Which cipher suites are offered by s_client when credentials are omitted?

TLS Handshake Behavior Without Client Certificates

When using openssl s_client to validate a server integration, it is often necessary to test the connection without providing production private keys or certificates via the -cert and -key flags.

In OpenSSL 3.x, the tool's behavior during the handshake depends heavily on the server's supported cipher suites and the client's default protocol configuration. If no credentials are supplied, the client may attempt to negotiate anonymous Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman (ECDH) suites. However, many modern servers disable these anonymous suites for security reasons, leading to a handshake failure.

There is uncertainty regarding how s_client handles the fallback mechanism when anonymous suites are rejected and no client certificate is provided, especially when comparing the default behavior of OpenSSL 1.1.1 against OpenSSL 3.0.

• Does s_client attempt a specific sequence of anonymous suites before failing the handshake?
• How does the introduction of TLS 1.3 in OpenSSL 3.x alter the cipher suite offer when credentials are absent?