Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • 4
    Certificates use public key algorithms (RSA, DSA) and Servers use them to exchange keys for use with symmetric algorithms (AES, DES, 3DES). So you won't see a symmetric key algorithm associated with a certificate. Commented Dec 10, 2019 at 1:03
  • @gowenfawr Thank you very much. Here's what I'm trying to determine: we run a vulnerability scan against our servers. It flagged a few certs we use are using 3DES symmetric encryption method, which is a weak encryption algorithm. It is unclear how this was determined, so I am hoping to be able to see if there is a way to determine this my own without having to run a scan every time to find out. Do you know if there is a way within Windows to do this, or can I use OpenSSL to determine this somehow? Commented Dec 10, 2019 at 16:02
  • If you scan your server and it reports weak ciphers, that has to do with the server cipher suite configuration, not the certificate. Under Windows there are various ways to manage your TLS cipher suites (see docs.microsoft.com/en-us/windows-server/security/tls/manage-tls) Commented Dec 10, 2019 at 16:09
  • You can use OpenSSL to test whether an individual cipher is enabled or not as described in this answer. If the server is on the Internet, SSL Labs can show you. And tools like sslscan will automate some for you as well. Commented Dec 10, 2019 at 16:10