I am scanning IPs (owned by my company) to determine which servers still support TLS 1.0, with the goal being to identify them and disable TLS 1.0 support.
I'm wondering if someone could weigh in on my methods of testing as I'm getting mixed results.
When using http://www.serversniff.net/tools/httpstlscheck.php - it returns that TLS 1.0 is NOT enabled:
Checking protocols sslv2, sslv3, tlsv1, tlsv1.1, tlsv1.2
sslv2 server does not support sslv2
sslv3 server does not support sslv3
tlsv1 server does not support tlsv1
tlsv1.1 server does not support tlsv1.1
tlsv1.2 server does support tlsv1.2
When using the command openssl s_client -connect x.x.x.x:443 -tls1 it connects, and shows what appears to be a valid TLS 1.0 connection:
SSL handshake has read 3418 bytes and written 315 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
No ALPN negotiated
Protocol : TLSv1
Cipher : ECDHE-RSA-AES256-SHA
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1532456238 Timeout : 7200 (sec)
Verify return code: 0 (ok)
Finally, when testing in IE, I can uncheck "Use TLS 1.1" and "Use TLS 1.2" and only have "Use TLS 1.0" checked. I can make a connection to the site (after restarting IE) in this way.
I am safe to assume that my openssl test is correct, and that the serversniff.net results are incorrect?