X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=doc%2Fapps%2Fs_server.pod;h=cd8a3ef74747d7ed23968126d8545d06a0faf1f6;hp=3e503e17e10713fb36e4f5d82218c1e560a225a5;hb=40e2d76becd095c7cb2749ee1b33a7a336c8c17d;hpb=e5fa864f62c096536d700d977a5eb924ad293304 diff --git a/doc/apps/s_server.pod b/doc/apps/s_server.pod index 3e503e17e1..cd8a3ef747 100644 --- a/doc/apps/s_server.pod +++ b/doc/apps/s_server.pod @@ -9,6 +9,7 @@ s_server - SSL/TLS server program B B [B<-accept port>] +[B<-naccept count>] [B<-context id>] [B<-verify depth>] [B<-Verify depth>] @@ -33,19 +34,51 @@ B B [B<-state>] [B<-CApath directory>] [B<-CAfile filename>] +[B<-no-CAfile>] +[B<-no-CApath>] +[B<-attime timestamp>] +[B<-check_ss_sig>] +[B<-explicit_policy>] +[B<-extended_crl>] +[B<-ignore_critical>] +[B<-inhibit_any>] +[B<-inhibit_map>] +[B<-issuer_checks>] +[B<-partial_chain>] +[B<-policy arg>] +[B<-policy_check>] +[B<-policy_print>] +[B<-purpose purpose>] +[B<-suiteB_128>] +[B<-suiteB_128_only>] +[B<-suiteB_192>] +[B<-trusted_first>] +[B<-no_alt_chains>] +[B<-use_deltas>] +[B<-verify_depth num>] +[B<-verify_return_error>] +[B<-verify_email email>] +[B<-verify_hostname hostname>] +[B<-verify_ip ip>] +[B<-verify_name name>] +[B<-x509_strict>] [B<-nocert>] [B<-cipher cipherlist>] +[B<-serverpref>] [B<-quiet>] [B<-no_tmp_rsa>] -[B<-ssl2>] [B<-ssl3>] [B<-tls1>] -[B<-no_ssl2>] +[B<-dtls>] +[B<-dtls1>] +[B<-dtls1_2>] +[B<-listen>] [B<-no_ssl3>] [B<-no_tls1>] [B<-no_dhe>] +[B<-no_ecdhe>] [B<-bugs>] -[B<-hack>] +[B<-brief>] [B<-www>] [B<-WWW>] [B<-HTTP>] @@ -54,6 +87,13 @@ B B [B<-no_ticket>] [B<-id_prefix arg>] [B<-rand file(s)>] +[B<-serverinfo file>] +[B<-no_resumption_on_reneg>] +[B<-status>] +[B<-status_verbose>] +[B<-status_timeout nsec>] +[B<-status_url url>] +[B<-nextprotoneg protocols>] =head1 DESCRIPTION @@ -62,12 +102,21 @@ for connections on a given port using SSL/TLS. =head1 OPTIONS +In addition to the options below the B utility also supports the +common and server only options documented in the +L manual +page. + =over 4 =item B<-accept port> the TCP port to listen on for connections. If not specified 4433 is used. +=item B<-naccept count> + +The server will exit after receiving B connections, default unlimited. + =item B<-context id> sets the SSL context id. It can be given any string value. If this option @@ -96,7 +145,7 @@ The private format to use: DER or PEM. PEM is the default. =item B<-pass arg> the private key password source. For more information about the format of B -see the B section in L. +see the B section in L. =item B<-dcert filename>, B<-dkey keyname> @@ -111,7 +160,7 @@ by using an appropriate certificate. =item B<-dcertform format>, B<-dkeyform format>, B<-dpass arg> -addtional certificate and private key format and passphrase respectively. +additional certificate and private key format and passphrase respectively. =item B<-nocert> @@ -131,19 +180,16 @@ a static set of parameters hard coded into the s_server program will be used. if this option is set then no DH parameters will be loaded effectively disabling the ephemeral DH cipher suites. +=item B<-no_ecdhe> + +if this option is set then no ECDH parameters will be loaded effectively +disabling the ephemeral ECDH cipher suites. + =item B<-no_tmp_rsa> certain export cipher suites sometimes use a temporary RSA key, this option disables temporary RSA key generation. -=item B<-verify depth>, B<-Verify depth> - -The verify depth to use. This specifies the maximum length of the -client certificate chain and makes the server request a certificate from -the client. With the B<-verify> option a certificate is requested but the -client does not have to send one, with the B<-Verify> option the client -must supply a certificate or an error occurs. - =item B<-crl_check>, B<-crl_check_all> Check the peer certificate has not been revoked by its CA. @@ -163,6 +209,41 @@ and to use when attempting to build the server certificate chain. The list is also used in the list of acceptable client CAs passed to the client when a certificate is requested. +=item B<-no-CAfile> + +Do not load the trusted CA certificates from the default file location + +=item B<-no-CApath> + +Do not load the trusted CA certificates from the default directory location + +=item B<-verify depth>, B<-Verify depth> + +The verify depth to use. This specifies the maximum length of the +client certificate chain and makes the server request a certificate from +the client. With the B<-verify> option a certificate is requested but the +client does not have to send one, with the B<-Verify> option the client +must supply a certificate or an error occurs. + +If the ciphersuite cannot request a client certificate (for example an +anonymous ciphersuite or PSK) this option has no effect. + +=item B<-attime>, B<-check_ss_sig>, B, B<-extended_crl>, +B<-ignore_critical>, B<-inhibit_any>, B<-inhibit_map>, B<-issuer_checks>, +B<-partial_chain>, B<-policy>, B<-policy_check>, B<-policy_print>, B<-purpose>, +B<-suiteB_128>, B<-suiteB_128_only>, B<-suiteB_192>, B<-trusted_first>, +B<-no_alt_chains>, B<-use_deltas>, B<-verify_depth>, B<-verify_email>, +B<-verify_hostname>, B<-verify_ip>, B<-verify_name>, B<-x509_strict> + +Set different peer certificate verification options. +See the L manual page for details. + +=item B<-verify_return_error> + +Verification errors normally just print a message but allow the +connection to continue, for debugging purposes. +If this option is used, then verification errors close the connection. + =item B<-state> prints out the SSL session states. @@ -175,6 +256,15 @@ print extensive debugging information including a hex dump of all traffic. show all protocol messages with hex dump. +=item B<-trace> + +show verbose trace output of protocol messages. OpenSSL needs to be compiled +with B for this option to work. + +=item B<-msgfile> + +file to send output of B<-msg> or B<-trace> to, default standard output. + =item B<-nbio_test> tests non blocking I/O @@ -201,21 +291,36 @@ Use the PSK key B when using a PSK cipher suite. The key is given as a hexadecimal number without leading 0x, for example -psk 1a2b3c4d. -=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1> +=item B<-ssl3>, B<-tls1>, B<-no_ssl3>, B<-no_tls1> these options disable the use of certain SSL or TLS protocols. By default the initial handshake uses a method which should be compatible with all -servers and permit them to use SSL v3, SSL v2 or TLS as appropriate. +servers and permit them to use SSL v3 or TLS as appropriate. + +=item B<-dtls>, B<-dtls1>, B<-dtls1_2> + +these options make s_server use DTLS protocols instead of TLS. With B<-dtls> +s_server will negotiate any supported DTLS protcol version, whilst B<-dtls1> and +B<-dtls1_2> will only support DTLS1.0 and DTLS1.2 respectively. + +=item B<-listen> + +this option can only be used in conjunction with one of the DTLS options above. +With this option s_server will listen on a UDP port for incoming connections. +Any ClientHellos that arrive will be checked to see if they have a cookie in +them or not. Any without a cookie will be responded to with a +HelloVerifyRequest. If a ClientHello with a cookie is received then s_server +will connect to that peer and complete the handshake. =item B<-bugs> there are several known bug in SSL and TLS implementations. Adding this option enables various workarounds. -=item B<-hack> +=item B<-brief> -this option enables a further workaround for some some early Netscape -SSL code (?). +only provide a brief summary of connection parameters instead of the +normal verbose output. =item B<-cipher cipherlist> @@ -225,6 +330,10 @@ also included in the server list is used. Because the client specifies the preference order, the order of the server cipherlist irrelevant. See the B command for more information. +=item B<-serverpref> + +use the server's cipher preferences, rather than the client's preferences. + =item B<-tlsextdebug> print out a hex dump of any TLS extensions received from the server. @@ -254,6 +363,11 @@ requested the file ./page.html will be loaded. The files loaded are assumed to contain a complete and correct HTTP response (lines that are part of the HTTP response line and headers must end with CRLF). +=item B<-rev> + +simple test server which just reverses the text received from the client +and sends it back to the server. Also sets B<-brief>. + =item B<-engine id> specifying an engine (by its unique B string) will cause B @@ -271,11 +385,50 @@ IDs (eg. with a certain prefix). =item B<-rand file(s)> a file or files containing random data used to seed the random number -generator, or an EGD socket (see L). +generator, or an EGD socket (see L). Multiple files can be specified separated by a OS-dependent character. The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for all others. +=item B<-serverinfo file> + +a file containing one or more blocks of PEM data. Each PEM block +must encode a TLS ServerHello extension (2 bytes type, 2 bytes length, +followed by "length" bytes of extension data). If the client sends +an empty TLS ClientHello extension matching the type, the corresponding +ServerHello extension will be returned. + +=item B<-no_resumption_on_reneg> + +set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag. + +=item B<-status> + +enables certificate status request support (aka OCSP stapling). + +=item B<-status_verbose> + +enables certificate status request support (aka OCSP stapling) and gives +a verbose printout of the OCSP response. + +=item B<-status_timeout nsec> + +sets the timeout for OCSP response to B seconds. + +=item B<-status_url url> + +sets a fallback responder URL to use if no responder URL is present in the +server certificate. Without this option an error is returned if the server +certificate does not contain a responder address. + +=item B<-nextprotoneg protocols> + +enable Next Protocol Negotiation TLS extension and provide a +comma-separated list of supported protocol names. +The list should contain most wanted protocols first. +Protocol names are printable ASCII strings, for example "http/1.1" or +"spdy/3". + =back =head1 CONNECTED COMMANDS @@ -350,6 +503,10 @@ unknown cipher suites a client says it supports. =head1 SEE ALSO -L, L, L +L, L, L + +=head1 HISTORY + +The -no_alt_chains options was first added to OpenSSL 1.1.0. =cut