RabbitMQ : TLS 1.2 : During handshake of TLS connection where does the client fetch the list of cipher suites from that it sends in 'Client Hello' message?

[mahendra25aug]

Searched a lot but still don't know that from where does the client fetches the list of cipher suites that it is going to propose to server?
Please note that I am asking of cipher suits proposed by client in 'Client Hello' message.

[michaelklishin]

Some clients allow you to configure specific cipher suites for TLS. I don't think it's a common thing to do, though.

What is documented in RabbitMQ's TLS docs is the server counterpart.

Did I understand your question correctly?

[mahendra25aug]

@michaelklishin
So I have RabbitMQ service installed and then in C# code I try to connect (Ex. var connection = factory.CreateConnection()) to it without any cipher suits configuration.

So here my C# application could be considered as Client.

somewhere I read that rabbitmq internally uses openssl, so when I ran the command 'openssl ciphers -s -tls1_2' I got a list that is different when I see rabbitmq client hello's cipher suits in wireshark. Also I don't have any group policy on machine that overrides the ciphers.

[lukebakken]

somewhere I read that rabbitmq internally uses openssl, so when I ran the command 'openssl ciphers -s -tls1_2' I got a list that is different when I see rabbitmq client hello's cipher suits in wireshark.

If your C# application runs on Windows it will be using the Windows TLS implementation, not OpenSSL. This explains the difference.

[mahendra25aug]

That C# application is using 'rabbitmq-dotnet-client' nuget package which internally use OpenSSL I guess...Moreover question is How Cipher list is determined in Client Hello message

[michaelklishin]

It does not use OpenSSL, it uses .NET's implementation of TLS which these days on Windows relies on the Windows implementation of TLS (IIRC).

[lukebakken]

That C# application is using 'rabbitmq-dotnet-client' nuget package which internally use OpenSSL I guess

No, not necessarily. If you run your client application on Windows, it uses the Windows TLS implementation which is not openssl.

If you run your client on linux, then yes it does use openssl.

You have not told us which platform you use for your C# client application.