OPENSSL-S_SERVER(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

🌈 openssl-s_server — SSL/TLS server program 🌈

hiii bestie 💖 okay so this is the manpage for openssl-s_server, straight out of the OpenSSL manual, section 1SSL. it's lowkey a whole chonky queen and we're only doing part one rn, so hydrate, sit down, and let's get into it. ✨

👑 NAME 👑

openssl-s_server — SSL/TLS server program 💅

🦋 SYNOPSIS 🦋

openssl s_server [-help] [-port +int] [-accept val] [-unix val] [-4]
[-6] [-unlink] [-context val] [-verify int] [-Verify int] [-cert infile]
[-cert2 infile] [-certform DER|PEM|P12] [-cert_chain infile]
[-build_chain] [-serverinfo val] [-key filename|uri] [-key2
filename|uri] [-keyform DER|PEM|P12] [-pass val] [-dcert infile]
[-dcertform DER|PEM|P12] [-dcert_chain infile] [-dkey filename|uri]
[-dkeyform DER|PEM|P12] [-dpass val] [-nbio_test] [-crlf] [-debug]
[-msg] [-msgfile outfile] [-state] [-nocert] [-quiet]
[-no_resume_ephemeral] [-www] [-WWW] [-http_server_binmode]
[-no_ca_names] [-ignore_unexpected_eof] [-servername]
[-servername_fatal] [-tlsextdebug] [-HTTP] [-id_prefix val]
[-keymatexport val] [-keymatexportlen +int] [-CRL infile] [-CRLform
DER|PEM] [-crl_download] [-chainCAfile infile] [-chainCApath dir]
[-chainCAstore uri] [-verifyCAfile infile] [-verifyCApath dir]
[-verifyCAstore uri] [-no_cache] [-ext_cache] [-verify_return_error]
[-verify_quiet] [-ign_eof] [-no_ign_eof] [-no_ems] [-status]
[-status_all] [-status_verbose] [-status_timeout int] [-proxy
[http[s]://][userinfo@]host[:port][/path][?query][#fragment]] [-no_proxy
addresses] [-status_url val] [-status_file infile] [-ssl_config val]
[-trace] [-security_debug] [-security_debug_verbose] [-brief] [-rev]
[-async] [-max_send_frag +int] [-split_send_frag +int] [-max_pipelines
+int] [-naccept +int] [-read_buf +int] [-no_tx_cert_comp]
[-no_rx_cert_comp] [-dhparam infile] [-nbio] [-psk_identity val]
[-psk_hint val] [-psk val] [-psk_session file] [-srpvfile infile]
[-srpuserseed val] [-timeout] [-mtu +int] [-listen] [-sctp]
[-sctp_label_bug] [-use_srtp val] [-no_dhe] [-nextprotoneg val] [-alpn
val] [-ktls] [-sendfile] [-zerocopy_sendfile] [-keylogfile outfile]
[-recv_max_early_data int] [-max_early_data int] [-early_data]
[-stateless] [-anti_replay] [-no_anti_replay] [-num_tickets] [-tfo]
[-cert_comp] [-nameopt option] [-no_ssl3] [-no_tls1] [-no_tls1_1]
[-no_tls1_2] [-no_tls1_3] [-tls1] [-tls1_1] [-tls1_2] [-tls1_3] [-dtls]
[-dtls1] [-dtls1_2] [-allow_proxy_certs] [-attime timestamp]
[-no_check_time] [-check_ss_sig] [-crl_check] [-crl_check_all]
[-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any]
[-inhibit_map] [-partial_chain] [-policy arg] [-policy_check]
[-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only]
[-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas]
[-auth_level num] [-verify_depth num] [-verify_email email]
[-verify_hostname hostname] [-verify_ip ip] [-verify_name name]
[-x509_strict] [-issuer_checks] [-bugs] [-no_comp] [-comp] [-no_ticket]
[-serverpref] [-client_renegotiation] [-legacy_renegotiation]
[-no_renegotiation] [-no_resumption_on_reneg] [-legacy_server_connect]
[-no_legacy_server_connect] [-no_etm] [-allow_no_dhe_kex]
[-prefer_no_dhe_kex] [-prioritize_chacha] [-strict] [-sigalgs algs]
[-client_sigalgs algs] [-groups groups] [-curves curves] [-named_curve
curve] [-cipher ciphers] [-ciphersuites 1.3ciphers] [-min_protocol
minprot] [-max_protocol maxprot] [-record_padding padding]
[-debug_broken_protocol] [-no_middlebox] [-xkey infile] [-xcert file]
[-xchain file] [-xchain_build file] [-xcertform DER|PEM]> [-xkeyform
DER|PEM]> [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath]
[-CAstore uri] [-no-CAstore] [-rand files] [-writerand file] [-provider
name] [-provider-path path] [-provparam [name:]key=value] [-propquery
propq] [-enable_server_rpk] [-enable_client_rpk] [-expected-rpks]
[-ech_key filename] [-ech_dir dirname] [-ech_noretry_dir dirname]
[-ech_trialdecrypt] [-ech_greaseretries]

💫 DESCRIPTION 💫

this command runs a generic SSL/TLS server — it sits there listening for connections on a port you give it, and it speaks SSL/TLS to whoever shows up. iconic behavior honestly. 🫶

✨ OPTIONS ✨

okay so on top of everything listed here, this command ALSO supports the common and server-only options documented as "Supported Command Line Commands" over in SSL_CONF_cmd(3). two-for-one. 😌

  • -help — prints out a usage message. "help me help you," etc. 💅
  • -port +int — the TCP port to listen on for connections. if you don't say anything, 4433 is used. yes, that's the default, no cap.
  • -accept val — the optional TCP host and port to listen on for connections. if you don't specify it, *:4433 is used.
  • -unix val — Unix domain socket to accept on.
  • -4 — use IPv4 only. old reliable.
  • -6 — use IPv6 only.
  • -unlink — for -unix, unlink any existing socket first. like clearing the driveway before you park. 🚗
  • -context val — sets the SSL context id. you can give it literally any string value. if this option isn't present, a default value gets used instead.
  • -verify int, -Verify int — the verify depth to use. this is the max length of the client certificate chain, and it makes the server request a certificate from the client. with -verify (lowercase bestie) a certificate is requested but the client doesn't have to send one; with -Verify (capital, no chill) the client must supply a certificate or an error occurs, periodt.

if the cipher suite can't request a client certificate (for example an anonymous cipher suite or PSK) this option has no effect — it just sits there ✨doing nothing✨.

by default, validation of any supplied client certificate and its chain is done w.r.t. the (D)TLS Client ("sslclient") purpose. for the deets, see "Certificate Extensions" in openssl-verification-options(1).

  • -cert infile — the certificate to use. most server cipher suites really want a certificate, and some want one with a specific public key type: for example the DSS cipher suites need a certificate holding a DSS (DSA) key. if you don't specify it, the filename server.pem is used.
  • -cert2 infile — the certificate file to use for servername; default is "server2.pem".
  • -certform DER|PEM|P12 — the server certificate file format; unspecified by default. see openssl-format-options(1) for the specifics.
  • -cert_chain — a file or URI of untrusted certificates to use when you're trying to build the certificate chain related to the certificate given via -cert. these untrusted certs get sent to clients and used for generating certificate status (aka OCSP stapling) requests. the input can be in PEM, DER, or PKCS#12 format.
  • -build_chain — specify whether the application should build the server certificate chain to be provided to the client.
  • -serverinfo val — a file containing one or more blocks of PEM data. each PEM block must encode a TLS ServerHello extension (2 bytes type, 2 bytes length, followed by "length" bytes of extension data). if the client sends an empty TLS ClientHello extension matching the type, the corresponding ServerHello extension gets returned. matching energy. 💞
  • -key filename|uri — the private key to use. if you don't specify it, the certificate file will be used.
  • -key2 filename|uri — the private key file to use for servername, if it wasn't already given via -cert2.
  • -keyform DER|PEM|P12 — the key format; unspecified by default. see openssl-format-options(1).
  • -pass val — the private key and certificate file password source. for more on the format of val, see openssl-passphrase-options(1).
  • -dcert infile, -dkey filename|uri — specify an additional certificate and private key. these behave the same way as the -cert and -key options, except there's no default if you don't specify them (so: no additional certificate and key gets used). as noted above, some cipher suites need a certificate containing a key of a certain type — some cipher suites need an RSA key and some need a DSS (DSA) key. by using RSA and DSS certificates and keys, a server can support clients that only do RSA or only do DSS cipher suites, by picking the appropriate certificate. versatile queen. 👑
  • -dcert_chain — a file or URI of untrusted certificates to use when attempting to build the server certificate chain while a certificate specified via the -dcert option is in use. the input can be in PEM, DER, or PKCS#12 format.
  • -dcertform DER|PEM|P12 — the format of the additional certificate file; unspecified by default. see openssl-format-options(1).
  • -dkeyform DER|PEM|P12 — the format of the additional private key; unspecified by default. see openssl-format-options(1).
  • -dpass val — the passphrase for the additional private key and certificate. for more on the format of val, see openssl-passphrase-options(1).
  • -nbio_test — tests non blocking I/O.
  • -crlf — this option translates a line feed from the terminal into CR+LF.
  • -debug — print extensive debugging information, including a hex dump of all traffic. every byte, bestie. 👀
  • -security_debug — print output from the SSL/TLS security framework.
  • -security_debug_verbose — print more output from the SSL/TLS security framework.
  • -msg — show all protocol messages with hex dump.
  • -msgfile outfile — the file to send output of -msg or -trace to; default is standard output.
  • -state — prints the SSL session states.
  • -CRL infile — the CRL file to use.
  • -CRLform DER|PEM — the CRL file format; unspecified by default. see openssl-format-options(1).
  • -crl_download — download CRLs from distribution points given in CDP extensions of certificates.
  • -verifyCAfile filename — a file in PEM format containing trusted CA certificates (root and/or intermediate) used to verify the client certificate chain.
  • -verifyCApath dir — a directory containing trusted certificates to use for verifying client certificates. this directory must be in "hash format", see openssl-verify(1) for more.
  • -verifyCAstore uri — the URI of a store containing trusted certificates to use for verifying client certificates.

when any of -verifyCAfile, -verifyCApath, or -verifyCAstore is specified, they get loaded into a separate verification store (via SSL_CTX_set1_verify_cert_store(3)) and used for client certificate verification instead of the store built from -CAfile, -CApath, and -CAstore. note that -CAfile is the sole source of acceptable issuing CA names sent to the client in the Certificate Request message during the handshake; -CApath, -CAstore, and the -verifyCA* options do not contribute to this list. important, don't skip it. 🚨

  • -chainCAfile file — a file in PEM format containing trusted certificates to use when attempting to build the server certificate chain.

and that's where part one wraps, bestie — there's SO much more server to get through, so don't go anywhere. 💖✨

  • -chainCApath dir — a directory full of trusted certs, used to build the server cert chain you hand over to the client. ✨ Heads up bestie: this dir has to be in "hash format" — peep openssl-verify(1) for the deets.
  • -chainCAstore uri — same idea but as a URI pointing at a store of trusted certs for building that server-side chain. The URI can be a single cert or a whole collection. If it's a "file:" scheme URI it acts like -chainCAfile or -chainCApath depending on whether it points to a directory or one file. More on the "file:" scheme in ossl_store-file(7). 🫶
  • -nocert — flip this on and no certificate gets used at all. 💀 That locks you into the anonymous cipher suites (currently just anonymous DH, so… slim pickings).
  • -quiet — stops it printing session and certificate info. Shhh. 🤫
  • -no_resume_ephemeral — kills caching and tickets whenever ephemeral (EC)DH is in play.
  • -tlsextdebug — prints a hex dump of every TLS extension the server sends back. Delulu for debugging, iconic for snooping. 🔥
  • -www — sends a lil status message back to the client the moment it connects. It spills info about the ciphers used plus various session params, all in HTML so you can literally open it in a browser. 🌈 Two special URLs: "/renegcert" turns on client cert validation, and "/reneg" tells the server to request renegotiation.
  • -WWW, -HTTP — emulates a basic web server. Pages resolve relative to the current directory, so if someone requests https://myhost/page.html you're sending back ./page.html. With the -HTTP flag the files go out directly and should already contain any HTTP response headers (status line included). With -WWW instead, the server generates the headers for you and peeks at the file extension to decide the Content-Type. Extensions "html", "htm", and "php" map to text/html; everything else is text/plain. Also, the special URL "/stats" returns status info just like -www does. 👑
  • -http_server_binmode — when you're web-serving (via -WWW or -HTTP), open the files the client asks for in binary mode.
  • -no_ca_names — disables the TLS Extension CA Names. You might want this for security reasons, or for compat with certain Windows TLS implementations that straight-up crash when this extension goes over 1024 bytes. 😭
  • -ignore_unexpected_eof — some TLS implementations just do NOT send the mandatory close_notify alert on shutdown, smh. Normally if the app waits for close_notify and the peer bails without it, that's an error. Turn this on and the peer doesn't have to send it — a closed connection gets treated as if close_notify showed up anyway. More on shutting down a connection in SSL_shutdown(3).
  • -servername — the servername for the HostName TLS extension.
  • -servername_fatal — on a servername mismatch, send a fatal alert (default is a warning alert, fyi).
  • -id_prefix val — generates SSL/TLS session IDs prefixed with val. Mostly useful when you're testing SSL/TLS code (proxies and such) that juggles multiple servers, where each one might be minting its own unique range of session IDs (say, with a certain prefix). 💅
  • -keymatexport — export keying material using label.
  • -keymatexportlen — export this many bytes of keying material; default is 20.
  • -no_cache — disable the session cache.
  • -ext_cache. — disable the internal cache, then set up and use an external one.
  • -verify_return_error — normally verification errors just print a message and let the connection keep going (it's a debugging thing). Use this and verification errors close the connection. No more second chances. 💀
  • -verify_quiet — no verify output at all, except for verify errors.
  • -ign_eof — ignore input EOF (and yes, it's the default when -quiet is on).
  • -no_ign_eof — do not ignore input EOF.
  • -no_ems — disable Extended master secret negotiation.
  • -status — enables certificate status request support (aka OCSP stapling 🎀): an OCSP response gets provided for the leaf (server) certificate if the client side asks for it.
  • -status_all — like the above, but for TLS v1.3 and beyond, status responses for all certs in the chain (except the trust anchor) are provided when the client asks.
  • -status_verbose — turns on certificate status request support (OCSP stapling again) AND gives you a verbose printout of the OCSP response. Use -cert_chain to specify the cert of the server's cert signer, which you need for certificate status requests.
  • -status_timeout int — sets the OCSP response timeout to int seconds.
  • -proxy [http[s]://][userinfo@]host[:port][/path][?query][#fragment] — the HTTP(S) proxy to reach the OCSP server through, unless -no_proxy applies (see below). If the host string is an IPv6 address it must be wrapped in "[" and "]". Proxy port defaults to 80, or 443 if the scheme is "https". Other than that, an optional "http://" or "https://" prefix is ignored, along with any userinfo, path, query, and fragment parts. Defaults to the env var "http_proxy" if it's set, else "HTTP_PROXY" when no TLS is used — otherwise "https_proxy" if set, else "HTTPS_PROXY".
  • -no_proxy addresses — a list of IPs and/or DNS names of servers that should not go through an HTTP(S) proxy, separated by commas and/or whitespace (and if you use whitespace, the whole argument has to be wrapped in "..."). Default comes from the env var "no_proxy" if set, else "NO_PROXY".
  • -status_url val — sets a fallback responder URL to use when the server certificate has no responder URL in it. Without this option you get an error if the server cert doesn't contain a responder address. The optional userinfo and fragment URL components get ignored, and any query component is treated as part of the path component.
  • -status_file infile — overrides any OCSP responder URLs from the cert and always provides the OCSP Response stored in the file. The file must be in DER format. You can use this option multiple times to specify OCSP responses for every cert in the server certificate chain. 🌸
  • -ssl_config val — configure SSL_CTX using the given configuration value.
  • -trace — show verbose trace output of protocol messages.
  • -brief — give a brief summary of connection parameters instead of the usual verbose dump.
  • -rev — a simple echo server that sends back received text reversed. Also sets -brief. Can't be used alongside -early_data. 🙈
  • -async — switch on asynchronous mode, so cryptographic operations get performed asynchronously. Only actually does anything if an async-capable provider is also used via the -provider option.
  • -max_send_frag +int — the maximum size of a data fragment to send. More in SSL_CTX_set_max_send_fragment(3).
  • -split_send_frag +int — this is for pipelines. There's currently no support for cipher pipelining in libssl. See SSL_CTX_set_max_send_fragment(3) for more.
  • -max_pipelines +int — also for pipelines. Again, no cipher pipelining support in libssl right now. Check SSL_CTX_set_max_send_fragment(3).
  • -naccept +int — the server exits after it's received the specified number of connections; default is unlimited.
  • -read_buf +int — the default read buffer size for connections. Only does something if the buffer size is bigger than what would otherwise be used and pipelining is in use (see SSL_CTX_set_default_read_buffer_len(3) for the full tea).
  • -no_tx_cert_comp — disables support for sending TLSv1.3 compressed certificates.
  • -no_rx_cert_comp — disables support for receiving TLSv1.3 compressed certificates.
  • -no_comp — disable negotiation of TLS compression. Real talk: TLS compression is not recommended and has been off by default since OpenSSL 1.1.0. 🙅
  • -num_tickets — controls how many tickets get sent to the client after a full handshake in TLSv1.3. Default number of tickets is 2. Doesn't affect the number of tickets sent after a resumption handshake.
  • -dhparam infile — the DH parameter file to use. The ephemeral DH cipher suites generate keys from a set of DH parameters. If you don't specify one, it tries to load them from the server certificate file. If that fails, a static hard-coded set of parameters baked into this command gets used. ✨
  • -nbio — turns on non-blocking I/O.
  • -timeout — enable timeouts.
  • -mtu — set link-layer MTU.
  • -psk_identity val — expect the client to send PSK identity val when using a PSK cipher suite, and warn if they don't. By default the expected PSK identity is the string "Client_identity".
  • -psk_hint val — use the PSK identity hint val when using a PSK cipher suite.
  • -psk val — use the PSK key val when using a PSK cipher suite. The key is a hexadecimal number with no leading 0x, e.g. -psk 1a2b3c4d. This one's mandatory if you wanna use a PSK cipher, no cap.
  • -psk_session file — use the PEM-encoded SSL_SESSION data stored in file as the basis of a PSK. Heads up: this only works if TLSv1.3 is negotiated. 💅
  • -srpvfile — the verifier file for SRP. This option is deprecated. 😬
  • -srpuserseed — a seed string for a default user salt. Also deprecated.
  • -listen — only usable alongside one of the DTLS options above. With this on, the command listens on a UDP port for incoming connections. Any ClientHellos that show up get checked for a cookie — ones without get answered with a HelloVerifyRequest. Once a ClientHello with a cookie arrives, this command connects to that peer and completes the handshake. 🦋
  • -sctp — use SCTP as the transport protocol instead of UDP when you're doing DTLS 🌀. bestie, it MUST go with -dtls, -dtls1 or -dtls1_2 or it's literally not valid. and it's only available where OpenSSL has SCTP support compiled in, no cap.
  • -sctp_label_bug — this one makes OpenSSL use the incorrect behaviour that older OpenSSL versions had when computing endpoint-pair shared secrets for DTLS/SCTP. so like, it lets you talk to the old broken implementations… but it also breaks interoperability with the implementations that do it correctly 😭. must be used together with -sctp. only available where OpenSSL has SCTP support enabled. > yes this is a pick-your-poison situation, choose wisely 💅
  • -use_srtp — offer SRTP key management, with a colon-separated profile list.
  • -no_dhe — set this and no DH parameters get loaded, which effectively disables the ephemeral DH cipher suites. bye bye DHE ✨
  • -alpn val, -nextprotoneg val — these enable the Application-Layer Protocol Negotiation and the Next Protocol Negotiation (NPN) extensions, respectively. heads up bestie: ALPN is the IETF standard and it replaces NPN 👑. the val list is a comma-separated list of supported protocol names, and you should put the most desirable protocols first. protocol names are printable ASCII strings, like "http/1.1" or "spdy/3". important: -nextprotoneg cannot be specified if -tls1_3 is used.
  • -ktls — enable Kernel TLS for sending and receiving 🔥. this option was introduced in OpenSSL 3.2.0, and Kernel TLS is off by default as of OpenSSL 3.2.0.
  • -sendfile — if this is set and KTLS is enabled, then SSL_sendfile() gets used instead of BIO_write() to send the HTTP response the client asked for. this one is only valid when -ktls is specified alongside -WWW or -HTTP. all three, bestie, no substitutions.
  • -zerocopy_sendfile — set this and SSL_sendfile() uses the zerocopy TX mode, which gives a performance boost when it's paired with KTLS hardware offload 💨. > ⚠️ note that invalid TLS records might be transmitted if the file gets changed while it's being sent. this option depends on -sendfile; if you use it alone, -sendfile is implied and you'll get a warning. also note that KTLS sendfile on FreeBSD always runs in zerocopy mode. it's just built different 🐧
  • -keylogfile outfile — appends TLS secrets to the keylog file you name, so external programs (like Wireshark 🔍) can decrypt the TLS connections. extremely useful, lowkey iconic.
  • -max_early_data int — changes the default maximum early data bytes specified for new sessions and for any incoming early data (when used together with the -early_data flag). the default value is approximately 16k. the argument has to be an integer greater than or equal to 0.
  • -recv_max_early_data int — specify the hard limit on the maximum number of early data bytes that will be accepted. that's the ceiling, periodt.
  • -early_data — accept early data where possible 🌱. cannot be used in conjunction with -www, -WWW, -HTTP or -rev.
  • -stateless — require TLSv1.3 cookies 🍪.
  • -anti_replay, -no_anti_replay — switcheroo: turns replay protection on or off, respectively. replay protection is on by default unless it's overridden by a configuration file. when it's on, OpenSSL will automatically detect if a session ticket has been used more than once, TLSv1.3 has been negotiated, and early data is enabled on the server. a full handshake is forced if a session ticket is used a second or subsequent time. any early data that was sent will be rejected.

also note that the server manages an internal cache of session tickets 📌. if a client closes the connection without sending the close_notify alert, the corresponding session ticket is removed and a full handshake is forced.

  • -tfo — enable acceptance of TCP Fast Open (RFC7413) connections ⚡.
  • -cert_comp — pre-compresses certificates (RFC8879) that will be sent during the handshake. smol bytes, big wins.
  • -nameopt option — specifies how the subject or issuer names get displayed 👀. see openssl-namedisplay-options(1) for the deets.
  • -no_ssl3, -no_tls1, -no_tls1_1, -no_tls1_2, -no_tls1_3, -tls1, -tls1_1, -tls1_2, -tls1_3 — see "TLS Version Options" in openssl(1).
  • -dtls, -dtls1, -dtls1_2 — these specify the use of DTLS instead of TLS. see "TLS Version Options" in openssl(1).
  • -bugs, -comp, -no_comp, -no_ticket, -serverpref, -client_renegotiation, -legacy_renegotiation, -no_renegotiation, -no_resumption_on_reneg, -legacy_server_connect, -no_legacy_server_connect, -no_etm, -allow_no_dhe_kex, -prefer_no_dhe_kex, -prioritize_chacha, -strict, -sigalgs algs, -client_sigalgs algs, -groups groups, -curves curves, -named_curve curve, -cipher ciphers, -ciphersuites 1.3ciphers, -min_protocol minprot, -max_protocol maxprot, -record_padding padding, -debug_broken_protocol, -no_middlebox — see "SUPPORTED COMMAND LINE COMMANDS" in SSL_CONF_cmd(3) for details 📚.
  • -xkey infile, -xcert file, -xchain file, -xchain_build file, -xcertform DER|PEM, -xkeyform DER|PEM — set extended certificate verification options. see "Extended Verification Options" in openssl-verification-options(1) for details.
  • -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore — see "Trusted Certificate Options" in openssl-verification-options(1) for details 🔐.
  • -rand files, -writerand file — see "Random State Options" in openssl(1) for details 🎲.
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7).
  • -allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict, -issuer_checks — these set various options of certificate chain verification, see "Verification Options" in openssl-verification-options(1) for details.

and bestie, heads up: if the server requests a client certificate, then verification errors are displayed (for debugging) but the command will proceed anyway — unless you use the -verify_return_error option 🫣.

  • -enable_server_rpk — enable support for sending raw public keys (RFC7250) to the client ✨. a raw public key will be sent by the server, if it's solicited by the client, provided a suitable key and public certificate pair is configured. clients that don't support raw public keys, or that prefer X.509 certs, can still elect to receive X.509 certificates as usual — nobody's forced into anything 🫶.

raw public keys are extracted from the configured certificate/private key.

  • -enable_client_rpk — enable support for receiving raw public keys (RFC7250) from the client. use of X.509 certificates by the client becomes optional, and clients that support raw public keys may elect to use them. clients that don't support raw public keys or prefer X.509 certificates can still elect to send X.509 certificates as usual 💖.
  • -expected-rpks file — this option implies the -enable_client_rpk option and can be specified multiple times. each PEM file should contain one or more public keys, private keys or certificates. with a private key or certificate, an attempt is made to extract the associated public key. each resulting public key is added — via a call to SSL_add_expected_rpk(3) — as a valid raw public key that the client may present to be considered verified. if a client nevertheless presents an X.509 certificate, the enclosed public key is validated as though it were presented as a raw public key instead 👑.

verification success or failure is reported as a DANE verification success or failure, because verification of raw public keys is internally mapped to verification of DANE TLSA records derived from the specified keys 🔎.

  • host:port
  • -ech_key filename — load one Encrypted Client Hello (ECH) key pair 🔑.
  • -ech_dir dirname — attempt to load an ECH key pair from every file in the named directory. any keys that load successfully will be returned in 'retry_configs'.
  • -ech_noretry_dir dirname — attempt to load an ECH key pair from every file in the named directory. keys loaded this way will not be returned in 'retry_configs' 🙈.
  • -ech_trialdecrypt — when an Encrypted Client Hello (ECH) extension is seen in a ClientHello, attempt to decrypt with all known ECH private keys if necessary. without this, the ECH "config_id" is used to match against the loaded ECH private keys, and decryption is only attempted when there's a match.
  • -ech_greaseretries — if set, servers will add GREASEy ECHConfig values to those sent in retry_configs 🧈.

🌸 CONNECTED COMMANDS 🌸

so this is the part where it gets interactive, bestie. if a connection request is established with an SSL client and neither the -www nor the -WWW option has been used, then normally any data received from the client is displayed, and any key presses get sent to the client ⌨️.

certain commands are also recognized, which perform special operations ✨. these commands are a letter that must appear at the start of a line. they're listed below:

  • q — end the current SSL connection but still accept new connections.
  • Q — end the current SSL connection and exit 👋.
  • r — renegotiate the SSL session (TLSv1.2 and below only).
  • R — renegotiate the SSL session and request a client certificate (TLSv1.2 and below only).
  • P — send some plain text down the underlying TCP connection: this should cause the client to disconnect due to a protocol violation 💀.
  • S — print out some session cache status information.
  • k — send a key update message to the client (TLSv1.3 only).
  • K — send a key update message to the client and request one back (TLSv1.3 only).
  • c — send a certificate request to the client (TLSv1.3 only).

✨ NOTES ✨

this command can be used to debug SSL clients 🐞. to accept connections from a web browser, the command:

 openssl s_server -accept 443 -www

can be used, for example.

even though specifying an empty list of CAs when requesting a client certificate is strictly speaking a protocol violation, some SSL clients interpret this to mean that any CA is acceptable 👀. this is useful for debugging purposes.

the session parameters can be printed out using the openssl-sess_id(1) command 📄.

💀 BUGS 💀

okay bestie, real talk, this one's a bit of a mess and we're just gonna say it out loud 🙈

  • So like... this program has a LOT of options, and also some of the techniques it uses are rather old, which means the C source for this command is rather hard to read and not a model of how things should be done. A typical SSL server program would be much simpler. Like, way simpler. Fr fr. 😭
  • The output of common ciphers is wrong: it just gives the list of ciphers that OpenSSL recognizes and the client supports. That's not it, bestie, that's not the vibe 💀
  • There should be a way for this command to print out details of any unknown cipher suites a client says it supports. There just... isn't. Not yet. We're manifesting it ✨🕯️

👀 SEE ALSO 👀

go read these next, they're all part of the same squad fr 🫶

📜 HISTORY 📜

the lore drop 🫶 here's when everything showed up (or dipped):

  • The -no_alt_chains option was added in OpenSSL 1.1.0.
  • The -allow-no-dhe-kex and -prioritize_chacha options were added in OpenSSL 1.1.1.
  • The -srpvfile and -srpuserseed option were deprecated in OpenSSL 3.0.
  • The -enable_client_rpk, -enable_server_rpk, -no_rx_cert_comp, -no_tx_cert_comp, and -tfo options were added in OpenSSL 3.2.
  • The -status_all option was added in OpenSSL 3.6.
  • The ech options were added in OpenSSL 4.0.
  • The -engine option was removed in OpenSSL 4.0. rest in peace king 💀🕊️
  • The -expected-rpks option was added in OpenSSL 4.0.

Copyright 2000-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

that's the whole page bestie, you made it to the end 🎀✨ this was OPENSSL-S_SERVER(1SSL), from the OpenSSL 4.0.3 source, dated 2026-09-29. go forth and serve some TLS, you absolute icon 👑💅

📦 where this page comes from