1

Which version of TLS is being used here?

A Wireshark capture of a TLS session initiation

1 Answer 1

4

Look at ServerHello message, in its extensions, does it have a "supported_versions" extension? In that, the server indicates TLS1.3. If it's not present then it's TLS1.2. See the RFC.

5
  • 1
    TLS 1.3 can only be engaged if the client indicated support for it in the "supported_versions" extension in ClientHello. If one side requires exactly TLS1.2 and the other side requires exactly TLS1.3, the connection will not be established at all.
    – Z.T.
    Commented Jun 29, 2022 at 6:13
  • Interesting! So default is always 1.2, if not otherwise stated. Thanks! (sorry i deleted my previous comment because I found the answer in the RFC - thanks!)
    – Oliver
    Commented Jun 29, 2022 at 6:13
  • 2
    TLS1.3 changed the version negotiation mechanism, but had to allow for TLS1.2 clients to connect to servers that support both TLS1.2 and TLS1.3, and also had to support old middleboxes that don't allow TLS1.3 clients to send a ClientHello that is too different from TLS1.2. "new version intolerance" and bad middleboxes have plagued TLS since the beginning.
    – Z.T.
    Commented Jun 29, 2022 at 6:16
  • 1
    As an alternative to looking at the ServerHello, you can just take Wireshark at its word. Wireshark does all this for you. E.g., Wireshark tells you it is "TLS 1.3 Record Layer." If it was TLS 1.2 Wireshark would say "TLS 1.2 Record Layer."
    – hft
    Commented Jun 30, 2022 at 18:08
  • 1
    @Oliver I would not call 1.2 the "default." What happened in TLS 1.3 is that the designers wanted to ensure compatibility with middleboxes that would try to force TLS 1.2. So the "version" bytes unfortunately do not really specify the TLS version anymore.
    – hft
    Commented Jun 30, 2022 at 18:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .