+#define KEY_INFO_name      (certtool_opt_strs+3102)
 #define KEY_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  pgp-key-info option description:
  */
-#define PGP_KEY_INFO_DESC      (certtool_opt_strs+3059)
-#define PGP_KEY_INFO_NAME      (certtool_opt_strs+3103)
-#define PGP_KEY_INFO_name      (certtool_opt_strs+3116)
+#define PGP_KEY_INFO_DESC      (certtool_opt_strs+3111)
+#define PGP_KEY_INFO_NAME      (certtool_opt_strs+3155)
+#define PGP_KEY_INFO_name      (certtool_opt_strs+3168)
 #define PGP_KEY_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  pubkey-info option description:
  */
-#define PUBKEY_INFO_DESC      (certtool_opt_strs+3129)
-#define PUBKEY_INFO_NAME      (certtool_opt_strs+3163)
-#define PUBKEY_INFO_name      (certtool_opt_strs+3175)
+#define PUBKEY_INFO_DESC      (certtool_opt_strs+3181)
+#define PUBKEY_INFO_NAME      (certtool_opt_strs+3215)
+#define PUBKEY_INFO_name      (certtool_opt_strs+3227)
 #define PUBKEY_INFO_FLAGS     (OPTST_DISABLED)
 
 /*
  *  v1 option description:
  */
-#define V1_DESC      (certtool_opt_strs+3187)
-#define V1_NAME      (certtool_opt_strs+3248)
-#define V1_name      (certtool_opt_strs+3251)
+#define V1_DESC      (certtool_opt_strs+3239)
+#define V1_NAME      (certtool_opt_strs+3300)
+#define V1_name      (certtool_opt_strs+3303)
 #define V1_FLAGS     (OPTST_DISABLED)
 
 /*
  *  to-p12 option description with
  *  "Must also have options" and "Incompatible options":
  */
-#define TO_P12_DESC      (certtool_opt_strs+3254)
-#define TO_P12_NAME      (certtool_opt_strs+3284)
-#define TO_P12_name      (certtool_opt_strs+3291)
+#define TO_P12_DESC      (certtool_opt_strs+3306)
+#define TO_P12_NAME      (certtool_opt_strs+3336)
+#define TO_P12_name      (certtool_opt_strs+3343)
 static int const aTo_P12MustList[] = {
     INDEX_OPT_LOAD_CERTIFICATE, NO_EQUIVALENT };
 #define TO_P12_FLAGS     (OPTST_DISABLED)
@@ -587,140 +598,140 @@ static int const aTo_P12MustList[] = {
 /*
  *  to-p8 option description:
  */
-#define TO_P8_DESC      (certtool_opt_strs+3298)
-#define TO_P8_NAME      (certtool_opt_strs+3327)
-#define TO_P8_name      (certtool_opt_strs+3333)
+#define TO_P8_DESC      (certtool_opt_strs+3350)
+#define TO_P8_NAME      (certtool_opt_strs+3379)
+#define TO_P8_name      (certtool_opt_strs+3385)
 #define TO_P8_FLAGS     (OPTST_DISABLED)
 
 /*
  *  pkcs8 option description:
  */
-#define PKCS8_DESC      (certtool_opt_strs+3339)
-#define PKCS8_NAME      (certtool_opt_strs+3375)
-#define PKCS8_name      (certtool_opt_strs+3381)
+#define PKCS8_DESC      (certtool_opt_strs+3391)
+#define PKCS8_NAME      (certtool_opt_strs+3427)
+#define PKCS8_name      (certtool_opt_strs+3433)
 #define PKCS8_FLAGS     (OPTST_DISABLED)
 
 /*
  *  rsa option description:
  */
-#define RSA_DESC      (certtool_opt_strs+3387)
-#define RSA_NAME      (certtool_opt_strs+3404)
-#define RSA_name      (certtool_opt_strs+3408)
+#define RSA_DESC      (certtool_opt_strs+3439)
+#define RSA_NAME      (certtool_opt_strs+3456)
+#define RSA_name      (certtool_opt_strs+3460)
 #define RSA_FLAGS     (OPTST_DISABLED)
 
 /*
  *  dsa option description:
  */
-#define DSA_DESC      (certtool_opt_strs+3412)
-#define DSA_NAME      (certtool_opt_strs+3429)
-#define DSA_name      (certtool_opt_strs+3433)
+#define DSA_DESC      (certtool_opt_strs+3464)
+#define DSA_NAME      (certtool_opt_strs+3481)
+#define DSA_name      (certtool_opt_strs+3485)
 #define DSA_FLAGS     (OPTST_DISABLED)
 
 /*
  *  ecc option description:
  */
-#define ECC_DESC      (certtool_opt_strs+3437)
-#define ECC_NAME      (certtool_opt_strs+3462)
-#define ECC_name      (certtool_opt_strs+3466)
+#define ECC_DESC      (certtool_opt_strs+3489)
+#define ECC_NAME      (certtool_opt_strs+3514)
+#define ECC_name      (certtool_opt_strs+3518)
 #define ECC_FLAGS     (OPTST_DISABLED)
 
 /*
  *  hash option description:
  */
-#define HASH_DESC      (certtool_opt_strs+3470)
-#define HASH_NAME      (certtool_opt_strs+3505)
-#define HASH_name      (certtool_opt_strs+3510)
+#define HASH_DESC      (certtool_opt_strs+3522)
+#define HASH_NAME      (certtool_opt_strs+3557)
+#define HASH_name      (certtool_opt_strs+3562)
 #define HASH_FLAGS     (OPTST_DISABLED \
         | OPTST_SET_ARGTYPE(OPARG_TYPE_STRING))
 
 /*
  *  inder option description:
  */
-#define INDER_DESC      (certtool_opt_strs+3515)
-#define INDER_NAME      (certtool_opt_strs+3571)
-#define NOT_INDER_name  (certtool_opt_strs+3577)
-#define NOT_INDER_PFX   (certtool_opt_strs+3586)
+#define INDER_DESC      (certtool_opt_strs+3567)
+#define INDER_NAME      (certtool_opt_strs+3623)
+#define NOT_INDER_name  (certtool_opt_strs+3629)
+#define NOT_INDER_PFX   (certtool_opt_strs+3638)
 #define INDER_name      (NOT_INDER_name + 3)
 #define INDER_FLAGS     (OPTST_DISABLED)
 
 /*
  *  inraw option description:
  */
-#define INRAW_DESC    (certtool_opt_strs+3589)
+#define INRAW_DESC    (certtool_opt_strs+3641)
 #define INRAW_NAME    NULL
-#define INRAW_name    (certtool_opt_strs+3618)
+#define INRAW_name    (certtool_opt_strs+3670)
 #define INRAW_FLAGS     (INDER_FLAGS | OPTST_ALIAS)
 
 /*
  *  outder option description:
  */
-#define OUTDER_DESC      (certtool_opt_strs+3624)
-#define OUTDER_NAME      (certtool_opt_strs+3680)
-#define NOT_OUTDER_name  (certtool_opt_strs+3687)
-#define NOT_OUTDER_PFX   (certtool_opt_strs+3586)
+#define OUTDER_DESC      (certtool_opt_strs+3676)
+#define OUTDER_NAME      (certtool_opt_strs+3732)
+#define NOT_OUTDER_name  (certtool_opt_strs+3739)
+#define NOT_OUTDER_PFX   (certtool_opt_strs+3638)
 #define OUTDER_name      (NOT_OUTDER_name + 3)
 #define OUTDER_FLAGS     (OPTST_DISABLED)
 
 /*
  *  outraw option description:
  */
-#define OUTRAW_DESC    (certtool_opt_strs+3697)
+#define OUTRAW_DESC    (certtool_opt_strs+3749)
 #define OUTRAW_NAME    NULL
-#define OUTRAW_name    (certtool_opt_strs+3727)
+#define OUTRAW_name    (certtool_opt_strs+3779)
 #define OUTRAW_FLAGS     (OUTDER_FLAGS | OPTST_ALIAS)
 
 /*
  *  bits option description:
  */
-#define BITS_DESC      (certtool_opt_strs+3734)
-#define BITS_NAME      (certtool_opt_strs+3778)
-#define BITS_name      (certtool_opt_strs+3783)
+#define BITS_DESC      (certtool_opt_strs+3786)
+#define BITS_NAME      (certtool_opt_strs+3830)
+#define BITS_name      (certtool_opt_strs+3835)
 #define BITS_FLAGS     (OPTST_DISABLED \
         | OPTST_SET_ARGTYPE(OPARG_TYPE_NUMERIC))
 
 /*
  *  sec-param option description:
  */
-#define SEC_PARAM_DESC      (certtool_opt_strs+3788)
-#define SEC_PARAM_NAME      (certtool_opt_strs+3851)
-#define SEC_PARAM_name      (certtool_opt_strs+3861)
+#define SEC_PARAM_DESC      (certtool_opt_strs+3840)
+#define SEC_PARAM_NAME      (certtool_opt_strs+3903)
+#define SEC_PARAM_name      (certtool_opt_strs+3913)
 #define SEC_PARAM_FLAGS     (OPTST_DISABLED \
         | OPTST_SET_ARGTYPE(OPARG_TYPE_STRING))
 
 /*
  *  disable-quick-random option description:
  */
-#define DISABLE_QUICK_RANDOM_DESC      (certtool_opt_strs+3871)
-#define DISABLE_QUICK_RANDOM_NAME      (certtool_opt_strs+3881)
-#define DISABLE_QUICK_RANDOM_name      (certtool_opt_strs+3902)
+#define DISABLE_QUICK_RANDOM_DESC      (certtool_opt_strs+3923)
+#define DISABLE_QUICK_RANDOM_NAME      (certtool_opt_strs+3933)
+#define DISABLE_QUICK_RANDOM_name      (certtool_opt_strs+3954)
 #define DISABLE_QUICK_RANDOM_FLAGS     (OPTST_DISABLED)
 
 /*
  *  template option description:
  */
-#define TEMPLATE_DESC      (certtool_opt_strs+3923)
-#define TEMPLATE_NAME      (certtool_opt_strs+3974)
-#define TEMPLATE_name      (certtool_opt_strs+3983)
+#define TEMPLATE_DESC      (certtool_opt_strs+3975)
+#define TEMPLATE_NAME      (certtool_opt_strs+4026)
+#define TEMPLATE_name      (certtool_opt_strs+4035)
 #define TEMPLATE_FLAGS     (OPTST_DISABLED \
         | OPTST_SET_ARGTYPE(OPARG_TYPE_FILE))
 
 /*
  *  pkcs-cipher option description:
  */
-#define PKCS_CIPHER_DESC      (certtool_opt_strs+3992)
-#define PKCS_CIPHER_NAME      (certtool_opt_strs+4037)
-#define PKCS_CIPHER_name      (certtool_opt_strs+4049)
+#define PKCS_CIPHER_DESC      (certtool_opt_strs+4044)
+#define PKCS_CIPHER_NAME      (certtool_opt_strs+4089)
+#define PKCS_CIPHER_name      (certtool_opt_strs+4101)
 #define PKCS_CIPHER_FLAGS     (OPTST_DISABLED \
         | OPTST_SET_ARGTYPE(OPARG_TYPE_STRING))
 
 /*
  *  Help/More_Help/Version option descriptions:
  */
-#define HELP_DESC       (certtool_opt_strs+4061)
-#define HELP_name       (certtool_opt_strs+4105)
+#define HELP_DESC       (certtool_opt_strs+4113)
+#define HELP_name       (certtool_opt_strs+4157)
 #ifdef HAVE_WORKING_FORK
-#define MORE_HELP_DESC  (certtool_opt_strs+4110)
-#define MORE_HELP_name  (certtool_opt_strs+4155)
+#define MORE_HELP_DESC  (certtool_opt_strs+4162)
+#define MORE_HELP_name  (certtool_opt_strs+4207)
 #define MORE_HELP_FLAGS (OPTST_IMM | OPTST_NO_INIT)
 #else
 #define MORE_HELP_DESC  NULL
@@ -733,8 +744,8 @@ static int const aTo_P12MustList[] = {
 #  define VER_FLAGS     (OPTST_SET_ARGTYPE(OPARG_TYPE_STRING) | \
                          OPTST_ARG_OPTIONAL | OPTST_IMM | OPTST_NO_INIT)
 #endif
-#define VER_DESC        (certtool_opt_strs+4165)
-#define VER_name        (certtool_opt_strs+4201)
+#define VER_DESC        (certtool_opt_strs+4217)
+#define VER_name        (certtool_opt_strs+4253)
 /*
  *  Declare option callback procedures
  */
@@ -1032,8 +1043,20 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ PASSWORD_DESC, PASSWORD_NAME, PASSWORD_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 23, VALUE_OPT_CERTIFICATE_INFO,
-     /* equiv idx, value */ 23, VALUE_OPT_CERTIFICATE_INFO,
+  {  /* entry idx, value */ 23, VALUE_OPT_NULL_PASSWORD,
+     /* equiv idx, value */ 23, VALUE_OPT_NULL_PASSWORD,
+     /* equivalenced to  */ NO_EQUIVALENT,
+     /* min, max, act ct */ 0, 1, 0,
+     /* opt state flags  */ NULL_PASSWORD_FLAGS, 0,
+     /* last opt argumnt */ { NULL }, /* --null-password */
+     /* arg list/cookie  */ NULL,
+     /* must/cannot opts */ NULL, NULL,
+     /* option proc      */ NULL,
+     /* desc, NAME, name */ NULL_PASSWORD_DESC, NULL_PASSWORD_NAME, NULL_PASSWORD_name,
+     /* disablement strs */ NULL, NULL },
+
+  {  /* entry idx, value */ 24, VALUE_OPT_CERTIFICATE_INFO,
+     /* equiv idx, value */ 24, VALUE_OPT_CERTIFICATE_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ CERTIFICATE_INFO_FLAGS, 0,
@@ -1044,8 +1067,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ CERTIFICATE_INFO_DESC, CERTIFICATE_INFO_NAME, CERTIFICATE_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 24, VALUE_OPT_CERTIFICATE_PUBKEY,
-     /* equiv idx, value */ 24, VALUE_OPT_CERTIFICATE_PUBKEY,
+  {  /* entry idx, value */ 25, VALUE_OPT_CERTIFICATE_PUBKEY,
+     /* equiv idx, value */ 25, VALUE_OPT_CERTIFICATE_PUBKEY,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ CERTIFICATE_PUBKEY_FLAGS, 0,
@@ -1056,8 +1079,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ CERTIFICATE_PUBKEY_DESC, CERTIFICATE_PUBKEY_NAME, CERTIFICATE_PUBKEY_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 25, VALUE_OPT_PGP_CERTIFICATE_INFO,
-     /* equiv idx, value */ 25, VALUE_OPT_PGP_CERTIFICATE_INFO,
+  {  /* entry idx, value */ 26, VALUE_OPT_PGP_CERTIFICATE_INFO,
+     /* equiv idx, value */ 26, VALUE_OPT_PGP_CERTIFICATE_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ PGP_CERTIFICATE_INFO_FLAGS, 0,
@@ -1068,8 +1091,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ PGP_CERTIFICATE_INFO_DESC, PGP_CERTIFICATE_INFO_NAME, PGP_CERTIFICATE_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 26, VALUE_OPT_PGP_RING_INFO,
-     /* equiv idx, value */ 26, VALUE_OPT_PGP_RING_INFO,
+  {  /* entry idx, value */ 27, VALUE_OPT_PGP_RING_INFO,
+     /* equiv idx, value */ 27, VALUE_OPT_PGP_RING_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ PGP_RING_INFO_FLAGS, 0,
@@ -1080,8 +1103,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ PGP_RING_INFO_DESC, PGP_RING_INFO_NAME, PGP_RING_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 27, VALUE_OPT_CRL_INFO,
-     /* equiv idx, value */ 27, VALUE_OPT_CRL_INFO,
+  {  /* entry idx, value */ 28, VALUE_OPT_CRL_INFO,
+     /* equiv idx, value */ 28, VALUE_OPT_CRL_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ CRL_INFO_FLAGS, 0,
@@ -1092,8 +1115,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ CRL_INFO_DESC, CRL_INFO_NAME, CRL_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 28, VALUE_OPT_CRQ_INFO,
-     /* equiv idx, value */ 28, VALUE_OPT_CRQ_INFO,
+  {  /* entry idx, value */ 29, VALUE_OPT_CRQ_INFO,
+     /* equiv idx, value */ 29, VALUE_OPT_CRQ_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ CRQ_INFO_FLAGS, 0,
@@ -1104,8 +1127,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ CRQ_INFO_DESC, CRQ_INFO_NAME, CRQ_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 29, VALUE_OPT_NO_CRQ_EXTENSIONS,
-     /* equiv idx, value */ 29, VALUE_OPT_NO_CRQ_EXTENSIONS,
+  {  /* entry idx, value */ 30, VALUE_OPT_NO_CRQ_EXTENSIONS,
+     /* equiv idx, value */ 30, VALUE_OPT_NO_CRQ_EXTENSIONS,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ NO_CRQ_EXTENSIONS_FLAGS, 0,
@@ -1116,8 +1139,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ NO_CRQ_EXTENSIONS_DESC, NO_CRQ_EXTENSIONS_NAME, NO_CRQ_EXTENSIONS_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 30, VALUE_OPT_P12_INFO,
-     /* equiv idx, value */ 30, VALUE_OPT_P12_INFO,
+  {  /* entry idx, value */ 31, VALUE_OPT_P12_INFO,
+     /* equiv idx, value */ 31, VALUE_OPT_P12_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ P12_INFO_FLAGS, 0,
@@ -1128,8 +1151,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ P12_INFO_DESC, P12_INFO_NAME, P12_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 31, VALUE_OPT_P7_INFO,
-     /* equiv idx, value */ 31, VALUE_OPT_P7_INFO,
+  {  /* entry idx, value */ 32, VALUE_OPT_P7_INFO,
+     /* equiv idx, value */ 32, VALUE_OPT_P7_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ P7_INFO_FLAGS, 0,
@@ -1140,8 +1163,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ P7_INFO_DESC, P7_INFO_NAME, P7_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 32, VALUE_OPT_SMIME_TO_P7,
-     /* equiv idx, value */ 32, VALUE_OPT_SMIME_TO_P7,
+  {  /* entry idx, value */ 33, VALUE_OPT_SMIME_TO_P7,
+     /* equiv idx, value */ 33, VALUE_OPT_SMIME_TO_P7,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ SMIME_TO_P7_FLAGS, 0,
@@ -1152,8 +1175,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ SMIME_TO_P7_DESC, SMIME_TO_P7_NAME, SMIME_TO_P7_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 33, VALUE_OPT_KEY_INFO,
-     /* equiv idx, value */ 33, VALUE_OPT_KEY_INFO,
+  {  /* entry idx, value */ 34, VALUE_OPT_KEY_INFO,
+     /* equiv idx, value */ 34, VALUE_OPT_KEY_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ KEY_INFO_FLAGS, 0,
@@ -1164,8 +1187,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ KEY_INFO_DESC, KEY_INFO_NAME, KEY_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 34, VALUE_OPT_PGP_KEY_INFO,
-     /* equiv idx, value */ 34, VALUE_OPT_PGP_KEY_INFO,
+  {  /* entry idx, value */ 35, VALUE_OPT_PGP_KEY_INFO,
+     /* equiv idx, value */ 35, VALUE_OPT_PGP_KEY_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ PGP_KEY_INFO_FLAGS, 0,
@@ -1176,8 +1199,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ PGP_KEY_INFO_DESC, PGP_KEY_INFO_NAME, PGP_KEY_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 35, VALUE_OPT_PUBKEY_INFO,
-     /* equiv idx, value */ 35, VALUE_OPT_PUBKEY_INFO,
+  {  /* entry idx, value */ 36, VALUE_OPT_PUBKEY_INFO,
+     /* equiv idx, value */ 36, VALUE_OPT_PUBKEY_INFO,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ PUBKEY_INFO_FLAGS, 0,
@@ -1188,8 +1211,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ PUBKEY_INFO_DESC, PUBKEY_INFO_NAME, PUBKEY_INFO_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 36, VALUE_OPT_V1,
-     /* equiv idx, value */ 36, VALUE_OPT_V1,
+  {  /* entry idx, value */ 37, VALUE_OPT_V1,
+     /* equiv idx, value */ 37, VALUE_OPT_V1,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ V1_FLAGS, 0,
@@ -1200,8 +1223,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ V1_DESC, V1_NAME, V1_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 37, VALUE_OPT_TO_P12,
-     /* equiv idx, value */ 37, VALUE_OPT_TO_P12,
+  {  /* entry idx, value */ 38, VALUE_OPT_TO_P12,
+     /* equiv idx, value */ 38, VALUE_OPT_TO_P12,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ TO_P12_FLAGS, 0,
@@ -1212,8 +1235,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ TO_P12_DESC, TO_P12_NAME, TO_P12_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 38, VALUE_OPT_TO_P8,
-     /* equiv idx, value */ 38, VALUE_OPT_TO_P8,
+  {  /* entry idx, value */ 39, VALUE_OPT_TO_P8,
+     /* equiv idx, value */ 39, VALUE_OPT_TO_P8,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ TO_P8_FLAGS, 0,
@@ -1224,8 +1247,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ TO_P8_DESC, TO_P8_NAME, TO_P8_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 39, VALUE_OPT_PKCS8,
-     /* equiv idx, value */ 39, VALUE_OPT_PKCS8,
+  {  /* entry idx, value */ 40, VALUE_OPT_PKCS8,
+     /* equiv idx, value */ 40, VALUE_OPT_PKCS8,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ PKCS8_FLAGS, 0,
@@ -1236,8 +1259,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ PKCS8_DESC, PKCS8_NAME, PKCS8_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 40, VALUE_OPT_RSA,
-     /* equiv idx, value */ 40, VALUE_OPT_RSA,
+  {  /* entry idx, value */ 41, VALUE_OPT_RSA,
+     /* equiv idx, value */ 41, VALUE_OPT_RSA,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ RSA_FLAGS, 0,
@@ -1248,8 +1271,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ RSA_DESC, RSA_NAME, RSA_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 41, VALUE_OPT_DSA,
-     /* equiv idx, value */ 41, VALUE_OPT_DSA,
+  {  /* entry idx, value */ 42, VALUE_OPT_DSA,
+     /* equiv idx, value */ 42, VALUE_OPT_DSA,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ DSA_FLAGS, 0,
@@ -1260,8 +1283,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ DSA_DESC, DSA_NAME, DSA_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 42, VALUE_OPT_ECC,
-     /* equiv idx, value */ 42, VALUE_OPT_ECC,
+  {  /* entry idx, value */ 43, VALUE_OPT_ECC,
+     /* equiv idx, value */ 43, VALUE_OPT_ECC,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ ECC_FLAGS, 0,
@@ -1272,8 +1295,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ ECC_DESC, ECC_NAME, ECC_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 43, VALUE_OPT_HASH,
-     /* equiv idx, value */ 43, VALUE_OPT_HASH,
+  {  /* entry idx, value */ 44, VALUE_OPT_HASH,
+     /* equiv idx, value */ 44, VALUE_OPT_HASH,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ HASH_FLAGS, 0,
@@ -1284,8 +1307,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ HASH_DESC, HASH_NAME, HASH_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 44, VALUE_OPT_INDER,
-     /* equiv idx, value */ 44, VALUE_OPT_INDER,
+  {  /* entry idx, value */ 45, VALUE_OPT_INDER,
+     /* equiv idx, value */ 45, VALUE_OPT_INDER,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ INDER_FLAGS, 0,
@@ -1296,8 +1319,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ INDER_DESC, INDER_NAME, INDER_name,
      /* disablement strs */ NOT_INDER_name, NOT_INDER_PFX },
 
-  {  /* entry idx, value */ 45, VALUE_OPT_INRAW,
-     /* equiv idx, value */ 45, VALUE_OPT_INRAW,
+  {  /* entry idx, value */ 46, VALUE_OPT_INRAW,
+     /* equiv idx, value */ 46, VALUE_OPT_INRAW,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ INRAW_FLAGS, 0,
@@ -1308,8 +1331,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ INRAW_DESC, INRAW_NAME, INRAW_name,
      /* disablement strs */ 0, 0 },
 
-  {  /* entry idx, value */ 46, VALUE_OPT_OUTDER,
-     /* equiv idx, value */ 46, VALUE_OPT_OUTDER,
+  {  /* entry idx, value */ 47, VALUE_OPT_OUTDER,
+     /* equiv idx, value */ 47, VALUE_OPT_OUTDER,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ OUTDER_FLAGS, 0,
@@ -1320,8 +1343,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ OUTDER_DESC, OUTDER_NAME, OUTDER_name,
      /* disablement strs */ NOT_OUTDER_name, NOT_OUTDER_PFX },
 
-  {  /* entry idx, value */ 47, VALUE_OPT_OUTRAW,
-     /* equiv idx, value */ 47, VALUE_OPT_OUTRAW,
+  {  /* entry idx, value */ 48, VALUE_OPT_OUTRAW,
+     /* equiv idx, value */ 48, VALUE_OPT_OUTRAW,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ OUTRAW_FLAGS, 0,
@@ -1332,8 +1355,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ OUTRAW_DESC, OUTRAW_NAME, OUTRAW_name,
      /* disablement strs */ 0, 0 },
 
-  {  /* entry idx, value */ 48, VALUE_OPT_BITS,
-     /* equiv idx, value */ 48, VALUE_OPT_BITS,
+  {  /* entry idx, value */ 49, VALUE_OPT_BITS,
+     /* equiv idx, value */ 49, VALUE_OPT_BITS,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ BITS_FLAGS, 0,
@@ -1344,8 +1367,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ BITS_DESC, BITS_NAME, BITS_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 49, VALUE_OPT_SEC_PARAM,
-     /* equiv idx, value */ 49, VALUE_OPT_SEC_PARAM,
+  {  /* entry idx, value */ 50, VALUE_OPT_SEC_PARAM,
+     /* equiv idx, value */ 50, VALUE_OPT_SEC_PARAM,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ SEC_PARAM_FLAGS, 0,
@@ -1356,8 +1379,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ SEC_PARAM_DESC, SEC_PARAM_NAME, SEC_PARAM_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 50, VALUE_OPT_DISABLE_QUICK_RANDOM,
-     /* equiv idx, value */ 50, VALUE_OPT_DISABLE_QUICK_RANDOM,
+  {  /* entry idx, value */ 51, VALUE_OPT_DISABLE_QUICK_RANDOM,
+     /* equiv idx, value */ 51, VALUE_OPT_DISABLE_QUICK_RANDOM,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ DISABLE_QUICK_RANDOM_FLAGS, 0,
@@ -1368,8 +1391,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ DISABLE_QUICK_RANDOM_DESC, DISABLE_QUICK_RANDOM_NAME, DISABLE_QUICK_RANDOM_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 51, VALUE_OPT_TEMPLATE,
-     /* equiv idx, value */ 51, VALUE_OPT_TEMPLATE,
+  {  /* entry idx, value */ 52, VALUE_OPT_TEMPLATE,
+     /* equiv idx, value */ 52, VALUE_OPT_TEMPLATE,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ TEMPLATE_FLAGS, 0,
@@ -1380,8 +1403,8 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ TEMPLATE_DESC, TEMPLATE_NAME, TEMPLATE_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 52, VALUE_OPT_PKCS_CIPHER,
-     /* equiv idx, value */ 52, VALUE_OPT_PKCS_CIPHER,
+  {  /* entry idx, value */ 53, VALUE_OPT_PKCS_CIPHER,
+     /* equiv idx, value */ 53, VALUE_OPT_PKCS_CIPHER,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ PKCS_CIPHER_FLAGS, 0,
@@ -1436,14 +1459,14 @@ static tOptDesc optDesc[OPTION_CT] = {
  *
  *  Define the certtool Option Environment
  */
-#define zPROGNAME       (certtool_opt_strs+4209)
-#define zUsageTitle     (certtool_opt_strs+4218)
+#define zPROGNAME       (certtool_opt_strs+4261)
+#define zUsageTitle     (certtool_opt_strs+4270)
 #define zRcName         NULL
 #define apzHomeList     NULL
-#define zBugsAddr       (certtool_opt_strs+4325)
-#define zExplain        (certtool_opt_strs+4344)
-#define zDetail         (certtool_opt_strs+4347)
-#define zFullVersion    (certtool_opt_strs+4521)
+#define zBugsAddr       (certtool_opt_strs+4377)
+#define zExplain        (certtool_opt_strs+4396)
+#define zDetail         (certtool_opt_strs+4399)
+#define zFullVersion    (certtool_opt_strs+4573)
 /* extracted from optcode.tlib near line 350 */
 
 #if defined(ENABLE_NLS)
@@ -1457,7 +1480,7 @@ static tOptDesc optDesc[OPTION_CT] = {
 
 #define certtool_full_usage (NULL)
 
-#define certtool_short_usage (certtool_opt_strs+4540)
+#define certtool_short_usage (certtool_opt_strs+4592)
 
 #endif /* not defined __doxygen__ */
 
@@ -1674,7 +1697,7 @@ tOptions certtoolOptions = {
       NO_EQUIVALENT, /* '-#' option index */
       NO_EQUIVALENT /* index of default opt */
     },
-    56 /* full option count */, 53 /* user option count */,
+    57 /* full option count */, 54 /* user option count */,
     certtool_full_usage, certtool_short_usage,
     NULL, NULL,
     PKGDATADIR, certtool_packager_info