gnutls-serv(1)

1gnutls-serv(1)                   User Commands                  gnutls-serv(1)
2
3
4

NAME

6       gnutls-serv - GnuTLS server
7

SYNOPSIS

9       gnutls-serv [-flags] [-flag [value]] [--option-name[[=| ]value]]
10
11       All arguments must be options.
12

DESCRIPTION

14       Server program that listens to incoming TLS connections.
15
16

OPTIONS

18       -d num, --debug=num
19              Enable  debugging.   This  option takes an integer number as its
20              argument.  The value of num is constrained to being:
21                  in the range 0 through 9999
22
23              Specifies the debug level.
24
25       --sni-hostname=str
26              Server's hostname for server name extension.
27
28              Server name of type host_name that the server will recognise as
29              its own. If the server receives client hello with different
30              name, it will send a warning-level unrecognized_name alert.
31
32       --sni-hostname-fatal
33              Send fatal alert on sni-hostname mismatch.
34
35
36       --alpn=str
37              Specify ALPN protocol to be enabled by the server.  This option
38              may appear an unlimited number of times.
39
40              Specify the (textual) ALPN protocol for the server to use.
41
42       --alpn-fatal
43              Send fatal alert on non-matching ALPN name.
44
45
46       --noticket
47              Don't accept session tickets.
48
49
50       --earlydata
51              Accept early data.
52
53
54       --maxearlydata=num
55              The maximum early data size to accept.  This option takes an in‐
56              teger number as its argument.  The value of num is constrained
57              to being:
58                  in the range 1 through 2147483648
59
60
61       --nocookie
62              Don't require cookie on DTLS sessions.
63
64
65       -g, --generate
66              Generate Diffie-Hellman parameters.
67
68
69       -q, --quiet
70              Suppress some messages.
71
72
73       --nodb Do not use a resumption database.
74
75
76       --http Act as an HTTP server.
77
78
79       --echo Act as an Echo server.
80
81
82       --crlf Do not replace CRLF by LF in Echo server mode.
83
84
85       -u, --udp
86              Use DTLS (datagram TLS) over UDP.
87
88
89       --mtu=num
90              Set MTU for datagram TLS.  This option takes an integer number
91              as its argument.  The value of num is constrained to being:
92                  in the range 0 through 17000
93
94
95       --srtp-profiles=str
96              Offer SRTP profiles.
97
98
99       -a, --disable-client-cert
100              Do not request a client certificate.  This option must not ap‐
101              pear in combination with any of the following options: require-
102              client-cert.
103
104
105       -r, --require-client-cert
106              Require a client certificate.
107
108              This option before 3.6.0 used to imply --verify-client-cert.
109              Since 3.6.0 it will no longer verify the certificate by default.
110
111       --verify-client-cert
112              If a client certificate is sent then verify it.
113
114              Do not require, but if a client certificate is sent then verify
115              it and close the connection if invalid.
116
117       --compress-cert=str
118              Compress certificate.  This option may appear an unlimited num‐
119              ber of times.
120
121              This option sets a supported compression method for certificate
122              compression.
123
124       -b, --heartbeat
125              Activate heartbeat support.
126
127              Regularly ping client via heartbeat extension messages
128
129       --x509fmtder
130              Use DER format for certificates to read from.
131
132
133       --priority=str
134              Priorities string.
135
136              TLS algorithms and protocols to enable. You can use predefined
137              sets of ciphersuites such as PERFORMANCE, NORMAL, SECURE128, SE‐
138              CURE256. The default is NORMAL.
139
140              Check  the  GnuTLS  manual  on  section  “Priority strings” for
141              more information on allowed keywords
142
143       --dhparams=file
144              DH params file to use.
145
146
147       --x509cafile=str
148              Certificate file or PKCS #11 URL to use.
149
150
151       --x509crlfile=file
152              CRL file to use.
153
154
155       --pgpkeyfile=file
156              PGP Key file to use.
157
158
159              NOTE: THIS OPTION IS DEPRECATED
160
161       --x509keyfile=str
162              X.509 key file or PKCS #11 URL to use.  This option may appear
163              an unlimited number of times.
164
165              Specify the private key file or URI to use; it must correspond
166              to the certificate specified in --x509certfile. Multiple keys
167              and certificates can be specified with this option and in that
168              case each occurrence of keyfile must be followed by the corre‐
169              sponding x509certfile or vice-versa.
170
171       --x509certfile=str
172              X.509 Certificate file or PKCS #11 URL to use.  This option may
173              appear an unlimited number of times.
174
175              Specify the certificate file or URI to use; it must correspond
176              to the key specified in --x509keyfile. Multiple keys and cer‐
177              tificates can be specified with this option and in that case
178              each occurrence of keyfile must be followed by the corresponding
179              x509certfile or vice-versa.
180
181       --x509dsakeyfile
182              This is an alias for the --x509keyfile option.
183
184              NOTE: THIS OPTION IS DEPRECATED
185
186       --x509dsacertfile
187              This is an alias for the --x509certfile option.
188
189              NOTE: THIS OPTION IS DEPRECATED
190
191       --x509ecckeyfile
192              This is an alias for the --x509keyfile option.
193
194              NOTE: THIS OPTION IS DEPRECATED
195
196       --x509ecccertfile
197              This is an alias for the --x509certfile option.
198
199              NOTE: THIS OPTION IS DEPRECATED
200
201       --rawpkkeyfile=str
202              Private key file (PKCS #8 or PKCS #12) or PKCS #11 URL to use.
203              This option may appear an unlimited number of times.
204
205              Specify the private key file or URI to use; it must correspond
206              to the raw public-key specified in --rawpkfile. Multiple key
207              pairs can be specified with this option and in that case each
208              occurrence of keyfile must be followed by the corresponding raw‐
209              pkfile or vice-versa.
210
211              In order to instruct the application to negotiate raw public
212              keys one must enable the respective certificate types via the
213              priority strings (i.e. CTYPE-CLI-* and CTYPE-SRV-* flags).
214
215              Check  the  GnuTLS  manual  on  section  “Priority strings” for
216              more information on how to set certificate types.
217
218       --rawpkfile=str
219              Raw public-key file to use.  This option may appear an unlimited
220              number of times.  This option must appear in combination with
221              the following options: rawpkkeyfile.
222
223              Specify the raw public-key file to use; it must correspond to
224              the private key specified in --rawpkkeyfile. Multiple key pairs
225              can be specified with this option and in that case each occur‐
226              rence of keyfile must be followed by the corresponding rawpkfile
227              or vice-versa.
228
229              In order to instruct the application to negotiate raw public
230              keys one must enable the respective certificate types via the
231              priority strings (i.e. CTYPE-CLI-* and CTYPE-SRV-* flags).
232
233              Check  the  GnuTLS  manual  on  section  “Priority strings” for
234              more information on how to set certificate types.
235
236       --srppasswd=file
237              SRP password file to use.
238
239
240       --srppasswdconf=file
241              SRP password configuration file to use.
242
243
244       --pskpasswd=file
245              PSK password file to use.
246
247
248       --pskhint=str
249              PSK identity hint to use.
250
251
252       --ocsp-response=str
253              The OCSP response to send to client.  This option may appear an
254              unlimited number of times.
255
256              If the client requested an OCSP response, return data from this
257              file to the client.
258
259       --ignore-ocsp-response-errors
260              Ignore any errors when setting the OCSP response.
261
262              That option instructs gnutls to not attempt to match the pro‐
263              vided OCSP responses with the certificates.
264
265       -p num, --port=num
266              The port to connect to.  This option takes an integer number as
267              its argument.
268
269
270       -l, --list
271              Print a list of the supported algorithms and modes.
272
273              Print a list of the supported algorithms and modes. If a prior‐
274              ity string is given then only the enabled ciphersuites are
275              shown.
276
277       --provider=file
278              Specify the PKCS #11 provider library.
279
280              This will override the default options in
281              /etc/gnutls/pkcs11.conf
282
283       --keymatexport=str
284              Label used for exporting keying material.
285
286
287       --keymatexportsize=num
288              Size of the exported keying material.  This option takes an in‐
289              teger number as its argument.
290
291
292       --recordsize=num
293              The maximum record size to advertise.  This option takes an in‐
294              teger number as its argument.  The value of num is constrained
295              to being:
296                  in the range 0 through 16384
297
298
299       --httpdata=file
300              The data used as HTTP response.
301
302
303       -v arg, --version=arg
304              Output version of program and exit.  The default mode is `v', a
305              simple version.  The `c' mode will print copyright information
306              and `n' will print the full copyright notice.
307
308       -h, --help
309              Display usage information and exit.
310
311       -!, --more-help
312              Pass the extended usage information through a pager.
313
314
315

EXAMPLES

317       Running your own TLS server based on GnuTLS can be useful when debug‐
318       ging clients and/or GnuTLS itself.  This section describes how to use
319       gnutls-serv as a simple HTTPS server.
320
321       The most basic server can be started as:
322
323           gnutls-serv --http --priority "NORMAL:+ANON-ECDH:+ANON-DH"
324
325       It will only support anonymous ciphersuites, which many TLS clients
326       refuse to use.
327
328       The next step is to add support for X.509.  First we generate a CA:
329
330           $ certtool --generate-privkey > x509-ca-key.pem
331           $ echo 'cn = GnuTLS test CA' > ca.tmpl
332           $ echo 'ca' >> ca.tmpl
333           $ echo 'cert_signing_key' >> ca.tmpl
334           $ certtool --generate-self-signed --load-privkey x509-ca-key.pem   --template ca.tmpl --outfile x509-ca.pem
335
336       Then generate a server certificate.  Remember to change the dns_name
337       value to the name of your server host, or skip that command to avoid
338       the field.
339
340           $ certtool --generate-privkey > x509-server-key.pem
341           $ echo 'organization = GnuTLS test server' > server.tmpl
342           $ echo 'cn = test.gnutls.org' >> server.tmpl
343           $ echo 'tls_www_server' >> server.tmpl
344           $ echo 'encryption_key' >> server.tmpl
345           $ echo 'signing_key' >> server.tmpl
346           $ echo 'dns_name = test.gnutls.org' >> server.tmpl
347           $ certtool --generate-certificate --load-privkey x509-server-key.pem   --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem   --template server.tmpl --outfile x509-server.pem
348
349       For use in the client, you may want to generate a client certificate as
350       well.
351
352           $ certtool --generate-privkey > x509-client-key.pem
353           $ echo 'cn = GnuTLS test client' > client.tmpl
354           $ echo 'tls_www_client' >> client.tmpl
355           $ echo 'encryption_key' >> client.tmpl
356           $ echo 'signing_key' >> client.tmpl
357           $ certtool --generate-certificate --load-privkey x509-client-key.pem   --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem   --template client.tmpl --outfile x509-client.pem
358
359       To be able to import the client key/certificate into some applications,
360       you will need to convert them into a PKCS#12 structure.  This also en‐
361       crypts the security sensitive key with a password.
362
363           $ certtool --to-p12 --load-ca-certificate x509-ca.pem   --load-privkey x509-client-key.pem --load-certificate x509-client.pem   --outder --outfile x509-client.p12
364
365       For icing, we'll create a proxy certificate for the client too.
366
367           $ certtool --generate-privkey > x509-proxy-key.pem
368           $ echo 'cn = GnuTLS test client proxy' > proxy.tmpl
369           $ certtool --generate-proxy --load-privkey x509-proxy-key.pem   --load-ca-certificate x509-client.pem --load-ca-privkey x509-client-key.pem   --load-certificate x509-client.pem --template proxy.tmpl   --outfile x509-proxy.pem
370
371       Then start the server again:
372
373           $ gnutls-serv --http             --x509cafile x509-ca.pem             --x509keyfile x509-server-key.pem             --x509certfile x509-server.pem
374
375       Try connecting to the server using your web browser.  Note that the
376       server listens to port 5556 by default.
377
378       While you are at it, to allow connections using ECDSA, you can also
379       create a ECDSA key and certificate for the server.  These credentials
380       will be used in the final example below.
381
382           $ certtool --generate-privkey --ecdsa > x509-server-key-ecc.pem
383           $ certtool --generate-certificate --load-privkey x509-server-key-ecc.pem   --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem   --template server.tmpl --outfile x509-server-ecc.pem
384
385
386       The next step is to add support for SRP authentication. This requires
387       an SRP password file created with srptool.  To start the server with
388       SRP support:
389
390           gnutls-serv --http --priority NORMAL:+SRP-RSA:+SRP             --srppasswdconf srp-tpasswd.conf             --srppasswd srp-passwd.txt
391
392       Let's also start a server with support for PSK. This would require a
393       password file created with psktool.
394
395           gnutls-serv --http --priority NORMAL:+ECDHE-PSK:+PSK             --pskpasswd psk-passwd.txt
396
397       If you want a server with support for raw public-keys we can also add
398       these credentials. Note however that there is no identity information
399       linked to these keys as is the case with regular x509 certificates. Au‐
400       thentication must be done via different means. Also we need to explic‐
401       itly enable raw public-key certificates via the priority strings.
402
403           gnutls-serv --http --priority NORMAL:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK             --rawpkfile srv.rawpk.pem             --rawpkkeyfile srv.key.pem
404
405
406       Finally, we start the server with all the earlier parameters and you
407       get this command:
408
409           gnutls-serv --http --priority NORMAL:+PSK:+SRP:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK             --x509cafile x509-ca.pem             --x509keyfile x509-server-key.pem             --x509certfile x509-server.pem             --x509keyfile x509-server-key-ecc.pem             --x509certfile x509-server-ecc.pem             --srppasswdconf srp-tpasswd.conf             --srppasswd srp-passwd.txt             --pskpasswd psk-passwd.txt             --rawpkfile srv.rawpk.pem             --rawpkkeyfile srv.key.pem
410

EXIT STATUS

412       One of the following exit values will be returned:
413
414       0  (EXIT_SUCCESS)
415              Successful program execution.
416
417       1  (EXIT_FAILURE)
418              The operation failed or the command syntax was not valid.
419

AUTHORS

COPYRIGHT

425       Copyright (C) 2020-2021 Free Software Foundation, and others all rights
426       reserved.  This program is released under the terms of the GNU General
427       Public License, version 3 or later
428

BUGS

430       Please send bug reports to: bugs@gnutls.org
431
432
433
4343.7.6                             27 May 2022                   gnutls-serv(1)