With the recent news about a new OpenSSL vulnerability (affecting 1.0.2 only), I'm looking to conduct some research and I was wondering if there was an way to identify what version of OpenSSL a server is running (without using Nmap). Ideally, I'd like to use OpenSSL itself to identify the server version.

Is there any way that s_client with other params can be used to force a server to throw out the version in use? Maybe key renegotiation?


  • There isn't a built in feature for that for security reasons I assume. What about trying to invoke/test the specific vulnerability in that version? – Silverfox Feb 2 '16 at 14:24

There is nothing like a "TLS stack type and version" in the TLS specification. OpenSSL by itself has also no kind of non-standard feature which allows you to ask a server for the version. Thus you don't get such explicit information on the protocol level. You might try to guess the version based on behavior changes or specific ciphers which only exist since a specific OpenSSL version, but it is unlikely that you get a very specific result this way.

You might also get a version inside the Server header of the HTTP server, i.e. something like Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0.e. But this can easily be faked.

On the other hand I doubt that it is useful at all to remotely get the OpenSSL version. At least this can not be used to find out if the server is affected by a specific security issue. Fixes for security issues usually get backported by the distributor and thus it might still be some OpenSSL 1.0.2e but it contains the security fixes (but not the features) from later versions.

| improve this answer | |
  • I thought that this would be the case. The issue there is that a lot of servers will have software and versions hidden. I suppose certain Nmap scripts can cover what I need but then again, there is no way to verify that Nmap's findings are correct. Thanks for the information. – Sevaara Feb 2 '16 at 14:35
  • @Sevaara: again - it is probably irrelevant which version the server has. It is relevant if the bugs are fixed or not. It is also important if the server supports specific features, but this not only depends on the version of the TLS stack but also on the server settings. – Steffen Ullrich Feb 2 '16 at 14:39
  • The best approach is to SSH into the box to get the version built or package used to install the binary. – deed02392 Jan 9 '19 at 12:06

Banners can be easily faked. However if a server answers with AES-GCM and TLS1.2 you know you got a pretty new OpenSSL on the other end. I would use nmap's ssl-cipher-enum plugin to determine what protocols and ciphers are available, and map those back to the versions that support them.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.