Index for Section 1ssl

Alphabetical listing for S

Bottom of page

s_server(1ssl)
NAME
  s_server - SSL/TLS server program

SYNOPSIS
  openssl s_server [-accept port] [-context id] [-verify depth] [-Verify
  depth] [-cert filename] [-key keyfile] [-dcert filename] [-dkey keyfile]
  [-dhparam filename] [-nbio] [-nbio_test] [-crlf] [-debug] [-state] [-CApath
  directory] [-CAfile filename] [-nocert] [-cipher cipherlist] [-quiet]
  [-no_tmp_rsa] [-ssl2] [-ssl3] [-tls1] [-no_ssl2] [-no_ssl3] [-no_tls1]
  [-no_dhe] [-bugs] [-hack] [-www] [-WWW] [-rand filename] [-engine id]

OPTIONS
  -accept port
	  The TCP port to listen on for connections. If not specified 4433 is
	  used.

  -context id
	  Sets the SSL context id. It can be given any string value. If this
	  option is not present a default value will be used.

  -cert certname
	  The certificate to use. Most server's cipher suites require the use
	  of a certificate and some require a certificate with a certain
	  public key type. For example, the DSS cipher suites require a
	  certificate containing a DSS (DSA) key. If not specified then the
	  filename server.pem will be used.

  -key keyfile
	  The private key to use. If not specified then the certificate file
	  will be used.

  -dcert filename
	  Specifies an additional certificate and private key. These behave
	  in the same manner as the -cert and -key options except there is no
	  default if they are not specified (no additional certificate and
	  key is used).	 Some cipher suites require a certificate containing
	  a key of a certain type. Some cipher suites need a certificate
	  carrying an RSA key and some a DSS (DSA) key. By using RSA and DSS
	  certificates and keys, a server can support clients which only
	  support RSA or DSS cipher suites by using an appropriate
	  certificate.

  -nocert If this option is set then no certificate is used. This restricts
	  the cipher suites available to the anonymous ones (currently just
	  anonymous DH).

  -dhparam filename
	  The DH parameter file to use. The ephemeral DH cipher suites
	  generate keys using a set of DH parameters. If not specified then
	  an attempt is made to load the parameters from the server
	  certificate file. If this fails then a static set of parameters
	  hard coded into the s_server program will be used.

  -no_dhe If this option is set then no DH parameters will be loaded
	  effectively disabling the ephemeral DH cipher suites.

  -no_tmp_rsa
	  Certain export cipher suites sometimes use a temporary RSA key,
	  this option disables temporary RSA key generation.

  -verify depth, -Verify depth
	  The verify depth to use. This specifies the maximum length of the
	  client certificate chain and makes the server request a certificate
	  from the client. With the -verify option a certificate is requested
	  but the client does not have to send one. With the -Verify option
	  the client must supply a certificate or an error occurs.

  -CApath directory
	  The directory to use for client certificate verification.  This
	  directory must be in hash format. See -verify for more information.
	  These are also used when building the server certificate chain.

  -CAfile file
	  A file containing trusted certificates to use during client
	  authentication and to use when attempting to build the server
	  certificate chain. The list is also used in the list of acceptable
	  client CAs passed to the client when a certificate is requested.

  -state  Prints out the SSL session states.

  -debug  Prints extensive debugging information including a hex dump of all
	  traffic.

  -nbio_test
	  Tests non-blocking I/O

  -nbio	  Turns on non-blocking I/O

  -crlf	  Translates a line feed from the terminal into CR+LF.

  -quiet  Inhibits printing of session and certificate information.

  -ssl2, -ssl3, -tls1, -no_ssl2, -no_ssl3, -no_tls1
	  Disables the use of certain SSL or TLS protocols. By default the
	  initial handshake uses a method which should be compatible with all
	  servers and permit them to use SSL v3, SSL v2 or TLS as
	  appropriate.

  -bugs	  There are several known bugs in SSL and TLS implementations. Adding
	  this option enables various workarounds.

  -hack	  Enables a further workaround for some early Netscape SSL code.

  -cipher cipherlist
	  Allows the cipher list used by the server to be modified.  When the
	  client sends a list of supported ciphers the first client cipher
	  also included in the server list is used. Because the client
	  specifies the preference order, the order of the server cipherlist
	  is irrelevant. See the ciphers command for more information.

  -www	  Sends a status message back to the client when it connects. This
	  includes lots of information about the ciphers used and various
	  session parameters. The output is in HTML format so this option
	  will normally be used with a web browser.

  -WWW	  Emulates a simple web server.	 Pages will be resolved relative to
	  the current directory. For example, if the URL
	  https://myhost/page.html is requested, the file ./page.html will be
	  loaded.

  -rand filename
	  A file or files containing random data used to seed the random
	  number generator, or an EGD socket. (See RAND_egd(3).) Multiple
	  files can be specified separated by an OS-dependent character. The
	  separator is a semicolon (;) for MS-Windows, a comma (,) for
	  OpenVMS, and a colon (:) for all others.

  -engine id
	  Specifying an engine (by its unique id string) will cause s_server
	  to attempt to obtain a functional reference to the specified
	  engine, thus initializing it if needed. The engine will then be set
	  as the default for all available algorithms.

  Connected Commands

  If a connection request is established with an SSL client and neither the
  -www nor the -WWW option has been used then normally any data received from
  the client is displayed and any key presses will be sent to the client.

  Certain single letter commands are also recognized which perform special
  operations. These are:

  q	  Ends the current SSL connection but still accept new connections.

  Q	  Ends the current SSL connection and exit.

  r	  Renegotiates the SSL session.

  R	  Renegotiates the SSL session and request a client certificate.

  P	  Sends some plain text down the underlying TCP connection: this
	  should cause the client to disconnect due to a protocol violation.

  S	  Prints out some session cache status information.

DESCRIPTION
  The s_server command implements a generic SSL/TLS server which listens for
  connections on a given port using SSL/TLS.

NOTES
  The <command role="strong">s_server command can be used to debug SSL
  clients. To accept connections from a web browser the following command can
  be used:

       openssl s_server -accept 443 -www

  Most web browsers (in particular Netscape and MSIE) only support RSA cipher
  suites, so they cannot connect to servers which do not use a certificate
  carrying an RSA key or a version of OpenSSL with RSA disabled.

  Although specifying an empty list of CAs when requesting a client
  certificate is strictly speaking a protocol violation, some SSL clients
  interpret this to mean any CA is acceptable. This is useful for debugging
  purposes.

  The session parameters can be printed out using the sess_id program.

RESTRICTIONS
  Because this program has a lot of options and also because some of the
  techniques used are rather old, the C source of s_server is rather hard to
  read and not a model of how things should be done. A typical SSL server
  program would be much simpler.

  The output of common ciphers is wrong. It only gives the list of ciphers
  that OpenSSL recognizes and the client supports.

  There should be a way for the s_server program to print out details of any
  unknown cipher suites a client says it supports.

SEE ALSO
  Commands: sess_id(1ssl), s_client(1ssl), ciphers(1ssl)

Index for Section 1ssl

Alphabetical listing for S

Top of page