Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I use TLS/SSL over Unix pipe with Unix command line?

I want the equivalent of

$ mkfifo /tmp/spipe
$ echo a|openssl s_server -acceptFifo /tmp/spipe &
[1] 25563
$ openssl s_client -connectFifo /tmp/spipe
[1]   Done                    echo a|openssl s_server -acceptFifo /tmp/spipe

(Yes, it's not hard to write a short program to do that, but I was hoping it is possible with existing tools)

Let me clarify, I do not want a tcp connection any time in the process. I want to use the TLS/SSL protocol over a UNIX pipe. The client will open a unix pipe, and will connect to the server "listening" on another pipe. I do NOT want to move data from TLS tcp connection to a pipe.

share|improve this question
TLS is bidrectional, so you need two pipes or a "bi-directional pipe" which can be simulated by dpipe from the vde2 package. – jofel Mar 2 '12 at 12:12
@jofel, correct. I'll have a look at the vde2 package. Thanks – Elazar Leibovich Mar 2 '12 at 13:30
Why? Encryption is pointless for local communication. – psusi May 31 '12 at 22:22
@psusi see comments in the answer below. It's mostly useful for debugging. – Elazar Leibovich Jun 2 '12 at 20:23
There's one aspect you won't be able to debug with unix sockets: host name verification. I'm not sure it even makes sense to use a certificate valid for localhost for a unix socket. – Bruno Jul 26 '12 at 22:34

You can use socat.

socat PIPE:/tmp/spipe OPENSSL:server:4443,cafile=server.crt,cert=client.pem

socat -u OPENSSL-LISTEN:4443,reuseaddr,pf=ip4,fork,cert=server.pem,cafile=client.crt PIPE:/tmp/spipe

socat has lots of features, so you could maybe avoid the pipes at all.

EDIT: added the -u (unidirectional) option to server's socat - without it, the pipe works as an echo service.

share|improve this answer
Your method opens a TCP connection, and does not use unix pipes to move the data. It will move the plaintext data from the tcp TLS connection to a pipe, but it will not use TLS when moving data through the pipe. It's equivalent to openssl s_client -connect host and openssl s_server. Please correct your answer. – Elazar Leibovich Mar 1 '12 at 14:31
Sorry, I misunderstood your questions. I think what you want is not possible with socat - so I will delete my answer soon. But why do you want a local ssl pipe? For me, this makes no sense at all. – jofel Mar 1 '12 at 14:38
It's really handy for debugging purposes. For instance, you can test an HTTP proxy with (echo -e 'CONNECT example.com 443 HTTP/1.1';tlsOnPipe)|nc proxyserver 8080. It can also make sense if you want to use TLS authentication (say, client cert), and to expose your service through tcp and through unix pipes. – Elazar Leibovich Mar 1 '12 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.