0

I want to check if the following encryptions are disabled in the openssl-1.0.2l

  • TLS_RSA_WITH_RC4_128_MD5
  • TLS_RSA_WITH_RC4_128_SHA
  • SSL_RSA_WITH_RC4_128_MD5
  • SSL_RSA_WITH_RC4_128_SHA
  • SSL_RSA_WITH_3DES_EDE_CBC_SHA

Are there a way to check that?

2

If you want to know which ciphers are available within your openssl binary just run openssl ciphers -V 'ALL:eNULL'. This shows you all ciphers available and the details, e.g.

0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
0xC0,0x28 - ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
0xC0,0x24 - ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
....

If you instead want to know which ciphers are available when using a specific cipher string inside the server use this cipher string instead of ALL:eNULL. Note that you need to make sure that your server and the openssl binary actually use the same OpenSSL library - and the exact same library build (i.e. same *.so file) and not another library with the same OpenSSL version number.

4
  • Thank you for the quick answer. Does the ssllabs.com can discover all the ciphers used by the server ? example: https://www.ssllabs.com/ssltest/analyze.html?d=heidoc.net – MOHAMED Dec 5 '17 at 10:32
  • @MOHAMED: SSLLabs usually does a good job in finding out which ciphers are used. t might have problems with some broken server implementations though. And, if your server is behind some SSL terminating load balancer or reverse proxy it will report the properties of this device and not of your server. – Steffen Ullrich Dec 5 '17 at 11:13
  • thank you, my server is behind a NAT and I added in the gateway a DMZ to my server. I think it should works. Isn't ? – MOHAMED Dec 5 '17 at 13:25
  • @MOHAMED: if the server is directly reachable from outside then it should work. – Steffen Ullrich Dec 5 '17 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.