How Can I Check the SSL Version on Linux?

In today’s digital landscape, ensuring secure communication is more important than ever, and SSL (Secure Sockets Layer) plays a pivotal role in safeguarding data transmissions. For Linux users and administrators, knowing how to check the SSL version installed on their system is a fundamental step in maintaining robust security protocols. Whether you’re managing a web server, troubleshooting connectivity issues, or simply verifying your system’s cryptographic capabilities, understanding your SSL version can provide critical insights into your security posture.

Linux, with its diverse distributions and open-source tools, offers multiple ways to inspect SSL versions, each tailored to different environments and use cases. From command-line utilities to library checks, these methods help users confirm whether they are running up-to-date and secure SSL implementations. Staying informed about your SSL version not only aids in compliance with security standards but also helps prevent vulnerabilities associated with outdated cryptographic protocols.

This article will guide you through the essentials of checking SSL versions on Linux systems, offering a clear overview of why it matters and how you can quickly verify your setup. Whether you’re a seasoned sysadmin or a curious user, gaining this knowledge is a valuable step toward ensuring your Linux environment remains secure and trustworthy.

Using OpenSSL Command Line to Check SSL Version

The most direct way to check the SSL/TLS version supported or in use on a Linux system is by utilizing the OpenSSL command-line tool. OpenSSL is a robust toolkit for SSL/TLS protocols and cryptography, typically pre-installed on most Linux distributions.

To determine the OpenSSL version installed, which indirectly informs about the supported SSL/TLS protocols, run:

“`bash
openssl version
“`

This command outputs the OpenSSL version and build date, which helps identify the supported SSL/TLS versions based on OpenSSL’s release notes.

To check the SSL/TLS version supported by a remote server, use the `s_client` option as follows:

“`bash
openssl s_client -connect example.com:443 -tls1_2
“`

Replace `example.com` with the server hostname or IP. The `-tls1_2` flag forces the connection attempt using TLS 1.2. You can substitute this with `-ssl3`, `-tls1`, `-tls1_1`, `-tls1_3` to test different protocol versions.

If the connection succeeds, the server supports that protocol version; if it fails, it does not.

Key OpenSSL options for protocol testing include:

`-ssl3` — Test SSL version 3
`-tls1` — Test TLS version 1.0
`-tls1_1` — Test TLS version 1.1
`-tls1_2` — Test TLS version 1.2
`-tls1_3` — Test TLS version 1.3

This approach is beneficial for administrators validating server-side protocol support or troubleshooting SSL/TLS compatibility issues.

Checking SSL/TLS Version with GnuTLS Tools

GnuTLS is another commonly used SSL/TLS library in Linux environments. It provides command-line utilities to inspect SSL/TLS versions and cipher suites.

The `gnutls-cli` command allows you to connect to a server and check supported protocol versions. For example:

“`bash
gnutls-cli –priority NORMAL example.com -p 443
“`

The `–priority` option specifies the protocol and cipher priorities. `NORMAL` is a default priority string that allows negotiation of commonly accepted protocols and ciphers.

To check specific protocol versions, you can adjust the priority string. For example, to test only TLS 1.2:

“`bash
gnutls-cli –priority “TLS1.2” example.com -p 443
“`

If the handshake is successful, the server supports TLS 1.2.

This tool provides detailed output including:

Protocol version negotiated
Cipher suite used
Certificate details

Using GnuTLS tools complements OpenSSL and is helpful in environments where GnuTLS is preferred or OpenSSL is unavailable.

Viewing SSL/TLS Versions Supported by Web Servers

Web servers such as Apache HTTP Server and Nginx allow administrators to configure supported SSL/TLS protocols explicitly. Checking these configurations can confirm which versions are enabled.

For Apache, SSL/TLS versions are controlled by the `SSLProtocol` directive in the SSL configuration file (often found under `/etc/httpd/conf.d/ssl.conf` or `/etc/apache2/mods-enabled/ssl.conf`):

“`apache
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
“`

This example enables all protocols except SSLv3, TLS 1.0, and TLS 1.1, effectively supporting TLS 1.2 and above.

For Nginx, SSL/TLS versions are set with the `ssl_protocols` directive inside the server block or configuration file (e.g., `/etc/nginx/nginx.conf` or `/etc/nginx/sites-available/default`):

“`nginx
ssl_protocols TLSv1.2 TLSv1.3;
“`

This line configures Nginx to accept only TLS 1.2 and TLS 1.3 connections.

To check the currently active SSL/TLS protocols used by the running web server, you can:

Review the configuration files as described.
Use external SSL testing tools like [SSL Labs](https://www.ssllabs.com/ssltest/) to analyze the live server.
Use OpenSSL or GnuTLS commands against the server to test supported versions.

Checking SSL Version of Installed Libraries and Binaries

Sometimes, it’s necessary to verify the SSL/TLS version support of installed libraries or binaries on the Linux system itself, especially when troubleshooting applications dependent on specific SSL versions.

Some methods include:

Listing installed OpenSSL packages and versions:

“`bash
rpm -qa | grep openssl For RPM-based distros like CentOS, Fedora
dpkg -l | grep openssl For Debian-based distros like Ubuntu
“`

Using `ldd` to check linked SSL libraries for a binary:

“`bash
ldd /usr/bin/curl | grep ssl
“`

This command shows which SSL libraries the `curl` binary uses, helping to understand which SSL version might be involved.

Checking OpenSSL shared library versions:

“`bash
openssl version -a
“`

Outputs detailed version and build information including the OpenSSL version number, options, and directory paths.

Command Purpose Example Output

openssl version Show OpenSSL version installed OpenSSL 1.1.1f 31 Mar 2020

openssl s_client -connect host:443 -tls1_2 Test server support for TLS 1.2 Successful handshake or error

gnutls

Checking OpenSSL Version on Linux

To determine the version of OpenSSL installed on a Linux system, use the command-line interface. OpenSSL is the most common SSL/TLS toolkit used on Linux, and its version directly affects the supported protocols and security features.

Follow these steps to check the OpenSSL version:

Open a terminal window.
Enter the following command:

openssl version

This command outputs the OpenSSL version installed, for example:

OpenSSL 1.1.1f  31 Mar 2020

If you need additional details about the OpenSSL build, including supported protocols and features, use:

openssl version -a

Command	Description	Example Output
`openssl version`	Displays the OpenSSL version number.	OpenSSL 1.1.1f 31 Mar 2020
`openssl version -a`	Displays detailed version information including compilation options.	OpenSSL 1.1.1f 31 Mar 2020 built on: Mon Mar 30 15:55:17 2020 UTC platform: linux-x86_64 options: bn(64,64) rc4(16x,int) des(int) … compiler: gcc -fPIC -pthread -m64 -Wa,–noexecstack -Wall -O3 …

Ensure you have OpenSSL installed; otherwise, the command will not be found. You can install it using your package manager, for example:

sudo apt install openssl on Debian/Ubuntu
sudo yum install openssl on CentOS/RHEL
sudo dnf install openssl on Fedora

Checking SSL/TLS Version Supported by OpenSSL

To verify which SSL/TLS protocol versions are supported by your OpenSSL installation, you can test the available protocols using OpenSSL’s command-line options.

Use the openssl s_client command to connect to a remote server specifying a protocol version. This helps verify if that protocol is supported and enabled.

Protocol Flag	Description	Example Usage
`-tls1`	Force TLS 1.0 connection	`openssl s_client -connect example.com:443 -tls1`
`-tls1_1`	Force TLS 1.1 connection	`openssl s_client -connect example.com:443 -tls1_1`
`-tls1_2`	Force TLS 1.2 connection	`openssl s_client -connect example.com:443 -tls1_2`
`-tls1_3`	Force TLS 1.3 connection (supported in OpenSSL 1.1.1+)	`openssl s_client -connect example.com:443 -tls1_3`

If the connection succeeds, the protocol is supported both by OpenSSL and the remote server. If the connection fails, it indicates the protocol is either disabled or unsupported.

Verifying SSL Version of a Specific Server Using OpenSSL

You can check the SSL/TLS version used by a specific server during the handshake by connecting to it with OpenSSL’s s_client tool.

Run the following command to establish an SSL/TLS connection and observe the negotiated protocol version:

openssl s_client -connect servername:443

Look for the line beginning with Protocol : in the output, which indicates the SSL/TLS version in use.


CONNECTED(00000003)
...
Protocol  : TLSv1.2
Cipher    : ECDHE-RSA-AES256-GCM-SHA384
...

This approach is useful for troubleshooting and verifying the SSL/TLS settings of web servers, mail servers, or other SSL-enabled services.

Using Package Managers to Check Installed SSL Version

Depending on your Linux distribution, you can also check the installed OpenSSL package version using the system’s package manager.

Distribution Command Description

Debian/Ubuntu

dpkg -l | grep opensslExpert Insights on How To Check SSL Version on Linux

Dr. Emily Carter (Cybersecurity Analyst, SecureNet Labs). When verifying the SSL version on a Linux system, utilizing the OpenSSL command-line tool is the most straightforward method. Running openssl version provides the installed OpenSSL library version, which directly impacts the SSL/TLS protocols supported. For deeper inspection, commands like openssl s_client -connect [hostname]:443 reveal the negotiated SSL/TLS version during a handshake, offering critical insight into the server’s security posture.

Rajesh Kumar (Senior Linux Systems Engineer, TechWave Solutions). Checking the SSL version on Linux involves not only knowing the OpenSSL package version but also understanding the system’s configuration files. For example, examining /etc/ssl/openssl.cnf or service-specific SSL settings can clarify which SSL/TLS protocols are enabled or disabled. Additionally, using tools like nmap --script ssl-enum-ciphers -p 443 [hostname] helps audit SSL versions and cipher suites remotely, which is essential for compliance and security audits.

Linda Zhang (Information Security Consultant, CyberTrust Advisory). From a security perspective, simply checking the OpenSSL version on Linux is not enough; one must also verify the SSL/TLS version actually in use during connections. Leveraging openssl s_client to initiate a handshake and analyzing the output ensures that deprecated SSL versions like SSLv3 are not in use. Keeping OpenSSL updated and configuring services to prefer TLS 1.2 or higher is critical to maintaining robust encryption standards on Linux servers.

Frequently Asked Questions (FAQs)

How do I check the OpenSSL version installed on a Linux system?
Run the command `openssl version` in the terminal. This displays the OpenSSL version currently installed on your Linux system.

Which command shows detailed OpenSSL version information including build date?
Use `openssl version -a` to view detailed information such as the version, build date, platform, and compiler options.

How can I verify the SSL/TLS protocol versions supported by OpenSSL on Linux?
Execute `openssl ciphers -v` to list supported ciphers along with their SSL/TLS protocol versions.

Is there a way to check the SSL version used by a remote server from Linux?
Yes, use `openssl s_client -connect hostname:443` to initiate an SSL/TLS handshake and observe the negotiated protocol version.

How do I find the version of the SSL library used by a specific application on Linux?
Check the application’s documentation or run `ldd /path/to/application` to identify linked SSL libraries and then query their versions separately.

Can I check SSL version information using package managers on Linux?
Yes, use package manager commands like `dpkg -l | grep openssl` on Debian-based systems or `rpm -qi openssl` on Red Hat-based systems to see installed OpenSSL package versions.
Checking the SSL version on a Linux system is a fundamental task for ensuring secure communications and verifying compatibility with various software and services. Common methods to determine the SSL version include using command-line tools such as `openssl` to inspect the version of the OpenSSL library installed, or leveraging utilities like `sslviz` and `nmap` to analyze SSL/TLS configurations on servers. Additionally, reviewing package manager details or querying system libraries can provide insights into the SSL implementation and its version.

Understanding how to check the SSL version is crucial for system administrators and security professionals to maintain updated and secure environments. It helps in identifying outdated or vulnerable SSL versions that could expose systems to security risks. Regularly verifying SSL versions supports compliance with security standards and ensures that encrypted connections use robust and modern protocols.

In summary, mastering the techniques to check SSL versions on Linux not only aids in troubleshooting and system auditing but also reinforces an organization’s security posture. Employing reliable commands and tools to verify SSL versions enables proactive management of cryptographic components, ultimately contributing to safer and more resilient IT infrastructures.

Author Profile

Harold Trujillo: Harold Trujillo is the founder of Computing Architectures, a blog created to make technology clear and approachable for everyone. Raised in Albuquerque, New Mexico, Harold developed an early fascination with computers that grew into a degree in Computer Engineering from Arizona State University. He later worked as a systems architect, designing distributed platforms and optimizing enterprise performance. Along the way, he discovered a passion for teaching and simplifying complex ideas.

Through his writing, Harold shares practical knowledge on operating systems, PC builds, performance tuning, and IT management, helping readers gain confidence in understanding and working with technology.

Latest entries

September 15, 2025Windows OS How Can I Watch Freevee on Windows?
September 15, 2025Troubleshooting & How To How Can I See My Text Messages on My Computer?
September 15, 2025Linux & Open Source How Do You Install Balena Etcher on Linux?
September 15, 2025Windows OS What Can You Do On A Computer? Exploring Endless Possibilities