Find out which ciphers suite are used for ssl/tls connection? #462

New Issue

2026-10-05T04:22:57+02:00

adam commented

2026-10-05 04:22:57 +02:00

Not sure if this is possible yet (maybe in the logs).
It would be nice to see somewhere what cipher suite is used for a connection.
Both ends would be interresting for me. (client-->znc, znc-->Server)

e.g. output I'm looking for:

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (Maybe even with TLS Version info)

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Not sure if this is possible yet (maybe in the logs). It would be nice to see somewhere what cipher suite is used for a connection. Both ends would be interresting for me. (client-->znc, znc-->Server) e.g. output I'm looking for: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (Maybe even with TLS Version info) ## <bountysource-plugin> Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/8161149-find-out-which-ciphers-suite-are-used-for-ssl-tls-connection?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:22:58 +02:00

I believe client should show you client --> ZNC or at least HexChat does that.

* * Certification info:
*   Subject:
*     OU=mkaysi
*     CN=lakka.kapsi.fi
*     emailAddress=mkaysi@lakka.kapsi.fi
*   Issuer:
*     OU=mkaysi
*     CN=lakka.kapsi.fi
*     emailAddress=mkaysi@lakka.kapsi.fi
*   Public key algorithm: rsaEncryption (2048 bits)
*   Sign algorithm sha256WithRSAEncryption
*   Valid since Dec 23 09:30:13 2014 GM to Dec 20 09:30:13 2024 GM
* * Cipher info:
*   Version: TLSv1/SSLv3, cipher ECDHE-RSA-AES128-GCM-SHA256 (128 bits)
* * Verify E: self signed certificate.? (18) -- Ignored
* Connected. Now logging in.

I believe client should show you client --> ZNC or at least HexChat does that. ``` * * Certification info: * Subject: * OU=mkaysi * CN=lakka.kapsi.fi * emailAddress=mkaysi@lakka.kapsi.fi * Issuer: * OU=mkaysi * CN=lakka.kapsi.fi * emailAddress=mkaysi@lakka.kapsi.fi * Public key algorithm: rsaEncryption (2048 bits) * Sign algorithm sha256WithRSAEncryption * Valid since Dec 23 09:30:13 2014 GM to Dec 20 09:30:13 2024 GM * * Cipher info: * Version: TLSv1/SSLv3, cipher ECDHE-RSA-AES128-GCM-SHA256 (128 bits) * * Verify E: self signed certificate.? (18) -- Ignored * Connected. Now logging in. ```

adam commented

2026-10-05 04:22:59 +02:00

May I ask where you would want to see this information though? And for which connection side? ZNC -> IRC, or client -> ZNC, or all of those?

Alternatively, if you want to see all supported ciphers that the ZNC SSL listener is configured for, you can run a cipher scan or a TestSSL.sh test against the server to see what's available. I use Linux, and testssl.sh or cipherscan to run checks from remote servers to my sites (or from my system to my servers). Both support port selection (so you can specify https://site.tld:9876 and such. The only problem is they have their own OpenSSL built binaries that are usually superior to the versions existing in the OpenSSL binaries of linux distributions, and support more ciphers, but its your call whether you use those binaries or not. (testssl.sh is superior and checks far more than just ciphers, unless you only want to see the ciphers and protocols, in which case just use cipherscan)

May I ask _where_ you would want to see this information though? And for which connection side? ZNC -> IRC, or client -> ZNC, or all of those? Alternatively, if you want to see all supported ciphers that the ZNC SSL listener is configured for, you can run a cipher scan or a TestSSL.sh test against the server to see what's available. I use Linux, and [testssl.sh](https://testssl.sh/) or [cipherscan](https://github.com/jvehent/cipherscan) to run checks from remote servers to my sites (or from my system to my servers). Both support port selection (so you can specify `https://site.tld:9876` and such. The only problem is they have their own OpenSSL built binaries that are usually superior to the versions existing in the OpenSSL binaries of linux distributions, and support more ciphers, but its your call whether you use those binaries or not. (testssl.sh is superior and checks far more than just ciphers, unless you only want to see the ciphers and protocols, in which case just use cipherscan)

adam commented

2026-10-05 04:22:59 +02:00

Well Both sides would be nice to see.
I know I can use a scanner to see what the Server supports. But then I still don't know what znc and the irc did agree on in the end. (Because of e.g. messed up SSLCiphers settings it connects different then I thought or wanted) Same for the Client site if client does not support to show connection details

Well Both sides would be nice to see. I know I can use a scanner to see what the Server supports. But then I still don't know what znc and the irc did agree on in the end. (Because of e.g. messed up SSLCiphers settings it connects different then I thought or wanted) Same for the Client site if client does not support to show connection details

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#462