16

Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it?

Background:

I have an old VB.NET application running on Windows Server 2008 R2 (64-bit).

It has code like this:

Dim req As New MSXML2.ServerXMLHTTP30
req.open("POST", "https://example.com", False)

From what I've read, ServerHTMLHTTP uses SChannel and you can't control the protocols used at the application level.

Windows Server 2008 R2 should support TLS 1.2, so I suspect the app will just work, but I'd like to verify by connecting to a site which only accepts TLS 1.2.

  • Google for "web site tls 1.2 only" gives me fancyssl.hboeck.de – paj28 Jun 23 '16 at 17:38
  • 6
    would something like this work: ssllabs.com/ssltest/viewMyClient.html – schroeder Jun 23 '16 at 17:38
  • @paj28 That site just talks about the justification for requiring 1.2. – Riley Major Jun 23 '16 at 17:42
  • 1
    @RileyMajor - That site is TLS 1.2 only. You could read it? Good - your browser supports TLS 1.2 :) If you want to check yourself, use sslscan, testssl, or SSL labs. – paj28 Jun 23 '16 at 17:54
  • 1
    @Anders "How do I test?" results in answers I don't want (e.g. build your own testing system with openssl). I'm asking for the canonical (existing) tool to test a capability. It's the equivalent of asking how to officially validate HTML, to which a great response would be to use the W3C validator tool. (validator.w3.org) My question here is basically: What's the security community's canonical TLS 1.2 validator tool? – Riley Major Jun 29 '16 at 17:56
12

SSLLabs

As @schroeder pointed out in the comments, this site assesses the client capabilities and reports on them in the response:

https://www.ssllabs.com/ssltest/viewMyClient.html

Disadvantages:

  • The response is designed for human consumption in a browser. It's not crystal clear whether the response requires JavaScript to give a valid response. It appears not to be required, as we were able to show different responses as between a Windows 10 machine running the app and a Windows Server 2008 R2 server running the app.
  • The site doesn't allow a POST; it requires a GET. Our app could be configured either way, but some might not.
  • The site won't require TLS 1.2 in a way which emulates the behavior of sites which do.

FancySSL

As @paj28 pointed out in the comments, this site will only work if TLS 1.2 is available:

https://fancyssl.hboeck.de/

Disadvantages:

Result

Unfortunately, our app did not work seamlessly on Windows 2008 R2. Trying the FancySSL site, it got this error:

The handle is in the wrong state for the requested operation

Trying the SSLLabs site, it got these results:

  • TLS 1.2: No
  • TLS 1.1: No
  • TLS 1.0: Yes*
  • SSL 3: Yes*
  • SSL 2: No

(*) Without JavaScript, this test reliably detects only the highest supported protocol.

When we run the same app on a Windows 10 or Windows Server 2012 R2, the app doesn't encounter the error and SSLLabs reports TLS 1.2 as available.


Another option I discovered:

https://www.howsmyssl.com/

  • I think the response at the SSL Labs site may be based on the request's User-Agent header. – paulmelnikow Jan 20 at 14:07
9

The website: https://badssl.com/ supports various versions of TLS using different subdomains, so you can test lots of variations there!

This subdomain and port only supports TLSv1.2

https://tls-v1-2.badssl.com:1012/

This subdomain and port only supports TLSv1.1

https://tls-v1-1.badssl.com:1011/

This subdomain and port only supports TLSv1.0

https://tls-v1-0.badssl.com:1010/

and more. And if that domains disappears for some reason, the source to it is here on Github

6

@paj28 appears to have pointed us in a good direction:

openssl s_server -tls1_2

You can launch an emulated TLS server and connect to it from your client. I'm not sure what settings you would need, or what, exactly, connecting would tell you, but it is a good, lightweight, and local resource you might be able to use for your needs.

https://www.openssl.org/docs/manmaster/man1/s_server.html

  • Thanks. That looks like it would work, but it's more effort than I wanted to put in. I was able to verify there was a problem with the website you referenced. – Riley Major Jun 27 '16 at 18:42
  • Typing in 25 characters more effort than the alternative? I'm obviously doing something wrong spending 2 days trying to isolate performance issues in schannel's PFS algorithms. – symcbean Nov 14 '18 at 21:28
  • @symcbean Apparently you also need to create certificate files, so this answer is not self-contained. – Christian Apr 3 at 13:17
  • This site has comprehensive documentation on how to do this which I found useful in a closed environment: superhero.ninja/2015/07/22/… – EdGruberman 5 hours ago
-1

The best example is the NIST web:

www.nist.gov

https://www.ssllabs.com/ssltest/analyze.html?d=www.nist.gov&s=2406%3ada00%3aff00%3a0%3a0%3a0%3a36f3%3a7090&latest

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    128
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    
  • This is just a public site that happens to only support 1.2. All the other answers provide stable, testing sites, not just a single site. – schroeder Apr 3 at 13:36
  • I know, but it's difficult to find a sample of a site that ONLY AND JUST ONLY supports 1.2 . Deppends on clients it's difficult to test that the client uses tls for that version and not others provided for the site (1.0, 1.1..) – Azimuts Apr 4 at 12:52
  • All of the other answers provide a solution to this: create your own or use one of the testing sites designed for this type of testing. The danger of an answer listing a specific public site is that there could be tons of potential other sites that satisfy this requirement. Or this one specific site might change their configuration. A more general or generic answer would be far more helpful. – schroeder Apr 8 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.