Support

View SSL Details via Command Line

This article will discuss viewing the details of an installed SSL via command line. Provided will be various commands for testing the strength of the SSL and commands for testing if the SSL passes compliance.

SSLv2 Disabled:

Run the following via command line:

openssl s_client -connect www.domain.com:443 -ssl2

Should return:

CONNECTED(00000003)

14918:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:

Alternatively, you can run the following via command line:

curl -Iv2 https://www.domain.com

This should return the following:

* About to connect() to www.domain.com port 443

* Trying 1.2.3.4... connected


* Connected to www.domain.com (1.2.3.4) port 443
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSLv2, Client hello (1):
Unknown SSL protocol error in connection to www.domain.com:443
* Closing connection #0
curl: (35) Unknown SSL protocol error in connection to www.domain.com:443

If the last line errors, it means that SSLv2 is disabled.

Ciphers Test:

Run the following command:

openssl s_client -connect www.domain.com:443 –cipher NULL

This should return a result similar to the following if NULL ciphers are not accepted:

CONNECTED(00000003) 3716:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:562:

You can also change the command to use LOW, MEDIUM, HIGH, or FIPS in place of NULL in the example above. This will test for those ciphers respectively and report the result in the same manner.