Since I limited my Ciphers to ECDHE because of the Logjam vulnerabilities, I am not able to do a curl from a Centos machine anymore. (works from Ubuntu)
$ curl -v https://mysite.mydomain.com
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
Opening with openssl works:
$ openssl s_client -connect mysite.mydomain.com:443
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
I tried with explicit cipher, --insecure and --tlsv1.2, no luck
$ curl --ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 -v https://mysite.mydomain.com
curl: (59) Unknown cipher in list: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Edit: tried with correct NSS cipher name, and less than 384 bit:
curl --ciphers ecdhe_rsa_aes_128_sha_256 https://mysite.mydomain.com
* Connected to xxx (xxx) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Unknown cipher in list: ecdhe_rsa_aes_128_sha_256
* Closing connection 0
curl: (59) Unknown cipher in list: ecdhe_rsa_aes_128_sha_256
Found this bug https://bugzilla.redhat.com/show_bug.cgi?id=1185708 but doesn't help me to get pass that.
SSLLabs report those ciphers as supported:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH 256 bits (eq. 3072 bits RSA) FS 256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH 256 bits (eq. 3072 bits RSA) FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH 256 bits (eq. 3072 bits RSA) FS 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH 256 bits (eq. 3072 bits RSA) FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH 256 bits (eq. 3072 bits RSA) FS 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH 256 bits (eq. 3072 bits RSA) FS 128