40

Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it?

Background:

I have an old VB.NET application running on Windows Server 2008 R2 (64-bit).

It has code like this:

Dim req As New MSXML2.ServerXMLHTTP30
req.open("POST", "https://example.com", False)

From what I've read, ServerHTMLHTTP uses SChannel and you can't control the protocols used at the application level.

Windows Server 2008 R2 should support TLS 1.2, so I suspect the app will just work, but I'd like to verify by connecting to a site which only accepts TLS 1.2.

Improve this question
11
  • Google for "web site tls 1.2 only" gives me fancyssl.hboeck.de
    – paj28
    Commented Jun 23, 2016 at 17:38
  • 7
    would something like this work: ssllabs.com/ssltest/viewMyClient.html
    – schroeder ♦
    Commented Jun 23, 2016 at 17:38
  • @paj28 That site just talks about the justification for requiring 1.2.
    – Riley Major
    Commented Jun 23, 2016 at 17:42
  • 1
    @RileyMajor - That site is TLS 1.2 only. You could read it? Good - your browser supports TLS 1.2 :) If you want to check yourself, use sslscan, testssl, or SSL labs.
    – paj28
    Commented Jun 23, 2016 at 17:54
  • 1
    @Anders "How do I test?" results in answers I don't want (e.g. build your own testing system with openssl). I'm asking for the canonical (existing) tool to test a capability. It's the equivalent of asking how to officially validate HTML, to which a great response would be to use the W3C validator tool. (validator.w3.org) My question here is basically: What's the security community's canonical TLS 1.2 validator tool?
    – Riley Major
    Commented Jun 29, 2016 at 17:56

4 Answers 4

Reset to default
48

The website: https://badssl.com/ supports various versions of TLS using different subdomains, so you can test lots of variations there!

This subdomain and port only supports TLSv1.2

https://tls-v1-2.badssl.com:1012/

This subdomain and port only supports TLSv1.1

https://tls-v1-1.badssl.com:1011/

This subdomain and port only supports TLSv1.0

https://tls-v1-0.badssl.com:1010/

and more. And if that domains disappears for some reason, the source to it is here on Github

Improve this answer
3
  • Do you know of any other sites? These are not available anymore. I'm trying to search but not finding any.
    – dev4life
    Commented Aug 3, 2020 at 19:07
  • 1
    @dev4life - I just checked, and they're still available - Chrome will give you a security error and you have to click the Advanced button, then Proceed to ... link on the page to see the site. Note you can tell Chrome to ignore all cert issues by starting it as detailed here - but be careful to only do this for development, as it could cause you issues otherwise!
    – Brad Parks
    Commented Aug 3, 2020 at 23:35
  • hmm. When I try to load the page, it says page not found. I'm guessing because my work is blocking it. DARN. Thank you though.
    – dev4life
    Commented Aug 7, 2020 at 19:57
16

SSLLabs

As @schroeder pointed out in the comments, this site assesses the client capabilities and reports on them in the response:

https://www.ssllabs.com/ssltest/viewMyClient.html

Disadvantages:

  • The response is designed for human consumption in a browser. It's not crystal clear whether the response requires JavaScript to give a valid response. It appears not to be required, as we were able to show different responses as between a Windows 10 machine running the app and a Windows Server 2008 R2 server running the app.
  • The site doesn't allow a POST; it requires a GET. Our app could be configured either way, but some might not.
  • The site won't require TLS 1.2 in a way which emulates the behavior of sites which do.

FancySSL

As @paj28 pointed out in the comments, this site will only work if TLS 1.2 is available:

https://fancyssl.hboeck.de/

Disadvantages:

Result

Unfortunately, our app did not work seamlessly on Windows 2008 R2. Trying the FancySSL site, it got this error:

The handle is in the wrong state for the requested operation

Trying the SSLLabs site, it got these results:

  • TLS 1.2: No
  • TLS 1.1: No
  • TLS 1.0: Yes*
  • SSL 3: Yes*
  • SSL 2: No

(*) Without JavaScript, this test reliably detects only the highest supported protocol.

When we run the same app on a Windows 10 or Windows Server 2012 R2, the app doesn't encounter the error and SSLLabs reports TLS 1.2 as available.

Another option I discovered:

https://www.howsmyssl.com/

Improve this answer
2
  • I think the response at the SSL Labs site may be based on the request's User-Agent header.
    – paulmelnikow
    Commented Jan 20, 2019 at 14:07
  • Hostname lookup for fancyssl.hboeck.de failed: No address found
    – rogerdpack
    Commented Feb 21, 2020 at 14:12
6

@paj28 appears to have pointed us in a good direction:

openssl s_server -tls1_2

You can launch an emulated TLS server and connect to it from your client. I'm not sure what settings you would need, or what, exactly, connecting would tell you, but it is a good, lightweight, and local resource you might be able to use for your needs.

https://www.openssl.org/docs/manmaster/man1/s_server.html

Improve this answer
4
  • Thanks. That looks like it would work, but it's more effort than I wanted to put in. I was able to verify there was a problem with the website you referenced.
    – Riley Major
    Commented Jun 27, 2016 at 18:42
  • Typing in 25 characters more effort than the alternative? I'm obviously doing something wrong spending 2 days trying to isolate performance issues in schannel's PFS algorithms.
    – symcbean
    Commented Nov 14, 2018 at 21:28
  • @symcbean Apparently you also need to create certificate files, so this answer is not self-contained.
    – Christian
    Commented Apr 3, 2019 at 13:17
  • This site has comprehensive documentation on how to do this which I found useful in a closed environment: superhero.ninja/2015/07/22/…
    – EdGruberman
    Commented Jul 18, 2019 at 17:59
0

The best example is the NIST web:

www.nist.gov

https://www.ssllabs.com/ssltest/analyze.html?d=www.nist.gov&s=2406%3ada00%3aff00%3a0%3a0%3a0%3a36f3%3a7090&latest

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    128
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH secp256r1 (eq. 3072 bits RSA)   FS
Improve this answer
4
  • 1
    This is just a public site that happens to only support 1.2. All the other answers provide stable, testing sites, not just a single site.
    – schroeder ♦
    Commented Apr 3, 2019 at 13:36
  • I know, but it's difficult to find a sample of a site that ONLY AND JUST ONLY supports 1.2 . Deppends on clients it's difficult to test that the client uses tls for that version and not others provided for the site (1.0, 1.1..)
    – Azimuts
    Commented Apr 4, 2019 at 12:52
  • All of the other answers provide a solution to this: create your own or use one of the testing sites designed for this type of testing. The danger of an answer listing a specific public site is that there could be tons of potential other sites that satisfy this requirement. Or this one specific site might change their configuration. A more general or generic answer would be far more helpful.
    – schroeder ♦
    Commented Apr 8, 2019 at 20:38
  • 1
    NIST is stable in one useful way: they'll never go back to supporting <= TLS 1.1, because they also publish NIST SP 800-52 Rev. 2, which requires federal entities (like themselves) to use TLS 1.2 at minimum. So, if your goal is to convince somebody to upgrade their system to support TLS 1.2, it can be a useful link to throw at them for multiple reasons :)
    – Dominic Scheirlinck
    Commented May 13, 2020 at 6:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .