gnutls-serv(1)

1gnutls-serv(1)                   User Commands                  gnutls-serv(1)
2
3
4

NAME

6       gnutls-serv - GnuTLS server
7

SYNOPSIS

9       gnutls-serv [-flags] [-flag [value]] [--option-name[[=| ]value]]
10
11       All arguments must be options.
12

DESCRIPTION

14       Server program that listens to incoming TLS connections.
15
16

OPTIONS

18       -d num, --debug=num
19              Enable  debugging.   This  option takes an integer number as its
20              argument.  The value of num is constrained to being:
21                  in the range 0 through 9999
22
23              Specifies the debug level.
24
25       --sni-hostname=str
26              Server's hostname for server name extension.
27
28              Server name of type host_name that the server will recognise as
29              its own. If the server receives client hello with different
30              name, it will send a warning-level unrecognized_name alert.
31
32       --sni-hostname-fatal
33              Send fatal alert on sni-hostname mismatch.
34
35
36       --alpn=str
37              Specify ALPN protocol to be enabled by the server.  This option
38              may appear an unlimited number of times.
39
40              Specify the (textual) ALPN protocol for the server to use.
41
42       --alpn-fatal
43              Send fatal alert on non-matching ALPN name.
44
45
46       --noticket
47              Don't accept session tickets.
48
49
50       --earlydata
51              Accept early data.
52
53
54       --maxearlydata=num
55              The maximum early data size to accept.  This option takes an in‐
56              teger number as its argument.  The value of num is constrained
57              to being:
58                  in the range 1 through 2147483648
59
60
61       --nocookie
62              Don't require cookie on DTLS sessions.
63
64
65       -g, --generate
66              Generate Diffie-Hellman parameters.
67
68
69       -q, --quiet
70              Suppress some messages.
71
72
73       --nodb Do not use a resumption database.
74
75
76       --http Act as an HTTP server.
77
78
79       --echo Act as an Echo server.
80
81
82       --crlf Do not replace CRLF by LF in Echo server mode.
83
84
85       -u, --udp
86              Use DTLS (datagram TLS) over UDP.
87
88
89       --mtu=num
90              Set MTU for datagram TLS.  This option takes an integer number
91              as its argument.  The value of num is constrained to being:
92                  in the range 0 through 17000
93
94
95       --srtp-profiles=str
96              Offer SRTP profiles.
97
98
99       -a, --disable-client-cert
100              Do not request a client certificate.  This option must not ap‐
101              pear in combination with any of the following options: require-
102              client-cert.
103
104
105       -r, --require-client-cert
106              Require a client certificate.
107
108              This option before 3.6.0 used to imply --verify-client-cert.
109              Since 3.6.0 it will no longer verify the certificate by default.
110
111       --verify-client-cert
112              If a client certificate is sent then verify it.
113
114              Do not require, but if a client certificate is sent then verify
115              it and close the connection if invalid.
116
117       --compress-cert=str
118              Compress certificate.  This option may appear an unlimited num‐
119              ber of times.
120
121              This option sets a supported compression method for certificate
122              compression.
123
124       -b, --heartbeat
125              Activate heartbeat support.
126
127              Regularly ping client via heartbeat extension messages
128
129       --x509fmtder
130              Use DER format for certificates to read from.
131
132
133       --priority=str
134              Priorities string.
135
136              TLS algorithms and protocols to enable. You can use predefined
137              sets of ciphersuites such as PERFORMANCE, NORMAL, SECURE128, SE‐
138              CURE256. The default is NORMAL.
139
140              Check  the  GnuTLS  manual  on  section  “Priority strings” for
141              more information on allowed keywords
142
143       --dhparams=file
144              DH params file to use.
145
146
147       --x509cafile=str
148              Certificate file or PKCS #11 URL to use.
149
150
151       --x509crlfile=file
152              CRL file to use.
153
154
155       --pgpkeyfile=file
156              PGP Key file to use.
157
158
159              NOTE: THIS OPTION IS DEPRECATED
160
161       --x509keyfile=str
162              X.509 key file or PKCS #11 URL to use.  This option may appear
163              an unlimited number of times.
164
165              Specify the private key file or URI to use; it must correspond
166              to the certificate specified in --x509certfile. Multiple keys
167              and certificates can be specified with this option and in that
168              case each occurrence of keyfile must be followed by the corre‐
169              sponding x509certfile or vice-versa.
170
171       --x509certfile=str
172              X.509 Certificate file or PKCS #11 URL to use.  This option may
173              appear an unlimited number of times.
174
175              Specify the certificate file or URI to use; it must correspond
176              to the key specified in --x509keyfile. Multiple keys and cer‐
177              tificates can be specified with this option and in that case
178              each occurrence of keyfile must be followed by the corresponding
179              x509certfile or vice-versa.
180
181       --x509dsakeyfile
182              This is an alias for the --x509keyfile option.
183
184              NOTE: THIS OPTION IS DEPRECATED
185
186       --x509dsacertfile
187              This is an alias for the --x509certfile option.
188
189              NOTE: THIS OPTION IS DEPRECATED
190
191       --x509ecckeyfile
192              This is an alias for the --x509keyfile option.
193
194              NOTE: THIS OPTION IS DEPRECATED
195
196       --x509ecccertfile
197              This is an alias for the --x509certfile option.
198
199              NOTE: THIS OPTION IS DEPRECATED
200
201       --rawpkkeyfile=str
202              Private key file (PKCS #8 or PKCS #12) or PKCS #11 URL to use.
203              This option may appear an unlimited number of times.
204
205              Specify the private key file or URI to use; it must correspond
206              to the raw public-key specified in --rawpkfile. Multiple key
207              pairs can be specified with this option and in that case each
208              occurrence of keyfile must be followed by the corresponding raw‐
209              pkfile or vice-versa.
210
211              In order to instruct the application to negotiate raw public
212              keys one must enable the respective certificate types via the
213              priority strings (i.e. CTYPE-CLI-* and CTYPE-SRV-* flags).
214
215              Check  the  GnuTLS  manual  on  section  “Priority strings” for
216              more information on how to set certificate types.
217
218       --rawpkfile=str
219              Raw public-key file to use.  This option may appear an unlimited
220              number of times.  This option must appear in combination with
221              the following options: rawpkkeyfile.
222
223              Specify the raw public-key file to use; it must correspond to
224              the private key specified in --rawpkkeyfile. Multiple key pairs
225              can be specified with this option and in that case each occur‐
226              rence of keyfile must be followed by the corresponding rawpkfile
227              or vice-versa.
228
229              In order to instruct the application to negotiate raw public
230              keys one must enable the respective certificate types via the
231              priority strings (i.e. CTYPE-CLI-* and CTYPE-SRV-* flags).
232
233              Check  the  GnuTLS  manual  on  section  “Priority strings” for
234              more information on how to set certificate types.
235
236       --srppasswd=file
237              SRP password file to use.
238
239
240       --srppasswdconf=file
241              SRP password configuration file to use.
242
243
244       --pskpasswd=file
245              PSK password file to use.
246
247
248       --pskhint=str
249              PSK identity hint to use.
250
251
252       --ocsp-response=str
253              The OCSP response to send to client.  This option may appear an
254              unlimited number of times.
255
256              If the client requested an OCSP response, return data from this
257              file to the client.
258
259       --ignore-ocsp-response-errors
260              Ignore any errors when setting the OCSP response.
261
262              That option instructs gnutls to not attempt to match the pro‐
263              vided OCSP responses with the certificates.
264
265       -p num, --port=num
266              The port to connect to.  This option takes an integer number as
267              its argument.
268
269
270       -l, --list
271              Print a list of the supported algorithms and modes.
272
273              Print a list of the supported algorithms and modes. If a prior‐
274              ity string is given then only the enabled ciphersuites are
275              shown.
276
277       --provider=file
278              Specify the PKCS #11 provider library.
279
280              This will override the default options in
281              /etc/gnutls/pkcs11.conf
282
283       --keymatexport=str
284              Label used for exporting keying material.
285
286
287       --keymatexportsize=num
288              Size of the exported keying material.  This option takes an in‐
289              teger number as its argument.
290
291
292       --recordsize=num
293              The maximum record size to advertise.  This option takes an in‐
294              teger number as its argument.  The value of num is constrained
295              to being:
296                  in the range 0 through 16384
297
298
299       --httpdata=file
300              The data used as HTTP response.
301
302
303       --timeout=num
304              The timeout period for server.  This option takes an integer
305              number as its argument.
306
307
308       --attime=timestamp
309              Perform validation at the timestamp instead of the system time.
310
311              timestamp is an instance in time encoded as Unix time or in a
312              human
313               readable timestring such as "29 Feb 2004", "2004-02-29".  Full
314              documentation available at <https://www.gnu.org/software/core‐
315              utils/manual/html_node/Date-input-formats.html> or locally via
316              info '(coreutils) date invocation'.
317
318       -v arg, --version=arg
319              Output version of program and exit.  The default mode is `v', a
320              simple version.  The `c' mode will print copyright information
321              and `n' will print the full copyright notice.
322
323       -h, --help
324              Display usage information and exit.
325
326       -!, --more-help
327              Pass the extended usage information through a pager.
328
329
330

EXAMPLES

332       Running your own TLS server based on GnuTLS can be useful when debug‐
333       ging clients and/or GnuTLS itself.  This section describes how to use
334       gnutls-serv as a simple HTTPS server.
335
336       The most basic server can be started as:
337
338           gnutls-serv --http --priority "NORMAL:+ANON-ECDH:+ANON-DH"
339
340       It will only support anonymous ciphersuites, which many TLS clients
341       refuse to use.
342
343       The next step is to add support for X.509.  First we generate a CA:
344
345           $ certtool --generate-privkey > x509-ca-key.pem
346           $ echo 'cn = GnuTLS test CA' > ca.tmpl
347           $ echo 'ca' >> ca.tmpl
348           $ echo 'cert_signing_key' >> ca.tmpl
349           $ certtool --generate-self-signed --load-privkey x509-ca-key.pem   --template ca.tmpl --outfile x509-ca.pem
350
351       Then generate a server certificate.  Remember to change the dns_name
352       value to the name of your server host, or skip that command to avoid
353       the field.
354
355           $ certtool --generate-privkey > x509-server-key.pem
356           $ echo 'organization = GnuTLS test server' > server.tmpl
357           $ echo 'cn = test.gnutls.org' >> server.tmpl
358           $ echo 'tls_www_server' >> server.tmpl
359           $ echo 'encryption_key' >> server.tmpl
360           $ echo 'signing_key' >> server.tmpl
361           $ echo 'dns_name = test.gnutls.org' >> server.tmpl
362           $ certtool --generate-certificate --load-privkey x509-server-key.pem   --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem   --template server.tmpl --outfile x509-server.pem
363
364       For use in the client, you may want to generate a client certificate as
365       well.
366
367           $ certtool --generate-privkey > x509-client-key.pem
368           $ echo 'cn = GnuTLS test client' > client.tmpl
369           $ echo 'tls_www_client' >> client.tmpl
370           $ echo 'encryption_key' >> client.tmpl
371           $ echo 'signing_key' >> client.tmpl
372           $ certtool --generate-certificate --load-privkey x509-client-key.pem   --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem   --template client.tmpl --outfile x509-client.pem
373
374       To be able to import the client key/certificate into some applications,
375       you will need to convert them into a PKCS#12 structure.  This also en‐
376       crypts the security sensitive key with a password.
377
378           $ certtool --to-p12 --load-ca-certificate x509-ca.pem   --load-privkey x509-client-key.pem --load-certificate x509-client.pem   --outder --outfile x509-client.p12
379
380       For icing, we'll create a proxy certificate for the client too.
381
382           $ certtool --generate-privkey > x509-proxy-key.pem
383           $ echo 'cn = GnuTLS test client proxy' > proxy.tmpl
384           $ certtool --generate-proxy --load-privkey x509-proxy-key.pem   --load-ca-certificate x509-client.pem --load-ca-privkey x509-client-key.pem   --load-certificate x509-client.pem --template proxy.tmpl   --outfile x509-proxy.pem
385
386       Then start the server again:
387
388           $ gnutls-serv --http             --x509cafile x509-ca.pem             --x509keyfile x509-server-key.pem             --x509certfile x509-server.pem
389
390       Try connecting to the server using your web browser.  Note that the
391       server listens to port 5556 by default.
392
393       While you are at it, to allow connections using ECDSA, you can also
394       create a ECDSA key and certificate for the server.  These credentials
395       will be used in the final example below.
396
397           $ certtool --generate-privkey --ecdsa > x509-server-key-ecc.pem
398           $ certtool --generate-certificate --load-privkey x509-server-key-ecc.pem   --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem   --template server.tmpl --outfile x509-server-ecc.pem
399
400
401       The next step is to add support for SRP authentication. This requires
402       an SRP password file created with srptool.  To start the server with
403       SRP support:
404
405           gnutls-serv --http --priority NORMAL:+SRP-RSA:+SRP             --srppasswdconf srp-tpasswd.conf             --srppasswd srp-passwd.txt
406
407       Let's also start a server with support for PSK. This would require a
408       password file created with psktool.
409
410           gnutls-serv --http --priority NORMAL:+ECDHE-PSK:+PSK             --pskpasswd psk-passwd.txt
411
412       If you want a server with support for raw public-keys we can also add
413       these credentials. Note however that there is no identity information
414       linked to these keys as is the case with regular x509 certificates. Au‐
415       thentication must be done via different means. Also we need to explic‐
416       itly enable raw public-key certificates via the priority strings.
417
418           gnutls-serv --http --priority NORMAL:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK             --rawpkfile srv.rawpk.pem             --rawpkkeyfile srv.key.pem
419
420
421       Finally, we start the server with all the earlier parameters and you
422       get this command:
423
424           gnutls-serv --http --priority NORMAL:+PSK:+SRP:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK             --x509cafile x509-ca.pem             --x509keyfile x509-server-key.pem             --x509certfile x509-server.pem             --x509keyfile x509-server-key-ecc.pem             --x509certfile x509-server-ecc.pem             --srppasswdconf srp-tpasswd.conf             --srppasswd srp-passwd.txt             --pskpasswd psk-passwd.txt             --rawpkfile srv.rawpk.pem             --rawpkkeyfile srv.key.pem
425

EXIT STATUS

427       One of the following exit values will be returned:
428
429       0  (EXIT_SUCCESS)
430              Successful program execution.
431
432       1  (EXIT_FAILURE)
433              The operation failed or the command syntax was not valid.
434

AUTHORS

COPYRIGHT

440       Copyright (C) 2020-2023 Free Software Foundation, and others all rights
441       reserved.  This program is released under the terms of the GNU General
442       Public License, version 3 or later
443

BUGS

445       Please send bug reports to: bugs@gnutls.org
446
447
448
4493.8.2                             15 Nov 2023                   gnutls-serv(1)