1

Is there a way to block ciphers suites supported by OpenSSL in OpenSSL configuration as oppose to doing it in Apache by creating:

SSLCipherSuite HIGH:!aNULL:@STTRENGTH

?

2

You can use openssl s_client --help to get some information about protocols to use:

-ssl2 - just use SSLv2 -ssl3 - just use SSLv3 -tls1_2 - just use TLSv1.2 -tls1_1 - just use TLSv1.1 -tls1 - just use TLSv1 -dtls1 - just use DTLSv1

It also mentions -ciphers:

-cipher - preferred cipher to use, use the 'openssl ciphers' command to see what is available

And openssl ciphers gives you the list. So in short, yes, you should be able to use fixed protocol and cipher from the client side.

2

I don't think there is a way (by means of configuration) to disable various ciphers for all programs that use the openssl crypto libraries.

You should, however, be able to recompile your own openssl library, setting some command line switches to do the same. According to the OpenSSL Wiki you can check the ssl_algs.c for the switches:

    ...
#ifndef OPENSSL_NO_DES
    EVP_add_cipher(EVP_des_cbc());
    EVP_add_cipher(EVP_des_ede3_cbc());
#endif
#ifndef OPENSSL_NO_IDEA
    EVP_add_cipher(EVP_idea_cbc());
#endif
    ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.