IBM HTTPServer - SSL Ciphers Check

How to check which ciphers are applied when using SSL

---

Test Environment

• Test OS : CentOS 7.2
• Test Version : IBM HTTPServer v8.5.0.0

---

Methods for checking ciphers for SSL set in web server

Check Options :

    [root@testServer11 bin]# ./apachectl -h
    Usage: /SW/web/HTTPServer/bin/httpd [-D name] [-d directory] [-f file]
                                        [-C "directive"] [-c "directive"]
                                        [-k start|restart|graceful|graceful-stop|stop]
                                        [-v] [-V] [-h] [-l] [-L] [-t] [-S]
 
    Options:
      -D name            : define a name for use in <IfDefine name> directives
      -d directory       : specify an alternate initial ServerRoot
      -f file            : specify an alternate ServerConfigFile
      -C "directive"     : process directive before reading config files
      -c "directive"     : process directive after reading config files
      -e level           : show startup errors of level (see LogLevel)
      -E file            : log startup errors to file
      -v                 : show version number
      -V                 : show compile settings
      -h                 : list available command line options (this page)
      -l                 : list compiled in modules
      -L                 : list available configuration directives
      -t -D DUMP_VHOSTS  : show parsed settings (currently only vhost settings)
      -S                 : a synonym for -t -D DUMP_VHOSTS
      -t -D DUMP_MODULES : show all loaded modules
      -M                 : a synonym for -t -D DUMP_MODULES
      -t -D DUMP_SSL_CONFIG: show parsed SSL vhost configurations
      -t -D DUMP_SSL_CIPHERS: show all known SSL ciphers
      -t                 : run syntax check for config files

Ciphers :

    [root@testServer11 bin]# ./apachectl -t -D DUMP_SSL_CIPHERS SSL    Ciphers:
    .
    .
    .
    SSL default cipher lists: SSL protocol SSLV2, FIPS    off, defaults =
    SSL protocol SSLV2, FIPS on, defaults =  SSL    protocol SSLV3, FIPS off, defaults =    TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_RC4_128_SHA(35),SSL_RSA_WITH_RC4_128_MD5(34),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
    SSL protocol SSLV3, FIPS on, defaults =  SSL protocol TLSv10, FIPS    off, defaults =    TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_RC4_128_SHA(35),SSL_RSA_WITH_RC4_128_MD5(34),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
    SSL protocol TLSv10, FIPS on, defaults =    TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
    SSL protocol TLSv11, FIPS off, defaults =    TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_RC4_128_SHA(35),SSL_RSA_WITH_RC4_128_MD5(34),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
    SSL protocol TLSv11, FIPS on, defaults =    TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
    SSL protocol TLSv12, FIPS off, defaults =    TLS_RSA_WITH_AES_128_GCM_SHA256(9C),TLS_RSA_WITH_AES_256_GCM_SHA384(9D),TLS_RSA_WITH_AES_128_CBC_SHA256(3C),TLS_RSA_WITH_AES_256_CBC_SHA256(3D),TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
    SSL protocol TLSv12, FIPS on, defaults =    TLS_RSA_WITH_AES_128_GCM_SHA256(9C),TLS_RSA_WITH_AES_256_GCM_SHA384(9D),TLS_RSA_WITH_AES_128_CBC_SHA256(3C),TLS_RSA_WITH_AES_256_CBC_SHA256(3D),TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
    Syntax OK

Related Reference Links :

https://testssl.sh/openssl-iana.mapping.html
https://www.ssllabs.com/?_ga=2.136721654.755247565.1559195773-1774555605.1559022470