s_client

If you’re working with SSL (whether websites or otherwise), it sometimes helps to be able to send text and commands directly to the server, but it’s not as easy as just telnetting to the server like with non-SSL servers. That’s where s_client comes in. It’s part of the openSSL suite, so you’ll find it on all unix based systems, and can compile it on Windows based systems.

s_client handles all of the SSL negotiation, with you controlling as much of the negotiation as you want. You can tell s_client what algorithms to “support”, and if the server will complete the negotiation, you know that the server supports that algorithm as well. This is useful to determine if a server supports weak algorithms.

s_client also acts like telnet. So if all you need to do is negotiate the SSL, s_client will handle all of that. If you’re trying to debug SSL, s_client lets you do that as well.

All of the options are listed at the OpenSSL documentation page, but I’ll cover some of the most common ones here.

To just create an SSL connection, use
openssl s_client -connect host:port

The certificates that belong to the server will be displayed, along with the algorithm that was negotiated.

To see if the server supports weak algorithms, you can use
openssl s_client -connect host:port -ssl2 -cipher cipherlist
Where cipherlist looks like CIPHER1:CIPHER2:CIPHER3 The server will select the first cipher in the list it will accept. You can use the openssl ciphers command to see the specific list of ciphers that your copy of OpenSSL supports, or you can refer to the documentation, which also includes “ciphers” such as EXPORT and eNULL – which means export level or no encryption.
Generally, I use
openssl s_client -connect host:port -ssl2 -ciphers eNULL:EXPORT

s_client is a useful tool both for diagnosing SSL/TLS problems, and for checking on the cipher strengths a server supports.