2

How can I check currently installed and in use versions of SSL and TLS? Strangely I couldn't find an answer online. Using Ubuntu 18.04.

Edit: Thanks all! I am asking this as I have trouble connecting from one ubuntu 18.04 server running curl to another with ftps server (vsftp). I get version error every time no meter which TLS version I ran curl with.

  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • error:1408F10B:SSL routines:ssl3_get_record:wrong version number
  • Closing connection 0
  • The version which a webserver or your web browser uses can be checked at ssllabs.com This is only useful for (graphical) web browsers and if you have a webserver. – Oskar Skog Jan 29 at 15:10
  • 3
    Each application in your system can be linked to a specific "SSL" library or even do everything internally (foolish but technically possible). So as is your question is too vague/broad. The answers show you a way to see what is installed regarding "SSL" (and there are multiple libraries) but that does not guarantee in any way you do not have other software doing other things, nor does it gives you a clear picture of what versions are "in use" because the versions are negotiated during the connections (the TLS handshake). You may wish to expand your motivations behind your question. – Patrick Mevzek Jan 29 at 22:08
  • Thanks Partic, I've added the specifics. – kroov Jan 30 at 8:20
  • Belongs to your edit: When using curl you can specify a TLS version. For example: --tlsv1 would be a downgrade and should work on old systems. But from your output, you got already a successful TLS handshake. It seems like the vsftp has a wrong configuration somewhere, so look for errors there first. – nieg Feb 3 at 10:50
6

You can check the installed package version with dpkg -l | grep -i openssl. The actual TLS/SSL version used depends on what the server offers or what is negotiated between server and client in any given session.

  • 2
    Please consider adding the phrase "in session" to your second sentence to make it clear that version is also a property of the SSL/TLS session. – DannyNiu Jan 29 at 13:20
3

Assuming you are using the default openssl implementation, you can query it directly:

$ openssl version
OpenSSL 1.1.1  11 Sep 2018

or more verbosely

$ openssl version -a
OpenSSL 1.1.1  11 Sep 2018
built on: Tue Nov 12 16:58:35 2019 UTC
platform: debian-amd64
options:  bn(64,64) rc4(16x,int) des(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-kxN_24/openssl-1.1.1=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
Seeding source: os-specific

For more options, see openssl version -help

3

There isn't a single answer:

  • Firefox uses NSS to provide SSL/TLS
  • A number of other programs use GnuTLS
  • Still others use OpenSSL.

And none of this tells you what version of SSL or TLS is actually in use, it just provides limits on what's available. For any given connection, the client and server negotiate a specific version of SSL/TLS and specific ciphers, based on what they've got in common and on any priority lists or application-specific rules that have been configured.

Assuming you've been keeping up with your updates, your software probably supports TLS 1.0, 1.1, and 1.2. Support for SSL 2.0 and 3.0 should be absent (they're both hopelessly obsolete with significant security issues). SSL 1.0 was so badly broken it never got out of the lab. Your browser probably supports TLS 1.3, but may have it disabled due to compatibility issues; it's unlikely that other software does (the big push for TLS 1.3 support took place in late 2018).

1

If you're using gnutls you can query it with:

$ certutil -v
certtool 3.6.7
Copyright (C) 2000-2019 Free Software Foundation, and others, all rights reserved.
This is free software. It is licensed for use, modification and
redistribution under the terms of the GNU General Public License,
version 3 or later <http://gnu.org/licenses/gpl.html>


Please send bug reports to:  <bugs@gnutls.org>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.