I am scanning IPs (owned by my company) to determine which servers still support TLS 1.0, with the goal being to identify them and disable TLS 1.0 support.
I'm wondering if someone could weigh in on my methods of testing as I'm getting mixed results.
When using http://www.serversniff.net/tools/httpstlscheck.php - it returns that TLS 1.0 is NOT enabled:
Checking protocols sslv2, sslv3, tlsv1, tlsv1.1, tlsv1.2
sslv2 server does not support sslv2
sslv3 server does not support sslv3
tlsv1 server does not support tlsv1
tlsv1.1 server does not support tlsv1.1
tlsv1.2 server does support tlsv1.2
When using the command openssl s_client -connect x.x.x.x:443 -tls1 it connects, and shows what appears to be a valid TLS 1.0 connection:
SSL handshake has read 3418 bytes and written 315 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1
Cipher : ECDHE-RSA-AES256-SHA
Session-ID: BE04A17FD209D42326FC2AC4DFB9456BBD3BFA89AACF4C8A614C3B
Session-ID-ctx:
Master-Key
14177405E2C3D11DB8E63dBA5AC179D26B1E8EA838EC2E309D3AD2CBE0C57DBB4B179854EBB6CCE86A9D50
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1532456238
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Finally, when testing in IE, I can uncheck "Use TLS 1.1" and "Use TLS 1.2" and only have "Use TLS 1.0" checked. I can make a connection to the site (after restarting IE) in this way.
I am safe to assume that my openssl test is correct, and that the serversniff.net results are incorrect?
s_clientdoesn't send by default, though using SNI for version would be really odd. I'd try ssllabs.com/ssltest as a tiebreaker -- Ristic has a good reputation for getting things right.