Git
/
testssl.sh
mirror of https://github.com/drwetter/testssl.sh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
testssl.sh/etc/client-simulation.wireshark...

466 lines
42 KiB
Plaintext
Raw Normal View History

Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
# This file contains client handshake data manually created from Wireshark.
Add client simlation data and provide howto While we are thankful that Ivan Ristic permitted to use the client data from SSLlabs, it became of bit outdated now (see #1158). Also as sslhaf [1] was used, the data comes from HTTP traffic only. This is a start to address it. It provides data from Android 9 (connecting to the play store, so that it is sure we don't capture a ClientHello from an application having an own TLS stack. Also it provides documentation how to grab data yourself, and provide it back to testssl.sh. Aim is at least for testssl.sh 3.0 to add Android 8 and OpenSSL 1.1.1 (@drwetter). My hope others can assist with Safari on OSX 11 and 12. Java 10 and 11, and a recent Opera and Edge version. (Firefox and Chrome are out of date too) Mail clients to follow later. [1] https://github.com/ssllabs/sslhaf
2019-04-18 10:06:01 +02:00
# The content needs to be added to client-simulation.txt which other part
# comes from the SSLlabs client API via update_client_sim_data.pl
# The whole process is done manually.
#
Update Thunderbird simulation to v68.3
2020-01-13 11:35:58 +01:00
# Instructions how to add a client simulation see file "client-simulation.wiresharked.md".
Add client simlation data and provide howto While we are thankful that Ivan Ristic permitted to use the client data from SSLlabs, it became of bit outdated now (see #1158). Also as sslhaf [1] was used, the data comes from HTTP traffic only. This is a start to address it. It provides data from Android 9 (connecting to the play store, so that it is sure we don't capture a ClientHello from an application having an own TLS stack. Also it provides documentation how to grab data yourself, and provide it back to testssl.sh. Aim is at least for testssl.sh 3.0 to add Android 8 and OpenSSL 1.1.1 (@drwetter). My hope others can assist with Safari on OSX 11 and 12. Java 10 and 11, and a recent Opera and Edge version. (Firefox and Chrome are out of date too) Mail clients to follow later. [1] https://github.com/ssllabs/sslhaf
2019-04-18 10:06:01 +02:00
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
names+=("Android 8.1 (native)")
short+=("android_81")
ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA")
ciphersuites+=("")
sni+=("$SNI")
warning+=("")
handshakebytes+=("16030100c0010000bc030346fcc7d3e5a9f68af0aa05de62de63c4ad1a4f472da56aa1424041106922370720ef51a7595abfd5bb32038c96c481bb6449053ba08023a752d124b1c1ca7d34fe001cc02bc02ccca9c02fc030cca8c009c00ac013c014009c009d002f0035010000570000001700150000127777772e676f6f676c65617069732e636f6d00170000ff01000100000a00080006001d00170018000b00020100000500050100000000000d00140012040308040401050308050501080606010201")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0303")
alpn+=("h2,http/1.1")
service+=("HTTP,FTP,SMTP,POP,IMAP")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
current+=(true)
Add client simlation data and provide howto While we are thankful that Ivan Ristic permitted to use the client data from SSLlabs, it became of bit outdated now (see #1158). Also as sslhaf [1] was used, the data comes from HTTP traffic only. This is a start to address it. It provides data from Android 9 (connecting to the play store, so that it is sure we don't capture a ClientHello from an application having an own TLS stack. Also it provides documentation how to grab data yourself, and provide it back to testssl.sh. Aim is at least for testssl.sh 3.0 to add Android 8 and OpenSSL 1.1.1 (@drwetter). My hope others can assist with Safari on OSX 11 and 12. Java 10 and 11, and a recent Opera and Edge version. (Firefox and Chrome are out of date too) Mail clients to follow later. [1] https://github.com/ssllabs/sslhaf
2019-04-18 10:06:01 +02:00
names+=("Android 9.0 (native)")
short+=("android_90")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
Add client simlation data and provide howto While we are thankful that Ivan Ristic permitted to use the client data from SSLlabs, it became of bit outdated now (see #1158). Also as sslhaf [1] was used, the data comes from HTTP traffic only. This is a start to address it. It provides data from Android 9 (connecting to the play store, so that it is sure we don't capture a ClientHello from an application having an own TLS stack. Also it provides documentation how to grab data yourself, and provide it back to testssl.sh. Aim is at least for testssl.sh 3.0 to add Android 8 and OpenSSL 1.1.1 (@drwetter). My hope others can assist with Safari on OSX 11 and 12. Java 10 and 11, and a recent Opera and Edge version. (Firefox and Chrome are out of date too) Mail clients to follow later. [1] https://github.com/ssllabs/sslhaf
2019-04-18 10:06:01 +02:00
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010246010002420303d6259dca682ab368c7e095da7189996da830514896063d4acdc83cb5d2c2568d2041a787bf8dd3d7a1ceda514a6606f1068432a13063ea320fd7e7b367af47ecae00220a0a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a010001d77a7a00000000001e001c0000196c68332e676f6f676c6575736572636f6e74656e742e636f6d00170000ff01000100000a000a0008aaaa001d00170018000b00020100002300000010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b0029aaaa000100001d00203e67895a11e9ce5c69df2995782adaddb7a03ef30b245000ca332d5940ecff20002d00020101002b000b0aeaea0304030303020301001b00030200026a6a0001000029010500e000da001c9941f6b101f853f370851e583bd22e03150fc67298947270c6058707fe1670efe590d777a34b9e2e2d0ec6aa8d0ddc375c2535934c75c9623d1a271f735417fdd9190dae7f4c8541c262f8fbfeee2e820f54f59f68e78503f5c093f6084037be22c20dad3d057f64dc73f2dd45948e27c707f3f2107b32040a21fa9c1273e7797aaf5a5bc8994e9eafc4bd43b2951e10f952564a910f146344ec6d0c49f75fc6a070c75f0ffdd84fe9e10f77c23f1062e90f9e1e396eddb84d8ac00bf7ac87c557622dd18c54bbc229268699c60434648b279dd86e996baee9d1c155002120235d43319c7d5bb4725a52fa782468cd2280bd622c40a36296b354759f6d4389")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP,FTP,SMTP,POP,IMAP")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
requiresSha2+=(true)
current+=(true)
Add a few MS client hellos * Edge 17 Win 10 * Firefox 66 Win 10 Disable 'Edge 13 Win Phone 10' per default and 'Firefox 62 Win 7'.
2019-04-23 10:32:17 +02:00
names+=("Edge 17 Win 10")
short+=("edge_17_win10")
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA")
ciphersuites+=("")
sni+=("$SNI")
warning+=("")
handshakebytes+=("160303018d0100018903035cbeb3c560acfb3dfe583ba45f51f5e2e36f99dfe5e22f1a230724dfaf5ddbde000026c02cc02bc030c02fc024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a0100013a0000001a0018000015737570706f72742e6d6963726f736f66742e636f6d000500050100000000000a00080006001d00170018000b00020100000d00140012040105010201040305030203020206010603002300c000000f032566a8435c845ce7de67f2f4fd6c75ed3206c9448a513d4b4f8cd2fedb5f7d1eb4573ce68756fdad198bd3e4eadfd4db2d7794cc69198366edcb9b9ff5803a58718c1de4d6dffeb4354cd48f5dba6de719cebb27d544f6b2f4427e4e5d46f564d3098134d9b69a4e83e233f5dfea099733f75022dba07665d7c35dd09742082a06f080871caaa6a7770ebc9e2c792eb88c44d0d56ae6ba068a189b674491cee28155148c86d53071e170ab354e0fd0e390b9ddda0886b9fa8c70ee1a0010000e000c02683208687474702f312e310017000000180006001003020100ff01000100")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0303")
alpn+=("h2,http/1.1")
service+=("HTTP,FTP")
minDhBits+=(1024)
maxDhBits+=(4096)
minRsaBits+=(-1)
maxRsaBits+=(16384)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
current+=(true)
Add Opera 60 + Chrome 73 Chrome 74 update pending
2019-04-23 11:33:47 +02:00
names+=("Chrome 73 (Win 10)")
short+=("chrome_73_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc0303a719e434922565bbd59fe0dfec21b7f5c8549fdf52566af99cce87ecb276992b20bbf979b5fbe4ebd1412e55ffe6b811e561d3f04ce451fc229d329babda4de91d00227a7a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a010001914a4a000000000012001000000d7777772e676f6f676c652e646500170000ff01000100000a000a0008aaaa001d00170018000b00020100002300000010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b0029aaaa000100001d00205c2f12fabe8b2ff843aa9f347816b7d3a8b8c051f0830f4bbf13d44b5ec37c2b002d00020101002b000b0aeaea0304030303020301001b0003020002eaea000100001500cb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
Update to chrome 74
2019-04-25 09:17:23 +02:00
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
Add recent Chrome and Opera handshakes Chrome 78 and 79, Opera 65 and 66 Remove FTP from Chrome
2020-01-13 16:02:39 +01:00
service+=("HTTP")
Update to chrome 74
2019-04-25 09:17:23 +02:00
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
current+=(false)
names+=("Chrome 74 (Win 10)")
short+=("chrome_74_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc0303b95f99af8f312f71a9bc94bec54911187cb29365a901f40ef1cc193c51f23afc2074daa030d03808edadb1ac4bc435e41cd106166b6436f925a6501f7314eae2a600222a2a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a01000191baba000000000012001000000d7777772e676f6f676c652e646500170000ff01000100000a000a00087a7a001d00170018000b00020100002300000010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b00297a7a000100001d002062d1679f47bf75d0486d6fc6fa041c13b6cbb4c53984998d0b2db4c3f6b1277a002d00020101002b000b0aaaaa0304030303020301001b00030200027a7a000100001500cb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
Add Opera 60 + Chrome 73 Chrome 74 update pending
2019-04-23 11:33:47 +02:00
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
Add recent Chrome and Opera handshakes Chrome 78 and 79, Opera 65 and 66 Remove FTP from Chrome
2020-01-13 16:02:39 +01:00
service+=("HTTP")
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
Add firefox 71 ... and * deprecate openssl 1.0.1 * enable Chrome 74 instead of Chrome 65
2020-01-13 22:57:10 +01:00
current+=(true)
Add recent Chrome and Opera handshakes Chrome 78 and 79, Opera 65 and 66 Remove FTP from Chrome
2020-01-13 16:02:39 +01:00
names+=("Chrome 78 (Win 10)")
short+=("chrome_78_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc030332e6eabb5d4b9818074f79423b0a9cde127a309671fcf0d0420bdb68f98bbc9320085a3e18e8e5cf4060c1e7065523d344f09186ffb835c10095df30b1611bc49a0022eaea130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a010001912a2a000000000014001200000f73736c2e677374617469632e636f6d00170000ff01000100000a000a0008eaea001d00170018000b00020100002300000010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b0029eaea000100001d0020e0a5bb30a2a14bc13685b4a19ba59628aad22b761dceb63a9dcfa10475f84260002d00020101002b000b0a0a0a0304030303020301001b00030200025a5a000100001500c9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP")
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
current+=(false)
names+=("Chrome 79 (Win 10)")
short+=("chrome_79_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc03032f8eea63ff25d05264565777081b6d1a326e12f37751c33c7e953973af65b2ab20a62f96b75b1c41454679b64cd32fb0fbbf99ff019501d92184d589a529c21c590022caca130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a010001917a7a000000000014001200000f73736c2e677374617469632e636f6d00170000ff01000100000a000a0008eaea001d00170018000b00020100002300000010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b0029eaea000100001d0020465dfa0295bf9cd3578d2f23bbfdf58d6468c5dd0c071f0b7c6bb92fc507685b002d00020101002b000b0ababa0304030303020301001b00030200029a9a000100001500c9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP")
Add Opera 60 + Chrome 73 Chrome 74 update pending
2019-04-23 11:33:47 +02:00
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
current+=(true)
Add a few MS client hellos * Edge 17 Win 10 * Firefox 66 Win 10 Disable 'Edge 13 Win Phone 10' per default and 'Firefox 62 Win 7'.
2019-04-23 10:32:17 +02:00
names+=("Firefox 66 (Win 8.1/10)")
short+=("firefox_66_win")
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc0303f488fc07f89155dba6560e527e1708e0b36458f32492fcf3074386f169d447e5204ed6d2d9d162b792388e9cee6c838b6b1e82dacdf1837f7279bc42339c70b79c0024130113031302c02bc02fcca9cca8c02cc030c00ac009c013c01400330039002f0035000a0100018f0000000f000d00000a7465737473736c2e736800170000ff01000100000a000e000c001d00170018001901000101000b00020100002300000010000e000c02683208687474702f312e310005000501000000000033006b0069001d0020f3c22d5492b1230da8895790bea5e5a3af7e63517cfa31b37d1d2a817a628f690017004104a373b66bce1c5d411d78d93b3c3ee6eb7c4519a52abf29e98bbc355a94f8f52a1c8bb7d6320c0104e98ec3895bc5e89ddc1d8f2b76305912992df46c546f2cf5002b0009080304030303020301000d0018001604030503060308040805080604010501060102030201002d00020101001c000240010015009400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl3 -no_ssl2")
Add firefox 71 ... and * deprecate openssl 1.0.1 * enable Chrome 74 instead of Chrome 65
2020-01-13 22:57:10 +01:00
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
Remove FTP as a "service" from Firefox' client simulation ... as firefox never supported FTP over TLS or SSL, see https://bugzilla.mozilla.org/show_bug.cgi?id=85464 In general browsers tend to remove noaways cleartext FTP from browsers.
2020-01-13 23:11:59 +01:00
service+=("HTTP")
Add firefox 71 ... and * deprecate openssl 1.0.1 * enable Chrome 74 instead of Chrome 65
2020-01-13 22:57:10 +01:00
minDhBits+=(1023)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072")
requiresSha2+=(false)
current+=(true)
names+=("Firefox 71 (Win 10)")
short+=("firefox_71_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384")
sni+=("$SNI")
warning+=("")
handshakebytes+=("16030102580100025403036d4532515bff048c5c74cb0d39518c9c02e2dfd4d8ecae6591ee67d29ea62eab20c70c3e8feae9ed79d54914215aab37d3d5b7966a422edc41d2c027f9973d6b160024130113031302c02bc02fcca9cca8c02cc030c00ac009c013c01400330039002f0035000a010001e700000014001200000f7777772e6d6f7a696c6c612e6f726700170000ff01000100000a000e000c001d00170018001901000101000b000201000010000e000c02683208687474702f312e310005000501000000000033006b0069001d002005dcfe2c42419119e518fb087071ba68445b825e4f4dd9ddb8679c3011d3e75800170041046bd8e6b1818d3985e55a8514d3ec5091945df5eb48136c3a9f67bb6d6665758ef088520626748d59bba63786c0164b948013e0f8eee0ba425d643b7c5d4bfa8f002b0009080304030303020301000d0018001604030503060308040805080604010501060102030201002d00020101001c00024001002900eb00c600c0995b148219e66aca5e58a74de1551ae6c76897f50fc853147cf22db9a937361496395112ab0382a942c95fbd48b787d031ae89a8f23f9b7a56c2a0ed5158e919d2491c003ab7d1ca1944b7e5d068d4e6a0c83d9096e9cb76ad2ac081075551cf4bdbfff1194a71c54bf8f88cbe7c246c728155e92f94015e4c5140ce84087c842033ea00fa92f5bd5b601f9650aee0eb0d000175e447945fd28e1df361c5cce443351fd0f7f13cb6cab2e2cc8c3951eb4367dc5004415ab6c3cf0adbca1e3be4f149f74100212008a1f3195cd13d7b4386acd47cdfae0afad06cf8d245744e815ec6989e3cdd6c")
protos+=("-no_ssl3 -no_ssl2")
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
Remove FTP as a "service" from Firefox' client simulation ... as firefox never supported FTP over TLS or SSL, see https://bugzilla.mozilla.org/show_bug.cgi?id=85464 In general browsers tend to remove noaways cleartext FTP from browsers.
2020-01-13 23:11:59 +01:00
service+=("HTTP")
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
minDhBits+=(1023)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072")
requiresSha2+=(false)
current+=(true)
Change the platform for Java from Ubuntu to OpenJDK
2019-05-07 19:39:20 +02:00
names+=("Java 11.0.2 (OpenJDK)")
Add Java 11 from Ubuntu 18.04 manually wiresharked, detailed version info: $ java -version openjdk version "11.0.2" 2019-01-15 OpenJDK Runtime Environment (build 11.0.2+9-Ubuntu-3ubuntu118.04.3) OpenJDK 64-Bit Server VM (build 11.0.2+9-Ubuntu-3ubuntu118.04.3, mixed mode)
2019-05-04 22:20:53 +02:00
short+=("java1102")
Remove erroneous DES-CBC-MD5 from Java 11 and 12 DES-CBC-MD5 was included by utils/hexstream2cipher.sh, heres the relevant snippet, line 160: 148: c025 --> 0xc0,0x25 --> ECDH-ECDSA-AES128-SHA256 152: c029 --> 0xc0,0x29 --> ECDH-RSA-AES128-SHA256 156: 0067 --> 0x00,0x67 --> DHE-RSA-AES128-SHA256 160: 0040 --> 0x00,0x40 --> DHE-DSS-AES128-SHA256 DES-CBC-MD5 164: c009 --> 0xc0,0x09 --> ECDHE-ECDSA-AES128-SHA 168: c013 --> 0xc0,0x13 --> ECDHE-RSA-AES128-SHA 172: 002f --> 0x00,0x2f --> AES128-SHA 176: c004 --> 0xc0,0x04 --> ECDH-ECDSA-AES128-SHA Unfortunately I don't know how to fix utils/hexstream2cipher.sh, but I have manually removed the erroneous cipher and space from the client-sim.
2019-05-06 18:07:43 +02:00
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:AES256-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:ECDH-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA")
Add Java 11 from Ubuntu 18.04 manually wiresharked, detailed version info: $ java -version openjdk version "11.0.2" 2019-01-15 OpenJDK Runtime Environment (build 11.0.2+9-Ubuntu-3ubuntu118.04.3) OpenJDK 64-Bit Server VM (build 11.0.2+9-Ubuntu-3ubuntu118.04.3, mixed mode)
2019-05-04 22:20:53 +02:00
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384")
sni+=("$SNI")
warning+=("")
handshakebytes+=("16030301b8010001b40303ca5f7e4933a89ce4d71df403c75e71e6068fbc14a00fc4f0edd5b0dc80fee88120ded1f3aacfab0d011cd1327a4049e0e15dc4f9c6ff512bf3792687227b238af4005813011302c02cc02bc030009dc02ec032009f00a3c02f009cc02dc031009e00a2c024c028003dc026c02a006b006ac00ac0140035c005c00f00390038c023c027003cc025c02900670040c009c013002fc004c00e003300320100011300000010000e00000b6369706865726c692e7374000500050100000000000a0020001e0017001800190009000a000b000c000d000e001601000101010201030104000b00020100000d002800260403050306030804080508060809080a080b04010501060104020303030103020203020102020032002800260403050306030804080508060809080a080b04010501060104020303030103020203020102020011000900070200040000000000170000002b0009080304030303020301002d000201010033004700450017004104c762a2d3f3ac33e332935a4b7bf0fd4a8f3b7ab7bbc630f78e35bd86a132b32b811a1defe5f4e18a26dc698a01513c6a6467ee10a20397fc7462b1f0b4b85f42ff01000100")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
Add Java 12 from Ubuntu 19.04 manually wiresharked, detailed version info: $ java -version openjdk version "12.0.1" 2019-04-16 OpenJDK Runtime Environment (build 12.0.1+12-Ubuntu-1) OpenJDK 64-Bit Server VM (build 12.0.1+12-Ubuntu-1, mixed mode, sharing)
2019-05-04 22:30:10 +02:00
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
service+=("ANY")
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(224)
curves+=("secp256r1:secp384r1:secp521r1:sect283k1:sect283r1:sect409k1:sect409r1:sect571k1:sect571r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192")
requiresSha2+=(false)
current+=(true)
Change the platform for Java from Ubuntu to OpenJDK
2019-05-07 19:39:20 +02:00
names+=("Java 12.0.1 (OpenJDK)")
Add Java 12 from Ubuntu 19.04 manually wiresharked, detailed version info: $ java -version openjdk version "12.0.1" 2019-04-16 OpenJDK Runtime Environment (build 12.0.1+12-Ubuntu-1) OpenJDK 64-Bit Server VM (build 12.0.1+12-Ubuntu-1, mixed mode, sharing)
2019-05-04 22:30:10 +02:00
short+=("java1201")
Remove erroneous DES-CBC-MD5 from Java 11 and 12 DES-CBC-MD5 was included by utils/hexstream2cipher.sh, heres the relevant snippet, line 160: 148: c025 --> 0xc0,0x25 --> ECDH-ECDSA-AES128-SHA256 152: c029 --> 0xc0,0x29 --> ECDH-RSA-AES128-SHA256 156: 0067 --> 0x00,0x67 --> DHE-RSA-AES128-SHA256 160: 0040 --> 0x00,0x40 --> DHE-DSS-AES128-SHA256 DES-CBC-MD5 164: c009 --> 0xc0,0x09 --> ECDHE-ECDSA-AES128-SHA 168: c013 --> 0xc0,0x13 --> ECDHE-RSA-AES128-SHA 172: 002f --> 0x00,0x2f --> AES128-SHA 176: c004 --> 0xc0,0x04 --> ECDH-ECDSA-AES128-SHA Unfortunately I don't know how to fix utils/hexstream2cipher.sh, but I have manually removed the erroneous cipher and space from the client-sim.
2019-05-06 18:07:43 +02:00
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:DHE-DSS-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:AES256-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:ECDH-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA")
Add Java 12 from Ubuntu 19.04 manually wiresharked, detailed version info: $ java -version openjdk version "12.0.1" 2019-04-16 OpenJDK Runtime Environment (build 12.0.1+12-Ubuntu-1) OpenJDK 64-Bit Server VM (build 12.0.1+12-Ubuntu-1, mixed mode, sharing)
2019-05-04 22:30:10 +02:00
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("16030301bd010001b90303179b0759c355875657d31c7c03293ac94c6f5c75a45689d8f073db3858e90b44207c60386fec70ab935d7d554482f153112b05c449fc1f718f97c09d9bdfb882fa0062130113021303c02cc02bcca9c030cca8009dc02ec032009fccaa00a3c02f009cc02dc031009e00a2c024c028003dc026c02a006b006ac00ac0140035c005c00f00390038c023c027003cc025c02900670040c009c013002fc004c00e0033003200ff0100010e00000010000e00000b6369706865726c692e7374000500050100000000000a0020001e0017001800190009000a000b000c000d000e001601000101010201030104000b00020100000d002800260403050306030804080508060809080a080b04010501060104020303030103020203020102020032002800260403050306030804080508060809080a080b04010501060104020303030103020203020102020011000900070200040000000000170000002b0009080304030303020301002d0002010100330047004500170041047fee265885ea4db5694f11d45e5a219052a2cab3d12339f07163a8e5cb6e822853ed990d130e356ee8ef2e37bb757d9fe9edff99478784a47c0350f66c2ce87e")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
Add Java 11 from Ubuntu 18.04 manually wiresharked, detailed version info: $ java -version openjdk version "11.0.2" 2019-01-15 OpenJDK Runtime Environment (build 11.0.2+9-Ubuntu-3ubuntu118.04.3) OpenJDK 64-Bit Server VM (build 11.0.2+9-Ubuntu-3ubuntu118.04.3, mixed mode)
2019-05-04 22:20:53 +02:00
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
service+=("ANY")
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(224)
curves+=("secp256r1:secp384r1:secp521r1:sect283k1:sect283r1:sect409k1:sect409r1:sect571k1:sect571r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192")
requiresSha2+=(false)
current+=(true)
Add Opera 60 + Chrome 73 Chrome 74 update pending
2019-04-23 11:33:47 +02:00
names+=("Opera 60 (Win 10)")
short+=("opera_60_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc03033503bae63f0cf8ef9d0a55623327a28e3c3525a2ce28153242e132279d3940e3206a440f32e7a8488b012b12d4b7d1b2b1764c784a944662a7f305e90f7d15168500228a8a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a01000191eaea000000000012001000000d7777772e6f706572612e636f6d00170000ff01000100000a000a0008caca001d00170018000b00020100002300c07505f51cc349fe3f9e022858dcd1eb12ca07a302fd9f43a4cbffec031296e77b07122bb9532dd112770b686a4898e20462c514c5fb043dc325a5453753c499774bfab673024a86543064c33d40b67b2e4e9dfa177305e8cdc39f3d8afe0fe7c80406a9e07ea836dd8a46ab7ef9aa5dc66301a346585f7ff26615a28cbea2544d4ba8101be6f528b4bba3a5ce9a6683537b29cd16d4c5015de6f9a93d3c132389e56ff20853d952f6ee06b46ca89dc52b67583fbb0fb61e2b78c03ef97892c6a90010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b0029caca000100001d00204aeb26ec670ce59e094a8b97c281186b4e87706df48667a24193e268a069cd54002d00020101002b000b0a3a3a0304030303020301001b00030200027a7a0001000015000b0000000000000000000000")
protos+=("-no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0300")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP,FTP")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
Add recent Chrome and Opera handshakes Chrome 78 and 79, Opera 65 and 66 Remove FTP from Chrome
2020-01-13 16:02:39 +01:00
current+=(false)
names+=("Opera 65 (Win 10)")
short+=("opera_65_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc03039eee8c108ed7b040285658cddb0022e7e1f17bc92084335edf8ad5404fbf424a203bedd34c83b59c3e302af681b449490895335de0d8a0f10d20a0ff610130229b00224a4a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a010001912a2a000000000014001200000f626c6f67732e6f706572612e636f6d00170000ff01000100000a000a00081a1a001d00170018000b00020100002300000010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b00291a1a000100001d0020cc29a9f8b3a69149c38b29ccb7341b98efd1714c3887fc1e84512470f783921a002d00020101002b000b0adada0304030303020301001b0003020002dada000100001500c9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl2 -no_ssl3")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP,FTP")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
current+=(false)
names+=("Opera 66 (Win 10)")
short+=("opera_66_win10")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc0303a7ab90aa0987b33da751017bb78958f51bc1aa76e116c21eb4bb0b51a9f88f77203658175a55b25ab41867568b52e8fb8eaf4c8e91ceccf30ae498879e468579b100222a2a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035000a010001911a1a000000000014001200000f626c6f67732e6f706572612e636f6d00170000ff01000100000a000a00087a7a001d00170018000b00020100002300000010000e000c02683208687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201001200000033002b00297a7a000100001d0020488d0d07b77098f98cb97ee85ae88b358404a8004633896e5110966ab3c18f66002d00020101002b000b0ababa0304030303020301001b00030200023a3a000100001500c9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl2 -no_ssl3")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP,FTP")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1")
requiresSha2+=(false)
Add Opera 60 + Chrome 73 Chrome 74 update pending
2019-04-23 11:33:47 +02:00
current+=(true)
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
names+=("OpenSSL 1.1.0j (Debian)")
short+=("openssl_110j")
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA")
ciphersuites+=("")
sni+=("$SNI")
warning+=("")
handshakebytes+=("16030100c2010000be03036468410c4ae36f78a4357ad19fa61353e46aed101eff4e0c9f77ec654dc12eb4000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff0100005d00000013001100000e7465737473736c2e73683a343433000b000403000102000a000a0008001d001700190018002300000016000000170000000d0020001e060106020603050105020503040104020403030103020303020102020203")
Fix typo in handshake simulation with openssl 1.1x "protos" contained "-no-ssl3" instead of "-no_ssl3" which lead to an error message "Oops: openssl s_client connect problem" -- which wasn't caught by the STARTTLS unit test either :-(
2019-05-02 09:53:51 +02:00
protos+=("-no_ssl2 -no_ssl3")
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
tlsvers+=("-tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0300")
highest_protocol+=("0x0303")
alpn+=("h2,http/1.1")
service+=("ANY")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp521r1:secp384r1")
Add client simlation data and provide howto While we are thankful that Ivan Ristic permitted to use the client data from SSLlabs, it became of bit outdated now (see #1158). Also as sslhaf [1] was used, the data comes from HTTP traffic only. This is a start to address it. It provides data from Android 9 (connecting to the play store, so that it is sure we don't capture a ClientHello from an application having an own TLS stack. Also it provides documentation how to grab data yourself, and provide it back to testssl.sh. Aim is at least for testssl.sh 3.0 to add Android 8 and OpenSSL 1.1.1 (@drwetter). My hope others can assist with Safari on OSX 11 and 12. Java 10 and 11, and a recent Opera and Edge version. (Firefox and Chrome are out of date too) Mail clients to follow later. [1] https://github.com/ssllabs/sslhaf
2019-04-18 10:06:01 +02:00
requiresSha2+=(false)
current+=(true)
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
names+=("OpenSSL 1.1.1b (Debian)")
short+=("openssl_111b")
ciphers+=("TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA")
ciphersuites+=("TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256")
sni+=("$SNI")
warning+=("")
handshakebytes+=("160301012d010001290303ac67ab7c72eea2e0f68615f02c9e566ed4a3bb0022c2ca1db7615acfb9dedd0120415470391af467e708e8983b134defcb4f4855e774606ae8223265af0fbb802a003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff010000a200000013001100000e7465737473736c2e73683a343433000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020b4556edddf807eb6b6bbcd61e25775a3992dd6f5caeee76d37f8895436efc972")
Fix typo in handshake simulation with openssl 1.1x "protos" contained "-no-ssl3" instead of "-no_ssl3" which lead to an error message "Oops: openssl s_client connect problem" -- which wasn't caught by the STARTTLS unit test either :-(
2019-05-02 09:53:51 +02:00
protos+=("-no_ssl2 -no_ssl3")
Add client simulations .. for Android 8.1 and Firefox 66. Add ciphersuites to the existing handshakes and update the documentation accordingly.
2019-04-20 20:21:25 +02:00
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0300")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("ANY")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:X448:secp521r1:secp384r1")
requiresSha2+=(true)
current+=(true)
Add client simlation data and provide howto While we are thankful that Ivan Ristic permitted to use the client data from SSLlabs, it became of bit outdated now (see #1158). Also as sslhaf [1] was used, the data comes from HTTP traffic only. This is a start to address it. It provides data from Android 9 (connecting to the play store, so that it is sure we don't capture a ClientHello from an application having an own TLS stack. Also it provides documentation how to grab data yourself, and provide it back to testssl.sh. Aim is at least for testssl.sh 3.0 to add Android 8 and OpenSSL 1.1.1 (@drwetter). My hope others can assist with Safari on OSX 11 and 12. Java 10 and 11, and a recent Opera and Edge version. (Firefox and Chrome are out of date too) Mail clients to follow later. [1] https://github.com/ssllabs/sslhaf
2019-04-18 10:06:01 +02:00
Add Thunderbird 60.6.1 to client simulation
2019-04-23 13:37:50 +02:00
names+=("Thunderbird (60.6)")
short+=("thunderbird_60_6_1")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc03039f5f6a4903cf739091fca37e8f43e6d173ffeb64905977b2dede05e061f3a24c20f958c20b0edd50e0716d108e1d6046178a8974d868c138eac8a6ab8becdf81cd001c130113031302c02bc02fcca9cca8c02cc030c013c014002f0035000a0100019700000013001100000e696d61702e676d61696c2e636f6d00170000ff01000100000a000e000c001d00170018001901000101000b00020100002300000005000501000000000033006b0069001d00200ff08104aea54116caac222c2b7661e05d852847fcfd6860a0ec2f09804bd5330017004104d7afd4ac669de5312ff866d84381723c1d5ff549d409658f9300644d76e33b5c953499a89bdb1fc8930587645bf3452a47fbe6e3f00a59e232c39c269791d871002b0009080304030303020301000d0018001604030503060308040805080604010501060102030201002d00020101001c00024001001500aa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP,SMTP,POP,IMAP")
minDhBits+=(-1)
maxDhBits+=(-1)
Update Thunderbird simulation to v68.3
2020-01-13 11:35:58 +01:00
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072")
requiresSha2+=(false)
current+=(false)
Add recent Chrome and Opera handshakes Chrome 78 and 79, Opera 65 and 66 Remove FTP from Chrome
2020-01-13 16:02:39 +01:00
names+=("Thunderbird (68.3)")
Update Thunderbird simulation to v68.3
2020-01-13 11:35:58 +01:00
short+=("thunderbird_68_3_1")
ciphers+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc030342ffc6c8b96ea60586a63fe7d97ec8d5c962b55ccfe02177cd94c8ea42f7333e209c9b6129e250f6fb8127664d26a46c410a6c217d4c2c4dc49125edd7191043810024130113031302c02bc02fcca9cca8c02cc030c00ac009c013c01400330039002f0035000a0100018f00000013001100000e696d61702e676d61696c2e636f6d00170000ff01000100000a000e000c001d00170018001901000101000b00020100002300000005000501000000000033006b0069001d0020fb48d75e98e9e9c7a7aa32106b8856384f9af1e50f9bd45f2ae3dc349858741b00170041047138476a2fbfd6dc6fa4b351b99248abc20bf27ccb962445161036ec3df7bf7566e048374b72d4cbcf4526475a8a13bbaea75e5925514d6db1a4ae60f6a961fd002b0009080304030303020301000d0018001604030503060308040805080604010501060102030201002d00020101001c00024001001500a2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP,SMTP,POP,IMAP")
minDhBits+=(-1)
maxDhBits+=(-1)
Add Thunderbird 60.6.1 to client simulation
2019-04-23 13:37:50 +02:00
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
curves+=("X25519:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072")
requiresSha2+=(false)
current+=(true)
Fix error + round brackets PR #1260 missed a 'current' line which caused an output problem. I'd like to add round brackets to the displayed name so that we remember what comes from wireshark and waht from SSLlabs
2019-05-04 11:05:57 +02:00
names+=("Safari 12.1 (iOS 12.2)")
Add Safari 12.1 from iOS 12.2 Manually Wiresharked
2019-05-04 00:58:31 +02:00
short+=("safari_121_ios_122")
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384")
sni+=("$SNI")
handshakebytes+=("1603010200010001fc03035695ccca492a68de5adfabb7e70c87b694974ddb17344e9f8d80d51aa64a881d204aca76c4eec10c3b9851b5f02fe71f371d896ba7c9c5a8cd78370b4af27896d60034130313011302c02cc02bc024c023c00ac009cca9c030c02fc028c027c014c013cca8009d009c003d003c0035002fc008c012000a0100017fff0100010000000010000e00000b6369706865726c692e737400170000000d0018001604030804040105030203080508050501080606010201000500050100000000337400000012000000100030002e0268320568322d31360568322d31350568322d313408737064792f332e3106737064792f3308687474702f312e31000b00020100003300260024001d00204090ee7a8be9431345ddcec031c3024ad13d968357e337da3882606afd91405f002d00020101002b0009080304030303020301000a000a0008001d0017001800190015004d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029005b002600205d10265edd7f80daa4cb33e036860f0817903b6f7ffeeaf69977cef1170892485c26fc13003130de816ac91ce4c32f5f7beb18209f6d917cb15fe2a0fd624d5500c64a583899aae55a1d64921d86878eccd66004f1b27f")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,http/1.1")
service+=("HTTP")
curves+=("X25519:secp256r1:secp384r1:secp521r1")
minDhBits+=(-1)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
requiresSha2+=(false)
current+=(true)
Add Safari 12.1 on macOS 10.13.6 manually wiresharked
2019-05-06 21:19:46 +02:00
names+=("Safari 12.1 (macOS 10.13.6)")
short+=("safari_121_osx_10136")
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA")
ciphersuites+=("")
sni+=("$SNI")
warning+=("")
handshakebytes+=("16030100e3010000df03039c6af5b589ea930473487870a111e2088f4c71c4497310945d571b318f259f47000028c02cc02bc024c023c00ac009cca9c030c02fc028c027c014c013cca8009d009c003d003c0035002f0100008eff0100010000000010000e00000b6369706865726c692e737400170000000d00140012040308040401050308050501080606010201000500050100000000337400000012000000100030002e0268320568322d31360568322d31350568322d313408737064792f332e3106737064792f3308687474702f312e31000b00020100000a000a0008001d001700180019")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0303")
alpn+=("h2,http/1.1")
service+=("HTTP")
curves+=("X25519:secp256r1:secp384r1:secp521r1")
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
requiresSha2+=(false)
current+=(true)
Update Safari to 13.0 and macOS to 10.14 manually wiresharked, now with TLS1.3 for macOS as well.
2019-10-16 20:36:08 +02:00
names+=("Safari 13.0 (macOS 10.14.6)")
short+=("safari_130_osx_10146")
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA")
ciphersuites+=("TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:")
sni+=("$SNI")
warning+=("")
handshakebytes+=("1603010200010001fc030320ed560be50a8d6545d0409dfc0f6fd560d886fc62a514ee9923c642455fb5832084efe206b1c656b3abab810251eb260834abb7b0ec0d30450e50594c3a7f74120034130313011302c02cc02bc024c023c00ac009cca9c030c02fc028c027c014c013cca8009d009c003d003c0035002fc008c012000a0100017fff0100010000000010000e00000b6369706865726c692e737400170000000d0018001604030804040105030203080508050501080606010201000500050100000000337400000012000000100030002e0268320568322d31360568322d31350568322d313408737064792f332e3106737064792f3308687474702f312e31000b00020100003300260024001d00205465c46a55942e9fe02115c0cc2ab46ee074d4d164222f2ce6510bd91fa18419002d00020101002b0009080304030303020301000a000a0008001d001700180019001500ac00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
protos+=("-no_ssl3 -no_ssl2")
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
lowest_protocol+=("0x0301")
highest_protocol+=("0x0304")
alpn+=("h2,h2-16,h2-15,h2-14,spdy/3.1,spdy/3,http/1.1")
service+=("HTTP")
curves+=("X25519:secp256r1:secp384r1:secp521r1")
minDhBits+=(1024)
maxDhBits+=(-1)
minRsaBits+=(-1)
maxRsaBits+=(-1)
minEcdsaBits+=(-1)
requiresSha2+=(false)
current+=(true)