Commit 2c5f67b894 for openssl.org

commit 2c5f67b894e4f0703ab23262800897b81586651a
Author: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date:   Wed Aug 12 10:19:04 2026 +0900

    doc: correct pkcs12 passin and passout descriptions

    The pkcs12 documentation incorrectly says that -passin is used to
    encrypt output private keys. The implementation uses -passin for input
    and -passout for output, with direction-specific roles depending on
    -export.

    Describe both options explicitly and link -passout to the shared
    passphrase-options documentation.

    Assisted-by: Codex:gpt-5.6-sol
    Reviewed-by: Richard Levitte <levitte@openssl.org>
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Merge-date: Tue Sep  1 14:10:54 2026
    Merged-from: https://github.com/openssl/openssl/pull/32315

diff --git a/doc/man1/openssl-pkcs12.pod.in b/doc/man1/openssl-pkcs12.pod.in
index ab49c95291..a2b60472b7 100644
--- a/doc/man1/openssl-pkcs12.pod.in
+++ b/doc/man1/openssl-pkcs12.pod.in
@@ -104,14 +104,19 @@ Print out a usage message.

 =item B<-passin> I<arg>

-The password source for the input, and for encrypting any private keys that
-are output.
+The password source for input files. With B<-export>, it is used to decrypt
+the input private key. Otherwise, it is the password for the input PKCS#12
+file.
 For more information about the format of B<arg>
 see L<openssl-passphrase-options(1)>.

 =item B<-passout> I<arg>

-The password source for output files.
+The password source for output files. With B<-export>, it is the password for
+the output PKCS#12 file. Otherwise, it is used to encrypt any private keys that
+are output.
+For more information about the format of B<arg>
+see L<openssl-passphrase-options(1)>.

 =item B<-password> I<arg>