1214 lines
52 KiB
Plaintext
1214 lines
52 KiB
Plaintext
.\" Automatically generated by Pod::Man 4.11 (Pod::Simple 3.35)
|
|
.\"
|
|
.\" Standard preamble:
|
|
.\" ========================================================================
|
|
.de Sp \" Vertical space (when we can't use .PP)
|
|
.if t .sp .5v
|
|
.if n .sp
|
|
..
|
|
.de Vb \" Begin verbatim text
|
|
.ft CW
|
|
.nf
|
|
.ne \\$1
|
|
..
|
|
.de Ve \" End verbatim text
|
|
.ft R
|
|
.fi
|
|
..
|
|
.\" Set up some character translations and predefined strings. \*(-- will
|
|
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
|
|
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
|
|
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
|
|
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
|
|
.\" nothing in troff, for use with C<>.
|
|
.tr \(*W-
|
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
|
.ie n \{\
|
|
. ds -- \(*W-
|
|
. ds PI pi
|
|
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
|
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
|
. ds L" ""
|
|
. ds R" ""
|
|
. ds C` ""
|
|
. ds C' ""
|
|
'br\}
|
|
.el\{\
|
|
. ds -- \|\(em\|
|
|
. ds PI \(*p
|
|
. ds L" ``
|
|
. ds R" ''
|
|
. ds C`
|
|
. ds C'
|
|
'br\}
|
|
.\"
|
|
.\" Escape single quotes in literal strings from groff's Unicode transform.
|
|
.ie \n(.g .ds Aq \(aq
|
|
.el .ds Aq '
|
|
.\"
|
|
.\" If the F register is >0, we'll generate index entries on stderr for
|
|
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
|
|
.\" entries marked with X<> in POD. Of course, you'll have to process the
|
|
.\" output yourself in some meaningful fashion.
|
|
.\"
|
|
.\" Avoid warning from groff about undefined register 'F'.
|
|
.de IX
|
|
..
|
|
.nr rF 0
|
|
.if \n(.g .if rF .nr rF 1
|
|
.if (\n(rF:(\n(.g==0)) \{\
|
|
. if \nF \{\
|
|
. de IX
|
|
. tm Index:\\$1\t\\n%\t"\\$2"
|
|
..
|
|
. if !\nF==2 \{\
|
|
. nr % 0
|
|
. nr F 2
|
|
. \}
|
|
. \}
|
|
.\}
|
|
.rr rF
|
|
.\"
|
|
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
|
|
.\" Fear. Run. Save yourself. No user-serviceable parts.
|
|
. \" fudge factors for nroff and troff
|
|
.if n \{\
|
|
. ds #H 0
|
|
. ds #V .8m
|
|
. ds #F .3m
|
|
. ds #[ \f1
|
|
. ds #] \fP
|
|
.\}
|
|
.if t \{\
|
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
|
. ds #V .6m
|
|
. ds #F 0
|
|
. ds #[ \&
|
|
. ds #] \&
|
|
.\}
|
|
. \" simple accents for nroff and troff
|
|
.if n \{\
|
|
. ds ' \&
|
|
. ds ` \&
|
|
. ds ^ \&
|
|
. ds , \&
|
|
. ds ~ ~
|
|
. ds /
|
|
.\}
|
|
.if t \{\
|
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
|
.\}
|
|
. \" troff and (daisy-wheel) nroff accents
|
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
|
. \" corrections for vroff
|
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
|
. \" for low resolution devices (crt and lpr)
|
|
.if \n(.H>23 .if \n(.V>19 \
|
|
\{\
|
|
. ds : e
|
|
. ds 8 ss
|
|
. ds o a
|
|
. ds d- d\h'-1'\(ga
|
|
. ds D- D\h'-1'\(hy
|
|
. ds th \o'bp'
|
|
. ds Th \o'LP'
|
|
. ds ae ae
|
|
. ds Ae AE
|
|
.\}
|
|
.rm #[ #] #H #V #F C
|
|
.\" ========================================================================
|
|
.\"
|
|
.IX Title "OPENSSL-S_CLIENT 1ossl"
|
|
.TH OPENSSL-S_CLIENT 1ossl "2024-11-04" "3.4.0" "OpenSSL"
|
|
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
|
|
.\" way too many mistakes in technical documents.
|
|
.if n .ad l
|
|
.nh
|
|
.SH "NAME"
|
|
openssl\-s_client \- SSL/TLS client program
|
|
.SH "SYNOPSIS"
|
|
.IX Header "SYNOPSIS"
|
|
\&\fBopenssl\fR \fBs_client\fR
|
|
[\fB\-help\fR]
|
|
[\fB\-ssl_config\fR \fIsection\fR]
|
|
[\fB\-connect\fR \fIhost\fR:\fIport\fR]
|
|
[\fB\-host\fR \fIhostname\fR]
|
|
[\fB\-port\fR \fIport\fR]
|
|
[\fB\-bind\fR \fIhost\fR:\fIport\fR]
|
|
[\fB\-proxy\fR \fIhost\fR:\fIport\fR]
|
|
[\fB\-proxy_user\fR \fIuserid\fR]
|
|
[\fB\-proxy_pass\fR \fIarg\fR]
|
|
[\fB\-unix\fR \fIpath\fR]
|
|
[\fB\-4\fR]
|
|
[\fB\-6\fR]
|
|
[\fB\-quic\fR]
|
|
[\fB\-servername\fR \fIname\fR]
|
|
[\fB\-noservername\fR]
|
|
[\fB\-verify\fR \fIdepth\fR]
|
|
[\fB\-verify_return_error\fR]
|
|
[\fB\-verify_quiet\fR]
|
|
[\fB\-verifyCAfile\fR \fIfilename\fR]
|
|
[\fB\-verifyCApath\fR \fIdir\fR]
|
|
[\fB\-verifyCAstore\fR \fIuri\fR]
|
|
[\fB\-cert\fR \fIfilename\fR]
|
|
[\fB\-certform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fBP12\fR]
|
|
[\fB\-cert_chain\fR \fIfilename\fR]
|
|
[\fB\-build_chain\fR]
|
|
[\fB\-CRL\fR \fIfilename\fR]
|
|
[\fB\-CRLform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR]
|
|
[\fB\-crl_download\fR]
|
|
[\fB\-key\fR \fIfilename\fR|\fIuri\fR]
|
|
[\fB\-keyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fBP12\fR|\fB\s-1ENGINE\s0\fR]
|
|
[\fB\-pass\fR \fIarg\fR]
|
|
[\fB\-chainCAfile\fR \fIfilename\fR]
|
|
[\fB\-chainCApath\fR \fIdirectory\fR]
|
|
[\fB\-chainCAstore\fR \fIuri\fR]
|
|
[\fB\-requestCAfile\fR \fIfilename\fR]
|
|
[\fB\-dane_tlsa_domain\fR \fIdomain\fR]
|
|
[\fB\-dane_tlsa_rrdata\fR \fIrrdata\fR]
|
|
[\fB\-dane_ee_no_namechecks\fR]
|
|
[\fB\-reconnect\fR]
|
|
[\fB\-showcerts\fR]
|
|
[\fB\-prexit\fR]
|
|
[\fB\-no\-interactive\fR]
|
|
[\fB\-debug\fR]
|
|
[\fB\-trace\fR]
|
|
[\fB\-nocommands\fR]
|
|
[\fB\-adv\fR]
|
|
[\fB\-security_debug\fR]
|
|
[\fB\-security_debug_verbose\fR]
|
|
[\fB\-msg\fR]
|
|
[\fB\-timeout\fR]
|
|
[\fB\-mtu\fR \fIsize\fR]
|
|
[\fB\-no_etm\fR]
|
|
[\fB\-no_ems\fR]
|
|
[\fB\-keymatexport\fR \fIlabel\fR]
|
|
[\fB\-keymatexportlen\fR \fIlen\fR]
|
|
[\fB\-msgfile\fR \fIfilename\fR]
|
|
[\fB\-nbio_test\fR]
|
|
[\fB\-state\fR]
|
|
[\fB\-nbio\fR]
|
|
[\fB\-crlf\fR]
|
|
[\fB\-ign_eof\fR]
|
|
[\fB\-no_ign_eof\fR]
|
|
[\fB\-psk_identity\fR \fIidentity\fR]
|
|
[\fB\-psk\fR \fIkey\fR]
|
|
[\fB\-psk_session\fR \fIfile\fR]
|
|
[\fB\-quiet\fR]
|
|
[\fB\-sctp\fR]
|
|
[\fB\-sctp_label_bug\fR]
|
|
[\fB\-fallback_scsv\fR]
|
|
[\fB\-async\fR]
|
|
[\fB\-maxfraglen\fR \fIlen\fR]
|
|
[\fB\-max_send_frag\fR]
|
|
[\fB\-split_send_frag\fR]
|
|
[\fB\-max_pipelines\fR]
|
|
[\fB\-read_buf\fR]
|
|
[\fB\-ignore_unexpected_eof\fR]
|
|
[\fB\-bugs\fR]
|
|
[\fB\-no_tx_cert_comp\fR]
|
|
[\fB\-no_rx_cert_comp\fR]
|
|
[\fB\-comp\fR]
|
|
[\fB\-no_comp\fR]
|
|
[\fB\-brief\fR]
|
|
[\fB\-legacy_server_connect\fR]
|
|
[\fB\-no_legacy_server_connect\fR]
|
|
[\fB\-allow_no_dhe_kex\fR]
|
|
[\fB\-prefer_no_dhe_kex\fR]
|
|
[\fB\-sigalgs\fR \fIsigalglist\fR]
|
|
[\fB\-curves\fR \fIcurvelist\fR]
|
|
[\fB\-cipher\fR \fIcipherlist\fR]
|
|
[\fB\-ciphersuites\fR \fIval\fR]
|
|
[\fB\-serverpref\fR]
|
|
[\fB\-starttls\fR \fIprotocol\fR]
|
|
[\fB\-name\fR \fIhostname\fR]
|
|
[\fB\-xmpphost\fR \fIhostname\fR]
|
|
[\fB\-name\fR \fIhostname\fR]
|
|
[\fB\-tlsextdebug\fR]
|
|
[\fB\-no_ticket\fR]
|
|
[\fB\-sess_out\fR \fIfilename\fR]
|
|
[\fB\-serverinfo\fR \fItypes\fR]
|
|
[\fB\-sess_in\fR \fIfilename\fR]
|
|
[\fB\-serverinfo\fR \fItypes\fR]
|
|
[\fB\-status\fR]
|
|
[\fB\-alpn\fR \fIprotocols\fR]
|
|
[\fB\-nextprotoneg\fR \fIprotocols\fR]
|
|
[\fB\-ct\fR]
|
|
[\fB\-noct\fR]
|
|
[\fB\-ctlogfile\fR]
|
|
[\fB\-keylogfile\fR \fIfile\fR]
|
|
[\fB\-early_data\fR \fIfile\fR]
|
|
[\fB\-enable_pha\fR]
|
|
[\fB\-use_srtp\fR \fIvalue\fR]
|
|
[\fB\-srpuser\fR \fIvalue\fR]
|
|
[\fB\-srppass\fR \fIvalue\fR]
|
|
[\fB\-srp_lateuser\fR]
|
|
[\fB\-srp_moregroups\fR]
|
|
[\fB\-srp_strength\fR \fInumber\fR]
|
|
[\fB\-ktls\fR]
|
|
[\fB\-tfo\fR]
|
|
[\fB\-nameopt\fR \fIoption\fR]
|
|
[\fB\-no_ssl3\fR]
|
|
[\fB\-no_tls1\fR]
|
|
[\fB\-no_tls1_1\fR]
|
|
[\fB\-no_tls1_2\fR]
|
|
[\fB\-no_tls1_3\fR]
|
|
[\fB\-ssl3\fR]
|
|
[\fB\-tls1\fR]
|
|
[\fB\-tls1_1\fR]
|
|
[\fB\-tls1_2\fR]
|
|
[\fB\-tls1_3\fR]
|
|
[\fB\-dtls\fR]
|
|
[\fB\-dtls1\fR]
|
|
[\fB\-dtls1_2\fR]
|
|
[\fB\-xkey\fR \fIinfile\fR]
|
|
[\fB\-xcert\fR \fIfile\fR]
|
|
[\fB\-xchain\fR \fIfile\fR]
|
|
[\fB\-xchain_build\fR \fIfile\fR]
|
|
[\fB\-xcertform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR]>
|
|
[\fB\-xkeyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR]>
|
|
[\fB\-CAfile\fR \fIfile\fR]
|
|
[\fB\-no\-CAfile\fR]
|
|
[\fB\-CApath\fR \fIdir\fR]
|
|
[\fB\-no\-CApath\fR]
|
|
[\fB\-CAstore\fR \fIuri\fR]
|
|
[\fB\-no\-CAstore\fR]
|
|
[\fB\-bugs\fR]
|
|
[\fB\-no_comp\fR]
|
|
[\fB\-comp\fR]
|
|
[\fB\-no_ticket\fR]
|
|
[\fB\-serverpref\fR]
|
|
[\fB\-client_renegotiation\fR]
|
|
[\fB\-legacy_renegotiation\fR]
|
|
[\fB\-no_renegotiation\fR]
|
|
[\fB\-no_resumption_on_reneg\fR]
|
|
[\fB\-legacy_server_connect\fR]
|
|
[\fB\-no_legacy_server_connect\fR]
|
|
[\fB\-no_etm\fR]
|
|
[\fB\-allow_no_dhe_kex\fR]
|
|
[\fB\-prefer_no_dhe_kex\fR]
|
|
[\fB\-prioritize_chacha\fR]
|
|
[\fB\-strict\fR]
|
|
[\fB\-sigalgs\fR \fIalgs\fR]
|
|
[\fB\-client_sigalgs\fR \fIalgs\fR]
|
|
[\fB\-groups\fR \fIgroups\fR]
|
|
[\fB\-curves\fR \fIcurves\fR]
|
|
[\fB\-named_curve\fR \fIcurve\fR]
|
|
[\fB\-cipher\fR \fIciphers\fR]
|
|
[\fB\-ciphersuites\fR \fI1.3ciphers\fR]
|
|
[\fB\-min_protocol\fR \fIminprot\fR]
|
|
[\fB\-max_protocol\fR \fImaxprot\fR]
|
|
[\fB\-record_padding\fR \fIpadding\fR]
|
|
[\fB\-debug_broken_protocol\fR]
|
|
[\fB\-no_middlebox\fR]
|
|
[\fB\-rand\fR \fIfiles\fR]
|
|
[\fB\-writerand\fR \fIfile\fR]
|
|
[\fB\-provider\fR \fIname\fR]
|
|
[\fB\-provider\-path\fR \fIpath\fR]
|
|
[\fB\-propquery\fR \fIpropq\fR]
|
|
[\fB\-engine\fR \fIid\fR]
|
|
[\fB\-ssl_client_engine\fR \fIid\fR]
|
|
[\fB\-allow_proxy_certs\fR]
|
|
[\fB\-attime\fR \fItimestamp\fR]
|
|
[\fB\-no_check_time\fR]
|
|
[\fB\-check_ss_sig\fR]
|
|
[\fB\-crl_check\fR]
|
|
[\fB\-crl_check_all\fR]
|
|
[\fB\-explicit_policy\fR]
|
|
[\fB\-extended_crl\fR]
|
|
[\fB\-ignore_critical\fR]
|
|
[\fB\-inhibit_any\fR]
|
|
[\fB\-inhibit_map\fR]
|
|
[\fB\-partial_chain\fR]
|
|
[\fB\-policy\fR \fIarg\fR]
|
|
[\fB\-policy_check\fR]
|
|
[\fB\-policy_print\fR]
|
|
[\fB\-purpose\fR \fIpurpose\fR]
|
|
[\fB\-suiteB_128\fR]
|
|
[\fB\-suiteB_128_only\fR]
|
|
[\fB\-suiteB_192\fR]
|
|
[\fB\-trusted_first\fR]
|
|
[\fB\-no_alt_chains\fR]
|
|
[\fB\-use_deltas\fR]
|
|
[\fB\-auth_level\fR \fInum\fR]
|
|
[\fB\-verify_depth\fR \fInum\fR]
|
|
[\fB\-verify_email\fR \fIemail\fR]
|
|
[\fB\-verify_hostname\fR \fIhostname\fR]
|
|
[\fB\-verify_ip\fR \fIip\fR]
|
|
[\fB\-verify_name\fR \fIname\fR]
|
|
[\fB\-x509_strict\fR]
|
|
[\fB\-issuer_checks\fR]
|
|
[\fB\-enable_server_rpk\fR]
|
|
[\fB\-enable_client_rpk\fR]
|
|
[\fIhost\fR:\fIport\fR]
|
|
.SH "DESCRIPTION"
|
|
.IX Header "DESCRIPTION"
|
|
This command implements a generic \s-1SSL/TLS\s0 client which
|
|
connects to a remote host using \s-1SSL/TLS.\s0 It is a \fIvery\fR useful diagnostic
|
|
tool for \s-1SSL\s0 servers.
|
|
.SH "OPTIONS"
|
|
.IX Header "OPTIONS"
|
|
In addition to the options below, this command also supports the
|
|
common and client only options documented
|
|
in the \*(L"Supported Command Line Commands\*(R" section of the \fBSSL_CONF_cmd\fR\|(3)
|
|
manual page.
|
|
.IP "\fB\-help\fR" 4
|
|
.IX Item "-help"
|
|
Print out a usage message.
|
|
.IP "\fB\-ssl_config\fR \fIsection\fR" 4
|
|
.IX Item "-ssl_config section"
|
|
Use the specified section of the configuration file to configure the \fB\s-1SSL_CTX\s0\fR object.
|
|
.IP "\fB\-connect\fR \fIhost\fR:\fIport\fR" 4
|
|
.IX Item "-connect host:port"
|
|
This specifies the host and optional port to connect to. It is possible to
|
|
select the host and port using the optional target positional argument instead.
|
|
If neither this nor the target positional argument are specified then an attempt
|
|
is made to connect to the local host on port 4433.
|
|
If the host string is an IPv6 address, it must be enclosed in \f(CW\*(C`[\*(C'\fR and \f(CW\*(C`]\*(C'\fR.
|
|
.IP "\fB\-host\fR \fIhostname\fR" 4
|
|
.IX Item "-host hostname"
|
|
Host to connect to; use \fB\-connect\fR instead.
|
|
.IP "\fB\-port\fR \fIport\fR" 4
|
|
.IX Item "-port port"
|
|
Connect to the specified port; use \fB\-connect\fR instead.
|
|
.IP "\fB\-bind\fR \fIhost\fR:\fIport\fR" 4
|
|
.IX Item "-bind host:port"
|
|
This specifies the host address and or port to bind as the source for the
|
|
connection. For Unix-domain sockets the port is ignored and the host is
|
|
used as the source socket address.
|
|
If the host string is an IPv6 address, it must be enclosed in \f(CW\*(C`[\*(C'\fR and \f(CW\*(C`]\*(C'\fR.
|
|
.IP "\fB\-proxy\fR \fIhost\fR:\fIport\fR" 4
|
|
.IX Item "-proxy host:port"
|
|
When used with the \fB\-connect\fR flag, the program uses the host and port
|
|
specified with this flag and issues an \s-1HTTP CONNECT\s0 command to connect
|
|
to the desired server.
|
|
If the host string is an IPv6 address, it must be enclosed in \f(CW\*(C`[\*(C'\fR and \f(CW\*(C`]\*(C'\fR.
|
|
.IP "\fB\-proxy_user\fR \fIuserid\fR" 4
|
|
.IX Item "-proxy_user userid"
|
|
When used with the \fB\-proxy\fR flag, the program will attempt to authenticate
|
|
with the specified proxy using basic (base64) authentication.
|
|
\&\s-1NB:\s0 Basic authentication is insecure; the credentials are sent to the proxy
|
|
in easily reversible base64 encoding before any \s-1TLS/SSL\s0 session is established.
|
|
Therefore, these credentials are easily recovered by anyone able to sniff/trace
|
|
the network. Use with caution.
|
|
.IP "\fB\-proxy_pass\fR \fIarg\fR" 4
|
|
.IX Item "-proxy_pass arg"
|
|
The proxy password source, used with the \fB\-proxy_user\fR flag.
|
|
For more information about the format of \fBarg\fR
|
|
see \fBopenssl\-passphrase\-options\fR\|(1).
|
|
.IP "\fB\-unix\fR \fIpath\fR" 4
|
|
.IX Item "-unix path"
|
|
Connect over the specified Unix-domain socket.
|
|
.IP "\fB\-4\fR" 4
|
|
.IX Item "-4"
|
|
Use IPv4 only.
|
|
.IP "\fB\-6\fR" 4
|
|
.IX Item "-6"
|
|
Use IPv6 only.
|
|
.IP "\fB\-quic\fR" 4
|
|
.IX Item "-quic"
|
|
Connect using the \s-1QUIC\s0 protocol. If specified then the \fB\-alpn\fR option must also
|
|
be provided.
|
|
.IP "\fB\-servername\fR \fIname\fR" 4
|
|
.IX Item "-servername name"
|
|
Set the \s-1TLS SNI\s0 (Server Name Indication) extension in the ClientHello message to
|
|
the given value.
|
|
If \fB\-servername\fR is not provided, the \s-1TLS SNI\s0 extension will be populated with
|
|
the name given to \fB\-connect\fR if it follows a \s-1DNS\s0 name format. If \fB\-connect\fR is
|
|
not provided either, the \s-1SNI\s0 is set to \*(L"localhost\*(R".
|
|
This is the default since OpenSSL 1.1.1.
|
|
.Sp
|
|
Even though \s-1SNI\s0 should normally be a \s-1DNS\s0 name and not an \s-1IP\s0 address, if
|
|
\&\fB\-servername\fR is provided then that name will be sent, regardless of whether
|
|
it is a \s-1DNS\s0 name or not.
|
|
.Sp
|
|
This option cannot be used in conjunction with \fB\-noservername\fR.
|
|
.IP "\fB\-noservername\fR" 4
|
|
.IX Item "-noservername"
|
|
Suppresses sending of the \s-1SNI\s0 (Server Name Indication) extension in the
|
|
ClientHello message. Cannot be used in conjunction with the \fB\-servername\fR or
|
|
\&\fB\-dane_tlsa_domain\fR options.
|
|
.IP "\fB\-cert\fR \fIfilename\fR" 4
|
|
.IX Item "-cert filename"
|
|
The client certificate to use, if one is requested by the server.
|
|
The default is not to use a certificate.
|
|
.Sp
|
|
The chain for the client certificate may be specified using \fB\-cert_chain\fR.
|
|
.IP "\fB\-certform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fBP12\fR" 4
|
|
.IX Item "-certform DER|PEM|P12"
|
|
The client certificate file format to use; unspecified by default.
|
|
See \fBopenssl\-format\-options\fR\|(1) for details.
|
|
.IP "\fB\-cert_chain\fR" 4
|
|
.IX Item "-cert_chain"
|
|
A file or \s-1URI\s0 of untrusted certificates to use when attempting to build the
|
|
certificate chain related to the certificate specified via the \fB\-cert\fR option.
|
|
The input can be in \s-1PEM, DER,\s0 or PKCS#12 format.
|
|
.IP "\fB\-build_chain\fR" 4
|
|
.IX Item "-build_chain"
|
|
Specify whether the application should build the client certificate chain to be
|
|
provided to the server.
|
|
.IP "\fB\-CRL\fR \fIfilename\fR" 4
|
|
.IX Item "-CRL filename"
|
|
\&\s-1CRL\s0 file to use to check the server's certificate.
|
|
.IP "\fB\-CRLform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR" 4
|
|
.IX Item "-CRLform DER|PEM"
|
|
The \s-1CRL\s0 file format; unspecified by default.
|
|
See \fBopenssl\-format\-options\fR\|(1) for details.
|
|
.IP "\fB\-crl_download\fR" 4
|
|
.IX Item "-crl_download"
|
|
Download \s-1CRL\s0 from distribution points in the certificate. Note that this option
|
|
is ignored if \fB\-crl_check\fR option is not provided. Note that the maximum size
|
|
of \s-1CRL\s0 is limited by \fBX509_CRL_load_http\fR\|(3) function.
|
|
.IP "\fB\-key\fR \fIfilename\fR|\fIuri\fR" 4
|
|
.IX Item "-key filename|uri"
|
|
The client private key to use.
|
|
If not specified then the certificate file will be used to read also the key.
|
|
.IP "\fB\-keyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR|\fBP12\fR|\fB\s-1ENGINE\s0\fR" 4
|
|
.IX Item "-keyform DER|PEM|P12|ENGINE"
|
|
The key format; unspecified by default.
|
|
See \fBopenssl\-format\-options\fR\|(1) for details.
|
|
.IP "\fB\-pass\fR \fIarg\fR" 4
|
|
.IX Item "-pass arg"
|
|
the private key and certificate file password source.
|
|
For more information about the format of \fIarg\fR
|
|
see \fBopenssl\-passphrase\-options\fR\|(1).
|
|
.IP "\fB\-verify\fR \fIdepth\fR" 4
|
|
.IX Item "-verify depth"
|
|
The verify depth to use. This specifies the maximum length of the
|
|
server certificate chain and turns on server certificate verification.
|
|
Currently the verify operation continues after errors so all the problems
|
|
with a certificate chain can be seen. As a side effect the connection
|
|
will never fail due to a server certificate verify failure.
|
|
.IP "\fB\-verify_return_error\fR" 4
|
|
.IX Item "-verify_return_error"
|
|
Return verification errors instead of continuing. This will typically
|
|
abort the handshake with a fatal error.
|
|
.IP "\fB\-verify_quiet\fR" 4
|
|
.IX Item "-verify_quiet"
|
|
Limit verify output to only errors.
|
|
.IP "\fB\-verifyCAfile\fR \fIfilename\fR" 4
|
|
.IX Item "-verifyCAfile filename"
|
|
A file in \s-1PEM\s0 format containing trusted certificates to use
|
|
for verifying the server's certificate.
|
|
.IP "\fB\-verifyCApath\fR \fIdir\fR" 4
|
|
.IX Item "-verifyCApath dir"
|
|
A directory containing trusted certificates to use
|
|
for verifying the server's certificate.
|
|
This directory must be in \*(L"hash format\*(R",
|
|
see \fBopenssl\-verify\fR\|(1) for more information.
|
|
.IP "\fB\-verifyCAstore\fR \fIuri\fR" 4
|
|
.IX Item "-verifyCAstore uri"
|
|
The \s-1URI\s0 of a store containing trusted certificates to use
|
|
for verifying the server's certificate.
|
|
.IP "\fB\-chainCAfile\fR \fIfile\fR" 4
|
|
.IX Item "-chainCAfile file"
|
|
A file in \s-1PEM\s0 format containing trusted certificates to use
|
|
when attempting to build the client certificate chain.
|
|
.IP "\fB\-chainCApath\fR \fIdirectory\fR" 4
|
|
.IX Item "-chainCApath directory"
|
|
A directory containing trusted certificates to use
|
|
for building the client certificate chain provided to the server.
|
|
This directory must be in \*(L"hash format\*(R",
|
|
see \fBopenssl\-verify\fR\|(1) for more information.
|
|
.IP "\fB\-chainCAstore\fR \fIuri\fR" 4
|
|
.IX Item "-chainCAstore uri"
|
|
The \s-1URI\s0 of a store containing trusted certificates to use
|
|
when attempting to build the client certificate chain.
|
|
The \s-1URI\s0 may indicate a single certificate, as well as a collection of them.
|
|
With URIs in the \f(CW\*(C`file:\*(C'\fR scheme, this acts as \fB\-chainCAfile\fR or
|
|
\&\fB\-chainCApath\fR, depending on if the \s-1URI\s0 indicates a directory or a
|
|
single file.
|
|
See \fBossl_store\-file\fR\|(7) for more information on the \f(CW\*(C`file:\*(C'\fR scheme.
|
|
.IP "\fB\-requestCAfile\fR \fIfile\fR" 4
|
|
.IX Item "-requestCAfile file"
|
|
A file containing a list of certificates whose subject names will be sent
|
|
to the server in the \fBcertificate_authorities\fR extension. Only supported
|
|
for \s-1TLS 1.3\s0
|
|
.IP "\fB\-dane_tlsa_domain\fR \fIdomain\fR" 4
|
|
.IX Item "-dane_tlsa_domain domain"
|
|
Enable \s-1RFC6698/RFC7671 DANE TLSA\s0 authentication and specify the
|
|
\&\s-1TLSA\s0 base domain which becomes the default \s-1SNI\s0 hint and the primary
|
|
reference identifier for hostname checks. This must be used in
|
|
combination with at least one instance of the \fB\-dane_tlsa_rrdata\fR
|
|
option below.
|
|
.Sp
|
|
When \s-1DANE\s0 authentication succeeds, the diagnostic output will include
|
|
the lowest (closest to 0) depth at which a \s-1TLSA\s0 record authenticated
|
|
a chain certificate. When that \s-1TLSA\s0 record is a \*(L"2 1 0\*(R" trust
|
|
anchor public key that signed (rather than matched) the top-most
|
|
certificate of the chain, the result is reported as \*(L"\s-1TA\s0 public key
|
|
verified\*(R". Otherwise, either the \s-1TLSA\s0 record \*(L"matched \s-1TA\s0 certificate\*(R"
|
|
at a positive depth or else \*(L"matched \s-1EE\s0 certificate\*(R" at depth 0.
|
|
.IP "\fB\-dane_tlsa_rrdata\fR \fIrrdata\fR" 4
|
|
.IX Item "-dane_tlsa_rrdata rrdata"
|
|
Use one or more times to specify the \s-1RRDATA\s0 fields of the \s-1DANE TLSA\s0
|
|
RRset associated with the target service. The \fIrrdata\fR value is
|
|
specified in \*(L"presentation form\*(R", that is four whitespace separated
|
|
fields that specify the usage, selector, matching type and associated
|
|
data, with the last of these encoded in hexadecimal. Optional
|
|
whitespace is ignored in the associated data field. For example:
|
|
.Sp
|
|
.Vb 12
|
|
\& $ openssl s_client \-brief \-starttls smtp \e
|
|
\& \-connect smtp.example.com:25 \e
|
|
\& \-dane_tlsa_domain smtp.example.com \e
|
|
\& \-dane_tlsa_rrdata "2 1 1
|
|
\& B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B" \e
|
|
\& \-dane_tlsa_rrdata "2 1 1
|
|
\& 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18"
|
|
\& ...
|
|
\& Verification: OK
|
|
\& Verified peername: smtp.example.com
|
|
\& DANE TLSA 2 1 1 ...ee12d2cc90180517616e8a18 matched TA certificate at depth 1
|
|
\& ...
|
|
.Ve
|
|
.IP "\fB\-dane_ee_no_namechecks\fR" 4
|
|
.IX Item "-dane_ee_no_namechecks"
|
|
This disables server name checks when authenticating via \s-1\fBDANE\-EE\s0\fR\|(3) \s-1TLSA\s0
|
|
records.
|
|
For some applications, primarily web browsers, it is not safe to disable name
|
|
checks due to \*(L"unknown key share\*(R" attacks, in which a malicious server can
|
|
convince a client that a connection to a victim server is instead a secure
|
|
connection to the malicious server.
|
|
The malicious server may then be able to violate cross-origin scripting
|
|
restrictions.
|
|
Thus, despite the text of \s-1RFC7671,\s0 name checks are by default enabled for
|
|
\&\s-1\fBDANE\-EE\s0\fR\|(3) \s-1TLSA\s0 records, and can be disabled in applications where it is safe
|
|
to do so.
|
|
In particular, \s-1SMTP\s0 and \s-1XMPP\s0 clients should set this option as \s-1SRV\s0 and \s-1MX\s0
|
|
records already make it possible for a remote domain to redirect client
|
|
connections to any server of its choice, and in any case \s-1SMTP\s0 and \s-1XMPP\s0 clients
|
|
do not execute scripts downloaded from remote servers.
|
|
.IP "\fB\-reconnect\fR" 4
|
|
.IX Item "-reconnect"
|
|
Reconnects to the same server 5 times using the same session \s-1ID,\s0 this can
|
|
be used as a test that session caching is working.
|
|
.IP "\fB\-showcerts\fR" 4
|
|
.IX Item "-showcerts"
|
|
Displays the server certificate list as sent by the server: it only consists of
|
|
certificates the server has sent (in the order the server has sent them). It is
|
|
\&\fBnot\fR a verified chain.
|
|
.IP "\fB\-prexit\fR" 4
|
|
.IX Item "-prexit"
|
|
Print session information when the program exits. This will always attempt
|
|
to print out information even if the connection fails. Normally information
|
|
will only be printed out once if the connection succeeds. This option is useful
|
|
because the cipher in use may be renegotiated or the connection may fail
|
|
because a client certificate is required or is requested only after an
|
|
attempt is made to access a certain \s-1URL.\s0 Note: the output produced by this
|
|
option is not always accurate because a connection might never have been
|
|
established.
|
|
.IP "\fB\-no\-interactive\fR" 4
|
|
.IX Item "-no-interactive"
|
|
This flag can be used to run the client in a non-interactive mode.
|
|
.IP "\fB\-state\fR" 4
|
|
.IX Item "-state"
|
|
Prints out the \s-1SSL\s0 session states.
|
|
.IP "\fB\-debug\fR" 4
|
|
.IX Item "-debug"
|
|
Print extensive debugging information including a hex dump of all traffic.
|
|
.IP "\fB\-nocommands\fR" 4
|
|
.IX Item "-nocommands"
|
|
Do not use interactive command letters.
|
|
.IP "\fB\-adv\fR" 4
|
|
.IX Item "-adv"
|
|
Use advanced command mode.
|
|
.IP "\fB\-security_debug\fR" 4
|
|
.IX Item "-security_debug"
|
|
Enable security debug messages.
|
|
.IP "\fB\-security_debug_verbose\fR" 4
|
|
.IX Item "-security_debug_verbose"
|
|
Output more security debug output.
|
|
.IP "\fB\-msg\fR" 4
|
|
.IX Item "-msg"
|
|
Show protocol messages.
|
|
.IP "\fB\-timeout\fR" 4
|
|
.IX Item "-timeout"
|
|
Enable send/receive timeout on \s-1DTLS\s0 connections.
|
|
.IP "\fB\-mtu\fR \fIsize\fR" 4
|
|
.IX Item "-mtu size"
|
|
Set \s-1MTU\s0 of the link layer to the specified size.
|
|
.IP "\fB\-no_etm\fR" 4
|
|
.IX Item "-no_etm"
|
|
Disable Encrypt-then-MAC negotiation.
|
|
.IP "\fB\-no_ems\fR" 4
|
|
.IX Item "-no_ems"
|
|
Disable Extended master secret negotiation.
|
|
.IP "\fB\-keymatexport\fR \fIlabel\fR" 4
|
|
.IX Item "-keymatexport label"
|
|
Export keying material using the specified label.
|
|
.IP "\fB\-keymatexportlen\fR \fIlen\fR" 4
|
|
.IX Item "-keymatexportlen len"
|
|
Export the specified number of bytes of keying material; default is 20.
|
|
.Sp
|
|
Show all protocol messages with hex dump.
|
|
.IP "\fB\-trace\fR" 4
|
|
.IX Item "-trace"
|
|
Show verbose trace output of protocol messages.
|
|
.IP "\fB\-msgfile\fR \fIfilename\fR" 4
|
|
.IX Item "-msgfile filename"
|
|
File to send output of \fB\-msg\fR or \fB\-trace\fR to, default standard output.
|
|
.IP "\fB\-nbio_test\fR" 4
|
|
.IX Item "-nbio_test"
|
|
Tests nonblocking I/O
|
|
.IP "\fB\-nbio\fR" 4
|
|
.IX Item "-nbio"
|
|
Turns on nonblocking I/O
|
|
.IP "\fB\-crlf\fR" 4
|
|
.IX Item "-crlf"
|
|
This option translated a line feed from the terminal into \s-1CR+LF\s0 as required
|
|
by some servers.
|
|
.IP "\fB\-ign_eof\fR" 4
|
|
.IX Item "-ign_eof"
|
|
Inhibit shutting down the connection when end of file is reached in the
|
|
input.
|
|
.IP "\fB\-quiet\fR" 4
|
|
.IX Item "-quiet"
|
|
Inhibit printing of session and certificate information. This implicitly
|
|
turns on \fB\-ign_eof\fR as well.
|
|
.IP "\fB\-no_ign_eof\fR" 4
|
|
.IX Item "-no_ign_eof"
|
|
Shut down the connection when end of file is reached in the input.
|
|
Can be used to override the implicit \fB\-ign_eof\fR after \fB\-quiet\fR.
|
|
.IP "\fB\-psk_identity\fR \fIidentity\fR" 4
|
|
.IX Item "-psk_identity identity"
|
|
Use the \s-1PSK\s0 identity \fIidentity\fR when using a \s-1PSK\s0 cipher suite.
|
|
The default value is \*(L"Client_identity\*(R" (without the quotes).
|
|
.IP "\fB\-psk\fR \fIkey\fR" 4
|
|
.IX Item "-psk key"
|
|
Use the \s-1PSK\s0 key \fIkey\fR when using a \s-1PSK\s0 cipher suite. The key is
|
|
given as a hexadecimal number without leading 0x, for example \-psk
|
|
1a2b3c4d.
|
|
This option must be provided in order to use a \s-1PSK\s0 cipher.
|
|
.IP "\fB\-psk_session\fR \fIfile\fR" 4
|
|
.IX Item "-psk_session file"
|
|
Use the pem encoded \s-1SSL_SESSION\s0 data stored in \fIfile\fR as the basis of a \s-1PSK.\s0
|
|
Note that this will only work if TLSv1.3 is negotiated.
|
|
.IP "\fB\-sctp\fR" 4
|
|
.IX Item "-sctp"
|
|
Use \s-1SCTP\s0 for the transport protocol instead of \s-1UDP\s0 in \s-1DTLS.\s0 Must be used in
|
|
conjunction with \fB\-dtls\fR, \fB\-dtls1\fR or \fB\-dtls1_2\fR. This option is only
|
|
available where OpenSSL has support for \s-1SCTP\s0 enabled.
|
|
.IP "\fB\-sctp_label_bug\fR" 4
|
|
.IX Item "-sctp_label_bug"
|
|
Use the incorrect behaviour of older OpenSSL implementations when computing
|
|
endpoint-pair shared secrets for \s-1DTLS/SCTP.\s0 This allows communication with
|
|
older broken implementations but breaks interoperability with correct
|
|
implementations. Must be used in conjunction with \fB\-sctp\fR. This option is only
|
|
available where OpenSSL has support for \s-1SCTP\s0 enabled.
|
|
.IP "\fB\-fallback_scsv\fR" 4
|
|
.IX Item "-fallback_scsv"
|
|
Send \s-1TLS_FALLBACK_SCSV\s0 in the ClientHello.
|
|
.IP "\fB\-async\fR" 4
|
|
.IX Item "-async"
|
|
Switch on asynchronous mode. Cryptographic operations will be performed
|
|
asynchronously. This will only have an effect if an asynchronous capable engine
|
|
is also used via the \fB\-engine\fR option. For test purposes the dummy async engine
|
|
(dasync) can be used (if available).
|
|
.IP "\fB\-maxfraglen\fR \fIlen\fR" 4
|
|
.IX Item "-maxfraglen len"
|
|
Enable Maximum Fragment Length Negotiation; allowed values are
|
|
\&\f(CW512\fR, \f(CW1024\fR, \f(CW2048\fR, and \f(CW4096\fR.
|
|
.IP "\fB\-max_send_frag\fR \fIint\fR" 4
|
|
.IX Item "-max_send_frag int"
|
|
The maximum size of data fragment to send.
|
|
See \fBSSL_CTX_set_max_send_fragment\fR\|(3) for further information.
|
|
.IP "\fB\-split_send_frag\fR \fIint\fR" 4
|
|
.IX Item "-split_send_frag int"
|
|
The size used to split data for encrypt pipelines. If more data is written in
|
|
one go than this value then it will be split into multiple pipelines, up to the
|
|
maximum number of pipelines defined by max_pipelines. This only has an effect if
|
|
a suitable cipher suite has been negotiated, an engine that supports pipelining
|
|
has been loaded, and max_pipelines is greater than 1. See
|
|
\&\fBSSL_CTX_set_split_send_fragment\fR\|(3) for further information.
|
|
.IP "\fB\-max_pipelines\fR \fIint\fR" 4
|
|
.IX Item "-max_pipelines int"
|
|
The maximum number of encrypt/decrypt pipelines to be used. This will only have
|
|
an effect if an engine has been loaded that supports pipelining (e.g. the dasync
|
|
engine) and a suitable cipher suite has been negotiated. The default value is 1.
|
|
See \fBSSL_CTX_set_max_pipelines\fR\|(3) for further information.
|
|
.IP "\fB\-read_buf\fR \fIint\fR" 4
|
|
.IX Item "-read_buf int"
|
|
The default read buffer size to be used for connections. This will only have an
|
|
effect if the buffer size is larger than the size that would otherwise be used
|
|
and pipelining is in use (see \fBSSL_CTX_set_default_read_buffer_len\fR\|(3) for
|
|
further information).
|
|
.IP "\fB\-ignore_unexpected_eof\fR" 4
|
|
.IX Item "-ignore_unexpected_eof"
|
|
Some \s-1TLS\s0 implementations do not send the mandatory close_notify alert on
|
|
shutdown. If the application tries to wait for the close_notify alert but the
|
|
peer closes the connection without sending it, an error is generated. When this
|
|
option is enabled the peer does not need to send the close_notify alert and a
|
|
closed connection will be treated as if the close_notify alert was received.
|
|
For more information on shutting down a connection, see \fBSSL_shutdown\fR\|(3).
|
|
.IP "\fB\-bugs\fR" 4
|
|
.IX Item "-bugs"
|
|
There are several known bugs in \s-1SSL\s0 and \s-1TLS\s0 implementations. Adding this
|
|
option enables various workarounds.
|
|
.IP "\fB\-no_tx_cert_comp\fR" 4
|
|
.IX Item "-no_tx_cert_comp"
|
|
Disables support for sending TLSv1.3 compressed certificates.
|
|
.IP "\fB\-no_rx_cert_comp\fR" 4
|
|
.IX Item "-no_rx_cert_comp"
|
|
Disables support for receiving TLSv1.3 compressed certificate.
|
|
.IP "\fB\-comp\fR" 4
|
|
.IX Item "-comp"
|
|
Enables support for \s-1SSL/TLS\s0 compression.
|
|
This option was introduced in OpenSSL 1.1.0.
|
|
\&\s-1TLS\s0 compression is not recommended and is off by default as of
|
|
OpenSSL 1.1.0. \s-1TLS\s0 compression can only be used in security level 1 or
|
|
lower. From OpenSSL 3.2.0 and above the default security level is 2, so this
|
|
option will have no effect without also changing the security level. Use the
|
|
\&\fB\-cipher\fR option to change the security level. See \fBopenssl\-ciphers\fR\|(1) for
|
|
more information.
|
|
.IP "\fB\-no_comp\fR" 4
|
|
.IX Item "-no_comp"
|
|
Disables support for \s-1SSL/TLS\s0 compression.
|
|
\&\s-1TLS\s0 compression is not recommended and is off by default as of
|
|
OpenSSL 1.1.0.
|
|
.IP "\fB\-brief\fR" 4
|
|
.IX Item "-brief"
|
|
Only provide a brief summary of connection parameters instead of the
|
|
normal verbose output.
|
|
.IP "\fB\-sigalgs\fR \fIsigalglist\fR" 4
|
|
.IX Item "-sigalgs sigalglist"
|
|
Specifies the list of signature algorithms that are sent by the client.
|
|
The server selects one entry in the list based on its preferences.
|
|
For example strings, see \fBSSL_CTX_set1_sigalgs\fR\|(3)
|
|
.IP "\fB\-curves\fR \fIcurvelist\fR" 4
|
|
.IX Item "-curves curvelist"
|
|
Specifies the list of supported curves to be sent by the client. The curve is
|
|
ultimately selected by the server.
|
|
.Sp
|
|
The list of all supported groups includes named \s-1EC\s0 parameters as well as X25519
|
|
and X448 or \s-1FFDHE\s0 groups, and may also include groups implemented in 3rd\-party
|
|
providers. For a list of named \s-1EC\s0 parameters, use:
|
|
.Sp
|
|
.Vb 1
|
|
\& $ openssl ecparam \-list_curves
|
|
.Ve
|
|
.IP "\fB\-cipher\fR \fIcipherlist\fR" 4
|
|
.IX Item "-cipher cipherlist"
|
|
This allows the TLSv1.2 and below cipher list sent by the client to be modified.
|
|
This list will be combined with any TLSv1.3 ciphersuites that have been
|
|
configured. Although the server determines which ciphersuite is used it should
|
|
take the first supported cipher in the list sent by the client. See
|
|
\&\fBopenssl\-ciphers\fR\|(1) for more information.
|
|
.IP "\fB\-ciphersuites\fR \fIval\fR" 4
|
|
.IX Item "-ciphersuites val"
|
|
This allows the TLSv1.3 ciphersuites sent by the client to be modified. This
|
|
list will be combined with any TLSv1.2 and below ciphersuites that have been
|
|
configured. Although the server determines which cipher suite is used it should
|
|
take the first supported cipher in the list sent by the client. See
|
|
\&\fBopenssl\-ciphers\fR\|(1) for more information. The format for this list is a simple
|
|
colon (\*(L":\*(R") separated list of TLSv1.3 ciphersuite names.
|
|
.IP "\fB\-starttls\fR \fIprotocol\fR" 4
|
|
.IX Item "-starttls protocol"
|
|
Send the protocol-specific message(s) to switch to \s-1TLS\s0 for communication.
|
|
\&\fIprotocol\fR is a keyword for the intended protocol. Currently, the only
|
|
supported keywords are \*(L"smtp\*(R", \*(L"pop3\*(R", \*(L"imap\*(R", \*(L"ftp\*(R", \*(L"xmpp\*(R", \*(L"xmpp-server\*(R",
|
|
\&\*(L"irc\*(R", \*(L"postgres\*(R", \*(L"mysql\*(R", \*(L"lmtp\*(R", \*(L"nntp\*(R", \*(L"sieve\*(R" and \*(L"ldap\*(R".
|
|
.IP "\fB\-xmpphost\fR \fIhostname\fR" 4
|
|
.IX Item "-xmpphost hostname"
|
|
This option, when used with \*(L"\-starttls xmpp\*(R" or \*(L"\-starttls xmpp-server\*(R",
|
|
specifies the host for the \*(L"to\*(R" attribute of the stream element.
|
|
If this option is not specified, then the host specified with \*(L"\-connect\*(R"
|
|
will be used.
|
|
.Sp
|
|
This option is an alias of the \fB\-name\fR option for \*(L"xmpp\*(R" and \*(L"xmpp-server\*(R".
|
|
.IP "\fB\-name\fR \fIhostname\fR" 4
|
|
.IX Item "-name hostname"
|
|
This option is used to specify hostname information for various protocols
|
|
used with \fB\-starttls\fR option. Currently only \*(L"xmpp\*(R", \*(L"xmpp-server\*(R",
|
|
\&\*(L"smtp\*(R" and \*(L"lmtp\*(R" can utilize this \fB\-name\fR option.
|
|
.Sp
|
|
If this option is used with \*(L"\-starttls xmpp\*(R" or \*(L"\-starttls xmpp-server\*(R",
|
|
if specifies the host for the \*(L"to\*(R" attribute of the stream element. If this
|
|
option is not specified, then the host specified with \*(L"\-connect\*(R" will be used.
|
|
.Sp
|
|
If this option is used with \*(L"\-starttls lmtp\*(R" or \*(L"\-starttls smtp\*(R", it specifies
|
|
the name to use in the \*(L"\s-1LMTP LHLO\*(R"\s0 or \*(L"\s-1SMTP EHLO\*(R"\s0 message, respectively. If
|
|
this option is not specified, then \*(L"mail.example.com\*(R" will be used.
|
|
.IP "\fB\-tlsextdebug\fR" 4
|
|
.IX Item "-tlsextdebug"
|
|
Print out a hex dump of any \s-1TLS\s0 extensions received from the server.
|
|
.IP "\fB\-no_ticket\fR" 4
|
|
.IX Item "-no_ticket"
|
|
Disable RFC4507bis session ticket support.
|
|
.IP "\fB\-sess_out\fR \fIfilename\fR" 4
|
|
.IX Item "-sess_out filename"
|
|
Output \s-1SSL\s0 session to \fIfilename\fR.
|
|
.IP "\fB\-sess_in\fR \fIfilename\fR" 4
|
|
.IX Item "-sess_in filename"
|
|
Load \s-1SSL\s0 session from \fIfilename\fR. The client will attempt to resume a
|
|
connection from this session.
|
|
.IP "\fB\-serverinfo\fR \fItypes\fR" 4
|
|
.IX Item "-serverinfo types"
|
|
A list of comma-separated \s-1TLS\s0 Extension Types (numbers between 0 and
|
|
65535). Each type will be sent as an empty ClientHello \s-1TLS\s0 Extension.
|
|
The server's response (if any) will be encoded and displayed as a \s-1PEM\s0
|
|
file.
|
|
.IP "\fB\-status\fR" 4
|
|
.IX Item "-status"
|
|
Sends a certificate status request to the server (\s-1OCSP\s0 stapling). The server
|
|
response (if any) is printed out.
|
|
.IP "\fB\-alpn\fR \fIprotocols\fR, \fB\-nextprotoneg\fR \fIprotocols\fR" 4
|
|
.IX Item "-alpn protocols, -nextprotoneg protocols"
|
|
These flags enable the Enable the Application-Layer Protocol Negotiation
|
|
or Next Protocol Negotiation (\s-1NPN\s0) extension, respectively. \s-1ALPN\s0 is the
|
|
\&\s-1IETF\s0 standard and replaces \s-1NPN.\s0
|
|
The \fIprotocols\fR list is a comma-separated list of protocol names that
|
|
the client should advertise support for. The list should contain the most
|
|
desirable protocols first. Protocol names are printable \s-1ASCII\s0 strings,
|
|
for example \*(L"http/1.1\*(R" or \*(L"spdy/3\*(R".
|
|
An empty list of protocols is treated specially and will cause the
|
|
client to advertise support for the \s-1TLS\s0 extension but disconnect just
|
|
after receiving ServerHello with a list of server supported protocols.
|
|
The flag \fB\-nextprotoneg\fR cannot be specified if \fB\-tls1_3\fR is used.
|
|
.IP "\fB\-ct\fR, \fB\-noct\fR" 4
|
|
.IX Item "-ct, -noct"
|
|
Use one of these two options to control whether Certificate Transparency (\s-1CT\s0)
|
|
is enabled (\fB\-ct\fR) or disabled (\fB\-noct\fR).
|
|
If \s-1CT\s0 is enabled, signed certificate timestamps (SCTs) will be requested from
|
|
the server and reported at handshake completion.
|
|
.Sp
|
|
Enabling \s-1CT\s0 also enables \s-1OCSP\s0 stapling, as this is one possible delivery method
|
|
for SCTs.
|
|
.IP "\fB\-ctlogfile\fR" 4
|
|
.IX Item "-ctlogfile"
|
|
A file containing a list of known Certificate Transparency logs. See
|
|
\&\fBSSL_CTX_set_ctlog_list_file\fR\|(3) for the expected file format.
|
|
.IP "\fB\-keylogfile\fR \fIfile\fR" 4
|
|
.IX Item "-keylogfile file"
|
|
Appends \s-1TLS\s0 secrets to the specified keylog file such that external programs
|
|
(like Wireshark) can decrypt \s-1TLS\s0 connections.
|
|
.IP "\fB\-early_data\fR \fIfile\fR" 4
|
|
.IX Item "-early_data file"
|
|
Reads the contents of the specified file and attempts to send it as early data
|
|
to the server. This will only work with resumed sessions that support early
|
|
data and when the server accepts the early data.
|
|
.IP "\fB\-enable_pha\fR" 4
|
|
.IX Item "-enable_pha"
|
|
For TLSv1.3 only, send the Post-Handshake Authentication extension. This will
|
|
happen whether or not a certificate has been provided via \fB\-cert\fR.
|
|
.IP "\fB\-use_srtp\fR \fIvalue\fR" 4
|
|
.IX Item "-use_srtp value"
|
|
Offer \s-1SRTP\s0 key management, where \fBvalue\fR is a colon-separated profile list.
|
|
.IP "\fB\-srpuser\fR \fIvalue\fR" 4
|
|
.IX Item "-srpuser value"
|
|
Set the \s-1SRP\s0 username to the specified value. This option is deprecated.
|
|
.IP "\fB\-srppass\fR \fIvalue\fR" 4
|
|
.IX Item "-srppass value"
|
|
Set the \s-1SRP\s0 password to the specified value. This option is deprecated.
|
|
.IP "\fB\-srp_lateuser\fR" 4
|
|
.IX Item "-srp_lateuser"
|
|
\&\s-1SRP\s0 username for the second ClientHello message. This option is deprecated.
|
|
.IP "\fB\-srp_moregroups\fR This option is deprecated." 4
|
|
.IX Item "-srp_moregroups This option is deprecated."
|
|
Tolerate other than the known \fBg\fR and \fBN\fR values.
|
|
.IP "\fB\-srp_strength\fR \fInumber\fR" 4
|
|
.IX Item "-srp_strength number"
|
|
Set the minimal acceptable length, in bits, for \fBN\fR. This option is
|
|
deprecated.
|
|
.IP "\fB\-ktls\fR" 4
|
|
.IX Item "-ktls"
|
|
Enable Kernel \s-1TLS\s0 for sending and receiving.
|
|
This option was introduced in OpenSSL 3.2.0.
|
|
Kernel \s-1TLS\s0 is off by default as of OpenSSL 3.2.0.
|
|
.IP "\fB\-tfo\fR" 4
|
|
.IX Item "-tfo"
|
|
Enable creation of connections via \s-1TCP\s0 fast open (\s-1RFC7413\s0).
|
|
.IP "\fB\-no_ssl3\fR, \fB\-no_tls1\fR, \fB\-no_tls1_1\fR, \fB\-no_tls1_2\fR, \fB\-no_tls1_3\fR, \fB\-ssl3\fR, \fB\-tls1\fR, \fB\-tls1_1\fR, \fB\-tls1_2\fR, \fB\-tls1_3\fR" 4
|
|
.IX Item "-no_ssl3, -no_tls1, -no_tls1_1, -no_tls1_2, -no_tls1_3, -ssl3, -tls1, -tls1_1, -tls1_2, -tls1_3"
|
|
See \*(L"\s-1TLS\s0 Version Options\*(R" in \fBopenssl\fR\|(1).
|
|
.IP "\fB\-dtls\fR, \fB\-dtls1\fR, \fB\-dtls1_2\fR" 4
|
|
.IX Item "-dtls, -dtls1, -dtls1_2"
|
|
These specify the use of \s-1DTLS\s0 instead of \s-1TLS.\s0
|
|
See \*(L"\s-1TLS\s0 Version Options\*(R" in \fBopenssl\fR\|(1).
|
|
.IP "\fB\-nameopt\fR \fIoption\fR" 4
|
|
.IX Item "-nameopt option"
|
|
This specifies how the subject or issuer names are displayed.
|
|
See \fBopenssl\-namedisplay\-options\fR\|(1) for details.
|
|
.IP "\fB\-xkey\fR \fIinfile\fR, \fB\-xcert\fR \fIfile\fR, \fB\-xchain\fR \fIfile\fR, \fB\-xchain_build\fR \fIfile\fR, \fB\-xcertform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR, \fB\-xkeyform\fR \fB\s-1DER\s0\fR|\fB\s-1PEM\s0\fR" 4
|
|
.IX Item "-xkey infile, -xcert file, -xchain file, -xchain_build file, -xcertform DER|PEM, -xkeyform DER|PEM"
|
|
Set extended certificate verification options.
|
|
See \*(L"Extended Verification Options\*(R" in \fBopenssl\-verification\-options\fR\|(1) for details.
|
|
.IP "\fB\-CAfile\fR \fIfile\fR, \fB\-no\-CAfile\fR, \fB\-CApath\fR \fIdir\fR, \fB\-no\-CApath\fR, \fB\-CAstore\fR \fIuri\fR, \fB\-no\-CAstore\fR" 4
|
|
.IX Item "-CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore"
|
|
See \*(L"Trusted Certificate Options\*(R" in \fBopenssl\-verification\-options\fR\|(1) for details.
|
|
.IP "\fB\-bugs\fR, \fB\-comp\fR, \fB\-no_comp\fR, \fB\-no_ticket\fR, \fB\-serverpref\fR, \fB\-client_renegotiation\fR, \fB\-legacy_renegotiation\fR, \fB\-no_renegotiation\fR, \fB\-no_resumption_on_reneg\fR, \fB\-legacy_server_connect\fR, \fB\-no_legacy_server_connect\fR, \fB\-no_etm\fR \fB\-allow_no_dhe_kex\fR, \fB\-prefer_no_dhe_kex\fR, \fB\-prioritize_chacha\fR, \fB\-strict\fR, \fB\-sigalgs\fR \fIalgs\fR, \fB\-client_sigalgs\fR \fIalgs\fR, \fB\-groups\fR \fIgroups\fR, \fB\-curves\fR \fIcurves\fR, \fB\-named_curve\fR \fIcurve\fR, \fB\-cipher\fR \fIciphers\fR, \fB\-ciphersuites\fR \fI1.3ciphers\fR, \fB\-min_protocol\fR \fIminprot\fR, \fB\-max_protocol\fR \fImaxprot\fR, \fB\-record_padding\fR \fIpadding\fR, \fB\-debug_broken_protocol\fR, \fB\-no_middlebox\fR" 4
|
|
.IX Item "-bugs, -comp, -no_comp, -no_ticket, -serverpref, -client_renegotiation, -legacy_renegotiation, -no_renegotiation, -no_resumption_on_reneg, -legacy_server_connect, -no_legacy_server_connect, -no_etm -allow_no_dhe_kex, -prefer_no_dhe_kex, -prioritize_chacha, -strict, -sigalgs algs, -client_sigalgs algs, -groups groups, -curves curves, -named_curve curve, -cipher ciphers, -ciphersuites 1.3ciphers, -min_protocol minprot, -max_protocol maxprot, -record_padding padding, -debug_broken_protocol, -no_middlebox"
|
|
See \*(L"\s-1SUPPORTED COMMAND LINE COMMANDS\*(R"\s0 in \fBSSL_CONF_cmd\fR\|(3) for details.
|
|
.IP "\fB\-rand\fR \fIfiles\fR, \fB\-writerand\fR \fIfile\fR" 4
|
|
.IX Item "-rand files, -writerand file"
|
|
See \*(L"Random State Options\*(R" in \fBopenssl\fR\|(1) for details.
|
|
.IP "\fB\-provider\fR \fIname\fR" 4
|
|
.IX Item "-provider name"
|
|
.PD 0
|
|
.IP "\fB\-provider\-path\fR \fIpath\fR" 4
|
|
.IX Item "-provider-path path"
|
|
.IP "\fB\-propquery\fR \fIpropq\fR" 4
|
|
.IX Item "-propquery propq"
|
|
.PD
|
|
See \*(L"Provider Options\*(R" in \fBopenssl\fR\|(1), \fBprovider\fR\|(7), and \fBproperty\fR\|(7).
|
|
.IP "\fB\-engine\fR \fIid\fR" 4
|
|
.IX Item "-engine id"
|
|
See \*(L"Engine Options\*(R" in \fBopenssl\fR\|(1).
|
|
This option is deprecated.
|
|
.IP "\fB\-ssl_client_engine\fR \fIid\fR" 4
|
|
.IX Item "-ssl_client_engine id"
|
|
Specify engine to be used for client certificate operations.
|
|
.IP "\fB\-allow_proxy_certs\fR, \fB\-attime\fR, \fB\-no_check_time\fR, \fB\-check_ss_sig\fR, \fB\-crl_check\fR, \fB\-crl_check_all\fR, \fB\-explicit_policy\fR, \fB\-extended_crl\fR, \fB\-ignore_critical\fR, \fB\-inhibit_any\fR, \fB\-inhibit_map\fR, \fB\-no_alt_chains\fR, \fB\-partial_chain\fR, \fB\-policy\fR, \fB\-policy_check\fR, \fB\-policy_print\fR, \fB\-purpose\fR, \fB\-suiteB_128\fR, \fB\-suiteB_128_only\fR, \fB\-suiteB_192\fR, \fB\-trusted_first\fR, \fB\-use_deltas\fR, \fB\-auth_level\fR, \fB\-verify_depth\fR, \fB\-verify_email\fR, \fB\-verify_hostname\fR, \fB\-verify_ip\fR, \fB\-verify_name\fR, \fB\-x509_strict\fR \fB\-issuer_checks\fR" 4
|
|
.IX Item "-allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict -issuer_checks"
|
|
Set various options of certificate chain verification.
|
|
See \*(L"Verification Options\*(R" in \fBopenssl\-verification\-options\fR\|(1) for details.
|
|
.Sp
|
|
Verification errors are displayed, for debugging, but the command will
|
|
proceed unless the \fB\-verify_return_error\fR option is used.
|
|
.IP "\fB\-enable_server_rpk\fR" 4
|
|
.IX Item "-enable_server_rpk"
|
|
Enable support for receiving raw public keys (\s-1RFC7250\s0) from the server.
|
|
Use of X.509 certificates by the server becomes optional, and servers that
|
|
support raw public keys may elect to use them.
|
|
Servers that don't support raw public keys or prefer to use X.509
|
|
certificates can still elect to send X.509 certificates as usual.
|
|
.IP "\fB\-enable_client_rpk\fR" 4
|
|
.IX Item "-enable_client_rpk"
|
|
Enable support for sending raw public keys (\s-1RFC7250\s0) to the server.
|
|
A raw public key will be sent by the client, if solicited by the server,
|
|
provided a suitable key and public certificate pair is configured.
|
|
Some servers may nevertheless not request any client credentials,
|
|
or may request a certificate.
|
|
.IP "\fIhost\fR:\fIport\fR" 4
|
|
.IX Item "host:port"
|
|
Rather than providing \fB\-connect\fR, the target host and optional port may
|
|
be provided as a single positional argument after all options. If neither this
|
|
nor \fB\-connect\fR are provided, falls back to attempting to connect to
|
|
\&\fIlocalhost\fR on port \fI4433\fR.
|
|
If the host string is an IPv6 address, it must be enclosed in \f(CW\*(C`[\*(C'\fR and \f(CW\*(C`]\*(C'\fR.
|
|
.SH "CONNECTED COMMANDS (BASIC)"
|
|
.IX Header "CONNECTED COMMANDS (BASIC)"
|
|
If a connection is established with an \s-1SSL/TLS\s0 server then any data received
|
|
from the server is displayed and any key presses will be sent to the
|
|
server. If end of file is reached then the connection will be closed down.
|
|
.PP
|
|
When used interactively (which means neither \fB\-quiet\fR nor \fB\-ign_eof\fR have been
|
|
given), and neither of \fB\-adv\fR or \fB\-nocommands\fR are given then \*(L"Basic\*(R" command
|
|
mode is entered. In this mode certain commands are recognized which perform
|
|
special operations. These commands are a letter which must appear at the start
|
|
of a line. All further data after the initial letter on the line is ignored.
|
|
The commands are listed below.
|
|
.IP "\fBQ\fR" 4
|
|
.IX Item "Q"
|
|
End the current \s-1SSL\s0 connection and exit.
|
|
.IP "\fBR\fR" 4
|
|
.IX Item "R"
|
|
Renegotiate the \s-1SSL\s0 session (TLSv1.2 and below only).
|
|
.IP "\fBC\fR" 4
|
|
.IX Item "C"
|
|
Attempt to reconnect to the server using a resumption handshake.
|
|
.IP "\fBk\fR" 4
|
|
.IX Item "k"
|
|
Send a key update message to the server (TLSv1.3 only)
|
|
.IP "\fBK\fR" 4
|
|
.IX Item "K"
|
|
Send a key update message to the server and request one back (TLSv1.3 only)
|
|
.SH "CONNECTED COMMANDS (ADVANCED)"
|
|
.IX Header "CONNECTED COMMANDS (ADVANCED)"
|
|
If \fB\-adv\fR has been given then \*(L"advanced\*(R" command mode is entered. As with basic
|
|
mode, if a connection is established with an \s-1SSL/TLS\s0 server then any data
|
|
received from the server is displayed and any key presses will be sent to the
|
|
server. If end of file is reached then the connection will be closed down.
|
|
.PP
|
|
Special commands can be supplied by enclosing them in braces, e.g. \*(L"{help}\*(R" or
|
|
\&\*(L"{quit}\*(R". These commands can appear anywhere in the text entered into s_client,
|
|
but they are not sent to the server. Some commands can take an argument by
|
|
ending the command name with \*(L":\*(R" and then providing the argument, e.g.
|
|
\&\*(L"{keyup:req}\*(R". Some commands are only available when certain protocol versions
|
|
have been negotiated.
|
|
.PP
|
|
If a newline appears at the end of a line entered into s_client then this is
|
|
also sent to the server. If a command appears on a line on its own with no other
|
|
text on the same line, then the newline is suppressed and not sent to the
|
|
server.
|
|
.PP
|
|
The following commands are recognised.
|
|
.IP "\fBhelp\fR" 4
|
|
.IX Item "help"
|
|
Prints out summary help text about the available commands.
|
|
.IP "\fBquit\fR" 4
|
|
.IX Item "quit"
|
|
Close the connection to the peer
|
|
.IP "\fBreconnect\fR" 4
|
|
.IX Item "reconnect"
|
|
Reconnect to the peer and attempt a resumption handshake
|
|
.IP "\fBkeyup\fR" 4
|
|
.IX Item "keyup"
|
|
Send a Key Update message. TLSv1.3 only. This command takes an optional
|
|
argument. If the argument \*(L"req\*(R" is supplied then the peer is also requested to
|
|
update its keys. Otherwise if \*(L"noreq\*(R" is supplied the peer is not requested
|
|
to update its keys. The default is \*(L"req\*(R".
|
|
.IP "\fBreneg\fR" 4
|
|
.IX Item "reneg"
|
|
Initiate a renegotiation with the server. (D)TLSv1.2 or below only.
|
|
.IP "\fBfin\fR" 4
|
|
.IX Item "fin"
|
|
Indicate \s-1FIN\s0 on the current stream. \s-1QUIC\s0 only. Once \s-1FIN\s0 has been sent any
|
|
further text entered for this stream is ignored.
|
|
.SH "NOTES"
|
|
.IX Header "NOTES"
|
|
This command can be used to debug \s-1SSL\s0 servers. To connect to an \s-1SSL HTTP\s0
|
|
server the command:
|
|
.PP
|
|
.Vb 1
|
|
\& openssl s_client \-connect servername:443
|
|
.Ve
|
|
.PP
|
|
would typically be used (https uses port 443). If the connection succeeds
|
|
then an \s-1HTTP\s0 command can be given such as \*(L"\s-1GET /\*(R"\s0 to retrieve a web page.
|
|
.PP
|
|
If the handshake fails then there are several possible causes, if it is
|
|
nothing obvious like no client certificate then the \fB\-bugs\fR,
|
|
\&\fB\-ssl3\fR, \fB\-tls1\fR, \fB\-no_ssl3\fR, \fB\-no_tls1\fR options can be tried
|
|
in case it is a buggy server. In particular you should play with these
|
|
options \fBbefore\fR submitting a bug report to an OpenSSL mailing list.
|
|
.PP
|
|
A frequent problem when attempting to get client certificates working
|
|
is that a web client complains it has no certificates or gives an empty
|
|
list to choose from. This is normally because the server is not sending
|
|
the clients certificate authority in its \*(L"acceptable \s-1CA\s0 list\*(R" when it
|
|
requests a certificate. By using this command, the \s-1CA\s0 list can be viewed
|
|
and checked. However, some servers only request client authentication
|
|
after a specific \s-1URL\s0 is requested. To obtain the list in this case it
|
|
is necessary to use the \fB\-prexit\fR option and send an \s-1HTTP\s0 request
|
|
for an appropriate page.
|
|
.PP
|
|
If a certificate is specified on the command line using the \fB\-cert\fR
|
|
option it will not be used unless the server specifically requests
|
|
a client certificate. Therefore, merely including a client certificate
|
|
on the command line is no guarantee that the certificate works.
|
|
.PP
|
|
If there are problems verifying a server certificate then the
|
|
\&\fB\-showcerts\fR option can be used to show all the certificates sent by the
|
|
server.
|
|
.PP
|
|
This command is a test tool and is designed to continue the
|
|
handshake after any certificate verification errors. As a result it will
|
|
accept any certificate chain (trusted or not) sent by the peer. Non-test
|
|
applications should \fBnot\fR do this as it makes them vulnerable to a \s-1MITM\s0
|
|
attack. This behaviour can be changed by with the \fB\-verify_return_error\fR
|
|
option: any verify errors are then returned aborting the handshake.
|
|
.PP
|
|
The \fB\-bind\fR option may be useful if the server or a firewall requires
|
|
connections to come from some particular address and or port.
|
|
.SS "Note on Non-Interactive Use"
|
|
.IX Subsection "Note on Non-Interactive Use"
|
|
When \fBs_client\fR is run in a non-interactive environment (e.g., a cron job or
|
|
a script without a valid \fIstdin\fR), it may close the connection prematurely,
|
|
especially with \s-1TLS 1.3.\s0 To prevent this, you can use the \fB\-ign_eof\fR flag,
|
|
which keeps \fBs_client\fR running even after reaching \s-1EOF\s0 from \fIstdin\fR.
|
|
.PP
|
|
For example:
|
|
.PP
|
|
.Vb 3
|
|
\& openssl s_client \-connect <server address>:443 \-tls1_3
|
|
\& \-sess_out /path/to/tls_session_params_file
|
|
\& \-ign_eof </dev/null
|
|
.Ve
|
|
.PP
|
|
However, relying solely on \fB\-ign_eof\fR can lead to issues if the server keeps
|
|
the connection open, expecting the client to close first. In such cases, the
|
|
client may hang indefinitely. This behavior is not uncommon, particularly with
|
|
protocols where the server waits for a graceful disconnect from the client.
|
|
.PP
|
|
For example, when connecting to an \s-1SMTP\s0 server, the session may pause if the
|
|
server expects a \s-1QUIT\s0 command before closing:
|
|
.PP
|
|
.Vb 8
|
|
\& $ openssl s_client \-brief \-ign_eof \-starttls smtp
|
|
\& \-connect <server address>:25 </dev/null
|
|
\& CONNECTION ESTABLISHED
|
|
\& Protocol version: TLSv1.3
|
|
\& Ciphersuite: TLS_AES_256_GCM_SHA384
|
|
\& ...
|
|
\& 250 CHUNKING
|
|
\& [long pause]
|
|
.Ve
|
|
.PP
|
|
To avoid such hangs, it's better to use an application-level command to
|
|
initiate a clean disconnect. For \s-1SMTP,\s0 you can send a \s-1QUIT\s0 command:
|
|
.PP
|
|
.Vb 2
|
|
\& printf \*(AqQUIT\er\en\*(Aq | openssl s_client \-connect <server address>:25
|
|
\& \-starttls smtp \-brief \-ign_eof
|
|
.Ve
|
|
.PP
|
|
Similarly, for \s-1HTTP/1.1\s0 connections, including a `Connection: close` header
|
|
ensures the server closes the connection after responding:
|
|
.PP
|
|
.Vb 2
|
|
\& printf \*(AqGET / HTTP/1.1\er\enHost: <server address>\er\enConnection: close\er\en\er\en\*(Aq
|
|
\& | openssl s_client \-connect <server address>:443 \-brief
|
|
.Ve
|
|
.PP
|
|
These approaches help manage the connection closure gracefully and prevent
|
|
hangs caused by the server waiting for the client to initiate the disconnect.
|
|
.SH "BUGS"
|
|
.IX Header "BUGS"
|
|
Because this program has a lot of options and also because some of the
|
|
techniques used are rather old, the C source for this command is rather
|
|
hard to read and not a model of how things should be done.
|
|
A typical \s-1SSL\s0 client program would be much simpler.
|
|
.PP
|
|
The \fB\-prexit\fR option is a bit of a hack. We should really report
|
|
information whenever a session is renegotiated.
|
|
.SH "SEE ALSO"
|
|
.IX Header "SEE ALSO"
|
|
\&\fBopenssl\fR\|(1),
|
|
\&\fBopenssl\-sess_id\fR\|(1),
|
|
\&\fBopenssl\-s_server\fR\|(1),
|
|
\&\fBopenssl\-ciphers\fR\|(1),
|
|
\&\fBSSL_CONF_cmd\fR\|(3),
|
|
\&\fBSSL_CTX_set_max_send_fragment\fR\|(3),
|
|
\&\fBSSL_CTX_set_split_send_fragment\fR\|(3),
|
|
\&\fBSSL_CTX_set_max_pipelines\fR\|(3),
|
|
\&\fBossl_store\-file\fR\|(7)
|
|
.SH "HISTORY"
|
|
.IX Header "HISTORY"
|
|
The \fB\-no_alt_chains\fR option was added in OpenSSL 1.1.0.
|
|
The \fB\-name\fR option was added in OpenSSL 1.1.1.
|
|
.PP
|
|
The \fB\-certform\fR option has become obsolete in OpenSSL 3.0.0 and has no effect.
|
|
.PP
|
|
The \fB\-engine\fR option was deprecated in OpenSSL 3.0.
|
|
.PP
|
|
The
|
|
\&\fB\-enable_client_rpk\fR,
|
|
\&\fB\-enable_server_rpk\fR,
|
|
\&\fB\-no_rx_cert_comp\fR,
|
|
\&\fB\-no_tx_cert_comp\fR,
|
|
and \fB\-tfo\fR
|
|
options were added in OpenSSL 3.2.
|
|
.SH "COPYRIGHT"
|
|
.IX Header "COPYRIGHT"
|
|
Copyright 2000\-2024 The OpenSSL Project Authors. All Rights Reserved.
|
|
.PP
|
|
Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file \s-1LICENSE\s0 in the source distribution or at
|
|
<https://www.openssl.org/source/license.html>.
|