I somehow was not able to find an answer. I can see the ciphersuits supported by the client/browser on the wire, but server does NOT appear to advertise the ciphersuites it supports during the handshake. But I know SSLLab's SSL tester does provide a report of the ciphersuites a SERVER would support. How was that done? One possibility is for the client to try ALL possibilities one at a time?

  • 2
    Yes they try one at a time, and so do many other tools that do this. See superuser.com/questions/109213/… for several scripts and links to at least a dozen more, and that doesn't count loads of commercial or otherwise restricted products. Commented Apr 9, 2016 at 23:59
  • Thanks. That's very helpful. I somehow didn't find it myself.
    – shrek
    Commented Apr 10, 2016 at 0:25

1 Answer 1


I use this nmap script, it's convenient and gives scores similar to Qualys SSL Labs:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .