Check SSL/TLS Versions and Ciphers: openssl, sslscan, testssl

Check SSL/TLS Versions and Ciphers: openssl, sslscan, testssl

Monitor SSL TLS version and security settings to track TLS versions, detect weak ciphers, and ensure secure SSL configuration. This guide shows you how to monitor SSL TLS security and set up automated monitoring.

For comprehensive SSL monitoring, see SSL Certificate Monitoring. For troubleshooting SSL issues, see SSL Certificate Expired.

Why Monitoring SSL TLS Security Matters

SSL TLS security is critical for protecting data in transit. Weak TLS versions or insecure ciphers can expose data to security risks. Monitoring SSL TLS security ensures secure communication and compliance.

Method 1: Check TLS Version with openssl

Test TLS Version Support

# Test TLS 1.2 support
echo | openssl s_client -connect example.com:443 -tls1_2 2>/dev/null | grep "Protocol"

# Test TLS 1.3 support
echo | openssl s_client -connect example.com:443 -tls1_3 2>/dev/null | grep "Protocol"

# Check supported TLS versions
for version in -ssl2 -ssl3 -tls1 -tls1_1 -tls1_2 -tls1_3; do
  echo -n "$version: "
  echo | openssl s_client -connect example.com:443 $version 2>/dev/null | grep -q "Protocol" && echo "Supported" || echo "Not supported"
done

Check TLS Cipher Suites

# List supported cipher suites
openssl s_client -connect example.com:443 -cipher 'ALL' 2>/dev/null | grep "Cipher"

# Test specific cipher
openssl s_client -connect example.com:443 -cipher 'ECDHE-RSA-AES256-GCM-SHA384' 2>/dev/null | grep "Cipher"

Method 2: Check SSL Configuration

Analyze SSL Configuration

# Check SSL configuration with sslscan
sslscan example.com:443

# Check SSL with testssl.sh
testssl.sh example.com

# Check TLS version with nmap
nmap --script ssl-enum-ciphers -p 443 example.com

Method 3: Automated SSL TLS Monitoring with Zuzia.app

Checking by hand tells you the state right now. Zuzia checks from outside, around the clock, with nothing installed on the server.

How it works in Zuzia

• Add a URL, a TCP port or a DNS record with the value you expect. The first check runs within about 30 seconds.
• Websites can be checked as often as once a minute, from agents in Poland, New York and Singapore. Zuzia records the HTTP status code and response time of every check.
• Zuzia warns you 14, 7 and 3 days before an SSL certificate expires, and does the same for the domain registration.
• Alerts go by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account). A public status page or an embeddable widget shows your client the same uptime you see.

Setting it up

1. In the Zuzia dashboard, add the URL, port or DNS record.
2. Choose the check interval and your notification channels.
3. Optionally create a status page or a widget for the client.

For the checks in this guide that run on the server itself, install the Zuzia agent and save those commands as a scheduled task.

Best Practices for SSL TLS Monitoring

1. Monitor TLS Versions Continuously

• Track supported TLS versions regularly
• Alert when weak TLS versions detected
• Ensure TLS 1.2+ is supported
• Disable old TLS versions

2. Monitor Cipher Suites

• Track cipher suite configuration
• Alert on weak ciphers
• Ensure strong ciphers are used
• Update cipher configuration

3. Set Up Comprehensive Alerts

• Configure alerts for weak TLS versions
• Set up alerts for weak ciphers
• Monitor certificate expiration
• Alert on SSL configuration changes

4. Maintain Security Compliance

• Meet security compliance requirements
• Document SSL TLS configuration
• Maintain security audit trails
• Report security incidents

Troubleshooting SSL TLS Issues

Step 1: Identify SSL Problems

When SSL TLS issues are detected:

# Check TLS version support
echo | openssl s_client -connect example.com:443 2>/dev/null | grep "Protocol"

# Check cipher suites
openssl s_client -connect example.com:443 2>/dev/null | grep "Cipher"

# Check certificate
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -text

Step 2: Resolve SSL Issues

Based on investigation:

1. Update TLS Configuration:

   • Disable old TLS versions
   • Enable TLS 1.2+
   • Update cipher suites

2. Fix Certificate Issues:

   • Renew expired certificates
   • Fix certificate configuration
   • Update certificate chain

3. Improve SSL Security:

   • Implement security best practices
   • Update SSL configuration
   • Monitor SSL security continuously

FAQ: Common Questions About SSL TLS Monitoring

How often should I check SSL TLS security?

For production servers, continuous automated monitoring is essential. Zuzia.app can check SSL TLS security every 30-60 minutes, storing historical data and alerting you when security issues are detected.

What TLS versions should I support?

Support TLS 1.2 and TLS 1.3. Disable TLS 1.0, TLS 1.1, SSL 2.0, and SSL 3.0 as they are insecure. Monitor TLS version support continuously.

How do I improve SSL TLS security?

Improve SSL TLS security by disabling old TLS versions, using strong cipher suites, keeping certificates updated, implementing security best practices, and monitoring SSL security continuously.

Can SSL monitoring impact server performance?

SSL monitoring commands have minimal impact on server performance when done correctly. Use appropriate monitoring frequency and avoid monitoring during peak traffic periods.

Related guides, recipes, and problems

• Related guides

  • guides--monitoring-ssl.md
  • guides--server-security-audit-complete-guide.md

• Related recipes

  • recipes--monitoring-ssl.md
  • recipes--ssl-certificate-expiration-monitoring.md

• Related problems

  • problems--expired-ssl-certificate.md
  • problems--weak-ssh-configuration-security-risk.md