Document -no-CApath and -no-CAfile

[openssl.git] / doc / apps / s_server.pod

diff --git a/doc/apps/s_server.pod b/doc/apps/s_server.pod
index a4424521b863d71cc10d2e2d9f13debfbc2629d1..cd8a3ef74747d7ed23968126d8545d06a0faf1f6 100644 (file)
--- a/doc/apps/s_server.pod
+++ b/doc/apps/s_server.pod
@@ -34,6 +34,8 @@ B<openssl> B<s_server>
 [B<-state>]
 [B<-CApath directory>]
 [B<-CAfile filename>]
+[B<-no-CAfile>]
+[B<-no-CApath>]
 [B<-attime timestamp>]
 [B<-check_ss_sig>]
 [B<-explicit_policy>]
@@ -67,13 +69,16 @@ B<openssl> B<s_server>
 [B<-no_tmp_rsa>]
 [B<-ssl3>]
 [B<-tls1>]
+[B<-dtls>]
+[B<-dtls1>]
+[B<-dtls1_2>]
+[B<-listen>]
 [B<-no_ssl3>]
 [B<-no_tls1>]
 [B<-no_dhe>]
 [B<-no_ecdhe>]
 [B<-bugs>]
 [B<-brief>]
-[B<-hack>]
 [B<-www>]
 [B<-WWW>]
 [B<-HTTP>]
@@ -140,7 +145,7 @@ The private format to use: DER or PEM. PEM is the default.
 =item B<-pass arg>
 
 the private key password source. For more information about the format of B<arg>
-see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)>.
 
 =item B<-dcert filename>, B<-dkey keyname>
 
@@ -204,6 +209,14 @@ and to use when attempting to build the server certificate chain. The list
 is also used in the list of acceptable client CAs passed to the client when
 a certificate is requested.
 
+=item B<-no-CAfile>
+
+Do not load the trusted CA certificates from the default file location
+
+=item B<-no-CApath>
+
+Do not load the trusted CA certificates from the default directory location
+
 =item B<-verify depth>, B<-Verify depth>
 
 The verify depth to use. This specifies the maximum length of the
@@ -223,7 +236,7 @@ B<-no_alt_chains>, B<-use_deltas>, B<-verify_depth>, B<-verify_email>,
 B<-verify_hostname>, B<-verify_ip>, B<-verify_name>, B<-x509_strict>
 
 Set different peer certificate verification options.
-See the L<B<verify>|verify(1)> manual page for details.
+See the L<verify(1)> manual page for details.
 
 =item B<-verify_return_error>
 
@@ -284,6 +297,21 @@ these options disable the use of certain SSL or TLS protocols. By default
 the initial handshake uses a method which should be compatible with all
 servers and permit them to use SSL v3 or TLS as appropriate.
 
+=item B<-dtls>, B<-dtls1>, B<-dtls1_2>
+
+these options make s_server use DTLS protocols instead of TLS. With B<-dtls>
+s_server will negotiate any supported DTLS protcol version, whilst B<-dtls1> and
+B<-dtls1_2> will only support DTLS1.0 and DTLS1.2 respectively.
+
+=item B<-listen>
+
+this option can only be used in conjunction with one of the DTLS options above.
+With this option s_server will listen on a UDP port for incoming connections.
+Any ClientHellos that arrive will be checked to see if they have a cookie in
+them or not. Any without a cookie will be responded to with a
+HelloVerifyRequest. If a ClientHello with a cookie is received then s_server
+will connect to that peer and complete the handshake.
+
 =item B<-bugs>
 
 there are several known bug in SSL and TLS implementations. Adding this
@@ -294,11 +322,6 @@ option enables various workarounds.
 only provide a brief summary of connection parameters instead of the
 normal verbose output.
 
-=item B<-hack>
-
-this option enables a further workaround for some some early Netscape
-SSL code (?).
-
 =item B<-cipher cipherlist>
 
 this allows the cipher list used by the server to be modified.  When
@@ -362,7 +385,7 @@ IDs (eg. with a certain prefix).
 =item B<-rand file(s)>
 
 a file or files containing random data used to seed the random number
-generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+generator, or an EGD socket (see L<RAND_egd(3)>).
 Multiple files can be specified separated by a OS-dependent character.
 The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
 all others.
@@ -480,7 +503,7 @@ unknown cipher suites a client says it supports.
 
 =head1 SEE ALSO
 
-L<sess_id(1)|sess_id(1)>, L<s_client(1)|s_client(1)>, L<ciphers(1)|ciphers(1)>
+L<sess_id(1)>, L<s_client(1)>, L<ciphers(1)>
 
 =head1 HISTORY