---
title: "Check Cipher Suites"
canonical: "https://wiki.patientsknowbest.com/space/api/4493115460/Check%20Cipher%20Suites"
format: markdown
---
> Macro (toc)

# Instruction

> 📝 Following instruction on this page you can test if your client has support for a necessary cipher suite required by our servers.

On the host that runs your service run the next command:

```
curl -o /dev/null -s -vvv https://my.patientsknowbest.com
```

Above command will try to fetch content from `my.patientsknowbest.com`.

# Context

A cipher suite is a fixed set of algorithms used together to establish a secure network connection to transmit data between to hosts. Cipher suite names are derived from the algorithms used.

These algorithms are:

- **Key Exchange Algorithms** (e.g.: RSA, DH, ECDH, …)
- **Authentication/Digital Signature Algorithm** (e.g.: RSA, ECDSA, …)
- **Bulk Encryption Algorithms** (e.g.: AES, CHACHA20, …)
- **Message Authentication Code Algorithms** (e.g.: SHA-256, POLY1305)

A cipher suite might be supported by by differetn TLS versions.

> ✅ Both server and client has a set of supported cipher suites which must overlap.

# Expected Success Output

```
*   Trying 35.246.122.93:443...
...
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
...
* Connection #0 to host my.patientsknowbest.com left intact
```

> ✅ `SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384` indicates that the host OS supports `TLS_AES_256_GCM_SHA384TLSv1.3` which is one cipher suite that our servers also support.

> ℹ️ **TIP**: Version of your integration engine running on the given host might not support any of the cipher suites that our servers support.

> ℹ️ **NEXT**: Consult documentation of your integration enginge to see what cupher suites it supports.

> ℹ️ **TIP**: client software might be outdated or missing security updates (can be OS and/or integration engine version).

> ℹ️ **NEXT**: Explore ways to update your client software and/or its runtime environment.

# Expected Failure Output

```
*   Trying 35.246.122.93:443...
* Connected to my.patientsknowbest.com (35.246.122.93) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ECDHE-RSA-AES256-SHA384
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [181 bytes data]
* TLSv1.2 (IN), TLS header, Unknown (21):
{ [5 bytes data]
* TLSv1.2 (IN), TLS alert, handshake failure (552):
{ [2 bytes data]
* error:0A000410:SSL routines::sslv3 alert handshake failure
* Closing connection 0
```

> ❌ `* error:0A000410:SSL routines::sslv3 alert handshake failure` indicates lack of ovelap in cipher suites supported by client and server.

> ℹ️ **TIP**: Version of your OS running on the given host might not support any of the cipher suites that our servers support.

> ℹ️ **NEXT**: Consult documentation of your OS, runtime environment and integration enginge to see what cupher suites they support.

> ℹ️ **TIP**: client software might be outdated or missing security updates (can be OS and/or integration engine version).

> ℹ️ **NEXT**: Explore ways to update your client software and/or its runtime environment.

## Trouble Shooting

Trouble shooting consists of two steps:

1. You need to learn [what cipher suites your software supports](https://pkbdev.atlassian.net/wiki/spaces/api/pages/4493115460/Check+cipher+suites#What-ciphers-my-OS-supports%3F) (see steps below).
2. Compare that with cipher suites our servers support
  1. Consult our [PKB API Network Connectivity](https://wiki.hub.patientsknowbest.com/wiki/pages/createpage.action?spaceKey=api&title=PKB%20API%20Network%20Connectivity%20-%20new&linkCreation=true&fromPageId=4493115460) page or
  2. Run a live scan on [SSLLabs](https://www.ssllabs.com/ssltest/analyze.html?d=my.patientsknowbest.com&latest).

> ✅ If the two sets intersect, we should be good.

> ❌ If the two sets does not intersect, then we need to figure out next steps together.

Outcomes can be:

1. You need to modernize client so it has support for secure and performant ciphers or
2. We need to modernize our server so it supports secure and performant ciphers.

> 📝 Please consult the table on [IANA’s website](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml) to see what ciphers are recommended at the moment.
> 📝 
> 📝 ![Screenshot 2024-11-15 at 13.26.04.png](media://cd14a903-7226-49f9-8264-1dbd3ce6e957)
> 📝 
> 📝 We only want to support secure ciphers.

## What Ciphers My OS Supports?

#### Linux

```
openssl ciphers -v
```

Here is an example of a TLS v1.2 cipher suite from Openssl command 'openssl ciphers -v' output:

```
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
```

> ℹ️ **Kx**: (Key Exchange) ECDHE
> ℹ️ 
> ℹ️ **Au**: (Authentication) RSA
> ℹ️ 
> ℹ️ **Enc**: (Bulk Encryption) AES256-GCM
> ℹ️ 
> ℹ️ **Mac**: (Message Authentication) SHA384

#### Windows

View and Modify the Windows Registry Settings for the TLS Cipher Suites:

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers
```

Unset or `0xffffffff` DWORD value means the given cipher suite is enabled, `0x0` means it’s disabled.