Openssl TLS extension support configuration (Server Name Indication)

https openssl ssl sni
PravinCG picture PravinCG · Sep 21, 2011 · Viewed 7.7k times · Source

I want to configure openssl client-server to support TLS extensions specifically server name indication (SNI).

I have build the latest openssl 1.0.0e on ubuntu linux without giving any additional config parameter.

 
./config
make
make install

Not sure if I need to give any additional config parameters while building for this version.

Now I have set up server and connecting to it through openssl client using the standard command line tool provided by openssl, viz s_client and s_server.

My question is: how do I specify the host name to be sent as extension in s_client? Does openssl have the provision to specify server name using some parameter in commandline?

Thanks!

Answer

PravinCG picture PravinCG · Feb 28, 2012

This has been lying dormant for some time. Since I figured this out long back, it would be logical to write the answer and put a closure to this.

The command-line option servername is available to specify SNI. 

openssl s_client -connect myweb.address.com:443 -servername myweb.address.com

The above command will trigger TLS client with the given server name present in SNI extension of client hello.

Related questions

SSL Error: unable to get local issuer certificate

I'm having trouble configuring SSL on a Debian 6.0 32bit server. I'm relatively new with SSL so please bear with me. I'm including as much information as I can. Note: The true domain name has been changed to protect the identity …

Read More
What does "SSL_CTX_use_PrivateKey_file" "problems getting password error" indicate in Nginx error log?

I'm trying to set up SSL on Nginx. It doesn't work, and I am getting the following error in the error log, which is getting passed up from the OpenSSL library which nginx was compiled with. I don't know what …

Read More
import self signed certificate in redhat

How can I import a self-signed certificate in Red-Hat Linux. I'm not an expert with respect to certificates and find it difficult to find the right answer through googling, since I don't know the difference between a .cer, .crt or …

Read More