I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?

The website is still in development so not visible outside our organization - which means presumably I can't use any of the public websites that would normally be recommended for this purpose (such as http://www.serversniff.net/content.php?do=ssl) since they wouldn't have access to the site. We're completely a Windows setup so I can't use unix-based tools like openssl. I have tried downloading and running SSLDigger, but the report that produced simply gave certificate details and listed the cyphers supported, without as far as I can see any mention of which SSL versions were supported. So I'm now out of ideas :(

  • 2
    I can implement that easily, and add it to TestSSLServer. I'll try to remember to do this tonight. Oct 11 '12 at 15:51

OpenSSL does support Windows. You can download it hehe.

This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL).

The command is as follows:

openssl s_client -connect localhost:443 -ssl2

EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!

  • Isn't that a unix command which I therefore can't use on Windows? (Certainly, trying it just gives 'not recognized as an internal or external command') Oct 11 '12 at 15:31
  • 2
    Have you navigated to the directory that contains OpenSSL or added it to your PATH? Or have you even installed it? slproweb.com/products/Win32OpenSSL.html
    – Fredefl
    Oct 11 '12 at 15:33
  • Ah, no, you're right, I hadn't realised it was a package you could install. I'll go do it... Oct 11 '12 at 16:06
  • Note that recent Linux distributions tend to deactivate support for SSLv2 in their OpenSSL package (e.g. on Ubuntu 12.04), so this command with "-ssl2" may no longer work in the future, depending on whether the packager for the Windows builds decides to follow the trend or not. Nov 5 '12 at 1:49

TestSSLServer is a tool (that I wrote) which can report some data about a SSL/TLS server. The new version (published 10 minutes ago !) supports SSLv2: for the tested server, it will tell you whether SSL 2.0 is supported, and, if yes, will list the supported cipher suites.

The new version also reports the server certificate (thumbprint and SubjectDN) and it has been ported to C#/.NET, for people who, for some reason, do not wish to install Java but are OK with .NET.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.