1

How can I let the openssl s_server to reply to every http(s) request directly from the command line or the server it self (the server is using centOS)? is that possible?

from the -help command for the openssl s_server I see that there is the -HTTP flag which should be used for :

 -WWW          - Respond to a 'GET /<path> HTTP/1.0' with file./<path> 
 -HTTP         - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>
                  with the assumption it contains a complete HTTP response.

is this could be the answer for my problem? if so and since I couldn't find any example how to use this flag, I would be really glad to know how to exactly use it.

the command that I'm trying to run is simple as:

openssl s_server -key key.pem -cert cert.pem -msg

Thanks in Advance!

  • Add -accept 443 -HTTP. – lcd047 Jun 1 '15 at 10:56
  • What exactly happened when you attempted that command, and what did you expect to happen by that? If s_server successfuly gets up and says ACCEPT, you can make an HTTP request by opening https://server:4433/ with your browser, then you can type in something on the command line to make a response to it. – yaegashi Jun 1 '15 at 12:56
  • Well I think I need to edit my question, I want to reply from a file so I don't writebthe response manually from the command line while listening.. – hduke-17 Jun 1 '15 at 12:59
  • That way I make the server reply automatically, or send the reply automatically without writing a script to do so.. I thought thats why the - HTTP flag ment to be for – hduke-17 Jun 1 '15 at 13:01
1

With -WWW or -HTTP, s_server acts as a static content HTTPS server using files in the current directory. Here's my full set up for demonstration.

$ openssl req -x509 -nodes -newkey rsa -keyout key.pem -out cert.pem -subj /CN=localhost
$ echo 'hello, world.' >index.txt
$ openssl s_server -key key.pem -cert cert.pem -WWW
Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT

s_server is now waiting for HTTPS requests on port 4433. From another shell you can make a request to s_server using curl.

$ curl -kv https://localhost:4433/index.txt
* Hostname was NOT found in DNS cache
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 4433 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*    subject: CN=localhost
*    start date: 2015-06-01 15:29:02 GMT
*    expire date: 2015-07-01 15:29:02 GMT
*    issuer: CN=localhost
*    SSL certificate verify result: self signed certificate (18), continuing anyway.
> GET /index.txt HTTP/1.1
> User-Agent: curl/7.38.0
> Host: localhost:4433
> Accept: */*
> 
* HTTP 1.0, assume close after body
< HTTP/1.0 200 ok
< Content-type: text/plain
< 
hello, world.
* Closing connection 0
* SSLv3, TLS alert, Client hello (1):

$ curl -k https://localhost:4433/not-existence
Error opening 'not-existence'
140226499298960:error:02001002:system library:fopen:No such file or directory:bss_file.c:169:fopen('not-existence','r')
140226499298960:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:172:

On each request s_server prints requested path and wait for the next request again.

FILE:index.txt
ACCEPT

If you want to run a script on requests (as CGI does), you might have to use another tool like socat.

$ echo 'echo "Your request is $(head -1)"' > server.sh
$ socat openssl-listen:4433,cert=cert.pem,key=key.pem,verify=0,reuseaddr,fork exec:"bash server.sh"

The result is:

$ curl -k https://localhost:4433/index.txt
Your request is GET /index.txt HTTP/1.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.