I used OpenSSL s_client to connect to a test server.

Because OpenSSL generated client side private DH key, I think there will be a way to show the private key or enforce a specific private key to be used in negotiation for test purposes.

How can I do this?

  • 1
    $\begingroup$ I'm voting to close this question as off-topic because this is about the command line use of a cryptographic tool. Please ask on superuser instead. $\endgroup$ – Maarten Bodewes Aug 30 '18 at 1:52
  • $\begingroup$ No, libssl won't show, or set, the ephemeral private key -- unless you intervene manually with a debugger, or change the source and rebuild which you can because it's open source. s_client does show the (derived) master secret for the session, which is sufficient to decrypt eavesdropped traffic; there are multiple Qs about that on security.SX and perhaps some other Stacks. $\endgroup$ – dave_thompson_085 Aug 31 '18 at 1:37
  • $\begingroup$ Thanks a lot. Do you happen to know a tool that does show it? Debugging or rebuild is too complex for me. $\endgroup$ – Zeta Aug 31 '18 at 5:15