278 lines
9.8 KiB
HTML
278 lines
9.8 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of S_TIME</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>S_TIME</H1>
|
|
Section: OpenSSL (1SSL)<BR>Updated: 2021-03-22<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
openssl-s_time, s_time - SSL/TLS performance timing program
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
|
|
|
|
<B>openssl</B> <B>s_time</B>
|
|
[<B>-help</B>]
|
|
[<B>-connect host:port</B>]
|
|
[<B>-www page</B>]
|
|
[<B>-cert filename</B>]
|
|
[<B>-key filename</B>]
|
|
[<B>-CApath directory</B>]
|
|
[<B>-cafile filename</B>]
|
|
[<B>-no-CAfile</B>]
|
|
[<B>-no-CApath</B>]
|
|
[<B>-reuse</B>]
|
|
[<B>-new</B>]
|
|
[<B>-verify depth</B>]
|
|
[<B>-nameopt option</B>]
|
|
[<B>-time seconds</B>]
|
|
[<B>-ssl3</B>]
|
|
[<B>-bugs</B>]
|
|
[<B>-cipher cipherlist</B>]
|
|
[<B>-ciphersuites val</B>]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
|
|
|
|
The <B>s_time</B> command implements a generic <FONT SIZE="-1">SSL/TLS</FONT> client which connects to a
|
|
remote host using <FONT SIZE="-1">SSL/TLS.</FONT> It can request a page from the server and includes
|
|
the time to transfer the payload data in its timing measurements. It measures
|
|
the number of connections within a given timeframe, the amount of data
|
|
transferred (if any), and calculates the average time spent for one connection.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-help</B><DD>
|
|
|
|
|
|
Print out a usage message.
|
|
<DT id="2"><B>-connect host:port</B><DD>
|
|
|
|
|
|
This specifies the host and optional port to connect to.
|
|
<DT id="3"><B>-www page</B><DD>
|
|
|
|
|
|
This specifies the page to <FONT SIZE="-1">GET</FONT> from the server. A value of '/' gets the
|
|
index.htm[l] page. If this parameter is not specified, then <B>s_time</B> will only
|
|
perform the handshake to establish <FONT SIZE="-1">SSL</FONT> connections but not transfer any
|
|
payload data.
|
|
<DT id="4"><B>-cert certname</B><DD>
|
|
|
|
|
|
The certificate to use, if one is requested by the server. The default is
|
|
not to use a certificate. The file is in <FONT SIZE="-1">PEM</FONT> format.
|
|
<DT id="5"><B>-key keyfile</B><DD>
|
|
|
|
|
|
The private key to use. If not specified then the certificate file will
|
|
be used. The file is in <FONT SIZE="-1">PEM</FONT> format.
|
|
<DT id="6"><B>-verify depth</B><DD>
|
|
|
|
|
|
The verify depth to use. This specifies the maximum length of the
|
|
server certificate chain and turns on server certificate verification.
|
|
Currently the verify operation continues after errors so all the problems
|
|
with a certificate chain can be seen. As a side effect the connection
|
|
will never fail due to a server certificate verify failure.
|
|
<DT id="7"><B>-nameopt option</B><DD>
|
|
|
|
|
|
Option which determines how the subject or issuer names are displayed. The
|
|
<B>option</B> argument can be a single option or multiple options separated by
|
|
commas. Alternatively the <B>-nameopt</B> switch may be used more than once to
|
|
set multiple options. See the <B><A HREF="/cgi-bin/man/man2html?1+x509">x509</A></B>(1) manual page for details.
|
|
<DT id="8"><B>-CApath directory</B><DD>
|
|
|
|
|
|
The directory to use for server certificate verification. This directory
|
|
must be in ``hash format'', see <B>verify</B> for more information. These are
|
|
also used when building the client certificate chain.
|
|
<DT id="9"><B>-CAfile file</B><DD>
|
|
|
|
|
|
A file containing trusted certificates to use during server authentication
|
|
and to use when attempting to build the client certificate chain.
|
|
<DT id="10"><B>-no-CAfile</B><DD>
|
|
|
|
|
|
Do not load the trusted <FONT SIZE="-1">CA</FONT> certificates from the default file location
|
|
<DT id="11"><B>-no-CApath</B><DD>
|
|
|
|
|
|
Do not load the trusted <FONT SIZE="-1">CA</FONT> certificates from the default directory location
|
|
<DT id="12"><B>-new</B><DD>
|
|
|
|
|
|
Performs the timing test using a new session <FONT SIZE="-1">ID</FONT> for each connection.
|
|
If neither <B>-new</B> nor <B>-reuse</B> are specified, they are both on by default
|
|
and executed in sequence.
|
|
<DT id="13"><B>-reuse</B><DD>
|
|
|
|
|
|
Performs the timing test using the same session <FONT SIZE="-1">ID</FONT>; this can be used as a test
|
|
that session caching is working. If neither <B>-new</B> nor <B>-reuse</B> are
|
|
specified, they are both on by default and executed in sequence.
|
|
<DT id="14"><B>-ssl3</B><DD>
|
|
|
|
|
|
This option disables the use of <FONT SIZE="-1">SSL</FONT> version 3. By default
|
|
the initial handshake uses a method which should be compatible with all
|
|
servers and permit them to use <FONT SIZE="-1">SSL</FONT> v3 or <FONT SIZE="-1">TLS</FONT> as appropriate.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
The timing program is not as rich in options to turn protocols on and off as
|
|
the <B><A HREF="/cgi-bin/man/man2html?1+s_client">s_client</A></B>(1) program and may not connect to all servers.
|
|
Unfortunately there are a lot of ancient and broken servers in use which
|
|
cannot handle this technique and will fail to connect. Some servers only
|
|
work if <FONT SIZE="-1">TLS</FONT> is turned off with the <B>-ssl3</B> option.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
Note that this option may not be available, depending on how
|
|
OpenSSL was built.
|
|
<DT id="15"><B>-bugs</B><DD>
|
|
|
|
|
|
There are several known bugs in <FONT SIZE="-1">SSL</FONT> and <FONT SIZE="-1">TLS</FONT> implementations. Adding this
|
|
option enables various workarounds.
|
|
<DT id="16"><B>-cipher cipherlist</B><DD>
|
|
|
|
|
|
This allows the TLSv1.2 and below cipher list sent by the client to be modified.
|
|
This list will be combined with any TLSv1.3 ciphersuites that have been
|
|
configured. Although the server determines which cipher suite is used it should
|
|
take the first supported cipher in the list sent by the client. See
|
|
<B><A HREF="/cgi-bin/man/man2html?1+ciphers">ciphers</A></B>(1) for more information.
|
|
<DT id="17"><B>-ciphersuites val</B><DD>
|
|
|
|
|
|
This allows the TLSv1.3 ciphersuites sent by the client to be modified. This
|
|
list will be combined with any TLSv1.2 and below ciphersuites that have been
|
|
configured. Although the server determines which cipher suite is used it should
|
|
take the first supported cipher in the list sent by the client. See
|
|
<B><A HREF="/cgi-bin/man/man2html?1+ciphers">ciphers</A></B>(1) for more information. The format for this list is a simple
|
|
colon (``:'') separated list of TLSv1.3 ciphersuite names.
|
|
<DT id="18"><B>-time length</B><DD>
|
|
|
|
|
|
Specifies how long (in seconds) <B>s_time</B> should establish connections and
|
|
optionally transfer payload data from a server. Server and client performance
|
|
and the link speed determine how many connections <B>s_time</B> can establish.
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
|
|
|
|
<B>s_time</B> can be used to measure the performance of an <FONT SIZE="-1">SSL</FONT> connection.
|
|
To connect to an <FONT SIZE="-1">SSL HTTP</FONT> server and get the default page the command
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl s_time -connect servername:443 -www / -CApath yourdir -CAfile yourfile.pem -cipher commoncipher [-ssl3]
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
would typically be used (https uses port 443). 'commoncipher' is a cipher to
|
|
which both client and server can agree, see the <B><A HREF="/cgi-bin/man/man2html?1+ciphers">ciphers</A></B>(1) command
|
|
for details.
|
|
<P>
|
|
|
|
If the handshake fails then there are several possible causes, if it is
|
|
nothing obvious like no client certificate then the <B>-bugs</B> and
|
|
<B>-ssl3</B> options can be tried
|
|
in case it is a buggy server. In particular you should play with these
|
|
options <B>before</B> submitting a bug report to an OpenSSL mailing list.
|
|
<P>
|
|
|
|
A frequent problem when attempting to get client certificates working
|
|
is that a web client complains it has no certificates or gives an empty
|
|
list to choose from. This is normally because the server is not sending
|
|
the clients certificate authority in its ``acceptable <FONT SIZE="-1">CA</FONT> list'' when it
|
|
requests a certificate. By using <B><A HREF="/cgi-bin/man/man2html?1+s_client">s_client</A></B>(1) the <FONT SIZE="-1">CA</FONT> list can be
|
|
viewed and checked. However some servers only request client authentication
|
|
after a specific <FONT SIZE="-1">URL</FONT> is requested. To obtain the list in this case it
|
|
is necessary to use the <B>-prexit</B> option of <B><A HREF="/cgi-bin/man/man2html?1+s_client">s_client</A></B>(1) and
|
|
send an <FONT SIZE="-1">HTTP</FONT> request for an appropriate page.
|
|
<P>
|
|
|
|
If a certificate is specified on the command line using the <B>-cert</B>
|
|
option it will not be used unless the server specifically requests
|
|
a client certificate. Therefor merely including a client certificate
|
|
on the command line is no guarantee that the certificate works.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
|
|
|
|
Because this program does not have all the options of the
|
|
<B><A HREF="/cgi-bin/man/man2html?1+s_client">s_client</A></B>(1) program to turn protocols on and off, you may not be
|
|
able to measure the performance of all protocols with all servers.
|
|
<P>
|
|
|
|
The <B>-verify</B> option should really exit if the server verification
|
|
fails.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+s_client">s_client</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+s_server">s_server</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+ciphers">ciphers</A></B>(1)
|
|
<A NAME="lbAI"> </A>
|
|
<H2>COPYRIGHT</H2>
|
|
|
|
|
|
|
|
Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
<P>
|
|
|
|
Licensed under the OpenSSL license (the ``License''). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file <FONT SIZE="-1">LICENSE</FONT> in the source distribution or at
|
|
<<A HREF="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</A>>.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="19"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="20"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="21"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="22"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DT id="23"><A HREF="#lbAF">NOTES</A><DD>
|
|
<DT id="24"><A HREF="#lbAG">BUGS</A><DD>
|
|
<DT id="25"><A HREF="#lbAH">SEE ALSO</A><DD>
|
|
<DT id="26"><A HREF="#lbAI">COPYRIGHT</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:27 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|