gnutls-cli - GnuTLS client Usage: gnutls-cli [ - [] | --[{=| }] ]... [hostname] None: -d, --debug=num Enable debugging - it must be in the range: 0 to 9999 -V, --verbose More verbose output --tofu Enable trust on first use authentication --strict-tofu Fail to connect if a certificate is unknown or a known certificate has changed --dane Enable DANE certificate verification (DNSSEC) --local-dns Use the local DNS server for DNSSEC resolving --ca-verification Enable CA certificate verification - enabled by default - disabled as '--no-ca-verification' --ocsp Enable OCSP certificate verification -r, --resume Establish a session and resume --earlydata=str Send early data on resumption from the specified file -e, --rehandshake Establish a session and rehandshake --sni-hostname=str Server's hostname for server name indication extension --verify-hostname=str Server's hostname to use for validation -s, --starttls Connect, establish a plain session and start TLS --app-proto an alias for the 'starttls-proto' option --starttls-proto=str The application protocol to be used to obtain the server's certificate (https, ftp, smtp, imap, ldap, xmpp, lmtp, pop3, nntp, sieve, postgres) - prohibits the option 'starttls' --starttls-name=str The hostname presented to the application protocol for STARTTLS (for smtp, xmpp, lmtp) - prohibits the option 'starttls' - requires the option 'starttls-proto' -u, --udp Use DTLS (datagram TLS) over UDP --mtu=num Set MTU for datagram TLS - it must be in the range: 0 to 17000 --crlf Send CR LF instead of LF --fastopen Enable TCP Fast Open --x509fmtder Use DER format for certificates to read from --print-cert Print peer's certificate in PEM format --save-cert=str Save the peer's certificate chain in the specified file in PEM format --save-ocsp=str Save the peer's OCSP status response in the provided file - prohibits the option 'save-ocsp-multi' --save-ocsp-multi=str Save all OCSP responses provided by the peer in this file - prohibits the option 'save-ocsp' --save-server-trace=str Save the server-side TLS message trace in the provided file --save-client-trace=str Save the client-side TLS message trace in the provided file --dh-bits=num The minimum number of bits allowed for DH --priority=str Priorities string --x509cafile=str Certificate file or PKCS #11 URL to use --x509crlfile=file CRL file to use - file must pre-exist --x509keyfile=str X.509 key file or PKCS #11 URL to use --x509certfile=str X.509 Certificate file or PKCS #11 URL to use - requires the option 'x509keyfile' --rawpkkeyfile=str Private key file (PKCS #8 or PKCS #12) or PKCS #11 URL to use --rawpkfile=str Raw public-key file to use - requires the option 'rawpkkeyfile' --srpusername=str SRP username to use --srppasswd=str SRP password to use --pskusername=str PSK username to use --pskkey=str PSK key (in hex) to use -p, --port=str The port or service to connect to --insecure Don't abort program if server certificate can't be validated --verify-allow-broken Allow broken algorithms, such as MD5 for certificate verification --benchmark-ciphers Benchmark individual ciphers --benchmark-tls-kx Benchmark TLS key exchange methods --benchmark-tls-ciphers Benchmark TLS ciphers -l, --list Print a list of the supported algorithms and modes - prohibits the option 'port' --priority-list Print a list of the supported priority strings --noticket Don't allow session tickets --srtp-profiles=str Offer SRTP profiles --alpn=str Application layer protocol --compress-cert=str Compress certificate -b, --heartbeat Activate heartbeat support --recordsize=num The maximum record size to advertise - it must be in the range: 0 to 4096 --disable-sni Do not send a Server Name Indication (SNI) --single-key-share Send a single key share under TLS1.3 --post-handshake-auth Enable post-handshake authentication under TLS1.3 --inline-commands Inline commands of the form ^^ --inline-commands-prefix=str Change the default delimiter for inline commands --provider=file Specify the PKCS #11 provider library - file must pre-exist --fips140-mode Reports the status of the FIPS140-2 mode in gnutls library --list-config Reports the configuration of the library --logfile=str Redirect informational messages to a specific file --keymatexport=str Label used for exporting keying material --keymatexportsize=num Size of the exported keying material --waitresumption Block waiting for the resumption data under TLS1.3 --ca-auto-retrieve Enable automatic retrieval of missing CA certificates --attime=str Perform validation at the timestamp instead of the system time Version, usage and configuration options: -v, --version[=arg] output version information and exit -h, --help display extended usage information and exit -!, --more-help extended usage information passed thru pager Options are specified by doubled hyphens and their name or by a single hyphen and the flag character. Operands and options may be intermixed. They will be reordered. Simple client program to set up a TLS connection to some other computer. It sets up a TLS connection and forwards data from the standard input to the secured socket and vice versa. Note that this program is only meant for testing and diagnostic purposes. For more practical use-cases, consider using alternatives like GNU Wget. Please send bug reports to: