956 lines
41 KiB
HTML
956 lines
41 KiB
HTML
<?xml version="1.0" ?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>s_client</title>
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
|
<link rev="made" href="mailto:root@localhost" />
|
|
</head>
|
|
|
|
<body style="background-color: white">
|
|
|
|
|
|
<!-- INDEX BEGIN -->
|
|
<div name="index">
|
|
<p><a name="__index__"></a></p>
|
|
|
|
<ul>
|
|
|
|
<li><a href="#name">NAME</a></li>
|
|
<li><a href="#synopsis">SYNOPSIS</a></li>
|
|
<li><a href="#description">DESCRIPTION</a></li>
|
|
<li><a href="#options">OPTIONS</a></li>
|
|
<li><a href="#connected_commands">CONNECTED COMMANDS</a></li>
|
|
<li><a href="#notes">NOTES</a></li>
|
|
<li><a href="#bugs">BUGS</a></li>
|
|
<li><a href="#see_also">SEE ALSO</a></li>
|
|
<li><a href="#history">HISTORY</a></li>
|
|
<li><a href="#copyright">COPYRIGHT</a></li>
|
|
</ul>
|
|
|
|
<hr name="index" />
|
|
</div>
|
|
<!-- INDEX END -->
|
|
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="name">NAME</a></h1>
|
|
<p>openssl-s_client,
|
|
s_client - SSL/TLS client program</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="synopsis">SYNOPSIS</a></h1>
|
|
<p><strong>openssl</strong> <strong>s_client</strong>
|
|
[<strong>-help</strong>]
|
|
[<strong>-connect host:port</strong>]
|
|
[<strong>-bind host:port</strong>]
|
|
[<strong>-proxy host:port</strong>]
|
|
[<strong>-unix path</strong>]
|
|
[<strong>-4</strong>]
|
|
[<strong>-6</strong>]
|
|
[<strong>-servername name</strong>]
|
|
[<strong>-noservername</strong>]
|
|
[<strong>-verify depth</strong>]
|
|
[<strong>-verify_return_error</strong>]
|
|
[<strong>-cert filename</strong>]
|
|
[<strong>-certform DER|PEM</strong>]
|
|
[<strong>-key filename</strong>]
|
|
[<strong>-keyform DER|PEM</strong>]
|
|
[<strong>-cert_chain filename</strong>]
|
|
[<strong>-build_chain</strong>]
|
|
[<strong>-xkey</strong>]
|
|
[<strong>-xcert</strong>]
|
|
[<strong>-xchain</strong>]
|
|
[<strong>-xchain_build</strong>]
|
|
[<strong>-xcertform PEM|DER</strong>]
|
|
[<strong>-xkeyform PEM|DER</strong>]
|
|
[<strong>-pass arg</strong>]
|
|
[<strong>-CApath directory</strong>]
|
|
[<strong>-CAfile filename</strong>]
|
|
[<strong>-chainCApath directory</strong>]
|
|
[<strong>-chainCAfile filename</strong>]
|
|
[<strong>-no-CAfile</strong>]
|
|
[<strong>-no-CApath</strong>]
|
|
[<strong>-requestCAfile filename</strong>]
|
|
[<strong>-dane_tlsa_domain domain</strong>]
|
|
[<strong>-dane_tlsa_rrdata rrdata</strong>]
|
|
[<strong>-dane_ee_no_namechecks</strong>]
|
|
[<strong>-attime timestamp</strong>]
|
|
[<strong>-check_ss_sig</strong>]
|
|
[<strong>-crl_check</strong>]
|
|
[<strong>-crl_check_all</strong>]
|
|
[<strong>-explicit_policy</strong>]
|
|
[<strong>-extended_crl</strong>]
|
|
[<strong>-ignore_critical</strong>]
|
|
[<strong>-inhibit_any</strong>]
|
|
[<strong>-inhibit_map</strong>]
|
|
[<strong>-no_check_time</strong>]
|
|
[<strong>-partial_chain</strong>]
|
|
[<strong>-policy arg</strong>]
|
|
[<strong>-policy_check</strong>]
|
|
[<strong>-policy_print</strong>]
|
|
[<strong>-purpose purpose</strong>]
|
|
[<strong>-suiteB_128</strong>]
|
|
[<strong>-suiteB_128_only</strong>]
|
|
[<strong>-suiteB_192</strong>]
|
|
[<strong>-trusted_first</strong>]
|
|
[<strong>-no_alt_chains</strong>]
|
|
[<strong>-use_deltas</strong>]
|
|
[<strong>-auth_level num</strong>]
|
|
[<strong>-nameopt option</strong>]
|
|
[<strong>-verify_depth num</strong>]
|
|
[<strong>-verify_email email</strong>]
|
|
[<strong>-verify_hostname hostname</strong>]
|
|
[<strong>-verify_ip ip</strong>]
|
|
[<strong>-verify_name name</strong>]
|
|
[<strong>-build_chain</strong>]
|
|
[<strong>-x509_strict</strong>]
|
|
[<strong>-reconnect</strong>]
|
|
[<strong>-showcerts</strong>]
|
|
[<strong>-debug</strong>]
|
|
[<strong>-msg</strong>]
|
|
[<strong>-nbio_test</strong>]
|
|
[<strong>-state</strong>]
|
|
[<strong>-nbio</strong>]
|
|
[<strong>-crlf</strong>]
|
|
[<strong>-ign_eof</strong>]
|
|
[<strong>-no_ign_eof</strong>]
|
|
[<strong>-psk_identity identity</strong>]
|
|
[<strong>-psk key</strong>]
|
|
[<strong>-psk_session file</strong>]
|
|
[<strong>-quiet</strong>]
|
|
[<strong>-ssl3</strong>]
|
|
[<strong>-tls1</strong>]
|
|
[<strong>-tls1_1</strong>]
|
|
[<strong>-tls1_2</strong>]
|
|
[<strong>-tls1_3</strong>]
|
|
[<strong>-no_ssl3</strong>]
|
|
[<strong>-no_tls1</strong>]
|
|
[<strong>-no_tls1_1</strong>]
|
|
[<strong>-no_tls1_2</strong>]
|
|
[<strong>-no_tls1_3</strong>]
|
|
[<strong>-dtls</strong>]
|
|
[<strong>-dtls1</strong>]
|
|
[<strong>-dtls1_2</strong>]
|
|
[<strong>-sctp</strong>]
|
|
[<strong>-sctp_label_bug</strong>]
|
|
[<strong>-fallback_scsv</strong>]
|
|
[<strong>-async</strong>]
|
|
[<strong>-max_send_frag</strong>]
|
|
[<strong>-split_send_frag</strong>]
|
|
[<strong>-max_pipelines</strong>]
|
|
[<strong>-read_buf</strong>]
|
|
[<strong>-bugs</strong>]
|
|
[<strong>-comp</strong>]
|
|
[<strong>-no_comp</strong>]
|
|
[<strong>-allow_no_dhe_kex</strong>]
|
|
[<strong>-sigalgs sigalglist</strong>]
|
|
[<strong>-curves curvelist</strong>]
|
|
[<strong>-cipher cipherlist</strong>]
|
|
[<strong>-ciphersuites val</strong>]
|
|
[<strong>-serverpref</strong>]
|
|
[<strong>-starttls protocol</strong>]
|
|
[<strong>-xmpphost hostname</strong>]
|
|
[<strong>-name hostname</strong>]
|
|
[<strong>-engine id</strong>]
|
|
[<strong>-tlsextdebug</strong>]
|
|
[<strong>-no_ticket</strong>]
|
|
[<strong>-sess_out filename</strong>]
|
|
[<strong>-sess_in filename</strong>]
|
|
[<strong>-rand file...</strong>]
|
|
[<strong>-writerand file</strong>]
|
|
[<strong>-serverinfo types</strong>]
|
|
[<strong>-status</strong>]
|
|
[<strong>-alpn protocols</strong>]
|
|
[<strong>-nextprotoneg protocols</strong>]
|
|
[<strong>-ct</strong>]
|
|
[<strong>-noct</strong>]
|
|
[<strong>-ctlogfile</strong>]
|
|
[<strong>-keylogfile file</strong>]
|
|
[<strong>-early_data file</strong>]
|
|
[<strong>-enable_pha</strong>]
|
|
[<strong>target</strong>]</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="description">DESCRIPTION</a></h1>
|
|
<p>The <strong>s_client</strong> command implements a generic SSL/TLS client which connects
|
|
to a remote host using SSL/TLS. It is a <em>very</em> useful diagnostic tool for
|
|
SSL servers.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="options">OPTIONS</a></h1>
|
|
<p>In addition to the options below the <strong>s_client</strong> utility also supports the
|
|
common and client only options documented
|
|
in the "Supported Command Line Commands" section of the <em>SSL_CONF_cmd(3)</em>
|
|
manual page.</p>
|
|
<dl>
|
|
<dt><strong><a name="help" class="item"><strong>-help</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Print out a usage message.</p>
|
|
</dd>
|
|
<dt><strong><a name="connect_host_port" class="item"><strong>-connect host:port</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This specifies the host and optional port to connect to. It is possible to
|
|
select the host and port using the optional target positional argument instead.
|
|
If neither this nor the target positional argument are specified then an attempt
|
|
is made to connect to the local host on port 4433.</p>
|
|
</dd>
|
|
<dt><strong><a name="bind_host_port" class="item"><strong>-bind host:port</strong>]</a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This specifies the host address and or port to bind as the source for the
|
|
connection. For Unix-domain sockets the port is ignored and the host is
|
|
used as the source socket address.</p>
|
|
</dd>
|
|
<dt><strong><a name="proxy_host_port" class="item"><strong>-proxy host:port</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>When used with the <strong>-connect</strong> flag, the program uses the host and port
|
|
specified with this flag and issues an HTTP CONNECT command to connect
|
|
to the desired server.</p>
|
|
</dd>
|
|
<dt><strong><a name="unix_path" class="item"><strong>-unix path</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Connect over the specified Unix-domain socket.</p>
|
|
</dd>
|
|
<dt><strong><a name="4" class="item"><strong>-4</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use IPv4 only.</p>
|
|
</dd>
|
|
<dt><strong><a name="6" class="item"><strong>-6</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use IPv6 only.</p>
|
|
</dd>
|
|
<dt><strong><a name="servername_name" class="item"><strong>-servername name</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Set the TLS SNI (Server Name Indication) extension in the ClientHello message to
|
|
the given value.
|
|
If <strong>-servername</strong> is not provided, the TLS SNI extension will be populated with
|
|
the name given to <strong>-connect</strong> if it follows a DNS name format. If <strong>-connect</strong> is
|
|
not provided either, the SNI is set to "localhost".
|
|
This is the default since OpenSSL 1.1.1.</p>
|
|
<p>Even though SNI should normally be a DNS name and not an IP address, if
|
|
<strong>-servername</strong> is provided then that name will be sent, regardless of whether
|
|
it is a DNS name or not.</p>
|
|
<p>This option cannot be used in conjunction with <strong>-noservername</strong>.</p>
|
|
</dd>
|
|
<dt><strong><a name="noservername" class="item"><strong>-noservername</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Suppresses sending of the SNI (Server Name Indication) extension in the
|
|
ClientHello message. Cannot be used in conjunction with the <strong>-servername</strong> or
|
|
<-dane_tlsa_domain> options.</p>
|
|
</dd>
|
|
<dt><strong><a name="cert_certname" class="item"><strong>-cert certname</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The certificate to use, if one is requested by the server. The default is
|
|
not to use a certificate.</p>
|
|
</dd>
|
|
<dt><strong><a name="certform_format" class="item"><strong>-certform format</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The certificate format to use: DER or PEM. PEM is the default.</p>
|
|
</dd>
|
|
<dt><strong><a name="key_keyfile" class="item"><strong>-key keyfile</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The private key to use. If not specified then the certificate file will
|
|
be used.</p>
|
|
</dd>
|
|
<dt><strong><a name="keyform_format" class="item"><strong>-keyform format</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The private format to use: DER or PEM. PEM is the default.</p>
|
|
</dd>
|
|
<dt><strong><a name="cert_chain" class="item"><strong>-cert_chain</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>A file containing trusted certificates to use when attempting to build the
|
|
client/server certificate chain related to the certificate specified via the
|
|
<strong>-cert</strong> option.</p>
|
|
</dd>
|
|
<dt><strong><a name="build_chain" class="item"><strong>-build_chain</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Specify whether the application should build the certificate chain to be
|
|
provided to the server.</p>
|
|
</dd>
|
|
<dt><strong><a name="xkey_infile_xcert_infile_xchain" class="item"><strong>-xkey infile</strong>, <strong>-xcert infile</strong>, <strong>-xchain</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Specify an extra certificate, private key and certificate chain. These behave
|
|
in the same manner as the <strong>-cert</strong>, <strong>-key</strong> and <strong>-cert_chain</strong> options. When
|
|
specified, the callback returning the first valid chain will be in use by the
|
|
client.</p>
|
|
</dd>
|
|
<dt><strong><a name="xchain_build" class="item"><strong>-xchain_build</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Specify whether the application should build the certificate chain to be
|
|
provided to the server for the extra certificates provided via <strong>-xkey infile</strong>,
|
|
<strong>-xcert infile</strong>, <strong>-xchain</strong> options.</p>
|
|
</dd>
|
|
<dt><strong><a name="xcertform_pem_der_xkeyform_pem_der" class="item"><strong>-xcertform PEM|DER</strong>, <strong>-xkeyform PEM|DER</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Extra certificate and private key format respectively.</p>
|
|
</dd>
|
|
<dt><strong><a name="pass_arg" class="item"><strong>-pass arg</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>the private key password source. For more information about the format of <strong>arg</strong>
|
|
see the <strong>PASS PHRASE ARGUMENTS</strong> section in <em>openssl(1)</em>.</p>
|
|
</dd>
|
|
<dt><strong><a name="verify_depth" class="item"><strong>-verify depth</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The verify depth to use. This specifies the maximum length of the
|
|
server certificate chain and turns on server certificate verification.
|
|
Currently the verify operation continues after errors so all the problems
|
|
with a certificate chain can be seen. As a side effect the connection
|
|
will never fail due to a server certificate verify failure.</p>
|
|
</dd>
|
|
<dt><strong><a name="verify_return_error" class="item"><strong>-verify_return_error</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Return verification errors instead of continuing. This will typically
|
|
abort the handshake with a fatal error.</p>
|
|
</dd>
|
|
<dt><strong><a name="nameopt_option" class="item"><strong>-nameopt option</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Option which determines how the subject or issuer names are displayed. The
|
|
<strong>option</strong> argument can be a single option or multiple options separated by
|
|
commas. Alternatively the <strong>-nameopt</strong> switch may be used more than once to
|
|
set multiple options. See the <em>x509(1)</em> manual page for details.</p>
|
|
</dd>
|
|
<dt><strong><a name="capath_directory" class="item"><strong>-CApath directory</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The directory to use for server certificate verification. This directory
|
|
must be in "hash format", see <em>verify(1)</em> for more information. These are
|
|
also used when building the client certificate chain.</p>
|
|
</dd>
|
|
<dt><strong><a name="cafile_file" class="item"><strong>-CAfile file</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>A file containing trusted certificates to use during server authentication
|
|
and to use when attempting to build the client certificate chain.</p>
|
|
</dd>
|
|
<dt><strong><a name="chaincapath_directory" class="item"><strong>-chainCApath directory</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The directory to use for building the chain provided to the server. This
|
|
directory must be in "hash format", see <em>verify(1)</em> for more information.</p>
|
|
</dd>
|
|
<dt><strong><a name="chaincafile_file" class="item"><strong>-chainCAfile file</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>A file containing trusted certificates to use when attempting to build the
|
|
client certificate chain.</p>
|
|
</dd>
|
|
<dt><strong><a name="no_cafile" class="item"><strong>-no-CAfile</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Do not load the trusted CA certificates from the default file location</p>
|
|
</dd>
|
|
<dt><strong><a name="no_capath" class="item"><strong>-no-CApath</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Do not load the trusted CA certificates from the default directory location</p>
|
|
</dd>
|
|
<dt><strong><a name="requestcafile_file" class="item"><strong>-requestCAfile file</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>A file containing a list of certificates whose subject names will be sent
|
|
to the server in the <strong>certificate_authorities</strong> extension. Only supported
|
|
for TLS 1.3</p>
|
|
</dd>
|
|
<dt><strong><a name="dane_tlsa_domain_domain" class="item"><strong>-dane_tlsa_domain domain</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Enable <a href="http://www.ietf.org/rfc/rfc6698.txt" class="rfc">RFC6698</a>/<a href="http://www.ietf.org/rfc/rfc7671.txt" class="rfc">RFC7671</a> DANE TLSA authentication and specify the
|
|
TLSA base domain which becomes the default SNI hint and the primary
|
|
reference identifier for hostname checks. This must be used in
|
|
combination with at least one instance of the <strong>-dane_tlsa_rrdata</strong>
|
|
option below.</p>
|
|
<p>When DANE authentication succeeds, the diagnostic output will include
|
|
the lowest (closest to 0) depth at which a TLSA record authenticated
|
|
a chain certificate. When that TLSA record is a "2 1 0" trust
|
|
anchor public key that signed (rather than matched) the top-most
|
|
certificate of the chain, the result is reported as "TA public key
|
|
verified". Otherwise, either the TLSA record "matched TA certificate"
|
|
at a positive depth or else "matched EE certificate" at depth 0.</p>
|
|
</dd>
|
|
<dt><strong><a name="dane_tlsa_rrdata_rrdata" class="item"><strong>-dane_tlsa_rrdata rrdata</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use one or more times to specify the RRDATA fields of the DANE TLSA
|
|
RRset associated with the target service. The <strong>rrdata</strong> value is
|
|
specified in "presentation form", that is four whitespace separated
|
|
fields that specify the usage, selector, matching type and associated
|
|
data, with the last of these encoded in hexadecimal. Optional
|
|
whitespace is ignored in the associated data field. For example:</p>
|
|
<pre>
|
|
$ openssl s_client -brief -starttls smtp \
|
|
-connect smtp.example.com:25 \
|
|
-dane_tlsa_domain smtp.example.com \
|
|
-dane_tlsa_rrdata "2 1 1
|
|
B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B" \
|
|
-dane_tlsa_rrdata "2 1 1
|
|
60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18"
|
|
...
|
|
Verification: OK
|
|
Verified peername: smtp.example.com
|
|
DANE TLSA 2 1 1 ...ee12d2cc90180517616e8a18 matched TA certificate at depth 1
|
|
...</pre>
|
|
</dd>
|
|
<dt><strong><a name="dane_ee_no_namechecks" class="item"><strong>-dane_ee_no_namechecks</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This disables server name checks when authenticating via DANE-EE(3) TLSA
|
|
records.
|
|
For some applications, primarily web browsers, it is not safe to disable name
|
|
checks due to "unknown key share" attacks, in which a malicious server can
|
|
convince a client that a connection to a victim server is instead a secure
|
|
connection to the malicious server.
|
|
The malicious server may then be able to violate cross-origin scripting
|
|
restrictions.
|
|
Thus, despite the text of <a href="http://www.ietf.org/rfc/rfc7671.txt" class="rfc">RFC7671</a>, name checks are by default enabled for
|
|
DANE-EE(3) TLSA records, and can be disabled in applications where it is safe
|
|
to do so.
|
|
In particular, SMTP and XMPP clients should set this option as SRV and MX
|
|
records already make it possible for a remote domain to redirect client
|
|
connections to any server of its choice, and in any case SMTP and XMPP clients
|
|
do not execute scripts downloaded from remote servers.</p>
|
|
</dd>
|
|
<dt><strong><a name="attime_check_ss_sig_crl_check_crl_check_all_explicit_policy_extended_crl_ignore_critical_inhibit_any_inhibit_map_no_alt_chains_no_check_time_partial_chain_policy_policy_check_policy_print_purpose_suiteb_128_suiteb_128_only_suiteb_192_trusted_first_use_deltas_auth_level_verify_depth_verify_email_verify_hostname_verify_ip_verify_name_x509_strict" class="item"><strong>-attime</strong>, <strong>-check_ss_sig</strong>, <strong>-crl_check</strong>, <strong>-crl_check_all</strong>,
|
|
<strong>-explicit_policy</strong>, <strong>-extended_crl</strong>, <strong>-ignore_critical</strong>, <strong>-inhibit_any</strong>,
|
|
<strong>-inhibit_map</strong>, <strong>-no_alt_chains</strong>, <strong>-no_check_time</strong>, <strong>-partial_chain</strong>, <strong>-policy</strong>,
|
|
<strong>-policy_check</strong>, <strong>-policy_print</strong>, <strong>-purpose</strong>, <strong>-suiteB_128</strong>,
|
|
<strong>-suiteB_128_only</strong>, <strong>-suiteB_192</strong>, <strong>-trusted_first</strong>, <strong>-use_deltas</strong>,
|
|
<strong>-auth_level</strong>, <strong>-verify_depth</strong>, <strong>-verify_email</strong>, <strong>-verify_hostname</strong>,
|
|
<strong>-verify_ip</strong>, <strong>-verify_name</strong>, <strong>-x509_strict</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Set various certificate chain validation options. See the
|
|
<em>verify(1)</em> manual page for details.</p>
|
|
</dd>
|
|
<dt><strong><a name="reconnect" class="item"><strong>-reconnect</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Reconnects to the same server 5 times using the same session ID, this can
|
|
be used as a test that session caching is working.</p>
|
|
</dd>
|
|
<dt><strong><a name="showcerts" class="item"><strong>-showcerts</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Displays the server certificate list as sent by the server: it only consists of
|
|
certificates the server has sent (in the order the server has sent them). It is
|
|
<strong>not</strong> a verified chain.</p>
|
|
</dd>
|
|
<dt><strong><a name="prexit" class="item"><strong>-prexit</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Print session information when the program exits. This will always attempt
|
|
to print out information even if the connection fails. Normally information
|
|
will only be printed out once if the connection succeeds. This option is useful
|
|
because the cipher in use may be renegotiated or the connection may fail
|
|
because a client certificate is required or is requested only after an
|
|
attempt is made to access a certain URL. Note: the output produced by this
|
|
option is not always accurate because a connection might never have been
|
|
established.</p>
|
|
</dd>
|
|
<dt><strong><a name="state" class="item"><strong>-state</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Prints out the SSL session states.</p>
|
|
</dd>
|
|
<dt><strong><a name="debug" class="item"><strong>-debug</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Print extensive debugging information including a hex dump of all traffic.</p>
|
|
</dd>
|
|
<dt><strong><a name="msg" class="item"><strong>-msg</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Show all protocol messages with hex dump.</p>
|
|
</dd>
|
|
<dt><strong><a name="trace" class="item"><strong>-trace</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Show verbose trace output of protocol messages. OpenSSL needs to be compiled
|
|
with <strong>enable-ssl-trace</strong> for this option to work.</p>
|
|
</dd>
|
|
<dt><strong><a name="msgfile" class="item"><strong>-msgfile</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>File to send output of <strong>-msg</strong> or <strong>-trace</strong> to, default standard output.</p>
|
|
</dd>
|
|
<dt><strong><a name="nbio_test" class="item"><strong>-nbio_test</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Tests non-blocking I/O</p>
|
|
</dd>
|
|
<dt><strong><a name="nbio" class="item"><strong>-nbio</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Turns on non-blocking I/O</p>
|
|
</dd>
|
|
<dt><strong><a name="crlf" class="item"><strong>-crlf</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This option translated a line feed from the terminal into CR+LF as required
|
|
by some servers.</p>
|
|
</dd>
|
|
<dt><strong><a name="ign_eof" class="item"><strong>-ign_eof</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Inhibit shutting down the connection when end of file is reached in the
|
|
input.</p>
|
|
</dd>
|
|
<dt><strong><a name="quiet" class="item"><strong>-quiet</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Inhibit printing of session and certificate information. This implicitly
|
|
turns on <strong>-ign_eof</strong> as well.</p>
|
|
</dd>
|
|
<dt><strong><a name="no_ign_eof" class="item"><strong>-no_ign_eof</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Shut down the connection when end of file is reached in the input.
|
|
Can be used to override the implicit <strong>-ign_eof</strong> after <strong>-quiet</strong>.</p>
|
|
</dd>
|
|
<dt><strong><a name="psk_identity_identity" class="item"><strong>-psk_identity identity</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use the PSK identity <strong>identity</strong> when using a PSK cipher suite.
|
|
The default value is "Client_identity" (without the quotes).</p>
|
|
</dd>
|
|
<dt><strong><a name="psk_key" class="item"><strong>-psk key</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use the PSK key <strong>key</strong> when using a PSK cipher suite. The key is
|
|
given as a hexadecimal number without leading 0x, for example -psk
|
|
1a2b3c4d.
|
|
This option must be provided in order to use a PSK cipher.</p>
|
|
</dd>
|
|
<dt><strong><a name="psk_session_file" class="item"><strong>-psk_session file</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use the pem encoded SSL_SESSION data stored in <strong>file</strong> as the basis of a PSK.
|
|
Note that this will only work if TLSv1.3 is negotiated.</p>
|
|
</dd>
|
|
<dt><strong><a name="ssl3_tls1_tls1_1_tls1_2_tls1_3_no_ssl3_no_tls1_no_tls1_1_no_tls1_2_no_tls1_3" class="item"><strong>-ssl3</strong>, <strong>-tls1</strong>, <strong>-tls1_1</strong>, <strong>-tls1_2</strong>, <strong>-tls1_3</strong>, <strong>-no_ssl3</strong>, <strong>-no_tls1</strong>, <strong>-no_tls1_1</strong>, <strong>-no_tls1_2</strong>, <strong>-no_tls1_3</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>These options require or disable the use of the specified SSL or TLS protocols.
|
|
By default <strong>s_client</strong> will negotiate the highest mutually supported protocol
|
|
version.
|
|
When a specific TLS version is required, only that version will be offered to
|
|
and accepted from the server.
|
|
Note that not all protocols and flags may be available, depending on how
|
|
OpenSSL was built.</p>
|
|
</dd>
|
|
<dt><strong><a name="dtls_dtls1_dtls1_2" class="item"><strong>-dtls</strong>, <strong>-dtls1</strong>, <strong>-dtls1_2</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>These options make <strong>s_client</strong> use DTLS protocols instead of TLS.
|
|
With <strong>-dtls</strong>, <strong>s_client</strong> will negotiate any supported DTLS protocol version,
|
|
whilst <strong>-dtls1</strong> and <strong>-dtls1_2</strong> will only support DTLS1.0 and DTLS1.2
|
|
respectively.</p>
|
|
</dd>
|
|
<dt><strong><a name="sctp" class="item"><strong>-sctp</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in
|
|
conjunction with <strong>-dtls</strong>, <strong>-dtls1</strong> or <strong>-dtls1_2</strong>. This option is only
|
|
available where OpenSSL has support for SCTP enabled.</p>
|
|
</dd>
|
|
<dt><strong><a name="sctp_label_bug" class="item"><strong>-sctp_label_bug</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use the incorrect behaviour of older OpenSSL implementations when computing
|
|
endpoint-pair shared secrets for DTLS/SCTP. This allows communication with
|
|
older broken implementations but breaks interoperability with correct
|
|
implementations. Must be used in conjunction with <strong>-sctp</strong>. This option is only
|
|
available where OpenSSL has support for SCTP enabled.</p>
|
|
</dd>
|
|
<dt><strong><a name="fallback_scsv" class="item"><strong>-fallback_scsv</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Send TLS_FALLBACK_SCSV in the ClientHello.</p>
|
|
</dd>
|
|
<dt><strong><a name="async" class="item"><strong>-async</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Switch on asynchronous mode. Cryptographic operations will be performed
|
|
asynchronously. This will only have an effect if an asynchronous capable engine
|
|
is also used via the <strong>-engine</strong> option. For test purposes the dummy async engine
|
|
(dasync) can be used (if available).</p>
|
|
</dd>
|
|
<dt><strong><a name="max_send_frag_int" class="item"><strong>-max_send_frag int</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The maximum size of data fragment to send.
|
|
See <em>SSL_CTX_set_max_send_fragment(3)</em> for further information.</p>
|
|
</dd>
|
|
<dt><strong><a name="split_send_frag_int" class="item"><strong>-split_send_frag int</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The size used to split data for encrypt pipelines. If more data is written in
|
|
one go than this value then it will be split into multiple pipelines, up to the
|
|
maximum number of pipelines defined by max_pipelines. This only has an effect if
|
|
a suitable cipher suite has been negotiated, an engine that supports pipelining
|
|
has been loaded, and max_pipelines is greater than 1. See
|
|
<em>SSL_CTX_set_split_send_fragment(3)</em> for further information.</p>
|
|
</dd>
|
|
<dt><strong><a name="max_pipelines_int" class="item"><strong>-max_pipelines int</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The maximum number of encrypt/decrypt pipelines to be used. This will only have
|
|
an effect if an engine has been loaded that supports pipelining (e.g. the dasync
|
|
engine) and a suitable cipher suite has been negotiated. The default value is 1.
|
|
See <em>SSL_CTX_set_max_pipelines(3)</em> for further information.</p>
|
|
</dd>
|
|
<dt><strong><a name="read_buf_int" class="item"><strong>-read_buf int</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The default read buffer size to be used for connections. This will only have an
|
|
effect if the buffer size is larger than the size that would otherwise be used
|
|
and pipelining is in use (see <em>SSL_CTX_set_default_read_buffer_len(3)</em> for
|
|
further information).</p>
|
|
</dd>
|
|
<dt><strong><a name="bugs" class="item"><strong>-bugs</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>There are several known bugs in SSL and TLS implementations. Adding this
|
|
option enables various workarounds.</p>
|
|
</dd>
|
|
<dt><strong><a name="comp" class="item"><strong>-comp</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Enables support for SSL/TLS compression.
|
|
This option was introduced in OpenSSL 1.1.0.
|
|
TLS compression is not recommended and is off by default as of
|
|
OpenSSL 1.1.0.</p>
|
|
</dd>
|
|
<dt><strong><a name="no_comp" class="item"><strong>-no_comp</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Disables support for SSL/TLS compression.
|
|
TLS compression is not recommended and is off by default as of
|
|
OpenSSL 1.1.0.</p>
|
|
</dd>
|
|
<dt><strong><a name="brief" class="item"><strong>-brief</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Only provide a brief summary of connection parameters instead of the
|
|
normal verbose output.</p>
|
|
</dd>
|
|
<dt><strong><a name="sigalgs_sigalglist" class="item"><strong>-sigalgs sigalglist</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Specifies the list of signature algorithms that are sent by the client.
|
|
The server selects one entry in the list based on its preferences.
|
|
For example strings, see <em>SSL_CTX_set1_sigalgs(3)</em></p>
|
|
</dd>
|
|
<dt><strong><a name="curves_curvelist" class="item"><strong>-curves curvelist</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Specifies the list of supported curves to be sent by the client. The curve is
|
|
ultimately selected by the server. For a list of all curves, use:</p>
|
|
<pre>
|
|
$ openssl ecparam -list_curves</pre>
|
|
</dd>
|
|
<dt><strong><a name="cipher_cipherlist" class="item"><strong>-cipher cipherlist</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This allows the TLSv1.2 and below cipher list sent by the client to be modified.
|
|
This list will be combined with any TLSv1.3 ciphersuites that have been
|
|
configured. Although the server determines which ciphersuite is used it should
|
|
take the first supported cipher in the list sent by the client. See the
|
|
<strong>ciphers</strong> command for more information.</p>
|
|
</dd>
|
|
<dt><strong><a name="ciphersuites_val" class="item"><strong>-ciphersuites val</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This allows the TLSv1.3 ciphersuites sent by the client to be modified. This
|
|
list will be combined with any TLSv1.2 and below ciphersuites that have been
|
|
configured. Although the server determines which cipher suite is used it should
|
|
take the first supported cipher in the list sent by the client. See the
|
|
<strong>ciphers</strong> command for more information. The format for this list is a simple
|
|
colon (":") separated list of TLSv1.3 ciphersuite names.</p>
|
|
</dd>
|
|
<dt><strong><a name="starttls_protocol" class="item"><strong>-starttls protocol</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Send the protocol-specific message(s) to switch to TLS for communication.
|
|
<strong>protocol</strong> is a keyword for the intended protocol. Currently, the only
|
|
supported keywords are "smtp", "pop3", "imap", "ftp", "xmpp", "xmpp-server",
|
|
"irc", "postgres", "mysql", "lmtp", "nntp", "sieve" and "ldap".</p>
|
|
</dd>
|
|
<dt><strong><a name="xmpphost_hostname" class="item"><strong>-xmpphost hostname</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This option, when used with "-starttls xmpp" or "-starttls xmpp-server",
|
|
specifies the host for the "to" attribute of the stream element.
|
|
If this option is not specified, then the host specified with "-connect"
|
|
will be used.</p>
|
|
<p>This option is an alias of the <strong>-name</strong> option for "xmpp" and "xmpp-server".</p>
|
|
</dd>
|
|
<dt><strong><a name="name_hostname" class="item"><strong>-name hostname</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>This option is used to specify hostname information for various protocols
|
|
used with <strong>-starttls</strong> option. Currently only "xmpp", "xmpp-server",
|
|
"smtp" and "lmtp" can utilize this <strong>-name</strong> option.</p>
|
|
<p>If this option is used with "-starttls xmpp" or "-starttls xmpp-server",
|
|
if specifies the host for the "to" attribute of the stream element. If this
|
|
option is not specified, then the host specified with "-connect" will be used.</p>
|
|
<p>If this option is used with "-starttls lmtp" or "-starttls smtp", it specifies
|
|
the name to use in the "LMTP LHLO" or "SMTP EHLO" message, respectively. If
|
|
this option is not specified, then "mail.example.com" will be used.</p>
|
|
</dd>
|
|
<dt><strong><a name="tlsextdebug" class="item"><strong>-tlsextdebug</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Print out a hex dump of any TLS extensions received from the server.</p>
|
|
</dd>
|
|
<dt><strong><a name="no_ticket" class="item"><strong>-no_ticket</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Disable <a href="http://www.ietf.org/rfc/rfc4507.txt" class="rfc">RFC4507</a>bis session ticket support.</p>
|
|
</dd>
|
|
<dt><strong><a name="sess_out_filename" class="item"><strong>-sess_out filename</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Output SSL session to <strong>filename</strong>.</p>
|
|
</dd>
|
|
<dt><strong><a name="sess_in_sess_pem" class="item"><strong>-sess_in sess.pem</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Load SSL session from <strong>filename</strong>. The client will attempt to resume a
|
|
connection from this session.</p>
|
|
</dd>
|
|
<dt><strong><a name="engine_id" class="item"><strong>-engine id</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Specifying an engine (by its unique <strong>id</strong> string) will cause <strong>s_client</strong>
|
|
to attempt to obtain a functional reference to the specified engine,
|
|
thus initialising it if needed. The engine will then be set as the default
|
|
for all available algorithms.</p>
|
|
</dd>
|
|
<dt><strong><a name="rand_file" class="item"><strong>-rand file...</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>A file or files containing random data used to seed the random number
|
|
generator.
|
|
Multiple files can be specified separated by an OS-dependent character.
|
|
The separator is <strong>;</strong> for MS-Windows, <strong>,</strong> for OpenVMS, and <strong>:</strong> for
|
|
all others.</p>
|
|
</dd>
|
|
<dt><strong><a name="writerand_file" class="item">[<strong>-writerand file</strong>]</a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Writes random data to the specified <em>file</em> upon exit.
|
|
This can be used with a subsequent <strong>-rand</strong> flag.</p>
|
|
</dd>
|
|
<dt><strong><a name="serverinfo_types" class="item"><strong>-serverinfo types</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>A list of comma-separated TLS Extension Types (numbers between 0 and
|
|
65535). Each type will be sent as an empty ClientHello TLS Extension.
|
|
The server's response (if any) will be encoded and displayed as a PEM
|
|
file.</p>
|
|
</dd>
|
|
<dt><strong><a name="status" class="item"><strong>-status</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Sends a certificate status request to the server (OCSP stapling). The server
|
|
response (if any) is printed out.</p>
|
|
</dd>
|
|
<dt><strong><a name="alpn_protocols_nextprotoneg_protocols" class="item"><strong>-alpn protocols</strong>, <strong>-nextprotoneg protocols</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>These flags enable the Enable the Application-Layer Protocol Negotiation
|
|
or Next Protocol Negotiation (NPN) extension, respectively. ALPN is the
|
|
IETF standard and replaces NPN.
|
|
The <strong>protocols</strong> list is a comma-separated list of protocol names that
|
|
the client should advertise support for. The list should contain the most
|
|
desirable protocols first. Protocol names are printable ASCII strings,
|
|
for example "http/1.1" or "spdy/3".
|
|
An empty list of protocols is treated specially and will cause the
|
|
client to advertise support for the TLS extension but disconnect just
|
|
after receiving ServerHello with a list of server supported protocols.
|
|
The flag <strong>-nextprotoneg</strong> cannot be specified if <strong>-tls1_3</strong> is used.</p>
|
|
</dd>
|
|
<dt><strong><a name="ct_noct" class="item"><strong>-ct</strong>, <strong>-noct</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Use one of these two options to control whether Certificate Transparency (CT)
|
|
is enabled (<strong>-ct</strong>) or disabled (<strong>-noct</strong>).
|
|
If CT is enabled, signed certificate timestamps (SCTs) will be requested from
|
|
the server and reported at handshake completion.</p>
|
|
<p>Enabling CT also enables OCSP stapling, as this is one possible delivery method
|
|
for SCTs.</p>
|
|
</dd>
|
|
<dt><strong><a name="ctlogfile" class="item"><strong>-ctlogfile</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>A file containing a list of known Certificate Transparency logs. See
|
|
<em>SSL_CTX_set_ctlog_list_file(3)</em> for the expected file format.</p>
|
|
</dd>
|
|
<dt><strong><a name="keylogfile_file" class="item"><strong>-keylogfile file</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Appends TLS secrets to the specified keylog file such that external programs
|
|
(like Wireshark) can decrypt TLS connections.</p>
|
|
</dd>
|
|
<dt><strong><a name="early_data_file" class="item"><strong>-early_data file</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Reads the contents of the specified file and attempts to send it as early data
|
|
to the server. This will only work with resumed sessions that support early
|
|
data and when the server accepts the early data.</p>
|
|
</dd>
|
|
<dt><strong><a name="enable_pha" class="item"><strong>-enable_pha</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>For TLSv1.3 only, send the Post-Handshake Authentication extension. This will
|
|
happen whether or not a certificate has been provided via <strong>-cert</strong>.</p>
|
|
</dd>
|
|
<dt><strong><a name="target" class="item"><strong>[target]</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Rather than providing <strong>-connect</strong>, the target hostname and optional port may
|
|
be provided as a single positional argument after all options. If neither this
|
|
nor <strong>-connect</strong> are provided, falls back to attempting to connect to localhost
|
|
on port 4433.</p>
|
|
</dd>
|
|
</dl>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="connected_commands">CONNECTED COMMANDS</a></h1>
|
|
<p>If a connection is established with an SSL server then any data received
|
|
from the server is displayed and any key presses will be sent to the
|
|
server. If end of file is reached then the connection will be closed down. When
|
|
used interactively (which means neither <strong>-quiet</strong> nor <strong>-ign_eof</strong> have been
|
|
given), then certain commands are also recognized which perform special
|
|
operations. These commands are a letter which must appear at the start of a
|
|
line. They are listed below.</p>
|
|
<dl>
|
|
<dt><strong><a name="q" class="item"><strong>Q</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>End the current SSL connection and exit.</p>
|
|
</dd>
|
|
<dt><strong><a name="r" class="item"><strong>R</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Renegotiate the SSL session (TLSv1.2 and below only).</p>
|
|
</dd>
|
|
<dt><strong><a name="b" class="item"><strong>B</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Send a heartbeat message to the server (DTLS only)</p>
|
|
</dd>
|
|
<dt><strong><a name="k" class="item"><strong>k</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Send a key update message to the server (TLSv1.3 only)</p>
|
|
</dd>
|
|
<dt><strong><a name="k" class="item"><strong>K</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Send a key update message to the server and request one back (TLSv1.3 only)</p>
|
|
</dd>
|
|
</dl>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="notes">NOTES</a></h1>
|
|
<p><strong>s_client</strong> can be used to debug SSL servers. To connect to an SSL HTTP
|
|
server the command:</p>
|
|
<pre>
|
|
openssl s_client -connect servername:443</pre>
|
|
<p>would typically be used (https uses port 443). If the connection succeeds
|
|
then an HTTP command can be given such as "GET /" to retrieve a web page.</p>
|
|
<p>If the handshake fails then there are several possible causes, if it is
|
|
nothing obvious like no client certificate then the <strong>-bugs</strong>,
|
|
<strong>-ssl3</strong>, <strong>-tls1</strong>, <strong>-no_ssl3</strong>, <strong>-no_tls1</strong> options can be tried
|
|
in case it is a buggy server. In particular you should play with these
|
|
options <strong>before</strong> submitting a bug report to an OpenSSL mailing list.</p>
|
|
<p>A frequent problem when attempting to get client certificates working
|
|
is that a web client complains it has no certificates or gives an empty
|
|
list to choose from. This is normally because the server is not sending
|
|
the clients certificate authority in its "acceptable CA list" when it
|
|
requests a certificate. By using <strong>s_client</strong> the CA list can be viewed
|
|
and checked. However some servers only request client authentication
|
|
after a specific URL is requested. To obtain the list in this case it
|
|
is necessary to use the <strong>-prexit</strong> option and send an HTTP request
|
|
for an appropriate page.</p>
|
|
<p>If a certificate is specified on the command line using the <strong>-cert</strong>
|
|
option it will not be used unless the server specifically requests
|
|
a client certificate. Therefor merely including a client certificate
|
|
on the command line is no guarantee that the certificate works.</p>
|
|
<p>If there are problems verifying a server certificate then the
|
|
<strong>-showcerts</strong> option can be used to show all the certificates sent by the
|
|
server.</p>
|
|
<p>The <strong>s_client</strong> utility is a test tool and is designed to continue the
|
|
handshake after any certificate verification errors. As a result it will
|
|
accept any certificate chain (trusted or not) sent by the peer. None test
|
|
applications should <strong>not</strong> do this as it makes them vulnerable to a MITM
|
|
attack. This behaviour can be changed by with the <strong>-verify_return_error</strong>
|
|
option: any verify errors are then returned aborting the handshake.</p>
|
|
<p>The <strong>-bind</strong> option may be useful if the server or a firewall requires
|
|
connections to come from some particular address and or port.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="bugs">BUGS</a></h1>
|
|
<p>Because this program has a lot of options and also because some of the
|
|
techniques used are rather old, the C source of <strong>s_client</strong> is rather hard to
|
|
read and not a model of how things should be done.
|
|
A typical SSL client program would be much simpler.</p>
|
|
<p>The <strong>-prexit</strong> option is a bit of a hack. We should really report
|
|
information whenever a session is renegotiated.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="see_also">SEE ALSO</a></h1>
|
|
<p><em>SSL_CONF_cmd(3)</em>, <em>sess_id(1)</em>, <em>s_server(1)</em>, <em>ciphers(1)</em>,
|
|
<em>SSL_CTX_set_max_send_fragment(3)</em>, <em>SSL_CTX_set_split_send_fragment(3)</em>,
|
|
<em>SSL_CTX_set_max_pipelines(3)</em></p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="history">HISTORY</a></h1>
|
|
<p>The <strong>-no_alt_chains</strong> option was added in OpenSSL 1.1.0.
|
|
The <strong>-name</strong> option was added in OpenSSL 1.1.1.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="copyright">COPYRIGHT</a></h1>
|
|
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
|
<p>Licensed under the OpenSSL license (the "License"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file LICENSE in the source distribution or at
|
|
<a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
|
|
|
</body>
|
|
|
|
</html>
|