6

I'm running Apache 2.2.31 and I'm trying to get Perfect Forward Secrecy working. Using Qualys SSL Labs shows that pretty much everything except IE is using ciphers that can use forward secrecy.

I've verified that SSLHonorCipherOrder is set to on in the Apache configuration, but I'm wondering if there's a way to externally test that the cipher order is being enforced.

SSLLabs lists the supported ciphers in order of preference, and it matches what I specified in the config file

Improve this question
4
  • Cipher orders can not be enforced. Your server is listing its preference, but it is up to the client to adhere to your preference. Not all clients obey this. The best you can do is generate a solid ssl config for the version of openssl, mod_ssl and apache you are using.
    – Aaron
    Sep 23, 2015 at 15:18
  • Erm... httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslhonorcipherorder says if it's enabled, the server's preference will be used in preference to the client. IE does support better ciphers, I'm just wondering if there's a way to make it respect the order.
    – Kyle
    Sep 23, 2015 at 15:34
  • That sounds more like a browser configuration question. MSIE likely requires changes to the registry but I would have to research that. Did you validate the order your browser defaults to? If that is taking precedence over what you have listed in SSLHonorCipherOrder, then that is one of the clients that does not adhere to it.
    – Aaron
    Sep 23, 2015 at 15:41
  • That's a good point, I'll test switching orders around and seeing if the cipher used changes as appropriate.
    – Kyle
    Sep 23, 2015 at 15:42

2 Answers 2

Reset to default
6

For decent HTTPS configuration analysis you can use https://testssl.sh/ as well. It grants really high quality information of overall HTTPS state.

testssl https://yoursite.com

In order to check configuration you asked - search for following check in the output:

Testing server preferences

Has server cipher order?     nope (NOT ok)

or

Testing server preferences

 Has server cipher order?     yes (OK)
Improve this answer
4

An Nmap EnumCipher script will help you with this

nmap --script ssl-enum-ciphers -p

I have also set SSLHonorCipherOrder as on, but it shows "cipher preference: client"

I was looking for an answer while stumbling on to this old question

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.