## How do I debug with SSL?

While Jetty is normally well behaved, there are times when it is necessary to debug problems. For information on how to set up general debugging options go to the tutorial page . The following are some hints for debugging when using SSL.

### JSSE

As described in the JSSE FAQ, there is a debug facility built into JSSE controlled by the javax.net.debug property.

Assuming that you've got JSSE configured properly you will be able to use it as follows, you will need to edit the etc/demo.xml as described in The JSSE SSL doco.

To get help use:

    JAVA_OPTIONS='-Djavax.net.debug=help' ./bin/jetty.sh run

You will get something like this:

    all         turn on all debugging
    ssl         turn on ssl debugging

    The following can be used with ssl:
            record      enable per-record tracing
            handshake   print each handshake message
            keygen      print key generation data
            session     print session activity

            handshake debugging can be widened with:
            data        hex dump of each handshake message
            verbose     verbose handshake message printing

            record debugging can be widened with:
            plaintext   hex dump of record plaintext

#### example

    JAVA_OPTIONS='-Djavax.net.debug=ssl,handshake,data' ./bin/jetty.sh run

### General SSL

Assuming you've got the excellent (in a Bill&Ted way) openssl package installed, you can use it's s_client utility to help debug an SSL setup.

To get help use:

    man s_client

or:

    openssl s_client -help

#### example

When run against a server using the expired test certificate the following is generated.

    bretts@london[7538]: openssl s_client -showcerts -connect localhost:8443
    CONNECTED(00000003)
    depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
    verify error:num=18:self signed certificate
    verify return:1
    depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
    verify error:num=10:Certificate has expired
    notAfter=Jan 20 13:55:44 2001 GMT
    verify return:1
    depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
    notAfter=Jan 20 13:55:44 2001 GMT
    verify return:1
    ---
    Certificate chain
     0 s:/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
       i:/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
    -----BEGIN CERTIFICATE-----
    MIICjjCCAfcCBDny8eAwDQYJKoZIhvcNAQEEBQAwgY0xEDAOBgNVBAYTB1Vua25v
    d24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xHDAaBgNVBAoT
    E01vcnQgQmF5IENvbnN1bHRpbmcxIDAeBgNVBAsTF09wZW4gU291cmNlIERldmVs
    b3BtZW50MRUwEwYDVQQDEwxKZXR0eSBTZXJ2ZXIwHhcNMDAxMDIyMTM1NTQ0WhcN
    MDEwMTIwMTM1NTQ0WjCBjTEQMA4GA1UEBhMHVW5rbm93bjEQMA4GA1UECBMHVW5r
    bm93bjEQMA4GA1UEBxMHVW5rbm93bjEcMBoGA1UEChMTTW9ydCBCYXkgQ29uc3Vs
    dGluZzEgMB4GA1UECxMXT3BlbiBTb3VyY2UgRGV2ZWxvcG1lbnQxFTATBgNVBAMT
    DEpldHR5IFNlcnZlcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtfU06Yq0
    Kgg/1PB/koBUVstoVZXunnpphJEtuC4MSD/ToBywEBtxgH+kqxU5PouY+D8q7F2e
    mhnAUkBOBBxiB5FhSVxAEMFgwRW2xY4KpEzHfoNv4D09dXqHpb7QytW7wh1JCWwJ
    /NxFyuDNvhJyuKHITt9UK5Y0Sq9QZN31YBECAwEAATANBgkqhkiG9w0BAQQFAAOB
    gQA9ETZCa9GY6sBA2tCqD9s+aLVU8TijVuQkR3djXDLo4b9IeiWmyWWzo+pOF3Mi
    7sO41rZoli5blTepQ6TwvnzgBXjkNbttcJPKGzc9qg+WT53wq2dpiYE/UbFDzUTG
    AapPu7TOQUxym81QgP+JcD7nvrT4VlvP17wXcSJ4P2pzPg==
    -----END CERTIFICATE-----
    ---
    Server certificate
    subject=/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
    issuer=/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting/OU=Open Source Development/CN=Jetty Server
    ---
    No client certificate CA names sent
    ---
    SSL handshake has read 1000 bytes and written 248 bytes
    ---
    New, TLSv1/SSLv3, Cipher is EXP-RC4-MD5
    Server public key is 1024 bit
    SSL-Session:
        Protocol  : TLSv1
        Cipher    : EXP-RC4-MD5
        Session-ID: 3B079FD18A6267CDC768F2BD0251E0B2EE8E2E9...
        Session-ID-ctx:
        Master-Key: 9AD848E83549CF9835747EC287876579D95F3D69A64B9DB8E9...
        Key-Arg   : None
        Start Time: 990355411
        Timeout   : 300 (sec)
        Verify return code: 0 (ok)
    ---

Author: Brett Sealey.
Last updated: 2003 April 4th

JettyFaq