1

I need to make a risk analysis for a given service in my Company. For this I would need to make a comparison between SSL Cipher Suites and how often they are used to reevaluate the need for old/weak ciphers. Is it possible in any way to monitor/output the Cipher Suites used by OpenSSL?

The goal is that I can say for example:

  • TLS 1.2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 was used in 1234 connections of 123456 connections
  • SSLv3 SSL_RSA_WITH_RC4_128_SHA was used in 12 connections of 123456

1 Answer 1

1

Openssl is just the library, you'll need to add the appropriate logging to the services that use TLS to record such details.

i.e. in Apache httpd you can record the SSL_CIPHER environment variable that contains the cipher suite with something along the lines of:

CustomLog logs/ssl_ciphers_log  "%t %h \"{User-agent}i\" %{SSL_PROTOCOL}x %{SSL_CIPHER}x "

Similarly in nginx https://serverfault.com/a/620130/37681

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .