1

I am trying to find out if TLSv1 and TLSv1.2 are disabled, so I am using the following commands:

openssl s_client -showcerts -debug -connect servername:port -tls1
openssl s_client -showcerts -debug -connect servername:port -tls1_1
openssl s_client -showcerts -debug -connect servername:port -tls1_2

I am getting very different outputs. Some of them are generating an error, so I guess the negotiation failed and the connection wasn't established. In other cases, I see some outputs on which the handshake reads 0 bytes and writes 0 bytes, and also it seems to be an error: "write:errno=104". And in other cases, it looks like is connecting with no issues.

However, I am not 100% sure and I need help to identify if the connection were successful. How can I do it? How can I know when a connection has failed or worked?

Some of the outputs I am getting... Please note that I have removed some lines because I am unsure if they include sensible information.

Case 1

I think this one is failing (write:errno=104), but not sure why...

[username@node1 ]$ openssl s_client -showcerts -debug -connect node1:port -tls1
CONNECTED(00000003)
write to 0x21b64d0 [0x21cd6d3] (181 bytes => -1 (0xFFFFFFFFFFFFFFFF))
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1640871716
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)

Case 2

Same here (139889728124816:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1493:SSL alert number 40):

[username@node2 ]$ openssl s_client -showcerts -debug -connect node2:port -tls1
CONNECTED(00000003)
write to 0x1c534d0 [0x1c6a6d3] (181 bytes => 181 (0xB5))
(I removed some lines)
139889728124816:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1493:SSL alert number 40
139889728124816:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1640871912
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)

Case 3

This one is similar to the last one (error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:365):

[username@node2 ]$ openssl s_client -showcerts -debug -connect node2:port -tls1_1
CONNECTED(00000003)
write to 0x23084d0 [0x231f6d3] (181 bytes => 181 (0xB5))
(I removed some lines)
139833724217232:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:365:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1640871957
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)

Case 4

Again, this looks similar to the others (error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70 and error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659):

[username@node1 ~]$ openssl s_client -showcerts -debug -connect node1:port -tls1_1
CONNECTED(00000003)
write to 0x10ee3f0 [0x11055c3] (181 bytes => 181 (0xB5))
(I removed some lines)
140090843924368:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70
140090843924368:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1640872087
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)

Case 5

Finally, I think this one is working:

[username@node1 ~]$ openssl s_client -showcerts -debug -connect node1:port -tls1_2
CONNECTED(00000003)
write to 0xff73f0 [0x100e5c3] (289 bytes => 289 (0x121))
(I removed some lines)
depth=0 C = ES, ST = Madrid, L = Madrid, O = CBEC, OU = cbec IT, CN = blabla.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = ES, ST = Madrid, L = Madrid, O = CBEC, OU = cbec IT, CN = blabla.com
verify return:1
read from 0xff73f0 [0x100a073] (5 bytes => 5 (0x5))
(I removed some lines)
0040 - <SPACES/NULS>
---
Certificate chain
 0 s:/C=ES/ST=Madrid/L=Madrid/O=CBEC/OU=cbec IT/CN=blabla.com
   i:/C=ES/ST=Madrid/L=Madrid/O=CBEC/OU=cbec IT/CN=blabla.com
-----BEGIN CERTIFICATE-----
(I removed some lines)
-----END CERTIFICATE-----
---
Server certificate
subject=/C=ES/ST=Madrid/L=Madrid/O=CBEC/OU=cbec IT/CN=blabla.com
issuer=/C=ES/ST=Madrid/L=Madrid/O=CBEC/OU=cbec IT/CN=blabla.com
---
No client certificate CA names sent
---
SSL handshake has read 1289 bytes and written 631 bytes
---
New, TLSv1/SSLv3, Cipher is AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES128-SHA
    Session-ID: (I removed the line)
    Session-ID-ctx:
    Master-Key: (I removed the line)
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 86400 (seconds)
    TLS session ticket:
    (I removed the lines)
    Start Time: 1640872114
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)

Thank you for your help!!

1

If no cipher was agreed on, then the connection is definitely not successful, i.e. this means a failure

Cipher    : 0000

Also, if the connection was sufficiently successful then openssl s_client is waiting for input (which then gets send to the peer), otherwise it will immediately exit.

Note that openssl s_client considers a connection sufficiently successful even if the certificate validation failed (check Verify return code: - should be 0 on success) because it is self-signed, expired, issued by an untrusted CA ...

Thus only in your last example the connection was sufficiently successful. It failed though to validate the certificate, i.e. a browser would complain here and tools with strict certificate checking (like most tools today by default) would abort the connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.