Centos – How to determine SSL Cipher strength

centoscentos6pci-dssssl

I have updated my ssl.conf file on my Apache2 configuration to use the following SSLCipherSuite

SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!ADH

However the PCI scan seems to detect that WEAK and MEDIUM ciphers are still enabled.

However, I have restarted Apache but it has had no effect.

I'd like to be able to probe the server to see which ciphers it is allowing without having to constantly wait for the PCI scan to run each time I make a change. How can I do this?

Best Answer

indiv posted a script here that can tell you what cipher suites are accepted by a site. Should work for your purposes.

#!/usr/bin/env bash

# OpenSSL requires the port number.
SERVER=192.168.1.11:443
DELAY=1
ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')

echo Obtaining cipher list from $(openssl version).

for cipher in ${ciphers[@]}
do
echo -n Testing $cipher...
result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
if [[ "$result" =~ "Cipher is " ]] ; then
  echo YES
else
  if [[ "$result" =~ ":error:" ]] ; then
    error=$(echo -n $result | cut -d':' -f6)
    echo NO \($error\)
  else
    echo UNKNOWN RESPONSE
    echo $result
  fi
fi
sleep $DELAY
done

You can also use Qualys's SSL scanner. It will tell you the same info.

Related Topic