While I was searching related questions, I saw this: https://superuser.com/questions/109213/how-do-i-list-the-ssl-tls-cipher-suites-a-particular-website-offers
I tried working on the solutions provided but I haven't found my solution.
I have 2 server, the test and the production server.
Both of them host an application, test and prod. This application requires a reverse proxy so I set up Apache for this.
I was asked to improve the cipher suite used for the HTTPS.
The PROD server uses, in apache, this:
SSLProtocol All -SSLv2 -SSLv3 SSLCipherSuite DES-CBC-SHA:HIGH:!aNULL:!MD5:!EXP SSLHonorCipherOrder on
The TEST server, which I'm currently working on, was updated for using this:
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off
It is time to test if the new configuration works (well, it already should, but you know...).
From a 3rd TEST machine I ran:
curl https://test.servertest.com/test1 against the TEST server and curl https://prodserver.com/accept to the PROD one.
Reading the APACHE error log from both the TEST and PROD servers, I do not see differences.
TEST: [Tue Oct 23 13:57:10.846249 2018] [ssl:trace3] [pid 13130] ssl_engine_kernel.c(1795): [remote 220.127.116.11:5555] OpenSSL: Handshake: done [Tue Oct 23 13:57:10.846257 2018] [ssl:debug] [pid 13130] ssl_engine_kernel.c(1844): [remote 18.104.22.168:5555] AH02041: Protocol: TLSv1, Cipher: ECDHE-RSA-AES256-SHA (256/256 bits) PROD: [Tue Oct 23 13:58:04.192403 2018] [ssl:trace3] [pid 6856] ssl_engine_kernel.c(1795): [remote 22.214.171.124:6666] OpenSSL: Handshake: done [Tue Oct 23 13:58:04.192409 2018] [ssl:debug] [pid 6856] ssl_engine_kernel.c(1844): [remote 126.96.36.199:6666] AH02041: Protocol: TLSv1, Cipher: ECDHE-RSA-AES256-SHA (256/256 bits)
Probably CURL might not be the best way for testing the cipher suite (?) but my question is: How can I be sure that the changes I applied are correct (beside finding the ciphers suite themselves in the Apache manual) ?