Re: Testing the disabling of TLS 1.0
Ramesh Kulkarni <[email protected]> Wed, 16 May 2018 16:48:52 -0400
| Newsgroups | gmane.org.user-groups.ajug.members |
|---|---|
| Message-ID | <CAK8ifwa4E5ChTybyu_unwRpJBXNP=FTcbhaXJYmGGFy+U4zg-A@mail.gmail.com> |
--===============7719936159755687629== Content-Type: multipart/alternative; boundary="000000000000674a9b056c58d9ff" --000000000000674a9b056c58d9ff Content-Type: text/plain; charset="UTF-8" Oh! Great. I will try this. On Wed, May 16, 2018 at 4:47 PM Venkateswara Venkatraman Prasanna < [email protected]> wrote: > Ramesh, > > If you have access to a linux/mac then it is as simple as using the curl. > > $ curl -v --tlsv1.0 https://httpbin.org/get > > This is from curl man page: > -1, --tlsv1 (SSL) Forces curl to use TLS version 1.x when > negotiating with a remote TLS server. You can use options --tlsv1.0, > --tlsv1.1, and --tlsv1.2 to control the TLS version more > precisely (if the SSL backend in use supports such a level of > control). > > -2, --sslv2 > (SSL) Forces curl to use SSL version 2 when negotiating with a > remote SSL server. Sometimes curl is built without SSLv2 > support. SSLv2 is widely considered insecure. > > -3, --sslv3 > (SSL) Forces curl to use SSL version 3 when negotiating with a > remote SSL server. Sometimes curl is built without SSLv3 > support. > > Regards, > Venkateswara VP > > > > On Wed, May 16, 2018 at 3:50 PM Sony Antony <[email protected]> wrote: > >> If postman runs on java, try starting it with >> -Djdk.tls.client.protocols=TLSv1.0 >> ( You need java 8 or java 7 with update 95 or higher ) >> --sony >> >> On Wed, May 16, 2018 at 3:19 PM, Ramesh Kulkarni >> <[email protected]> wrote: >> > Thank you for your detailed response. I read your blog post. It was >> helpful. >> > What I was looking for specifically is after I turn off TLS 1.0 on my >> > tomcat, I want to be able to fire off an API request using TLS 1.0 and >> see >> > it getting rejected. This request is actually from our QA team. They are >> > asking me how can I test that disabling TLS 1.0 is working. That is why >> I >> > was asking if there was a way in postman to set the TLS version so that >> it >> > becomes easier to test. >> > >> > >> > On Wed, May 16, 2018 at 6:43 AM Venkateswara Venkatraman Prasanna >> > <[email protected]> wrote: >> >> >> >> Ramesh, >> >> >> >> Here are couple of things. Disabling TLS1.0 on the website means we we >> are >> >> closing some of the weaker and older doors to access the site. Having >> said >> >> that to enter more secure protocols like TLS1.1 or TLS1.2 or even >> TLS1.3 you >> >> need the client to be able to connect to your API/services. So what >> you are >> >> doing is Strengthening your service/server. This is perfectly fine and >> most >> >> corporations are aggressively adopting to this. This is a standard >> drill >> >> that happens once in a while. >> >> >> >> While disabling weak protocols, we usually disable the weak Ciphers and >> >> tend to add additional stronger Ciphers.If you site is internet >> facing you >> >> may go to ssllabs.com and test it for any weak ciphers listed on your >> >> service endpoint.Strong ciphers will lot depend on the client's >> ability to >> >> connect to the server. >> >> >> >> I think your concern is clients that are connecting to your API/service >> >> will stop working. Is that right? If so, the test that you are doing >> needs >> >> to consider the clients ability to connect to your site. >> >> >> >> This can be done in multiple ways, >> >> 1. https://www.ssllabs.com/ssltest/clients.html has a list of clients >> and >> >> their support for the protocol. You may look into the list and find if >> your >> >> client is strong enough to connect to you. >> >> 2. If you are using a JAVA based client, like a SOAP client then you >> can >> >> test the service with simple test program. I usually test it using my >> >> program to connect to the site and download some static resource like >> >> image/js or even css to see if JDK is able to connect to the site. I >> just >> >> put it on GIST if you want to use it: >> >> https://gist.github.com/reflexdemon/8499cfb9128546f6e945306e9dd8e01c >> >> 3. If your endpoint is behind a 2-way SSL setup where you will have to >> >> connect using your own truststore, then you can test the service using >> a >> >> tool that I had written recently (A bit of show off :)). >> >> https://github.com/reflexdemon/tls-testing-tool. >> >> >> >> Some useful troubleshooting tools are openssl and nmap: >> >> >> >> 1. OpenSSL command to see the server cert and the protocol supported: >> >> openssl s_client -showcerts -status -connect website.address.com:port >> >> 2. Nmap command to list the Ciphers: nmap --script ssl-enum-ciphers -p >> >> <port> website.address.com >> >> >> >> Have fun with TLS :) >> >> >> >> Bonus: I just wrote a blog on TLS and Ciphers that is very much >> speaking >> >> about the exact TLS testing. >> >> https://blog.vpv.io/2018/04/java-ssltls-testing-tool-cipher-suite.html >> >> >> >> Regards, >> >> Venkateswara VP >> >> >> >> >> >> >> >> On Tue, May 15, 2018 at 11:15 PM koshi jose <[email protected]> >> wrote: >> >>> >> >>> Post master should have the explicit content settings in the http, >> layer >> >>> to set the tls, however if you are not able to do with postmaster, >> you can >> >>> still have your webest vice request go through a Unix OS box, where >> you can >> >>> set the tls 2.0 explicitly and then test it. >> >>> >> >>> On Tue, May 15, 2018, 10:29 PM Ramesh Kulkarni >> >>> <[email protected]> wrote: >> >>>> >> >>>> Hello >> >>>> >> >>>> We are disabling TLS 1.0 on our site by end of June (I know it is >> late >> >>>> but better late than never). I have seen some links on how to set >> the TLS >> >>>> version on the browsers. But I have not found a good resource on how >> to test >> >>>> our web services and the rest APIs by explicitly setting the TLS >> version? We >> >>>> use Postman for testing our APIs and I could not find a setting thru >> which >> >>>> we could set the TLS version. Can anyone guide me on how to test it? >> >>>> >> >>>> Thanks >> >>>> Ramesh >> >>>> _______________________________________________ >> >>>> ajug-members mailing list >> >>>> [email protected] >> >>>> Manage your subscription and unsubscribe >> >>>> http://lists.ajug.org/mailman/listinfo/ajug-members >> >>> >> >>> _______________________________________________ >> >>> ajug-members mailing list >> >>> [email protected] >> >>> Manage your subscription and unsubscribe >> >>> http://lists.ajug.org/mailman/listinfo/ajug-members >> >> >> >> _______________________________________________ >> >> ajug-members mailing list >> >> [email protected] >> >> Manage your subscription and unsubscribe >> >> http://lists.ajug.org/mailman/listinfo/ajug-members >> > >> > >> > _______________________________________________ >> > ajug-members mailing list >> > [email protected] >> > Manage your subscription and unsubscribe >> > http://lists.ajug.org/mailman/listinfo/ajug-members >> _______________________________________________ >> ajug-members mailing list >> [email protected] >> Manage your subscription and unsubscribe >> http://lists.ajug.org/mailman/listinfo/ajug-members > > _______________________________________________ > ajug-members mailing list > [email protected] > Manage your subscription and unsubscribe > http://lists.ajug.org/mailman/listinfo/ajug-members --000000000000674a9b056c58d9ff Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Oh! Great. I will try this.=C2=A0</div><br><div class=3D"g= mail_quote"><div dir=3D"ltr">On Wed, May 16, 2018 at 4:47 PM Venkateswara V= enkatraman Prasanna <<a href=3D"mailto:[email protected]">venkat= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quot= e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">= <div dir=3D"ltr"><div><div>Ramesh,<br><br></div>If you have access to a lin= ux/mac then it is as simple as using the curl.<br><br>$ curl -v --tlsv1.0 <= a href=3D"https://httpbin.org/get" target=3D"_blank">https://httpbin.org/ge= t</a><br><br></div>This is from curl man page:<br>-1, --tlsv1 (SSL)=C2=A0 F= orces=C2=A0 curl=C2=A0 to=C2=A0 use=C2=A0 TLS=C2=A0 version 1.x when negoti= ating with a remote TLS server.=C2=A0 You can use options --tlsv1.0,<br>=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= --tlsv1.1, and --tlsv1.2 to control the TLS version more precisely (if the= SSL backend in use supports such=C2=A0 a=C2=A0 level=C2=A0 of<br>=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 contr= ol).<br><br>-2, --sslv2<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (SSL)=C2=A0 Force= s=C2=A0 curl to use SSL version 2 when negotiating with a remote SSL server= . Sometimes curl is built without SSLv2<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 s= upport. SSLv2 is widely considered insecure.<br><br>-3, --sslv3<br>=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 (SSL) Forces curl to use SSL version 3 when negoti= ating with a remote SSL server. Sometimes curl is built=C2=A0 without=C2=A0= SSLv3<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 support.<br><div><div><div><br cle= ar=3D"all"><div><div><div dir=3D"ltr" class=3D"m_-9056397962633598670gmail_= signature">Regards,<br>Venkateswara VP<br><br></div></div><br></div></div><= /div></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr">On Wed, Ma= y 16, 2018 at 3:50 PM Sony Antony <<a href=3D"mailto:[email protected]= om" target=3D"_blank">[email protected]</a>> wrote:<br></div><blockq= uote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc = solid;padding-left:1ex">If postman runs on java, try starting it with -Djdk= .tls.client.protocols=3DTLSv1.0<br> ( You need java 8 or java 7 with update 95 or higher=C2=A0 )<br> --sony<br> <br> On Wed, May 16, 2018 at 3:19 PM, Ramesh Kulkarni<br> <<a href=3D"mailto:[email protected]" target=3D"_blank">rame= [email protected]</a>> wrote:<br> > Thank you for your detailed response. I read your blog post. It was he= lpful.<br> > What I was looking for specifically is after I turn off TLS 1.0 on my<= br> > tomcat, I want to be able to fire off an API request using TLS 1.0 and= see<br> > it getting rejected. This request is actually from our QA team. They a= re<br> > asking me how can I test that disabling TLS 1.0 is working. That is wh= y I<br> > was asking if there was a way in postman to set the TLS version so tha= t it<br> > becomes easier to test.<br> ><br> ><br> > On Wed, May 16, 2018 at 6:43 AM Venkateswara Venkatraman Prasanna<br> > <<a href=3D"mailto:[email protected]" target=3D"_blank">ven= [email protected]</a>> wrote:<br> >><br> >> Ramesh,<br> >><br> >> Here are couple of things. Disabling TLS1.0 on the website means w= e we are<br> >> closing some of the weaker and older doors to access the site. Hav= ing said<br> >> that to enter more secure protocols like TLS1.1 or TLS1.2 or even = TLS1.3 you<br> >> need the client to be able to connect to your API/services. So wha= t you are<br> >> doing is Strengthening your service/server. This is perfectly fine= and most<br> >> corporations are aggressively adopting to this. This is a standard= drill<br> >> that happens once in a while.<br> >><br> >> While disabling weak protocols, we usually disable the weak Cipher= s and<br> >> tend to=C2=A0 add additional stronger Ciphers.If you site is inter= net facing you<br> >> may go to <a href=3D"http://ssllabs.com" rel=3D"noreferrer" target= =3D"_blank">ssllabs.com</a> and test it for any weak ciphers listed on your= <br> >> service endpoint.Strong ciphers will lot depend on the client'= s ability to<br> >> connect to the server.<br> >><br> >> I think your concern is clients that are connecting to your API/se= rvice<br> >> will stop working. Is that right? If so, the test that you are doi= ng needs<br> >> to consider the clients ability to connect to your site.<br> >><br> >> This can be done in multiple ways,<br> >> 1. <a href=3D"https://www.ssllabs.com/ssltest/clients.html" rel=3D= "noreferrer" target=3D"_blank">https://www.ssllabs.com/ssltest/clients.html= </a> has a list of clients and<br> >> their support for the protocol. You may look into the list and fin= d if your<br> >> client is strong enough to connect to you.<br> >> 2. If you are using a JAVA based client, like a SOAP client then y= ou can<br> >> test the service with simple test program. I usually test it using= my<br> >> program to connect to the site and download some static resource l= ike<br> >> image/js or even css to see if JDK is able to connect to the site.= I just<br> >> put it on GIST if you want to use it:<br> >> <a href=3D"https://gist.github.com/reflexdemon/8499cfb9128546f6e94= 5306e9dd8e01c" rel=3D"noreferrer" target=3D"_blank">https://gist.github.com= /reflexdemon/8499cfb9128546f6e945306e9dd8e01c</a><br> >> 3. If your endpoint is behind a 2-way SSL setup where you will hav= e to<br> >> connect using your own truststore, then you can test the service u= sing a<br> >> tool that I had written recently (A bit of show off :)).<br> >> <a href=3D"https://github.com/reflexdemon/tls-testing-tool" rel=3D= "noreferrer" target=3D"_blank">https://github.com/reflexdemon/tls-testing-t= ool</a>.<br> >><br> >> Some useful troubleshooting tools are openssl and nmap:<br> >><br> >> 1. OpenSSL command to see the server cert and the protocol support= ed:<br> >> openssl s_client -showcerts -status -connect website.address.com:p= ort<br> >> 2. Nmap command to list the Ciphers: nmap --script ssl-enum-cipher= s=C2=A0 -p<br> >> <port> <a href=3D"http://website.address.com" rel=3D"norefer= rer" target=3D"_blank">website.address.com</a><br> >><br> >> Have fun with TLS :)<br> >><br> >> Bonus: I just wrote a blog on TLS and Ciphers that is very much sp= eaking<br> >> about the exact TLS testing.<br> >> <a href=3D"https://blog.vpv.io/2018/04/java-ssltls-testing-tool-ci= pher-suite.html" rel=3D"noreferrer" target=3D"_blank">https://blog.vpv.io/2= 018/04/java-ssltls-testing-tool-cipher-suite.html</a><br> >><br> >> Regards,<br> >> Venkateswara VP<br> >><br> >><br> >><br> >> On Tue, May 15, 2018 at 11:15 PM koshi jose <<a href=3D"mailto:= [email protected]" target=3D"_blank">[email protected]</a>> wrote:<b= r> >>><br> >>> Post master should have the explicit content settings in the h= ttp, layer<br> >>> to set the tls, however if you are not able to do with postmas= ter, you can<br> >>> still have your webest vice request go through a Unix OS box, = where you can<br> >>> set the tls 2.0 explicitly and then test it.<br> >>><br> >>> On Tue, May 15, 2018, 10:29 PM Ramesh Kulkarni<br> >>> <<a href=3D"mailto:[email protected]" target=3D= "_blank">[email protected]</a>> wrote:<br> >>>><br> >>>> Hello<br> >>>><br> >>>> We are disabling TLS 1.0 on our site by end of June (I kno= w it is late<br> >>>> but better late than never). I have seen some links on how= to set the TLS<br> >>>> version on the browsers. But I have not found a good resou= rce on how to test<br> >>>> our web services and the rest APIs by explicitly setting t= he TLS version? We<br> >>>> use Postman for testing our APIs and I could not find a se= tting thru which<br> >>>> we could set the TLS version. Can anyone guide me on how t= o test it?<br> >>>><br> >>>> Thanks<br> >>>> Ramesh<br> >>>> _______________________________________________<br> >>>> ajug-members mailing list<br> >>>> <a href=3D"mailto:[email protected]" target=3D"_= blank">[email protected]</a><br> >>>> Manage your subscription and unsubscribe<br> >>>> <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-mem= bers" rel=3D"noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/li= stinfo/ajug-members</a><br> >>><br> >>> _______________________________________________<br> >>> ajug-members mailing list<br> >>> <a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a><br> >>> Manage your subscription and unsubscribe<br> >>> <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-members= " rel=3D"noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/listin= fo/ajug-members</a><br> >><br> >> _______________________________________________<br> >> ajug-members mailing list<br> >> <a href=3D"mailto:[email protected]" target=3D"_blank">a= [email protected]</a><br> >> Manage your subscription and unsubscribe<br> >> <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-members" re= l=3D"noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/listinfo/a= jug-members</a><br> ><br> ><br> > _______________________________________________<br> > ajug-members mailing list<br> > <a href=3D"mailto:[email protected]" target=3D"_blank">ajug-= [email protected]</a><br> > Manage your subscription and unsubscribe<br> > <a href=3D"http://lists.ajug.org/mailman/listinfo/ajug-members" rel=3D= "noreferrer" target=3D"_blank">http://lists.ajug.org/mailman/listinfo/ajug-= members</a><br> _______________________________________________<br> ajug-members mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">ajug-membe= [email protected]</a><br> Manage your subscription and unsubscribe <a href=3D"http://lists.ajug.org/m= ailman/listinfo/ajug-members" rel=3D"noreferrer" target=3D"_blank">http://l= ists.ajug.org/mailman/listinfo/ajug-members</a></blockquote></div> _______________________________________________<br> ajug-members mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">ajug-membe= [email protected]</a><br> Manage your subscription and unsubscribe <a href=3D"http://lists.ajug.org/m= ailman/listinfo/ajug-members" rel=3D"noreferrer" target=3D"_blank">http://l= ists.ajug.org/mailman/listinfo/ajug-members</a></blockquote></div> --000000000000674a9b056c58d9ff-- --===============7719936159755687629== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KYWp1Zy1tZW1i ZXJzIG1haWxpbmcgbGlzdAphanVnLW1lbWJlcnNAbGlzdHMuYWp1Zy5vcmcKTWFuYWdlIHlvdXIg c3Vic2NyaXB0aW9uIGFuZCB1bnN1YnNjcmliZSBodHRwOi8vbGlzdHMuYWp1Zy5vcmcvbWFpbG1h bi9saXN0aW5mby9hanVnLW1lbWJlcnM= --===============7719936159755687629==--