#!/bin/bash # Generate nginx config and HTML for testing ciphers # Author: Peter Wu #domain=ciphertest.lekensteyn.nl # ssl-enabled ip:port, may occur multiple times space-separated # PORT will be replaced for a number that increments for every test #listen=$domain:PORT domain=${1:-local.al.lekensteyn.nl} address=localhost listen="$address:4433 $address:PORT " portbase=4433 pkdir=certs/ rsa_prv=server.pem rsa_pub=server.crt dsa_prv=dsa.pem dsa_pub=dsa.crt #ecc_prv=ec.pem #ecc_pub=ec.crt ecc_prv=secp384r1.pem ecc_pub=secp384r1.crt dh_params=dhparams.pem root=/srv/http/ciphertest html="$root/index.html" get_ciphers() { # output: index (n1 << 8 | n2) name version auth line openssl ciphers -V | sort -n | awk -F'[ ,]+' '{ print ++i, $2, $3, $5, $6, substr($8, 4), $0 }' } htmlescape() { sed 's/&/&/g;s//\>/g' } #if [ ! -s "$html" ]; then if true; then # always generate file cat > "$html" < Cipher suite test
$(openssl version -a | htmlescape)

Hide cipher suites:
EOF fi # Begin nginx config generator get_common() { local auth=$1 local port=${2:-$portbase} local crtfile keyfile dhpfile case $auth in RSA) crtfile=$rsa_pub keyfile=$rsa_prv ;; ECDH) # Note: NSS does not support all cipher suites from OpenSSL, but OpenSSL # cannot work with ECDH-RSA using th below certificates. crtfile=$ecc_pub keyfile=$ecc_prv #dhpfile=$dh_params ;; DSS) crtfile=$dsa_pub keyfile=$dsa_prv ;; ECDSA) crtfile=$ecc_pub keyfile=$ecc_prv #dhpfile=$dh_params ;; PSK) #echo "Unknown Au=$auth - using RSA" >&2 crtfile=$rsa_pub keyfile=$rsa_prv ;; *) echo "Unknown Au=$auth - using RSA" >&2 crtfile=$rsa_pub keyfile=$rsa_prv ;; esac local listens l listens=$(echo ${listen//PORT/$port} | tr ' ' '\n' | sort -u | tr '\n' ' ') for l in $listens; do echo " listen $l ssl;" done cat <document.domain='$domain'"; } } EOF done cat <