66

Is there a command to check the TLS version required by a host site? Right now, the only way I know to check is by adjusting the max TLS version of my browser and checking if I can still access the site. However, I suspect there is a more sophisticated way to do this.

2
  • 1
    Test it at ssllabs.
    – user207421
    Nov 11, 2016 at 23:26
  • 1
    Not command line, but Firefox can tell you the Technical Details of the encryption level when you go to Padlock->More Information->Security. (I don't know whether it's necessary to allow the particular TLS version before it will tell you what it is.)
    – mwfearnley
    Jan 16 at 11:36

5 Answers 5

117

You can check using following commands.

For TLS 1.2:

openssl s_client -connect www.google.com:443 -tls1_2

For TLS 1.1:

openssl s_client -connect www.google.com:443 -tls1_1

For TLS 1:

openssl s_client -connect www.google.com:443 -tls1

If you get the certificate chain and the handshake then the TLS version is supported. If you don't see the certificate chain, and something similar to "handshake error" then its not.

5
  • 1
    How we can check it in windows servers? Sep 23, 2019 at 4:21
  • 1
    @DarshanaPatel You can connect to any server with that command, or if you want to use that command you can install OpenSSL for Windows
    – golimar
    Sep 28, 2021 at 7:24
  • I've had mixed results with this. An API being tested with this method did not report a certificate with 1.1, but did with 1.2. Hinting at 1.1 not being supported. Yet with curl below, using 1.1 downloaded the site content/landing page. Not sure why openssl results didn't match curl. An aside, curl was inline with the online tools offering similar checks.
    – Niall
    May 31 at 17:49
  • 1
    For TLS 1.3 use -tls3 at the end.
    – Shayan
    Jul 28 at 0:14
  • 1
    @Shayan -tls1_3
    – Camille G.
    Nov 15 at 12:12
57

From https://maxchadwick.xyz/blog/checking-ssl-tls-version-support-of-remote-host-from-command-line:

nmap ssl-enum-ciphers

Another option for checking SSL / TLS version support is nmap. nmap is not typically installed by default, so you’ll need to manually install it. Once installed you can use the following command to check SSL / TLS version support…

nmap --script ssl-enum-ciphers -p 443 www.google.com

nmap’s ssl-enum-ciphers script will not only check SSL / TLS version support for all versions (TLS 1.0, TLS 1.1, and TLS 1.2) in one go, but will also check cipher support for each version including giving providing a grade.

4
  • 3
    This is way better than guess-and-check with openssl.
    – Sinjai
    Apr 21, 2021 at 19:41
  • 3
    This is otherwise good but this script doesn't support TLS 1.3. Aug 9, 2021 at 11:45
  • 5
    Seems that they recently added support for 1.3: github.com/nmap/nmap/issues/1348
    – golimar
    Sep 28, 2021 at 7:35
  • fantastic answer, and preferred over the one that is accepted
    – ericdain
    Aug 2 at 0:32
7

I like to use curl which can report a TLS version negotiation quite nicely.

For example, this tries to connect with TLS 1.1, which the server negotiates to upgrade to 1.2:

$ curl -Iiv --tlsv1.1 https://example.com
*   Trying 192.168.205.11:443...
* TCP_NODELAY set
* Connected to example.com (192.168.205.11) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
[...]

To forbid that the server upgrades the TLS version use the --tls-max option:

$ curl -Iiv --tlsv1.1 --tls-max 1.1 https://example.com
*   Trying 192.168.205.11:443...
* TCP_NODELAY set
* Connected to example.com (192.168.205.11) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS alert, internal error (592):
* error:141E70BF:SSL routines:tls_construct_client_hello:no protocols available
* Closing connection 0
curl: (35) error:141E70BF:SSL routines:tls_construct_client_hello:no protocols available

In this case, the connection fails because the client does not offer any TLS version above 1.1, but the server does not accept any version below 1.2 (no protocols available). If used like this, the output is very similar to the openssl_client output.

0

Nmap has very convenient TLS version and ciphersuite checking NSE script. All in one, multiplatform too: https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html

0

testssl.sh (download site) produces a report similar to the SSLLabs one, the report includes information about the supported TLS versions. To speed things up, you can use the -p (--protocols) flag to only test the supported TLS versions.

One specific case where I've found testssl.sh (and local command line tools in general) useful is when testing a server before it goes "live". The SSLLabs online test takes a hostname, resolves it to IP addresses, and tests each IP address. This requires my server to already have a DNS entry. With testssl.sh I can test a single server by its IP address:

./testssl.sh -p --ip 123.123.123.123 https://example.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.