How to botch TLS forward secrecy

Re:How to botch TLS forward secrecy by dfc on Friday June 28, 2013 @02:06AM (#5956527)

The recent discussions of SSL/TLS on the server made me wonder about client configuration. I looked around for a SSL Labs like tool for browser and asked on security.SX[1] but I was unable to find anything comparable which was troubling.

Am I missing something to think that an SSL Labs like tool for the client is also important? Does anyone have any recommendations?

[1] http://security.stackexchange.com/q/38084/4564

[ Parent | on HN ]

Re:How to botch TLS forward secrecy by e12e on Friday June 28, 2013 @11:15AM (#5958424)

If you want to just test yourself, you get quite a lot of info from openssl's s_servers's status-page, enabled with -www:

    openssl req -x509 -nodes -days 30 -newkey rsa:2048 -keyout localhost.key -out localhost.crt
    openssl s_server -www -debug -accept 4433 -key localhost.key -cert localhost.crt

Then open https://localhost:4433 in your browser and temporarily ignore the cert-warning.

You'll get a list of ciphers supported by the server, and a list of ciphers common between the server and the client (which, with all ciphers enabled (default) on the server -- should be rather exhaustive).

[ Parent | on HN ]