13 files changed, 30 insertions, 170 deletions
diff --git a/doc/apps/CA.pl.pod b/doc/apps/CA.pl.pod
index 9d287f0c4d5..83e4c0af810 100644
--- a/doc/apps/CA.pl.pod
+++ b/doc/apps/CA.pl.pod
@@ -102,35 +102,6 @@ the request and finally create a PKCS#12 file containing it.
  CA.pl -signreq
  CA.pl -pkcs12 "My Test Certificate"
 
-=head1 DSA CERTIFICATES
-
-Although the B<CA.pl> creates RSA CAs and requests it is still possible to
-use it with DSA certificates and requests using the L<req(1)|req(1)> command
-directly. The following example shows the steps that would typically be taken.
-
-Create some DSA parameters:
-
- openssl dsaparam -out dsap.pem 1024
-
-Create a DSA CA certificate and private key:
-
- openssl req -x509 -newkey dsa:dsap.pem -keyout cacert.pem -out cacert.pem
-
-Create the CA directories and files:
-
- CA.pl -newca
-
-enter cacert.pem when prompted for the CA file name.
-
-Create a DSA certificate request and privat key (a different set of parameters
-can optionally be created first):
-
- openssl req -out newreq.pem -newkey dsa:dsap.pem 
-
-Sign the request:
-
- CA.pl -signreq
-
 =head1 NOTES
 
 Most of the filenames mentioned can be modified by editing the B<CA.pl> script.
diff --git a/doc/apps/ciphers.pod b/doc/apps/ciphers.pod
index 21077614a72..2301e28251c 100644
--- a/doc/apps/ciphers.pod
+++ b/doc/apps/ciphers.pod
@@ -25,13 +25,9 @@ the appropriate cipherlist.
 
 =item B<-v>
 
-verbose option. List ciphers with a complete description of
-protocol version (SSLv2 or SSLv3; the latter includes TLS), key exchange,
-authentication, encryption and mac algorithms used along with any key size
+verbose option. List ciphers with a complete description of the authentication,
+key exchange, encryption and mac algorithms used along with any key size
 restrictions and whether the algorithm is classed as an "export" cipher.
-Note that without the B<-v> option, ciphers may seem to appear twice
-in a cipher list; this is when similar ciphers are available for
-SSL v2 and for SSL v3/TLS v1.
 
 =item B<-ssl3>
 
diff --git a/doc/apps/dgst.pod b/doc/apps/dgst.pod
index fcfd3ecf23f..cbf2cc529aa 100644
--- a/doc/apps/dgst.pod
+++ b/doc/apps/dgst.pod
@@ -6,7 +6,7 @@ dgst, md5, md2, sha1, sha, mdc2, ripemd160 - message digests
 
 =head1 SYNOPSIS
 
-B<openssl> B<dgst> 
+[B<dgst>]
 [B<-md5|-md2|-sha1|-sha|mdc2|-ripemd160>]
 [B<-c>]
 [B<-d>]
diff --git a/doc/apps/dhparam.pod b/doc/apps/dhparam.pod
index ff8a6e5e5b6..6b237ec05a9 100644
--- a/doc/apps/dhparam.pod
+++ b/doc/apps/dhparam.pod
@@ -6,19 +6,18 @@ dhparam - DH parameter manipulation and generation
 
 =head1 SYNOPSIS
 
-B<openssl dhparam>
+B<openssl dh>
 [B<-inform DER|PEM>]
 [B<-outform DER|PEM>]
-[B<-in> I<filename>]
-[B<-out> I<filename>]
-[B<-dsaparam>]
+[B<-in filename>]
+[B<-out filename>]
 [B<-noout>]
 [B<-text>]
 [B<-C>]
 [B<-2>]
 [B<-5>]
-[B<-rand> I<file(s)>]
-[I<numbits>]
+[B<-rand file(s)>]
+[numbits]
 
 =head1 DESCRIPTION
 
@@ -40,46 +39,34 @@ additional header and footer lines.
 This specifies the output format, the options have the same meaning as the 
 B<-inform> option.
 
-=item B<-in> I<filename>
+=item B<-in filename>
 
 This specifies the input filename to read parameters from or standard input if
 this option is not specified.
 
-=item B<-out> I<filename>
+=item B<-out filename>
 
 This specifies the output filename parameters to. Standard output is used
 if this option is not present. The output filename should B<not> be the same
 as the input filename.
 
-=item B<-dsaparam>
-
-If this option is used, DSA rather than DH parameters are read or created;
-they are converted to DH format.  Otherwise, "strong" primes (such
-that (p-1)/2 is also prime) will be used for DH parameter generation.
-
-DH parameter generation with the B<-dsaparam> option is much faster,
-and the recommended exponent length is shorter, which makes DH key
-exchange more efficient.  Beware that with such DSA-style DH
-parameters, a fresh DH key should be created for each use to
-avoid small-subgroup attacks that may be possible otherwise.
-
 =item B<-2>, B<-5>
 
 The generator to use, either 2 or 5. 2 is the default. If present then the
 input file is ignored and parameters are generated instead.
 
-=item B<-rand> I<file(s)>
+=item B<-rand file(s)>
 
 a file or files containing random data used to seed the random number
 generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
 Multiple files can be specified separated by a OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
 all others.
 
-=item I<numbits>
+=item B<numbits>
 
 this option specifies that a parameter set should be generated of size
-I<numbits>. It must be the last option. If not present then a value of 512
+B<numbits>. It must be the last option. If not present then a value of 512
 is used. If this option is present then the input file is ignored and 
 parameters are generated instead.
 
@@ -94,7 +81,7 @@ this option prints out the DH parameters in human readable form.
 =item B<-C>
 
 this option converts the parameters into C code. The parameters can then
-be loaded by calling the B<get_dh>I<numbits>B<()> function.
+be loaded by calling the B<get_dhXXX()> function.
 
 =back
 
@@ -125,9 +112,4 @@ There should be a way to generate and manipulate DH keys.
 
 L<dsaparam(1)|dsaparam(1)>
 
-=head1 HISTORY
-
-The B<dhparam> command was added in OpenSSL 0.9.5.
-The B<-dsaparam> option was added in OpenSSL 0.9.6.
-
 =cut
diff --git a/doc/apps/dsaparam.pod b/doc/apps/dsaparam.pod
index 50c2f61242f..8647f34698c 100644
--- a/doc/apps/dsaparam.pod
+++ b/doc/apps/dsaparam.pod
@@ -73,7 +73,7 @@ parameters.
 a file or files containing random data used to seed the random number
 generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
 Multiple files can be specified separated by a OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
 all others.
 
 =item B<numbits>
diff --git a/doc/apps/gendsa.pod b/doc/apps/gendsa.pod
index 74318fe7fb6..3314ace5172 100644
--- a/doc/apps/gendsa.pod
+++ b/doc/apps/gendsa.pod
@@ -34,7 +34,7 @@ If none of these options is specified no encryption is used.
 a file or files containing random data used to seed the random number
 generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
 Multiple files can be specified separated by a OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
 all others.
 
 =item B<paramfile>
diff --git a/doc/apps/genrsa.pod b/doc/apps/genrsa.pod
index cdcc03c1237..a2d878410b0 100644
--- a/doc/apps/genrsa.pod
+++ b/doc/apps/genrsa.pod
@@ -51,7 +51,7 @@ the public exponent to use, either 65537 or 3. The default is 65537.
 a file or files containing random data used to seed the random number
 generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
 Multiple files can be specified separated by a OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
 all others.
 
 =item B<numbits>
@@ -83,6 +83,3 @@ be much larger (typically 1024 bits).
 =head1 SEE ALSO
 
 L<gendsa(1)|gendsa(1)>
-
-=cut
-
diff --git a/doc/apps/openssl.pod b/doc/apps/openssl.pod
index 2fc61b6c217..9b1320606ba 100644
--- a/doc/apps/openssl.pod
+++ b/doc/apps/openssl.pod
@@ -12,10 +12,6 @@ I<command>
 [ I<command_opts> ]
 [ I<command_args> ]
 
-B<openssl> [ B<list-standard-commands> | B<list-message-digest-commands> | B<list-cipher-commands> ]
-
-B<openssl> B<no->I<XXX> [ I<arbitrary options> ]
-
 =head1 DESCRIPTION
 
 OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL
@@ -39,22 +35,6 @@ The B<openssl> program provides a rich variety of commands (I<command> in the
 SYNOPSIS above), each of which often has a wealth of options and arguments
 (I<command_opts> and I<command_args> in the SYNOPSIS).
 
-The pseudo-commands B<list-standard-commands>, B<list-message-digest-commands>,
-and B<list-cipher-commands> output a list (one entry per line) of the names
-of all standard commands, message digest commands, or cipher commands,
-respectively, that are available in the present B<openssl> utility.
-
-The pseudo-command B<no->I<XXX> tests whether a command of the
-specified name is available.  If no command named I<XXX> exists, it
-returns 0 (success) and prints B<no->I<XXX>; otherwise it returns 1
-and prints I<XXX>.  In both cases, the output goes to B<stdout> and
-nothing is printed to B<stderr>.  Additional command line arguments
-are always ignored.  Since for each cipher there is a command of the
-same name, this provides an easy way for shell scripts to test for the
-availability of ciphers in the B<openssl> program.  (B<no->I<XXX> is
-not able to detect pseudo-commands such as B<quit>,
-B<list->I<...>B<-commands>, or B<no->I<XXX> itself.)
-
 =head2 STANDARD COMMANDS
 
 =over 10
@@ -123,10 +103,6 @@ Generation of hashed passwords.
 
 PKCS#7 Data Management.
 
-=item L<B<rand>|rand(1)>
-
-Generate pseudo-random bytes.
-
 =item L<B<req>|req(1)>
 
 X.509 Certificate Signing Request (CSR) Management.
@@ -309,17 +285,14 @@ L<enc(1)|enc(1)>, L<gendsa(1)|gendsa(1)>,
 L<genrsa(1)|genrsa(1)>, L<nseq(1)|nseq(1)>, L<openssl(1)|openssl(1)>,
 L<passwd(1)|passwd(1)>,
 L<pkcs12(1)|pkcs12(1)>, L<pkcs7(1)|pkcs7(1)>, L<pkcs8(1)|pkcs8(1)>,
-L<rand(1)|rand(1)>, L<req(1)|req(1)>, L<rsa(1)|rsa(1)>, L<s_client(1)|s_client(1)>,
+L<req(1)|req(1)>, L<rsa(1)|rsa(1)>, L<s_client(1)|s_client(1)>,
 L<s_server(1)|s_server(1)>, L<smime(1)|smime(1)>, L<spkac(1)|spkac(1)>,
 L<verify(1)|verify(1)>, L<version(1)|version(1)>, L<x509(1)|x509(1)>,
 L<crypto(3)|crypto(3)>, L<ssl(3)|ssl(3)> 
 
 =head1 HISTORY
 
-The openssl(1) document appeared in OpenSSL 0.9.2.
-The B<list->I<XXX>B<-commands> pseudo-commands were added in OpenSSL 0.9.3;
-the B<no->I<XXX> pseudo-commands were added in OpenSSL 0.9.5a.
-For notes on the availability of other commands, see their individual
-manual pages.
+The openssl(1) document appeared in OpenSSL 0.9.2
 
 =cut
+
diff --git a/doc/apps/pkcs12.pod b/doc/apps/pkcs12.pod
index c4009998b8a..241f9c4a8b0 100644
--- a/doc/apps/pkcs12.pod
+++ b/doc/apps/pkcs12.pod
@@ -244,7 +244,7 @@ to be needed to use MAC iterations counts but they are now used by default.
 a file or files containing random data used to seed the random number
 generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
 Multiple files can be specified separated by a OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
 all others.
 
 =back
diff --git a/doc/apps/rand.pod b/doc/apps/rand.pod
deleted file mode 100644
index cbf8768801b..00000000000
--- a/doc/apps/rand.pod
+++ /dev/null
@@ -1,50 +0,0 @@
-=pod
-
-=head1 NAME
-
-rand - generate pseudo-random bytes
-
-=head1 SYNOPSIS
-
-B<openssl rand>
-[B<-out> I<file>]
-[B<-rand> I<file(s)>]
-[B<-base64>]
-I<num>
-
-=head1 DESCRIPTION
-
-The B<rand> command outputs I<num> pseudo-random bytes after seeding
-the random number generater once.  As in other B<openssl> command
-line tools, PRNG seeding uses the file I<$HOME/>B<.rnd> or B<.rnd>
-in addition to the files given in the B<-rand> option.  A new
-I<$HOME>/B<.rnd> or B<.rnd> file will be written back if enough
-seeding was obtained from these sources.
-
-=head1 OPTIONS
-
-=over 4
-
-=item B<-out> I<file>
-
-Write to I<file> instead of standard output.
-
-=item B<-rand> I<file(s)>
-
-Use specified file or files or EGD socket (see L<RAND_egd(3)|RAND_egd(3)>)
-for seeding the random number generator.
-Multiple files can be specified separated by a OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
-all others.
-
-=item B<-base64>
-
-Perform base64 encoding on the output.
-
-=back
-
-=head1 SEE ALSO
-
-L<RAND_bytes(3)|RAND_bytes(3)>
-
-=cut
diff --git a/doc/apps/s_client.pod b/doc/apps/s_client.pod
index 2f803753199..3ede134164c 100644
--- a/doc/apps/s_client.pod
+++ b/doc/apps/s_client.pod
@@ -22,7 +22,6 @@ B<openssl> B<s_client>
 [B<-state>]
 [B<-nbio>]
 [B<-crlf>]
-[B<-ign_eof>]
 [B<-quiet>]
 [B<-ssl2>]
 [B<-ssl3>]
@@ -123,15 +122,9 @@ turns on non-blocking I/O
 this option translated a line feed from the terminal into CR+LF as required
 by some servers.
 
-=item B<-ign_eof>
-
-inhibit shutting down the connection when end of file is reached in the
-input.
-
 =item B<-quiet>
 
-inhibit printing of session and certificate information.  This implicitely
-turns on B<-ign_eof> as well.
+inhibit printing of session and certificate information.
 
 =item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>
 
@@ -162,10 +155,9 @@ command for more information.
 
 If a connection is established with an SSL server then any data received
 from the server is displayed and any key presses will be sent to the
-server. When used interactively (which means neither B<-quiet> nor B<-ign_eof>
-have been given), the session will be renegociated if the line begins with an
-B<R>, and if the line begins with a B<Q> or if end of file is reached, the
-connection will be closed down.
+server. If the line begins with an B<R> then the session will be
+renegotiated. If the line begins with a B<Q> the connection will be closed
+down.
 
 =head1 NOTES
 
diff --git a/doc/apps/smime.pod b/doc/apps/smime.pod
index 5dee9356068..631ecdc241e 100644
--- a/doc/apps/smime.pod
+++ b/doc/apps/smime.pod
@@ -179,7 +179,7 @@ the B<-recip> or B<-signer> file.
 a file or files containing random data used to seed the random number
 generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
 Multiple files can be specified separated by a OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
 all others.
 
 =item B<cert.pem...>
diff --git a/doc/apps/x509.pod b/doc/apps/x509.pod
index e4ae5468da3..b127182bbbf 100644
--- a/doc/apps/x509.pod
+++ b/doc/apps/x509.pod
@@ -212,10 +212,9 @@ clears all the prohibited or rejected uses of the certificate.
 
 =item B<-addtrust arg>
 
-adds a trusted certificate use. Any object name can be used here
-but currently only B<clientAuth> (SSL client use), B<serverAuth>
-(SSL server use) and B<emailProtection> (S/MIME email) are used.
-Other OpenSSL applications may define additional uses.
+adds a trusted certificate use. Currently acceptable values
+are B<all> (any purpose), B<sslclient> (SSL client use), B<sslserver>
+(SSL server use) B<email> (S/MIME email) and B<objsign> (Object signing).
 
 =item B<-addreject arg>