openssl
/
openssl
mirror of https://github.com/openssl/openssl
1
0
Fork 0
Code Issues Releases Wiki Activity

Make SNI behavior more clear in s_client doc & help 

Update s_client -help and pod file.

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3654)
This commit is contained in:
Paul Yang 2017-06-13 20:18:55 +08:00 committed by Rich Salz
parent 979874a208
commit 481afe2ad1
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apps/s_client.c
View File

@ -651,7 +651,7 @@ const OPTIONS s_client_options[] = {
"CA file for certificate verification (PEM format)"},
{"nocommands", OPT_NOCMDS, '-', "Do not use interactive command letters"},
{"servername", OPT_SERVERNAME, 's',
"Set TLS extension servername in ClientHello"},
"Set TLS extension servername (SNI) in ClientHello (default)"},
{"noservername", OPT_NOSERVERNAME, '-',
"Do not send the server name (SNI) extension in the ClientHello"},
{"tlsextdebug", OPT_TLSEXTDEBUG, '-',

14
doc/man1/s_client.pod
View File

@ -159,16 +159,20 @@ Use IPv6 only.
=item B<-servername name>
Set the TLS SNI (Server Name Indication) extension in the ClientHello message to
the given value.
the given value. If both this option and the B<-noservername> are not given, the
TLS SNI extension is still set to the hostname provided to the B<-connect> option,
or "localhost" if B<-connect> has not been supplied. This is default since OpenSSL
1.1.1.
Even though SNI name should normally be a DNS name and not an IP address, this
option will not make the distinction when parsing B<-connect> and will send
IP address if one passed.
=item B<-noservername>
Suppresses sending of the SNI (Server Name Indication) extension in the
ClientHello message. Cannot be used in conjunction with the B<-servername> or
<-dane_tlsa_domain> options. If this option is not given then the hostname
provided to the B<-connect> option is used in the SNI extension, or "localhost"
if B<-connect> has not been supplied. Note that an SNI name should normally be a
DNS name and not an IP address.
<-dane_tlsa_domain> options.
=item B<-cert certname>