> The s_client and s_server utilities can use the new SSL_CONF API in 1.0.2, > see: > http://www.openssl.org/docs/ssl/SSL_CONF_cmd.html#SUPPORTED_COMMAND_LINE_COMMANDS > The -sigalgs and -curves options should do the trick.
I did try -curves before and failed, but I must have been tripped up by trying to use the "secp256r1" I saw in the Java logs which OpenSSL understands as "prime256v1". So, additional data now. This works: ./openssl s_client -debug -cipher 'ECDHE-RSA-AES256-SHA' -curves 'secp521r1:secp384r1:prime256v1:sect571r1' -connect tomcat-host:443 But use the same curves in a different order, with sect571r1 first the way it is in the list that OpenSSL 1.0.1e sends: ./openssl s_client -debug -cipher 'ECDHE-RSA-AES256-SHA' -curves 'sect571r1:secp521r1:secp384r1:prime256v1' -connect tomcat-host:443 That fails with the pkcs11 error. -Andrew ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
