问题
Is there a command to check the TLS version reuired by a host site. Right now, the only way I know to check is by adjusting the max TLS version of my browser and checking if I can still access the site. However, I suspect there is a more sophisticated way to do this.
回答1:
you can check using following commands
for tls 1.2
openssl s_client -connect www.google.com:443 -tls1_2
for tls 1.1
openssl s_client -connect www.google.com:443 -tls1_1
for tls 1
openssl s_client -connect www.google.com:443 -tls1
If you get the certificate chain and the handshake then the tls version is supported. If you don't see the certificate chain, and something similar to "handshake error" then its not.
回答2:
From https://maxchadwick.xyz/blog/checking-ssl-tls-version-support-of-remote-host-from-command-line:
nmap ssl-enum-ciphers
Another option for checking SSL / TLS version support is nmap. nmap is not typically installed by default, so you’ll need to manually install it. Once installed you can use the following command to check SSL / TLS version support…
$ nmap --script ssl-enum-ciphers -p 443 www.google.com
nmap’s ssl-enum-ciphers script will not only check SSL / TLS version support for all versions (TLS 1.0, TLS 1.1, and TLS 1.2) in one go, but will also check cipher support for each version including giving providing a grade.
回答3:
It seems the most sophisticated way is to check like this for each version:
openssl s_client -connect : -
回答4:
Nmap has very convenient TLS version and ciphersuite checking NSE script. All in one, multiplatform too: https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html
来源：https://stackoverflow.com/questions/40557031/command-prompt-to-check-tls-version-required-by-a-host