2

I was looking at the TLS handshake and I noticed that the client will send its list of supported cipher suites and the server will select a cipher suite. The server never sends its list of supported cipher suites. How does a client like SSLLabs know the cipher suites that the server supports? Also, I noticed that SSLLabs only sends one request to the server.

  • 3
    I'm not certain of how SSLLabs does it... but I'd guess that they just spam the server with connection requests as clients that support different subsets of all ciphers, and check what cipher suite the server responds with. It probably wouldn't take many requests to narrow it down if they immediately exclude any cipher the server has already selected. – nbering Jun 3 '18 at 1:56
  • You can look at the source code for the tool sslyze, and see that it uses a large number of connection attempts when determining cipher suites. – CBHacking Jun 3 '18 at 6:12
5

In TLS the client announces what kind of ciphers it supports inside the ClientHello and the server picks a cipher from these which is supported on the server too. While one cannot query the server ciphers directly from the client side one can simply take all known ciphers, construct a ClientHello with each of these and check how the server reacts to this ClientHello - i.e. if the server is accepting the cipher or not.

By intelligently combining multiple ciphers in the ClientHello one can speed up this process and also determine which ciphers the server prefers against others (i.e. cipher order). And that's exactly what SSLLabs is doing for determining the ciphers and also for getting supported SSL/TLS protocol versions and other features of the server.

Also, I noticed that SSLLabs only sends one request to the server.

If you look into the access log of your web server you'll see only HTTP(S) requests. But, most tests done by the SSLLabs scanner don't result in a completed HTTP request. Instead they already stop in the middle of a TLS handshake. These requests will not be shown in the access log of the web server but you'll see them if you are doing a packet capture.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.