1S_TIME(1)                           OpenSSL                          S_TIME(1)
2
3
4

NAME

6       s_time - SSL/TLS performance timing program
7

SYNOPSIS

9       openssl s_time [-connect host:port] [-www page] [-cert filename] [-key
10       filename] [-CApath directory] [-CAfile filename] [-reuse] [-new] [-ver‐
11       ify depth] [-nbio] [-time seconds] [-ssl2] [-ssl3] [-bugs] [-cipher
12       cipherlist]
13

DESCRIPTION

15       The s_client command implements a generic SSL/TLS client which connects
16       to a remote host using SSL/TLS. It can request a page from the server
17       and includes the time to transfer the payload data in its timing mea‐
18       surements. It measures the number of connections within a given time‐
19       frame, the amount of data transferred (if any), and calculates the
20       average time spent for one connection.
21

OPTIONS

23       -connect host:port
24           This specifies the host and optional port to connect to.
25
26       -www page
27           This specifies the page to GET from the server. A value of '/' gets
28           the index.htm[l] page. If this parameter is not specified, then
29           s_time will only perform the handshake to establish SSL connections
30           but not transfer any payload data.
31
32       -cert certname
33           The certificate to use, if one is requested by the server. The
34           default is not to use a certificate. The file is in PEM format.
35
36       -key keyfile
37           The private key to use. If not specified then the certificate file
38           will be used. The file is in PEM format.
39
40       -verify depth
41           The verify depth to use. This specifies the maximum length of the
42           server certificate chain and turns on server certificate verifica‐
43           tion.  Currently the verify operation continues after errors so all
44           the problems with a certificate chain can be seen. As a side effect
45           the connection will never fail due to a server certificate verify
46           failure.
47
48       -CApath directory
49           The directory to use for server certificate verification. This
50           directory must be in "hash format", see verify for more informa‐
51           tion. These are also used when building the client certificate
52           chain.
53
54       -CAfile file
55           A file containing trusted certificates to use during server authen‐
56           tication and to use when attempting to build the client certificate
57           chain.
58
59       -new
60           performs the timing test using a new session ID for each connec‐
61           tion.  If neither -new nor -reuse are specified, they are both on
62           by default and executed in sequence.
63
64       -reuse
65           performs the timing test using the same session ID; this can be
66           used as a test that session caching is working. If neither -new nor
67           -reuse are specified, they are both on by default and executed in
68           sequence.
69
70       -nbio
71           turns on non-blocking I/O.
72
73       -ssl2, -ssl3
74           these options disable the use of certain SSL or TLS protocols. By
75           default the initial handshake uses a method which should be compat‐
76           ible with all servers and permit them to use SSL v3, SSL v2 or TLS
77           as appropriate.  The timing program is not as rich in options to
78           turn protocols on and off as the s_client(1) program and may not
79           connect to all servers.
80
81           Unfortunately there are a lot of ancient and broken servers in use
82           which cannot handle this technique and will fail to connect. Some
83           servers only work if TLS is turned off with the -ssl3 option; oth‐
84           ers will only support SSL v2 and may need the -ssl2 option.
85
86       -bugs
87           there are several known bug in SSL and TLS implementations. Adding
88           this option enables various workarounds.
89
90       -cipher cipherlist
91           this allows the cipher list sent by the client to be modified.
92           Although the server determines which cipher suite is used it should
93           take the first supported cipher in the list sent by the client.
94           See the ciphers(1) command for more information.
95
96       -time length
97           specifies how long (in seconds) s_time should establish connections
98           and optionally transfer payload data from a server. Server and
99           client performance and the link speed determine how many connec‐
100           tions s_time can establish.
101

NOTES

103       s_client can be used to measure the performance of an SSL connection.
104       To connect to an SSL HTTP server and get the default page the command
105
106        openssl s_time -connect servername:443 -www / -CApath yourdir -CAfile yourfile.pem -cipher commoncipher [-ssl3]
107
108       would typically be used (https uses port 443). 'commoncipher' is a
109       cipher to which both client and server can agree, see the ciphers(1)
110       command for details.
111
112       If the handshake fails then there are several possible causes, if it is
113       nothing obvious like no client certificate then the -bugs, -ssl2, -ssl3
114       options can be tried in case it is a buggy server. In particular you
115       should play with these options before submitting a bug report to an
116       OpenSSL mailing list.
117
118       A frequent problem when attempting to get client certificates working
119       is that a web client complains it has no certificates or gives an empty
120       list to choose from. This is normally because the server is not sending
121       the clients certificate authority in its "acceptable CA list" when it
122       requests a certificate. By using s_client(1) the CA list can be viewed
123       and checked. However some servers only request client authentication
124       after a specific URL is requested. To obtain the list in this case it
125       is necessary to use the -prexit option of s_client(1) and send an HTTP
126       request for an appropriate page.
127
128       If a certificate is specified on the command line using the -cert
129       option it will not be used unless the server specifically requests a
130       client certificate. Therefor merely including a client certificate on
131       the command line is no guarantee that the certificate works.
132

BUGS

134       Because this program does not have all the options of the s_client(1)
135       program to turn protocols on and off, you may not be able to measure
136       the performance of all protocols with all servers.
137
138       The -verify option should really exit if the server verification fails.
139

SEE ALSO

141       s_client(1), s_server(1), ciphers(1)
142
143
144
1450.9.8b                            2004-01-08                         S_TIME(1)
Impressum