Enumerating TLS protocol versions and ciphers supported by the peer

[Hubert Kario]

On Monday, 6 December 2021 15:52:30 CET, Dr. Matthias St. Pierre wrote:
>
>> "Comparable elegant" is underspecified.
>
> (I guess, "Comparably elegant" would have been grammatically more correct.)
>
>> Perhaps try testssl.sh (https://testssl.sh/)? It has various 
>> options for reducing the number and types of tests it runs. 
>> We've used it for
>> profiling internal TLS-enabled servers.
>
> My question was mainly for educational purpose (since the 
> 'nmap' tool already satisfies my needs), but I wanted to know 
> whether the openssl tool
> can do same thing with a comparable effort. By this I mean a 
> simple shell one-liner (or failing that just a few lines of 
> shell script) utilizing `openssl s_client`.
> Thanks for the weblink nevertheless.

No, it can't.

As what's necessary is to connect to server, note the used cipher,
exclude that cipher from ClientHello and see what is the next cipher that
server selects, repeat until connection rejected.
That's not simple to do in bash (for a way to do it look at 
mozilla/cipherscan)

The big problem is that this approach works only for ciphers supported and
enabled in openssl. If a cipher is unsupported by openssl, it will not be
detected as enabled on server side.
Given that there is no version of openssl that simultaneously supports 
SSLv2
and TLS 1.3, you can't reliably test arbitrary servers using openssl, even
if the server uses openssl too.

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic