I have a node.js server that I'm configuring for TLS 1.2. I set the following options in the config of my https server:

honorCipherOrder: true,
secureProtocol: 'TLSv1_2_method'

I then ran cipherscan on the port it created and got this result:

prio  ciphersuite                  protocols  pfs                 curves
1     ECDHE-RSA-AES128-SHA256      TLSv1.2    ECDH,P-256,256bits  prime256v1
2     AES128-GCM-SHA256            TLSv1.2    None                None
3     ECDHE-RSA-RC4-SHA            TLSv1.2    ECDH,P-256,256bits  prime256v1
4     RC4-SHA                      TLSv1.2    None                None
5     ECDHE-RSA-AES256-GCM-SHA384  TLSv1.2    ECDH,P-256,256bits  prime256v1
6     ECDHE-RSA-AES256-SHA384      TLSv1.2    ECDH,P-256,256bits  prime256v1
7     ECDHE-RSA-AES256-SHA         TLSv1.2    ECDH,P-256,256bits  prime256v1
8     AES256-GCM-SHA384            TLSv1.2    None                None
9     AES256-SHA256                TLSv1.2    None                None
10    AES256-SHA                   TLSv1.2    None                None
11    CAMELLIA256-SHA              TLSv1.2    None                None
12    ECDHE-RSA-AES128-GCM-SHA256  TLSv1.2    ECDH,P-256,256bits  prime256v1
13    ECDHE-RSA-AES128-SHA         TLSv1.2    ECDH,P-256,256bits  prime256v1
14    AES128-SHA256                TLSv1.2    None                None
15    AES128-SHA                   TLSv1.2    None                None
16    CAMELLIA128-SHA              TLSv1.2    None                None
17    ECDHE-RSA-DES-CBC3-SHA       TLSv1.2    ECDH,P-256,256bits  prime256v1
18    DES-CBC3-SHA                 TLSv1.2    None                None

Certificate: trusted, 2048 bit, sha256WithRSAEncryption signature
TLS ticket lifetime hint: 7200
OCSP stapling: not supported
Cipher ordering: server
Curves ordering: server
Curves fallback: False

Fallbacks required:
big-SSLv3 config not supported, connection failed
big-TLSv1.0 config not supported, connection failed
big-TLSv1.1 config not supported, connection failed
big-TLSv1.2 no fallback req, connected: TLSv1.2 ECDHE-RSA-AES128-SHA256

Any idea why 'ECDHE-ECDSA-AES256-SHA384' is not my top priority cipher? It doesn't matter so much to me, but I would like to understand what I'm seeing better.

  • Have you tried asking e.g. Indutny on github? – Deer Hunter Aug 16 '15 at 20:41
  • 1
    Probably relevant: github.com/nodejs/node/issues/818 – Deer Hunter Aug 16 '15 at 21:08
  • Ok, probably comes down to my not really understanding the format of that string. I'll try tweaking it based on what I'm seeing in that discussion. – Ben Flynn Aug 16 '15 at 21:49
  • Ok, I adjusted my list and it is being obeyed. Seems as though ECDSA may not be supported, but that is not a problem. Thanks for the tip. – Ben Flynn Aug 16 '15 at 22:38
  • Ben, you may post an answer to your owm question if you fixed the problem. – Deer Hunter Aug 17 '15 at 2:23


No ECDSA cert installed or no ECDSA-scan support in the tool you used, maybe?

Check with another tool. Or by hand on the command line with the openssl s_client command.

| improve this answer | |
  • Yes, that makes sense. A combination of me not reading the screen carefully enough, not understanding the cipher string well enough, and not realizing the my cert is RSA. – Ben Flynn Aug 17 '15 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.