我想用 cURL 测试某些密码的使用，但它似乎不尊重该--ciphers选项：
curl -vvv --tlsv1.0 --ciphers 'RC4-SHA' https://my.url.com/alive
* Hostname was NOT found in DNS cache
* Trying ip...
* Connected to my.url.com (ip) port 443 (#0)
* TLS 1.0 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* Server certificate: *.url.com
* Server certificate: DigiCert SHA2 Secure Server CA
* Server certificate: DigiCert Global Root CA
> GET /alive HTTP/1.1
> User-Agent: curl/7.37.1
> Host: my.url.com
> Accept: */*
>
< HTTP/1.1 200 OK
* Server nginx/1.4.6 (Ubuntu) is not blacklisted
< Server: nginx/1.4.6 (Ubuntu)
< Date: Fri, 13 Mar 2015 20:33:46 GMT
< Content-Type: application/json; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Status: 200 OK
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-UA-Compatible: chrome=1
< ETag: "561750c34ae7a13fe0c237e9fa9e3fbd"
< Cache-Control: max-age=0, private, must-revalidate
< X-Request-Id: da72f82b-32f9-4e43-8118-9e5122b9ab96
< X-Runtime: 0.025375
< Strict-Transport-Security: max-age=63072000
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
<
* Connection #0 to host my.url.com left intact
{"alive":true,"timestamp":"2015-03-13T20:33:46+00:00","requested_by":"myip"}
我知道很弱，RC4-SHA不应该使用，但这就是为什么我想用我的服务器测试拒绝。
Nginx 中设置的允许密码如下：
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
DHE-RSA-AES128-GCM-SHA256
DHE-DSS-AES128-GCM-SHA256
kEDH+AESGCM
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-RSA-AES128-SHA256
DHE-RSA-AES128-SHA
DHE-DSS-AES128-SHA256
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA
DHE-RSA-AES256-SHA
AES128-GCM-SHA256
AES256-GCM-SHA384
AES128-SHA256
AES256-SHA256
AES128-SHA
AES256-SHA
AES
CAMELLIA
DES-CBC3-SHA
!aNULL
!eNULL
!EXPORT
!DES
!RC4
!MD5
!PSK
!aECDH
!EDH-DSS-DES-CBC3-SHA
!EDH-RSA-DES-CBC3-SHA
!KRB5-DES-CBC3-SHA
为什么将算法更改为TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA？它不应该只是拒绝连接吗？
这是我正在使用的 cURL 版本：
curl -V
curl 7.37.1 (x86_64-apple-darwin14.0) libcurl/7.37.1 SecureTransport zlib/1.2.5
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IPv6 Largefile NTLM NTLM_WB SSL libz
编辑：在 OS X 中使用Apple 的安全传输层--ciphers时，该选项似乎被忽略了。