SCLIENT(1) OpenSSL SCLIENT(1)

NAME
       sclient - SSL/TLS client program

SYNOPSIS
       ooppeennssssll sscclliieenntt [-ccoonnnneecctt hhoosstt::ppoorrtt] [-vveerriiffyy ddeepptthh] [-cceerrtt ffiilleennaammee]
       [-kkeeyy ffiilleennaammee] [-CCAAppaatthh ddiirreeccttoorryy] [-CCAAffiillee ffiilleennaammee] [-rreeccoonnnneecctt]
       [-ppaauussee] [-sshhoowwcceerrttss] [-ddeebbuugg] [-mmssgg] [-nnbbiiootteesstt] [-ssttaattee] [-nnbbiioo]
       [-ccrrllff] [-iiggnneeooff] [-qquuiieett] [-ssssll22] [-ssssll33] [-ttllss11] [-nnoossssll22]
       [-nnoossssll33] [-nnoottllss11] [-bbuuggss] [-cciipphheerr cciipphheerrlliisstt] [-ssttaarrttttllss pprroottooccooll]
       [-eennggiinnee iidd] [-rraanndd ffiillee((ss))]

DESCRIPTION
       The sscclliieenntt command implements a generic SSL/TLS client which connects
       to a remote host using SSL/TLS. It is a very useful diagnostic tool for
       SSL servers.

OOPPTTIIOONNSS
       -ccoonnnneecctt hhoosstt::ppoorrtt
           This specifies the host and optional port to connect to. If not
           specified then an attempt is made to connect to the local host on
           port 4433.

       -cceerrtt cceerrttnnaammee
           The certificate to use, if one is requested by the server. The
           default is not to use a certificate.

       -kkeeyy kkeeyyffiillee
           The private key to use. If not specified then the certificate file
           will be used.

       -vveerriiffyy ddeepptthh
           The verify depth to use. This specifies the maximum length of the
           server certificate chain and turns on server certificate
           verification.  Currently the verify operation continues after
           errors so all the problems with a certificate chain can be seen. As
           a side effect the connection will never fail due to a server
           certificate verify failure.

       -CCAAppaatthh ddiirreeccttoorryy
           The directory to use for server certificate verification. This
           directory must be in "hash format", see vveerriiffyy for more
           information. These are also used when building the client
           certificate chain.

       -CCAAffiillee ffiillee
           A file containing trusted certificates to use during server
           authentication and to use when attempting to build the client
           certificate chain.

       -rreeccoonnnneecctt
           reconnects to the same server 5 times using the same session ID,
           this can be used as a test that session caching is working.

       -ppaauussee
           pauses 1 second between each read and write call.

       -sshhoowwcceerrttss
           display the whole server certificate chain: normally only the
           server certificate itself is displayed.

       -pprreexxiitt
           print session information when the program exits. This will always
           attempt to print out information even if the connection fails.
           Normally information will only be printed out once if the
           connection succeeds. This option is useful because the cipher in
           use may be renegotiated or the connection may fail because a client
           certificate is required or is requested only after an attempt is
           made to access a certain URL. Note: the output produced by this
           option is not always accurate because a connection might never have
           been established.

       -ssttaattee
           prints out the SSL session states.

       -ddeebbuugg
           print extensive debugging information including a hex dump of all
           traffic.

       -mmssgg
           show all protocol messages with hex dump.

       -nnbbiiootteesstt
           tests non-blocking I/O

       -nnbbiioo
           turns on non-blocking I/O

       -ccrrllff
           this option translated a line feed from the terminal into CR+LF as
           required by some servers.

       -iiggnneeooff
           inhibit shutting down the connection when end of file is reached in
           the input.

       -qquuiieett
           inhibit printing of session and certificate information.  This
           implicitly turns on -iiggnneeooff as well.

       -ssssll22, -ssssll33, -ttllss11, -nnoossssll22, -nnoossssll33, -nnoottllss11
           these options disable the use of certain SSL or TLS protocols. By
           default the initial handshake uses a method which should be
           compatible with all servers and permit them to use SSL v3, SSL v2
           or TLS as appropriate.

           Unfortunately there are a lot of ancient and broken servers in use
           which cannot handle this technique and will fail to connect. Some
           servers only work if TLS is turned off with the -nnoottllss option
           others will only support SSL v2 and may need the -ssssll22 option.

       -bbuuggss
           there are several known bug in SSL and TLS implementations. Adding
           this option enables various workarounds.

       -cciipphheerr cciipphheerrlliisstt
           this allows the cipher list sent by the client to be modified.
           Although the server determines which cipher suite is used it should
           take the first supported cipher in the list sent by the client. See
           the cciipphheerrss command for more information.

       -ssttaarrttttllss pprroottooccooll
           send the protocol-specific message(s) to switch to TLS for
           communication.  pprroottooccooll is a keyword for the intended protocol.
           Currently, the only supported keywords are "smtp" and "pop3".

       -eennggiinnee iidd
           specifying an engine (by it's unique iidd string) will cause sscclliieenntt
           to attempt to obtain a functional reference to the specified
           engine, thus initialising it if needed. The engine will then be set
           as the default for all available algorithms.

       -rraanndd ffiillee((ss))
           a file or files containing random data used to seed the random
           number generator, or an EGD socket (see RANDegd(3)).  Multiple
           files can be specified separated by a OS-dependent character.  The
           separator is ;; for MS-Windows, ,, for OpenVMS, and :: for all others.

CCOONNNNEECCTTEEDD CCOOMMMMAANNDDSS
       If a connection is established with an SSL server then any data
       received from the server is displayed and any key presses will be sent
       to the server. When used interactively (which means neither -qquuiieett nor
       -iiggnneeooff have been given), the session will be renegotiated if the line
       begins with an RR, and if the line begins with a QQ or if end of file is
       reached, the connection will be closed down.

NNOOTTEESS
       sscclliieenntt can be used to debug SSL servers. To connect to an SSL HTTP
       server the command:

        openssl sclient -connect servername:443

       would typically be used (https uses port 443). If the connection
       succeeds then an HTTP command can be given such as "GET /" to retrieve
       a web page.

       If the handshake fails then there are several possible causes, if it is
       nothing obvious like no client certificate then the -bbuuggss, -ssssll22,
       -ssssll33, -ttllss11, -nnoossssll22, -nnoossssll33, -nnoottllss11 options can be tried in case
       it is a buggy server. In particular you should play with these options
       bbeeffoorree submitting a bug report to an OpenSSL mailing list.

       A frequent problem when attempting to get client certificates working
       is that a web client complains it has no certificates or gives an empty
       list to choose from. This is normally because the server is not sending
       the clients certificate authority in its "acceptable CA list" when it
       requests a certificate. By using sscclliieenntt the CA list can be viewed and
       checked. However some servers only request client authentication after
       a specific URL is requested. To obtain the list in this case it is
       necessary to use the -pprreexxiitt option and send an HTTP request for an
       appropriate page.

       If a certificate is specified on the command line using the -cceerrtt
       option it will not be used unless the server specifically requests a
       client certificate. Therefor merely including a client certificate on
       the command line is no guarantee that the certificate works.

       If there are problems verifying a server certificate then the
       -sshhoowwcceerrttss option can be used to show the whole chain.

BUGS
       Because this program has a lot of options and also because some of the
       techniques used are rather old, the C source of sclient is rather hard
       to read and not a model of how things should be done. A typical SSL
       client program would be much simpler.

       The -vveerriiffyy option should really exit if the server verification fails.

       The -pprreexxiitt option is a bit of a hack. We should really report
       information whenever a session is renegotiated.

SEE ALSO
       sessid(1), sserver(1), ciphers(1)



0.9.7l                            2004-01-04                       SCLIENT(1)