1 AutoGen Definitions options
;
2 prog
-name
= gnutls
-cli
;
3 prog
-title
= "GnuTLS client";
4 prog
-desc
= "Simple client program to set up a TLS connection.";
5 short
-usage
= "Usage: gnutls-cli [options] hostname\ngnutls-cli --help for usage instructions.\n";
7 detail
= "Simple client program to set up a TLS connection to some other computer.
8 It sets up a TLS connection and forwards data from the standard input to the secured socket and vice versa.";
10 argument
= "[hostname]";
17 descrip
= "Enable trust on first use authentication";
20 doc
= "This option will, in addition to certificate authentication, perform authentication based on previously seen public keys, a model similar to SSH authentication.";
25 descrip
= "Enable OCSP certificate verification";
28 doc
= "This option will enable verification of the peer's certificate using ocsp";
34 descrip
= "Establish a session and resume";
35 doc
= "Connect, establish a session, reconnect and resume.";
41 descrip
= "Activate heartbeat support";
48 descrip
= "Establish a session and rehandshake";
49 doc
= "Connect, establish a session and rehandshake immediately.";
54 descrip
= "Don't accept session tickets";
61 descrip
= "Connect, establish a plain session and start TLS.";
62 doc
= "The TLS session will be initiated when EOF or a SIGALRM is received.";
68 descrip
= "Use DTLS (datagram TLS) over UDP";
75 arg
-range
= "0->17000";
76 descrip
= "Set MTU for datagram TLS";
82 descrip
= "Send CR LF instead of LF";
88 descrip
= "Use DER format for certificates to read from";
95 descrip
= "Send the openpgp fingerprint, instead of the key";
100 name
= disable
-extensions
;
101 descrip
= "Disable all the TLS extensions";
107 descrip
= "Print peer's certificate in PEM format";
114 arg
-range
= "0->4096";
115 descrip
= "The maximum record size to advertize";
122 descrip
= "The minimum number of bits allowed for DH";
123 doc
= "This option sets the minimum number of bits allowed for a Diffie-Hellman key exchange. You may want to lower the default value if the peer sends a weak prime and you get an connection error with unacceptable prime.";
129 descrip
= "Priorities string";
130 doc
= "TLS algorithms and protocols to enable. You can
131 use predefined sets of ciphersuites such as PERFORMANCE,
132 NORMAL, SECURE128, SECURE256.
134 Check the GnuTLS manual on section ``Priority strings'' for more
135 information on allowed keywords";
141 descrip
= "Certificate file or PKCS #11 URL to use";
149 descrip
= "CRL file to use";
157 descrip
= "PGP Key file to use";
165 descrip
= "PGP Key ring file to use";
173 descrip
= "PGP Public Key (certificate) file to use";
180 descrip
= "X.509 key file or PKCS #11 URL to use";
187 descrip
= "X.509 Certificate file or PKCS #11 URL to use";
194 descrip
= "PGP subkey to use (hex or auto)";
201 descrip
= "SRP username to use";
208 descrip
= "SRP password to use";
215 descrip
= "PSK username to use";
222 descrip
= "PSK key (in hex) to use";
230 descrip
= "The port or service to connect to";
236 descrip
= "Don't abort program if server certificate can't be validated";
241 name
= benchmark
-ciphers
;
242 descrip
= "Benchmark individual ciphers";
247 name
= benchmark
-soft
-ciphers
;
248 descrip
= "Benchmark individual software ciphers (no hw acceleration)";
253 name
= benchmark
-tls
-kx
;
254 descrip
= "Benchmark TLS key exchange methods";
259 name
= benchmark
-tls
-ciphers
;
260 descrip
= "Benchmark TLS ciphers";
267 descrip
= "Print a list of the supported algorithms and modes";
268 doc
= "Print a list of the supported algorithms and modes. If a priority string is given then only the enabled ciphersuites are shown.";
274 ds
-type
= 'SEE ALSO'; // or anything else
275 ds
-format
= 'texi'; // or texi or mdoc format
277 gnutls
-cli
-debug(1), gnutls
-serv(1)
282 ds
-type
= 'EXAMPLES';
285 @subheading Connecting using PSK authentication
286 To connect to a server using PSK authentication
, you need to enable the choice of PSK by using a cipher priority parameter such as in the example below.
288 $ .
/gnutls
-cli
-p
5556 localhost
--pskusername psk_identity \
289 --pskkey
88f3824b3e5659f52d00e959bacab954b6540344 \
290 --priority NORMAL
:-KX
-ALL
:+ECDHE
-PSK
:+DHE
-PSK
:+PSK
291 Resolving
'localhost'...
292 Connecting to
'127.0.0.1:5556'...
293 - PSK authentication.
296 - Cipher
: AES
-128-CBC
299 - Handshake was completed
301 - Simple Client Mode
:
303 By keeping the
--pskusername parameter and removing the
--pskkey parameter
, it will query only for the password during the handshake.
305 @subheading Listing ciphersuites in a priority string
306 To list the ciphersuites in a priority string
:
308 $ .
/gnutls
-cli
--priority SECURE192
-l
309 Cipher suites for SECURE192
310 TLS_ECDHE_ECDSA_AES_256_CBC_SHA384
0xc0, 0x24 TLS1.2
311 TLS_ECDHE_ECDSA_AES_256_GCM_SHA384
0xc0, 0x2e TLS1.2
312 TLS_ECDHE_RSA_AES_256_GCM_SHA384
0xc0, 0x30 TLS1.2
313 TLS_DHE_RSA_AES_256_CBC_SHA256
0x00, 0x6b TLS1.2
314 TLS_DHE_DSS_AES_256_CBC_SHA256
0x00, 0x6a TLS1.2
315 TLS_RSA_AES_256_CBC_SHA256
0x00, 0x3d TLS1.2
317 Certificate types
: CTYPE
-X
.509
318 Protocols
: VERS
-TLS1.2
, VERS
-TLS1.1
, VERS
-TLS1.0
, VERS
-SSL3.0
, VERS
-DTLS1.0
319 Compression
: COMP
-NULL
320 Elliptic curves
: CURVE
-SECP384R1
, CURVE
-SECP521R1
321 PK
-signatures
: SIGN
-RSA
-SHA384
, SIGN
-ECDSA
-SHA384
, SIGN
-RSA
-SHA512
, SIGN
-ECDSA
-SHA512