title: socat openssl-listen - ensuring TLSv1.3 is in use
body: <p>I have a working client/server scenario using <code>socat</code> with the following commands:</p>
  
  <p><strong>Server</strong></p>
  
  <pre><code>socat openssl-listen:5000,reuseaddr,cert=server.pem,cafile=server.crt,verify=0 STDIO
  </code></pre>
  
  <p><strong>Client</strong></p>
  
  <pre><code>socat stdio openssl-connect:localhost:5000,cert=server.pem,cafile=server.crt,verify=0
  </code></pre>
  
  <p>This is part of a larger system, but the commands above work well for what we are trying to achieve. However, I need to ensure that TLS v1.3 is in use, and ensure it is the only version of encryption being used. I can ensure version 1.2 is used using something like:</p>
  
  <p><code>socat - OPENSSL-LISTEN:443,method=TLS1.2,verify=0,cert=cert.pem,key=key.pem</code></p>
  
  <p>openssl is at the latest (1.1.1 version), which is supposed to support TLS1.3</p>
  
  <p>At time of writing (Feb 2020), almost all the documentation I can find for socat only makes reference to setting TLS1.2, and no reference to TLS1.3. For the <code>openssl</code> command line, you can set <code>-tls1_3</code>, for instance:</p>
  
  <p><code>openssl s_server -accept 443  -tls1_3 -ciphersuites TLS_AES_256_GCM_SHA384 -key key.pem -cert cert.pem</code></p>
  
  <p>[1] <a href="https://8gwifi.org/docs/tlsv13.jsp" rel="nofollow noreferrer">https://8gwifi.org/docs/tlsv13.jsp</a></p>
  
  <p>This command works (alongside the relevant <code>s_client</code> command), but I cannot get the same parameters passed in through socat.</p>