-serverinfo file
A file containing one or more blocks of PEM data. Each PEM block must encode a TLS ServerHello extension (2 bytes type, 2 bytes length, followed by "length" bytes of extension data). If the client sends an empty TLS ClientHello extension matching the type, the corresponding ServerHello extension will be returned.
-no_resumption_on_reneg
Set the SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION option.
-status
Enables certificate status request support (aka OCSP stapling).
-status_verbose
Enables certificate status request support (aka OCSP stapling) and gives a verbose printout of the OCSP response.
-status_timeout nsec
Sets the timeout for OCSP response to nsec seconds.
-status_url url
Sets a fallback responder URL to use if no responder URL is present in the server certificate. Without this option an error is returned if the server certificate does not contain a responder address.
-alpn protocols, -nextprotoneg protocols
these flags enable the Enable the Application-Layer Protocol Negotiation or Next Protocol Negotiation extension, respectively. ALPN is the IETF standard and replaces NPN. The protocols list is a comma-separated list of supported protocol names. The list should contain most wanted protocols first. Protocol names are printable ASCII strings, for example "http/1.1" or "spdy/3".
CONNECTED COMMANDS
If a connection request is established with an SSL client and neither the -www nor the -WWW option has been used then normally any data received from the client is displayed and any key presses will be sent to the client.
Certain single letter commands are also recognized which perform special operations: these are listed below.
- q
-
end the current SSL connection but still accept new connections.
- Q
-
end the current SSL connection and exit.
- r
-
renegotiate the SSL session.
- R
-
renegotiate the SSL session and request a client certificate.
- P
-
send some plain text down the underlying TCP connection: this should cause the client to disconnect due to a protocol violation.
- S
-
print out some session cache status information.
NOTES
s_server can be used to debug SSL clients. To accept connections from a web browser the command:
openssl s_server -accept 443 -www
can be used for example.
Although specifying an empty list of CAs when requesting a client certificate is strictly speaking a protocol violation, some SSL clients interpret this to mean any CA is acceptable. This is useful for debugging purposes.
The session parameters can printed out using the sess_id program.
BUGS
Because this program has a lot of options and also because some of the techniques used are rather old, the C source of s_server is rather hard to read and not a model of how things should be done. A typical SSL server program would be much simpler.
The output of common ciphers is wrong: it just gives the list of ciphers that OpenSSL recognizes and the client supports.
There should be a way for the s_server program to print out details of any unknown cipher suites a client says it supports.
SEE ALSO
sess_id(1), ciphers(1)
HISTORY
The -no_alt_chains options was first added to OpenSSL 1.1.0.
COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.