20

My understanding is that during ssl negotiation, the client (i.e. curl) sends a list of ciphers to the server, and the server replies with its preferred choice.

How do I see the list of ciphers that curl is sending?

4 Answers 4

19

There is a website that offers curl cipher request detection as a service:

curl https://www.howsmyssl.com/a/check

However, it does not accept all ciphers - if one of the ciphers they accept is not on the list that your curl is sending, then you will not be able to get a response at all.

1

You can use Wireshark. For example, if you set a packet filter of "tcp port 443" and then set the display filter to "ssl", you'll get output like this:

Wireshark screenshot showing Client Hello of TLS

You can see that the "Client Hello" packet shows cipher suites like TLS_AES_128_GCM_SHA256.

0

Create a self-signed cert and open a web server with openssl:

openssl s_server -key Server.key -cert Server.crt -accept 4433

A connection request by curl on that address should show shared ciphers. That often is NOT all the ciphers offered by the client.

Related: How to Use OpenSSL’s Client and Server for Testing

Warning: creating a self-signed cert could be a complex process if you have never created one. It is, however, a basic skill needed to work with certs. This answer requires one self-signed cert. More info:

https://netburner.com/learn/creating-a-self-signed-certificate-for-secure-iot-applications

4
  • 1
    s_server shows the shared suites between the client and itself; that often is NOT all the suites offered by the client. E.g. OpenSSL by default excludes aNULL suites, which client might use; in 2015 when this was asked RedHat-family OpenSSL deleted ECC suites; and even if you specify -cipher ALL:eNULL (and yes ALL includes aNULL but NOT eNULL!) recent OpenSSL releases as typically built exclude RC4 EXPORT 1DES suites and no longer even have the obsolete SSLv2 protocol and its suites, (some of) which a sufficiently old client might still use or even require. Sep 7, 2021 at 2:47
  • @dave_thompson_085 True, thanks. Is there any other local (not using internet) way to list client ciphers?
    – IsaaC
    Sep 7, 2021 at 3:06
  • 1
    Silly answer: if like me you have memorized most of TLS, use -debug or -msg on s_server to get a hex dump of clienthello, identify the ciphersuite values, and look them up on the IANA webpage. Serious answers: (install and) run wireshark on the interface used to send/receive clienthello to any local server (s_server or something like python -mhttps.server); or if your OpenSSL 1.1.0 up is compiled with a special option (most aren't) s_server -trace gives a similar decode of the values it knows, and you can manually look up any others (typically few, maybe none) :-) Sep 7, 2021 at 8:03
  • So, I guess that your answer is: Yes, this is the local way to see the ciphers, just add -debug or -trace to the server invocation. Thanks, better now. @dave_thompson_085
    – IsaaC
    Sep 7, 2021 at 11:23
-1

This answer [1] is a good start, but it glosses over how to actually create a self-signed certificate, and the answer doesnt work without that part. Further, the article [2] they link to with instruction on how to create a self-signed certificate is using OpenSSL, which is good for some purposes, but maybe not ideal for creating a self-signed certificate, as it makes the process harder than it needs to be. To that end, I found another tool [3], thats much simpler:

generate_cert -host localhost

Its just a single file written in Go, with no external dependencies. After you run the above command, you can then use OpenSSL or similar to start a server:

openssl s_server -msg -accept 8080 -cert cert.pem -key key.pem 

Then make a request like this:

curl -k https://localhost:8080
  1. https://unix.stackexchange.com/a/667824
  2. https://netburner.com/learn/creating-a-self-signed-certificate-for-secure-iot-applications
  3. https://github.com/golang/go/blob/go1.17.4/src/crypto/tls/generate_cert.go

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.