There is no way to do this directly, however you can script it a bit.
Let's say that your initial cipher suites string is
!3DES:HIGH. (You should probably have a better cipher suites string to begin with, but that's a good starting point and won't clutter this answer too much.)
Now, do this:
$ openssl ciphers '!3DES:HIGH' \
| sed -e 's/:/\n/g' \
| grep -v GCM \
| sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/:!/g' -e 's/^/!/'
Explanation, per line:
- Start with the set of ciphers you "really" want
- Split the
:-separated list into one-per-line cipher suite
- Remove anything that doesn't explicitly say
- Read the whole file in at once, replace newlines with
:!, then add a
! at the very beginning
Now take this output and place it at the front of your cipher suite string. Don't throw-out your original, because you might want to re-run this process later when your initial cipher suites string changes, or if new ciphers are added to OpenSSL or even to their
HIGH default list.