How to Inspect SSL Cipher Suites and Security Protocols

Inspecting your SSL/TLS configuration ensures that your web server protects sensitive data from modern cryptographic attacks and eavesdropping. By verifying your active cipher suites and security protocols, you guarantee that encrypted connections negotiate securely using robust algorithms like AES-GCM and ChaCha20 while dropping outdated protocols like SSLv3, TLS 1.0, and TLS 1.1.

To quickly audit your web application's certificate validity, trust chain, and intermediate installations without running manual command-line utilities, you can use the free SSL Checker on XiaTools to verify your public-facing HTTPS endpoints instantly.

Understanding SSL/TLS Protocols and Cipher Suites

When a client browser connects to your web server via HTTPS, both parties participate in a cryptographic handshake. This handshake determines two critical elements of the connection session: the security protocol version and the exact cipher suite.

The Evolution of Transport Layer Security (TLS)

Secure Sockets Layer (SSL) and early Transport Layer Security versions contain severe cryptographic vulnerabilities. Modern security standards mandate disabling SSLv2, SSLv3, TLS 1.0, and TLS 1.1 entirely. Your server should exclusively support:

• TLS 1.2: The current baseline standard, widely compatible and secure when paired with modern ciphers.
• TLS 1.3: The latest standard, offering significantly faster handshakes through 0-RTT support and mandatory forward secrecy.

What is a Cipher Suite?

A cipher suite is a combination of cryptographic algorithms used to secure network connections. A modern secure cipher suite string, such as TLS_AES_256_GCM_SHA384, defines:

1. Authentication: How the server proves its identity (e.g., RSA, ECDSA).
2. Key Exchange: How session keys are securely shared (e.g., ECDHE for Elliptic Curve Diffie-Hellman Ephemeral, providing forward secrecy).
3. Bulk Encryption: The algorithm used to encrypt the data stream (e.g., AES-256-GCM).
4. Message Authentication Code (MAC): Ensures data integrity (often integrated directly into AEAD ciphers like GCM).

Command-Line Methods to Inspect Ciphers and Protocols

While web-based tools provide an instant overview, network engineers often need granular CLI tools to inspect cipher suites directly from the terminal or server console.

Using OpenSSL to Test Supported Protocols

You can use openssl s_client to test which TLS versions your server accepts. Replace example.com with your target domain:

# Test TLS 1.2 connection
openssl s_client -connect example.com:443 -tls1_2

# Test TLS 1.3 connection
openssl s_client -connect example.com:443 -tls1_3

If the connection succeeds, the output will display the negotiated cipher suite, certificate chain details, and session parameters. If the protocol is disabled on the server, OpenSSL will return a handshake failure error:

CONNECTED(00000003)
402B0300FA7F0000:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_enc.c:602:

Enumerating Ciphers with OpenSSL Client

To check which specific ciphers your server exposes, you can script a loop or use specialized testing flags, though modern OpenSSL builds prioritize server-preferred orders. Alternatively, test your server configuration locally using test domains or development endpoints.

Configuring Secure Ciphers on Popular Web Servers

To ensure your infrastructure passes security audits, you must explicitly configure your web server to disable weak ciphers and enforce strong protocol orders.

Nginx Configuration

Edit your server block configuration file (typically located in /etc/nginx/sites-available/) to set secure protocols and cipher suites:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Enforce modern protocols only
    ssl_protocols TLSv1.2 TLSv1.3;

    # Set robust cipher suites with forward secrecy
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers on;
}

Apache HTTP Server Configuration

Edit your SSL configuration file (often found in /etc/httpd/conf.d/ssl.conf or equivalent paths depending on your operating system distribution):

<VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/example.com.crt
    SSLCertificateKeyFile /etc/pki/tls/private/example.com.key

    # Disable obsolete protocols
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

    # Enforce secure cipher suites
    SSLCipherSuite HIGH:!aNULL:!MD5:!RC4
    SSLHonorCipherOrder on
</VirtualHost>

Note: Exact file paths and menu names for web server configuration may differ slightly depending on whether you are running Ubuntu, RHEL, Alpine, or a managed control panel.

Comparison of TLS Protocol Versions and Features

Common Mistakes and How to Fix Them

1. Failing to Include Intermediate Certificates:
   • Symptom: Browsers trust the site, but automated scanners report an incomplete certificate chain.
   • Fix: Ensure your web server configuration points to the fullchain.pem bundle rather than just the domain certificate file (cert.pem).
2. Allowing Export-Grade or Null Ciphers:
   • Symptom: Vulnerability scanners flag your server for supporting weak or anonymous ciphers.
   • Fix: Explicitly restrict your cipher string to include only ECDHE and GCM structures, excluding aNULL, eNULL, and RC4.
3. Forgetting to Restart the Web Service:
   • Symptom: Configuration changes do not reflect when testing the live domain.
   • Fix: Always test your syntax (nginx -t or apachectl configtest) and restart or reload the service (systemctl reload nginx or systemctl reload httpd).

SSL Security Audit Checklist

Use this quick reference checklist to verify your SSL implementation:

• Disabled SSLv2, SSLv3, TLS 1.0, and TLS 1.1.
• Enabled TLS 1.2 and TLS 1.3.
• Configured modern cipher suites utilizing forward secrecy (ECDHE).
• Installed the complete certificate chain including all intermediate CAs.
• Enabled HTTP Strict Transport Security (HSTS) headers.
• Verified expiration dates and automated renewal cron jobs.