Re: Testing the disabling of TLS 1.0
Venkateswara Venkatraman Prasanna <[email protected]> Wed, 16 May 2018 16:47:33 -0400
| Newsgroups | gmane.org.user-groups.ajug.members |
|---|---|
| Message-ID | <CAL25MiHv6eBeJ7-Gp-a7=RNGEG1C2-naDAEKmccf6wyzRMdj=Q@mail.gmail.com> |
--===============6828701729802871773==
Content-Type: multipart/alternative; boundary="000000000000b10d77056c58d438"
--000000000000b10d77056c58d438
Content-Type: text/plain; charset="UTF-8"
Ramesh,
If you have access to a linux/mac then it is as simple as using the curl.
$ curl -v --tlsv1.0 https://httpbin.org/get
This is from curl man page:
-1, --tlsv1 (SSL) Forces curl to use TLS version 1.x when negotiating
with a remote TLS server. You can use options --tlsv1.0,
--tlsv1.1, and --tlsv1.2 to control the TLS version more
precisely (if the SSL backend in use supports such a level of
control).
-2, --sslv2
(SSL) Forces curl to use SSL version 2 when negotiating with a
remote SSL server. Sometimes curl is built without SSLv2
support. SSLv2 is widely considered insecure.
-3, --sslv3
(SSL) Forces curl to use SSL version 3 when negotiating with a remote
SSL server. Sometimes curl is built without SSLv3
support.
Regards,
Venkateswara VP
On Wed, May 16, 2018 at 3:50 PM Sony Antony <[email protected]> wrote:
> If postman runs on java, try starting it with
> -Djdk.tls.client.protocols=TLSv1.0
> ( You need java 8 or java 7 with update 95 or higher )
> --sony
>
> On Wed, May 16, 2018 at 3:19 PM, Ramesh Kulkarni
> <[email protected]> wrote:
> > Thank you for your detailed response. I read your blog post. It was
> helpful.
> > What I was looking for specifically is after I turn off TLS 1.0 on my
> > tomcat, I want to be able to fire off an API request using TLS 1.0 and
> see
> > it getting rejected. This request is actually from our QA team. They are
> > asking me how can I test that disabling TLS 1.0 is working. That is why I
> > was asking if there was a way in postman to set the TLS version so that
> it
> > becomes easier to test.
> >
> >
> > On Wed, May 16, 2018 at 6:43 AM Venkateswara Venkatraman Prasanna
> > <[email protected]> wrote:
> >>
> >> Ramesh,
> >>
> >> Here are couple of things. Disabling TLS1.0 on the website means we we
> are
> >> closing some of the weaker and older doors to access the site. Having
> said
> >> that to enter more secure protocols like TLS1.1 or TLS1.2 or even
> TLS1.3 you
> >> need the client to be able to connect to your API/services. So what you
> are
> >> doing is Strengthening your service/server. This is perfectly fine and
> most
> >> corporations are aggressively adopting to this. This is a standard drill
> >> that happens once in a while.
> >>
> >> While disabling weak protocols, we usually disable the weak Ciphers and
> >> tend to add additional stronger Ciphers.If you site is internet facing
> you
> >> may go to ssllabs.com and test it for any weak ciphers listed on your
> >> service endpoint.Strong ciphers will lot depend on the client's ability
> to
> >> connect to the server.
> >>
> >> I think your concern is clients that are connecting to your API/service
> >> will stop working. Is that right? If so, the test that you are doing
> needs
> >> to consider the clients ability to connect to your site.
> >>
> >> This can be done in multiple ways,
> >> 1. https://www.ssllabs.com/ssltest/clients.html has a list of clients
> and
> >> their support for the protocol. You may look into the list and find if
> your
> >> client is strong enough to connect to you.
> >> 2. If you are using a JAVA based client, like a SOAP client then you can
> >> test the service with simple test program. I usually test it using my
> >> program to connect to the site and download some static resource like
> >> image/js or even css to see if JDK is able to connect to the site. I
> just
> >> put it on GIST if you want to use it:
> >> https://gist.github.com/reflexdemon/8499cfb9128546f6e945306e9dd8e01c
> >> 3. If your endpoint is behind a 2-way SSL setup where you will have to
> >> connect using your own truststore, then you can test the service using a
> >> tool that I had written recently (A bit of show off :)).
> >> https://github.com/reflexdemon/tls-testing-tool.
> >>
> >> Some useful troubleshooting tools are openssl and nmap:
> >>
> >> 1. OpenSSL command to see the server cert and the protocol supported:
> >> openssl s_client -showcerts -status -connect website.address.com:port
> >> 2. Nmap command to list the Ciphers: nmap --script ssl-enum-ciphers -p
> >> <port> website.address.com
> >>
> >> Have fun with TLS :)
> >>
> >> Bonus: I just wrote a blog on TLS and Ciphers that is very much speaking
> >> about the exact TLS testing.
> >> https://blog.vpv.io/2018/04/java-ssltls-testing-tool-cipher-suite.html
> >>
> >> Regards,
> >> Venkateswara VP
> >>
> >>
> >>
> >> On Tue, May 15, 2018 at 11:15 PM koshi jose <[email protected]>
> wrote:
> >>>
> >>> Post master should have the explicit content settings in the http,
> layer
> >>> to set the tls, however if you are not able to do with postmaster, you
> can
> >>> still have your webest vice request go through a Unix OS box, where
> you can
> >>> set the tls 2.0 explicitly and then test it.
> >>>
> >>> On Tue, May 15, 2018, 10:29 PM Ramesh Kulkarni
> >>> <[email protected]> wrote:
> >>>>
> >>>> Hello
> >>>>
> >>>> We are disabling TLS 1.0 on our site by end of June (I know it is late
> >>>> but better late than never). I have seen some links on how to set the
> TLS
> >>>> version on the browsers. But I have not found a good resource on how
> to test
> >>>> our web services and the rest APIs by explicitly setting the TLS
> version? We
> >>>> use Postman for testing our APIs and I could not find a setting thru
> which
> >>>> we could set the TLS version. Can anyone guide me on how to test it?
> >>>>
> >>>> Thanks
> >>>> Ramesh
> >>>> _______________________________________________
> >>>> ajug-members mailing list
> >>>> [email protected]
> >>>> Manage your subscription and unsubscribe
> >>>> http://lists.ajug.org/mailman/listinfo/ajug-members
> >>>
> >>> _______________________________________________
> >>> ajug-members mailing list
> >>> [email protected]
> >>> Manage your subscription and unsubscribe
> >>> http://lists.ajug.org/mailman/listinfo/ajug-members
> >>
> >> _______________________________________________
> >> ajug-members mailing list
> >> [email protected]
> >> Manage your subscription and unsubscribe
> >> http://lists.ajug.org/mailman/listinfo/ajug-members
> >
> >
> > _______________________________________________
> > ajug-members mailing list
> > [email protected]
> > Manage your subscription and unsubscribe
> > http://lists.ajug.org/mailman/listinfo/ajug-members
> _______________________________________________
> ajug-members mailing list
> [email protected]
> Manage your subscription and unsubscribe
> http://lists.ajug.org/mailman/listinfo/ajug-members
--000000000000b10d77056c58d438
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div><div>Ramesh,<br><br></div>If you have access to a lin=
ux/mac then it is as simple as using the curl.<br><br>$ curl -v --tlsv1.0 <=
a href=3D"https://httpbin.org/get">https://httpbin.org/get</a><br><br></div=
>This is from curl man page:<br>-1, --tlsv1 (SSL)=C2=A0 Forces=C2=A0 curl=
=C2=A0 to=C2=A0 use=C2=A0 TLS=C2=A0 version 1.x when negotiating with a rem=
ote TLS server.=C2=A0 You can use options --tlsv1.0,<br>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 --tlsv1.1, and=
--tlsv1.2 to control the TLS version more precisely (if the SSL backend in=
use supports such=C2=A0 a=C2=A0 level=C2=A0 of<br>=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 control).<br><br>-2,=
--sslv2<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (SSL)=C2=A0 Forces=C2=A0 curl to=
use SSL version 2 when negotiating with a remote SSL server. Sometimes cur=
l is built without SSLv2<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 support. SSLv2 i=
s widely considered insecure.<br><br>-3, --sslv3<br>=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 (SSL) Forces curl to use SSL version 3 when negotiating with a re=
mote SSL server. Sometimes curl is built=C2=A0 without=C2=A0 SSLv3<br>=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 support.<br><div><div><div><br clear=3D"all"><d=
iv><div><div dir=3D"ltr" class=3D"gmail_signature">Regards,<br>Venkateswara=
VP<br><br></div></div><br></div></div></div></div></div><br><div class=3D"=
gmail_quote"><div dir=3D"ltr">On Wed, May 16, 2018 at 3:50 PM Sony Antony &=
lt;<a href=3D"mailto:[email protected]">[email protected]</a>> w=
rote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex=
;border-left:1px #ccc solid;padding-left:1ex">If postman runs on java, try =
starting it with -Djdk.tls.client.protocols=3DTLSv1.0<br>
( You need java 8 or java 7 with update 95 or higher=C2=A0 )<br>
--sony<br>
<br>
On Wed, May 16, 2018 at 3:19 PM, Ramesh Kulkarni<br>
<<a href=3D"mailto:[email protected]" target=3D"_blank">rame=
[email protected]</a>> wrote:<br>
> Thank you for your detailed response. I read your blog post. It was he=
lpful.<br>
> What I was looking for specifically is after I turn off TLS 1.0 on my<=
br>
> tomcat, I want to be able to fire off an API request using TLS 1.0 and=
see<br>
> it getting rejected. This request is actually from our QA team. They a=
re<br>
> asking me how can I test that disabling TLS 1.0 is working. That is wh=
y I<br>
> was asking if there was a way in postman to set the TLS version so tha=
t it<br>
> becomes easier to test.<br>
><br>
><br>
> On Wed, May 16, 2018 at 6:43 AM Venkateswara Venkatraman Prasanna<br>
> <<a href=3D"mailto:[email protected]" target=3D"_blank">ven=
[email protected]</a>> wrote:<br>
>><br>
>> Ramesh,<br>
>><br>
>> Here are couple of things. Disabling TLS1.0 on the website means w=
e we are<br>
>> closing some of the weaker and older doors to access the site. Hav=
ing said<br>
>> that to enter more secure protocols like TLS1.1 or TLS1.2 or even =
TLS1.3 you<br>
>> need the client to be able to connect to your API/services. So wha=
t you are<br>
>> doing is Strengthening your service/server. This is perfectly fine=
and most<br>
>> corporations are aggressively adopting to this. This is a standard=
drill<br>
>> that happens once in a while.<br>
>><br>
>> While disabling weak protocols, we usually disable the weak Cipher=
s and<br>
>> tend to=C2=A0 add additional stronger Ciphers.If you site is inter=
net facing you<br>
>> may go to <a href=3D"http://ssllabs.com" rel=3D"noreferrer" target=
=3D"_blank">ssllabs.com</a> and test it for any weak ciphers listed on your=
<br>
>> service endpoint.Strong ciphers will lot depend on the client'=
s ability to<br>
>> connect to the server.<br>
>><br>
>> I think your concern is clients that are connecting to your API/se=
rvice<br>
>> will stop working. Is that right? If so, the test that you are doi=
ng needs<br>
>> to consider the clients ability to connect to your site.<br>
>><br>
>> This can be done in multiple ways,<br>
>> 1. <a href=3D"https://www.ssllabs.com/ssltest/clients.html" rel=3D=
"noreferrer" target=3D"_blank">https://www.ssllabs.com/ssltest/clients.html=
</a> has a list of clients and<br>
>> their support for the protocol. You may look into the list and fin=
d if your<br>
>> client is strong enough to connect to you.<br>
>> 2. If you are using a JAVA based client, like a SOAP client then y=
ou can<br>
>> test the service with simple test program. I usually test it using=
my<br>
>> program to connect to the site and download some static resource l=
ike<br>
>> image/js or even css to see if JDK is able to connect to the site.=
I just<br>
>> put it on GIST if you want to use it:<br>
>> <a href=3D"https://gist.github.com/reflexdemon/8499cfb9128546f6e94=
5306e9dd8e01c" rel=3D"noreferrer" target=3D"_blank">https://gist.github.com=
/reflexdemon/8499cfb9128546f6e945306e9dd8e01c</a><br>
>> 3. If your endpoint is behind a 2-way SSL setup where you will hav=
e to<br>
>> connect using your own truststore, then you can test the service u=
sing a<br>
>> tool that I had written recently (A bit of show off :)).<br>
>> <a href=3D"https://github.com/reflexdemon/tls-testing-tool" rel=3D=
"noreferrer" target=3D"_blank">https://github.com/reflexdemon/tls-testing-t=
ool</a>.<br>
>><br>
>> Some useful troubleshooting tools are openssl and nmap:<br>
>><br>
>> 1. OpenSSL command to see the server cert and the protocol support=
ed:<br>
>> openssl s_client -showcerts -status -connect website.address.com:p=
ort<br>
>> 2. Nmap command to list the Ciphers: nmap --script ssl-enum-cipher=
s=C2=A0 -p<br>
>> <port> <a href=3D"http://website.address.com" rel=3D"norefer=
rer" target=3D"_blank">website.address.com</a><br>
>><br>
>> Have fun with TLS :)<br>
>><br>
>> Bonus: I just wrote a blog on TLS and Ciphers that is very much sp=
eaking<br>
>> about the exact TLS testing.<br>
>> <a href=3D"https://blog.vpv.io/2018/04/java-ssltls-testing-tool-ci=
pher-suite.html" rel=3D"noreferrer" target=3D"_blank">https://blog.vpv.io/2=
018/04/java-ssltls-testing-tool-cipher-suite.html</a><br>
>><br>
>> Regards,<br>
>> Venkateswara VP<br>
>><br>
>><br>
>><br>
>> On Tue, May 15, 2018 at 11:15 PM koshi jose <<a href=3D"mailto:=
[email protected]" target=3D"_blank">[email protected]</a>> wrote:<b=
r>
>>><br>
>>> Post master should have the explicit content settings in the h=
ttp, layer<br>
>>> to set the tls, however if you are not able to do with postmas=
ter, you can<br>
>>> still have your webest vice request go through a Unix OS box, =
where you can<br>
>>> set the tls 2.0 explicitly and then test it.<br>
>>><br>
>>> On Tue, May 15, 2018, 10:29 PM Ramesh Kulkarni<br>
>>> <<a href=3D"mailto:[email protected]" target=3D=
"_blank">[email protected]</a>> wrote:<br>
>>>><br>
>>>> Hello<br>
>>>><br>
>>>> We are disabling TLS 1.0 on our site by end of June (I kno=
w it is late<br>
>>>> but better late than never). I have seen some links on how=
to set the TLS<br>
>>>> version on the browsers. But I have not found a good resou=
rce on how to test<br>
>>>> our web services and the rest APIs by explicitly setting t=
he TLS version? We<br>
>>>> use Postman for testing our APIs and I could not find a se=
tting thru which<br>
>>>> we could set the TLS version. Can anyone guide me on how t=
o test it?<br>
>>>><br>
>>>> Thanks<br>
>>>> Ramesh<br>
>>>> _______________________________________________<br>
>>>> ajug-members mailing list<br>
>>>> <a href=3D"mailto:[email protected]" target=3D"_=
blank">[email protected]</a><br>
>>>> Manage your subscription and unsubscribe<br>
>>>> <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-mem=
bers" rel=3D"noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/li=
stinfo/ajug-members</a><br>
>>><br>
>>> _______________________________________________<br>
>>> ajug-members mailing list<br>
>>> <a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a><br>
>>> Manage your subscription and unsubscribe<br>
>>> <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-members=
" rel=3D"noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/listin=
fo/ajug-members</a><br>
>><br>
>> _______________________________________________<br>
>> ajug-members mailing list<br>
>> <a href=3D"mailto:[email protected]" target=3D"_blank">a=
[email protected]</a><br>
>> Manage your subscription and unsubscribe<br>
>> <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-members" re=
l=3D"noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/listinfo/a=
jug-members</a><br>
><br>
><br>
> _______________________________________________<br>
> ajug-members mailing list<br>
> <a href=3D"mailto:[email protected]" target=3D"_blank">ajug-=
[email protected]</a><br>
> Manage your subscription and unsubscribe<br>
> <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-members" rel=3D=
"noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/listinfo/ajug-=
members</a><br>
_______________________________________________<br>
ajug-members mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">ajug-membe=
[email protected]</a><br>
Manage your subscription and unsubscribe <a href=3D"http://lists.ajug.org/m=
ailman/listinfo/ajug-members" rel=3D"noreferrer" target=3D"_blank">http://l=
ists.ajug.org/mailman/listinfo/ajug-members</a></blockquote></div>
--000000000000b10d77056c58d438--
--===============6828701729802871773==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KYWp1Zy1tZW1i
ZXJzIG1haWxpbmcgbGlzdAphanVnLW1lbWJlcnNAbGlzdHMuYWp1Zy5vcmcKTWFuYWdlIHlvdXIg
c3Vic2NyaXB0aW9uIGFuZCB1bnN1YnNjcmliZSBodHRwOi8vbGlzdHMuYWp1Zy5vcmcvbWFpbG1h
bi9saXN0aW5mby9hanVnLW1lbWJlcnM=
--===============6828701729802871773==--