title: How to force OpenSSL to use old ciphers
body: <p>I'm trying to check the "security" certificate on an APC power distribution unit using OpenSSL from this shell script, but kept getting back an empty response.</p>
  
  <pre><code>#!/bin/bash
  host=192.168.242.27
  port=443
  cert=$(openssl s_client -connect "$host":"$port" 2&gt;/dev/null | sed -n '/BEGIN CERT/,/END CERT/p')
  echo "We got a cert:"
  echo $cert
  </code></pre>
  
  <p>So I did some debugging. I'm on a Mac, and have a MacPorts environment. Using the MacPorts version of OpenSSL to connect to the server, I get nothing:</p>
  
  <pre><code>❱ openssl version
  OpenSSL 1.0.2h  3 May 2016
  
  ❱ openssl s_client -connect 192.168.242.27:443
  CONNECTED(00000003)
  140735258415184:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:769:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 7 bytes and written 308 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : 0000
      Session-ID: 
      Session-ID-ctx: 
      Master-Key: 
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1464972048
      Timeout   : 300 (sec)
      Verify return code: 0 (ok)
  ---
  </code></pre>
  
  <p>But, using the built-in version I get a response:</p>
  
  <pre><code>❱ /usr/bin/openssl version
  OpenSSL 0.9.8zh 14 Jan 2016
  
  ❱ /usr/bin/openssl s_client -connect 192.168.242.27:443
  CONNECTED(00000003)
  depth=0 /C=US/ST=Default State/L=Default Locality/O=American Power Conversion Corp/OU=Internally Generated Certificate/CN=5A1320E05051
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=0 /C=US/ST=Default State/L=Default Locality/O=American Power Conversion Corp/OU=Internally Generated Certificate/CN=5A1320E05051
  verify error:num=21:unable to verify the first certificate
  verify return:1
  ---
  Certificate chain
   0 s:/C=US/ST=Default State/L=Default Locality/O=American Power Conversion Corp/OU=Internally Generated Certificate/CN=5A1320E05051
     i:/C=US/ST=Default State/L=Default Locality/O=American Power Conversion Corp/OU=Internally Generated Certificate/CN=5A1320E05051
  ---
  Server certificate
  -----BEGIN CERTIFICATE-----
  MIIC1DCCAl6gAwIBAgIIWotX81/0ywkwDQYJKoZIhvcNAQEFBQAwgasxCzAJBgNV
  BAYTAlVTMRYwFAYDVQQIEw1EZWZhdWx0IFN0YXRlMRkwFwYDVQQHExBEZWZhdWx0
  IExvY2FsaXR5MScwJQYDVQQKEx5BbWVyaWNhbiBQb3dlciBDb252ZXJzaW9uIENv
  cnAxKTAnBgNVBAsTIEludGVybmFsbHkgR2VuZXJhdGVkIENlcnRpZmljYXRlMRUw
  EwYDVQQDEww1QTEzMjBFMDUwNTEwHhcNMDEwOTEzMDk1NjU2WhcNMjIwOTEzMDk1
  NjU2WjCBqzELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDURlZmF1bHQgU3RhdGUxGTAX
  BgNVBAcTEERlZmF1bHQgTG9jYWxpdHkxJzAlBgNVBAoTHkFtZXJpY2FuIFBvd2Vy
  IENvbnZlcnNpb24gQ29ycDEpMCcGA1UECxMgSW50ZXJuYWxseSBHZW5lcmF0ZWQg
  Q2VydGlmaWNhdGUxFTATBgNVBAMTDDVBMTMyMEUwNTA1MTB8MA0GCSqGSIb3DQEB
  AQUAA2sAMGgCYQDch9OnR65LipagZvVj5VACX2UIzjtq/4/EjRID34r7+GABci2P
  Gw1+UOKG1fc/AeUQdOrYKwpC4qzMmGij/H1mhEbvdc3FYtq4l8/f/Ou+mLW32SfJ
  d/yMuL0gtq98oRsCAwEAAaNEMEIwEQYKKwYBBAGXVQMBBQQDAwEAMB0GA1UdDgQW
  BBQUcKO5XStaWDQVNrzCuYli5ezggTAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcN
  AQEFBQADYQB7XFmN6oBMT7sCRyHqoujjb/yCRvol19YBcIvzuMJiPOtzLrDOOqBc
  QrROWPKq1RwPQnLzQ9bnbJ7dcMukrpmLrAA4T9SK0en+puTGtMqEsxFdX7mZr0ZG
  wRCP+fFjCGU=
  -----END CERTIFICATE-----
  subject=/C=US/ST=Default State/L=Default Locality/O=American Power Conversion Corp/OU=Internally Generated Certificate/CN=5A1320E05051
  issuer=/C=US/ST=Default State/L=Default Locality/O=American Power Conversion Corp/OU=Internally Generated Certificate/CN=5A1320E05051
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 848 bytes and written 280 bytes
  ---
  New, TLSv1/SSLv3, Cipher is RC4-MD5
  Server public key is 768 bit
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : RC4-MD5
      Session-ID: E07867E677700F3E7F69FFCC96B4A158
      Session-ID-ctx: 
      Master-Key: 16CB13EF51575C010EB50D37C353A276C108B6673D5FEFEA7B196F84C7ECD858AC00A3137C5AAB9758C50ED35B92BC8B
      Key-Arg   : None
      Start Time: 1464972023
      Timeout   : 300 (sec)
      Verify return code: 21 (unable to verify the first certificate)
  ---
  </code></pre>
  
  <p>(Yes, that is RC4-MD5 cipher on a 2 year old piece of hardware; and no, I don't recommend anyone purchase one of these things.)</p>
  
  <p>In production, I want to be able to do this from a Linux server where I will only have access to OpenSSL 1.0.2. I've tried with all sorts of arguments to <code>openssl s_client</code> to disable and enable various combinations of SSL and TLS with no luck. So, is there a way to get a modern version of OpenSSL to talk to a device with weak crypto?</p>