gnutls-cli(1) gnutls-cli(1) (NAME) gnutls-cli - TLS (SYNOPSIS) gnutls-cli [-flags] [-flag [value]] [--option-name[[=| ]value]] [hostname] . . (DESCRIPTION) TLS . TLS . . GNU Wget . (OPTIONS) -d num, --debug=num . . num : 0 9999 . -V, --verbose . --tofu, --no-tofu << >> (TOFU). no-tofu . SSH. tofu (PKI) DANE . --strict-tofu, --no-strict-tofu . no-strict-tofu . --tofu . --dane, --no-dane DANE ( DNSSEC). no-dane . (CA) DANE DNSSEC . --local-dns, --no-local-dns DNS DNSSEC. no-local-dns . DNS DNSSEC . DNSSEC . --ca-verification, --no-ca-verification CA. no-ca-verification . . CA . --dane --tofu . --ocsp, --no-ocsp OCSP. no-ocsp . OCSP . -r, --resume . (Resume). --earlydata=str (Early Data) . -e, --rehandshake . (Rehandshake) . --sni-hostname=str (SNI). TLS Server Name Indication . DNS . . . --verify-hostname . --verify-hostname=str . . -s, --starttls TLS. TLS EOF SIGALRM . --app-proto --starttls-proto . --starttls-proto=str (https, ftp, smtp, imap, ldap, xmpp, lmtp, pop3, nntp, sieve, postgres). : starttls. STARTTLS . gnutls-cli TLS . --starttls-name=str STARTTLS ( smtp xmpp lmtp). : starttls. : starttls-proto. STARTTLS . -u, --udp DTLS ( TLS) UDP. --mtu=num MTU TLS. . num : 0 17000 --crlf CR LF LF. --fastopen TCP Fast Open. --x509fmtder DER . --print-cert PEM. --save-cert=str PEM. --save-ocsp=str OCSP . : save-ocsp-multi. --save-ocsp-multi=str OCSP . : save-ocsp. OCSP PEM . --save-server-trace=str TLS . --save-client-trace=str TLS . --dh-bits=num DH. . - (Diffie-Hellman) . . --priority=str (Priorities string). TLS . PERFORMANCE NORMAL PFS SECURE128 SECURE256 . NORMAL . "Priority strings" GnuTLS . --x509cafile=str PKCS #11 . --x509crlfile=file CRL . --x509keyfile=str X.509 PKCS #11 . --x509certfile=str X.509 PKCS #11 . : x509keyfile. --rawpkkeyfile=str (PKCS #8 PKCS #12) PKCS #11 . (Raw Public Keys) ( CTYPE-CLI-* CTYPE-SRV-*) . "Priority strings" GnuTLS . --rawpkfile=str (Raw Public- Key) . : rawpkkeyfile. ( CTYPE-CLI-* CTYPE-SRV-*) . "Priority strings" GnuTLS . --srpusername=str SRP . --srppasswd=str SRP . --pskusername=str PSK . --pskkey=str PSK ( ) . -p str, --port=str . --insecure . --verify-allow-broken MD5 . --ranges . ( CBC) () . : --benchmark-ciphers () . . GNUTLS_CPUID_OVERRIDE 0x1 . --benchmark-tls-kx TLS. --benchmark-tls-ciphers TLS. . GNUTLS_CPUID_OVERRIDE 0x1 . -l, --list . : port. . . --priority-list . . -l -p . --noticket (Session Tickets). TLS1.2 . --srtp-profiles=str () SRTP. --alpn=str . . (ALPN) TLS . --compress-cert=str . . . -b, --heartbeat (Heartbeat). --recordsize=num . . num : 0 4096 --disable-sni (SNI). --disable-extensions TLS. TLS . . : --single-key-share TLS1.3. ( ) . --post-handshake-auth TLS1.3. TLS1.3 . --inline-commands ^^. ^^. . : resume rekey1 ( ) rekey ( ) renegotiate. --inline-commands-prefix=str . (^) . US-ASCII ( 0 - 127) . inline-commands . --provider=file PKCS #11. /etc/gnutls/pkcs11.conf . --fips140-mode FIPS140-2 gnutls. --list-config . --logfile=str . . /dev/null gnutls (stdout) . --keymatexport=str (Keying Material). --keymatexportsize=num . . --waitresumption TLS1.3. TLS1.3 . --resume . --ca-auto-retrieve, --no-ca-auto-retrieve CA. no-ca-auto-retrieve . CA Authority Information Access (AIA) . --attime=timestamp . "29 Feb 2004" "2004-02-29" . 'info '(coreutils) date invocation'' . -v arg, --version=arg . `v' . `c' `n' . -h, --help . -!, --more-help (Pager). (EXAMPLES) PSK PSK PSK . $ ./gnutls-cli -p 5556 localhost --pskusername psk_identity --pskkey 88f3824b3e5659f52d00e959bacab954b6540344 --priority NORMAL:-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK Resolving 'localhost'... Connecting to '127.0.0.1:5556'... - PSK authentication. - Version: TLS1.1 - Key Exchange: PSK - Cipher: AES-128-CBC - MAC: SHA1 - Compression: NULL - Handshake was completed - Simple Client Mode: --pskusername --pskkey . . $ ./gnutls-cli -p 5556 localhost --priority NORMAL:-CTYPE-CLI-ALL:+CTYPE-CLI-RAWPK --rawpkkeyfile cli.key.pem --rawpkfile cli.rawpk.pem Processed 1 client raw public key pair... Resolving 'localhost'... Connecting to '127.0.0.1:5556'... - Successfully sent 1 certificate(s) to server. - Server has requested a certificate. - Certificate type: X.509 - Got a certificate list of 1 certificates. - Certificate[0] info: - skipped - Description: (TLS1.3-Raw Public Key-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM) - Options: - Handshake was completed - Simple Client Mode: STARTTLS STARTTLS . $ gnutls-cli --starttls-proto smtp --port 25 localhost : $ ./gnutls-cli --priority SECURE192 -l Cipher suites for SECURE192 TLS_ECDHE_ECDSA_AES_256_CBC_SHA384 0xc0, 0x24 TLS1.2 TLS_ECDHE_ECDSA_AES_256_GCM_SHA384 0xc0, 0x2e TLS1.2 TLS_ECDHE_RSA_AES_256_GCM_SHA384 0xc0, 0x30 TLS1.2 TLS_DHE_RSA_AES_256_CBC_SHA256 0x00, 0x6b TLS1.2 TLS_DHE_DSS_AES_256_CBC_SHA256 0x00, 0x6a TLS1.2 TLS_RSA_AES_256_CBC_SHA256 0x00, 0x3d TLS1.2 Certificate types: CTYPE-X.509 Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0, VERS-SSL3.0, VERS-DTLS1.0 Compression: COMP-NULL Elliptic curves: CURVE-SECP384R1, CURVE-SECP521R1 PK-signatures: SIGN-RSA-SHA384, SIGN-ECDSA-SHA384, SIGN-RSA-SHA512, SIGN-ECDSA-SHA512 PKCS #11 PKCS #11 PKCS 11 x509certfile x509keyfile . "p11tool --list-tokens" . $ p11tool --list-tokens Token 0: URL: pkcs11:model=PKCS15;manufacturer=MyMan;serial=1234;token=Test Label: Test Manufacturer: EnterSafe Model: PKCS15 Serial: 1234 $ p11tool --login --list-certs "pkcs11:model=PKCS15;manufacturer=MyMan;serial=1234;token=Test" Object 0: URL: pkcs11:model=PKCS15;manufacturer=MyMan;serial=1234;token=Test;object=client;type=cert Type: X.509 Certificate Label: client ID: 2a:97:0d:58:d1:51:3c:23:07:ae:4e:0d:72:26:03:7d:99:06:02:6a $ MYCERT="pkcs11:model=PKCS15;manufacturer=MyMan;serial=1234;token=Test;object=client;type=cert" $ MYKEY="pkcs11:model=PKCS15;manufacturer=MyMan;serial=1234;token=Test;object=client;type=private" $ export MYCERT MYKEY $ gnutls-cli www.example.com --x509keyfile $MYKEY --x509certfile $MYCERT (type) . (EXIT STATUS) : 0 (EXIT_SUCCESS) . 1 (EXIT_FAILURE) . (SEE ALSO) gnutls-cli-debug(1), gnutls-serv(1) (AUTHORS) (COPYRIGHT) (C) 2020-2023 (Free Software Foundation) . . (GNU GPL) . (BUGS) : bugs@gnutls.org 3.8.13 29 Apr 2026 gnutls-cli(1)