-
-
Notifications
You must be signed in to change notification settings - Fork 11.1k
Description
Contrary to what the name suggests SSL_get_shared_ciphers returns the same ciphers as SSL_get_client_ciphers, i.e. the contents of ssl->session->ciphers. The ciphers member of ssl_session_st is documented as follows:
STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */
The question mark behind "shared ciphers" is there since at least 0.9.8 - and rightly so. Because this member contains at least in the current versions not the shared ciphers but all ciphers offered by the client.
Given that SSL_get_shared_ciphers is used for example in apps/s_server.c the output from this app is misleading since it claims that the client provided ciphers are actually the shared ciphers. For example when using s_server with a restricted cipher set and connecting with a client offering a larger cipher set the output looks like this:
$ openssl s_server -cipher 'AES128-SHA' -cert ...
....
Shared ciphers:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:...AES128-SHA:...
...
CIPHER is AES128-SHA