Determine supported SSL Cipher Suite for particular web server.

By | December 10, 2014

What is SSL Cipher Suite?
A cipher suite is a named combination of authentication, encryption, message authentication code (MAC) and key exchange algorithms used to negotiate the security settings for a network connection using the Transport Layer Security (TLS) / Secure Sockets Layer (SSL) network protocol

Below bash script gets a list of supported cipher suites from OpenSSL and tries to connect using each one. If the handshake is successful, it prints YES. If the handshake isn’t successful, it prints NO, followed by the OpenSSL error text.
[code language=”bash”]
#!/usr/bin/env bash

# OpenSSL requires the port number.
SERVER=192.168.1.11:443
DELAY=1
ciphers=$(openssl ciphers ‘ALL:eNULL’ | sed -e ‘s/:/ /g’)

echo Obtaining cipher list from $(openssl version).

for cipher in ${ciphers[@]}
do
echo -n Testing $cipher…
result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
if [[ "$result" =~ "Cipher is ${cipher}" || "$result" =~ "Cipher :" ]] ; then
echo YES
else
if [[ "$result" =~ ":error:" ]] ; then
error=$(echo -n $result | cut -d’:’ -f6)
echo NO \($error\)
else
echo UNKNOWN RESPONSE
echo $result
fi
fi
sleep $DELAY
done
[/code]

Here’s sample output showing 3 unsupported ciphers, and 1 supported cipher:


[@linux ~]$ ./test_ciphers
Obtaining cipher list from OpenSSL 0.9.8k 25 Mar 2009.
Testing ADH-AES256-SHA...NO (sslv3 alert handshake failure)
Testing DHE-RSA-AES256-SHA...NO (sslv3 alert handshake failure)
Testing DHE-DSS-AES256-SHA...NO (sslv3 alert handshake failure)
Testing AES256-SHA...YES

Reference:
http://en.wikipedia.org/wiki/Cipher_suite
http://superuser.com/questions/109213/is-there-a-tool-that-can-test-what-ssl-tls-cipher-suites-a-particular-website-of
https://www.ssllabs.com/ssltest/index.html

Loading