Enabling FIPS Mode (FIPS 140-2) on Splunk. How to determine which ciphers are used?

[adnankhan5133]

We're planning to purchase Splunk (v8.0.6) and Splunk ES (v6.2) shortly, and have a requirement to enable FIPS Mode in order to meet government regulations. We'll be following the directions from this Splunk doc here: https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/SecuringSplunkEnterprisewithFIPs 

Once we're running on FIPS 140-2, how do we determine which cipher is being used?

[sowings]

In general, you don't have to worry about the specific algorithm(s) being used for a TLS connection. By installing Splunk with FIPS mode enabled, you'll be installing FIPS-compliant cryptographic modules. This means that ciphers that are disallowed by FIPS won't be an option in the negotiation process that occurs between client and server during the TLS handshake. If you'd like to see which ciphers are available, you can use the openssl "ciphers" command (splunk cmd openssl ciphers) to see which are available on your system. Testing a connection to another node (say, a UF to an indexer), you can use openssl s_client to see which cipher suite was negotiated by client and server. Splunk configuration allows you to require certain strength or disallow certain ciphers, see this section of docs for details: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#SSL.2FTLS_Configuration_details