OpenSSL s_server Commands
Create TLS test servers for debugging clients, testing certificates, and validating TLS configurations
Basic Server Setup
Start basic TLS server on port 4433
openssl s_server -accept 4433Creates a simple TLS server with a self-signed certificate. Listens on port 4433 (default for s_server).
Server with specific certificate and key
openssl s_server -accept 4433 -cert server.crt -key server.keyUse your own certificate and private key instead of the auto-generated self-signed certificate.
Server with certificate chain
openssl s_server -accept 4433 -cert server.crt -key server.key -CAfile chain.pemServe complete certificate chain including intermediate certificates. Essential for proper client validation.
Server on standard HTTPS port 443
sudo openssl s_server -accept 443 -cert server.crt -key server.keyRun server on port 443 (requires root/sudo). Useful for testing with browsers that expect standard HTTPS port.
Server with ECDSA certificate
openssl s_server -accept 4433 -cert ecdsa-server.crt -key ecdsa-server.keyUse an ECDSA certificate for smaller key sizes and faster handshakes. Generate ECDSA key with openssl ecparam -genkey -name prime256v1.
Bind to specific network interface
openssl s_server -accept 192.168.1.100:4433 -cert server.crt -key server.keyListen only on specific IP address. Format: host:port. Useful for restricting access to a specific interface.
TLS Protocol Versions
TLS 1.3 only
openssl s_server -accept 4433 -tls1_3 -cert server.crt -key server.keyAccept only TLS 1.3 connections. Most secure and modern protocol version.
TLS 1.2 only
openssl s_server -accept 4433 -tls1_2 -cert server.crt -key server.keyAccept only TLS 1.2 connections. Still widely supported and secure when properly configured.
Support multiple TLS versions
openssl s_server -accept 4433 -no_tls1 -no_tls1_1 -cert server.crt -key server.keyDisable old protocols (TLS 1.0, 1.1) while allowing TLS 1.2 and 1.3. Recommended security practice.
Show supported protocol versions
openssl s_server -accept 4433 -state -cert server.crt -key server.keyDisplay TLS handshake state changes. Shows negotiated protocol version and cipher suite.
Client Certificate Authentication (mTLS)
Request client certificate (optional)
openssl s_server -accept 4433 -cert server.crt -key server.key -verify 1Request but don't require client certificate. Connection continues even if client doesn't provide one.
Require client certificate (mandatory)
openssl s_server -accept 4433 -cert server.crt -key server.key -Verify 1Require valid client certificate. Connection fails if client doesn't provide a certificate.
Verify client certificate against CA
openssl s_server -accept 4433 -cert server.crt -key server.key -verify 1 -CAfile client-ca.pemRequire client certificate signed by specific CA. Essential for mutual TLS authentication.
Show client certificate details
openssl s_server -accept 4433 -cert server.crt -key server.key -Verify 5 -showcertsDisplay client certificate details during handshake. Verify up to 5 certificates in the chain.
Cipher Suite Configuration
Specify cipher suites (TLS 1.2 and below)
openssl s_server -accept 4433 -cert server.crt -key server.key -cipher 'ECDHE-RSA-AES256-GCM-SHA384'Allow only specific cipher suite. Useful for testing client cipher support.
Specify TLS 1.3 cipher suites
openssl s_server -accept 4433 -cert server.crt -key server.key -ciphersuites 'TLS_AES_256_GCM_SHA384'Specify TLS 1.3 cipher suites separately from older versions.
Show available cipher suites
openssl ciphers -vList all available cipher suites with protocol versions. Use with s_server -cipher option.
High security cipher suites only
openssl s_server -accept 4433 -cert server.crt -key server.key -cipher 'HIGH:!aNULL:!MD5'Allow only strong cipher suites, exclude anonymous and MD5-based ciphers.
SNI (Server Name Indication)
Enable SNI support
openssl s_server -accept 4433 -cert server.crt -key server.key -servername example.comRespond to SNI requests for specific hostname. Essential for hosting multiple TLS sites on one IP.
Multiple certificates with SNI
openssl s_server -accept 4433 \
-cert default.crt -key default.key \
-servername example.com -cert2 example.crt -key2 example.keyServe different certificates based on SNI hostname. Use -cert2/-key2 for alternate certificate.
Show SNI information
openssl s_server -accept 4433 -cert server.crt -key server.key -tlsextdebugDisplay TLS extension debug information including SNI hostname sent by client.
Session Management and Resumption
Set session context ID
openssl s_server -accept 4433 -cert server.crt -key server.key -context "mycontext"Sets the session ID context for the server. Useful for distinguishing sessions across multiple server instances.
Set maximum session cache size
openssl s_server -accept 4433 -cert server.crt -key server.key -naccept 10Accept 10 connections then exit. Useful for automated testing scenarios.
Disable session caching
openssl s_server -accept 4433 -cert server.crt -key server.key -no_cacheDisable session caching. Forces full handshake for every connection.
Enable session tickets (RFC 5077)
openssl s_server -accept 4433 -cert server.crt -key server.key -no_ticketDisable session tickets. By default, tickets are enabled for stateless resumption.
Debugging and Verbose Output
Show TLS handshake details
openssl s_server -accept 4433 -cert server.crt -key server.key -stateDisplay TLS state machine transitions during handshake. Essential for debugging handshake issues.
Show protocol messages
openssl s_server -accept 4433 -cert server.crt -key server.key -msgDisplay all TLS protocol messages in hexadecimal. Shows raw handshake data.
Verbose debug output
openssl s_server -accept 4433 -cert server.crt -key server.key -debugShow detailed debugging information including certificate chains and verification.
Show server certificate chain
openssl s_server -accept 4433 -cert server.crt -key server.key -showcertsDisplay complete certificate chain sent to clients. Verify intermediate certificates are included.
Combined debugging (maximum verbosity)
openssl s_server -accept 4433 -cert server.crt -key server.key -state -msg -debug -showcertsEnable all debugging flags for comprehensive troubleshooting.
HTTP/WWW Mode
Simple HTTP server mode
openssl s_server -accept 4433 -cert server.crt -key server.key -WWWServe local files via HTTPS. Request /path/to/file to retrieve files from current directory.
HTTP mode with status page
openssl s_server -accept 4433 -cert server.crt -key server.key -HTTPHTTP mode showing connection statistics. Displays SSL/TLS session info on requests.
Test with browser
openssl s_server -accept 4433 -cert server.crt -key server.key -WWW
# Visit https://localhost:4433/ in browserStart server and test with web browser. Browser will show certificate warnings for self-signed certs.
Advanced Options
Enable OCSP stapling
openssl s_server -accept 4433 -cert server.crt -key server.key -status_file ocsp_response.derServe OCSP stapling response from file. Improves client certificate validation performance.
Use Diffie-Hellman parameters
openssl s_server -accept 4433 -cert server.crt -key server.key -dhparam dhparams.pemSpecify custom DH parameters for DHE cipher suites. Improves perfect forward secrecy.
Quiet mode (suppress output)
openssl s_server -accept 4433 -cert server.crt -key server.key -quietSuppress informational output. Shows only errors and critical messages.
Non-blocking mode
openssl s_server -accept 4433 -cert server.crt -key server.key -nbioUse non-blocking I/O. Useful for testing client behavior with slow or unreliable connections.
Enable early data (0-RTT) for TLS 1.3
openssl s_server -accept 4433 -cert server.crt -key server.key -early_dataAccept 0-RTT data in TLS 1.3 resumption. Reduces latency but has replay attack considerations.
Practical Testing Scenarios
Test TLS client implementation
# Terminal 1: Start server
openssl s_server -accept 4433 -cert server.crt -key server.key -state
# Terminal 2: Connect with client
openssl s_client -connect localhost:4433Test TLS client by starting server and connecting from another terminal.
Test mutual TLS (mTLS)
# Server requires client certificate
openssl s_server -accept 4433 -cert server.crt -key server.key \
-verify 1 -CAfile client-ca.pem
# Client provides certificate
openssl s_client -connect localhost:4433 \
-cert client.crt -key client.keyComplete mutual TLS test with both server and client authentication.
Test certificate chain validation
openssl s_server -accept 4433 \
-cert server.crt -key server.key \
-CAfile chain.pem -showcerts -stateVerify complete certificate chain is sent to clients and properly validated.
Test cipher suite negotiation
# Server with specific cipher
openssl s_server -accept 4433 -cert server.crt -key server.key \
-cipher 'ECDHE-RSA-AES256-GCM-SHA384' -state
# Client connects
openssl s_client -connect localhost:4433 -cipher 'ALL'Test if client can negotiate specific cipher suites with the server.
Important Notes
Not for Production
s_server is a testing tool, not a production web server. Use nginx, Apache, or similar for real deployments.
Security Warnings
Self-signed certificates will trigger browser warnings. For testing with browsers, use tools like mkcert for local trusted certificates.
Port Permissions
Ports below 1024 (like 443) require root/administrator privileges. Use sudo or run on higher ports (4433, 8443).
Single Connection Mode
By default, s_server exits after one connection. Use -www, -WWW, or -HTTP flags for persistent server mode.
Protocol Support
Available protocol versions depend on OpenSSL version. Use openssl version to check TLS 1.3 support.