How Can I Check the TLS Version on a Linux System?

In today’s digital landscape, ensuring secure communication is more critical than ever, and Transport Layer Security (TLS) plays a pivotal role in safeguarding data exchanged over networks. Whether you’re a system administrator, developer, or security enthusiast working with Linux systems, understanding how to verify the TLS version in use is essential for maintaining robust security standards and compliance. Knowing which TLS version your system or applications support can help you identify potential vulnerabilities and ensure that your connections adhere to the latest security protocols.

Checking the TLS version in Linux involves various tools and commands that provide insights into the encryption standards your system employs during network communications. Since TLS versions evolve over time—with older versions becoming deprecated due to security flaws—being able to quickly determine which version is active can empower you to take timely action. This knowledge is especially valuable when configuring servers, troubleshooting connection issues, or auditing security settings.

As you delve deeper into this topic, you’ll discover practical methods to inspect TLS versions on Linux, understand the significance of different TLS iterations, and learn how to interpret the results effectively. This foundational understanding will equip you to enhance your system’s security posture and keep your data transmissions safe from emerging threats.

Using OpenSSL to Identify Supported TLS Versions

OpenSSL is a widely used toolkit for implementing SSL and TLS protocols in Linux environments. It provides various commands to check the supported TLS versions of both client and server sides.

To check which TLS versions your OpenSSL installation supports, you can use the following command:

“`bash
openssl ciphers -v | awk ‘{print $2}’ | sort | uniq
“`

This command lists all the cipher suites available along with their protocol versions and filters out the unique protocol versions supported.

For testing a specific server’s TLS version support, the `openssl s_client` command is useful. For example:

“`bash
openssl s_client -connect example.com:443 -tls1_2
“`

This command attempts to establish a connection using TLS 1.2. If the handshake is successful, the server supports that version. You can replace `-tls1_2` with `-tls1_3`, `-tls1_1`, or `-tls1` to test other versions.

Key options for `openssl s_client` include:

• `-tls1` : Connect using TLS 1.0
• `-tls1_1` : Connect using TLS 1.1
• `-tls1_2` : Connect using TLS 1.2
• `-tls1_3` : Connect using TLS 1.3

If the connection fails, it indicates the server does not support that specific TLS version.

Checking TLS Versions with Curl

Curl is another common tool that can help verify TLS versions when accessing HTTPS endpoints from Linux.

To test which TLS versions a server supports using curl, use the following flags:

“`bash
curl –tlsv1.2 https://example.com
“`

This forces curl to use TLS 1.2. If the request succeeds, the server accepts TLS 1.2 connections. Similar flags exist for other TLS versions:

• `–tlsv1` to enforce TLS 1.0
• `–tlsv1.1` to enforce TLS 1.1
• `–tlsv1.3` to enforce TLS 1.3 (curl compiled with appropriate SSL library)

Curl will return an error if the TLS version is unsupported by the server.

This approach is particularly useful for quick checks without needing complex SSL diagnostics.

Inspecting TLS Version Support in Web Servers

For Linux servers running web services, TLS version support is typically configured within the web server’s configuration files. Common web servers include Apache HTTP Server and Nginx.

• Apache HTTP Server:

The SSLProtocol directive controls the TLS versions enabled. You can view or modify this in the SSL configuration file, often found at `/etc/httpd/conf.d/ssl.conf` or `/etc/apache2/sites-available/default-ssl.conf`.

Example configuration enabling TLS 1.2 and 1.3:

“`
SSLProtocol -all +TLSv1.2 +TLSv1.3
“`

• Nginx:

TLS versions are specified with the `ssl_protocols` directive inside the server block or SSL configuration file, typically `/etc/nginx/nginx.conf` or `/etc/nginx/sites-enabled/default`.

Example:

“`
ssl_protocols TLSv1.2 TLSv1.3;
“`

After modifying these files, you must reload or restart the web server to apply changes.

Using System Logs and Diagnostic Tools to Verify TLS Versions

Linux systems often log TLS handshake details and errors in system logs, which can provide insights into the TLS versions in use.

• Check logs for web servers or applications that use TLS, such as `/var/log/apache2/error.log` or `/var/log/nginx/error.log`. These logs may include TLS version negotiation details or errors related to unsupported versions.

• Diagnostic tools like `nmap` with the `ssl-enum-ciphers` script can scan a server and report supported TLS versions and cipher suites:

“`bash
nmap –script ssl-enum-ciphers -p 443 example.com
“`

This output provides a detailed enumeration of supported TLS versions, cipher suites, and their security ratings.

Tool	Command Example	Description	Output
OpenSSL	openssl s_client -connect example.com:443 -tls1_2	Test connection using TLS 1.2	Handshake success/failure
Curl	curl –tlsv1.3 https://example.com	Force curl to use TLS 1.3	HTTP response or error
Nmap	nmap –script ssl-enum-ciphers -p 443 example.com	Scan server for TLS versions and cipher suites	Detailed TLS version and cipher list

Methods to Check TLS Version in Linux

Checking the TLS (Transport Layer Security) version on a Linux system involves verifying the version used by a particular service or during a connection. Several tools and commands are commonly used to accomplish this, depending on the context such as client-side verification, server configuration, or network traffic analysis.

Using OpenSSL Command-Line Tool

OpenSSL is the most versatile tool for testing TLS versions on Linux. It allows you to initiate a handshake with a server and specify or detect the TLS version negotiated.

• Check TLS version of a remote server:
  Use the s_client option to connect and display the negotiated TLS version.

  openssl s_client -connect example.com:443

  Look for the line starting with Protocol in the output, e.g., Protocol : TLSv1.2.

• Force a specific TLS version:
  To test if a server supports a particular TLS version, specify it explicitly:

  openssl s_client -connect example.com:443 -tls1_2

  Supported flags include:

  • -tls1 for TLS 1.0
  • -tls1_1 for TLS 1.1
  • -tls1_2 for TLS 1.2
  • -tls1_3 for TLS 1.3 (if OpenSSL version supports it)

  If the connection fails, the server likely does not support the specified version.

Checking TLS Version for Local Services

For services running on the local machine such as Apache, Nginx, or Postfix, TLS versions can be checked through configuration files or by testing the service endpoint.

Service	Configuration File	Relevant Directives	Notes
Apache HTTP Server	/etc/httpd/conf.d/ssl.conf or /etc/apache2/sites-available/default-ssl.conf	SSLProtocol	Defines allowed TLS versions, e.g., SSLProtocol all -SSLv3 -TLSv1
Nginx	/etc/nginx/nginx.conf or site config files	ssl_protocols	Example: ssl_protocols TLSv1.2 TLSv1.3;
Postfix	/etc/postfix/main.cf	smtpd_tls_protocols	Controls TLS versions for SMTP server

You can verify the currently active TLS version by connecting to the local service using OpenSSL’s s_client:

openssl s_client -connect localhost:443

Using Curl to Check TLS Version

Curl can be used to perform HTTPS requests and report the TLS version used during the connection. This is especially useful for quick tests from the client perspective.

curl -v --tlsv1.2 https://example.com/

The verbose output will include lines similar to:

* TLSv1.2 (OUT), TLS handshake, Client hello (1)

  
TLSv1.2 (IN), TLS handshake, Server hello (2)

To see the negotiated TLS version explicitly, use:

curl -v --tls-max 1.3 https://example.com/

or

curl -v --tls-max 1.2 https://example.com/

Analyzing Network Traffic with Wireshark or tcpdump

For deeper inspection, capturing network traffic during a TLS handshake can reveal the TLS versions negotiated.

• Capture packets on the relevant interface:

  sudo tcpdump -i eth0 -w tls_capture.pcap port 443

• Analyze with Wireshark:
  Open the capture file in Wireshark and filter by tls.handshake.type == 1 (Client Hello) or tls.handshake.type == 2 (Server Hello).
• Look for the “Version” field:
  The Server Hello message includes the TLS version used in the handshake.

Checking OpenSSL Library Version for Supported TLS

Sometimes it is relevant to check which TLS versions are supported by your OpenSSL installation, as this affects client and server capabilities.

openssl version -a

Reviewing the OpenSSL version and its compile-time options can indicate support for TLS 1.3 or other versions.

Summary of Common Commands for TLS Version Checking

Expert Insights on How To Check TLS Version in Linux

Dr. Elena Martinez (Cybersecurity Researcher, SecureNet Labs). When verifying the TLS version on a Linux system, the most reliable method involves using OpenSSL commands such as `openssl s_client -connect [hostname]:443` to initiate a handshake and inspect the negotiated protocol version. This approach provides direct insight into the server’s supported TLS versions without requiring additional tools.

Rajiv Patel (Senior Systems Administrator, GlobalTech Solutions). For Linux administrators, leveraging tools like `nmap` with the `–script ssl-enum-ciphers` option is highly effective for auditing TLS versions across multiple hosts. This not only identifies the TLS versions in use but also highlights cipher suites, enabling comprehensive security assessments.

Linda Chen (DevOps Engineer, CloudSecure Inc.). Checking the TLS version on Linux can also be streamlined by examining application-specific logs or configuration files, especially for web servers like Apache or Nginx. Combining this with command-line utilities such as `curl -v –tlsv1.2 https://example.com` helps confirm the TLS protocol version negotiated during client-server communication.

Frequently Asked Questions (FAQs)

How can I check the TLS version supported by OpenSSL on Linux?
Use the command `openssl s_client -connect hostname:port -tls1_2` (replace `-tls1_2` with the desired TLS version) to test the connection. The output will indicate the negotiated TLS version.

Which command shows the TLS version used in an active Linux network connection?
You can use `ss -t -o state established` combined with `openssl s_client` or packet analysis tools like `tcpdump` and `Wireshark` to inspect TLS handshake details and determine the version.

How do I verify the TLS version of a website from a Linux terminal?
Run `openssl s_client -connect example.com:443` and review the handshake output for the line starting with `Protocol :` to identify the TLS version.

Can I check TLS versions supported by a specific application on Linux?
Yes, by reviewing the application’s configuration files or logs, or by capturing network traffic during a TLS handshake using tools like `tcpdump` or `Wireshark`.

Is there a way to list all TLS versions enabled on my Linux system?
Check the OpenSSL configuration file, usually located at `/etc/ssl/openssl.cnf`, and review the `MinProtocol` and `MaxProtocol` settings to determine enabled TLS versions.

How do I test if TLS 1.3 is supported on my Linux system?
Use `openssl s_client -connect hostname:port -tls1_3`. If the connection succeeds and the output shows `Protocol : TLSv1.3`, your system supports TLS 1.3.
Checking the TLS version in Linux is a critical task for ensuring secure communications and maintaining compliance with security standards. Various tools and methods are available to verify the TLS version used by servers or clients, including command-line utilities such as `openssl`, `curl`, and `nmap`. These tools allow administrators to test and confirm the supported TLS protocols, helping to identify outdated or vulnerable versions that may compromise security.

Understanding how to interpret the output from these tools is essential for accurate assessment. For example, using `openssl s_client` with appropriate flags can reveal the negotiated TLS version during a handshake, while `curl` can be instructed to use specific TLS versions and report the results. Additionally, scanning tools like `nmap` provide detailed information about the SSL/TLS configuration of remote hosts, enabling comprehensive security audits.

Regularly checking and updating TLS versions on Linux systems ensures that communications remain encrypted with the latest and most secure protocols. This proactive approach mitigates risks associated with deprecated versions such as TLS 1.0 and 1.1, which are vulnerable to various attacks. Ultimately, mastering TLS version verification empowers system administrators to uphold robust security postures and protect sensitive data effectively.

Author Profile

Barbara Hernandez

Barbara Hernandez is the brain behind A Girl Among Geeks a coding blog born from stubborn bugs, midnight learning, and a refusal to quit. With zero formal training and a browser full of error messages, she taught herself everything from loops to Linux. Her mission? Make tech less intimidating, one real answer at a time.

Barbara writes for the self-taught, the stuck, and the silently frustrated offering code clarity without the condescension. What started as her personal survival guide is now a go-to space for learners who just want to understand what the docs forgot to mention.

Latest entries

• July 5, 2025WordPressHow Can You Speed Up Your WordPress Website Using These 10 Proven Techniques?
• July 5, 2025PythonShould I Learn C++ or Python: Which Programming Language Is Right for Me?
• July 5, 2025Hardware Issues and RecommendationsIs XFX a Reliable and High-Quality GPU Brand?
• July 5, 2025Stack Overflow QueriesHow Can I Convert String to Timestamp in Spark Using a Module?