0

I read cipher suite description of mod_ssl, and understood the meaning of alias and keywords like ! + etc. But I am unable to understand how to read ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW completely specially when it comes to priority using +.

When I try to use openssl to undestand how ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW is interpretted by Apache then still there is not much help, because ALL: suggest me that ALL ciphers should come, but it is not.

Also, in the below o/p is cipher suite is listed in order of preference they would be chosen by Apache?

[apache1@hagrawal conf.d]$ openssl ciphers -v 'ALL!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW'
DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-DSS-AES256-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA1
AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-DSS-AES128-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA1
AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
KRB5-DES-CBC3-MD5       SSLv3 Kx=KRB5     Au=KRB5 Enc=3DES(168) Mac=MD5 
KRB5-DES-CBC3-SHA       SSLv3 Kx=KRB5     Au=KRB5 Enc=3DES(168) Mac=SHA1
EDH-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  Enc=3DES(168) Mac=SHA1
EDH-DSS-DES-CBC3-SHA    SSLv3 Kx=DH       Au=DSS  Enc=3DES(168) Mac=SHA1
DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1
KRB5-RC4-MD5            SSLv3 Kx=KRB5     Au=KRB5 Enc=RC4(128)  Mac=MD5 
KRB5-RC4-SHA            SSLv3 Kx=KRB5     Au=KRB5 Enc=RC4(128)  Mac=SHA1
RC4-SHA                 SSLv3 Kx=RSA      Au=RSA  Enc=RC4(128)  Mac=SHA1
RC4-MD5                 SSLv3 Kx=RSA      Au=RSA  Enc=RC4(128)  Mac=MD5 
KRB5-DES-CBC-MD5        SSLv3 Kx=KRB5     Au=KRB5 Enc=DES(56)   Mac=MD5 
KRB5-DES-CBC-SHA        SSLv3 Kx=KRB5     Au=KRB5 Enc=DES(56)   Mac=SHA1
EDH-RSA-DES-CBC-SHA     SSLv3 Kx=DH       Au=RSA  Enc=DES(56)   Mac=SHA1
EDH-DSS-DES-CBC-SHA     SSLv3 Kx=DH       Au=DSS  Enc=DES(56)   Mac=SHA1
DES-CBC-SHA             SSLv3 Kx=RSA      Au=RSA  Enc=DES(56)   Mac=SHA1

Second question:
Generally in Apache cipher suite is specified as SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW but can it be specified as SSLCipherSuite TLS_RSA_WITH_RC4_128_SHA, which means instead of specifying the alias and connecting them, directly specifying the cipher I want to use. If I try this can it blow something on my Apache?


I tried using SSLCipherSuite TLS_RSA_WITH_RC4_128_SHA and I got below error. At least Apache should have started, no?

[Tue Aug 18 07:53:02 2015] [info] Configuring server for SSL protocol
[Tue Aug 18 07:53:02 2015] [error] Unable to configure permitted SSL ciphers
[Tue Aug 18 07:53:02 2015] [error] SSL Library Error: 336646329 error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match

I am trying to build the below preference of cipher suites.

SSL3-RSA-RSA-NONE-0-MD5
SSL3-RSA-RSA-NONE-0-SHA
SSL3-RSA-RSA-RC4-128-MD5
SSL3-RSA-RSA-RC4-128-SHA
SSL3-RSA-RSA-DES-56-SHA
SSL3-RSA-RSA-DES3-168-SHA
TLS1.0-RSA-RSA-AES-128-CBC-128-SHA
TLS1.0-RSA-RSA-AES-256-CBC-256-SHA
TLS1.2-RSA-RSA-NONE-0-SHA256
TLS1.2-RSA-RSA-AES-128-CBC-128-SHA256
TLS1.2-RSA-RSA-AES-256-CBC-256-SHA256
  • 1
    BTW, usually your server should support multiple cipher suites to allow as many people as possible to connect and to maintain high security with those clients supporting high security suites. – SEJPM Aug 18 '15 at 11:42
  • 1
    @JOW Yes, we are having few old web clients like IE8. Anyways RC4 will will be chosen only in case of old web clients, so I think this is fine. – hagrawal Aug 18 '15 at 16:53
  • 1
    Nitpicks: @Z.T. OpenSSL 1.0.0 or later supports ECDHE, except on older RedHat builds which disabled ECC, but OP's comment says they don't want ephemeral anyway. OpenSSL 1.0.1 or later is needed for new-in-TLS1.2 ciphers, some of which are in the OP's desired list. – dave_thompson_085 Aug 19 '15 at 7:42
  • 1
    @hagrawal Do you want this: openssl ciphers -v 'RC4-MD5:RC4-SHA:DES-CBC-SHA:DES-CBC3-SHA:AES128-SHA:AES256-SHA:AES128-SHA256:AES256-SHA256' ? – Z.T. Aug 19 '15 at 10:56
  • 1
    @hagrawal: If you do TLS, then you will have to pick from the list of TLS cipher suites. This is the official list for all public suites: iana.org/assignments/tls-parameters/tls-parameters.xhtml – StackzOfZtuff Aug 19 '15 at 11:08
6

Don't write, generate.

Use the Mozilla SSL Configuration Generator

Gory details

You get 20 lines of cipher suites. On my version of OpenSSL I get far more cipher suites. As of today, I've got a total of 139 to pick from:

$ openssl version
OpenSSL 1.0.2d 9 Jul 2015

$ openssl ciphers -V 'ALL' | wc -l
131

$ openssl ciphers -V 'ALL:COMPLEMENTOFALL' | wc -l
139

Yeah. ALL does not in fact mean "All".

Now let's build the cipher list one option after the other and see how the numbers change:

$ openssl ciphers -V 'ALL' | wc -l
131

$ openssl ciphers -V 'ALL:!ADH' | wc -l
117

$ openssl ciphers -V 'ALL:!ADH:!EXPORT' | wc -l
110

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW' | wc -l
106

The numbers didn't change at all for the last 5 options. So this suggests to me that that cipher string has been constructed for a different version than mine. And/or is just wrong/pointless.

EDIT2015-08-19: Wrong. As @dave-thompson-085 helpfully pointed out: the cipher suite count is not supposed to change for any keyword with the + sign in front. It only sorts what's already there. (I mistakenly thought that it both added and then sorted.)

But then again I've got no idea what the original author of the cipher suite string intended to do.

OpenSSL Cookbook

Ivan Ristic of SSL Labs publishes a free chapter of his "Bulletproof SSL and TLS" online. This is called the OpenSSL Cookbook (archived here) and does a good job of explaining the dreaded cipher suite string in the Cipher Suite Selection section.

TLS_RSA_WITH_RC4_128_SHA

If I try this can it blow something on my Apache?

Yeah. You'll lock out anybody who has blocked RC4 client side. (Such as Google Chrome. And Firefox is also moving in that direction.) Not a good idea. But easily fixed. Just put the old string back and restart Apache.

By the way: OpenSSL command line option parsing is terrible.

$ openssl ciphers 'RC4'
ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AECDH-RC4-SHA:ADH-RC4-MD5:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:PSK-RC4-SHA:EXP-ADH-RC4-MD5:EXP-RC4-MD5:EXP-RC4-MD5

$ openssl ciphers 'RC4:!OPENSSL:+OPTION:PARSING:!MAKES:+ME:A:!BIT:+SAD:SOMETIMES'
ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AECDH-RC4-SHA:ADH-RC4-MD5:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:PSK-RC4-SHA:EXP-ADH-RC4-MD5:EXP-RC4-MD5:EXP-RC4-MD5

Yes, that's the same output both times. And no error messages.

EDIT 2015-08-19: How to get Cipher Suite names

You listed some cipher suite names that don't actually exist.

Here's the general recipe on how to get the OpenSSL names: You list everything and then grep for the bits that you want. Like so:

SSL3-RSA-RSA-NONE-0-MD5

$ openssl ciphers -V ALL:COMPLEMENTOFALL | grep -i 'kx=rsa' | grep -i 'au=rsa' | grep -i 'Enc=None' | grep -i 'mac=md5'
      0x00,0x01 - NULL-MD5                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=MD5

So the only cipher suite that satisfies these criteria is NULL-MD5. (That's the OpenSSL name. The official IANA name of this would have been TLS_RSA_WITH_NULL_MD5.)

Here's another example:

SSL3-RSA-RSA-NONE-0-SHA

$ openssl ciphers -V ALL:COMPLEMENTOFALL | grep -i 'kx=rsa' | grep -i 'au=rsa' | grep -i 'Enc=None' | grep -i 'mac=sha1'
      0x00,0x02 - NULL-SHA                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=SHA1

And so on.

  • Thank you for your inputs. Could you please see edit to my question. – hagrawal Aug 18 '15 at 12:09
  • Actually if we use 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW' then DHE or ECDHE is picked up by most of the browser. And we want a 3rd party to decrypt the HTTPS traffic (for some reason) and we have provided them our private key as well. So, we cannot use ECDHE or DHE because it uses a new session key each time and hence even though they have our private key still they will not be able to decrypt, right? So, we are trying for anything below ECDHE or DHE. Using MOZ link you have provided, most are ECDHE or DHE, so I am not sure if we can use, as per our requirement. – hagrawal Aug 18 '15 at 12:09
  • I think cipher list didn't change in last 5 cases because you have already added ALL and killed some ciphers, so there is nothing left, and hence same list all last 5 times. – hagrawal Aug 18 '15 at 12:12
  • 2
    (1) If you exclude(d) !ADH on old OpenSSL because it doesn't authenticate, on 1.0.0+ you should exclude !AECDH for the same reason, or better !aNULL which does the correct thing in all versions (2) +something only reorders, it doesn't select -- and the order only matters on server if you also specify SSLHonorCipherOrder on (3) yes the (lack of) error reporting sucks – dave_thompson_085 Aug 19 '15 at 7:45
  • @dave_thompson_085 Thank you for your inputs. Excluding !aNULL is a good idea, we will do it. SSLHonorCipherOrder was good point, I was not aware, thank you. I assume by default this is off, right? I didn't fully understand your third point. – hagrawal Aug 19 '15 at 10:48
1

Answer of one of my questions is as below:

Available prefixes are:

  1. (+): Move the matching cipher at the current location in the list.
  2. (-): Remove matching cipher from the list (can be added later).
  3. (!): Kill the matching cipher from the list (cannot be added later).

Default cipher string in Apache v2.2 is ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP and can be read as:

  • Start with all ciphers (ALL:)
    • Remember cipher specification is colon separated
  • Remove all anonymous diffie-hellman ciphers (!ADH)
  • Add all RC4 and RSA
  • Add high, medium and low strength ciphers
  • Add SSLv2 and export ciphers to the list, in the end.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.