2

Can I enforce a cipher suite to be used when connecting to a TLS web site via a script.

For monitoring and trouble shooting purposes, my goal is to create a powershell script that checks if a remote server is able to use a specific cypher. I'm using the command Invoke-WebRequest now to connect to the websiste, but as far as I can see, there is no option to enforce a cipher.

Google was not friendly to me either.

Thanks for helping out.

PS: Powershell is prefered, but command line or vbscript is also fine.

2 Answers 2

1

You kind of can.

When looking at this page, you can set your own Cipher with the highest priority to use:

PS C:\>Enable-TlsCipherSuite -Name "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" -Position 0
1

As far as I know you have no control over what cipher suite is used from PowerShell or dot.net, the underlying Windows APIs will negotiate the 'best' suite with the server.

I am using https://github.com/nabla-c0d3/sslyze/ which also has a binary exe version to test for cipher suites. When calling it from PowerShell, you have to do some parsing of the output. Or use the native Python implementation. Of look at the Python code to see what they are doing.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .