My understanding is that during ssl negotiation, the client (i.e. curl) sends a list of ciphers to the server, and the server replies with its preferred choice.
How do I see the list of ciphers that curl is sending?
How to see list of curl ciphers
curlhttpsssl
Related Solutions
There is no documentation covering all of the conversions between the name of the cipher, and the name that curl is expecting as an argument.
Luckily, curl is open source, and the mapping is available in the source code.
For the benefit of future searchers, I reproduce it more neatly here:
SSL2 cipher suites
<argument> <name>
rc4 SSL_EN_RC4_128_WITH_MD5
rc4-md5 SSL_EN_RC4_128_WITH_MD5
rc4export SSL_EN_RC4_128_EXPORT40_WITH_MD5
rc2 SSL_EN_RC2_128_CBC_WITH_MD5
rc2export SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5
des SSL_EN_DES_64_CBC_WITH_MD5
desede3 SSL_EN_DES_192_EDE3_CBC_WITH_MD5
SSL3/TLS cipher suites
<argument> <name>
rsa_rc4_128_md5 SSL_RSA_WITH_RC4_128_MD5
rsa_rc4_128_sha SSL_RSA_WITH_RC4_128_SHA
rsa_3des_sha SSL_RSA_WITH_3DES_EDE_CBC_SHA
rsa_des_sha SSL_RSA_WITH_DES_CBC_SHA
rsa_rc4_40_md5 SSL_RSA_EXPORT_WITH_RC4_40_MD5
rsa_rc2_40_md5 SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
rsa_null_md5 SSL_RSA_WITH_NULL_MD5
rsa_null_sha SSL_RSA_WITH_NULL_SHA
fips_3des_sha SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
fips_des_sha SSL_RSA_FIPS_WITH_DES_CBC_SHA
fortezza SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA
fortezza_rc4_128_sha SSL_FORTEZZA_DMS_WITH_RC4_128_SHA
fortezza_null SSL_FORTEZZA_DMS_WITH_NULL_SHA
TLS 1.0: Exportable 56-bit Cipher Suites.
<argument> <name>
rsa_des_56_sha TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
rsa_rc4_56_sha TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
AES ciphers.
<argument> <name>
dhe_dss_aes_128_cbc_sha TLS_DHE_DSS_WITH_AES_128_CBC_SHA
dhe_dss_aes_256_cbc_sha TLS_DHE_DSS_WITH_AES_256_CBC_SHA
dhe_rsa_aes_128_cbc_sha TLS_DHE_RSA_WITH_AES_128_CBC_SHA
dhe_rsa_aes_256_cbc_sha TLS_DHE_RSA_WITH_AES_256_CBC_SHA
rsa_aes_128_sha TLS_RSA_WITH_AES_128_CBC_SHA
rsa_aes_256_sha TLS_RSA_WITH_AES_256_CBC_SHA
ECC ciphers.
<argument> <name>
ecdh_ecdsa_null_sha TLS_ECDH_ECDSA_WITH_NULL_SHA
ecdh_ecdsa_rc4_128_sha TLS_ECDH_ECDSA_WITH_RC4_128_SHA
ecdh_ecdsa_3des_sha TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
ecdh_ecdsa_aes_128_sha TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
ecdh_ecdsa_aes_256_sha TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
ecdhe_ecdsa_null_sha TLS_ECDHE_ECDSA_WITH_NULL_SHA
ecdhe_ecdsa_rc4_128_sha TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
ecdhe_ecdsa_3des_sha TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
ecdhe_ecdsa_aes_128_sha TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
ecdhe_ecdsa_aes_256_sha TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
ecdh_rsa_null_sha TLS_ECDH_RSA_WITH_NULL_SHA
ecdh_rsa_128_sha TLS_ECDH_RSA_WITH_RC4_128_SHA
ecdh_rsa_3des_sha TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
ecdh_rsa_aes_128_sha TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
ecdh_rsa_aes_256_sha TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
echde_rsa_null TLS_ECDHE_RSA_WITH_NULL_SHA
ecdhe_rsa_rc4_128_sha TLS_ECDHE_RSA_WITH_RC4_128_SHA
ecdhe_rsa_3des_sha TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
ecdhe_rsa_aes_128_sha TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
ecdhe_rsa_aes_256_sha TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
ecdh_anon_null_sha TLS_ECDH_anon_WITH_NULL_SHA
ecdh_anon_rc4_128sha TLS_ECDH_anon_WITH_RC4_128_SHA
ecdh_anon_3des_sha TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
ecdh_anon_aes_128_sha TLS_ECDH_anon_WITH_AES_128_CBC_SHA
ecdh_anon_aes_256_sha TLS_ECDH_anon_WITH_AES_256_CBC_SHA
new HMAC-SHA256 cipher suites specified in RFC
<argument> <name>
rsa_null_sha_256 TLS_RSA_WITH_NULL_SHA256
rsa_aes_128_cbc_sha_256 TLS_RSA_WITH_AES_128_CBC_SHA256
rsa_aes_256_cbc_sha_256 TLS_RSA_WITH_AES_256_CBC_SHA256
dhe_rsa_aes_128_cbc_sha_256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
dhe_rsa_aes_256_cbc_sha_256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
ecdhe_ecdsa_aes_128_cbc_sha_256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
ecdhe_rsa_aes_128_cbc_sha_256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
AES GCM cipher suites in RFC 5288 and RFC 5289
<argument> <name>
rsa_aes_128_gcm_sha_256 TLS_RSA_WITH_AES_128_GCM_SHA256
dhe_rsa_aes_128_gcm_sha_256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
dhe_dss_aes_128_gcm_sha_256 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
ecdhe_ecdsa_aes_128_gcm_sha_256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
ecdh_ecdsa_aes_128_gcm_sha_256 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
ecdhe_rsa_aes_128_gcm_sha_256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
ecdh_rsa_aes_128_gcm_sha_256 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
So if you want to use the cipher TLS_DHE_RSA_WITH_AES_128_CBC_SHA, the command would be:
curl --ciphers dhe_rsa_aes_128_cbc_sha <url>
In order to specify multiple ciphers, separate the list with commas. So if you want to use the cipher TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 as well, the command would be:
curl --ciphers dhe_rsa_aes_128_cbc_sha,ecdh_rsa_aes_128_gcm_sha_256 <url>
To view a list of the ciphers that curl is using, you will need an external service - like this:
curl --ciphers ecdhe_rsa_aes_256_sha https://www.howsmyssl.com/a/check
Although NB, that service does not accept all ciphers, which means if you are restricting connection to only one cipher which is not in use, you will get an error "Cannot communicate securely with peer: no common encryption algorithm" instead of a response.
You can check the installed package version with dpkg -l | grep -i openssl. The actual TLS/SSL version used depends on what the server offers or what is negotiated between server and client in any given session.
Best Answer
There is a website that offers curl cipher requestion detection as a service:
However, it does not accept all ciphers - if one of the ciphers they accept is not on the list that your curl is sending, then you will not be able to get a response at all.