Check Supported SSL/TLS Ciphers on Server using Nmap

When troubleshooting SSL/TLS handshake issues, it can be useful to check which SSL/TLS ciphers are supported on the server. This tutorial demonstrates how to do that using Nmap.

Nmap has a ssl-enum-ciphers script that allows to get a list of supported SSL/TLS ciphers for particular server:

nmap --script ssl-enum-ciphers -p 443 google.com

A part of the output:

Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-04 01:48 UTC
...

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|     warnings:
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|   TLSv1.1:
|     ciphers:
|       TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
...
|_  least strength: C

Nmap done: 1 IP address (1 host up) scanned in 2.17 seconds