Logging TLS cipher suite

[Richard Frovarp]

On Wed, 2021-04-21 at 16:26 +0000, Cantor, Scott wrote:
> On 4/21/21, 12:01 PM, "users on behalf of Andrew Jason Morgan" <
> users-bounces at shibboleth.net on behalf of morgan at oregonstate.edu>
> wrote:
> 
> >    Does this log the TLS protocol version as well?
> 
> No.
> 
> >  TLS 1.0 and 1.1 could be used with a "good" cipher, but we still
> > want to disable TLS 1.0 and 1.1.  Knowing the
> > cipher used may not be sufficient.
> 
> I was hoping that would not be the case, but if so, not much I know
> to do about it.
> 
> -- Scott
> 
> 

All of the ciphers in TLSv1.0 and TLSv1.1 are considered weak. Some of
them also exist in TLSv1.2, which is what earns them a "good". But
anything that can speak TLSv1.2 can also speak the strong ciphers. Not
sure under what conditions a TLSv1.2 client would prefer the weak
ciphers. I've never really dug deep in how those are ordered / selected
by anything.