Update documentation of SSL METHODs and ciphers
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
This commit is contained in:
Viktor Dukhovni
parent
1cb7757ee7
commit
8c73aeb61e
6 changed files with 291 additions and 221 deletions
|
|
@ -32,7 +32,7 @@ the appropriate cipherlist.
|
|||
|
||||
=item B<-help>
|
||||
|
||||
Print out a usage message.
|
||||
Print a usage message.
|
||||
|
||||
=item B<-s>
|
||||
|
||||
|
|
@ -53,21 +53,25 @@ L<SSL_CIPHER_description(3)>.
|
|||
|
||||
Like B<-v>, but include the official cipher suite values in hex.
|
||||
|
||||
=item B<-tls1_2>
|
||||
|
||||
In combination with the B<-s> option, list the ciphers which would be used if
|
||||
TLSv1.2 were negotiated.
|
||||
|
||||
=item B<-ssl3>
|
||||
|
||||
List the ciphers which would be used if SSL v3 was negotiated.
|
||||
In combination with the B<-s> option, list the ciphers which would be used if
|
||||
SSLv3 were negotiated.
|
||||
|
||||
=item B<-tls1>
|
||||
|
||||
List the ciphers which would be used if TLS v1.0 was negotiated.
|
||||
In combination with the B<-s> option, list the ciphers which would be used if
|
||||
TLSv1 were negotiated.
|
||||
|
||||
=item B<-tls1_1>
|
||||
|
||||
List the ciphers which would be used if TLS v1.1 was negotiated.
|
||||
|
||||
=item B<-tls1_2>
|
||||
|
||||
List the ciphers which would be used if TLS v1.2 was negotiated.
|
||||
In combination with the B<-s> option, list the ciphers which would be used if
|
||||
TLSv1.1 were negotiated.
|
||||
|
||||
=item B<-stdname>
|
||||
|
||||
|
|
@ -132,25 +136,27 @@ The following is a list of all permitted cipher strings and their meanings.
|
|||
|
||||
=item B<DEFAULT>
|
||||
|
||||
the default cipher list. This is determined at compile time and
|
||||
is B<ALL:!COMPLEMENTOFDEFAULT:!eNULL>. This must be the first cipher
|
||||
string specified.
|
||||
The default cipher list.
|
||||
This is determined at compile time and is normally
|
||||
B<ALL:!COMPLEMENTOFDEFAULT:!eNULL>.
|
||||
When used, this must be the first cipherstring specified.
|
||||
|
||||
=item B<COMPLEMENTOFDEFAULT>
|
||||
|
||||
the ciphers included in B<ALL>, but not enabled by default. Currently
|
||||
The ciphers included in B<ALL>, but not enabled by default. Currently
|
||||
this includes all RC4, DES, RC2 and anonymous ciphers. Note that this rule does
|
||||
not cover B<eNULL>, which is not included by B<ALL> (use B<COMPLEMENTOFALL> if
|
||||
necessary).
|
||||
|
||||
=item B<ALL>
|
||||
|
||||
all cipher suites except the B<eNULL> ciphers which must be explicitly enabled;
|
||||
as of OpenSSL, the B<ALL> cipher suites are reasonably ordered by default
|
||||
All cipher suites except the B<eNULL> ciphers (which must be explicitly enabled
|
||||
if needed).
|
||||
As of OpenSSL 1.0.0, the B<ALL> cipher suites are sensibly ordered by default.
|
||||
|
||||
=item B<COMPLEMENTOFALL>
|
||||
|
||||
the cipher suites not enabled by B<ALL>, currently being B<eNULL>.
|
||||
The cipher suites not enabled by B<ALL>, currently B<eNULL>.
|
||||
|
||||
=item B<HIGH>
|
||||
|
||||
|
|
@ -170,83 +176,86 @@ ciphersuites have been removed as of OpenSSL 1.1.0.
|
|||
|
||||
=item B<eNULL>, B<NULL>
|
||||
|
||||
the "NULL" ciphers that is those offering no encryption. Because these offer no
|
||||
encryption at all and are a security risk they are disabled unless explicitly
|
||||
included.
|
||||
The "NULL" ciphers that is those offering no encryption. Because these offer no
|
||||
encryption at all and are a security risk they are not enabled via either the
|
||||
B<DEFAULT> or B<ALL> cipher strings.
|
||||
Be careful when building cipherlists out of lower-level primitives such as
|
||||
B<kRSA> or B<aECDSA> as these do overlap with the B<eNULL> ciphers. When in
|
||||
doubt, include B<!eNULL> in your cipherlist.
|
||||
|
||||
=item B<aNULL>
|
||||
|
||||
the cipher suites offering no authentication. This is currently the anonymous
|
||||
The cipher suites offering no authentication. This is currently the anonymous
|
||||
DH algorithms and anonymous ECDH algorithms. These cipher suites are vulnerable
|
||||
to a "man in the middle" attack and so their use is normally discouraged.
|
||||
to "man in the middle" attacks and so their use is discouraged.
|
||||
These are excluded from the B<DEFAULT> ciphers, but included in the B<ALL>
|
||||
ciphers.
|
||||
Be careful when building cipherlists out of lower-level primitives such as
|
||||
B<kDHE> or B<AES> as these do overlap with the B<aNULL> ciphers.
|
||||
When in doubt, include B<!aNULL> in your cipherlist.
|
||||
|
||||
=item B<kRSA>, B<aRSA>, B<RSA>
|
||||
|
||||
cipher suites using RSA key exchange, authentication or either respectively.
|
||||
Cipher suites using RSA key exchange, authentication or either respectively.
|
||||
|
||||
=item B<kDHr>, B<kDHd>, B<kDH>
|
||||
|
||||
cipher suites using DH key agreement and DH certificates signed by CAs with RSA
|
||||
and DSS keys or either respectively.
|
||||
Cipher suites using static DH key agreement and DH certificates signed by CAs
|
||||
with RSA and DSS keys or either respectively.
|
||||
All these cipher suites have been removed in OpenSSL 1.1.0.
|
||||
|
||||
=item B<kDHE>, B<kEDH>
|
||||
=item B<kDHE>, B<kEDH>, B<DH>
|
||||
|
||||
cipher suites using ephemeral DH key agreement, including anonymous cipher
|
||||
Cipher suites using ephemeral DH key agreement, including anonymous cipher
|
||||
suites.
|
||||
|
||||
=item B<DHE>, B<EDH>
|
||||
|
||||
cipher suites using authenticated ephemeral DH key agreement.
|
||||
Cipher suites using authenticated ephemeral DH key agreement.
|
||||
|
||||
=item B<ADH>
|
||||
|
||||
anonymous DH cipher suites, note that this does not include anonymous Elliptic
|
||||
Anonymous DH cipher suites, note that this does not include anonymous Elliptic
|
||||
Curve DH (ECDH) cipher suites.
|
||||
|
||||
=item B<DH>
|
||||
=item B<kEECDH>, B<kECDHE>, B<ECDH>
|
||||
|
||||
cipher suites using DH, including anonymous DH, ephemeral DH and fixed DH.
|
||||
|
||||
=item B<kEECDH>, B<kECDHE>
|
||||
|
||||
cipher suites using ephemeral ECDH key agreement, including anonymous
|
||||
Cipher suites using ephemeral ECDH key agreement, including anonymous
|
||||
cipher suites.
|
||||
|
||||
=item B<ECDHE>, B<EECDH>
|
||||
|
||||
cipher suites using authenticated ephemeral ECDH key agreement.
|
||||
Cipher suites using authenticated ephemeral ECDH key agreement.
|
||||
|
||||
=item B<AECDH>
|
||||
|
||||
anonymous Elliptic Curve Diffie Hellman cipher suites.
|
||||
|
||||
=item B<ECDH>
|
||||
|
||||
cipher suites using ECDH key exchange, including anonymous and ephemeral.
|
||||
Anonymous Elliptic Curve Diffie Hellman cipher suites.
|
||||
|
||||
=item B<aDSS>, B<DSS>
|
||||
|
||||
cipher suites using DSS authentication, i.e. the certificates carry DSS keys.
|
||||
Cipher suites using DSS authentication, i.e. the certificates carry DSS keys.
|
||||
|
||||
=item B<aDH>
|
||||
|
||||
cipher suites effectively using DH authentication, i.e. the certificates carry
|
||||
Cipher suites effectively using DH authentication, i.e. the certificates carry
|
||||
DH keys.
|
||||
All these cipher suites have been removed in OpenSSL 1.1.0.
|
||||
|
||||
=item B<aECDSA>, B<ECDSA>
|
||||
|
||||
cipher suites using ECDSA authentication, i.e. the certificates carry ECDSA
|
||||
Cipher suites using ECDSA authentication, i.e. the certificates carry ECDSA
|
||||
keys.
|
||||
|
||||
=item B<TLSv1.2>, B<TLSv1.0>, B<SSLv3>
|
||||
|
||||
Lists ciphersuites which are only supported in at least TLS v1.2, TLS v1.0
|
||||
or SSL v3.0 respectively. Note: there are no ciphersuites specific to TLS v1.1.
|
||||
Since this is only the minimum version if, for example, TLS v1.0 is supported
|
||||
then both TLS v1.0 and SSL v3.0 ciphersuites are included.
|
||||
Lists ciphersuites which are only supported in at least TLS v1.2, TLS v1.0 or
|
||||
SSL v3.0 respectively.
|
||||
Note: there are no ciphersuites specific to TLS v1.1.
|
||||
Since this is only the minimum version, if, for example, TLSv1.0 is negotiated
|
||||
then both TLSv1.0 and SSLv3.0 ciphersuites are available.
|
||||
|
||||
Note: these cipher strings B<do not> change the negotiated version of SSL or
|
||||
TLS only the list of cipher suites.
|
||||
TLS, they only affect the list of available cipher suites.
|
||||
|
||||
=item B<AES128>, B<AES256>, B<AES>
|
||||
|
||||
|
|
@ -279,81 +288,85 @@ cipher suites using triple DES.
|
|||
|
||||
=item B<DES>
|
||||
|
||||
cipher suites using DES (not triple DES).
|
||||
Cipher suites using DES (not triple DES).
|
||||
All these cipher suites have been removed in OpenSSL 1.1.0.
|
||||
|
||||
=item B<RC4>
|
||||
|
||||
cipher suites using RC4.
|
||||
Cipher suites using RC4.
|
||||
|
||||
=item B<RC2>
|
||||
|
||||
cipher suites using RC2.
|
||||
Cipher suites using RC2.
|
||||
|
||||
=item B<IDEA>
|
||||
|
||||
cipher suites using IDEA.
|
||||
Cipher suites using IDEA.
|
||||
|
||||
=item B<SEED>
|
||||
|
||||
cipher suites using SEED.
|
||||
Cipher suites using SEED.
|
||||
|
||||
=item B<MD5>
|
||||
|
||||
cipher suites using MD5.
|
||||
Cipher suites using MD5.
|
||||
|
||||
=item B<SHA1>, B<SHA>
|
||||
|
||||
cipher suites using SHA1.
|
||||
Cipher suites using SHA1.
|
||||
|
||||
=item B<SHA256>, B<SHA384>
|
||||
|
||||
ciphersuites using SHA256 or SHA384.
|
||||
Ciphersuites using SHA256 or SHA384.
|
||||
|
||||
=item B<aGOST>
|
||||
=item B<aGOST>
|
||||
|
||||
cipher suites using GOST R 34.10 (either 2001 or 94) for authentication
|
||||
(needs an engine supporting GOST algorithms).
|
||||
Cipher suites using GOST R 34.10 (either 2001 or 94) for authentication
|
||||
(needs an engine supporting GOST algorithms).
|
||||
|
||||
=item B<aGOST01>
|
||||
|
||||
cipher suites using GOST R 34.10-2001 authentication.
|
||||
Cipher suites using GOST R 34.10-2001 authentication.
|
||||
|
||||
=item B<kGOST>
|
||||
|
||||
cipher suites, using VKO 34.10 key exchange, specified in the RFC 4357.
|
||||
Cipher suites, using VKO 34.10 key exchange, specified in the RFC 4357.
|
||||
|
||||
=item B<GOST94>
|
||||
|
||||
cipher suites, using HMAC based on GOST R 34.11-94.
|
||||
Cipher suites, using HMAC based on GOST R 34.11-94.
|
||||
|
||||
=item B<GOST89MAC>
|
||||
|
||||
cipher suites using GOST 28147-89 MAC B<instead of> HMAC.
|
||||
Cipher suites using GOST 28147-89 MAC B<instead of> HMAC.
|
||||
|
||||
=item B<PSK>
|
||||
|
||||
all cipher suites using pre-shared keys (PSK).
|
||||
All cipher suites using pre-shared keys (PSK).
|
||||
|
||||
=item B<kPSK>, B<kECDHEPSK>, B<kDHEPSK>, B<kRSAPSK>
|
||||
|
||||
cipher suites using PSK key exchange, ECDHE_PSK, DHE_PSK or RSA_PSK.
|
||||
Cipher suites using PSK key exchange, ECDHE_PSK, DHE_PSK or RSA_PSK.
|
||||
|
||||
=item B<aPSK>
|
||||
|
||||
cipher suites using PSK authentication (currently all PSK modes apart from
|
||||
Cipher suites using PSK authentication (currently all PSK modes apart from
|
||||
RSA_PSK).
|
||||
|
||||
=item B<SUITEB128>, B<SUITEB128ONLY>, B<SUITEB192>
|
||||
|
||||
enables suite B mode operation using 128 (permitting 192 bit mode by peer)
|
||||
Enables suite B mode of operation using 128 (permitting 192 bit mode by peer)
|
||||
128 bit (not permitting 192 bit by peer) or 192 bit level of security
|
||||
respectively. If used these cipherstrings should appear first in the cipher
|
||||
list and anything after them is ignored. Setting Suite B mode has additional
|
||||
consequences required to comply with RFC6460. In particular the supported
|
||||
signature algorithms is reduced to support only ECDSA and SHA256 or SHA384,
|
||||
only the elliptic curves P-256 and P-384 can be used and only the two suite B
|
||||
compliant ciphersuites (ECDHE-ECDSA-AES128-GCM-SHA256 and
|
||||
ECDHE-ECDSA-AES256-GCM-SHA384) are permissible.
|
||||
respectively.
|
||||
If used these cipherstrings should appear first in the cipher
|
||||
list and anything after them is ignored.
|
||||
Setting Suite B mode has additional consequences required to comply with
|
||||
RFC6460.
|
||||
In particular the supported signature algorithms is reduced to support only
|
||||
ECDSA and SHA256 or SHA384, only the elliptic curves P-256 and P-384 can be
|
||||
used and only the two suite B compliant ciphersuites
|
||||
(ECDHE-ECDSA-AES128-GCM-SHA256 and ECDHE-ECDSA-AES256-GCM-SHA384) are
|
||||
permissible.
|
||||
|
||||
=back
|
||||
|
||||
|
|
@ -473,13 +486,13 @@ Note: these ciphers can also be used in SSL v3.
|
|||
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ECDHE-RSA-DES-CBC3-SHA
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ECDHE-RSA-AES128-SHA
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ECDHE-RSA-AES256-SHA
|
||||
|
||||
|
||||
TLS_ECDHE_ECDSA_WITH_NULL_SHA ECDHE-ECDSA-NULL-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ECDHE-ECDSA-RC4-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA ECDHE-ECDSA-DES-CBC3-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDHE-ECDSA-AES128-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDHE-ECDSA-AES256-SHA
|
||||
|
||||
|
||||
TLS_ECDH_anon_WITH_NULL_SHA AECDH-NULL-SHA
|
||||
TLS_ECDH_anon_WITH_RC4_128_SHA AECDH-RC4-SHA
|
||||
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA AECDH-DES-CBC3-SHA
|
||||
|
|
|
|||
|
|
@ -64,10 +64,15 @@ B<openssl> B<s_client>
|
|||
[B<-quiet>]
|
||||
[B<-ssl3>]
|
||||
[B<-tls1>]
|
||||
[B<-tls1_1>]
|
||||
[B<-tls1_2>]
|
||||
[B<-no_ssl3>]
|
||||
[B<-no_tls1>]
|
||||
[B<-no_tls1_1>]
|
||||
[B<-no_tls1_2>]
|
||||
[B<-dtls>]
|
||||
[B<-dtls1>]
|
||||
[B<-dtls1_2>]
|
||||
[B<-fallback_scsv>]
|
||||
[B<-async>]
|
||||
[B<-bugs>]
|
||||
|
|
@ -305,15 +310,20 @@ Use the PSK key B<key> when using a PSK cipher suite. The key is
|
|||
given as a hexadecimal number without leading 0x, for example -psk
|
||||
1a2b3c4d.
|
||||
|
||||
=item B<-ssl3>, B<-tls1>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
|
||||
=item B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
|
||||
|
||||
these options disable the use of certain SSL or TLS protocols. By default
|
||||
the initial handshake uses a method which should be compatible with all
|
||||
servers and permit them to use SSL v3 or TLS as appropriate.
|
||||
These options require or disable the use of the specified SSL or TLS protocols.
|
||||
By default B<s_client> will negotiate the highest mutually supported protocol
|
||||
version.
|
||||
When a specific TLS version is required, only that version will be offered to
|
||||
and accepted from the server.
|
||||
|
||||
Unfortunately there are still ancient and broken servers in use which
|
||||
cannot handle this technique and will fail to connect. Some servers only
|
||||
work if TLS is turned off.
|
||||
=item B<-dtls>, B<-dtls1>, B<-dtls1_2>
|
||||
|
||||
These options make B<s_client> use DTLS protocols instead of TLS.
|
||||
With B<-dtls>, B<s_client> will negotiate any supported DTLS protcol version,
|
||||
whilst B<-dtls1> and B<-dtls1_2> will only support DTLS1.0 and DTLS1.2
|
||||
respectively.
|
||||
|
||||
=item B<-fallback_scsv>
|
||||
|
||||
|
|
@ -479,10 +489,10 @@ option: any verify errors are then returned aborting the handshake.
|
|||
|
||||
=head1 BUGS
|
||||
|
||||
Because this program has a lot of options and also because some of
|
||||
the techniques used are rather old, the C source of s_client is rather
|
||||
hard to read and not a model of how things should be done. A typical
|
||||
SSL client program would be much simpler.
|
||||
Because this program has a lot of options and also because some of the
|
||||
techniques used are rather old, the C source of B<s_client> is rather hard to
|
||||
read and not a model of how things should be done.
|
||||
A typical SSL client program would be much simpler.
|
||||
|
||||
The B<-prexit> option is a bit of a hack. We should really report
|
||||
information whenever a session is renegotiated.
|
||||
|
|
|
|||
|
|
@ -75,6 +75,8 @@ B<openssl> B<s_server>
|
|||
[B<-async>]
|
||||
[B<-no_ssl3>]
|
||||
[B<-no_tls1>]
|
||||
[B<-no_tls1_1>]
|
||||
[B<-no_tls1_2>]
|
||||
[B<-no_dhe>]
|
||||
[B<-bugs>]
|
||||
[B<-comp>]
|
||||
|
|
@ -116,15 +118,15 @@ Print out a usage message.
|
|||
|
||||
=item B<-accept port>
|
||||
|
||||
the TCP port to listen on for connections. If not specified 4433 is used.
|
||||
The TCP port to listen on for connections. If not specified 4433 is used.
|
||||
|
||||
=item B<-naccept count>
|
||||
|
||||
The server will exit after receiving B<number> connections, default unlimited.
|
||||
The server will exit after receiving B<number> connections, default unlimited.
|
||||
|
||||
=item B<-context id>
|
||||
|
||||
sets the SSL context id. It can be given any string value. If this option
|
||||
Sets the SSL context id. It can be given any string value. If this option
|
||||
is not present a default value will be used.
|
||||
|
||||
=item B<-cert certname>
|
||||
|
|
@ -149,12 +151,12 @@ The private format to use: DER or PEM. PEM is the default.
|
|||
|
||||
=item B<-pass arg>
|
||||
|
||||
the private key password source. For more information about the format of B<arg>
|
||||
The private key password source. For more information about the format of B<arg>
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)>.
|
||||
|
||||
=item B<-dcert filename>, B<-dkey keyname>
|
||||
|
||||
specify an additional certificate and private key, these behave in the
|
||||
Specify an additional certificate and private key, these behave in the
|
||||
same manner as the B<-cert> and B<-key> options except there is no default
|
||||
if they are not specified (no additional certificate and key is used). As
|
||||
noted above some cipher suites require a certificate containing a key of
|
||||
|
|
@ -165,24 +167,25 @@ by using an appropriate certificate.
|
|||
|
||||
=item B<-dcertform format>, B<-dkeyform format>, B<-dpass arg>
|
||||
|
||||
additional certificate and private key format and passphrase respectively.
|
||||
Additional certificate and private key format and passphrase respectively.
|
||||
|
||||
=item B<-nocert>
|
||||
|
||||
if this option is set then no certificate is used. This restricts the
|
||||
If this option is set then no certificate is used. This restricts the
|
||||
cipher suites available to the anonymous ones (currently just anonymous
|
||||
DH).
|
||||
|
||||
=item B<-dhparam filename>
|
||||
|
||||
the DH parameter file to use. The ephemeral DH cipher suites generate keys
|
||||
The DH parameter file to use. The ephemeral DH cipher suites generate keys
|
||||
using a set of DH parameters. If not specified then an attempt is made to
|
||||
load the parameters from the server certificate file. If this fails then
|
||||
a static set of parameters hard coded into the s_server program will be used.
|
||||
load the parameters from the server certificate file.
|
||||
If this fails then a static set of parameters hard coded into the B<s_server>
|
||||
program will be used.
|
||||
|
||||
=item B<-no_dhe>
|
||||
|
||||
if this option is set then no DH parameters will be loaded effectively
|
||||
If this option is set then no DH parameters will be loaded effectively
|
||||
disabling the ephemeral DH cipher suites.
|
||||
|
||||
=item B<-crl_check>, B<-crl_check_all>
|
||||
|
|
@ -242,40 +245,40 @@ If this option is used, then verification errors close the connection.
|
|||
|
||||
=item B<-state>
|
||||
|
||||
prints out the SSL session states.
|
||||
Prints the SSL session states.
|
||||
|
||||
=item B<-debug>
|
||||
|
||||
print extensive debugging information including a hex dump of all traffic.
|
||||
Print extensive debugging information including a hex dump of all traffic.
|
||||
|
||||
=item B<-msg>
|
||||
|
||||
show all protocol messages with hex dump.
|
||||
Show all protocol messages with hex dump.
|
||||
|
||||
=item B<-trace>
|
||||
|
||||
show verbose trace output of protocol messages. OpenSSL needs to be compiled
|
||||
Show verbose trace output of protocol messages. OpenSSL needs to be compiled
|
||||
with B<enable-ssl-trace> for this option to work.
|
||||
|
||||
=item B<-msgfile>
|
||||
|
||||
file to send output of B<-msg> or B<-trace> to, default standard output.
|
||||
File to send output of B<-msg> or B<-trace> to, default standard output.
|
||||
|
||||
=item B<-nbio_test>
|
||||
|
||||
tests non blocking I/O
|
||||
Tests non blocking I/O
|
||||
|
||||
=item B<-nbio>
|
||||
|
||||
turns on non blocking I/O
|
||||
Turns on non blocking I/O
|
||||
|
||||
=item B<-crlf>
|
||||
|
||||
this option translated a line feed from the terminal into CR+LF.
|
||||
This option translated a line feed from the terminal into CR+LF.
|
||||
|
||||
=item B<-quiet>
|
||||
|
||||
inhibit printing of session and certificate information.
|
||||
Inhibit printing of session and certificate information.
|
||||
|
||||
=item B<-psk_hint hint>
|
||||
|
||||
|
|
@ -287,37 +290,41 @@ Use the PSK key B<key> when using a PSK cipher suite. The key is
|
|||
given as a hexadecimal number without leading 0x, for example -psk
|
||||
1a2b3c4d.
|
||||
|
||||
=item B<-ssl3>, B<-tls1>, B<-no_ssl3>, B<-no_tls1>
|
||||
=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
|
||||
|
||||
these options disable the use of certain SSL or TLS protocols. By default
|
||||
the initial handshake uses a method which should be compatible with all
|
||||
servers and permit them to use SSL v3 or TLS as appropriate.
|
||||
These options require or disable the use of the specified SSL or TLS protocols.
|
||||
By default B<s_server> will negotiate the highest mutually supported protocol
|
||||
version.
|
||||
When a specific TLS version is required, only that version will be accepted
|
||||
from the client.
|
||||
|
||||
=item B<-dtls>, B<-dtls1>, B<-dtls1_2>
|
||||
|
||||
these options make s_server use DTLS protocols instead of TLS. With B<-dtls>
|
||||
s_server will negotiate any supported DTLS protcol version, whilst B<-dtls1> and
|
||||
B<-dtls1_2> will only support DTLS1.0 and DTLS1.2 respectively.
|
||||
These options make B<s_server> use DTLS protocols instead of TLS.
|
||||
With B<-dtls>, B<s_server> will negotiate any supported DTLS protcol version,
|
||||
whilst B<-dtls1> and B<-dtls1_2> will only support DTLSv1.0 and DTLSv1.2
|
||||
respectively.
|
||||
|
||||
=item B<-listen>
|
||||
|
||||
this option can only be used in conjunction with one of the DTLS options above.
|
||||
With this option s_server will listen on a UDP port for incoming connections.
|
||||
This option can only be used in conjunction with one of the DTLS options above.
|
||||
With this option B<s_server> will listen on a UDP port for incoming connections.
|
||||
Any ClientHellos that arrive will be checked to see if they have a cookie in
|
||||
them or not. Any without a cookie will be responded to with a
|
||||
HelloVerifyRequest. If a ClientHello with a cookie is received then s_server
|
||||
will connect to that peer and complete the handshake.
|
||||
them or not.
|
||||
Any without a cookie will be responded to with a HelloVerifyRequest.
|
||||
If a ClientHello with a cookie is received then B<s_server> will connect to
|
||||
that peer and complete the handshake.
|
||||
|
||||
=item B<-async>
|
||||
|
||||
switch on asynchronous mode. Cryptographic operations will be performed
|
||||
Switch on asynchronous mode. Cryptographic operations will be performed
|
||||
asynchronously. This will only have an effect if an asynchronous capable engine
|
||||
is also used via the B<-engine> option. For test purposes the dummy async engine
|
||||
(dasync) can be used (if available).
|
||||
|
||||
=item B<-bugs>
|
||||
|
||||
there are several known bug in SSL and TLS implementations. Adding this
|
||||
There are several known bug in SSL and TLS implementations. Adding this
|
||||
option enables various workarounds.
|
||||
|
||||
=item B<-comp>
|
||||
|
|
@ -335,12 +342,12 @@ OpenSSL 1.1.0.
|
|||
|
||||
=item B<-brief>
|
||||
|
||||
only provide a brief summary of connection parameters instead of the
|
||||
normal verbose output.
|
||||
Provide a brief summary of connection parameters instead of the normal verbose
|
||||
output.
|
||||
|
||||
=item B<-cipher cipherlist>
|
||||
|
||||
this allows the cipher list used by the server to be modified. When
|
||||
This allows the cipher list used by the server to be modified. When
|
||||
the client sends a list of supported ciphers the first client cipher
|
||||
also included in the server list is used. Because the client specifies
|
||||
the preference order, the order of the server cipherlist irrelevant. See
|
||||
|
|
@ -348,32 +355,32 @@ the B<ciphers> command for more information.
|
|||
|
||||
=item B<-serverpref>
|
||||
|
||||
use the server's cipher preferences, rather than the client's preferences.
|
||||
Use the server's cipher preferences, rather than the client's preferences.
|
||||
|
||||
=item B<-tlsextdebug>
|
||||
|
||||
print out a hex dump of any TLS extensions received from the server.
|
||||
Print a hex dump of any TLS extensions received from the server.
|
||||
|
||||
=item B<-no_ticket>
|
||||
|
||||
disable RFC4507bis session ticket support.
|
||||
Disable RFC4507bis session ticket support.
|
||||
|
||||
=item B<-www>
|
||||
|
||||
sends a status message back to the client when it connects. This includes
|
||||
lots of information about the ciphers used and various session parameters.
|
||||
Sends a status message back to the client when it connects. This includes
|
||||
information about the ciphers used and various session parameters.
|
||||
The output is in HTML format so this option will normally be used with a
|
||||
web browser.
|
||||
|
||||
=item B<-WWW>
|
||||
|
||||
emulates a simple web server. Pages will be resolved relative to the
|
||||
Emulates a simple web server. Pages will be resolved relative to the
|
||||
current directory, for example if the URL https://myhost/page.html is
|
||||
requested the file ./page.html will be loaded.
|
||||
|
||||
=item B<-HTTP>
|
||||
|
||||
emulates a simple web server. Pages will be resolved relative to the
|
||||
Emulates a simple web server. Pages will be resolved relative to the
|
||||
current directory, for example if the URL https://myhost/page.html is
|
||||
requested the file ./page.html will be loaded. The files loaded are
|
||||
assumed to contain a complete and correct HTTP response (lines that
|
||||
|
|
@ -381,26 +388,26 @@ are part of the HTTP response line and headers must end with CRLF).
|
|||
|
||||
=item B<-rev>
|
||||
|
||||
simple test server which just reverses the text received from the client
|
||||
Simple test server which just reverses the text received from the client
|
||||
and sends it back to the server. Also sets B<-brief>.
|
||||
|
||||
=item B<-engine id>
|
||||
|
||||
specifying an engine (by its unique B<id> string) will cause B<s_server>
|
||||
Specifying an engine (by its unique B<id> string) will cause B<s_server>
|
||||
to attempt to obtain a functional reference to the specified engine,
|
||||
thus initialising it if needed. The engine will then be set as the default
|
||||
for all available algorithms.
|
||||
|
||||
=item B<-id_prefix arg>
|
||||
|
||||
generate SSL/TLS session IDs prefixed by B<arg>. This is mostly useful
|
||||
Generate SSL/TLS session IDs prefixed by B<arg>. This is mostly useful
|
||||
for testing any SSL/TLS code (eg. proxies) that wish to deal with multiple
|
||||
servers, when each of which might be generating a unique range of session
|
||||
IDs (eg. with a certain prefix).
|
||||
|
||||
=item B<-rand file(s)>
|
||||
|
||||
a file or files containing random data used to seed the random number
|
||||
A file or files containing random data used to seed the random number
|
||||
generator, or an EGD socket (see L<RAND_egd(3)>).
|
||||
Multiple files can be specified separated by a OS-dependent character.
|
||||
The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
|
||||
|
|
@ -408,7 +415,7 @@ all others.
|
|||
|
||||
=item B<-serverinfo file>
|
||||
|
||||
a file containing one or more blocks of PEM data. Each PEM block
|
||||
A file containing one or more blocks of PEM data. Each PEM block
|
||||
must encode a TLS ServerHello extension (2 bytes type, 2 bytes length,
|
||||
followed by "length" bytes of extension data). If the client sends
|
||||
an empty TLS ClientHello extension matching the type, the corresponding
|
||||
|
|
@ -416,30 +423,30 @@ ServerHello extension will be returned.
|
|||
|
||||
=item B<-no_resumption_on_reneg>
|
||||
|
||||
set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag.
|
||||
Set the B<SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION> option.
|
||||
|
||||
=item B<-status>
|
||||
|
||||
enables certificate status request support (aka OCSP stapling).
|
||||
Enables certificate status request support (aka OCSP stapling).
|
||||
|
||||
=item B<-status_verbose>
|
||||
|
||||
enables certificate status request support (aka OCSP stapling) and gives
|
||||
Enables certificate status request support (aka OCSP stapling) and gives
|
||||
a verbose printout of the OCSP response.
|
||||
|
||||
=item B<-status_timeout nsec>
|
||||
|
||||
sets the timeout for OCSP response to B<nsec> seconds.
|
||||
Sets the timeout for OCSP response to B<nsec> seconds.
|
||||
|
||||
=item B<-status_url url>
|
||||
|
||||
sets a fallback responder URL to use if no responder URL is present in the
|
||||
Sets a fallback responder URL to use if no responder URL is present in the
|
||||
server certificate. Without this option an error is returned if the server
|
||||
certificate does not contain a responder address.
|
||||
|
||||
=item B<-nextprotoneg protocols>
|
||||
|
||||
enable Next Protocol Negotiation TLS extension and provide a
|
||||
Enable Next Protocol Negotiation TLS extension and provide a
|
||||
comma-separated list of supported protocol names.
|
||||
The list should contain most wanted protocols first.
|
||||
Protocol names are printable ASCII strings, for example "http/1.1" or
|
||||
|
|
@ -451,7 +458,7 @@ Protocol names are printable ASCII strings, for example "http/1.1" or
|
|||
|
||||
If a connection request is established with an SSL client and neither the
|
||||
B<-www> nor the B<-WWW> option has been used then normally any data received
|
||||
from the client is displayed and any key presses will be sent to the client.
|
||||
from the client is displayed and any key presses will be sent to the client.
|
||||
|
||||
Certain single letter commands are also recognized which perform special
|
||||
operations: these are listed below.
|
||||
|
|
@ -506,10 +513,10 @@ The session parameters can printed out using the B<sess_id> program.
|
|||
|
||||
=head1 BUGS
|
||||
|
||||
Because this program has a lot of options and also because some of
|
||||
the techniques used are rather old, the C source of s_server is rather
|
||||
hard to read and not a model of how things should be done. A typical
|
||||
SSL server program would be much simpler.
|
||||
Because this program has a lot of options and also because some of the
|
||||
techniques used are rather old, the C source of B<s_server> is rather hard to
|
||||
read and not a model of how things should be done.
|
||||
A typical SSL server program would be much simpler.
|
||||
|
||||
The output of common ciphers is wrong: it just gives the list of ciphers that
|
||||
OpenSSL recognizes and the client supports.
|
||||
|
|
|
|||
|
|
@ -122,9 +122,9 @@ than the deprecated alternative commands below.
|
|||
|
||||
=item B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
|
||||
|
||||
Disables protocol support for SSLv3, TLS 1.0, TLS 1.1 or TLS 1.2
|
||||
by setting the corresponding options B<SSL_OP_NO_SSL3>, B<SSL_OP_NO_TLS1>,
|
||||
B<SSL_OP_NO_TLS1_1> and B<SSL_OP_NO_TLS1_2> respectively.
|
||||
Disables protocol support for SSLv3, TLSv1.0, TLSv1.1 or TLSv1.2 by setting the
|
||||
corresponding options B<SSL_OP_NO_SSL3>, B<SSL_OP_NO_TLS1>, B<SSL_OP_NO_TLS1_1>
|
||||
and B<SSL_OP_NO_TLS1_2> respectively.
|
||||
These options are deprecated, instead use B<-min_protocol> and B<-max_protocol>.
|
||||
|
||||
=item B<-bugs>
|
||||
|
|
|
|||
|
|
@ -76,85 +76,88 @@ B<method> can be of the following types:
|
|||
|
||||
=over 4
|
||||
|
||||
=item SSLv3_method(), SSLv3_server_method(), SSLv3_client_method()
|
||||
|
||||
An SSL connection established with these methods will only understand
|
||||
the SSLv3 protocol.
|
||||
A client will send out a SSLv3 client hello messages and will
|
||||
indicate that it supports SSLv3.
|
||||
A server will only understand SSLv3 client hello message and only
|
||||
support the SSLv3 protocol.
|
||||
|
||||
=item TLSv1_method(), TLSv1_server_method(), TLSv1_client_method()
|
||||
|
||||
A TLS connection established with these methods will only understand
|
||||
the TLS 1.0 protocol.
|
||||
|
||||
=item TLSv1_1_method(), TLSv1_1_server_method(), TLSv1_1_client_method()
|
||||
|
||||
A TLS connection established with these methods will only understand
|
||||
the TLS 1.1 protocol.
|
||||
|
||||
=item TLSv1_2_method(), TLSv1_2_server_method(), TLSv1_2_client_method()
|
||||
|
||||
A TLS connection established with these methods will only understand
|
||||
the TLS 1.2 protocol.
|
||||
|
||||
=item TLS_method(), TLS_server_method(), TLS_client_method()
|
||||
|
||||
A TLS/SSL connection established with these methods may understand
|
||||
the SSLv3, TLSv1, TLSv1.1 and TLSv1.2 protocols.
|
||||
|
||||
If extensions are required (for example server name)
|
||||
a client will send out TLSv1 client hello messages including extensions and
|
||||
will indicate that it also understands TLSv1.1, TLSv1.2 and permits a
|
||||
fallback to SSLv3. A server will support SSLv3, TLSv1, TLSv1.1 and TLSv1.2
|
||||
protocols. This is the best choice when compatibility is a concern.
|
||||
These are the general-purpose I<version-flexible> SSL/TLS methods.
|
||||
The actual protocol version used will be negotiated to the highest version
|
||||
mutually supported by the client and the server.
|
||||
The supported protocols are SSLv3, TLSv1, TLSv1.1 and TLSv1.2.
|
||||
Most applications should use these method, and avoid the version specific
|
||||
methods described below.
|
||||
|
||||
=item SSLv23_method(), SSLv23_server_method(), SSLv23_client_method()
|
||||
|
||||
Use of these functions is deprecated. They have been replaced with TLS_method(),
|
||||
TLS_server_method() and TLS_client_method() respectively. New code should use
|
||||
those functions instead.
|
||||
Use of these functions is deprecated. They have been replaced with the above
|
||||
TLS_method(), TLS_server_method() and TLS_client_method() respectively. New
|
||||
code should use those functions instead.
|
||||
|
||||
=item TLSv1_2_method(), TLSv1_2_server_method(), TLSv1_2_client_method()
|
||||
|
||||
A TLS/SSL connection established with these methods will only understand the
|
||||
TLSv1.2 protocol.
|
||||
|
||||
=item TLSv1_1_method(), TLSv1_1_server_method(), TLSv1_1_client_method()
|
||||
|
||||
A TLS/SSL connection established with these methods will only understand the
|
||||
TLSv1.1 protocol.
|
||||
|
||||
=item TLSv1_method(), TLSv1_server_method(), TLSv1_client_method()
|
||||
|
||||
A TLS/SSL connection established with these methods will only understand the
|
||||
TLSv1 protocol.
|
||||
|
||||
=item SSLv3_method(), SSLv3_server_method(), SSLv3_client_method()
|
||||
|
||||
A TLS/SSL connection established with these methods will only understand the
|
||||
SSLv3 protocol.
|
||||
The SSLv3 protocol is deprecated and should not be used.
|
||||
|
||||
=item DTLS_method(), DTLS_server_method(), DTLS_client_method()
|
||||
|
||||
A DTLS connection established with those methods understands all
|
||||
supported DTLS protocols.
|
||||
These are the version-flexible DTLS methods.
|
||||
Currently supported protocols are DTLS 1.0 and DTLS 1.2.
|
||||
|
||||
=item DTLSv1_method(), DTLSv1_server_method(), DTLSv1_client_method()
|
||||
|
||||
A DTLS connection established with these methods will only understand
|
||||
the DTLS 1.0 protocol.
|
||||
|
||||
=item DTLSv1_2_method(), DTLSv1_2_server_method(), DTLSv1_2_client_method()
|
||||
|
||||
A DTLS connection established with these methods will only understand
|
||||
the DTLS 1.2 protocol.
|
||||
These are the version-specific methods for DTLSv1.2.
|
||||
|
||||
=item DTLSv1_method(), DTLSv1_server_method(), DTLSv1_client_method()
|
||||
|
||||
These are the version-specific methods for DTLSv1.
|
||||
|
||||
=back
|
||||
|
||||
SSL_CTX_new() initializes the list of ciphers, the session cache setting, the
|
||||
callbacks, the keys and certificates and the options to their default values.
|
||||
|
||||
TLS_method(), TLS_server_method(), TLS_client_method(), DTLS_method(),
|
||||
DTLS_server_method() and DTLS_client_method() are the version
|
||||
flexible methods.
|
||||
DTLS_server_method() and DTLS_client_method() are the I<version-flexible>
|
||||
methods.
|
||||
All other methods only support one specific protocol version.
|
||||
Use these methods instead of the other version specific methods.
|
||||
Use the I<version-flexible> methods instead of the version specific methods.
|
||||
|
||||
If you want to limit the supported protocols for the version flexible
|
||||
methods you can use SSL_CTX_set_min_proto_version(),
|
||||
SSL_set_min_proto_version(), SSL_CTX_set_max_proto_version() and
|
||||
SSL_set_max_proto_version() functions.
|
||||
They can also be limited by setting an option like B<SSL_OP_NO_SSLv3>
|
||||
via the L<SSL_CTX_set_options(3)> or L<SSL_set_options(3)> functions,
|
||||
but that's not recommended.
|
||||
methods you can use L<SSL_CTX_set_min_proto_version(3)>,
|
||||
L<SSL_set_min_proto_version(3)>, L<SSL_CTX_set_max_proto_version(3)> and
|
||||
LSSL_set_max_proto_version(3)> functions.
|
||||
Using these functions it is possible to choose e.g. TLS_server_method()
|
||||
and be able to negotiate with all possible clients, but to only
|
||||
allow newer protocols like TLS 1.0, TLS 1.1 or TLS 1.2.
|
||||
|
||||
SSL_CTX_new() initializes the list of ciphers, the session cache
|
||||
setting, the callbacks, the keys and certificates and the options
|
||||
to its default values.
|
||||
The list of protocols available can also be limited using the
|
||||
B<SSL_OP_NO_SSLv3>, B<SSL_OP_NO_TLSv1>, B<SSL_OP_NO_TLSv1_1> and
|
||||
B<SSL_OP_NO_TLSv1_2> options of the L<SSL_CTX_set_options(3)> or
|
||||
L<SSL_set_options(3)> functions, but this approach is not recommended.
|
||||
Clients should avoid creating "holes" in the set of protocols they support.
|
||||
When disabling a protocol, make sure that you also disable either all previous
|
||||
or all subsequent protocol versions.
|
||||
In clients, when a protocol version is disabled without disabling I<all>
|
||||
previous protocol versions, the effect is to also disable all subsequent
|
||||
protocol versions.
|
||||
|
||||
The SSLv3 protocol is deprecated and should generally not be used.
|
||||
Applications should typically use L<SSL_CTX_set_min_proto_version(3)> to set
|
||||
the minimum protocol to at least B<TLS1_VERSION>.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
|
|
@ -164,8 +167,8 @@ The following return values can occur:
|
|||
|
||||
=item NULL
|
||||
|
||||
The creation of a new SSL_CTX object failed. Check the error stack to
|
||||
find out the reason.
|
||||
The creation of a new SSL_CTX object failed. Check the error stack to find out
|
||||
the reason.
|
||||
|
||||
=item Pointer to an SSL_CTX object
|
||||
|
||||
|
|
@ -185,8 +188,7 @@ and TLS_client_method() functions were introduced in OpenSSL 1.1.0.
|
|||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<SSL_CTX_free(3)>, L<SSL_accept(3)>,
|
||||
L<SSL_CTX_set_min_proto_version(3)>,
|
||||
L<ssl(3)>, L<SSL_set_connect_state(3)>
|
||||
L<SSL_CTX_set_options(3)>, L<SSL_CTX_free(3)>, L<SSL_accept(3)>,
|
||||
L<SSL_CTX_set_min_proto_version(3)>, L<ssl(3)>, L<SSL_set_connect_state(3)>
|
||||
|
||||
=cut
|
||||
|
|
|
|||
|
|
@ -118,29 +118,67 @@ protocol methods defined in B<SSL_METHOD> structures.
|
|||
|
||||
=over 4
|
||||
|
||||
=item const SSL_METHOD *B<SSLv3_client_method>(void);
|
||||
=item const SSL_METHOD *B<TLS_method>(void);
|
||||
|
||||
Constructor for the SSLv3 SSL_METHOD structure for a dedicated client.
|
||||
Constructor for the I<version-flexible> SSL_METHOD structure for clients,
|
||||
servers or both.
|
||||
See L<SSL_CTX_new(3)> for details.
|
||||
|
||||
=item const SSL_METHOD *B<SSLv3_server_method>(void);
|
||||
=item const SSL_METHOD *B<TLS_client_method>(void);
|
||||
|
||||
Constructor for the SSLv3 SSL_METHOD structure for a dedicated server.
|
||||
Constructor for the I<version-flexible> SSL_METHOD structure for clients.
|
||||
|
||||
=item const SSL_METHOD *B<SSLv3_method>(void);
|
||||
=item const SSL_METHOD *B<TLS_server_method>(void);
|
||||
|
||||
Constructor for the SSLv3 SSL_METHOD structure for combined client and server.
|
||||
Constructor for the I<version-flexible> SSL_METHOD structure for servers.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_client_method>(void);
|
||||
=item const SSL_METHOD *B<TLSv1_2_method>(void);
|
||||
|
||||
Constructor for the TLSv1 SSL_METHOD structure for a dedicated client.
|
||||
Constructor for the TLSv1.2 SSL_METHOD structure for clients, servers or both.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_server_method>(void);
|
||||
=item const SSL_METHOD *B<TLSv1_2_client_method>(void);
|
||||
|
||||
Constructor for the TLSv1 SSL_METHOD structure for a dedicated server.
|
||||
Constructor for the TLSv1.2 SSL_METHOD structure for clients.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_2_server_method>(void);
|
||||
|
||||
Constructor for the TLSv1.2 SSL_METHOD structure for servers.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_1_method>(void);
|
||||
|
||||
Constructor for the TLSv1.1 SSL_METHOD structure for clients, servers or both.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_1_client_method>(void);
|
||||
|
||||
Constructor for the TLSv1.1 SSL_METHOD structure for clients.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_1_server_method>(void);
|
||||
|
||||
Constructor for the TLSv1.1 SSL_METHOD structure for servers.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_method>(void);
|
||||
|
||||
Constructor for the TLSv1 SSL_METHOD structure for combined client and server.
|
||||
Constructor for the TLSv1 SSL_METHOD structure for clients, servers or both.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_client_method>(void);
|
||||
|
||||
Constructor for the TLSv1 SSL_METHOD structure for clients.
|
||||
|
||||
=item const SSL_METHOD *B<TLSv1_server_method>(void);
|
||||
|
||||
Constructor for the TLSv1 SSL_METHOD structure for servers.
|
||||
|
||||
=item const SSL_METHOD *B<SSLv3_method>(void);
|
||||
|
||||
Constructor for the SSLv3 SSL_METHOD structure for clients, servers or both.
|
||||
|
||||
=item const SSL_METHOD *B<SSLv3_client_method>(void);
|
||||
|
||||
Constructor for the SSLv3 SSL_METHOD structure for clients.
|
||||
|
||||
=item const SSL_METHOD *B<SSLv3_server_method>(void);
|
||||
|
||||
Constructor for the SSLv3 SSL_METHOD structure for servers.
|
||||
|
||||
=back
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue