I would like to troubleshoot per directory authentication with client certificate. I would specially like to find out which acceptable client certificates does server send.
How do I debug SSL handshake, preferably with cURL?
I have used this command to troubleshoot client certificate negotiation:
openssl s_client -connect www.test.com:443 -prexit
The output will probably contain "Acceptable client certificate CA names" and a list of CA certificates from the server, or possibly "No client certificate CA names sent", if the server doesn't always require client certificates.
-showcerts
and it worked like a charm - thanks!
OpenSSL 1.0.2k-fips 26 Jan 2017
the client side certs were not sent. When client side certs were requested (via CertificateRequest message), then client responded with a client Certificate message with an empty list of certificates.
curl -iv https://your.domain.io
That will give you cert and header output if you do not wish to use openssl command.
openssl s_client
does. :-/
openssl s_client
instead of curl
.-msg
does the trick!-debug
helps to see what actually travels over the socket.-status
OCSP stapling should be standard nowadays.openssl s_client -connect example.com:443 \
-tls1_2 -status -msg -debug \
-CAfile <path to trusted root ca pem> \
-key <path to client private key pem> \
-cert <path to client cert pem>
Other useful switches
-tlsextdebug
-prexit
-state
Actually openssl
command is a better tool than curl
for checking and debugging SSL. Here is an example with openssl
:
openssl s_client -showcerts -connect stackoverflow.com:443 < /dev/null
and < /dev/null
is for adding EOL to the STDIN
otherwise it hangs on the Terminal.
But if you liked, you can wrap some useful openssl
commands with curl
(as I did with curly) and make it more human readable like so:
# check if SSL is valid
>>> curly --ssl valid -d stackoverflow.com
Verify return code: 0 (ok)
issuer=C = US
O = Let's Encrypt
CN = R3
subject=CN = *.stackexchange.com
option: ssl
action: valid
status: OK
# check how many days it will be valid
>>> curly --ssl date -d stackoverflow.com
Verify return code: 0 (ok)
from: Tue Feb 9 16:13:16 UTC 2021
till: Mon May 10 16:13:16 UTC 2021
days total: 89
days passed: 8
days left: 81
option: ssl
action: date
status: OK
# check which names it supports
curly --ssl name -d stackoverflow.com
*.askubuntu.com
*.blogoverflow.com
*.mathoverflow.net
*.meta.stackexchange.com
*.meta.stackoverflow.com
*.serverfault.com
*.sstatic.net
*.stackexchange.com
*.stackoverflow.com
*.stackoverflow.email
*.superuser.com
askubuntu.com
blogoverflow.com
mathoverflow.net
openid.stackauth.com
serverfault.com
sstatic.net
stackapps.com
stackauth.com
stackexchange.com
stackoverflow.blog
stackoverflow.com
stackoverflow.email
stacksnippets.net
superuser.com
option: ssl
action: name
status: OK
# check the CERT of the SSL
>>> curly --ssl cert -d stackoverflow.com
-----BEGIN CERTIFICATE-----
MIIG9DCCBdygAwIBAgISBOh5mcfyJFrMPr3vuAuikAYwMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTAyMDkxNjEzMTZaFw0yMTA1MTAxNjEzMTZaMB4xHDAaBgNVBAMM
Eyouc3RhY2tleGNoYW5nZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDRDObYpjCvb2smnCP+UUpkKdSr6nVsIN8vkI6YlJfC4xC72bY2v38lE2xB
LCaL9MzKhsINrQZRIUivnEHuDOZyJ3Xwmxq3wY0qUKo2c963U7ZJpsIFsj37L1Ac
Qp4pubyyKPxTeFAzKbpfwhNml633Ao78Cy/l/sYjNFhMPoBN4LYBX7/WJNIfc3UZ
niMfh230NE2dwoXGqA0MnkPQyFKlIwHcmMb+ZI5T8TziYq0WQiYUY3ssOEu1CI5n
wh0+BTAwpx7XBUe5Z+B9SrFp8BUDYWcWuVEIh2btYvo763mrr+lmm8PP23XKkE4f
287Iwlfg/IqxxIxKv9smFoPkyZcFAgMBAAGjggQWMIIEEjAOBgNVHQ8BAf8EBAMC
BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAw
HQYDVR0OBBYEFMnjX41T+J1bbLgG9TjR/4CvHLv/MB8GA1UdIwQYMBaAFBQusxe3
WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0
cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5j
ci5vcmcvMIIB5AYDVR0RBIIB2zCCAdeCDyouYXNrdWJ1bnR1LmNvbYISKi5ibG9n
b3ZlcmZsb3cuY29tghIqLm1hdGhvdmVyZmxvdy5uZXSCGCoubWV0YS5zdGFja2V4
Y2hhbmdlLmNvbYIYKi5tZXRhLnN0YWNrb3ZlcmZsb3cuY29tghEqLnNlcnZlcmZh
dWx0LmNvbYINKi5zc3RhdGljLm5ldIITKi5zdGFja2V4Y2hhbmdlLmNvbYITKi5z
dGFja292ZXJmbG93LmNvbYIVKi5zdGFja292ZXJmbG93LmVtYWlsgg8qLnN1cGVy
dXNlci5jb22CDWFza3VidW50dS5jb22CEGJsb2dvdmVyZmxvdy5jb22CEG1hdGhv
dmVyZmxvdy5uZXSCFG9wZW5pZC5zdGFja2F1dGguY29tgg9zZXJ2ZXJmYXVsdC5j
b22CC3NzdGF0aWMubmV0gg1zdGFja2FwcHMuY29tgg1zdGFja2F1dGguY29tghFz
dGFja2V4Y2hhbmdlLmNvbYISc3RhY2tvdmVyZmxvdy5ibG9nghFzdGFja292ZXJm
bG93LmNvbYITc3RhY2tvdmVyZmxvdy5lbWFpbIIRc3RhY2tzbmlwcGV0cy5uZXSC
DXN1cGVydXNlci5jb20wTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMB
AQEwKDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEE
BgorBgEEAdZ5AgQCBIH1BIHyAPAAdgBElGUusO7Or8RAB9io/ijA2uaCvtjLMbU/
0zOWtbaBqAAAAXeHyHI8AAAEAwBHMEUCIQDnzDcCrmCPdfgcb/ojY0WJV1rCj+uE
hCiQi0+4fBP9lgIgSI5mwEqBmVcQwRfKikUzhkH0w6K/6wq0e/1zJA0j5a4AdgD2
XJQv0XcwIhRUGAgwlFaO400TGTO/3wwvIAvMTvFk4wAAAXeHyHIoAAAEAwBHMEUC
IHd0ZLB3j0b31Sh/D3RIfF8C31NxIRSG6m/BFSCGlxSWAiEAvYlgPjrPcBZpX4Xm
SdkF39KbVicTGnFOSAqDpRB3IJwwDQYJKoZIhvcNAQELBQADggEBABZ+2WXyP4w/
A+jJtBgKTZQsA5VhUCabAFDEZdnlWWcV3WYrz4iuJjp5v6kL4MNzAvAVzyCTqD1T
m7EUn/usz59m02mZF82+ELLW6Mqix8krYZTpYt7Hu3Znf6HxiK3QrjEIVlwSGkjV
XMCzOHdALreTkB+UJaL6bEs1sB+9h20zSnZAKrPokGL/XwgxUclXIQXr1uDAShJB
Ts0yjoSY9D687W9sjhq+BIjNYIWg1n9NJ7HM48FWBCDmV3NlCR0Zh1Yx15pXCUhb
UqWd6RzoSLmIfdOxgfi9uRSUe0QTZ9o/Fs4YoMi5K50tfRycLKW+BoYDgde37As5
0pCUFwVVH2E=
-----END CERTIFICATE-----
option: ssl
action: cert
status: OK
-servername stackoverflow.com
in there as well, since the server you're contacting is using SNI (e.g. if you're on Cloudflare or Heroku). The browsers send this automatically, but using the CLI openssl
you have to pass this flag manually.
curl probably does have some options for showing more information but for things like this I always use openssl s_client
With the -debug
option this gives lots of useful information
Maybe I should add that this also works with non HTTP connections. So if you are doing "https", try the curl commands suggested below. If you aren't or want a second option openssl s_client
might be good
curl -V
), then you should try to debug your connection with a binary which uses that SSL library instead e.g. gnutls-cli -V www.google.com 443
Commented
Sep 28, 2016 at 8:24
curl
has a --trace
(and --trace-ascii
) option, which prints basically everything, including all SSL/TSL handshaking. Since --trace
supersedes other verbosity options, all you need is
curl --trace /path/to/trace.log https://example.com
You can then read up on ietf to match the messages from the log to the respective messages from the standard - e.g. TLS v1.2, TLS v1.3, curl even prints the corresponding message number from the standard like:
== Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):
Where the (1)
is the message number.
--trace-ascii
works just as --trace
but does not print the binary data.
--trace
output will therefore not include TLS handshake output. Ouch!
curl
is not a debugger :) But actually I liked curl
output more than openssl s_client
's because I was able to see how many certificates both parties sent and their CN
s.
You can use curl
this way (--trace
):
curl --trace a.log https://example.com
In case you want to use CA certs from a custom file (--cacert
):
curl --trace a.log https://example.com \
--cacert certs/ca.crt
Or provide the client certifirate (--cert
, --key
):
curl --trace a.log https://example.com \
--cacert certs/ca.crt \
--cert certs/client.crt --key certs/client.key
You can also use --trace-ascii
in place of --trace
.
Similar things are possible with openssl s_client
(-connect
, -servername
, -CAfile
, -cert
, -key
):
openssl s_client -connect IP:PORT \
-servername DOMAIN \
-CAfile certs/ca.crt \
-cert certs/client.crt -key certs/client.key
You can add:
-state
- notify when the session state changes (similar to what you get if you set the info callback)-msg
- shows what messages (bytes) are exactly sent-debug
- similar to -msg
But if you want to debug for real :) you can build openssl
with debug symbols e.g.:
$ docker run --rm -it alpine:3.19
/ # apk add git build-base perl linux-headers
/ # git clone https://github.com/openssl/openssl
/ # cd openssl
/openssl # ./Configure --debug CFLAGS='-g3 -O0'
/openssl # make install
/openssl # LD_LIBRARY_PATH=/usr/local/lib64 openssl --version
Then you can launch your application with gdb
:
/ # apk add gdb
/ # LD_LIBRARY_PATH=/usr/local/lib64 \
gdb -ex 'b main' -ex r \
-ex 'b ossl_statem_client_process_message' -ex c \
--args path/to/app [ARGS]
ossl_statem_client_process_message
is the entrypoint for processing server messages. Use ossl_statem_server_process_message
for client messages, and verify_chain
for certificate verification.