Auditing tools like
https://sslanalyzer.comodoca.com/?url=www.google.com
report that SSL v3 is disabled on www.google.com (as you'd expect; with the security flaws that have been discovered in SSL v3, a company like Google isn't going to forget to turn it off).
But then, how come when I connect to it with openssl and grep the output for "ssl":
openssl s_client -state -connect www.google.com:443 | grep -i "ssl"
the output references SSLv3 multiple times?
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=1 /C=US/O=Google Trust Services/CN=Google Internet Authority G3
verify error:num=20:unable to get local issuer certificate
verify return:0
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
SSL handshake has read 2450 bytes and written 447 bytes
New, TLSv1/SSLv3, Cipher is AES128-SHA
SSL-Session:
I do see the reference to "TLSv1/SSLv3". I've heard that "TLS uses SSL certificates" although I don't understand the details, but does that mean that this connection is using the TLS protocol but using SSLv3 certificates, and that's why I see all the references to SSLv3 even though we're not using the SSLv3 protocol?
(I assume this is more of a conceptual question than a programming question which is why I'm posting it here instead of Stack Overflow.)
SSL -Session:
which you did not post, the line forProtocol:
tells the protocol version that was negotiated. You can also specify the exact version to negotiate with-ssl3
or-tls1
(or-tls1_1
or-tls1_2
in OpenSSL 1.0.1 up) and see them fail and succeed respectively.