{"id":5088,"date":"2020-10-23T12:35:56","date_gmt":"2020-10-23T11:35:56","guid":{"rendered":"https:\/\/rakhesh.com\/?p=5088"},"modified":"2020-10-23T12:53:58","modified_gmt":"2020-10-23T11:53:58","slug":"how-to-check-ldaps-certificate-and-tls-version","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/how-to-check-ldaps-certificate-and-tls-version\/","title":{"rendered":"How to check LDAPS certificate and TLS version"},"content":{"rendered":"<p>Get OpenSSL (a list of 3rd party sites <a href=\"https:\/\/wiki.openssl.org\/index.php\/Binaries\">here<\/a>; I went with this <a href=\"https:\/\/indy.fulgan.com\/SSL\/\">one<\/a>). The connect to your DC thus:<\/p>\n<pre class=\"lang:ps decode:true \">openssl s_client -connect &lt;Domain_Controller&gt;:636<\/pre>\n<p>To test a specific version add a switch like <code>-tls1_2<\/code> or <code>-tls1_1<\/code>. If it fails you get an error like this (this was me asking for TLS1.1):<\/p>\n<pre class=\"lang:ps mark:2,3 decode:true\">CONNECTED(000002F4)\r\n51720:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:.\\ssl\\s3_pkt.c:1498:SSL alert number 70\r\n51720:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:.\\ssl\\s3_pkt.c:659:\r\n---\r\nno peer certificate available\r\n---\r\nNo client certificate CA names sent\r\n---\r\nSSL handshake has read 7 bytes and written 0 bytes\r\n---\r\nNew, (NONE), Cipher is (NONE)\r\nSecure Renegotiation IS NOT supported\r\nCompression: NONE\r\nExpansion: NONE\r\nNo ALPN negotiated\r\nSSL-Session:\r\n    Protocol  : TLSv1\r\n    Cipher    : 0000\r\n    Session-ID:\r\n    Session-ID-ctx:\r\n    Master-Key:\r\n    Key-Arg   : None\r\n    PSK identity: None\r\n    PSK identity hint: None\r\n    SRP username: None\r\n    Start Time: 1603452101\r\n    Timeout   : 7200 (sec)\r\n    Verify return code: 0 (ok)\r\n---<\/pre>\n<p>Hope that helps someone!<\/p>\n<p><strong>Update<\/strong>: Just for completeness, <a href=\"https:\/\/docs.microsoft.com\/en-us\/archive\/blogs\/friis\/disabling-tls-1-0-on-your-windows-2008-r2-server-just-because-you-still-have-one\">here<\/a> are the regkeys to enable\/ disable various TLS versions in Windows.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Get OpenSSL (a list of 3rd party sites here; I went with this one). The connect to your DC thus: openssl s_client -connect &lt;Domain_Controller&gt;:636 To test a specific version add a switch like -tls1_2 or -tls1_1. If it fails you get an error like this (this was me asking for TLS1.1): CONNECTED(000002F4) 51720:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert &hellip; <a href=\"https:\/\/rakhesh.com\/windows\/how-to-check-ldaps-certificate-and-tls-version\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">How to check LDAPS certificate and TLS version<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[266,406],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5088"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=5088"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5088\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=5088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=5088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=5088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}