info gnutls

9.1 Invoking gnutls-cli

Simple client program to set up a TLS connection to some other computer. It sets up a TLS connection and forwards data from the standard input to the secured socket and vice versa.

This section was generated by AutoGen, using the agtexi-cmd template and the option descriptions for the gnutls-cli program. This software is released under the GNU General Public License, version 3 or later.

gnutls-cli usage (-h)

This is the automatically generated usage text for gnutls-cli:

gnutls-cli - GnuTLS client - Ver. 3.0.17
USAGE:  gnutls-cli [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [hostname]

   -d, --debug=num            Enable debugging.
                                - It must be in the range:
                                  0 to 9999
   -V, --verbose              More verbose output
                                - may appear multiple times
       --tofu                 Enable trust on first use authentication
                                - disabled as --no-tofu
       --ocsp                 Enable OCSP certificate verification
                                - disabled as --no-ocsp
   -r, --resume               Establish a session and resume
   -e, --rehandshake          Establish a session and rehandshake
       --noticket             Don't accept session tickets
   -s, --starttls             Connect, establish a plain session and start TLS.
   -u, --udp                  Use DTLS (datagram TLS) over UDP
       --mtu=num              Set MTU for datagram TLS
                                - It must be in the range:
                                  0 to 17000
       --crlf                 Send CR LF instead of LF
       --x509fmtder           Use DER format for certificates to read from
   -f, --fingerprint          Send the openpgp fingerprint, instead of the key
       --disable-extensions   Disable all the TLS extensions
       --print-cert           Print peer's certificate in PEM format
       --recordsize=num       The maximum record size to advertize
                                - It must be in the range:
                                  0 to 4096
       --priority=str         Priorities string
       --x509cafile=str       Certificate file or PKCS #11 URL to use
       --x509crlfile=file     CRL file to use
                                - file must pre-exist
       --pgpkeyfile=file      PGP Key file to use
                                - file must pre-exist
       --pgpkeyring=file      PGP Key ring file to use
                                - file must pre-exist
       --pgpcertfile=file     PGP Public Key (certificate) file to use
                                - file must pre-exist
       --x509keyfile=str      X.509 key file or PKCS #11 URL to use
       --x509certfile=str     X.509 Certificate file or PKCS #11 URL to use
       --pgpsubkey=str        PGP subkey to use (hex or auto)
       --srpusername=str      SRP username to use
       --srppasswd=str        SRP password to use
       --pskusername=str      PSK username to use
       --pskkey=str           PSK key (in hex) to use
   -p, --port=str             The port or service to connect to
       --insecure             Don't abort program if server certificate can't be validated
       --benchmark-ciphers    Benchmark individual ciphers
       --benchmark-soft-ciphers  Benchmark individual software ciphers (no hw acceleration)
       --benchmark-tls        Benchmark ciphers and key exchange methods in TLS
   -l, --list                 Print a list of the supported algorithms and modes
   -v, --version[=arg]        Output version information and exit
   -h, --help                 Display extended usage information and exit
   -!, --more-help            Extended usage information passed thru pager

Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
Operands and options may be intermixed.  They will be reordered.



Simple client program to set up a TLS connection to some other computer.
It sets up a TLS connection and forwards data from the standard input
to the secured socket and vice versa.

please send bug reports to:  bug-gnutls@gnu.org

benchmark-ciphers option

This is the “benchmark individual ciphers” option.

benchmark-soft-ciphers option

This is the “benchmark individual software ciphers (no hw acceleration)” option.

benchmark-tls option

This is the “benchmark ciphers and key exchange methods in tls” option.

crlf option

This is the “send cr lf instead of lf” option.

debug option (-d)

This is the “enable debugging.” option. Specifies the debug level.

disable-extensions option

This is the “disable all the tls extensions” option.

fingerprint option (-f)

This is the “send the openpgp fingerprint, instead of the key” option.

insecure option

This is the “don’t abort program if server certificate can’t be validated” option.

list option (-l)

This is the “print a list of the supported algorithms and modes” option. Print a list of the supported algorithms and modes. If a priority string is given then only the enabled ciphersuites are shown.

mtu option

This is the “set mtu for datagram tls” option.

noticket option

This is the “don’t accept session tickets” option.

ocsp option

This is the “enable ocsp certificate verification” option. This option will enable verification of the peer’s certificate using ocsp

pgpcertfile option

This is the “pgp public key (certificate) file to use” option.

pgpkeyfile option

This is the “pgp key file to use” option.

pgpkeyring option

This is the “pgp key ring file to use” option.

pgpsubkey option

This is the “pgp subkey to use (hex or auto)” option.

port option (-p)

This is the “the port or service to connect to” option.

print-cert option

This is the “print peer’s certificate in pem format” option.

priority option

This is the “priorities string” option. TLS algorithms and protocols to enable. You can use predefined sets of ciphersuites such as PERFORMANCE, NORMAL, SECURE128, SECURE256.

Check the GnuTLS manual on section “Priority strings” for more information on allowed keywords

pskkey option

This is the “psk key (in hex) to use” option.

pskusername option

This is the “psk username to use” option.

recordsize option

This is the “the maximum record size to advertize” option.

rehandshake option (-e)

This is the “establish a session and rehandshake” option. Connect, establish a session and rehandshake immediately.

resume option (-r)

This is the “establish a session and resume” option. Connect, establish a session, reconnect and resume.

srppasswd option

This is the “srp password to use” option.

srpusername option

This is the “srp username to use” option.

starttls option (-s)

This is the “connect, establish a plain session and start tls.” option. The TLS session will be initiated when EOF or a SIGALRM is received.

tofu option

This is the “enable trust on first use authentication” option. This option will, in addition to certificate authentication, perform authentication based on previously seen public keys, a model similar to SSH authentication.

udp option (-u)

This is the “use dtls (datagram tls) over udp” option.

verbose option (-V)

This is the “more verbose output” option.

This option has some usage constraints. It:

may appear an unlimited number of times.

x509cafile option

This is the “certificate file or pkcs #11 url to use” option.

x509certfile option

This is the “x.509 certificate file or pkcs #11 url to use” option.

x509crlfile option

This is the “crl file to use” option.

x509fmtder option

This is the “use der format for certificates to read from” option.

x509keyfile option

This is the “x.509 key file or pkcs #11 url to use” option.

gnutls-cli exit status

One of the following exit values will be returned:

‘0’: Successful program execution.
‘1’: The operation failed or the command syntax was not valid.

gnutls-cli See Also

gnutls-cli-debug(1), gnutls-serv(1)

gnutls-cli Examples

Connecting using PSK authentication

To connect to a server using PSK authentication, you need to enable the choice of PSK by using a cipher priority parameter such as in the example below.

$ ./gnutls-cli -p 5556 localhost --pskusername psk_identity \
    --pskkey 88f3824b3e5659f52d00e959bacab954b6540344 \
    --priority NORMAL:-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK
Resolving 'localhost'...
Connecting to '127.0.0.1:5556'...
- PSK authentication.
- Version: TLS1.1
- Key Exchange: PSK
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed
    
- Simple Client Mode:

By keeping the –pskusername parameter and removing the –pskkey parameter, it will query only for the password during the handshake.

Listing ciphersuites in a priority string

To list the ciphersuites in a priority string:

$ ./gnutls-cli --priority SECURE192 -l
Cipher suites for SECURE192
TLS_ECDHE_ECDSA_AES_256_CBC_SHA384         0xc0, 0x24	TLS1.2
TLS_ECDHE_ECDSA_AES_256_GCM_SHA384         0xc0, 0x2e	TLS1.2
TLS_ECDHE_RSA_AES_256_GCM_SHA384           0xc0, 0x30	TLS1.2
TLS_DHE_RSA_AES_256_CBC_SHA256             0x00, 0x6b	TLS1.2
TLS_DHE_DSS_AES_256_CBC_SHA256             0x00, 0x6a	TLS1.2
TLS_RSA_AES_256_CBC_SHA256                 0x00, 0x3d	TLS1.2

Certificate types: CTYPE-X.509
Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0, VERS-SSL3.0, VERS-DTLS1.0
Compression: COMP-NULL
Elliptic curves: CURVE-SECP384R1, CURVE-SECP521R1
PK-signatures: SIGN-RSA-SHA384, SIGN-ECDSA-SHA384, SIGN-RSA-SHA512, SIGN-ECDSA-SHA512

This document was generated on March 23, 2012 using texi2html 5.0.