From 2a6ede56ad8c29181fde7691904f226102d43e54 Mon Sep 17 00:00:00 2001

From: Rob Crittenden <rcritten@redhat.com>

Date: Thu, 14 May 2020 14:15:17 -0400

Subject: [PATCH 42/43] Add long command-line options to man pages

The man pages almost universally only documented the short

options even though the long options were all defined in

the popt configuration.

Also do a bit of minor bit of reformatting and added a lint

option. I'm not going to require mandoc as a requirement as

the linting is pretty minor at the moment but it's better than

nothing.

https://bugzilla.redhat.com/show_bug.cgi?id=1782838

---

 src/Makefile.am                               |   6 +

 src/certmaster-getcert.1.in                   |  72 ++---

 src/certmonger-certmaster-submit.8.in         |  59 ++--

 ...tmonger-dogtag-ipa-renew-agent-submit.8.in | 288 +++++++++++-------

 src/certmonger-dogtag-submit.8.in             | 252 ++++++++-------

 src/certmonger-ipa-submit.8.in                | 115 ++++---

 src/certmonger-local-submit.8.in              |  62 ++--

 src/certmonger-scep-submit.8.in               | 124 ++++----

 src/certmonger.8.in                           |  86 +++---

 src/certmonger.conf.5.in                      |  20 +-

 src/getcert-add-ca.1.in                       |  48 +--

 src/getcert-add-scep-ca.1.in                  |  80 ++---

 src/getcert-list-cas.1.in                     |  44 +--

 src/getcert-list.1.in                         |  84 ++---

 src/getcert-modify-ca.1.in                    |  46 +--

 src/getcert-refresh-ca.1.in                   |  50 +--

 src/getcert-refresh.1.in                      |  52 ++--

 src/getcert-rekey.1.in                        | 107 ++++---

 src/getcert-remove-ca.1.in                    |  44 +--

 src/getcert-request.1.in                      | 157 ++++++----

 src/getcert-resubmit.1.in                     | 112 ++++---

 src/getcert-start-tracking.1.in               | 134 ++++----

 src/getcert-status.1.in                       |  54 ++--

 src/getcert-stop-tracking.1.in                |  65 ++--

 src/getcert.1.in                              |  54 ++--

 src/ipa-getcert.1.in                          |  74 ++---

 src/local-getcert.1.in                        |  76 ++---

 src/selfsign-getcert.1.in                     |  74 ++---

 28 files changed, 1321 insertions(+), 1118 deletions(-)

diff --git a/src/Makefile.am b/src/Makefile.am

index fe3b235..5343dbc 100644

--- a/src/Makefile.am

+++ b/src/Makefile.am

@@ -266,3 +266,9 @@ submit_h_CFLAGS = $(AM_CFLAGS) $(CURL_CFLAGS) $(XML_CFLAGS) -DCM_SUBMIT_H_MAIN

 submit_h_SOURCES = submit-h.c submit-h.h log.c log.h tm.c tm.h

 submit_h_LDADD = $(CURL_LIBS) $(XML_LIBS) $(TALLOC_LIBS) $(LTLIBICONV) \

 		 $(POPT_LIBS)

+

+.PHONY: manlint

+manlint: $(man_MANS)

+	for page in $(MANS); do \

+		mandoc -T lint $${page}; \

+	done

diff --git a/src/certmaster-getcert.1.in b/src/certmaster-getcert.1.in

index ef1c14a..7a038f9 100644

--- a/src/certmaster-getcert.1.in

+++ b/src/certmaster-getcert.1.in

@@ -1,20 +1,20 @@

-.TH certmonger 1 "23 November 2009" "certmonger Manual"

+.TH CERTMONGER 1 "November 23, 2009" "certmonger Manual"

 .SH NAME

-certmaster-getcert

+certmaster\-getcert

 .SH SYNOPSIS

- certmaster-getcert request [options]

- certmaster-getcert resubmit [options]

- certmaster-getcert start-tracking [options]

- certmaster-getcert status [options]

- certmaster-getcert stop-tracking [options]

- certmaster-getcert list [options]

- certmaster-getcert list-cas [options]

- certmaster-getcert refresh-cas [options]

+ certmaster\-getcert request [options]

+ certmaster\-getcert resubmit [options]

+ certmaster\-getcert start\-tracking [options]

+ certmaster\-getcert status [options]

+ certmaster\-getcert stop\-tracking [options]

+ certmaster\-getcert list [options]

+ certmaster\-getcert list\-cas [options]

+ certmaster\-getcert refresh\-cas [options]

 .SH DESCRIPTION

-The \fIcertmaster-getcert\fR tool issues requests to a @CM_DBUS_NAME@

+The \fIcertmaster\-getcert\fR tool issues requests to a @CM_DBUS_NAME@

 service on behalf of the invoking user.  It can ask the service to begin

 enrollment, optionally generating a key pair to use, it can ask the

 service to begin monitoring a certificate in a specified location for

@@ -22,17 +22,17 @@ expiration, and optionally to refresh it when expiration nears, it can

 list the set of certificates that the service is already monitoring, or

 it can list the set of CAs that the service is capable of using.

-If no command is given as the first command-line argument,

-\fIcertmaster-getcert\fR will print short usage information for each of

+If no command is given as the first command\-line argument,

+\fIcertmaster\-getcert\fR will print short usage information for each of

 its functions.

-The \fIcertmaster-getcert\fR tool behaves identically to the generic

-\fIgetcert\fR tool when it is used with the \fB-c

+The \fIcertmaster\-getcert\fR tool behaves identically to the generic

+\fIgetcert\fR tool when it is used with the \fB\-c

 \fI@CM_CERTMASTER_CA_NAME@\fR option.

 There is no standard authenticated method for obtaining the root certificate

 from certmaster CAs, so \fBcertmonger\fR does not support retrieving trust

-information from them.  While the \fB-F\fR and \fB-a\fR options will still

+information from them.  While the \fB\-F\fR and \fB\-a\fR options will still

 be recognized, they will effectively be ignored.

 .SH BUGS

@@ -41,24 +41,24 @@ Please file tickets for any that you find at https://fedorahosted.org/certmonger

 .SH SEE ALSO

 \fBcertmonger\fR(8)

 \fBgetcert\fR(1)

-\fBgetcert-add-ca\fR(1)

-\fBgetcert-add-scep-ca\fR(1)

-\fBgetcert-list-cas\fR(1)

-\fBgetcert-list\fR(1)

-\fBgetcert-modify-ca\fR(1)

-\fBgetcert-refresh-ca\fR(1)

-\fBgetcert-refresh\fR(1)

-\fBgetcert-rekey\fR(1)

-\fBgetcert-remove-ca\fR(1)

-\fBgetcert-request\fR(1)

-\fBgetcert-resubmit\fR(1)

-\fBgetcert-start-tracking\fR(1)

-\fBgetcert-status\fR(1)

-\fBgetcert-stop-tracking\fR(1)

-\fBcertmonger-certmaster-submit\fR(8)

-\fBcertmonger-dogtag-ipa-renew-agent-submit\fR(8)

-\fBcertmonger-dogtag-submit\fR(8)

-\fBcertmonger-ipa-submit\fR(8)

-\fBcertmonger-local-submit\fR(8)

-\fBcertmonger-scep-submit\fR(8)

+\fBgetcert\-add\-ca\fR(1)

+\fBgetcert\-add\-scep\-ca\fR(1)

+\fBgetcert\-list\-cas\fR(1)

+\fBgetcert\-list\fR(1)

+\fBgetcert\-modify\-ca\fR(1)

+\fBgetcert\-refresh\-ca\fR(1)

+\fBgetcert\-refresh\fR(1)

+\fBgetcert\-rekey\fR(1)

+\fBgetcert\-remove\-ca\fR(1)

+\fBgetcert\-request\fR(1)

+\fBgetcert\-resubmit\fR(1)

+\fBgetcert\-start\-tracking\fR(1)

+\fBgetcert\-status\fR(1)

+\fBgetcert\-stop\-tracking\fR(1)

+\fBcertmonger\-certmaster\-submit\fR(8)

+\fBcertmonger\-dogtag\-ipa\-renew\-agent\-submit\fR(8)

+\fBcertmonger\-dogtag\-submit\fR(8)

+\fBcertmonger\-ipa\-submit\fR(8)

+\fBcertmonger\-local\-submit\fR(8)

+\fBcertmonger\-scep\-submit\fR(8)

 \fBcertmonger_selinux\fR(8)

diff --git a/src/certmonger-certmaster-submit.8.in b/src/certmonger-certmaster-submit.8.in

index aec8b83..e3e990f 100644

--- a/src/certmonger-certmaster-submit.8.in

+++ b/src/certmonger-certmaster-submit.8.in

@@ -1,17 +1,17 @@

-.TH certmonger 8 "7 June 2010" "certmonger Manual"

+.TH CERTMONGER 8 "June 7, 2010" "certmonger Manual"

 .SH NAME

-certmaster-submit

+certmaster\-submit

 .SH SYNOPSIS

-certmaster-submit [-h serverHost] [-c cafile] [-C capath] [csrfile]

+certmaster\-submit [\-h HOST] [\-c FILE] [\-C DIR] [\-v] [csrfile]

 .SH DESCRIPTION

-\fIcertmaster-submit\fR is the helper which \fIcertmonger\fR uses to make

-requests to certmaster-based CAs.  It is not normally run interactively,

+\fIcertmaster\-submit\fR is the helper which \fIcertmonger\fR uses to make

+requests to certmaster\-based CAs.  It is not normally run interactively,

 but it can be for troubleshooting purposes.  The signing request which is

 to be submitted should either be in a file whose name is given as an argument,

-or fed into \fIcertmaster-submit\fR via stdin.

+or fed into \fIcertmaster\-submit\fR via stdin.

 There is no standard authenticated method for obtaining the root certificate

 from certmaster CAs, so \fBcertmonger\fR does not support retrieving trust

@@ -19,21 +19,24 @@ information from them.

 .SH OPTIONS

 .TP

-\fB\-h\fR serverHost

+\fB\-h\fR \fIHOST\fR, \fB\-\-server\-host\fR=\fIHOST\fR

 Submit the request to the certmaster instance running on the named host.  The

 default is \fIlocalhost:51235\fR if a file named \fB/var/run/certmaster.pid\fR

 is found on the local system, and is read from \fB/etc/certmaster/minion.conf\fR

 if that file is not found.

 .TP

-\fB\-c\fR cafile

+\fB\-c\fR \fIFILE\fR, \fB\-\-cafile\fR=\fIFILE\fR

 Submit the request over HTTPS instead of HTTP, and only trust the server

 if its certificate was issued by the CA whose certificate is in the named file.

 .TP

-\fB\-C\fR capath

+\fB\-C\fR \fIDIR\fR, \fB\-\-capath\fR=\fIDIR\fR

 Submit the request over HTTPS instead of HTTP, and only trust the server

 if its certificate was issued by a CA whose certificate is in a file in

 the named directory.

-

+.TP

+\fB\-v\fR, \fB\-\-verbose\fR

+Be verbose about errors.  Normally, the details of an error received from

+the daemon will be suppressed if the client can make a diagnostic suggestion.

 .SH EXIT STATUS

 .TP

 0

@@ -73,22 +76,22 @@ Please file tickets for any that you find at https://fedorahosted.org/certmonger

 .SH SEE ALSO

 \fBcertmonger\fR(8)

 \fBgetcert\fR(1)

-\fBgetcert-add-ca\fR(1)

-\fBgetcert-add-scep-ca\fR(1)

-\fBgetcert-list-cas\fR(1)

-\fBgetcert-list\fR(1)

-\fBgetcert-modify-ca\fR(1)

-\fBgetcert-refresh-ca\fR(1)

-\fBgetcert-refresh\fR(1)

-\fBgetcert-rekey\fR(1)

-\fBgetcert-remove-ca\fR(1)

-\fBgetcert-resubmit\fR(1)

-\fBgetcert-start-tracking\fR(1)

-\fBgetcert-status\fR(1)

-\fBgetcert-stop-tracking\fR(1)

-\fBcertmonger-dogtag-ipa-renew-agent-submit\fR(8)

-\fBcertmonger-dogtag-submit\fR(8)

-\fBcertmonger-ipa-submit\fR(8)

-\fBcertmonger-local-submit\fR(8)

-\fBcertmonger-scep-submit\fR(8)

+\fBgetcert\-add\-ca\fR(1)

+\fBgetcert\-add\-scep\-ca\fR(1)

+\fBgetcert\-list\-cas\fR(1)

+\fBgetcert\-list\fR(1)

+\fBgetcert\-modify\-ca\fR(1)

+\fBgetcert\-refresh\-ca\fR(1)

+\fBgetcert\-refresh\fR(1)

+\fBgetcert\-rekey\fR(1)

+\fBgetcert\-remove\-ca\fR(1)

+\fBgetcert\-resubmit\fR(1)

+\fBgetcert\-start\-tracking\fR(1)

+\fBgetcert\-status\fR(1)

+\fBgetcert\-stop\-tracking\fR(1)

+\fBcertmonger\-dogtag\-ipa\-renew\-agent\-submit\fR(8)

+\fBcertmonger\-dogtag\-submit\fR(8)

+\fBcertmonger\-ipa\-submit\fR(8)

+\fBcertmonger\-local\-submit\fR(8)

+\fBcertmonger\-scep\-submit\fR(8)

 \fBcertmonger_selinux\fR(8)

diff --git a/src/certmonger-dogtag-ipa-renew-agent-submit.8.in b/src/certmonger-dogtag-ipa-renew-agent-submit.8.in

index 84c8b0d..33e0648 100644

--- a/src/certmonger-dogtag-ipa-renew-agent-submit.8.in

+++ b/src/certmonger-dogtag-ipa-renew-agent-submit.8.in

@@ -1,44 +1,51 @@

-.TH certmonger 8 "27 Oct 2015" "certmonger Manual"

+.TH CERTMONGER 8 "October 27, 2015" "certmonger Manual"

 .SH NAME

-dogtag-ipa-renew-agent-submit

+dogtag\-ipa\-renew\-agent\-submit

 .SH SYNOPSIS

-dogtag-ipa-renew-agent-submit -E EE-URL -A AGENT-URL

-[-d dbdir]

-[-n nickname]

-[-i cainfo]

-[-C capath]

-[-c certfile]

-[-k keyfile]

-[-p pinfile]

-[-P pin]

-[-s serial (hex)]

-[-D serial (decimal)]

-[-S state]

-[-T profile]

-[-O param=value]

-[-N | -R]

-[-t]

-[-o option=value]

-[-v]

+dogtag\-ipa\-renew\-agent\-submit \-E EE\-URL \-A AGENT\-URL

+[\-d dbdir]

+[\-n nickname]

+[\-i cainfo]

+[\-C capath]

+[\-c certfile]

+[\-k keyfile]

+[\-p pinfile]

+[\-P pin]

+[\-s serial (hex)]

+[\-D serial (decimal)]

+[\-S state]

+[\-T profile]

+[\-O param=value]

+[\-N | \-R]

+[\-t]

+[\-o option=value]

+[\-a]

+[\-u uid]

+[\-U udn]

+[\-W pwd]

+[\-w pwdfile]

+[\-Y pin]

+[\-y pinfile]

 [csrfile]

+

 .SH DESCRIPTION

-\fIdogtag-ipa-renew-agent-submit\fR is the helper which \fIcertmonger\fR uses

+\fIdogtag\-ipa\-renew\-agent\-submit\fR is the helper which \fIcertmonger\fR uses

 to make certificate renewal requests to Dogtag instances running on IPA

 servers.  It is not normally run interactively, but it can be for

 troubleshooting purposes.

-The preferred option is to request a renewal of an already-issued certificate,

-using its serial number, which can be read from a PEM-formatted certificate

+The preferred option is to request a renewal of an already\-issued certificate,

+using its serial number, which can be read from a PEM\-formatted certificate

 provided in the \fICERTMONGER_CERTIFICATE\fR environment variable, or via the

-\fB-s\fR or \fB-D\fR option on the command line.  If no serial number is

+\fB\-s\fR or \fB\-D\fR option on the command line.  If no serial number is

 provided, then the client will attempt to obtain a new certificate by

 submitting a signing request to the CA.

 The signing request which is to be submitted should either be in a file whose

-name is given as an argument, or fed into \fIdogtag-ipa-renew-agent-submit\fR

+name is given as an argument, or fed into \fIdogtag\-ipa\-renew\-agent\-submit\fR

 via stdin.

 \fBcertmonger\fR does not yet support retrieving trust information from Dogtag

@@ -46,8 +53,8 @@ CAs.

 .SH OPTIONS

 .TP

-\fB\-E\fR EE-URL

-The top-level URL for the end-entity interface provided by the CA.  In IPA

+\fB\-E\fR \fIEE\-URL\fR, \fB\-\-ee\-url\fR=\fIEE\-URL\fR

+The top\-level URL for the end\-entity interface provided by the CA.  In IPA

 installations, this is typically

 \fIhttp://\fBSERVER\fP:\fBEEPORT\fP/ca/ee/ca\fR.

 If no URL is specified, the \fIhost\fR named in the \fI[global]\fR section in

@@ -58,8 +65,8 @@ and the value of \fBEEPORT\fR will be inferred based on the value of the

 if \fIdogtag_version\fR is set to \fI10\fR or more, \fBEEPORT\fR will

 be set to 8080.  Otherwise it will be 9180.

 .TP

-\fB\-A\fR AGENT-URL

-The top-level URL for the agent interface provided by the CA.  In IPA

+\fB\-A\fR \fIAGENT\-URL\fR, \fB\-\-agent\-url\fR=\fIAGENT\-URL\fR

+The top\-level URL for the agent interface provided by the CA.  In IPA

 installations, this is typically

 \fIhttps://\fBSERVER\fP:\fBAGENTPORT\fP/ca/agent/ca\fR.

 If no URL is specified, the \fIhost\fR named in the \fI[global]\fR section in

@@ -70,96 +77,159 @@ and the value of \fBAGENTPORT\fR will be inferred based on the value of the

 if \fIdogtag_version\fR is set to \fI10\fR or more, \fBAGENTPORT\fR will

 be set to 8443.  Otherwise it will be 9443.

 .TP

-\fB\-d\fR dbdir \fB\-n\fR nickname \fB\-c\fR certfile \fB\-k\fR keyfile

-The location of the key and certificate which the client should use to

-authenticate to the CA's agent interface.  Exactly which values are

-meaningful depend on which cryptography library your copy of libcurl was

-linked with.

-

-If none of these options are specified, and none of the \fB-p\fR, \fB-P\fR,

-\fB-i\fR, nor \fB-C\fR options are specified, then this set of defaults is

-used:

- \fB-i\fR \fI/etc/ipa/ca.crt\fR

- \fB-d\fR \fI/etc/httpd/alias\fR

- \fB-n\fR \fIipaCert\fR

- \fB-p\fR \fI/etc/httpd/alias/pwdfile.txt\fR

-.TP

-\fB\-p\fR pinfile

-The name of a file which contains a PIN/password which will be needed in

-order to make use of the agent credentials.

-

-If this option is not specified, and none of the \fB-d\fR, \fB-n\fR, \fB-c\fR,

-\fB-k\fR, \fB-P\fR, \fB-i\fR, nor \fB-C\fR options are specified, then this set

-of defaults is used:

- \fB-i\fR \fI/etc/ipa/ca.crt\fR

- \fB-d\fR \fI/etc/httpd/alias\fR

- \fB-n\fR \fIipaCert\fR

- \fB-p\fR \fI/etc/httpd/alias/pwdfile.txt\fR

-.TP

-\fB\-i\fR cainfo \fB\-C\fR capath

+\fB\-i\fR \fIFILE\fB, \fB\-\-cafile\fR=\fIPATH\fR

 The location of a file containing a copy of the CA's certificate, against which

-the CA server's certificate will be verified, or a directory containing, among

-other things, such a file.

-

-If these options are not specified, and none of the \fB-d\fR, \fB-n\fR,

-\fB-c\fR, \fB-k\fR, \fB-p\fR, nor \fB-P\fR options are specified, then this set

-of defaults is used:

- \fB-i\fR \fI/etc/ipa/ca.crt\fR

- \fB-d\fR \fI/etc/httpd/alias\fR

- \fB-n\fR \fIipaCert\fR

- \fB-p\fR \fI/etc/httpd/alias/pwdfile.txt\fR

-.TP

-\fB-s\fR serial

-The serial number of an already-issued certificate for which the client should

-attempt to obtain a new certificate, in hexadecimal form, if one can not be

+the CA server's certificate will be verified. The default is

+\fB/etc/ipa/ca.crt\fR.

+.TP

+\fB\-C\fR \fIDIR\fR, \fB\-\-capath\fR=\fIDIR\fR

+The location of a directory containing a copy of the CA's certificate,

+against which the CA server's certificate will be verified.

+.TP

+\fB\-s\fR \fINUMBER\fR, \fB\-\-hex\-serial\fR=\fINUMBER\fB

+The serial number of an already\-issued certificate for which the client should

+attempt to obtain a new certificate, in hexidecimal form, if one can not be

 read from the \fICERTMONGER_CERTIFICATE\fR environment variable.

 .TP

-\fB-D\fR serial

-The serial number of an already-issued certificate for which the client should

+\fB\-D\fR \fINUMBER\fR, \fB\-\-serial\fR=\fINUMBER\fB

+The serial number of an already\-issued certificate for which the client should

 attempt to obtain a new certificate, in decimal form, if one can not be

 read from the \fICERTMONGER_CERTIFICATE\fR environment variable.

 .TP

-\fB-S\fR state

+\fB\-S\fR \fISTATE\-VALUE\fR, \fB\-\-state\fR=\fISTATE\-VALUE\fR

 A cookie value provided by a previous instance of this helper, if the helper

-is being asked to continue a multi-step enrollment process.  If the

+is being asked to continue a multi\-step enrollment process.  If the

 \fICERTMONGER_COOKIE\fR environment variable is set, its value is used.

 .TP

-\fB-T\fR profile/template

+\fB\-T\fR \fINAME\fR, \fB\-\-profile\fR=\fINAME\fR

 The name of the type of certificate which the client should request from the CA

-if it is not renewing a certificate (per the \fB-s\fR option above).  If the

+if it is not renewing a certificate (per the \fB\-s\fR option above).  If the

 \fICERTMONGER_CA_PROFILE\fR environment variable is set, its value is used.

 Otherwise, the default value is \fBcaServerCert\fP.

 .TP

-\fB-O\fR param=value

+\fB\-t\fR, \fB\-\-profile\-list\fR

+Instead of attempting to obtain a new certificate, query the server for a list

+of the enabled enrollment profiles.

+.TP

+\fB\-O\fR \fIparam=value\fR, \fB\-\-approval\-option\fR=\fIparam=value\fR

 An additional parameter to pass to the server when approving the signing

-request using the agent's credentials.  By default, any server-supplied default

+request using the agent's credentials.  By default, any server\-supplied default

 settings are applied.  This option can be used either to override a

-server-supplied default setting, or to supply one which would otherwise have

+server\-supplied default setting, or to supply one which would otherwise have

 not been used.

 .TP

-\fB-N\fR

-Even if an already-issued certificate is available in the

+\fB\-N\fR, \fB\-\-force\-new\fR

+Even if an already\-issued certificate is available in the

 \fICERTMONGER_CERTIFICATE\fR environment variable, or a serial number has been

 provided, don't attempt to renew a certificate using its serial number.

 Instead, attempt to obtain a new certificate using the signing request.

 The default behavior is to request a renewal if possible.

 .TP

-\fB-R\fR

-Negates the effect of the \fB-N\fR flag.

-.TP

-\fB-t\fR

-Instead of attempting to obtain a new certificate, query the server for a list

-of the enabled enrollment profiles.

+\fB\-R\fR, \fB\-\-force\-renew\fR

+Negates the effect of the \fB\-N\fR flag.

 .TP

-\fB-o\fR param=value

+\fB\-o\fR \fIparam=value\fR, \fB\-\-submit\-option\fR=\fIparam=value\fR

 When initially submitting a request to the CA, add the specified parameter and

 value along with any request parameters which would otherwise be sent.  This

 option is not typically used.

 .TP

-\fB-v\fR

+\fB\-a\fR, \fB\-\-agent\-submit\fR

+Use agent credentials, specified using some combination of the \fB\-d\fR,

+\fB\-n\fR, \fB\-c\fR, and \fB\-k\fR flags, to authenticate to the CA when

+initially submitting a request to the CA or retrieving the list of enabled

+enrollment profiles.

+This is typically required when the enrollment profile being used uses

+\fIAgentCertAuth\fR\-based

+authentication,

+and requires that the URL specified using the \fB\-E\fR flag be an HTTPS URL,

+or when the URL specified using the \fB\-E\fR flag is an HTTPS URL.

+.TP

+\fB\-u username\fR, \fB\-\-uid\fR=\fIusername\fR

+When initially submitting a request to the CA, supply the specified value as a user name.

+This is typically required when the enrollment profile being used uses

+\fIUidPwdDirAuth\fR\-based or \fINISAuth\fR\-based

+authentication..TP

+\fB\-U\fR \fIuserdn\fR, \fB\-\-upn\fR=\fIuserdn\fR

+When initially submitting a request to the CA, supply the specified value as the DN

+(distinguished name) of the user's entry in a directory server which the CA is

+configured to use for checking the user's password.

+This is typically required when the enrollment profile being used uses

+\fIUdnPwdDirAuth\fR\-based

+authentication.

+.TP

+\fB\-W\fR \fIPASSWORD\fR, \fB\-\-userpwd\fR=\fIPASSWORD\fR

+When initially submitting a request to the CA, supply the specified value as the password

+for the user whose name is specified with the \fB\-u\fR option, or whose DN is

+specified with the \fB\-U\fR option.

+This is typically only required when the enrollment profile being used uses

+\fIUidPwdDirAuth\fR\-based, \fIUserPwdDirAuth\fR\-based, or \fINISAuth\fR\-based

+authentication.

+If the URL specified using the \fB\-E\fR flag is not an HTTPS URL, this value

+will not be encrypted.

+.TP

+\fB\-w\fR \fIFILE\fR, \fB\-\-userpwdfile\fR=\fIFILE\fR

+When initially submitting a request to the CA, read from the specified file a

+password to supply for the user whose name is specified with the \fB\-u\fR

+option, or whose DN is specified with the \fB\-U\fR option.

+This is typically only required when the enrollment profile being used uses

+\fIUidPwdDirAuth\fR\-based, \fIUserPwdDirAuth\fR\-based, or \fINISAuth\fR\-based

+authentication.

+If the URL specified using the \fB\-E\fR flag is not an HTTPS URL, this value

+will not be encrypted.

+.TP

+\fB\-Y\fR \fIPIN\fR, \fB\-\-userpin\fR=\fIPIN\fR

+When initially submitting a request to the CA, supply the specified value as the PIN

+for the user whose name is specified with the \fB\-u\fR option, or whose DN is

+specified with the \fB\-U\fR option.

+This is typically only required when the enrollment profile being used uses

+\fIUidPwdPinDirAuth\fR\-based

+authentication.

+If the URL specified using the \fB\-E\fR flag is not an HTTPS URL, this value

+will not be encrypted.

+\fB\-y\fR \fIFILE\fR, \fB\-\-userpinfile\fR=\fIFILE\fR

+When initially submitting a request to the CA, read from the specified file a

+PIN to supply for the user whose name is specified with the \fB\-u\fR

+option, or whose DN is specified with the \fB\-U\fR option.

+This is typically only required when the enrollment profile being used uses

+\fIUidPwdPinDirAuth\fR\-based

+authentication.  If the URL specified using the \fB\-E\fR flag is not an HTTPS URL, this value

+will not be encrypted.

+.TP

+\fB\-v\fR, \fB\-\-verbose\fR

 Increases the logging level.  Use twice for more logging.  This option is mainly

 useful for troubleshooting.

-

+.SH AGENT KEY AND CERTIFICATE OPTIONS

+Options that provide the location for the private key and public certificate

+which the client should use to authenticate to the CA's agent interface.

+The values to use depend on which cryptography library your copy of libcurl

+was linked with.

+.TP

+If none of these options are specified, and none of the \fB\-p\fR, \fB\-P\fR, \fB\-i\fR, nor \fB\-C\fR options are specified, then this set of defaults is used:

+ \fB\-i\fR \fI/etc/ipa/ca.crt\fR

+ \fB\-d\fR \fI/etc/httpd/alias\fR

+ \fB\-n\fR \fIipaCert\fR

+ \fB\-p\fR \fI/etc/httpd/alias/pwdfile.txt\fR

+.TP

+\fB\-d\fR \fIdbdir\fR, \fB\-\-dbdir\fR=\fIdbdir\fR

+Use an NSS database in the specified directory for this certificate

+and key. Only valid with \-n.

+.TP

+\fB\-n\fR \fINAME\fR, \fB\-\-nickname\fR=\fINAME\fR

+Use the NSS key with this nickname. Only valid with \-d.

+.TP

+\fB\-c\fR \fIFILE\fR, \fB\-\-certfile\fR=\fIFILE\fR

+The PEM file that contains the public certificate. Only valid with \-k.

+.TP

+\fB\-k\fR \fIFILE\fR, \fB\-\-keyfile\fR=\fIFILE\fR

+The PEM file that contains the private certificate. Only valid with \-c.

+.TP

+\fB\-p\fR \fIFILE\fR, \fB\-\-sslpinfile\fR=\fIFILE\fR

+The name of a file which contains a PIN/password which will be needed in

+order to make use of the agent credentials.

+.TP

+\fB\-P\fR \fIPIN\fR, \fB\-\-sslpin\fR=\fIPIN\fR

+The name of a file which contains a PIN/password which will be needed in

+order to make use of the agent credentials.

 .SH EXIT STATUS

 .TP

 0

@@ -189,7 +259,7 @@ pair.

 .TP

 .I /etc/ipa/default.conf

 is the IPA client configuration file.  This file is consulted to determine

-the URL for the Dogtag server's end-entity and agent interfaces if they are

+the URL for the Dogtag server's end\-entity and agent interfaces if they are

 not supplied as arguments.

 .SH BUGS

@@ -198,22 +268,22 @@ Please file tickets for any that you find at https://fedorahosted.org/certmonger

 .SH SEE ALSO

 \fBcertmonger\fR(8)

 \fBgetcert\fR(1)

-\fBgetcert-add-ca\fR(1)

-\fBgetcert-add-scep-ca\fR(1)

-\fBgetcert-list-cas\fR(1)

-\fBgetcert-list\fR(1)

-\fBgetcert-modify-ca\fR(1)

-\fBgetcert-refresh-ca\fR(1)

-\fBgetcert-refresh\fR(1)

-\fBgetcert-rekey\fR(1)

-\fBgetcert-remove-ca\fR(1)

-\fBgetcert-resubmit\fR(1)

-\fBgetcert-start-tracking\fR(1)

-\fBgetcert-status\fR(1)

-\fBgetcert-stop-tracking\fR(1)

-\fBcertmonger-certmaster-submit\fR(8)

-\fBcertmonger-dogtag-submit\fR(8)

-\fBcertmonger-ipa-submit\fR(8)

-\fBcertmonger-local-submit\fR(8)

-\fBcertmonger-scep-submit\fR(8)

+\fBgetcert\-add\-ca\fR(1)

+\fBgetcert\-add\-scep\-ca\fR(1)

+\fBgetcert\-list\-cas\fR(1)

+\fBgetcert\-list\fR(1)

+\fBgetcert\-modify\-ca\fR(1)

+\fBgetcert\-refresh\-ca\fR(1)

+\fBgetcert\-refresh\fR(1)

+\fBgetcert\-rekey\fR(1)

+\fBgetcert\-remove\-ca\fR(1)

+\fBgetcert\-resubmit\fR(1)

+\fBgetcert\-start\-tracking\fR(1)

+\fBgetcert\-status\fR(1)

+\fBgetcert\-stop\-tracking\fR(1)

+\fBcertmonger\-certmaster\-submit\fR(8)

+\fBcertmonger\-dogtag\-submit\fR(8)

+\fBcertmonger\-ipa\-submit\fR(8)

+\fBcertmonger\-local\-submit\fR(8)

+\fBcertmonger\-scep\-submit\fR(8)

 \fBcertmonger_selinux\fR(8)

diff --git a/src/certmonger-dogtag-submit.8.in b/src/certmonger-dogtag-submit.8.in

index 19ecab7..e92de67 100644

--- a/src/certmonger-dogtag-submit.8.in

+++ b/src/certmonger-dogtag-submit.8.in

@@ -1,196 +1,214 @@

-.TH certmonger 8 "27 Oct 2015" "certmonger Manual"

+.TH CERTMONGER 8 "October 27, 2015" "certmonger Manual"

 .SH NAME

-dogtag-submit

+dogtag\-submit

 .SH SYNOPSIS

-dogtag-submit -E EE-URL -A AGENT-URL

-[-d dbdir]

-[-n nickname]

-[-i cainfo]

-[-C capath]

-[-c certfile]

-[-k keyfile]

-[-p pinfile]

-[-P pin]

-[-s serial (hex)]

-[-D serial (decimal)]

-[-S state]

-[-T profile]

-[-O param=value]

-[-N | -R]

-[-t]

-[-o option=value]

-[-a ]

-[-u username]

-[-U userdn]

-[-W userpassword]

-[-w userpasswordfile]

-[-Y userpin]

-[-y userpinfile]

-[-v]

+dogtag\-submit \-E EE\-URL \-A AGENT\-URL

+[\-d DIR]

+[\-n NAME]

+[\-i FILE]

+[\-C DIR]

+[\-c FILE]

+[\-k FILE]

+[\-p FILE]

+[\-P PIN]

+[\-s serial (hex)]

+[\-D serial (decimal)]

+[\-S state]

+[\-T profile]

+[\-O param=value]

+[\-N | \-R]

+[\-t]

+[\-o option=value]

+[\-a]

+[\-u username]

+[\-U userdn]

+[\-W PASSWORD]

+[\-w FILE]

+[\-Y PIN]

+[\-y FILE]

+[\-v]

 [csrfile]

 .SH DESCRIPTION

-\fIdogtag-submit\fR is the helper which \fIcertmonger\fR can use to make

+\fIdogtag\-submit\fR is the helper which \fIcertmonger\fR can use to make

 certificate enrollment and renewal requests to Dogtag servers.  It is not

 normally run interactively, but it can be for troubleshooting purposes.

-The preferred option is to request a renewal of an already-issued certificate,

-using its serial number, which can be read from a PEM-formatted certificate

+The preferred option is to request a renewal of an already\-issued certificate,

+using its serial number, which can be read from a PEM\-formatted certificate

 provided in the \fICERTMONGER_CERTIFICATE\fR environment variable, or via the

-\fB-s\fR or \fB-D\fR option on the command line.  If no serial number is

+\fB\-s\fR or \fB\-D\fR option on the command line.  If no serial number is

 provided, then the client will attempt to obtain a new certificate by

 submitting a signing request to the CA.

 The signing request which is to be submitted should either be in a file whose

-name is given as an argument, or fed into \fIdogtag-submit\fR via stdin.