5.3. 识别环境中的 TLS 版本

流程

• 针对 Dashboard 服务可访问的 URL 运行密码扫描：

  $ ./cipherscan https://openstack.lab.local
  ..............................
  Target: openstack.lab.local:443
  
  prio  ciphersuite                  protocols  pfs                 curves
  1     ECDHE-RSA-AES128-GCM-SHA256  TLSv1.2    ECDH,P-256,256bits  prime256v1
  2     ECDHE-RSA-AES256-GCM-SHA384  TLSv1.2    ECDH,P-256,256bits  prime256v1
  3     DHE-RSA-AES128-GCM-SHA256    TLSv1.2    DH,1024bits         None
  4     DHE-RSA-AES256-GCM-SHA384    TLSv1.2    DH,1024bits         None
  5     ECDHE-RSA-AES128-SHA256      TLSv1.2    ECDH,P-256,256bits  prime256v1
  6     ECDHE-RSA-AES256-SHA384      TLSv1.2    ECDH,P-256,256bits  prime256v1
  7     ECDHE-RSA-AES128-SHA         TLSv1.2    ECDH,P-256,256bits  prime256v1
  8     ECDHE-RSA-AES256-SHA         TLSv1.2    ECDH,P-256,256bits  prime256v1
  9     DHE-RSA-AES128-SHA256        TLSv1.2    DH,1024bits         None
  10    DHE-RSA-AES128-SHA           TLSv1.2    DH,1024bits         None
  11    DHE-RSA-AES256-SHA256        TLSv1.2    DH,1024bits         None
  12    DHE-RSA-AES256-SHA           TLSv1.2    DH,1024bits         None
  13    ECDHE-RSA-DES-CBC3-SHA       TLSv1.2    ECDH,P-256,256bits  prime256v1
  14    EDH-RSA-DES-CBC3-SHA         TLSv1.2    DH,1024bits         None
  15    AES128-GCM-SHA256            TLSv1.2    None                None
  16    AES256-GCM-SHA384            TLSv1.2    None                None
  17    AES128-SHA256                TLSv1.2    None                None
  18    AES256-SHA256                TLSv1.2    None                None
  19    AES128-SHA                   TLSv1.2    None                None
  20    AES256-SHA                   TLSv1.2    None                None
  21    DES-CBC3-SHA                 TLSv1.2    None                None
  
  Certificate: trusted, 2048 bits, sha256WithRSAEncryption signature
  TLS ticket lifetime hint: None
  NPN protocols: None
  OCSP stapling: not supported
  Cipher ordering: server
  Curves ordering: server - fallback: no
  Server supports secure renegotiation
  Server supported compression methods: NONE
  TLS Tolerance: yes
  
  Intolerance to:
   SSL 3.254           : absent
   TLS 1.0             : PRESENT
   TLS 1.1             : PRESENT
   TLS 1.2             : absent
   TLS 1.3             : absent
   TLS 1.4             : absent