현재 운영중인 웹서버의 보안 SSL의 TSL 버전이 몇인지 간단하게 테스트 하는 방법
1. openssl 명령어로 확인 openssl s_client -connect www.xinet.kr:443
|
1 |
openssl s_client -connect www.xinet.kr:443 |
결과갑 중간 체크해보면
|
1 2 3 4 5 6 7 8 9 10 11 12 |
SSL handshake has read 4908 bytes and written 394 bytes Verification error: unable to get local issuer certificate --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 20 (unable to get local issuer certificate) --- |
2. 다른 웹서버도 체크
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
[root@xinet ~]# openssl s_client -connect ssl2019.xinet.kr:443 CONNECTED(00000003) depth=1 C = US, O = Let's Encrypt, CN = R3 verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = ssl2019.xinet.kr verify return:1 --- Certificate chain 0 s:CN = ssl2019.xinet.kr i:C = US, O = Let's Encrypt, CN = R3 1 s:C = US, O = Let's Encrypt, CN = R3 i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 --- --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA Server Temp Key: ECDH, P-384, 384 bits --- SSL handshake has read 3412 bytes and written 476 bytes Verification error: unable to get local issuer certificate --- New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 3072 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: |
위 버전은 TSL 1.2 를 사용하고 있음
그럼 tls 1.3을 지원하는 웹서버에 tls 1.2도 지원하는지 테스트 / w
|
1 2 3 4 5 6 7 8 9 10 11 12 |
[root@xinet ~]# openssl s_client -connect www.xinet.kr:443 -tls1_2 CONNECTED(00000003) depth=2 OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 |
지원이 되면 정상적으로 통신 체크 완료
만약 tls 1.1을 테스트 하고 싶다면
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
[root@xinet ~]# openssl s_client -connect www.xinet.kr:443 -tls1_1 CONNECTED(00000003) 140035563018048:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:ssl/record/rec_layer_s3.c:1536:SSL alert number 70 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 125 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1638930535 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- |
해당서버는 tls 1.1를 지원하지 않는다.