Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking for a tool to verify the configuration of ssl/tls settings in the browser. I have found a few sites that enumerate supported ciphers and the preferences but none of them seem to provide judgement for what should be enabled and what should be disabled. In fact most of the sites I have stumbled across merely show what is supported and do not show what is not supported.

Essentially I am looking for an SSL Labs for the client not for servers. Any pointers?

share|improve this question
1  
Could you please clarify what you want to verify ? You can already get a lot of information of how a specific SSL connection is handled simply by using packet monitoring software with a good parser like wireshark. –  Stephane Jun 27 '13 at 9:56
    
Stephanie have you seen SSL Labs? I dont want to see a specific connection. –  dfc Jun 27 '13 at 16:15

2 Answers 2

up vote 5 down vote accepted
share|improve this answer
    
I appreciate the answer sadly this is actually the site I was thinking of when I wrote the question. It is a great example of "merely show what is supported and do not show what is not supported" and providing no judgement about the configuration. Surely 56 bit RSA-3DES-EDE-SHA should be on the tsk tsk list? –  dfc Jun 27 '13 at 16:20
    
I forgot to add to my comment above: "If a cipher I expected to show up on the supported list is not there is the omission due to the fact the server did not probe for the cipher or because it did try the cipher and my browser did not support it. –  dfc Jun 27 '13 at 16:29
    
i'm going to ask iristic for a tool like ssl-labs for browsers –  that guy from over there Jun 28 '13 at 9:11
    
@dfc From the speed and number of requests the browser makes, I'd guess that the info is what the browser sends upon connecting. The browser tells the server "hey I wanna setup SSL/TLS and support the following: x, y, z. What's it gonna be?" This website then displays back to you what the browser offered to use. So it's not "only those that the server probed for" but the other way around. See also the second sentence of the "high level description" in this post of mine: security.stackexchange.com/a/20833/10863 –  Luc Jul 10 '13 at 15:25

Browsers almost always use the Operating System for SSL connectivity, so that is what you need to look at. You don't need a specialist tool for that to be honest, you simply need to look at the OS configuration. In windows that means looking at the registry using regedit, and in linux it's a simple text editor.

Here is how to make the changes in windows. Linux is distribution dependent, you'd need to look at the specific version to find it, however it's almost always going to be in /etc somewhere. I'd do a find /etc | egrep "ssl.conf" to get an idea of where the files hide.

share|improve this answer
6  
I'm sorry, but that both overly general and also incorrect. For instance, on windows, IE and Firefox uses different SSL libraries completely. Furthermore, each application can decide exactly how to uses these libraries and what option to use. –  Stephane Jun 27 '13 at 9:54
    
In addition to Stephane's criticism I would like to add that I am not trying identify how my browser is configured. I want to verify how the browser is operating. If I configure the browser to do X and Y and not do Z is it actually doing X and Y and rejecting Z? –  dfc Jun 27 '13 at 16:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.