I would like to remove support for TLS 1.1 from my endpoints but want to make sure that TLS 1.1 is not being used by any clients to connect to the endpoints (so I can work with those users to update). We are using an F5 in our colos and ELBs in AWS for TLS termination. Is the way to determine what protocols and cipher suites are actually being used for connections?
For AWS ELB, you can enable access logs to AWS S3 and get the TLS version and cipher suite for each request: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
In my experience, TLS1.1 is never used, TLS1.0 is used by bots (that also send a User Agent strings masquerading as real browsers). But your user base might be different.
Yes Rick, you can use nmap(https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html) for this or even the openssl command line tool.