0

I want to check if the following encryptions are disabled in the openssl-1.0.2l

  • TLS_RSA_WITH_RC4_128_MD5
  • TLS_RSA_WITH_RC4_128_SHA
  • SSL_RSA_WITH_RC4_128_MD5
  • SSL_RSA_WITH_RC4_128_SHA
  • SSL_RSA_WITH_3DES_EDE_CBC_SHA

Are there a way to check that?

Improve this question

1 Answer 1

Reset to default
2

If you want to know which ciphers are available within your openssl binary just run openssl ciphers -V 'ALL:eNULL'. This shows you all ciphers available and the details, e.g.

0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
0xC0,0x28 - ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
0xC0,0x24 - ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
....

If you instead want to know which ciphers are available when using a specific cipher string inside the server use this cipher string instead of ALL:eNULL. Note that you need to make sure that your server and the openssl binary actually use the same OpenSSL library - and the exact same library build (i.e. same *.so file) and not another library with the same OpenSSL version number.

Improve this answer
4
  • Thank you for the quick answer. Does the ssllabs.com can discover all the ciphers used by the server ? example: https://www.ssllabs.com/ssltest/analyze.html?d=heidoc.net
    – MOHAMED
    Dec 5, 2017 at 10:32
  • @MOHAMED: SSLLabs usually does a good job in finding out which ciphers are used. t might have problems with some broken server implementations though. And, if your server is behind some SSL terminating load balancer or reverse proxy it will report the properties of this device and not of your server.
    – Steffen Ullrich
    Dec 5, 2017 at 11:13
  • thank you, my server is behind a NAT and I added in the gateway a DMZ to my server. I think it should works. Isn't ?
    – MOHAMED
    Dec 5, 2017 at 13:25
  • @MOHAMED: if the server is directly reachable from outside then it should work.
    – Steffen Ullrich
    Dec 5, 2017 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .