Testing Go TLS / HTTPS Client Support for Various Cipher Suites

README.md

Testing Go TLS / HTTPS Client Support for Various Cipher Suites

$ go run ./main.go
- 0x0005: TLS_RSA_WITH_RC4_128_SHA (failure)
- 0x000a: TLS_RSA_WITH_3DES_EDE_CBC_SHA (failure)
- 0x002f: TLS_RSA_WITH_AES_128_CBC_SHA (success)
- 0x0035: TLS_RSA_WITH_AES_256_CBC_SHA (success)
- 0x003c: TLS_RSA_WITH_AES_128_CBC_SHA256 (success)
- 0x009c: TLS_RSA_WITH_AES_128_GCM_SHA256 (success)
- 0x009d: TLS_RSA_WITH_AES_256_GCM_SHA384 (success)
- 0xc007: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (failure)
- 0xc009: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (failure)
- 0xc00a: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (failure)
- 0xc011: TLS_ECDHE_RSA_WITH_RC4_128_SHA (failure)
- 0xc012: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (failure)
- 0xc013: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (success)
- 0xc014: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (success)
- 0xc023: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (failure)
- 0xc027: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (success)
- 0xc02f: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (success)
- 0xc02b: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (failure)
- 0xc030: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (success)
- 0xc02c: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (failure)
- 0xcca8: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (failure)
- 0xcca9: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (failure)
- 0x1301: TLS_AES_128_GCM_SHA256 (failure)
- 0x1302: TLS_AES_256_GCM_SHA384 (failure)
- 0x1303: TLS_CHACHA20_POLY1305_SHA256 (failure)

main.go

package main

import (
	"crypto/tls"
	"fmt"
	"net/http"
)

type CipherPair struct {
	Name   string
	Cipher uint16
}

func main() {
  // See: https://godoc.org/crypto/tls#pkg-constants
	suites := []CipherPair{
		{Name: "TLS_RSA_WITH_RC4_128_SHA", Cipher: tls.TLS_RSA_WITH_RC4_128_SHA},
		{Name: "TLS_RSA_WITH_3DES_EDE_CBC_SHA", Cipher: tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA},
		{Name: "TLS_RSA_WITH_AES_128_CBC_SHA", Cipher: tls.TLS_RSA_WITH_AES_128_CBC_SHA},
		{Name: "TLS_RSA_WITH_AES_256_CBC_SHA", Cipher: tls.TLS_RSA_WITH_AES_256_CBC_SHA},
		{Name: "TLS_RSA_WITH_AES_128_CBC_SHA256", Cipher: tls.TLS_RSA_WITH_AES_128_CBC_SHA256},
		{Name: "TLS_RSA_WITH_AES_128_GCM_SHA256", Cipher: tls.TLS_RSA_WITH_AES_128_GCM_SHA256},
		{Name: "TLS_RSA_WITH_AES_256_GCM_SHA384", Cipher: tls.TLS_RSA_WITH_AES_256_GCM_SHA384},
		{Name: "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", Cipher: tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA},
		{Name: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", Cipher: tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA},
		{Name: "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", Cipher: tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA},
		{Name: "TLS_ECDHE_RSA_WITH_RC4_128_SHA", Cipher: tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA},
		{Name: "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", Cipher: tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA},
		{Name: "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", Cipher: tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
		{Name: "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", Cipher: tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA},
		{Name: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", Cipher: tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256},
		{Name: "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", Cipher: tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256},
		{Name: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", Cipher: tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
		{Name: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", Cipher: tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
		{Name: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", Cipher: tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384},
		{Name: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", Cipher: tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384},
		{Name: "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", Cipher: tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256},
		{Name: "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", Cipher: tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256},
		{Name: "TLS_AES_128_GCM_SHA256", Cipher: tls.TLS_AES_128_GCM_SHA256},
		{Name: "TLS_AES_256_GCM_SHA384", Cipher: tls.TLS_AES_256_GCM_SHA384},
		{Name: "TLS_CHACHA20_POLY1305_SHA256", Cipher: tls.TLS_CHACHA20_POLY1305_SHA256},
	}

	for _, p := range suites {
		client := &http.Client{
			Transport: &http.Transport{
				TLSClientConfig: &tls.Config{
					CipherSuites: []uint16{p.Cipher},
				},
			},
		}

		// H/T: https://security.stackexchange.com/a/197684/197059
		// _, err := client.Get("https://tls-v1-1.badssl.com:1012/")
		// _, err := client.Get("https://tls-v1-2.badssl.com:1012/")
		_, err := client.Get("https://tls-v1-3.badssl.com:1012/")
		if err == nil {
			fmt.Printf("- 0x%04x: %s (success)\n", p.Cipher, p.Name)
		} else {
			fmt.Printf("- 0x%04x: %s (failure)\n", p.Cipher, p.Name)
		}
	}
}