Re: Testing the disabling of TLS 1.0

--===============1675220153362058678==
Content-Type: multipart/alternative; boundary="00000000000030f069056c579ab3"

--00000000000030f069056c579ab3
Content-Type: text/plain; charset="UTF-8"

Thank you for your detailed response. I read your blog post. It was
helpful. What I was looking for specifically is after I turn off TLS 1.0 on
my tomcat, I want to be able to fire off an API request using TLS 1.0 and
see it getting rejected. This request is actually from our QA team. They
are asking me how can I test that disabling TLS 1.0 is working. That is why
I was asking if there was a way in postman to set the TLS version so that
it becomes easier to test.

On Wed, May 16, 2018 at 6:43 AM Venkateswara Venkatraman Prasanna <
[email protected]> wrote:

> Ramesh,
>
> Here are couple of things. Disabling TLS1.0 on the website means we we are
> closing some of the weaker and older doors to access the site. Having said
> that to enter more secure protocols like TLS1.1 or TLS1.2 or even TLS1.3
> you need the client to be able to connect to your API/services. So what you
> are doing is Strengthening your service/server. This is perfectly fine and
> most corporations are aggressively adopting to this. This is a standard
> drill that happens once in a while.
>
> While disabling weak protocols, we usually disable the weak Ciphers and
> tend to  add additional stronger Ciphers.If you site is internet facing you
> may go to ssllabs.com and test it for any weak ciphers listed on your
> service endpoint.Strong ciphers will lot depend on the client's ability to
> connect to the server.
>
> I think your concern is clients that are connecting to your API/service
> will stop working. Is that right? If so, the test that you are doing needs
> to consider the clients ability to connect to your site.
>
> This can be done in multiple ways,
> 1. https://www.ssllabs.com/ssltest/clients.html has a list of clients and
> their support for the protocol. You may look into the list and find if your
> client is strong enough to connect to you.
> 2. If you are using a JAVA based client, like a SOAP client then you can
> test the service with simple test program. I usually test it using my
> program to connect to the site and download some static resource like
> image/js or even css to see if JDK is able to connect to the site. I just
> put it on GIST if you want to use it:
> https://gist.github.com/reflexdemon/8499cfb9128546f6e945306e9dd8e01c
> 3. If your endpoint is behind a 2-way SSL setup where you will have to
> connect using your own truststore, then you can test the service using a
> tool that I had written recently (A bit of show off :)).
> https://github.com/reflexdemon/tls-testing-tool.
>
> Some useful troubleshooting tools are openssl and nmap:
>
> 1. OpenSSL command to see the server cert and the protocol supported:
> openssl s_client -showcerts -status -connect website.address.com:port
> 2. Nmap command to list the Ciphers: nmap --script ssl-enum-ciphers  -p
> <port> website.address.com
>
> Have fun with TLS :)
>
> Bonus: I just wrote a blog on TLS and Ciphers that is very much speaking
> about the exact TLS testing.
> https://blog.vpv.io/2018/04/java-ssltls-testing-tool-cipher-suite.html
>
> Regards,
> Venkateswara VP
>
>
>
> On Tue, May 15, 2018 at 11:15 PM koshi jose <[email protected]> wrote:
>
>> Post master should have the explicit content settings in the http, layer
>> to set the tls, however if you are not able to do with postmaster, you can
>> still have your webest vice request go through a Unix OS box, where you can
>> set the tls 2.0 explicitly and then test it.
>>
>> On Tue, May 15, 2018, 10:29 PM Ramesh Kulkarni <
>> [email protected]> wrote:
>>
>>> Hello
>>>
>>> We are disabling TLS 1.0 on our site by end of June (I know it is late
>>> but better late than never). I have seen some links on how to set the TLS
>>> version on the browsers. But I have not found a good resource on how to
>>> test our web services and the rest APIs by explicitly setting the TLS
>>> version? We use Postman for testing our APIs and I could not find a setting
>>> thru which we could set the TLS version. Can anyone guide me on how to test
>>> it?
>>>
>>> Thanks
>>> Ramesh
>>> _______________________________________________
>>> ajug-members mailing list
>>> [email protected]
>>> Manage your subscription and unsubscribe
>>> http://lists.ajug.org/mailman/listinfo/ajug-members
>>
>> _______________________________________________
>> ajug-members mailing list
>> [email protected]
>> Manage your subscription and unsubscribe
>> http://lists.ajug.org/mailman/listinfo/ajug-members
>
> _______________________________________________
> ajug-members mailing list
> [email protected]
> Manage your subscription and unsubscribe
> http://lists.ajug.org/mailman/listinfo/ajug-members

--00000000000030f069056c579ab3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thank you for your detailed response. I read your blog pos=
t. It was helpful. What I was looking for specifically is after I turn off =
TLS 1.0 on my tomcat, I want to be able to fire off an API request using TL=
S 1.0 and see it getting rejected. This request is actually from our QA tea=
m. They are asking me how can I test that disabling TLS 1.0 is working. Tha=
t is why I was asking if there was a way in postman to set the TLS version =
so that it becomes easier to test.=C2=A0=C2=A0<br><br><div class=3D"gmail_q=
uote"><div dir=3D"ltr">On Wed, May 16, 2018 at 6:43 AM Venkateswara Venkatr=
aman Prasanna &lt;<a href=3D"mailto:[email protected]">venkateswara=
[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" sty=
le=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div d=
ir=3D"ltr"><div><div><div><div>Ramesh,<br><br></div>Here are couple of thin=
gs. Disabling TLS1.0 on the website means we we are closing some of the wea=
ker and older doors to access the site. Having said that to enter more secu=
re protocols like TLS1.1 or TLS1.2 or even TLS1.3 you need the client to be=
 able to connect to your API/services. So what you are doing is Strengtheni=
ng your service/server. This is perfectly fine and most corporations are ag=
gressively adopting to this. This is a standard drill that happens once in =
a while.<br><br></div><div>While disabling weak protocols, we usually disab=
le the weak Ciphers and tend to=C2=A0 add additional stronger Ciphers.If yo=
u site is internet facing you may go to <a href=3D"http://ssllabs.com" targ=
et=3D"_blank">ssllabs.com</a> and test it for any weak ciphers listed on yo=
ur service endpoint.Strong ciphers will lot depend on the client&#39;s abil=
ity to connect to the server.<br></div><div><br></div>I think your concern =
is clients that are connecting to your API/service will stop working. Is th=
at right? If so, the test that you are doing needs to consider the clients =
ability to connect to your site.<br><br></div>This can be done in multiple =
ways,<br></div>1. <a href=3D"https://www.ssllabs.com/ssltest/clients.html" =
target=3D"_blank">https://www.ssllabs.com/ssltest/clients.html</a> has a li=
st of clients and their support for the protocol. You may look into the lis=
t and find if your client is strong enough to connect to you.<br><div>2. If=
 you are using a JAVA based client, like a SOAP client then you can test th=
e service with simple test program. I usually test it using my program to c=
onnect to the site and download some static resource like image/js or even =
css to see if JDK is able to connect to the site. I just put it on GIST if =
you want to use it: <a href=3D"https://gist.github.com/reflexdemon/8499cfb9=
128546f6e945306e9dd8e01c" target=3D"_blank">https://gist.github.com/reflexd=
emon/8499cfb9128546f6e945306e9dd8e01c</a><br></div><div>3. If your endpoint=
 is behind a 2-way SSL setup where you will have to connect using your own =
truststore, then you can test the service using a tool that I had written r=
ecently (A bit of show off :)). <a href=3D"https://github.com/reflexdemon/t=
ls-testing-tool" target=3D"_blank">https://github.com/reflexdemon/tls-testi=
ng-tool</a>.<br><br></div><div>Some useful troubleshooting tools are openss=
l and nmap:<br><br></div><div>1. OpenSSL command to see the server cert and=
 the protocol supported: openssl s_client -showcerts -status -connect websi=
te.address.com:port<br></div><div>2. Nmap command to list the Ciphers: nmap=
 --script ssl-enum-ciphers=C2=A0 -p &lt;port&gt; <a href=3D"http://website.=
address.com" target=3D"_blank">website.address.com</a><br></div><div><br></=
div><div>Have fun with TLS :)<br></div><div><br></div><div>Bonus: I just wr=
ote a blog on TLS and Ciphers that is very much speaking about the exact TL=
S testing. <a href=3D"https://blog.vpv.io/2018/04/java-ssltls-testing-tool-=
cipher-suite.html" target=3D"_blank">https://blog.vpv.io/2018/04/java-ssltl=
s-testing-tool-cipher-suite.html</a><br></div><div><div><div><div><div><br =
clear=3D"all"><div><div><div dir=3D"ltr" class=3D"m_-4070227598540782764gma=
il_signature">Regards,<br>Venkateswara VP<br><br></div></div><br></div></di=
v></div></div></div></div></div><br><div class=3D"gmail_quote"><div dir=3D"=
ltr">On Tue, May 15, 2018 at 11:15 PM koshi jose &lt;<a href=3D"mailto:kosh=
[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:<br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-lef=
t:1px #ccc solid;padding-left:1ex"><div dir=3D"auto">Post master should hav=
e the explicit content settings in the http, layer to set the tls, however =
if you are not able to do with postmaster, you can still have your webest v=
ice request go through a Unix OS box, where you can set the tls 2.0 explici=
tly and then test it.</div><br><div class=3D"gmail_quote"><div dir=3D"ltr">=
On Tue, May 15, 2018, 10:29 PM Ramesh Kulkarni &lt;<a href=3D"mailto:ramesh=
[email protected]" rel=3D"noreferrer" target=3D"_blank">ramesh.c.kulk=
[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><di=
v dir=3D"ltr">Hello<div><br></div><div>We are disabling TLS 1.0 on our site=
 by end of June (I know it is late but better late than never). I have seen=
 some links on how to set the TLS version on the browsers. But I have not f=
ound a good resource on how to test our web services and the rest APIs by e=
xplicitly setting the TLS version? We use Postman for testing our APIs and =
I could not find a setting thru which we could set the TLS version. Can any=
one guide me on how to test it?=C2=A0</div><div><br></div><div>Thanks</div>=
<div>Ramesh</div></div>
_______________________________________________<br>
ajug-members mailing list<br>
<a href=3D"mailto:[email protected]" rel=3D"noreferrer noreferrer=
" target=3D"_blank">[email protected]</a><br>
Manage your subscription and unsubscribe <a href=3D"http://lists.ajug.org/m=
ailman/listinfo/ajug-members" rel=3D"noreferrer noreferrer noreferrer" targ=
et=3D"_blank">http://lists.ajug.org/mailman/listinfo/ajug-members</a></bloc=
kquote></div>
_______________________________________________<br>
ajug-members mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">ajug-membe=
[email protected]</a><br>
Manage your subscription and unsubscribe <a href=3D"http://lists.ajug.org/m=
ailman/listinfo/ajug-members" rel=3D"noreferrer" target=3D"_blank">http://l=
ists.ajug.org/mailman/listinfo/ajug-members</a></blockquote></div>
_______________________________________________<br>
ajug-members mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">ajug-membe=
[email protected]</a><br>
Manage your subscription and unsubscribe <a href=3D"http://lists.ajug.org/m=
ailman/listinfo/ajug-members" rel=3D"noreferrer" target=3D"_blank">http://l=
ists.ajug.org/mailman/listinfo/ajug-members</a></blockquote></div></div>

--00000000000030f069056c579ab3--

--===============1675220153362058678==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KYWp1Zy1tZW1i
ZXJzIG1haWxpbmcgbGlzdAphanVnLW1lbWJlcnNAbGlzdHMuYWp1Zy5vcmcKTWFuYWdlIHlvdXIg
c3Vic2NyaXB0aW9uIGFuZCB1bnN1YnNjcmliZSBodHRwOi8vbGlzdHMuYWp1Zy5vcmcvbWFpbG1h
bi9saXN0aW5mby9hanVnLW1lbWJlcnM=

--===============1675220153362058678==--