Why does the cipher list in sslcert test show disabled ciphers?
Why does the list of ciphers in the "sslcert" xymon test show ciphers that are disabled on the server? For example, we have disabled RC4 ciphers on our servers, and confirmed using the "Qualys SSL Labs" server test, that they are turned off. However, xymon still shows them.
g
It's not giving you a list of the ciphers the remote host permits. All it does is cycle through the list of ciphers available on the Xymon server. I think there's a flag (for xymonnet, maybe?) that turns off that list. A long time back I patched my copy of xymonnet to only return the cipher actually used to talk to the remore server.
There's a program called sslscan that actually tests the entire list of ciphers against the remote host and tells you what works and what fails. That could be incorporated into an external test, maybe.
Ralph Mitchell On Aug 4, 2015 12:41 PM, "Ribeiro, Glauber" <glauber.ribeiro at experian.com> wrote:
Why does the list of ciphers in the "sslcert" xymon test show ciphers that are disabled on the server? For example, we have disabled RC4 ciphers on our servers, and confirmed using the "Qualys SSL Labs" server test, that they are turned off. However, xymon still shows them.
g
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
Yes, I think i’m going to turn that list off, it’s just clutter.
From: Ralph Mitchell [mailto:ralphmitchell at gmail.com] Sent: Tuesday, August 04, 2015 15:43 To: Ribeiro, Glauber Cc: xymon at xymon.com Subject: Re: [Xymon] Why does the cipher list in sslcert test show disabled ciphers?
It's not giving you a list of the ciphers the remote host permits. All it does is cycle through the list of ciphers available on the Xymon server. I think there's a flag (for xymonnet, maybe?) that turns off that list. A long time back I patched my copy of xymonnet to only return the cipher actually used to talk to the remore server.
There's a program called sslscan that actually tests the entire list of ciphers against the remote host and tells you what works and what fails. That could be incorporated into an external test, maybe.
Ralph Mitchell On Aug 4, 2015 12:41 PM, "Ribeiro, Glauber" <glauber.ribeiro at experian.com<mailto:glauber.ribeiro at experian.com>> wrote: Why does the list of ciphers in the "sslcert" xymon test show ciphers that are disabled on the server? For example, we have disabled RC4 ciphers on our servers, and confirmed using the "Qualys SSL Labs" server test, that they are turned off. However, xymon still shows them.
g
Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon[lists.xymon.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=BQMFaQ&c=BNNF-YNv0CLLslhP2Bcx5Q&r=SjsIRf81D06XmEsmKkV_wxtLjrsUQpuz8iegmn0NIEg&m=rIw_5dYH-FEgtOSRM6E1_zSnZWIjukwDIPbjdKUSD0M&s=bIJ9DajJNn28muXrZgI4Fc_BJDJsQiOeIubBCIwcv50&e=>
Hmm. This would seem like something we should probably look into changing.
A list of ciphers the remote host is permiting would be much more valuable from a monitoring perspective (when enabled).
-jc
On Tue, August 4, 2015 1:42 pm, Ralph Mitchell wrote:
It's not giving you a list of the ciphers the remote host permits. All it does is cycle through the list of ciphers available on the Xymon server. I think there's a flag (for xymonnet, maybe?) that turns off that list. A long time back I patched my copy of xymonnet to only return the cipher actually used to talk to the remore server.
There's a program called sslscan that actually tests the entire list of ciphers against the remote host and tells you what works and what fails. That could be incorporated into an external test, maybe.
Ralph Mitchell On Aug 4, 2015 12:41 PM, "Ribeiro, Glauber" <glauber.ribeiro at experian.com> wrote:
Why does the list of ciphers in the "sslcert" xymon test show ciphers that are disabled on the server? For example, we have disabled RC4 ciphers on our servers, and confirmed using the "Qualys SSL Labs" server test, that they are turned off. However, xymon still shows them.
g
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
The problem there is that you have to try each cipher in your local list. That's setting up and tearing down possibly 40 or more cipher connections per ssl test per server per test cycle. That's the bit where I bailed out and went with just displaying the cipher actually used.
Ralph Mitchell On Aug 4, 2015 6:14 PM, "J.C. Cleaver" <cleaver at terabithia.org> wrote:
Hmm. This would seem like something we should probably look into changing.
A list of ciphers the remote host is permiting would be much more valuable from a monitoring perspective (when enabled).
-jc
On Tue, August 4, 2015 1:42 pm, Ralph Mitchell wrote:
It's not giving you a list of the ciphers the remote host permits. All it does is cycle through the list of ciphers available on the Xymon server. I think there's a flag (for xymonnet, maybe?) that turns off that list. A long time back I patched my copy of xymonnet to only return the cipher actually used to talk to the remore server.
There's a program called sslscan that actually tests the entire list of ciphers against the remote host and tells you what works and what fails. That could be incorporated into an external test, maybe.
Ralph Mitchell On Aug 4, 2015 12:41 PM, "Ribeiro, Glauber" < glauber.ribeiro at experian.com> wrote:
Why does the list of ciphers in the "sslcert" xymon test show ciphers that are disabled on the server? For example, we have disabled RC4 ciphers on our servers, and confirmed using the "Qualys SSL Labs" server test, that they are turned off. However, xymon still shows them.
g
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
Yes. This tests every cipher: https://www.ssllabs.com/ssltest/ It tests a bunch of other things too, and it takes forever, because it’s cautious not to overload the server with too many requests. I think a test of every cipher is too much to do every 5 minutes. But displaying the cipher actually used, is more useful than displaying the full list.
g
From: Ralph Mitchell [mailto:ralphmitchell at gmail.com] Sent: Tuesday, August 04, 2015 17:20 To: Japheth Cleaver Cc: Ribeiro, Glauber; xymon at xymon.com Subject: Re: [Xymon] Why does the cipher list in sslcert test show disabled ciphers?
The problem there is that you have to try each cipher in your local list. That's setting up and tearing down possibly 40 or more cipher connections per ssl test per server per test cycle. That's the bit where I bailed out and went with just displaying the cipher actually used.
Ralph Mitchell On Aug 4, 2015 6:14 PM, "J.C. Cleaver" <cleaver at terabithia.org<mailto:cleaver at terabithia.org>> wrote:
Hmm. This would seem like something we should probably look into changing.
A list of ciphers the remote host is permiting would be much more valuable from a monitoring perspective (when enabled).
-jc
On Tue, August 4, 2015 1:42 pm, Ralph Mitchell wrote:
It's not giving you a list of the ciphers the remote host permits. All it does is cycle through the list of ciphers available on the Xymon server. I think there's a flag (for xymonnet, maybe?) that turns off that list. A long time back I patched my copy of xymonnet to only return the cipher actually used to talk to the remore server.
There's a program called sslscan that actually tests the entire list of ciphers against the remote host and tells you what works and what fails. That could be incorporated into an external test, maybe.
Ralph Mitchell On Aug 4, 2015 12:41 PM, "Ribeiro, Glauber" <glauber.ribeiro at experian.com<mailto:glauber.ribeiro at experian.com>> wrote:
Why does the list of ciphers in the "sslcert" xymon test show ciphers that are disabled on the server? For example, we have disabled RC4 ciphers on our servers, and confirmed using the "Qualys SSL Labs" server test, that they are turned off. However, xymon still shows them.
g
Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon[lists.xymon.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=BQMFaQ&c=BNNF-YNv0CLLslhP2Bcx5Q&r=SjsIRf81D06XmEsmKkV_wxtLjrsUQpuz8iegmn0NIEg&m=tf0R2E0QvkcqKbk36jgk0IupIwE_yo0sAeHe3uDTADA&s=IDfRmqRnBp3EmqyfrR8HdyEFK3ltbj-_5BNz0ixJwxI&e=>
Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon[lists.xymon.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=BQMFaQ&c=BNNF-YNv0CLLslhP2Bcx5Q&r=SjsIRf81D06XmEsmKkV_wxtLjrsUQpuz8iegmn0NIEg&m=tf0R2E0QvkcqKbk36jgk0IupIwE_yo0sAeHe3uDTADA&s=IDfRmqRnBp3EmqyfrR8HdyEFK3ltbj-_5BNz0ixJwxI&e=>
The attached diff adds an "else" to the --nocipherlist option. If you use that option to turn off the cipher list, you get the cipher that was actually used instead.
It also adds "signature algorithm" to the list of interesting things printed about the certificate. I needed that for a CGI script that screen-scrapes the sslcert column to make up a report for SSL cert compliance.
Ralph Mitchell
On Tue, Aug 4, 2015 at 6:32 PM, Ribeiro, Glauber < glauber.ribeiro at experian.com> wrote:
Yes. This tests every cipher: https://www.ssllabs.com/ssltest/
It tests a bunch of other things too, and it takes forever, because it’s cautious not to overload the server with too many requests.
I think a test of every cipher is too much to do every 5 minutes. But displaying the cipher actually used, is more useful than displaying the full list.
g
*From:* Ralph Mitchell [mailto:ralphmitchell at gmail.com] *Sent:* Tuesday, August 04, 2015 17:20 *To:* Japheth Cleaver *Cc:* Ribeiro, Glauber; xymon at xymon.com *Subject:* Re: [Xymon] Why does the cipher list in sslcert test show disabled ciphers?
The problem there is that you have to try each cipher in your local list. That's setting up and tearing down possibly 40 or more cipher connections per ssl test per server per test cycle. That's the bit where I bailed out and went with just displaying the cipher actually used.
Ralph Mitchell
On Aug 4, 2015 6:14 PM, "J.C. Cleaver" <cleaver at terabithia.org> wrote:
Hmm. This would seem like something we should probably look into changing.
A list of ciphers the remote host is permiting would be much more valuable from a monitoring perspective (when enabled).
-jc
On Tue, August 4, 2015 1:42 pm, Ralph Mitchell wrote:
It's not giving you a list of the ciphers the remote host permits. All it does is cycle through the list of ciphers available on the Xymon server. I think there's a flag (for xymonnet, maybe?) that turns off that list. A long time back I patched my copy of xymonnet to only return the cipher actually used to talk to the remore server.
There's a program called sslscan that actually tests the entire list of ciphers against the remote host and tells you what works and what fails. That could be incorporated into an external test, maybe.
Ralph Mitchell On Aug 4, 2015 12:41 PM, "Ribeiro, Glauber" < glauber.ribeiro at experian.com> wrote:
Why does the list of ciphers in the "sslcert" xymon test show ciphers that are disabled on the server? For example, we have disabled RC4 ciphers on our servers, and confirmed using the "Qualys SSL Labs" server test, that they are turned off. However, xymon still shows them.
g
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon[lists.xymon.com] <https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=BQMFaQ&c=BNNF-YNv0CLLslhP2Bcx5Q&r=SjsIRf81D06XmEsmKkV_wxtLjrsUQpuz8iegmn0NIEg&m=tf0R2E0QvkcqKbk36jgk0IupIwE_yo0sAeHe3uDTADA&s=IDfRmqRnBp3EmqyfrR8HdyEFK3ltbj-_5BNz0ixJwxI&e=>
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon[lists.xymon.com] <https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=BQMFaQ&c=BNNF-YNv0CLLslhP2Bcx5Q&r=SjsIRf81D06XmEsmKkV_wxtLjrsUQpuz8iegmn0NIEg&m=tf0R2E0QvkcqKbk36jgk0IupIwE_yo0sAeHe3uDTADA&s=IDfRmqRnBp3EmqyfrR8HdyEFK3ltbj-_5BNz0ixJwxI&e=>
participants (3)
-
cleaver＠terabithia.org
-
glauber.ribeiro＠experian.com
-
ralphmitchell＠gmail.com