openssl 调试TLS的工具

openssl s_client -connect 127.0.0.1:2222 -tls1_2 -msg

C:\Program Files\OpenSSL-Win64\bin>openssl s_client -connect 127.0.0.1:2222 -tls1_2 -msg
Connecting to 127.0.0.1
CONNECTED(00000190)
>>> TLS 1.0, RecordHeader [length 0005]
    16 03 01 00 bc
>>> TLS 1.2, Handshake [length 00bc], ClientHello
    01 00 00 b8 03 03 b6 67 86 22 0c 4e f4 af 5e 21
    e7 69 d7 60 0b 82 54 6c f7 78 15 90 73 50 19 90
    ff 59 0a 12 cd ca 00 00 36 c0 2c c0 30 00 9f cc
    a9 cc a8 cc aa c0 2b c0 2f 00 9e c0 24 c0 28 00
    6b c0 23 c0 27 00 67 c0 0a c0 14 00 39 c0 09 c0
    13 00 33 00 9d 00 9c 00 3d 00 3c 00 35 00 2f 01
    00 00 59 ff 01 00 01 00 00 0b 00 02 01 00 00 0a
    00 10 00 0e 00 1d 00 17 00 1e 00 18 00 19 01 00
    01 01 00 23 00 00 00 16 00 00 00 17 00 00 00 0d
    00 2a 00 28 04 03 05 03 06 03 08 07 08 08 08 09
    08 0a 08 0b 08 04 08 05 08 06 04 01 05 01 06 01
    03 03 03 01 03 02 04 02 05 02 06 02
<<< TLS 1.2, RecordHeader [length 0005]
    16 03 03 00 31
<<< TLS 1.2, Handshake [length 0031], ServerHello
    02 00 00 2d 03 03 3d 26 af 8f 43 19 71 b4 82 ef
    0f e2 2a 17 90 6b 7b 64 ec 35 dd 17 20 72 85 f6
    2e cf ff 92 ff ec 00 c0 2f 00 00 05 ff 01 00 01
    00
Can't use SSL_get_servername
<<< TLS 1.2, RecordHeader [length 0005]
    16 03 03 02 f6
<<< TLS 1.2, Handshake [length 02f6], Certificate
    0b 00 02 f2 00 02 ef 00 02 ec 30 82 02 e8 30 82
    01 d0 a0 03 02 01 02 02 14 32 5c 12 78 bd fb 55
    e1 62 7e aa 7c 90 fd 9f 89 77 e8 6e b7 30 0d 06
    09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 14 31 12
    30 10 06 03 55 04 03 0c 09 6c 6f 63 61 6c 68 6f
    73 74 30 1e 17 0d 32 36 30 38 31 30 30 33 35 31
    31 35 5a 17 0d 32 37 30 38 31 30 30 33 35 31 31
    35 5a 30 14 31 12 30 10 06 03 55 04 03 0c 09 6c
    6f 63 61 6c 68 6f 73 74 30 82 01 22 30 0d 06 09
    2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00
    30 82 01 0a 02 82 01 01 00 88 47 9a c4 56 c0 67
    4c a6 58 fe 4a 0c a1 b0 9b 9d c2 f1 a2 83 41 39
    24 2d 42 09 32 51 48 ad dd eb 57 db e6 50 d7 4d
    0c 77 bd 29 67 8b 35 fa b5 bb 60 43 b0 c7 0d 70
    96 a0 8d 28 25 12 17 2e ee 6e a2 53 59 33 25 78
    9c 6e bf 11 d2 5a d2 b4 e9 84 b5 9c ec b6 5d 76
    e8 c1 17 af f3 2a 03 3f 96 9b d7 f7 ec 32 7a d8
    fd 15 93 c4 52 77 f8 fd 36 fc 89 31 a8 cc 37 55
    a7 80 c2 3e da ec 6e ab a8 b5 c3 e0 57 0b cf 47
    14 c1 09 07 ef 48 d1 f8 10 4f 56 f6 18 3d 99 ec
    28 33 ab dc 05 b2 3d 8c 67 e8 b3 07 24 02 ea 13
    0f ae a6 de 47 eb e9 5f a6 fb 36 d5 2b 1f c1 ff
    cb aa db 25 e6 4b 05 36 c1 e1 14 da 51 dd 01 19
    b4 34 51 02 ca 6a d8 48 dd 2e 4b 4b 44 79 eb 93
    20 68 c7 85 ac 86 27 9a 98 b7 be 33 2d af ab bd
    40 b5 91 68 45 06 aa fa d1 99 40 3d a2 f5 91 b7
    bf db 46 d5 ab b0 a8 dc 75 02 03 01 00 01 a3 32
    30 30 30 1d 06 03 55 1d 0e 04 16 04 14 72 91 11
    d9 88 c9 38 33 1f 21 ca 7c 01 2e 0e 0a 49 2e 4b
    6a 30 0f 06 03 55 1d 13 01 01 ff 04 05 30 03 01
    01 ff 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05
    00 03 82 01 01 00 68 ee 81 f5 1a 2a 42 99 da a2
    79 a2 9e 51 5c 03 3f ee 5e e1 7a 4c a8 b1 be 6c
    62 b2 b0 38 76 57 fd 0f 12 45 bc 92 cb 15 79 b0
    0b 63 36 4d 29 e7 54 ee 80 e0 0b 20 41 97 bf db
    65 97 a3 64 d2 5c d1 48 cf 08 63 78 9d c3 40 39
    51 3e 3d 22 5f 69 84 9d 6a 79 44 1e 46 10 60 f7
    a7 1e 47 0d 06 5c 5b cb 8a e6 c1 b2 71 86 63 aa
    cb 1a 81 d8 80 5c 98 82 3c 4a 9b 1a 62 be c5 4e
    42 b1 33 20 03 e9 50 ba 87 33 97 b7 62 5a c4 10
    19 27 21 b0 ef e9 e5 53 e6 82 8d 2a da 9c 0d fd
    87 d3 0b ee ef 69 e3 7d ce 68 8e 3f 94 91 23 69
    1a 25 b6 89 3c 44 fc ae 59 7e 43 f6 01 4a 3b e2
    c1 45 30 95 bb 19 fb 7d 09 ee 68 be 68 50 88 0d
    4c 4b af 62 6e 54 28 e6 8e a9 ab a3 d3 7d a0 f5
    3b d0 e0 9d 2b 61 c2 55 36 8a dd f7 30 a1 25 41
    44 c9 9e 11 c6 6a ed 88 ca 5e c2 f0 ec c4 18 3b
    2b ce 93 78 61 c9
depth=0 CN=localhost
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN=localhost
verify return:1
<<< TLS 1.2, RecordHeader [length 0005]
    16 03 03 01 4d
<<< TLS 1.2, Handshake [length 014d], ServerKeyExchange
    0c 00 01 49 03 00 17 41 04 d2 07 e7 a3 5c 74 f7
    fe 7c 33 da 47 e0 f7 d9 39 3f 22 66 b4 0c ec 6a
    a3 49 fc 87 a4 2e 5f 59 d7 d2 d2 3b b3 52 90 e2
    21 87 a8 df f8 38 0c d7 e6 5e ec fd 59 9f dd ef
    ad c1 c7 d3 af 5b 64 a3 1b 04 01 01 00 03 ec c6
    eb 9b f7 eb 34 50 c0 da 97 9f 26 55 13 38 78 cc
    db 9d 16 45 b8 1c 1b f4 43 2f 6f ad 85 36 cb 34
    b9 33 73 c8 c0 30 99 20 5e 24 db be 90 28 16 f7
    34 08 89 87 a2 b7 e5 1b 38 78 89 35 47 16 b4 a6
    a8 a7 01 c2 74 5d 4e ef 5e bd 99 07 4a 5f cb e5
    17 b6 b9 16 a2 6d f9 ff 5f aa de ea 31 57 68 81
    0f 3d e0 05 52 d5 03 e5 f7 9c cf 7a 43 1f 12 15
    b2 93 46 23 e7 c3 10 09 32 ce d6 15 5e 83 bc b7
    48 ec d0 c6 41 14 7f 14 a7 e4 a3 8a f7 ce ca ef
    28 61 06 13 8c 45 39 34 02 56 9e bb 00 9b b1 03
    0a 57 bf 93 1b 75 7c 78 93 17 65 eb a4 df fa 01
    ef 45 7b 2f e3 7d 14 43 5e 13 5f a1 3b cb 5d 61
    fc a7 69 aa 9b 57 f9 a3 fd df 84 b9 d2 be f0 20
    28 87 b6 f9 a9 9b 0a 36 af dc f4 43 89 bc 4d b6
    eb a6 2c 98 93 d6 3e 8b 1e 5a 85 14 60 13 42 1c
    5b 49 61 a7 08 63 c3 98 b3 f4 0c a4 94
<<< TLS 1.2, RecordHeader [length 0005]
    16 03 03 00 04
<<< TLS 1.2, Handshake [length 0004], ServerHelloDone
    0e 00 00 00
>>> TLS 1.2, RecordHeader [length 0005]
    16 03 03 00 46
>>> TLS 1.2, Handshake [length 0046], ClientKeyExchange
    10 00 00 42 41 04 61 dd 6a be 1d 26 6f 7b 2e d1
    6c 40 72 77 bb 05 67 03 fa 2a 20 09 ca 67 01 b9
    e0 df e0 ac 5b 3a e3 99 55 af f7 30 28 e6 99 6b
    49 f0 c5 fc 91 6f 5f 9e 53 81 96 87 f5 e9 99 2c
    68 89 98 30 c0 a2
>>> TLS 1.2, RecordHeader [length 0005]
    14 03 03 00 01
>>> TLS 1.2, ChangeCipherSpec [length 0001]
    01
>>> TLS 1.2, RecordHeader [length 0005]
    16 03 03 00 28
>>> TLS 1.2, Handshake [length 0010], Finished
    14 00 00 0c 45 6b 1c 9b ef 8e 15 a2 e0 3a 49 f7
<<< TLS 1.2, RecordHeader [length 0005]
    15 03 03 00 12
>>> TLS 1.2, RecordHeader [length 0005]
    15 03 03 00 1a
>>> TLS 1.2, Alert [length 0002], fatal unexpected_message
    02 0a
B4500000:error:0A0000CD:SSL routines:ssl3_read_bytes:invalid alert:ssl\record\rec_layer_s3.c:878:
---
Certificate chain
 0 s:CN=localhost
   i:CN=localhost
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Aug 10 03:51:15 2026 GMT; NotAfter: Aug 10 03:51:15 2027 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC6DCCAdCgAwIBAgIUMlwSeL37VeFifqp8kP2fiXfobrcwDQYJKoZIhvcNAQEL
BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgxMDAzNTExNVoXDTI3MDgx
MDAzNTExNVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAiEeaxFbAZ0ymWP5KDKGwm53C8aKDQTkkLUIJMlFIrd3r
V9vmUNdNDHe9KWeLNfq1u2BDsMcNcJagjSglEhcu7m6iU1kzJXicbr8R0lrStOmE
tZzstl126MEXr/MqAz+Wm9f37DJ62P0Vk8RSd/j9NvyJMajMN1WngMI+2uxuq6i1
w+BXC89HFMEJB+9I0fgQT1b2GD2Z7Cgzq9wFsj2MZ+izByQC6hMPrqbeR+vpX6b7
NtUrH8H/y6rbJeZLBTbB4RTaUd0BGbQ0UQLKathI3S5LS0R565MgaMeFrIYnmpi3
vjMtr6u9QLWRaEUGqvrRmUA9ovWRt7/bRtWrsKjcdQIDAQABozIwMDAdBgNVHQ4E
FgQUcpER2YjJODMfIcp8AS4OCkkuS2owDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
9w0BAQsFAAOCAQEAaO6B9RoqQpnaonminlFcAz/uXuF6TKixvmxisrA4dlf9DxJF
vJLLFXmwC2M2TSnnVO6A4AsgQZe/22WXo2TSXNFIzwhjeJ3DQDlRPj0iX2mEnWp5
RB5GEGD3px5HDQZcW8uK5sGycYZjqssagdiAXJiCPEqbGmK+xU5CsTMgA+lQuocz
l7diWsQQGSchsO/p5VPmgo0q2pwN/YfTC+7vaeN9zmiOP5SRI2kaJbaJPET8rll+
Q/YBSjviwUUwlbsZ+30J7mi+aFCIDUxLr2JuVCjmjqmro9N9oPU70OCdK2HCVTaK
3fcwoSVBRMmeEcZq7YjKXsLw7MQYOyvOk3hhyQ==
-----END CERTIFICATE-----
subject=CN=localhost
issuer=CN=localhost
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: rsa_pkcs1_sha256
Peer Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 1187 bytes and written 350 bytes
Verification error: self-signed certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Protocol: TLSv1.2
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID:
    Session-ID-ctx:
    Master-Key: C0EB514F8E4EC2D102FD5275F0255FE5D9B526AB7241A39BFD37BD27B1D67CA06348B3A0F1AEDFB2B27FD385DB2F52E9
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1786617077
    Timeout   : 7200 (sec)
    Verify return code: 18 (self-signed certificate)
    Extended master secret: no
---
ECH: NOT CONFIGURED: -103
---