gnutls-serv(1) User Commands gnutls-serv(1) (NAME) gnutls-serv - GnuTLS (SYNOPSIS) gnutls-serv [-flags] [-flag [value]] [--option-name[[=| ]value]] . (DESCRIPTION) TLS . . (OPTIONS) -d num, --debug=num . . num : 0 9999 . --sni-hostname=str (SNI). host_name . client hello unrecognized_name (warning-level) . --sni-hostname-fatal (fatal alert) sni-hostname. --alpn=str ALPN . . ALPN () . --alpn-fatal (fatal alert) ALPN. --noticket (session tickets). --earlydata (early data). --maxearlydata=num (early data) . . num : 1 2147483648 --nocookie DTLS. -g, --generate - (Diffie-Hellman). -q, --quiet . --nodb (resumption database). --http HTTP. --echo Echo (). --crlf CRLF LF Echo. -u, --udp DTLS ( TLS) UDP. --mtu=num MTU TLS. . num : 0 17000 --srtp-profiles=str SRTP. -a, --disable-client-cert . : require-client-cert. -r, --require-client-cert . 3.6.0 --verify-client-cert . 3.6.0 . --verify-client-cert . . --compress-cert=str . . . -b, --heartbeat (heartbeat). (heartbeat). --x509fmtder DER . --priority=str (Priorities string). TLS . PERFORMANCE NORMAL SECURE128 SECURE256 . NORMAL . "Priority strings" GnuTLS . --dhparams=file DH (-) . --x509cafile=str (URL) PKCS #11 . --x509crlfile=file CRL . --pgpkeyfile=file PGP . : . --x509keyfile=str X.509 (URL) PKCS #11 . . URI --x509certfile . keyfile x509certfile . --x509certfile=str X.509 (URL) PKCS #11 . . URI --x509keyfile . keyfile x509certfile . --x509dsakeyfile --x509keyfile . : . --x509dsacertfile --x509certfile . : . --x509ecckeyfile --x509keyfile . : . --x509ecccertfile --x509certfile . : . --rawpkkeyfile=str (PKCS #8 PKCS #12) PKCS #11 . . URI --rawpkfile . keyfile rawpkfile . ( CTYPE-CLI-* CTYPE-SRV-*) . "Priority strings" GnuTLS . --rawpkfile=str (Raw public- key) . . : rawpkkeyfile. --rawpkkeyfile . keyfile rawpkfile . ( CTYPE-CLI-* CTYPE-SRV-*) . "Priority strings" GnuTLS . --srppasswd=file SRP . --srppasswdconf=file SRP . --pskpasswd=file PSK . --pskhint=str (Identity hint) PSK . --ocsp-response=str OCSP . . OCSP . --ignore-ocsp-response-errors OCSP. gnutls OCSP . -p num, --port=num () . . -l, --list . . . --provider=file (provider) PKCS #11. /etc/gnutls/pkcs11.conf (override) . --keymatexport=str (keying material). --keymatexportsize=num . . --recordsize=num . . num : 0 16384 --httpdata=file HTTP. --timeout=num (timeout) . . --attime=timestamp . (Unix time) "29 Feb 2004" "2004-02-29" . 'info '(coreutils) date invocation . -v arg, --version=arg . `v` . `c` `n` . -h, --help . -!, --more-help (pager). (EXAMPLES) TLS GnuTLS GnuTLS . gnutls-serv HTTPS . : gnutls-serv --http --priority "NORMAL:+ANON-ECDH:+ANON-DH" TLS . X.509 . (CA) : $ certtool --generate-privkey > x509-ca-key.pem $ echo 'cn = GnuTLS test CA' > ca.tmpl $ echo 'ca' >> ca.tmpl $ echo 'cert_signing_key' >> ca.tmpl $ certtool --generate-self-signed --load-privkey x509-ca-key.pem --template ca.tmpl --outfile x509-ca.pem . dns_name . $ certtool --generate-privkey > x509-server-key.pem $ echo 'organization = GnuTLS test server' > server.tmpl $ echo 'cn = test.gnutls.org' >> server.tmpl $ echo 'tls_www_server' >> server.tmpl $ echo 'encryption_key' >> server.tmpl $ echo 'signing_key' >> server.tmpl $ echo 'dns_name = test.gnutls.org' >> server.tmpl $ certtool --generate-certificate --load-privkey x509-server-key.pem --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem --template server.tmpl --outfile x509-server.pem . $ certtool --generate-privkey > x509-client-key.pem $ echo 'cn = GnuTLS test client' > client.tmpl $ echo 'tls_www_client' >> client.tmpl $ echo 'encryption_key' >> client.tmpl $ echo 'signing_key' >> client.tmpl $ certtool --generate-certificate --load-privkey x509-client-key.pem --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem --template client.tmpl --outfile x509-client.pem / (import) PKCS#12 . . $ certtool --to-p12 --load-ca-certificate x509-ca.pem --load-privkey x509-client-key.pem --load-certificate x509-client.pem --outder --outfile x509-client.p12 . $ certtool --generate-privkey > x509-proxy-key.pem $ echo 'cn = GnuTLS test client proxy' > proxy.tmpl $ certtool --generate-proxy --load-privkey x509-proxy-key.pem --load-ca-certificate x509-client.pem --load-ca-privkey x509-client-key.pem --load-certificate x509-client.pem --template proxy.tmpl --outfile x509-proxy.pem : $ gnutls-serv --http --x509cafile x509-ca.pem --x509keyfile x509-server-key.pem --x509certfile x509-server.pem . 5556 . ECDSA ECDSA . . $ certtool --generate-privkey --ecdsa > x509-server-key-ecc.pem $ certtool --generate-certificate --load-privkey x509-server-key-ecc.pem --load-ca-certificate x509-ca.pem --load-ca-privkey x509-ca-key.pem --template server.tmpl --outfile x509-server-ecc.pem SRP . SRP srptool . SRP: gnutls-serv --http --priority NORMAL:+SRP-RSA:+SRP --srppasswdconf srp-tpasswd.conf --srppasswd srp-passwd.txt PSK . psktool . gnutls-serv --http --priority NORMAL:+ECDHE-PSK:+PSK --pskpasswd psk-passwd.txt (raw public-keys) . x509 . . . gnutls-serv --http --priority NORMAL:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK --rawpkfile srv.rawpk.pem --rawpkkeyfile srv.key.pem : gnutls-serv --http --priority NORMAL:+PSK:+SRP:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK --x509cafile x509-ca.pem --x509keyfile x509-server-key.pem --x509certfile x509-server.pem --x509keyfile x509-server-key-ecc.pem --x509certfile x509-server-ecc.pem --srppasswdconf srp-tpasswd.conf --srppasswd srp-passwd.txt --pskpasswd psk-passwd.txt --rawpkfile srv.rawpk.pem --rawpkkeyfile srv.key.pem (EXIT STATUS) : 0 (EXIT_SUCCESS) . 1 (EXIT_FAILURE) . (SEE ALSO) gnutls-cli-debug(1), gnutls-cli(1) (AUTHORS) GnuTLS . (COPYRIGHT) (C) 2020-2023 . . (REPORTING BUGS) : bugs@gnutls.org 3.8.13 29 Apr 2026 gnutls-serv(1)