How do I debug with SSL?

While Jetty is normally well behaved, there are times when it is necessary to debug problems. For information on how to set up general debugging options go to the tutorial page . The following are some hints for debugging when using SSL.

JSSE

As described in the JSSE FAQ, there is a debug facility built into JSSE controlled by the javax.net.debug property.

Assuming that you've got JSSE configured properly you will be able to use it as follows, you will need to edit the etc/demo.xml as described in The JSSE SSL doco.

To get help use:

JAVA_OPTIONS='-Djavax.net.debug=help' ./bin/jetty.sh run

You will get something like this:

all         turn on all debugging
ssl         turn on ssl debugging

The following can be used with ssl:
        record      enable per-record tracing
        handshake   print each handshake message
        keygen      print key generation data
        session     print session activity

        handshake debugging can be widened with:
        data        hex dump of each handshake message
        verbose     verbose handshake message printing

        record debugging can be widened with:
        plaintext   hex dump of record plaintext

example

JAVA_OPTIONS='-Djavax.net.debug=ssl,handshake,data' ./bin/jetty.sh run

General SSL

Assuming you've got the excellent (in a Bill&Ted way) openssl package installed, you can use it's s_client utility to help debug an SSL setup.

To get help use:

man s_client

or:

openssl s_client -help

example

When run against a server using the expired test certificate the following is generated.

bretts@london[7538]: openssl s_client -showcerts -connect localhost:8443
CONNECTED(00000003)
depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
verify error:num=10:Certificate has expired
notAfter=Jan 20 13:55:44 2001 GMT
verify return:1
depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
notAfter=Jan 20 13:55:44 2001 GMT
verify return:1
---
Certificate chain
 0 s:/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
   i:/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
-----BEGIN CERTIFICATE-----
MIICjjCCAfcCBDny8eAwDQYJKoZIhvcNAQEEBQAwgY0xEDAOBgNVBAYTB1Vua25v
d24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xHDAaBgNVBAoT
E01vcnQgQmF5IENvbnN1bHRpbmcxIDAeBgNVBAsTF09wZW4gU291cmNlIERldmVs
b3BtZW50MRUwEwYDVQQDEwxKZXR0eSBTZXJ2ZXIwHhcNMDAxMDIyMTM1NTQ0WhcN
MDEwMTIwMTM1NTQ0WjCBjTEQMA4GA1UEBhMHVW5rbm93bjEQMA4GA1UECBMHVW5r
bm93bjEQMA4GA1UEBxMHVW5rbm93bjEcMBoGA1UEChMTTW9ydCBCYXkgQ29uc3Vs
dGluZzEgMB4GA1UECxMXT3BlbiBTb3VyY2UgRGV2ZWxvcG1lbnQxFTATBgNVBAMT
DEpldHR5IFNlcnZlcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtfU06Yq0
Kgg/1PB/koBUVstoVZXunnpphJEtuC4MSD/ToBywEBtxgH+kqxU5PouY+D8q7F2e
mhnAUkBOBBxiB5FhSVxAEMFgwRW2xY4KpEzHfoNv4D09dXqHpb7QytW7wh1JCWwJ
/NxFyuDNvhJyuKHITt9UK5Y0Sq9QZN31YBECAwEAATANBgkqhkiG9w0BAQQFAAOB
gQA9ETZCa9GY6sBA2tCqD9s+aLVU8TijVuQkR3djXDLo4b9IeiWmyWWzo+pOF3Mi
7sO41rZoli5blTepQ6TwvnzgBXjkNbttcJPKGzc9qg+WT53wq2dpiYE/UbFDzUTG
AapPu7TOQUxym81QgP+JcD7nvrT4VlvP17wXcSJ4P2pzPg==
-----END CERTIFICATE-----
---
Server certificate
subject=/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
issuer=/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
---
No client certificate CA names sent
---
SSL handshake has read 1000 bytes and written 248 bytes
---
New, TLSv1/SSLv3, Cipher is EXP-RC4-MD5
Server public key is 1024 bit
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EXP-RC4-MD5
    Session-ID: 3B079FD18A6267CDC768F2BD0251E0B2EE8E2E9...
    Session-ID-ctx: 
    Master-Key: 9AD848E83549CF9835747EC287876579D95F3D69A64B9DB8E9...
    Key-Arg   : None
    Start Time: 990355411
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---


Author: Brett Sealey.
Last updated: 2003 April 4th


JettyFaq