How can I find out the mode block cipher used in a PEM certificate I have? It's been generated with an intermediate CA that does sha256WithRSAEncryption but I need to find out if it's a GCM or CBC to properly configure some devices.
Certificates only contain public keys for an asymmetric algorithm such as RSA or ECC. They do not contain symmetric keys, which is what operates using block ciphers in the various modes.
Symmetric keys are established during the SSL handshake, and are based on the list of ciphers presented by the server and negotiated with the client at the time the connection is made. The mode of operation is defined as part of each listed cipher.
To assert your clients can use CBC or GCM, you will need to go to your server’s configuration and ensure those algorithms are on the list of valid ciphers. You don’t have to worry about including extra ciphers because your clients will not negotiate to use an algorithm they don’t support.
(You may want to remove algorithms from the list for other reasons. You probably don’t want to support using weak algorithms or very short keys, for example.)