www.LinuxHowtos.org howtos, tips&tricks and tutorials for linux

from small one page howto to huge articles all in one place

Other .linuxhowtos.org sites:toolsntoys.linuxhowtos.org
gentoo.linuxhowtos.org

poll results

Last additions:

using iotop to find disk usage hogs

words:

887

views:

20174

userrating:

average rating: 3.4 (203 votes) (1=very good 6=terrible)

May 25th. 2007:

Words

486

Views

35953

why adblockers are bad

Workaround and fixes for the current Core Dump Handling vulnerability affected kernels

words:

161

views:

20951

userrating:

average rating: 1.0 (50 votes) (1=very good 6=terrible)

April, 26th. 2006:

Words

Views

16025

New subdomain: toolsntoys.linuxhowtos.org

You are here: manpages

gnutls\-cli

Section: User Commands (1)
Updated: December 1st 2003
Index Return to Main Contents

NAME

gnutls-cli - GnuTLS test client

SYNOPSIS

gnutls-cli [options] hostname

DESCRIPTION

Simple client program to set up a TLS connection to some other computer. It sets up a TLS connection and forwards data from the standard input to the secured socket and vice versa.

OPTIONS

Program control options

-d, --debug LEVEL: Specify the debug level. Default is 1.
-h, --help: Prints a short reminder of the command line options.
-l, --list: Print a list of the supported algorithms and modes.
-r, --resume: Connect, establish a session. Connect again and resume this session.
-s, --starttls: Connect, establish a plain session and start TLS when EOF or a SIGALRM is received.
-v, --version: Prints the program's version number.
-V, --verbose: More verbose output.

TLS/SSL control options

--priority PRIORITY STRING: TLS algorithms and protocols to enable. Unless the first keyword is "NONE" the defaults are:
: Protocols: TLS1.1, TLS1.0, and SSL3.0.
: Compression: NULL.
: Certificate types: X.509, OpenPGP.
: Signature algorithms: RSA-SHA1, RSA-MD2, RSA-MD5, RSA-SHA256, RSA-SHA512, DSA-SHA1.
: You can also use predefined sets of ciphersuites such as:
: PERFORMANCE all the "secure" ciphersuites are enabled, limited to 128 bit ciphers and sorted by terms of speed performance.
: NORMAL option enables all "secure" ciphersuites. The 256-bit ciphers are included as a fallback only. The ciphers are sorted by security margin.
: SECURE128 flag enables all "secure" ciphersuites with ciphers up to 128 bits, sorted by security margin.
: SECURE256 flag enables all "secure" ciphersuites including the 256 bit ciphers, sorted by security margin.
: EXPORT all the ciphersuites are enabled, including the low-security 40 bit ciphers.
: NONE nothing is enabled. This disables even protocols and compression methods.

: Special keywords:
: "!" or "-" appended with an algorithm will remove this algorithm.
: "+" appended with an algorithm will add this algorithm.
: "%COMPAT" will enable compatibility features for a server.
: "%SSL3_RECORD_VERSION" force SSL3.0 record version in the first client hello. This is to avoid buggy servers from terminating connection.
: "%UNSAFE_RENEGOTIATION" Permits (re-)handshakes even unsafe ones.
: "%PARTIAL_RENEGOTIATION" Prevents renegotiation with clients and servers not supporting the safe renegotiation extension. (default)
: "%SAFE_RENEGOTIATION" will enable safe renegotiation. This is the most secure and recommended option for clients. However this will prevent from connecting to legacy servers.
: To avoid collisions in order to specify a compression algorithm in this string you have to prefix it with "COMP-", protocol versions with "VERS-" and certificate types with "CTYPE-". All other algorithms don't need a prefix.
: Examples:
: "NORMAL"
: "NORMAL:%COMPAT"
: "NORMAL:!AES-128-CBC"
: "NONE:+VERS-TLS1.0:+AES-128-CBC:+RSA:+SHA1:+COMP-NULL"
--crlf: Send CR LF instead of LF.
-f, --fingerprint: Send the openpgp fingerprint, instead of the key.
-p, --port integer: The port to connect to.
--ciphers cipher1 cipher2...: Ciphers to enable (use gnutls-cli --list to show the supported ciphers).
--protocols protocol1 protocol2...: Protocols to enable (use gnutls-cli --list to show the supported protocols).
--comp comp1 comp2...: Compression methods to enable (use gnutls-cli --list to show the supported methods).
--macs mac1 mac2...: MACs to enable (use gnutls-cli --list to show the supported MACs).
--kx kx1 kx2...: Key exchange methods to enable (use gnutls-cli --list to show the supported methods).
--ctypes certType1 certType2...: Certificate types to enable (use gnutls-cli --list to show the supported types).
--recordsize integer: The maximum record size to advertize.
--disable-extensions: Disable all the TLS extensions.
--print-cert: Print the certificate in PEM format.
--insecure: Don't abort program if server certificates can't be validated.