How Can I Check the SSL/TLS Version on a Linux System?

AvatarByHarold Trujillo Linux & Open Source

In today’s digital landscape, ensuring secure communication between systems is more important than ever. SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols play a critical role in encrypting data transmitted over networks, safeguarding sensitive information from prying eyes. For Linux users and administrators, understanding how to check the SSL/TLS version in use is essential not only for maintaining security compliance but also for troubleshooting connectivity and compatibility issues.

Whether you’re managing a web server, configuring email services, or simply verifying the security posture of your Linux environment, knowing which SSL/TLS versions are active can help you identify outdated protocols that may expose your systems to vulnerabilities. The process involves using various command-line tools and utilities that provide insights into the cryptographic protocols negotiated during secure connections. By mastering these techniques, you can ensure your Linux systems adhere to modern security standards and avoid potential risks associated with deprecated SSL/TLS versions.

This article will guide you through the fundamental concepts behind SSL and TLS versions on Linux, highlighting why it’s crucial to monitor them regularly. Without diving into the technical steps just yet, you’ll gain a clear understanding of the importance of protocol version verification and how it fits into the broader context of system security and network integrity. Get ready to enhance your Linux security skills by learning

Using OpenSSL to Check SSL/TLS Version

OpenSSL is a widely used command-line tool for managing SSL/TLS protocols on Linux systems. It allows you to connect to a server and inspect the SSL/TLS handshake, revealing the protocol version in use. This method is especially useful for verifying what SSL/TLS versions a server supports.

To check the SSL/TLS version supported by a remote server, use the following command structure:

“`
openssl s_client -connect :443 -tls1_2
“`

Here, `-connect` specifies the target server and port, and the `-tls1_2` flag forces the connection to use TLS 1.2. By changing the protocol flag, you can test support for different versions:

  • `-ssl3` for SSL 3.0 (rarely supported due to vulnerabilities)
  • `-tls1` for TLS 1.0
  • `-tls1_1` for TLS 1.1
  • `-tls1_2` for TLS 1.2
  • `-tls1_3` for TLS 1.3

If the connection is successful, the server supports the specified version. If it fails, the version is not supported or the connection is blocked.

You can also omit the version flag to allow OpenSSL to negotiate the highest supported version automatically:

“`
openssl s_client -connect :443
“`

Within the command output, look for the line starting with `Protocol :` to identify the negotiated SSL/TLS version.

Checking SSL/TLS Version in Local Services

When assessing SSL/TLS versions in local services such as web servers or mail servers, configuration files often define the minimum and maximum protocol versions allowed. Common Linux servers include Apache, Nginx, and Postfix.

For example, in Apache’s SSL configuration (`ssl.conf` or relevant virtual host file), SSL/TLS versions are controlled by the `SSLProtocol` directive:

“`
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
“`

This configuration disables SSL 3.0, TLS 1.0, and TLS 1.1, allowing only TLS 1.2 and above.

In Nginx, the `ssl_protocols` directive sets the allowed protocols:

“`
ssl_protocols TLSv1.2 TLSv1.3;
“`

To determine which SSL/TLS versions your local service supports, you can:

  • Review the service’s configuration files for protocol directives.
  • Use OpenSSL’s `s_client` to connect locally on the service’s SSL port.
  • Use specialized tools such as `nmap` or `testssl.sh` for a more thorough scan.

Using Nmap to Detect SSL/TLS Versions

Nmap is a powerful network scanning tool that can probe SSL/TLS services to enumerate supported protocol versions and cipher suites. The `ssl-enum-ciphers` script is particularly useful.

Run this command to scan a server:

“`
nmap –script ssl-enum-ciphers -p 443
“`

The output categorizes supported SSL/TLS versions and their corresponding cipher suites, highlighting weak or deprecated protocols.

The following table summarizes typical output elements of the `ssl-enum-ciphers` script:

SSL/TLS Version Supported Key Exchange Encryption Strength
TLSv1.3 Yes ECDHE AES_256_GCM Strong
TLSv1.2 Yes DHE, ECDHE AES_128_GCM Strong
TLSv1.1 No — — —
SSLv3 No — — —

This method is particularly effective for remote servers and can be scripted for regular security audits.

Using testssl.sh for Comprehensive SSL/TLS Analysis

`testssl.sh` is a free, open-source tool designed for deep SSL/TLS testing. It provides detailed information on supported protocol versions, cipher suites, certificate validity, and known vulnerabilities.

To use it, download and run the script against a target server:

“`
./testssl.sh :443
“`

The output is categorized and color-coded, providing an easy-to-read summary of:

  • Supported SSL/TLS protocols (including deprecated ones).
  • Cipher suites with their security ratings.
  • Server certificate details.
  • Vulnerability checks (e.g., Heartbleed, POODLE).

This tool is ideal for administrators who require a thorough understanding of SSL/TLS configurations without manually parsing raw outputs.

Checking SSL/TLS Version with Curl

Curl, commonly used for transferring data, can also be used to check the SSL/TLS version negotiated during a connection. Use the verbose mode with the `–tlsv1.x` options to specify the TLS version.

Example to check TLS 1.2 support:

“`
curl -v –tlsv1.2 https://
“`

The verbose output will include a line such as:

“`

  • TLSv1.2 (OUT), TLS handshake, Client hello (1):

“`

If the connection fails,

Checking SSL/TLS Version Using OpenSSL Command

OpenSSL is a widely used tool for managing SSL/TLS connections and certificates. It allows you to test and determine the supported SSL/TLS versions of a server directly from the Linux command line.

To check the SSL/TLS version supported by a remote server, use the following command structure:

“`bash
openssl s_client -connect : -tls1_2
“`

Replace `` with the target server’s domain or IP address and `` with the SSL-enabled port, typically 443 for HTTPS.

Common OpenSSL TLS Version Flags

TLS Version OpenSSL Flag
SSLv3 `-ssl3`
TLS 1.0 `-tls1`
TLS 1.1 `-tls1_1`
TLS 1.2 `-tls1_2`
TLS 1.3 `-tls1_3`

Example: Checking TLS 1.2 Support

“`bash
openssl s_client -connect example.com:443 -tls1_2
“`

If the connection is successful, OpenSSL will display the certificate details and the negotiated SSL/TLS version. If the server does not support the specified version, the connection will fail with an error.

Step-by-Step Process to Identify Supported TLS Versions

  1. Test SSLv3 support:

“`bash
openssl s_client -connect example.com:443 -ssl3
“`

  1. Test TLS 1.0 support:

“`bash
openssl s_client -connect example.com:443 -tls1
“`

  1. Test TLS 1.1 support:

“`bash
openssl s_client -connect example.com:443 -tls1_1
“`

  1. Test TLS 1.2 support:

“`bash
openssl s_client -connect example.com:443 -tls1_2
“`

  1. Test TLS 1.3 support (available in OpenSSL 1.1.1 and later):

“`bash
openssl s_client -connect example.com:443 -tls1_3
“`

Interpreting the Output

  • Look for the line starting with `Protocol :` to see the negotiated protocol version.
  • A successful handshake indicates support for that SSL/TLS version.
  • If the handshake fails, the server likely does not support that version or has it disabled.

—

Using nmap to Detect SSL/TLS Versions

The `nmap` utility, with its scripting engine, can scan SSL/TLS-enabled services and report supported protocol versions.

Command to Detect SSL/TLS Versions

“`bash
nmap –script ssl-enum-ciphers -p 443 example.com
“`

Explanation

  • `–script ssl-enum-ciphers` runs a script that enumerates supported SSL/TLS versions and cipher suites.
  • `-p 443` specifies the port to scan.
  • Replace `example.com` with the target hostname or IP.

Sample Output Breakdown

Section Description
SSL/TLS Versions Lists TLS versions the server supports.
Cipher Suites Displays ciphers available for each TLS version.
Certificate Info Shows details about the SSL certificate.

This method provides a comprehensive view of the SSL/TLS configuration, including version support and cipher strength.

—

Checking SSL/TLS Version of Local Services

When verifying the SSL/TLS version used by a service running locally (e.g., Apache, Nginx), you can use OpenSSL in combination with the service’s port.

Example for a Local HTTPS Service

“`bash
openssl s_client -connect localhost:443
“`

Review the handshake output for the `Protocol` line to determine the TLS version negotiated.

Using curl for HTTPS Endpoints

“`bash
curl -v –tlsv1.2 https://localhost
“`

  • The `-v` flag enables verbose output.
  • `–tlsv1.2` forces curl to use TLS 1.2.
  • If the connection succeeds, TLS 1.2 is supported by the server.

You can replace `–tlsv1.2` with `–tlsv1.3` or other versions to test support.

—

Verifying SSL/TLS Version in Configuration Files

Sometimes, checking the SSL/TLS version support requires reviewing server configuration files directly.

Common Configuration File Paths

Service Configuration File Location
Apache `/etc/httpd/conf.d/ssl.conf` or `/etc/apache2/sites-enabled/`
Nginx `/etc/nginx/nginx.conf` or `/etc/nginx/sites-enabled/`
Postfix `/etc/postfix/main.cf`
Dovecot `/etc/dovecot/conf.d/10-ssl.conf`

Key Directives to Look For

Service Directive Name Purpose
Apache `SSLProtocol` Specifies enabled SSL/TLS versions.
Nginx `ssl_protocols` Defines supported SSL/TLS versions.
Postfix `smtpd_tls_protocols` TLS versions allowed for SMTP service.
Dovecot `ssl_min_protocol` / `ssl_max_protocol` Minimum and maximum SSL/TLS versions.

Example: Nginx Configuration Snippet

“`nginx
ssl_protocols TLSv1.2 TLSv1.3;
“`

This line restricts the server to only support TLS 1.2 and TLS 1.3.

—

Using sslyze for Comprehensive SSL/TLS Analysis

`sslyze` is a Python-based tool designed to perform in-depth SSL/TLS

Expert Insights on Checking SSL/TLS Versions in Linux

Dr. Elena Martinez (Cybersecurity Analyst, SecureNet Solutions). When verifying SSL/TLS versions on a Linux system, using tools like `openssl s_client` is indispensable. It allows administrators to establish a connection to a server and explicitly inspect the protocol version negotiated during the handshake, ensuring compliance with organizational security policies.

Rajiv Patel (Senior Linux Systems Engineer, CloudWave Technologies). The `nmap` utility with the `–script ssl-enum-ciphers` option provides a comprehensive overview of SSL/TLS versions supported by a remote Linux server. This method is especially useful for auditing and identifying deprecated protocols that could expose systems to vulnerabilities.

Linda Chen (Information Security Consultant, CipherGuard). For real-time monitoring of SSL/TLS versions on Linux, integrating `sslyze` into your workflow offers detailed protocol analysis and cipher suite enumeration. This approach aids in proactive vulnerability management by highlighting outdated or weak TLS versions before they can be exploited.

Frequently Asked Questions (FAQs)

How can I check the SSL/TLS version used by a server in Linux?
You can use the `openssl s_client` command with the `-connect` option followed by the server address and port. For example: `openssl s_client -connect example.com:443`. The output will show the negotiated SSL/TLS version.

Which OpenSSL command helps identify supported TLS versions on a Linux system?
The `openssl ciphers -v` command lists available ciphers along with their corresponding SSL/TLS protocol versions supported by the OpenSSL library on your system.

Is there a way to test specific TLS versions when connecting to a server using OpenSSL?
Yes, you can specify the TLS version using flags like `-tls1_2`, `-tls1_3`, or `-tls1` with `openssl s_client`. For example: `openssl s_client -connect example.com:443 -tls1_2` tests TLS 1.2 support.

How do I verify the TLS version used by a service running locally on Linux?
Use `openssl s_client` to connect to the local service’s port, for example, `openssl s_client -connect localhost:443`. The output will indicate the TLS version negotiated during the handshake.

Can I check TLS versions using tools other than OpenSSL on Linux?
Yes, tools like `nmap` with the `–script ssl-enum-ciphers` option or `sslyze` can scan servers to report supported SSL/TLS versions and cipher suites.

How do I interpret the TLS version information shown in the OpenSSL s_client output?
Look for the line starting with `Protocol :` in the output; it specifies the negotiated SSL/TLS version between the client and server during the handshake.
checking the SSL/TLS version in Linux is a critical task for maintaining secure communications and ensuring compatibility with modern security standards. Various tools such as OpenSSL, GnuTLS, and specialized utilities like nmap or curl provide effective means to inspect and verify the SSL/TLS versions supported by servers or clients. Utilizing commands like `openssl s_client` or `gnutls-cli` allows administrators to establish connections and observe the negotiated protocol versions in real-time, facilitating proactive security management.

Understanding how to interpret the output of these tools is essential for accurately assessing the security posture of a system. It enables the identification of deprecated or vulnerable protocol versions, such as SSLv3 or early TLS iterations, which should be disabled to prevent potential exploits. Regularly auditing SSL/TLS versions helps organizations comply with industry standards and regulatory requirements, thereby enhancing overall cybersecurity resilience.

Ultimately, mastering the techniques to check SSL/TLS versions on Linux empowers system administrators and security professionals to implement best practices in encryption management. This knowledge supports informed decision-making regarding updates, configuration changes, and the deployment of secure communication channels, ensuring robust protection of sensitive data in transit.

Author Profile

Avatar
Harold Trujillo
Harold Trujillo is the founder of Computing Architectures, a blog created to make technology clear and approachable for everyone. Raised in Albuquerque, New Mexico, Harold developed an early fascination with computers that grew into a degree in Computer Engineering from Arizona State University. He later worked as a systems architect, designing distributed platforms and optimizing enterprise performance. Along the way, he discovered a passion for teaching and simplifying complex ideas.

Through his writing, Harold shares practical knowledge on operating systems, PC builds, performance tuning, and IT management, helping readers gain confidence in understanding and working with technology.