This has nothing to do with TLS itself yet. Initially, the client needs to create a TCP connection to the server. Note that most of what I say here is also true for SSL, which is mainly the earlier name for the same protocol family now known as TLS. To understand what need to be checked to be really sure it is better to have at least a basic understanding of how the TLS-Handshake works. Checking if a server has really TLS 1.0 disabled is not that simple. But you cannot be sure that the server does not support TLS 1.0 if this attempt fails.Īs you already realized the information given in the link you cite are at least partly wrong. You can be sure that the server supports TLS 1.0 if you get a successful connection with TLS 1.0. TL TR: It is far from trivial to verify from the client that a server is not supporting TLS 1.0. How do I interpret the output from openssl? Did I successfully disable TLS1.0 with the config above or since it says 'CONNECTED' in both output, I didn't disable it and I'll fail the security scan again? Verify return code: 21 (unable to verify the first certificate) New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA SSL handshake has read 2121 bytes and written 357 bytes

Server Temp Key: ECDH, secp521r1, 521 bits Verify error:num=21:unable to verify the first certificate (Output from TLS1.0 enabled) openssl s_client -connect localhost:8443 -tls1

If I allow Tomcat to use TLS1.0, I still see CONNECTED but I also see the certificate info. However, as you can see the messages above, it says both even though I configured Tomcat to use TLS1.2.

The link said if the protocol is enabled, it will say 'Connected', else 'handshake failure'. SSL handshake has read 7 bytes and written 0 bytes I found a link that gave me commands to use to check if a specific protocol is used/enabled. Due to a security scan, I was told to not use TLS1.0.

Test tls 1.2 server 2008