2

How can I let the openssl s_server to reply to every http(s) request directly from the command line or the server it self (the server is using centOS)? is that possible?

from the -help command for the openssl s_server I see that there is the -HTTP flag which should be used for :

 -WWW          - Respond to a 'GET /<path> HTTP/1.0' with file./<path> 
 -HTTP         - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>
                  with the assumption it contains a complete HTTP response.

is this could be the answer for my problem? if so and since I couldn't find any example how to use this flag, I would be really glad to know how to exactly use it.

the command that I'm trying to run is simple as:

openssl s_server -key key.pem -cert cert.pem -msg

Thanks in Advance!

4
  • Add -accept 443 -HTTP.
    – lcd047
    Jun 1, 2015 at 10:56
  • What exactly happened when you attempted that command, and what did you expect to happen by that? If s_server successfuly gets up and says ACCEPT, you can make an HTTP request by opening https://server:4433/ with your browser, then you can type in something on the command line to make a response to it.
    – yaegashi
    Jun 1, 2015 at 12:56
  • Well I think I need to edit my question, I want to reply from a file so I don't writebthe response manually from the command line while listening..
    – hduke-17
    Jun 1, 2015 at 12:59
  • That way I make the server reply automatically, or send the reply automatically without writing a script to do so.. I thought thats why the - HTTP flag ment to be for
    – hduke-17
    Jun 1, 2015 at 13:01

1 Answer 1

4

With -WWW or -HTTP, s_server acts as a static content HTTPS server using files in the current directory. Here's my full set up for demonstration.

$ openssl req -x509 -nodes -newkey rsa -keyout key.pem -out cert.pem -subj /CN=localhost
$ echo 'hello, world.' >index.txt
$ openssl s_server -key key.pem -cert cert.pem -WWW
Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT

s_server is now waiting for HTTPS requests on port 4433. From another shell you can make a request to s_server using curl.

$ curl -kv https://localhost:4433/index.txt
* Hostname was NOT found in DNS cache
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 4433 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*    subject: CN=localhost
*    start date: 2015-06-01 15:29:02 GMT
*    expire date: 2015-07-01 15:29:02 GMT
*    issuer: CN=localhost
*    SSL certificate verify result: self signed certificate (18), continuing anyway.
> GET /index.txt HTTP/1.1
> User-Agent: curl/7.38.0
> Host: localhost:4433
> Accept: */*
> 
* HTTP 1.0, assume close after body
< HTTP/1.0 200 ok
< Content-type: text/plain
< 
hello, world.
* Closing connection 0
* SSLv3, TLS alert, Client hello (1):

$ curl -k https://localhost:4433/not-existence
Error opening 'not-existence'
140226499298960:error:02001002:system library:fopen:No such file or directory:bss_file.c:169:fopen('not-existence','r')
140226499298960:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:172:

On each request s_server prints requested path and wait for the next request again.

FILE:index.txt
ACCEPT

If you want to run a script on requests (as CGI does), you might have to use another tool like socat.

$ echo 'echo "Your request is $(head -1)"' > server.sh
$ socat openssl-listen:4433,cert=cert.pem,key=key.pem,verify=0,reuseaddr,fork exec:"bash server.sh"

The result is:

$ curl -k https://localhost:4433/index.txt
Your request is GET /index.txt HTTP/1.1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .