We have a site and need to connect to a 3rd party service that uses a system with certain cipher support. I've tried LetsEncrypt and Comodo but neither work.

Is there a resource that I can locate to find which SSL certificate authority supports the desired ciphers without going through the install and doing nmap --script ssl-enum-ciphers -p 443 example.org

Here are the ciphers supported:

Cipher#  0 : TLS_RSA_WITH_AES_256_CBC_SHA256 
Cipher#  1 : TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 
Cipher#  2 : TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 
Cipher#  3 : TLS_RSA_WITH_AES_256_CBC_SHA 
Cipher#  4 : TLS_DHE_RSA_WITH_AES_256_CBC_SHA 
Cipher#  5 : TLS_DHE_DSS_WITH_AES_256_CBC_SHA 
Cipher#  6 : TLS_RSA_WITH_AES_128_CBC_SHA256 
Cipher#  7 : TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 
Cipher#  8 : TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 
Cipher#  9 : TLS_RSA_WITH_AES_128_CBC_SHA 
Cipher#  10 : TLS_DHE_RSA_WITH_AES_128_CBC_SHA 
Cipher#  11 : TLS_DHE_DSS_WITH_AES_128_CBC_SHA 
Cipher#  13 : TLS_DH_anon_WITH_AES_256_CBC_SHA256 
Cipher#  14 : TLS_DH_anon_WITH_AES_256_CBC_SHA 
Cipher#  15 : TLS_DH_anon_WITH_AES_128_CBC_SHA256 
Cipher#  16 : TLS_DH_anon_WITH_AES_128_CBC_SHA 
Cipher#  20 : SSL_DH_anon_WITH_DES_CBC_SHA 
Cipher#  21 : TLS_RSA_WITH_NULL_SHA256 
Cipher#  22 : SSL_RSA_WITH_NULL_SHA 
Cipher#  23 : SSL_RSA_WITH_NULL_MD5 
Cipher#  24 : TLS_KRB5_WITH_DES_CBC_SHA 
Cipher#  25 : TLS_KRB5_WITH_DES_CBC_MD5

The certificate does not explicitly determine what ciphers are made available by the server. This is actually controlled (for instance, on application servers that make use of OpenSSL) by a Cipher String configuration parameter, which allows the server admin to enable or disable specific ciphers, or suites of ciphers, or to prefer a particular order of ciphers.

There is some good info on this here: https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet


There are essentially two kinds of certificates which differ in the kind of public key used: the typical ones are RSA certificates and the lesser used ones are ECC certificates. The first are used for the cipher with RSA authentication (i.e. TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 ... in your list) and ECC is used for cipher with ECDSA authentication (there is no ECDSA cipher in your list).

Several ciphers in your list don't make use of certificates at all, like TLS_DH_anon_WITH_AES_256_CBC_SHA or TLS_KRB5_WITH_DES_CBC_SHA. Other ciphers in your list are no real ciphers at all but only pseudo-ciphers: TLS_EMPTY_RENEGOTIATION_INFO_SCSV. And then there are DSS ciphers which would require DSA certificates which no public CA issues anyway.

Apart from that many ciphers in this list are terrible insecure, like SSL_RSA_WITH_NULL_MD5 (no encryption at all), SSL_RSA_WITH_DES_CBC_SHA (easy to crack encryption) or TLS_DH_anon_WITH_AES_256_CBC_SHA (no protection against man in the middle attacks since no authentication of the server).

We have a site and need to connect to a 3rd party service that uses a system with certain cipher support.

If you need to connect to a 3rd party service then you are a TLS client. TLS clients usually don't have certificates at all. TLS clients might need (client) certificates if mutual authentication is required. In this case the type of certificate has no relation to the cipher at all - only server certificates have such a relation. But the server will likely require specific certificates, like certificates issued by the 3rd parties certificate authority or other certificates with specific properties. What properties the certificate need to have should be documented by the 3rd party service.

  • 1
    Nit: client cert is independent of ciphersuite except no client cert can be used with anonymous, Kerberos, PSK, and SRP suites. – dave_thompson_085 Nov 15 '18 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.