We are looking for restrict the allowed cipher suite we offer to client on our Apache servers hosted on our Linux servers.
But first, we would like to know which old ciphers are still used by our clients.
Is there a way to monitor SSL handshake, ciphers used, sessions aborted, etc ... by tuning apache or listen network with tcpdump?
EDIT: for logging used cipher, %{SSL_PROTOCOL} and %{SSL_CIPHER} can be added to CustomLog,
Exemple: CustomLog "logs/ssl_request_log" "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x "%r" %b"
But I still lack handshake failures