Auditing tools like
report that SSL v3 is disabled on www.google.com (as you'd expect; with the security flaws that have been discovered in SSL v3, a company like Google isn't going to forget to turn it off).
But then, how come when I connect to it with openssl and grep the output for "ssl":
openssl s_client -state -connect www.google.com:443 | grep -i "ssl"
the output references SSLv3 multiple times?
SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=1 /C=US/O=Google Trust Services/CN=Google Internet Authority G3 verify error:num=20:unable to get local issuer certificate verify return:0 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A SSL handshake has read 2450 bytes and written 447 bytes New, TLSv1/SSLv3, Cipher is AES128-SHA SSL-Session:
I do see the reference to "TLSv1/SSLv3". I've heard that "TLS uses SSL certificates" although I don't understand the details, but does that mean that this connection is using the TLS protocol but using SSLv3 certificates, and that's why I see all the references to SSLv3 even though we're not using the SSLv3 protocol?
(I assume this is more of a conceptual question than a programming question which is why I'm posting it here instead of Stack Overflow.)
SSL -Session:which you did not post, the line for
Protocol:tells the protocol version that was negotiated. You can also specify the exact version to negotiate with
-tls1_2in OpenSSL 1.0.1 up) and see them fail and succeed respectively.