The TCP port to listen on for connections. If not specified 4433 is used.

The optional TCP host and port to listen on for connections. If not specified, *:4433 is used.

Unix domain socket to accept on.

Use IPv4 only.

Use IPv6 only.

For -unix, unlink any existing socket first.

Sets the SSL context id. It can be given any string value. If this option is not present a default value will be used.

The verify depth to use. This specifies the maximum length of the client certificate chain and makes the server request a certificate from the client. With the -verify option a certificate is requested but the client does not have to send one, with the -Verify option the client must supply a certificate or an error occurs.

If the cipher suite cannot request a client certificate (for example an anonymous cipher suite or PSK) this option has no effect.

The certificate to use, most servers cipher suites require the use of a certificate and some require a certificate with a certain public key type: for example the DSS cipher suites require a certificate containing a DSS (DSA) key. If not specified then the filename server.pem will be used.

Specify whether the application should build the server certificate chain to be provided to the client.

A file containing one or more blocks of PEM data. Each PEM block must encode a TLS ServerHello extension (2 bytes type, 2 bytes length, followed by "length" bytes of extension data). If the client sends an empty TLS ClientHello extension matching the type, the corresponding ServerHello extension will be returned.

The private key to use. If not specified then the certificate file will be used.

A file containing untrusted certificates to use when attempting to build the server certificate chain when a certificate specified via the -dcert option is in use.

This option translated a line feed from the terminal into CR+LF.

Print extensive debugging information including a hex dump of all traffic.

Show all protocol messages with hex dump.

File to send output of -msg or -trace to, default standard output.

Prints the SSL session states.

The CRL file to use.

A file in PEM format CA containing trusted certificates to use for verifying client certificates.

A file in PEM format containing trusted certificates to use when attempting to build the server certificate chain.

Inhibit printing of session and certificate information.

Print a hex dump of any TLS extensions received from the server.

Sends a status message back to the client when it connects. This includes information about the ciphers used and various session parameters. The output is in HTML format so this option can be used with a web browser. The special URL /renegcert turns on client cert validation, and /reneg tells the server to request renegotiation. The -early_data option cannot be used with this option.

Emulates a simple web server. Pages will be resolved relative to the current directory, for example if the URL https://myhost/page.html is requested the file ./page.html will be sent. If the -HTTP flag is used, the files are sent directly, and should contain any HTTP response headers (including status response line). If the -WWW option is used, the response headers are generated by the server, and the file extension is examined to determine the Content-Type header. Extensions of html, htm, and php are text/html and all others are text/plain. In addition, the special URL /stats will return status information like the -www option. Neither of these options can be used in conjunction with -early_data.

When acting as web-server (using option -WWW or -HTTP) open files requested by the client in binary mode.

Disable TLS Extension CA Names. You may want to disable it for security reasons or for compatibility with some Windows TLS implementations crashing when this extension is larger than 1024 bytes.

Generate SSL/TLS session IDs prefixed by val. This is mostly useful for testing any SSL/TLS code (eg. proxies) that wish to deal with multiple servers, when each of which might be generating a unique range of session IDs (eg. with a certain prefix).

Verification errors normally just print a message but allow the connection to continue, for debugging purposes. If this option is used, then verification errors close the connection.

Enables certificate status request support (aka OCSP stapling).

Enables certificate status request support (aka OCSP stapling) and gives a verbose printout of the OCSP response.

Sets the timeout for OCSP response to int seconds.

Sets a fallback responder URL to use if no responder URL is present in the server certificate. Without this option an error is returned if the server certificate does not contain a responder address.

Overrides any OCSP responder URLs from the certificate and always provides the OCSP Response stored in the file. The file must be in DER format.

Show verbose trace output of protocol messages. OpenSSL needs to be compiled with enable-ssl-trace for this option to work.

Provide a brief summary of connection parameters instead of the normal verbose output.

Simple test server which just reverses the text received from the client and sends it back to the server. Also sets -brief. Cannot be used in conjunction with -early_data.

Switch on asynchronous mode. Cryptographic operations will be performed asynchronously. This will only have an effect if an asynchronous capable engine is also used via the -engine option. For test purposes the dummy async engine (dasync) can be used (if available).

Disable negotiation of TLS compression. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.

Enable negotiation of TLS compression. This option was introduced in OpenSSL 1.1.0. TLS compression is not recommended and is off by default as of OpenSSL 1.1.0.

Disable RFC4507bis session ticket support. This option has no effect if TLSv1.3 is negotiated. See -num_tickets.

Control the number of tickets that will be sent to the client after a full handshake in TLSv1.3. The default number of tickets is 2. This option does not affect the number of tickets sent after a resumption handshake.

Use the server's cipher preferences, rather than the client's preferences.

Prioritize ChaCha ciphers when preferred by clients. Requires -serverpref.

Set the SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION option.

Signature algorithms to support for client certificate authentication (colon-separated list).

Specifies the elliptic curve to use. NOTE: this is single curve, not a list. For a list of all possible curves, use:

    $ openssl ecparam -list_curves

Turns on non blocking I/O.

Expect the client to send PSK identity val when using a PSK cipher suite, and warn if they do not. By default, the expected PSK identity is the string "Client_identity".

Use the PSK identity hint val when using a PSK cipher suite.

Use the PSK key val when using a PSK cipher suite. The key is given as a hexadecimal number without leading 0x, for example -psk 1a2b3c4d. This option must be provided in order to use a PSK cipher.

Use the pem encoded SSL_SESSION data stored in file as the basis of a PSK. Note that this will only work if TLSv1.3 is negotiated.

This option can only be used in conjunction with one of the DTLS options above. With this option, this command will listen on a UDP port for incoming connections. Any ClientHellos that arrive will be checked to see if they have a cookie in them or not. Any without a cookie will be responded to with a HelloVerifyRequest. If a ClientHello with a cookie is received then this command will connect to that peer and complete the handshake.

Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in conjunction with -dtls, -dtls1 or -dtls1_2. This option is only available where OpenSSL has support for SCTP enabled.

Use the incorrect behaviour of older OpenSSL implementations when computing endpoint-pair shared secrets for DTLS/SCTP. This allows communication with older broken implementations but breaks interoperability with correct implementations. Must be used in conjunction with -sctp. This option is only available where OpenSSL has support for SCTP enabled.

If this option is set then no DH parameters will be loaded effectively disabling the ephemeral DH cipher suites.

These flags enable the Enable the Application-Layer Protocol Negotiation or Next Protocol Negotiation (NPN) extension, respectively. ALPN is the IETF standard and replaces NPN. The val list is a comma-separated list of supported protocol names. The list should contain the most desirable protocols first. Protocol names are printable ASCII strings, for example "http/1.1" or "spdy/3". The flag -nextprotoneg cannot be specified if -tls1_3 is used.

If this option is set and KTLS is enabled, SSL_sendfile() will be used instead of BIO_write() to send the HTTP response requested by a client. This option is only valid if -WWW or -HTTP is specified.

Appends TLS secrets to the specified keylog file such that external programs (like Wireshark) can decrypt TLS connections.

Change the default maximum early data bytes that are specified for new sessions and any incoming early data (when used in conjunction with the -early_data flag). The default value is approximately 16k. The argument must be an integer greater than or equal to 0.

Specify the hard limit on the maximum number of early data bytes that will be accepted.

Accept early data where possible. Cannot be used in conjunction with -www, -WWW, -HTTP or -rev.

Require TLSv1.3 cookies.

Switches replay protection on or off, respectively. Replay protection is on by default unless overridden by a configuration file. When it is on, OpenSSL will automatically detect if a session ticket has been used more than once, TLSv1.3 has been negotiated, and early data is enabled on the server. A full handshake is forced if a session ticket is used a second or subsequent time. Any early data that was sent will be rejected.