1=pod 2{- OpenSSL::safe::output_do_not_edit_headers(); -} 3 4=head1 NAME 5 6openssl-sess_id - SSL/TLS session handling command 7 8=head1 SYNOPSIS 9 10B<openssl> B<sess_id> 11[B<-help>] 12[B<-inform> B<DER>|B<PEM>] 13[B<-outform> B<DER>|B<PEM>|B<NSS>] 14[B<-in> I<filename>] 15[B<-out> I<filename>] 16[B<-text>] 17[B<-cert>] 18[B<-noout>] 19[B<-context> I<ID>] 20 21=head1 DESCRIPTION 22 23This command processes the encoded version of the SSL session 24structure and optionally prints out SSL session details (for example 25the SSL session master key) in human readable format. Since this is a 26diagnostic tool that needs some knowledge of the SSL protocol to use 27properly, most users will not need to use it. 28 29The precise format of the data can vary across OpenSSL versions and 30is not documented. 31 32=head1 OPTIONS 33 34=over 4 35 36=item B<-help> 37 38Print out a usage message. 39 40=item B<-inform> B<DER>|B<PEM>, B<-outform> B<DER>|B<PEM>|B<NSS> 41 42The input and output formats; the default is PEM. 43See L<openssl-format-options(1)> for details. 44 45For B<NSS> output, the session ID and master key are reported in NSS "keylog" 46format. 47 48=item B<-in> I<filename> 49 50This specifies the input filename to read session information from or standard 51input by default. 52 53=item B<-out> I<filename> 54 55This specifies the output filename to write session information to or standard 56output if this option is not specified. 57 58=item B<-text> 59 60Prints out the various public or private key components in 61plain text in addition to the encoded version. 62 63=item B<-cert> 64 65If a certificate is present in the session it will be output using this option, 66if the B<-text> option is also present then it will be printed out in text form. 67 68=item B<-noout> 69 70This option prevents output of the encoded version of the session. 71 72=item B<-context> I<ID> 73 74This option can set the session id so the output session information uses the 75supplied ID. The ID can be any string of characters. This option won't normally 76be used. 77 78=back 79 80=head1 OUTPUT 81 82Typical output: 83 84 SSL-Session: 85 Protocol : TLSv1 86 Cipher : 0016 87 Session-ID: 871E62626C554CE95488823752CBD5F3673A3EF3DCE9C67BD916C809914B40ED 88 Session-ID-ctx: 01000000 89 Master-Key: A7CEFC571974BE02CAC305269DC59F76EA9F0B180CB6642697A68251F2D2BB57E51DBBB4C7885573192AE9AEE220FACD 90 Key-Arg : None 91 Start Time: 948459261 92 Timeout : 300 (sec) 93 Verify return code 0 (ok) 94 95These are described below in more detail. 96 97=over 4 98 99=item B<Protocol> 100 101This is the protocol in use TLSv1.3, TLSv1.2, TLSv1.1, TLSv1 or SSLv3. 102 103=item B<Cipher> 104 105The cipher used this is the actual raw SSL or TLS cipher code, see the SSL 106or TLS specifications for more information. 107 108=item B<Session-ID> 109 110The SSL session ID in hex format. 111 112=item B<Session-ID-ctx> 113 114The session ID context in hex format. 115 116=item B<Master-Key> 117 118This is the SSL session master key. 119 120=item B<Start Time> 121 122This is the session start time represented as an integer in standard 123Unix format. 124 125=item B<Timeout> 126 127The timeout in seconds. 128 129=item B<Verify return code> 130 131This is the return code when an SSL client certificate is verified. 132 133=back 134 135=head1 NOTES 136 137Since the SSL session output contains the master key it is 138possible to read the contents of an encrypted session using this 139information. Therefore, appropriate security precautions should be taken if 140the information is being output by a "real" application. This is however 141strongly discouraged and should only be used for debugging purposes. 142 143=head1 BUGS 144 145The cipher and start time should be printed out in human readable form. 146 147=head1 SEE ALSO 148 149L<openssl(1)>, 150L<openssl-ciphers(1)>, 151L<openssl-s_server(1)> 152 153=head1 COPYRIGHT 154 155Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved. 156 157Licensed under the Apache License 2.0 (the "License"). You may not use 158this file except in compliance with the License. You can obtain a copy 159in the file LICENSE in the source distribution or at 160L<https://www.openssl.org/source/license.html>. 161 162=cut 163
