Check a webserver's cipher suites

Today we wrote a simple shell script to query an SSL enabled webserver. Pretty fun to have in the aresenal, it looks like this:

1
#!/bin/bash
2

3
if [ $# -eq 0 ]
4
  then
5
    echo "No fqdn given to check, try again (ie- $0 yahoo.com)"
6
    exit 1
7
fi
8

9
for v in ssl2 ssl3 tls1 tls1_1 tls1_2; do
10
 for c in $(openssl ciphers 'ALL:eNULL' | tr ':' ' '); do
11
 openssl s_client -connect ${1}:443 \
12
 -cipher $c -$v < /dev/null > /dev/null 2>&1 && echo -e "$v:\t$c"
13
 done
14
done
15

16
exit 0

Let’s run it against our site and see what we get:

1
$ ./ssl_cipher_test.sh fak3r.com
2
tls1_2: ECDHE-RSA-AES256-SHA
3
tls1_2: AES256-SHA
4
tls1_2: ECDHE-RSA-AES128-GCM-SHA256
5
tls1_2: ECDHE-RSA-AES128-SHA
6
tls1_2: AES128-GCM-SHA256
7
tls1_2: AES128-SHA

So what do you think?

Not bad