How can one determine the encryption algorithm type (e.g. AES, DES, 3DES, etc.) that is used by a certificate in Windows (10, 2012-2019)? Is it obvious, and I'm just not seeing it in the certificate details?
we run a vulnerability scan against our servers. It flagged a few certs we use are using 3DES symmetric encryption method, which is a weak encryption algorithm. It is unclear how this was determined, so I am hoping to be able to see if there is a way to determine this my own without having to run a scan every time to find out
Is TLS, the server has a list of cipher suites that it is willing to use when speaking to the client. This is completely independent of the Certificate. The vulnerability scanner connects multiple times, each time asking to use a single cipher, and determines which ciphers are or are not in the allowed cipher suite.
You will want to alter your server configuration so that it removes weak ciphers from its cipher suite. Windows offers a number of ways to manipulate its cipher suites.
The best way to test is to repeat what the vulnerability scanner did. You can do this for a single cipher using OpenSSL. You can test the full suite with a single command using the sslscan tool. And if your server is on the Internet, SSL Labs will test your cipher suite and other aspects of your server configuration as well.