In response to Logjam I want to prove I've hardened my services. I know that the DH param has to be 2048 bits at least and self generated. But I am unable to find a way to actually check this for something other than an HTTPS site. (thats I can do here) I would like to check my other SSL protected services for this as well:
- Mail (Postfix and Dovecot)
- Any other
I got as far as
openssl s_client -starttls smtp -crlf -connect localhost:25 But that yielded:
CONNECTED(00000003) depth=3 C = SE, O = ME, OU = Also ME, CN = Me again verify error:num=19:self signed certificate in certificate chain verify return:0 Server certificate -SNIPED SOME VALUES- --- SSL handshake has read 6118 bytes and written 466 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 6EAA8A5B22E8C18E9D0E78A0B08447C8449E9B9543601BC53F57CB2059597754 Session-ID-ctx: Master-Key: <MASTERKEY> Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1432213909 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain) --- 250 DSN
How can I test the DH parameters? and what should I watch for to know if I'm at risk?