Commit 481afe2a authored by Paul Yang's avatar Paul Yang Committed by Rich Salz
Browse files

Make SNI behavior more clear in s_client doc & help 



Update s_client -help and pod file.

Signed-off-by: default avatarPaul Yang <paulyang.inf@gmail.com>

Reviewed-by: default avatarAndy Polyakov <appro@openssl.org>
Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3654)
parent 979874a2

apps/s_client.c

+1 −1
Original line number Diff line number Diff line
@@ -651,7 +651,7 @@ const OPTIONS s_client_options[] = { 
     "CA file for certificate verification (PEM format)"},

    {"nocommands", OPT_NOCMDS, '-', "Do not use interactive command letters"},

    {"servername", OPT_SERVERNAME, 's',

     "Set TLS extension servername in ClientHello"},

     "Set TLS extension servername (SNI) in ClientHello (default)"},

    {"noservername", OPT_NOSERVERNAME, '-',

     "Do not send the server name (SNI) extension in the ClientHello"},

    {"tlsextdebug", OPT_TLSEXTDEBUG, '-',

doc/man1/s_client.pod

+9 −5
Original line number Diff line number Diff line
@@ -159,16 +159,20 @@ Use IPv6 only. 
=item B<-servername name>



Set the TLS SNI (Server Name Indication) extension in the ClientHello message to

the given value.

the given value. If both this option and the B<-noservername> are not given, the

TLS SNI extension is still set to the hostname provided to the B<-connect> option,

or "localhost" if B<-connect> has not been supplied. This is default since OpenSSL

1.1.1.



Even though SNI name should normally be a DNS name and not an IP address, this

option will not make the distinction when parsing B<-connect> and will send

IP address if one passed.



=item B<-noservername>



Suppresses sending of the SNI (Server Name Indication) extension in the

ClientHello message. Cannot be used in conjunction with the B<-servername> or

<-dane_tlsa_domain> options. If this option is not given then the hostname

provided to the B<-connect> option is used in the SNI extension, or "localhost"

if B<-connect> has not been supplied. Note that an SNI name should normally be a

DNS name and not an IP address.

<-dane_tlsa_domain> options.



=item B<-cert certname>