I was testing the supported cipher suites for an exposed httpd service.
On the server, the cipher suites are defined in the httpd properties file (
When I run
testssl from my Kali machine, I get a list of cipher suites, but one of the default lists does not show. Am I missing something?
The command I run:
testssl -E myserver.com:19000
Testing ciphers per protocol via OpenSSL plus sockets against the server, ordered by encryption strength Hexcode | Cipher Suite Name (OpenSSL) | KeyExch. | Encryption | Bits | Cipher Suite Name (IANA/RFC) ____________________________________________________________________________ SSLv2 SSLv3 TLS 1 TLS 1.1 TLS 1.2 xc030 | ECDHE-RSA-AES256-GCM-SHA384 | ECDH 256 | AESGCM | 256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 xc028 | ECDHE-RSA-AES256-SHA384 | ECDH 256 | AES | 256 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 xc02f | ECDHE-RSA-AES128-GCM-SHA256 | ECDH 256 | AESGCM | 128 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 xc027 | ECDHE-RSA-AES128-SHA256 | ECDH 256 | AES | 128 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS 1.3 Done 2023-06-08 07:51:15 [17s] -->> x.x.x.x:19000 (myserver.com) <<--
In the default list of cipher we have
ECDHE-ECDSA-AES128-SHA256, however both are not detected in the testssl scan.
According to chatgpt:
Question: if I have a server exposing a TLS port with an RSA certificate, and I run the testssl.sh tool on a linux machine acting as a client to detect the supported cipher suites by the server, will testssl detect the cipher suites that use ECDSA ?
Yes, the testssl.sh tool should be able to detect cipher suites that use ECDSA on the server, even if the server is using an RSA certificate.
When performing a scan with testssl.sh, it checks the supported cipher suites by initiating a connection to the server and examining the ServerHello message sent by the server during the SSL/TLS handshake. The ServerHello message includes information about the cipher suites supported by the server.
Cipher suites are negotiated during the handshake process, and the server's certificate type (RSA or ECDSA) does not restrict the available cipher suites. The cipher suites supported by the server depend on the server's configuration, and they can include both RSA and ECDSA-based cipher suites.
Therefore, testssl.sh should be able to detect and display the cipher suites supported by the server, including those that utilize ECDSA.