Specify the debug level. Default is 1.

Prints a short reminder of the command line options.

Print a list of the supported algorithms and modes.

Connect, establish a session. Connect again and resume this session.

Connect, establish a plain session and start TLS when EOF or a SIGALRM is received.

Prints the program's version number.

More verbose output.

TLS algorithms and protocols to enable. Unless the first keyword is "NONE" the defaults are:

Protocols: TLS1.1, TLS1.0, and SSL3.0.

Compression: NULL.

Certificate types: X.509, OpenPGP.

Signature algorithms: RSA-SHA1, RSA-MD2, RSA-MD5, RSA-SHA256, RSA-SHA512, DSA-SHA1.

You can also use predefined sets of ciphersuites such as:

all the "secure" ciphersuites are enabled, limited to 128 bit ciphers and sorted by terms of speed performance.

option enables all "secure" ciphersuites. The 256-bit ciphers are included as a fallback only. The ciphers are sorted by security margin.

flag enables all "secure" ciphersuites with ciphers up to 128 bits, sorted by security margin.

flag enables all "secure" ciphersuites including the 256 bit ciphers, sorted by security margin.

all the ciphersuites are enabled, including the low-security 40 bit ciphers.

nothing is enabled. This disables even protocols and compression methods.

Special keywords:

"!" or "-" appended with an algorithm will remove this algorithm.

"+" appended with an algorithm will add this algorithm.

"%COMPAT" will enable compatibility features for a server.

"%SSL3_RECORD_VERSION" force SSL3.0 record version in the first client hello. This is to avoid buggy servers from terminating connection.

To avoid collisions in order to specify a compression algorithm in this string you have to prefix it with "COMP-", protocol versions with "VERS-" and certificate types with "CTYPE-". All other algorithms don't need a prefix.

Examples:

"NORMAL"

"NORMAL:%COMPAT"

"NORMAL:!AES-128-CBC"

"NONE:+VERS-TLS1.0:+AES-128-CBC:+RSA:+SHA1:+COMP-NULL"

Send CR LF instead of LF.

Send the openpgp fingerprint, instead of the key.

The port to connect to.

Ciphers to enable (use gnutls−cli −−list to show the supported ciphers).

Protocols to enable (use gnutls−cli −−list to show the supported protocols).

Compression methods to enable (use gnutls−cli −−list to show the supported methods).

MACs to enable (use gnutls−cli −−list to show the supported MACs).

Key exchange methods to enable (use gnutls−cli −−list to show the supported methods).

Certificate types to enable (use gnutls−cli −−list to show the supported types).

The maximum record size to advertize.

Disable all the TLS extensions.

Print the certificate in PEM format.

Don't abort program if server certificates can't be validated.

PGP Public Key (certificate) file to use.

PGP Key file to use.

PGP Key ring file to use.

PGP trustdb file to use.

PGP subkey to use.

SRP password to use.

SRP username to use.

Certificate file to use.

X.509 Certificate file to use.

Use DER format for certificates

X.509 key file to use.

X.509 CRL file to use.

PSK username to use.

PSK key (in hex) to use.

Use Opaque PRF Input DATA.