1*2175Sjp161948 2*2175Sjp161948=pod 3*2175Sjp161948 4*2175Sjp161948=head1 NAME 5*2175Sjp161948 6*2175Sjp161948sess_id - SSL/TLS session handling utility 7*2175Sjp161948 8*2175Sjp161948=head1 SYNOPSIS 9*2175Sjp161948 10*2175Sjp161948B<openssl> B<sess_id> 11*2175Sjp161948[B<-inform PEM|DER>] 12*2175Sjp161948[B<-outform PEM|DER>] 13*2175Sjp161948[B<-in filename>] 14*2175Sjp161948[B<-out filename>] 15*2175Sjp161948[B<-text>] 16*2175Sjp161948[B<-noout>] 17*2175Sjp161948[B<-context ID>] 18*2175Sjp161948 19*2175Sjp161948=head1 DESCRIPTION 20*2175Sjp161948 21*2175Sjp161948The B<sess_id> process the encoded version of the SSL session structure 22*2175Sjp161948and optionally prints out SSL session details (for example the SSL session 23*2175Sjp161948master key) in human readable format. Since this is a diagnostic tool that 24*2175Sjp161948needs some knowledge of the SSL protocol to use properly, most users will 25*2175Sjp161948not need to use it. 26*2175Sjp161948 27*2175Sjp161948=over 4 28*2175Sjp161948 29*2175Sjp161948=item B<-inform DER|PEM> 30*2175Sjp161948 31*2175Sjp161948This specifies the input format. The B<DER> option uses an ASN1 DER encoded 32*2175Sjp161948format containing session details. The precise format can vary from one version 33*2175Sjp161948to the next. The B<PEM> form is the default format: it consists of the B<DER> 34*2175Sjp161948format base64 encoded with additional header and footer lines. 35*2175Sjp161948 36*2175Sjp161948=item B<-outform DER|PEM> 37*2175Sjp161948 38*2175Sjp161948This specifies the output format, the options have the same meaning as the 39*2175Sjp161948B<-inform> option. 40*2175Sjp161948 41*2175Sjp161948=item B<-in filename> 42*2175Sjp161948 43*2175Sjp161948This specifies the input filename to read session information from or standard 44*2175Sjp161948input by default. 45*2175Sjp161948 46*2175Sjp161948=item B<-out filename> 47*2175Sjp161948 48*2175Sjp161948This specifies the output filename to write session information to or standard 49*2175Sjp161948output if this option is not specified. 50*2175Sjp161948 51*2175Sjp161948=item B<-text> 52*2175Sjp161948 53*2175Sjp161948prints out the various public or private key components in 54*2175Sjp161948plain text in addition to the encoded version. 55*2175Sjp161948 56*2175Sjp161948=item B<-cert> 57*2175Sjp161948 58*2175Sjp161948if a certificate is present in the session it will be output using this option, 59*2175Sjp161948if the B<-text> option is also present then it will be printed out in text form. 60*2175Sjp161948 61*2175Sjp161948=item B<-noout> 62*2175Sjp161948 63*2175Sjp161948this option prevents output of the encoded version of the session. 64*2175Sjp161948 65*2175Sjp161948=item B<-context ID> 66*2175Sjp161948 67*2175Sjp161948this option can set the session id so the output session information uses the 68*2175Sjp161948supplied ID. The ID can be any string of characters. This option wont normally 69*2175Sjp161948be used. 70*2175Sjp161948 71*2175Sjp161948=back 72*2175Sjp161948 73*2175Sjp161948=head1 OUTPUT 74*2175Sjp161948 75*2175Sjp161948Typical output: 76*2175Sjp161948 77*2175Sjp161948 SSL-Session: 78*2175Sjp161948 Protocol : TLSv1 79*2175Sjp161948 Cipher : 0016 80*2175Sjp161948 Session-ID: 871E62626C554CE95488823752CBD5F3673A3EF3DCE9C67BD916C809914B40ED 81*2175Sjp161948 Session-ID-ctx: 01000000 82*2175Sjp161948 Master-Key: A7CEFC571974BE02CAC305269DC59F76EA9F0B180CB6642697A68251F2D2BB57E51DBBB4C7885573192AE9AEE220FACD 83*2175Sjp161948 Key-Arg : None 84*2175Sjp161948 Start Time: 948459261 85*2175Sjp161948 Timeout : 300 (sec) 86*2175Sjp161948 Verify return code 0 (ok) 87*2175Sjp161948 88*2175Sjp161948Theses are described below in more detail. 89*2175Sjp161948 90*2175Sjp161948=over 4 91*2175Sjp161948 92*2175Sjp161948=item B<Protocol> 93*2175Sjp161948 94*2175Sjp161948this is the protocol in use TLSv1, SSLv3 or SSLv2. 95*2175Sjp161948 96*2175Sjp161948=item B<Cipher> 97*2175Sjp161948 98*2175Sjp161948the cipher used this is the actual raw SSL or TLS cipher code, see the SSL 99*2175Sjp161948or TLS specifications for more information. 100*2175Sjp161948 101*2175Sjp161948=item B<Session-ID> 102*2175Sjp161948 103*2175Sjp161948the SSL session ID in hex format. 104*2175Sjp161948 105*2175Sjp161948=item B<Session-ID-ctx> 106*2175Sjp161948 107*2175Sjp161948the session ID context in hex format. 108*2175Sjp161948 109*2175Sjp161948=item B<Master-Key> 110*2175Sjp161948 111*2175Sjp161948this is the SSL session master key. 112*2175Sjp161948 113*2175Sjp161948=item B<Key-Arg> 114*2175Sjp161948 115*2175Sjp161948the key argument, this is only used in SSL v2. 116*2175Sjp161948 117*2175Sjp161948=item B<Start Time> 118*2175Sjp161948 119*2175Sjp161948this is the session start time represented as an integer in standard Unix format. 120*2175Sjp161948 121*2175Sjp161948=item B<Timeout> 122*2175Sjp161948 123*2175Sjp161948the timeout in seconds. 124*2175Sjp161948 125*2175Sjp161948=item B<Verify return code> 126*2175Sjp161948 127*2175Sjp161948this is the return code when an SSL client certificate is verified. 128*2175Sjp161948 129*2175Sjp161948=back 130*2175Sjp161948 131*2175Sjp161948=head1 NOTES 132*2175Sjp161948 133*2175Sjp161948The PEM encoded session format uses the header and footer lines: 134*2175Sjp161948 135*2175Sjp161948 -----BEGIN SSL SESSION PARAMETERS----- 136*2175Sjp161948 -----END SSL SESSION PARAMETERS----- 137*2175Sjp161948 138*2175Sjp161948Since the SSL session output contains the master key it is possible to read the contents 139*2175Sjp161948of an encrypted session using this information. Therefore appropriate security precautions 140*2175Sjp161948should be taken if the information is being output by a "real" application. This is 141*2175Sjp161948however strongly discouraged and should only be used for debugging purposes. 142*2175Sjp161948 143*2175Sjp161948=head1 BUGS 144*2175Sjp161948 145*2175Sjp161948The cipher and start time should be printed out in human readable form. 146*2175Sjp161948 147*2175Sjp161948=head1 SEE ALSO 148*2175Sjp161948 149*2175Sjp161948L<ciphers(1)|ciphers(1)>, L<s_server(1)|s_server(1)> 150*2175Sjp161948 151*2175Sjp161948=cut 152