Remove all RFC5878 code.

[openssl.git] / doc / apps / s_server.pod

diff --git a/doc/apps/s_server.pod b/doc/apps/s_server.pod
index 2a08ee25e0d8b911296432ecb01c95851d75b612..a8e52782301c45f15ecfe1fcd48ac23913308369 100644 (file)
--- a/doc/apps/s_server.pod
+++ b/doc/apps/s_server.pod
@@ -34,8 +34,33 @@ B<openssl> B<s_server>
 [B<-state>]
 [B<-CApath directory>]
 [B<-CAfile filename>]
 [B<-state>]
 [B<-CApath directory>]
 [B<-CAfile filename>]

+[B<-attime timestamp>]
+[B<-check_ss_sig>]
+[B<-explicit_policy>]
+[B<-extended_crl>]
+[B<-ignore_critical>]
+[B<-inhibit_any>]
+[B<-inhibit_map>]
+[B<-issuer_checks>]
+[B<-partial_chain>]
+[B<-policy arg>]
+[B<-policy_check>]
+[B<-policy_print>]
+[B<-purpose purpose>]
+[B<-suiteB_128>]
+[B<-suiteB_128_only>]
+[B<-suiteB_192>]
+[B<-trusted_first>]
+[B<-use_deltas>]
+[B<-verify_depth num>]
+[B<-verify_email email>]
+[B<-verify_hostname hostname>]
+[B<-verify_ip ip>]
+[B<-verify_name name>]
+[B<-x509_strict>]

 [B<-nocert>]
 [B<-cipher cipherlist>]
 [B<-nocert>]
 [B<-cipher cipherlist>]

+[B<-serverpref>]

 [B<-quiet>]
 [B<-no_tmp_rsa>]
 [B<-ssl2>]
 [B<-quiet>]
 [B<-no_tmp_rsa>]
 [B<-ssl2>]


@@ -45,6 +70,7 @@ B<openssl> B<s_server>
 [B<-no_ssl3>]
 [B<-no_tls1>]
 [B<-no_dhe>]
 [B<-no_ssl3>]
 [B<-no_tls1>]
 [B<-no_dhe>]

+[B<-no_ecdhe>]

 [B<-bugs>]
 [B<-brief>]
 [B<-hack>]
 [B<-bugs>]
 [B<-brief>]
 [B<-hack>]


@@ -56,7 +82,8 @@ B<openssl> B<s_server>
 [B<-no_ticket>]
 [B<-id_prefix arg>]
 [B<-rand file(s)>]
 [B<-no_ticket>]
 [B<-id_prefix arg>]
 [B<-rand file(s)>]

-
+[B<-serverinfo file>]
+[B<-no_resumption_on_reneg>]

 =head1 DESCRIPTION
 
 The B<s_server> command implements a generic SSL/TLS server which listens
 =head1 DESCRIPTION
 
 The B<s_server> command implements a generic SSL/TLS server which listens


@@ -122,7 +149,7 @@ by using an appropriate certificate.
 
 =item B<-dcertform format>, B<-dkeyform format>, B<-dpass arg>
 
 
 =item B<-dcertform format>, B<-dkeyform format>, B<-dpass arg>
 

-addtional certificate and private key format and passphrase respectively.
+additional certificate and private key format and passphrase respectively.

 
 =item B<-nocert>
 
 
 =item B<-nocert>
 


@@ -142,6 +169,11 @@ a static set of parameters hard coded into the s_server program will be used.
 if this option is set then no DH parameters will be loaded effectively
 disabling the ephemeral DH cipher suites.
 
 if this option is set then no DH parameters will be loaded effectively
 disabling the ephemeral DH cipher suites.
 

+=item B<-no_ecdhe>
+
+if this option is set then no ECDH parameters will be loaded effectively
+disabling the ephemeral ECDH cipher suites.
+

 =item B<-no_tmp_rsa>
 
 certain export cipher suites sometimes use a temporary RSA key, this option
 =item B<-no_tmp_rsa>
 
 certain export cipher suites sometimes use a temporary RSA key, this option


@@ -174,6 +206,16 @@ and to use when attempting to build the server certificate chain. The list
 is also used in the list of acceptable client CAs passed to the client when
 a certificate is requested.
 
 is also used in the list of acceptable client CAs passed to the client when
 a certificate is requested.
 

+=item B<-attime>, B<-check_ss_sig>, B<explicit_policy>, B<-extended_crl>,
+B<-ignore_critical>, B<-inhibit_any>, B<-inhibit_map>, B<-issuer_checks>,
+B<-partial_chain>, B<-policy>, B<-policy_check>, B<-policy_print>, B<-purpose>,
+B<-suiteB_128>, B<-suiteB_128_only>, B<-suiteB_192>, B<-trusted_first>,
+B<-use_deltas>, B<-verify_depth>, B<-verify_email>, B<-verify_hostname>,
+B<-verify_ip>, B<-verify_name>, B<-x509_strict>
+
+Set different peer certificate verification options.
+See the L<B<verify>|verify(1)> manual page for details.
+

 =item B<-state>
 
 prints out the SSL session states.
 =item B<-state>
 
 prints out the SSL session states.


@@ -250,6 +292,10 @@ also included in the server list is used. Because the client specifies
 the preference order, the order of the server cipherlist irrelevant. See
 the B<ciphers> command for more information.
 
 the preference order, the order of the server cipherlist irrelevant. See
 the B<ciphers> command for more information.
 

+=item B<-serverpref>
+
+use the server's cipher preferences, rather than the client's preferences.
+

 =item B<-tlsextdebug>
 
 print out a hex dump of any TLS extensions received from the server.
 =item B<-tlsextdebug>
 
 print out a hex dump of any TLS extensions received from the server.


@@ -306,6 +352,18 @@ Multiple files can be specified separated by a OS-dependent character.
 The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
 all others.
 
 The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
 all others.
 

+=item B<-serverinfo file>
+
+a file containing one or more blocks of PEM data.  Each PEM block
+must encode a TLS ServerHello extension (2 bytes type, 2 bytes length,
+followed by "length" bytes of extension data).  If the client sends
+an empty TLS ClientHello extension matching the type, the corresponding
+ServerHello extension will be returned.
+
+=item B<-no_resumption_on_reneg>
+
+set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag.
+

 =back
 
 =head1 CONNECTED COMMANDS
 =back
 
 =head1 CONNECTED COMMANDS