How to Check SSL Ciphers

[vsolodkyi]

How to Check SSL Ciphers

If you have enabled SSL on Sisense side, the Nginx controller will be deployed in the default namespace.

To check the currently configured ciphers run the following command and check the "nginx.ingress.kubernetes.io/ssl-ciphers:" row: 

kubectl -n sisense describe ingress

Name:             sisense-ingress

Labels:           app=api-gateway

                  app.kubernetes.io/managed-by=Helm

                  chart=api-gateway-2024.2.077

                  release=sisense

                  sisense-version=2024.2.077

Namespace:        sisense

Address:

Ingress Class:    <none>

Default backend:  <default>

TLS:

  sisense-tls terminates

Rules:

  Host                         Path  Backends

  ----                         ----  --------

  paragoninsgroup.sisense.com

                               /   api-gateway-external:8456 (10.42.140.227:8456)

Annotations:                   kubernetes.io/ingress.class: nginx

                               kubernetes.io/tls-acme: true

                               meta.helm.sh/release-name: sisense

                               meta.helm.sh/release-namespace: sisense

                               nginx.ingress.kubernetes.io/configuration-snippet: more_clear_headers Server;

                               nginx.ingress.kubernetes.io/proxy-body-size: 0m

                               nginx.ingress.kubernetes.io/proxy-read-timeout: 300

                               nginx.ingress.kubernetes.io/ssl-ciphers:

                                 ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS:!AESCCM

                               nginx.ingress.kubernetes.io/ssl-prefer-server-ciphers: true

To decrypt the full list of the currently used ciphers use the string from the mentioned row with the following command:

openssl ciphers -v 'ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS:!AESCCM' | column -t

Output Example:

ECDHE-RSA-AES256-GCM-SHA384  TLSv1.2 Kx=ECDH    Au=RSA  Enc=AESGCM(256) Mac=AEAD

ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH    Au=ECDSA Enc=AESGCM(256) Mac=AEAD

ECDH-RSA-AES256-GCM-SHA384   TLSv1.2 Kx=ECDH/RSA  Au=ECDH  Enc=AESGCM(256) Mac=AEAD

ECDH-ECDSA-AES256-GCM-SHA384  TLSv1.2 Kx=ECDH/ECDSA Au=ECDH  Enc=AESGCM(256) Mac=AEAD

ECDHE-RSA-AES128-GCM-SHA256  TLSv1.2 Kx=ECDH    Au=RSA  Enc=AESGCM(128) Mac=AEAD

ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH    Au=ECDSA Enc=AESGCM(128) Mac=AEAD

ECDH-RSA-AES128-GCM-SHA256   TLSv1.2 Kx=ECDH/RSA  Au=ECDH  Enc=AESGCM(128) Mac=AEAD

ECDH-ECDSA-AES128-GCM-SHA256  TLSv1.2 Kx=ECDH/ECDSA Au=ECDH  Enc=AESGCM(128) Mac=AEAD

DH-DSS-AES256-GCM-SHA384    TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(256) Mac=AEAD

DH-RSA-AES256-GCM-SHA384    TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AESGCM(256) Mac=AEAD

DHE-RSA-AES256-GCM-SHA384   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(256) Mac=AEAD

DH-DSS-AES128-GCM-SHA256    TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(128) Mac=AEAD

DH-RSA-AES128-GCM-SHA256    TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AESGCM(128) Mac=AEAD

DHE-RSA-AES128-GCM-SHA256   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(128) Mac=AEAD

ECDHE-RSA-AES256-SHA384    TLSv1.2 Kx=ECDH    Au=RSA  Enc=AES(256)   Mac=SHA384

ECDHE-ECDSA-AES256-SHA384   TLSv1.2 Kx=ECDH    Au=ECDSA Enc=AES(256)   Mac=SHA384

ECDHE-RSA-AES256-SHA      SSLv3  Kx=ECDH    Au=RSA  Enc=AES(256)   Mac=SHA1

ECDHE-ECDSA-AES256-SHA     SSLv3  Kx=ECDH    Au=ECDSA Enc=AES(256)   Mac=SHA1

ECDH-RSA-AES256-SHA384     TLSv1.2 Kx=ECDH/RSA  Au=ECDH  Enc=AES(256)   Mac=SHA384

ECDH-ECDSA-AES256-SHA384    TLSv1.2 Kx=ECDH/ECDSA Au=ECDH  Enc=AES(256)   Mac=SHA384

ECDH-RSA-AES256-SHA      SSLv3  Kx=ECDH/RSA  Au=ECDH  Enc=AES(256)   Mac=SHA1

ECDH-ECDSA-AES256-SHA     SSLv3  Kx=ECDH/ECDSA Au=ECDH  Enc=AES(256)   Mac=SHA1

DHE-RSA-AES256-SHA256     TLSv1.2 Kx=DH     Au=RSA  Enc=AES(256)   Mac=SHA256

DH-RSA-AES256-SHA256      TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AES(256)   Mac=SHA256

DH-DSS-AES256-SHA256      TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AES(256)   Mac=SHA256

DHE-RSA-AES256-SHA       SSLv3  Kx=DH     Au=RSA  Enc=AES(256)   Mac=SHA1

DH-RSA-AES256-SHA       SSLv3  Kx=DH/RSA   Au=DH   Enc=AES(256)   Mac=SHA1

DH-DSS-AES256-SHA       SSLv3  Kx=DH/DSS   Au=DH   Enc=AES(256)   Mac=SHA1

ECDHE-RSA-AES128-SHA256    TLSv1.2 Kx=ECDH    Au=RSA  Enc=AES(128)   Mac=SHA256

ECDHE-ECDSA-AES128-SHA256   TLSv1.2 Kx=ECDH    Au=ECDSA Enc=AES(128)   Mac=SHA256

ECDHE-RSA-AES128-SHA      SSLv3  Kx=ECDH    Au=RSA  Enc=AES(128)   Mac=SHA1

ECDHE-ECDSA-AES128-SHA     SSLv3  Kx=ECDH    Au=ECDSA Enc=AES(128)   Mac=SHA1

ECDH-RSA-AES128-SHA256     TLSv1.2 Kx=ECDH/RSA  Au=ECDH  Enc=AES(128)   Mac=SHA256

ECDH-ECDSA-AES128-SHA256    TLSv1.2 Kx=ECDH/ECDSA Au=ECDH  Enc=AES(128)   Mac=SHA256

ECDH-RSA-AES128-SHA      SSLv3  Kx=ECDH/RSA  Au=ECDH  Enc=AES(128)   Mac=SHA1

ECDH-ECDSA-AES128-SHA     SSLv3  Kx=ECDH/ECDSA Au=ECDH  Enc=AES(128)   Mac=SHA1

DHE-RSA-AES128-SHA256     TLSv1.2 Kx=DH     Au=RSA  Enc=AES(128)   Mac=SHA256

DH-RSA-AES128-SHA256      TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AES(128)   Mac=SHA256

DH-DSS-AES128-SHA256      TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AES(128)   Mac=SHA256

DHE-RSA-AES128-SHA       SSLv3  Kx=DH     Au=RSA  Enc=AES(128)   Mac=SHA1

DH-RSA-AES128-SHA       SSLv3  Kx=DH/RSA   Au=DH   Enc=AES(128)   Mac=SHA1

DH-DSS-AES128-SHA       SSLv3  Kx=DH/DSS   Au=DH   Enc=AES(128)   Mac=SHA1

AES256-GCM-SHA384       TLSv1.2 Kx=RSA     Au=RSA  Enc=AESGCM(256) Mac=AEAD

AES128-GCM-SHA256       TLSv1.2 Kx=RSA     Au=RSA  Enc=AESGCM(128) Mac=AEAD

AES256-SHA256         TLSv1.2 Kx=RSA     Au=RSA  Enc=AES(256)   Mac=SHA256

AES256-SHA           SSLv3  Kx=RSA     Au=RSA  Enc=AES(256)   Mac=SHA1

AES128-SHA256         TLSv1.2 Kx=RSA     Au=RSA  Enc=AES(128)   Mac=SHA256

AES128-SHA           SSLv3  Kx=RSA     Au=RSA  Enc=AES(128)   Mac=SHA1

Check out this related content:

Academy course

Sisense Documentation