Bare with me here, im learning as I go...
We are currently running our outgoing cipher as : AES256-SHA due to a requirement with a receiving party. We occasionally have an issue sending mail to a few other domains in which we have found disabling TLS fixes the issue. I have been unable to get in touch with the right people or people on the receiving end when this problem occurs to see if they have this cipher available. It appears that if they don't have it that TLS would fail based on this article http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117855-technote-esa-00.html as we have to have a matching cipher in order to send mail over TLS
Is there a way to remotely find out what Ciphers are available on a remote server? I have tired www.checktls.com but I would assume this negotiates and reports what it can use or negotiate not what is available for me to compare to.
It also looks like I can run multiple ciphers in a specified order but I cant follow the CLI guide it basically says pick one of the following which does not line up with the AES256-SHA setting that is in use..... how would I use AES256-SHA as the primary for my requirement and what other ones should I run that most platforms have and can negotiate with?
In SSLCONFIG I only see the following options when configuring the outgoing cipher, I don't see the one I am currently using or what I can potentially use?
1. SSL v2.
2. SSL v3
3. TLS v1
4. SSL v2 and v3
5. SSL v3 and TLS v1
6. SSL v2, v3 and TLS v1
I also don't understand why if TLS can not agree on a cipher why it would not revert to no TLS. My Default destination control for TLS Support is "Prefered" not required and would have applied to the few domains that I had to disable it for.
