I am scanning IPs (owned by my company) to determine which servers still support TLS 1.0, with the goal being to identify them and disable TLS 1.0 support.

I'm wondering if someone could weigh in on my methods of testing as I'm getting mixed results.

When using http://www.serversniff.net/tools/httpstlscheck.php - it returns that TLS 1.0 is NOT enabled:

Checking protocols sslv2, sslv3, tlsv1, tlsv1.1, tlsv1.2
sslv2 server does not support sslv2
sslv3 server does not support sslv3
tlsv1 server does not support tlsv1
tlsv1.1 server does not support tlsv1.1
tlsv1.2 server does support tlsv1.2

When using the command openssl s_client -connect x.x.x.x:443 -tls1 it connects, and shows what appears to be a valid TLS 1.0 connection:

SSL handshake has read 3418 bytes and written 315 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Protocol : TLSv1
Session-ID: BE04A17FD209D42326FC2AC4DFB9456BBD3BFA89AACF4C8A614C3B
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1532456238 Timeout : 7200 (sec)

Verify return code: 0 (ok)

Finally, when testing in IE, I can uncheck "Use TLS 1.1" and "Use TLS 1.2" and only have "Use TLS 1.0" checked. I can make a connection to the site (after restarting IE) in this way.

I am safe to assume that my openssl test is correct, and that the serversniff.net results are incorrect?

  • Probably, although if you are testing from inside (logically, including a VPN) or possibly certain preferred locations/networks, it could be serversniff's path to the server goes through a WAF or IPS or similar but yours doesn't. It's also conceivable the server is using SNI, which s_client doesn't send by default, though using SNI for version would be really odd. I'd try ssllabs.com/ssltest as a tiebreaker -- Ristic has a good reputation for getting things right. Jul 25, 2018 at 3:12

1 Answer 1


Assuming the serversniff.com showing incorrect results for this. OpenSSL, when compared to ssllabs, checked out ok.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .