I would like to remove support for TLS 1.1 from my endpoints but want to make sure that TLS 1.1 is not being used by any clients to connect to the endpoints (so I can work with those users to update). We are using an F5 in our colos and ELBs in AWS for TLS termination. Is the way to determine what protocols and cipher suites are actually being used for connections?

  • I am not the most familiar with the F5 feature set, but I would first check to see if the F5 provides some sort of logging statistics for this information. If not, your best bet is to record your TLS handshakes over a period of time, and to examine those to determine if there are any TLS1.1 connections being made. – Dan Landberg Mar 26 '19 at 21:41
  • 1
    I like to use tls-hello-dump for passive sniffing of ciphers github.com/ge0rg/tls-hello-dump – eckes Mar 26 '19 at 23:31

For AWS ELB, you can enable access logs to AWS S3 and get the TLS version and cipher suite for each request: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

In my experience, TLS1.1 is never used, TLS1.0 is used by bots (that also send a User Agent strings masquerading as real browsers). But your user base might be different.


Yes Rick, you can use nmap(https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html) for this or even the openssl command line tool.

  • 1
    Hi camp0, Please re-read the original question. It's not a question about what ciphers are supported by the server, but what ciphers are actually being used by clients. – Dan Landberg Mar 26 '19 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.