On Monday, 6 December 2021 15:52:30 CET, Dr. Matthias St. Pierre wrote:
"Comparable elegant" is underspecified.
(I guess, "Comparably elegant" would have been grammatically more correct.)
Perhaps try testssl.sh (https://testssl.sh/)? It has various
options for reducing the number and types of tests it runs.
We've used it for
profiling internal TLS-enabled servers.
My question was mainly for educational purpose (since the
'nmap' tool already satisfies my needs), but I wanted to know
whether the openssl tool
can do same thing with a comparable effort. By this I mean a
simple shell one-liner (or failing that just a few lines of
shell script) utilizing `openssl s_client`.
Thanks for the weblink nevertheless.
No, it can't.
As what's necessary is to connect to server, note the used cipher,
exclude that cipher from ClientHello and see what is the next cipher that
server selects, repeat until connection rejected.
That's not simple to do in bash (for a way to do it look at
mozilla/cipherscan)
The big problem is that this approach works only for ciphers supported and
enabled in openssl. If a cipher is unsupported by openssl, it will not be
detected as enabled on server side.
Given that there is no version of openssl that simultaneously supports
SSLv2
and TLS 1.3, you can't reliably test arbitrary servers using openssl, even
if the server uses openssl too.
--
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
