<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/tis-the-season-to-check-your-ssl-tls-cipher-list-thrice-rcurl-curl-openssl/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2018/11/17/tis-the-season-to-check-your-ssl-tls-cipher-list-thrice-rcurl-curl-openssl/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>The <code>libcurl</code> library (the foundational library behind the <code>RCurl</code> and <code>curl</code> packages) has switched to using OpenSSL’s default ciphers since version 7.56.0 (October 4 2017). If you’re a regular updater of <code>curl</code>/<code>httr</code> you should be fairly current with these cipher suites, but if you’re not a keen updater or use <code>RCurl</code> for your web-content tasks, you are likely not working with a recent cipher list and may start running into trouble as the internet self-proclaimed web guardians keep their wild abandon push towards “HTTPS Everywhere”.</p>
<p>Why is this important? Well, as a web consumer (via browsers) you likely haven’t run into any issues when visiting SSL/TLS-enabled sites since most browsers update super-frequently and bring along modern additions to cipher suites with them. Cipher suites are one of the backbones of assurance when it comes to secure connections to servers and stronger/different ciphers are continually added to <code>openssl</code> (and other libraries). If a server (rightfully) only supports a modern, seriously secure TLS configuration, clients that do not have such support won’t be able to connect and you’ll see errors such as:</p>
<pre><code>SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
</code></pre>
<p>You can test what a <em>server</em> supports via tools like <a rel="nofollow" href="https://www.ssllabs.com/ssltest/" target="_blank">SSL Test</a>. I’d point to a command-line tool but there are enough R users on crippled Windows systems that it’s just easier to have you point and click to see. If you <em>are game</em> to try a command-line tool then give <a rel="nofollow" href="https://github.com/drwetter/testssl.sh" target="_blank"><code>testssl</code><img alt="🔗" src="https://i0.wp.com/s.w.org/images/core/emoji/11/72x72/1f517.png?w=456&ssl=1" class="wp-smiley" data-recalc-dims="1"></a> a go from an RStudio terminal (I use that suggestion specifically to be platform agnostic as I cannot assume R Windows users know how to use a sane shell). The <code>testssl</code> script has virtually no dependencies so it should “work everywhere”. Note that both SSL Test and <code>testssl</code>make <em>quite a few connections</em> to a site so make sure you’re only using your own server(s) as test targets unless you have permission from others to use theirs (go ahead and hit mine if you like).</p>
<p>You can also see what your R client packages support. One <em>could</em> run:</p>
<pre><code>library(magrittr)

read.table(
  text = system(&quot;openssl ciphers -v&quot;, intern=TRUE) %>% 
    gsub(&quot;[[:alpha:]]+=&quot;, &quot;&quot;, .)
) %>% 
  setNames(
    c(&quot;ciphername&quot;, &quot;protoccol_version&quot;, &quot;key_exchange&quot;, &quot;authentication&quot;, 
      &quot;symmetric_encryption_method&quot;, &quot;message_authentication_code&quot;)
  )
</code></pre>
<p>in attempt to do that via the <code>openssl</code> binary on your system, but Windows users likely won’t be able to run that (unlike every other modern OS including iOS) <em>and</em> it might not show you what your installed R client packages can handle since they may be using different libraries.</p>
<p>So, another platform-agnostic (but requiring a call to a web site, so some privacy leakage) is to use <a rel="nofollow" href="https://www.howsmyssl.com/a/check" target="_blank">How’s My SSL</a>.</p>
<pre><code>ssl_check_url &lt;- &quot;https://www.howsmyssl.com/a/check&quot;

jsonlite::fromJSON(
  readLines(url(ssl_check_url), warn = FALSE)
) -> base_chk

jsonlite::fromJSON(
  RCurl::getURL(ssl_check_url)
) -> rcurl_chk

jsonlite::fromJSON(
  rawToChar(
    curl::curl_fetch_memory(ssl_check_url)$content
  )
) -> curl_chk
</code></pre>
<p>Compare the <code>$given_cipher_suites</code> for each of those to see how they compare and also take a look at <code>$rating</code>. macOS and Linux users <em>should</em> have fairly uniform results for all three. Windows users may be in for a sad awakening (I mean you’re used to that on a regular basis, so it’s cool). You can also configure how you communicate what you support via the <code>ssl_cipher_list</code> cURL option (capitalization is a bit different with <code>RCurl</code> but I <em>kinda want you to use the <code>curl</code> package</em> so you’re on your own to translate. Note that you can’t game the system and claim you can handle a cipher you don’t actually have.</p>
<h3>FIN</h3>
<p>You should try to stay current with the OpenSSL (or equivalent) library on your operating system and also with the <code>libcurl</code> library on your system and then the <code>curl</code>, <code>openssl</code>, and <code>RCurl</code> packages. You may have production-rules requiring lead-times for changing configs but these should be in the “test when they make it to CRAN and install as-soon-as-possible-thereafter” category.</p>
	<p>
<div>
<div>To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="https://rud.is/b/2018/11/17/tis-the-season-to-check-your-ssl-tls-cipher-list-thrice-rcurl-curl-openssl/"> R – rud.is</a></strong>.</div>
<hr>
<a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers.com</a> offers <strong><a rel="nofollow" href="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers">daily e-mail updates</a></strong> about <a rel="nofollow" href="https://www.r-project.org/" title="The R Project for Statistical Computing">R</a> news and <a rel="nofollow" href="https://www.r-bloggers.com/search/tutorial" title="R tutorials">tutorials</a> on topics such as: <a rel="nofollow" href="https://www.r-bloggers.com/search/data%20science" title="Data science">Data science</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Big%20Data" title="Big Data">Big Data, <a rel="nofollow" href="https://www.r-users.com/" title="R jobs">R jobs</a>, visualization (<a rel="nofollow" href="https://www.r-bloggers.com/search/ggplot2" title="ggplot and ggplot2 tutorials">ggplot2</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/boxplot" title="Boxplots using lattice and ggplot2 tutorials">Boxplots</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/map" title="Maps and gis">maps</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/animation" title="Animation in R">animation</a>), programming (<a rel="nofollow" href="https://www.r-bloggers.com/search/RStudio" title="RStudio IDE for R">RStudio</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/sweave" title="Sweave and literate programming">Sweave</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/LaTeX" title="LaTeX in R">LaTeX</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/SQL" title="SQL and databases">SQL</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/eclipse" title="Eclipse IDE for R">Eclipse</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/git" title="git and github, Version Control System">git</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/hadoop" title="Large data in R using Hadoop">hadoop</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Web+Scraping" title="Web Scraping of google, facebook, yahoo, twitter and more using R">Web Scraping</a>) statistics (<a rel="nofollow" href="https://www.r-bloggers.com/search/regression" title="Regressions and ANOVA analysis tutorials">regression</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/PCA" title="principal component analysis tutorial">PCA</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/time+series" title="Time series">time series</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/trading" title="finance trading">trading</a>) and more...
<img width="1" alt="" src="http://feeds.feedburner.com/~r/RBloggers/~4/SYfKrSm-XAM" height="1"></a></div>