Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?

The website is still in development so not visible outside our organization - which means presumably I can't use any of the public websites that would normally be recommended for this purpose (such as http://www.serversniff.net/content.php?do=ssl) since they wouldn't have access to the site. We're completely a Windows setup so I can't use unix-based tools like openssl. I have tried downloading and running SSLDigger, but the report that produced simply gave certificate details and listed the cyphers supported, without as far as I can see any mention of which SSL versions were supported. So I'm now out of ideas :(

share|improve this question
2  
I can implement that easily, and add it to TestSSLServer. I'll try to remember to do this tonight. – Thomas Pornin Oct 11 '12 at 15:51

2 Answers

up vote 4 down vote accepted

OpenSSL does support Windows. You can download it hehe.

This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL).

The command is as follows:

openssl s_client -connect localhost:443 -ssl2

EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!

share|improve this answer
Isn't that a unix command which I therefore can't use on Windows? (Certainly, trying it just gives 'not recognized as an internal or external command') – PhantomDrummer Oct 11 '12 at 15:31
2  
Have you navigated to the directory that contains OpenSSL or added it to your PATH? Or have you even installed it? slproweb.com/products/Win32OpenSSL.html – Fredefl Oct 11 '12 at 15:33
Ah, no, you're right, I hadn't realised it was a package you could install. I'll go do it... – PhantomDrummer Oct 11 '12 at 16:06
Note that recent Linux distributions tend to deactivate support for SSLv2 in their OpenSSL package (e.g. on Ubuntu 12.04), so this command with "-ssl2" may no longer work in the future, depending on whether the packager for the Windows builds decides to follow the trend or not. – Thomas Pornin Nov 5 '12 at 1:49
Thanks for the heads up @ThomasPornin! :-D – Fredefl Nov 5 '12 at 19:25
up vote 2 down vote

TestSSLServer is a tool (that I wrote) which can report some data about a SSL/TLS server. The new version (published 10 minutes ago !) supports SSLv2: for the tested server, it will tell you whether SSL 2.0 is supported, and, if yes, will list the supported cipher suites.

The new version also reports the server certificate (thumbprint and SubjectDN) and it has been ported to C#/.NET, for people who, for some reason, do not wish to install Java but are OK with .NET.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.