. My email:
. Bill@billbennett.com
My company web site:
. My company email:
. Marketing@billbennett.
Can you see TLS version in Wireshark?
I'm wondering whether it is possible to see the version of TLS being used (and possibly the SSL version, but I'm not sure whether that's actually possible). In this case, we're talking about a very large website (over one million hits per day) using HTTPS. The certificate is provided by a Let's Encrypt certificate.
I know that Wireshark can show the certificate, but I'm not sure how to filter for specific bits. Wireshark will capture all traffic going to a web server, and you will see all the encrypted communication going over TCP. In other words, if your client sends requests to a web server, Wireshark will see those requests and the encrypted responses from the web server.
There are many ways to filter the traffic to the web server. Here are a couple of possibilities: If you want to see what TLS version is being used, you could use TLS Alert messages to filter the traffic to the web server. An alert message is sent by either the client or the server to indicate an error or important event that has occurred.
There is also the tlsincoming.alert value in the capture. This value is set by the client to indicate which TLS Alert messages were sent by the server. You can filter on this value to see if a particular alert was received.
How do you check if TLS 1.2 is on?
I've read the following question: How to check if my OpenSSL/SSL version supports TLS 1.2 on FreeBSD and Linux? My concern is the "answer to see if it works with an open source app" part. I want to see that a connection is made to that address without requiring some app to send something to check against the cert for the server.
I can check for port 443, but not that a given app sent that exact line. Can you help me with an easy command or two for this? EDIT: as suggested in a comment (by @Micky), I tried https instead of http. It worked, but now it shows errors if that site has mixed content. This makes it hard to verify if it really did work.
EDIT 2: it's possible that openssl is connecting for now. That is why you needed to specify an invalid port, you were missing the HTTP header and content-length headers that you would normally get when telneting to an HTTP server.
When using HTTPS, you should look at the certificate in the handshake that OpenSSL presents the client. If it is there, that means that OpenSSL negotiated TLS 1. If not, TLS 1.2 was not negotiated.
