Skip to content

Instantly share code, notes, and snippets.

@warmfusion
Created September 21, 2015 10:43
Show Gist options
  • Save warmfusion/6519b9d5b8984477ff68 to your computer and use it in GitHub Desktop.
Save warmfusion/6519b9d5b8984477ff68 to your computer and use it in GitHub Desktop.
Uses OpenSSL to test which SSL ciphers are supported on a given backend
Obtaining cipher list from OpenSSL 0.9.8zg 14 July 2015.
Testing ADH-SEED-SHA                   NO (sslv3 alert handshake failure)
Testing DHE-RSA-SEED-SHA               NO (sslv3 alert handshake failure)
Testing DHE-DSS-SEED-SHA               NO (sslv3 alert handshake failure)
Testing SEED-SHA                       NO (sslv3 alert handshake failure)
Testing ADH-AES256-SHA                 NO (sslv3 alert handshake failure)
Testing DHE-RSA-AES256-SHA             YES
Testing DHE-DSS-AES256-SHA             NO (sslv3 alert handshake failure)
Testing AES256-SHA                     NO (sslv3 alert handshake failure)
Testing ADH-AES128-SHA                 NO (sslv3 alert handshake failure)
Testing DHE-RSA-AES128-SHA             YES
Testing DHE-DSS-AES128-SHA             NO (sslv3 alert handshake failure)
Testing AES128-SHA                     NO (sslv3 alert handshake failure)
Testing ADH-DES-CBC3-SHA               NO (sslv3 alert handshake failure)
Testing ADH-DES-CBC-SHA                NO (sslv3 alert handshake failure)
Testing EXP-ADH-DES-CBC-SHA            NO (sslv3 alert handshake failure)
Testing ADH-RC4-MD5                    NO (sslv3 alert handshake failure)
Testing EXP-ADH-RC4-MD5                NO (sslv3 alert handshake failure)
Testing EDH-RSA-DES-CBC3-SHA           NO (sslv3 alert handshake failure)
Testing EDH-RSA-DES-CBC-SHA            NO (sslv3 alert handshake failure)
Testing EXP-EDH-RSA-DES-CBC-SHA        NO (sslv3 alert handshake failure)
Testing EDH-DSS-DES-CBC3-SHA           NO (sslv3 alert handshake failure)
Testing EDH-DSS-DES-CBC-SHA            NO (sslv3 alert handshake failure)
Testing EXP-EDH-DSS-DES-CBC-SHA        NO (sslv3 alert handshake failure)
Testing DES-CBC3-SHA                   NO (sslv3 alert handshake failure)
Testing DES-CBC-SHA                    NO (sslv3 alert handshake failure)
Testing EXP-DES-CBC-SHA                NO (sslv3 alert handshake failure)
Testing EXP-RC2-CBC-MD5                NO (sslv3 alert handshake failure)
Testing RC4-SHA                        NO (sslv3 alert handshake failure)
Testing RC4-MD5                        NO (sslv3 alert handshake failure)
Testing EXP-RC4-MD5                    NO (sslv3 alert handshake failure)
Testing DES-CBC3-MD5                   NO (sslv3 alert handshake failure)
Testing DES-CBC-MD5                    NO (sslv3 alert handshake failure)
Testing EXP-RC2-CBC-MD5                NO (sslv3 alert handshake failure)
Testing RC2-CBC-MD5                    NO (sslv3 alert handshake failure)
Testing EXP-RC4-MD5                    NO (sslv3 alert handshake failure)
Testing RC4-MD5                        NO (sslv3 alert handshake failure)
Testing NULL-SHA                       NO (sslv3 alert handshake failure)
Testing NULL-MD5                       NO (sslv3 alert handshake failure)
#!/usr/bin/env bash
# OpenSSL requires the port number.
SERVER=${1:-127.0.0.1:443}
DELAY=1
ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')
echo Obtaining cipher list from $(openssl version).
for cipher in ${ciphers[@]}
do
#echo -n Testing $cipher...
result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
if [[ "$result" =~ ":error:" ]] ; then
error=$(echo -n $result | cut -d':' -f6)
RES="NO ($error)"
else
if [[ "$result" =~ "Cipher is ${cipher}" || "$result" =~ "Cipher :" ]] ; then
RES="YES"
else
RES="UNKNOWN RESPONSE: $result"
fi
fi
printf "Testing %-30s %-30s\n" $cipher "$RES"
sleep $DELAY
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment