Question

How can I obtain a list of ciphers supported by a remote server via a Java JSSE environment.

I want to get a list of weak ciphers supported by the remote server, so that they can be fixed.

I am using SSLSocket, which has a method called getSupportedCipherSuites, but this method returns ciphers that are supported by the client, not a remote server.

Answer 1

You can’t get a list of the supported cipher suites, but you can get the server’s enabled weak cipher suites, as follows:

1. Enable all the weak cipher suites at your client, and none of the strong ones.
2. Have your client connect and call startHandshake().
3. If that succeeds, the server has chosen a weak cipher suite, which you can get from the SSLSession. Remove that from the enabled cipher suites and repeat.

All the handshakes at (2) which succeed indicate that the corresponding weak cipher suite is enabled at the server. If there are zero, good. Otherwise print out the succeeding cipher suites and act accordingly.