Section: User Commands (1)Updated: December 1st 2003Local indexUp
NAME
gnutls-cli - GNU TLS test client
SYNOPSIS
gnutls-cli [options] hostname
DESCRIPTION
Simple client program to set up a TLS connection to some other
computer. It sets up a TLS connection and forwards data from the
standard input to the secured socket and vice versa.
OPTIONS
Program control options
-d, --debug LEVEL
Specify the debug level. Default is 1.
-h, --help
Prints a short reminder of the command line options.
-l, --list
Print a list of the supported algorithms and modes.
-r, --resume
Connect, establish a session. Connect again and resume this session.
-s, --starttls
Connect, establish a plain session and start TLS when EOF or a SIGALRM
is received.
-v, --version
Prints the program's version number.
-V, --verbose
More verbose output.
TLS/SSL control options
--priority PRIORITY STRING
TLS algorithms and protocols to enable.
Unless the first keyword is "NONE" the defaults are:
Protocols: TLS1.1, TLS1.0, and SSL3.0.
Compression: NULL.
Certificate types: X.509, OpenPGP.
You can also use predefined sets of ciphersuites such as:
PERFORMANCE
all the "secure" ciphersuites are enabled, limited to 128 bit
ciphers and sorted by terms of speed performance.
NORMAL
option enables all "secure" ciphersuites. The 256-bit ciphers
are included as a fallback only. The ciphers are sorted by security
margin.
SECURE128
flag enables all "secure" ciphersuites with ciphers up to
128 bits, sorted by security margin.
SECURE256
flag enables all "secure" ciphersuites including the 256 bit
ciphers, sorted by security margin.
EXPORT
all the ciphersuites are enabled, including the
low-security 40 bit ciphers.
NONE
nothing is enabled. This disables even protocols and
compression methods.
Special keywords:
"!" or "-" appended with an algorithm will remove this algorithm.
"+" appended with an algorithm will add this algorithm.
"%COMPAT" will enable compatibility features for a server.
"%SSL3_RECORD_VERSION" force SSL3.0 record version in the first client
hello. This is to avoid buggy servers from terminating connection.
To avoid collisions in order to specify a compression algorithm in
this string you have to prefix it with "COMP-", protocol versions
with "VERS-" and certificate types with "CTYPE-". All other
algorithms don't need a prefix.