I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?

The website is still in development so not visible outside our organization - which means presumably I can't use any of the public websites that would normally be recommended for this purpose (such as http://www.serversniff.net/content.php?do=ssl) since they wouldn't have access to the site. We're completely a Windows setup so I can't use unix-based tools like openssl. I have tried downloading and running SSLDigger, but the report that produced simply gave certificate details and listed the cyphers supported, without as far as I can see any mention of which SSL versions were supported. So I'm now out of ideas :(

  • 2
    I can implement that easily, and add it to TestSSLServer. I'll try to remember to do this tonight. Commented Oct 11, 2012 at 15:51

2 Answers 2


OpenSSL does support Windows. You can download it hehe.

This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL).

The command is as follows:

openssl s_client -connect localhost:443 -ssl2

EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!

  • Isn't that a unix command which I therefore can't use on Windows? (Certainly, trying it just gives 'not recognized as an internal or external command') Commented Oct 11, 2012 at 15:31
  • 2
    Have you navigated to the directory that contains OpenSSL or added it to your PATH? Or have you even installed it? slproweb.com/products/Win32OpenSSL.html
    – Fredefl
    Commented Oct 11, 2012 at 15:33
  • Ah, no, you're right, I hadn't realised it was a package you could install. I'll go do it... Commented Oct 11, 2012 at 16:06
  • Note that recent Linux distributions tend to deactivate support for SSLv2 in their OpenSSL package (e.g. on Ubuntu 12.04), so this command with "-ssl2" may no longer work in the future, depending on whether the packager for the Windows builds decides to follow the trend or not. Commented Nov 5, 2012 at 1:49

TestSSLServer is a tool (that I wrote) which can report some data about a SSL/TLS server. The new version (published 10 minutes ago !) supports SSLv2: for the tested server, it will tell you whether SSL 2.0 is supported, and, if yes, will list the supported cipher suites.

The new version also reports the server certificate (thumbprint and SubjectDN) and it has been ported to C#/.NET, for people who, for some reason, do not wish to install Java but are OK with .NET.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .