OPENSSL-S_CLIENT(1ssl) OpenSSL OPENSSL-S_CLIENT(1ssl) (NAME) openssl-s_client - SSL/TLS (SYNOPSIS) openssl s_client [-help] [-ssl_config section] [-connect host:port] [-host hostname] [-port port] [-bind host:port] [-proxy host:port] [-proxy_user userid] [-proxy_pass arg] [-unix path] [-4] [-6] [-quic] [-servername name] [-noservername] [-verify depth] [-verify_return_error] [-verify_quiet] [-verifyCAfile filename] [-verifyCApath dir] [-verifyCAstore uri] [-cert filename] [-certform DER|PEM|P12] [-cert_chain filename] [-build_chain] [-CRL filename] [-CRLform DER|PEM] [-crl_download] [-key filename|uri] [-keyform DER|PEM|P12|ENGINE] [-pass arg] [-chainCAfile filename] [-chainCApath directory] [-chainCAstore uri] [-requestCAfile filename] [-dane_tlsa_domain domain] [-dane_tlsa_rrdata rrdata] [-dane_ee_no_namechecks] [-reconnect] [-showcerts] [-prexit] [-no-interactive] [-debug] [-trace] [-nocommands] [-adv] [-security_debug] [-security_debug_verbose] [-msg] [-timeout] [-mtu size] [-no_ems] [-keymatexport label] [-keymatexportlen len] [-msgfile filename] [-nbio_test] [-state] [-nbio] [-crlf] [-ign_eof] [-no_ign_eof] [-psk_identity identity] [-psk key] [-psk_session file] [-quiet] [-sctp] [-sctp_label_bug] [-fallback_scsv] [-async] [-maxfraglen len] [-max_send_frag] [-split_send_frag] [-max_pipelines] [-read_buf] [-ignore_unexpected_eof] [-no_tx_cert_comp] [-no_rx_cert_comp] [-brief] [-starttls protocol] [-xmpphost hostname] [-name hostname] [-tlsextdebug] [-sess_out filename] [-sess_in filename] [-serverinfo types] [-status] [-ocsp_check_leaf] [-ocsp_check_all] [-alpn protocols] [-nextprotoneg protocols] [-ct] [-noct] [-ctlogfile] [-keylogfile file] [-early_data file] [-enable_pha] [-use_srtp value] [-srpuser value] [-srppass value] [-srp_lateuser] [-srp_moregroups] [-srp_strength number] [-ktls] [-tfo] [-nameopt option] [-no_ssl3] [-no_tls1] [-no_tls1_1] [-no_tls1_2] [-no_tls1_3] [-ssl3] [-tls1] [-tls1_1] [-tls1_2] [-tls1_3] [-dtls] [-dtls1] [-dtls1_2] [-xkey infile] [-xcert file] [-xchain file] [-xchain_build file] [-xcertform DER|PEM]> [-xkeyform DER|PEM]> [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath] [-CAstore uri] [-no-CAstore] [-bugs] [-no_comp] [-comp] [-no_ticket] [-serverpref] [-client_renegotiation] [-legacy_renegotiation] [-no_renegotiation] [-no_resumption_on_reneg] [-legacy_server_connect] [-no_legacy_server_connect] [-no_etm] [-allow_no_dhe_kex] [-prefer_no_dhe_kex] [-prioritize_chacha] [-strict] [-sigalgs algs] [-client_sigalgs algs] [-groups groups] [-curves curves] [-named_curve curve] [-cipher ciphers] [-ciphersuites 1.3ciphers] [-min_protocol minprot] [-max_protocol maxprot] [-record_padding padding] [-debug_broken_protocol] [-no_middlebox] [-rand files] [-writerand file] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] [-engine id] [-ssl_client_engine id] [-allow_proxy_certs] [-attime timestamp] [-no_check_time] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-issuer_checks] [-enable_server_rpk] [-enable_client_rpk] [host:port] (DESCRIPTION) SSL/TLS SSL/TLS . SSL . (OPTIONS) " " SSL_CONF_cmd(3) . -help . -ssl_config section SSL_CTX. -connect host:port . . (localhost) . IPv6 "[" "]" . -host hostname -connect . -port port -connect . -bind host:port / (bind) . . IPv6 "[" "]" . -proxy host:port -connect HTTP CONNECT . IPv6 "[" "]" . -proxy_user userid -proxy (base64) . : TLS/SSL base64 . . . -proxy_pass arg -proxy_user . arg openssl-passphrase-options(1) . -unix path . -4 IPv4. -6 IPv6. -quic QUIC. -alpn . -servername name TLS SNI ( ) ClientHello . -servername TLS SNI -connect DNS . -connect SNI "localhost" . OpenSSL 1.1.1 . SNI DNS IP -servername DNS . -noservername . -noservername SNI ( ) ClientHello . -servername -dane_tlsa_domain . -cert filename . . -cert_chain . -certform DER|PEM|P12 . openssl-format-options(1) . -cert_chain (URI) -cert. PEM DER PKCS#12 . -build_chain . -CRL filename CRL . -CRLform DER|PEM CRL . openssl-format-options(1) . -crl_download CRL . -crl_check . CRL X509_CRL_load_http(3) . -key filename|uri . . -keyform DER|PEM|P12|ENGINE . openssl-format-options(1) . -pass arg . arg openssl-passphrase-options(1) . -verify depth . . -verify_return_error . . (D)TLS ("sslserver") . " " openssl-verification-options(1) . -verify_return_error -verify . . -verify_quiet . -verifyCAfile filename PEM . -verifyCApath dir . " " openssl-verify(1) . -verifyCAstore uri (URI) . -verifyCAfile -verifyCApath -verifyCAstore ( SSL_CTX_set1_verify_cert_store(3)) -CAfile -CApath -CAstore . -chainCAfile file PEM . -chainCApath directory . " " openssl-verify(1) . -chainCAstore uri (URI) . URI . URI "file:" URI -chainCAfile -chainCApath . "file:" ossl_store-file(7) . -requestCAfile file (subject names) certificate_authorities . TLS 1.3 . -dane_tlsa_domain domain RFC6698/RFC7671 DANE TLSA TLSA SNI . -dane_tlsa_rrdata . DANE ( 0) TLSA . TLSA (trust anchor) "2 1 0" ( ) "TA public key verified" . TLSA "matched TA certificate" "matched EE certificate" 0. -dane_tlsa_rrdata rrdata RRDATA DANE TLSA . rrdata " " . . : $ openssl s_client -brief -starttls smtp \ -connect smtp.example.com:25 \ -dane_tlsa_domain smtp.example.com \ -dane_tlsa_rrdata "2 1 1 B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B" \ -dane_tlsa_rrdata "2 1 1 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18" ... Verification: OK Verified peername: smtp.example.com DANE TLSA 2 1 1 ...ee12d2cc90180517616e8a18 matched TA certificate at depth 1 ... -dane_ee_no_namechecks TLSA DANE-EE(3) . " " (unknown key share) . (cross- origin) . RFC7671 TLSA DANE-EE(3) . SMTP XMPP SRV MX SMTP XMPP . -reconnect (session ID) . -showcerts : ( ). . -prexit . . . URL . : . -no-interactive . -state SSL. -debug . -nocommands . -adv . -security_debug . -security_debug_verbose . -msg . -timeout / DTLS. -mtu size MTU . -no_ems (Extended master secret). -keymatexport label . -keymatexportlen len . . -trace . -msgfile filename -msg -trace . -nbio_test I/O . -nbio I/O . -crlf CR+LF . -ign_eof (EOF) . -nocommands . -quiet . -ign_eof -nocommands . -no_ign_eof . -ign_eof -quiet . -psk_identity identity PSK identity PSK. "Client_identity" ( ) . -psk key PSK key PSK. 0x -psk 1a2b3c4d. PSK . -psk_session file SSL_SESSION PEM file PSK. TLSv1.3 . -sctp SCTP UDP DTLS. -dtls -dtls1 -dtls1_2 . SCTP OpenSSL . -sctp_label_bug OpenSSL DTLS/SCTP. . -sctp . SCTP OpenSSL . -fallback_scsv TLS_FALLBACK_SCSV ClientHello. -async . . -engine . (dasync) . -maxfraglen len 512 1024 2048 4096. -max_send_frag int . SSL_CTX_set_max_send_fragment(3) . -split_send_frag int . max_pipelines . max_pipelines . SSL_CTX_set_split_send_fragment(3) . -max_pipelines int / . ( dasync) . . SSL_CTX_set_max_pipelines(3) . -read_buf int . ( SSL_CTX_set_default_read_buffer_len(3) ). -ignore_unexpected_eof TLS close_notify . close_notify . close_notify close_notify . SSL_shutdown(3) . -no_tx_cert_comp TLSv1.3 . -no_rx_cert_comp TLSv1.3 . -brief . -starttls protocol () TLS. protocol . "smtp" "pop3" "imap" "ftp" "xmpp" "xmpp-server" "irc" "postgres" "mysql" "lmtp" "nntp" "sieve" "ldap". -xmpphost hostname "-starttls xmpp" "-starttls xmpp-server" "to" . "-connect" . -name "xmpp" "xmpp-server" . -name hostname -starttls . "xmpp" "xmpp-server" "smtp" "lmtp" -name . "-starttls xmpp" "-starttls xmpp-server" "to" . "-connect" . "-starttls lmtp" "-starttls smtp" "LMTP LHLO" "SMTP EHLO" . "mail.example.com" . -tlsextdebug TLS . -sess_out filename SSL filename. -sess_in filename SSL filename. . -serverinfo types TLS ( ). TLS ClientHello . ( ) PEM . -status (OCSP stapling). ( ) . -ocsp_check_leaf ( ) OCSP TLS ( "OCSP stapling") . OCSP CRL . -status . -ocsp_check_all ( CA ). -status -ocsp_check_leaf . -alpn protocols, -nextprotoneg protocols (ALPN) (NPN) . ALPN IETF NPN . protocols . . "http/1.1" "spdy/3". -tls1_3 -nextprotoneg . -ct, -noct (CT) (-ct) (-noct) . CT (SCT) . CT OCSP stapling SCT . -ctlogfile (Certificate Transparency). SSL_CTX_set_ctlog_list_file(3) . -keylogfile file TLS ( Wireshark) TLS . -early_data file (early data) . . -enable_pha TLSv1.3 (Post-Handshake Authentication) . -cert . -use_srtp value SRTP value . -srpuser value SRP . . -srppass value SRP . . -srp_lateuser SRP ClientHello. . -srp_moregroups This option is deprecated. g N. . -srp_strength number ( ) N. . -ktls Kernel TLS . OpenSSL 3.2.0 . OpenSSL 3.2.0 Kernel TLS . -tfo TCP fast open (RFC7413). -no_ssl3, -no_tls1, -no_tls1_1, -no_tls1_2, -no_tls1_3, -ssl3, -tls1, -tls1_1, -tls1_2, -tls1_3 " TLS" openssl(1) . -dtls, -dtls1, -dtls1_2 DTLS TLS . " TLS" openssl(1) . -nameopt option . openssl-namedisplay-options(1) . -xkey infile, -xcert file, -xchain file, -xchain_build file, -xcertform DER|PEM, -xkeyform DER|PEM . " " openssl-verification-options(1) . -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore " " openssl-verification-options(1) . -bugs, -comp, -no_comp, -no_ticket, -serverpref, -client_renegotiation, -legacy_renegotiation, -no_renegotiation, -no_resumption_on_reneg, -legacy_server_connect, -no_legacy_server_connect, -no_etm -allow_no_dhe_kex, -prefer_no_dhe_kex, -prioritize_chacha, -strict, -sigalgs algs, -client_sigalgs algs, -groups groups, -curves curves, -named_curve curve, -cipher ciphers, -ciphersuites 1.3ciphers, -min_protocol minprot, -max_protocol maxprot, -record_padding padding, -debug_broken_protocol, -no_middlebox " " SSL_CONF_cmd(3) . -rand files, -writerand file " " openssl(1) . -provider name -provider-path path -provparam [name:]key=value -propquery propq " " openssl(1) provider(7) property(7) . -engine id " " openssl(1) . . -ssl_client_engine id . -allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict -issuer_checks . " " openssl-verification-options(1) . -verify_return_error . -enable_server_rpk (RFC7250) . X.509 . X.509 X.509 . -enable_client_rpk (RFC7250) . . . host:port -connect . -connect localhost 4433 . IPv6 "[" "]" . () (CONNECTED COMMANDS (BASIC)) SSL/TLS . (EOF) . ( -quiet -ign_eof ) -adv -nocommands "" (Basic) . . . . : Q SSL . R SSL ( TLSv1.2 ). C (resumption handshake). k ( TLSv1.3). K ( TLSv1.3). () (CONNECTED COMMANDS (ADVANCED)) -adv "" (advanced) . SSL/TLS . (EOF) . "{help}" "{quit}". s_client . ":" "{keyup:req}". . s_client . . : help . quit (peer). reconnect . keyup (Key Update). TLSv1.3. . "req" . "noreq" . "req" . reneg . (D)TLSv1.2 . fin FIN . QUIC. FIN . (NOTES) SSL . HTTP SSL : openssl s_client -connect servername:443 ( https ). HTTP "GET /" . -bugs -ssl3 -tls1 -no_ssl3 -no_tls1 . OpenSSL . . " CA " . CA . URL . -prexit HTTP . -cert . . -showcerts . . ( ) . (MITM) . -verify_return_error : . -bind / . (Note on Non-Interactive Use) s_client ( cron stdin ) TLS 1.3. -ign_eof s_client (EOF) stdin . : openssl s_client -connect :443 -tls1_3 -sess_out /path/to/tls_session_params_file -ign_eof -ign_eof . (hang) . . SMTP QUIT : $ openssl s_client -brief -ign_eof -starttls smtp -connect :25 . SMTP QUIT : printf 'QUIT\r\n' | openssl s_client -connect :25 -starttls smtp -brief -ign_eof HTTP/1.1 `Connection: close` : printf 'GET / HTTP/1.1\r\nHost: \r\nConnection: close\r\n\r\n' | openssl s_client -connect :443 -brief . (BUGS) C . SSL . -prexit (hack) . . (SEE ALSO) openssl(1), openssl-sess_id(1), openssl-s_server(1), openssl-ciphers(1), SSL_CONF_cmd(3), SSL_CTX_set_max_send_fragment(3), SSL_CTX_set_split_send_fragment(3), SSL_CTX_set_max_pipelines(3), ossl_store-file(7) (HISTORY) -no_alt_chains OpenSSL 1.1.0 . -name OpenSSL 1.1.1 . -certform OpenSSL 3.0.0 . -engine OpenSSL 3.0 . -enable_client_rpk -enable_server_rpk -no_rx_cert_comp -no_tx_cert_comp -tfo OpenSSL 3.2 . <-ocsp_check_leaf> -ocsp_check_all OpenSSL 3.6 . (COPYRIGHT) - OpenSSL . . . ("") . . LICENSE . 3.6.4 2026-08-25 OPENSSL-S_CLIENT(1ssl)