How to Check the TLS Version on Linux (OpenSSL, Curl, Nmap)

AvatarByEric Dawson Computers & Software

Checking the TLS version on Linux takes one command in most cases. Run openssl s_client -connect example.com:443 -servername example.com -brief and read the Protocol version line in the output, since it names the exact version the server negotiated, such as TLSv1.3. Curl and nmap answer the same question from different angles: curl tests one connection at a time, while nmap’s ssl-enum-ciphers script lists every version a remote server accepts. All three tools ship with nearly every Linux distribution.

How to Check the TLS Version with OpenSSL

OpenSSL’s s_client command is the standard way to see which TLS version a Linux system negotiates with a remote server. Type openssl s_client -connect example.com:443 -servername example.com -brief </dev/null to get output such as "Protocol version: TLSv1.3" within a second or two.

The -servername flag matters more than it looks. Many web servers host several sites on one IP address, and without Server Name Indication the server has no way to know which certificate or configuration to offer, so a check without it can report the wrong host entirely. Include -servername on every check against a shared host.

Two flags help when a quick check is not enough detail. The -debug flag prints a hex dump of the entire exchange, and -trace shows a readable log of each protocol message as it happens. Neither is needed for a routine version check, but both help when a connection fails and the cause is not obvious.

Piping </dev/null into the command, or following it with | echo Q, closes the connection automatically once the handshake completes. Skip that step and s_client waits for keyboard input, so the terminal appears to hang.

OpenSSL’s default connection method works with most servers, but a few very old or misconfigured ones cannot handle it and drop the connection instead. If a check against a live server fails outright, try adding -tls1_2 to force a specific version before assuming the server is unreachable.

How to Force a Specific TLS Version with OpenSSL

Add a version flag, such as -tls1_2 or -tls1_3, and OpenSSL will attempt to negotiate only that version, so success or failure tells you exactly what the server supports.

Five flags cover version control directly. The flag -tls1 targets TLS 1.0, -tls1_1 targets TLS 1.1, -tls1_2 targets TLS 1.2, and -tls1_3 targets TLS 1.3. Pair any of them with a matching -no_tls1_2 or -no_tls1_3 flag to rule a version out instead of forcing one in.

Flag Purpose Example
-tls1 Force TLS 1.0 openssl s_client -connect host:443 -tls1
-tls1_1 Force TLS 1.1 openssl s_client -connect host:443 -tls1_1
-tls1_2 Force TLS 1.2 openssl s_client -connect host:443 -tls1_2
-tls1_3 Force TLS 1.3 openssl s_client -connect host:443 -tls1_3
-no_tls1_2 Disable TLS 1.2 openssl s_client -connect host:443 -no_tls1_2
-no_tls1_3 Disable TLS 1.3 openssl s_client -connect host:443 -no_tls1_3
-brief Minimal output openssl s_client -connect host:443 -brief
-servername SNI support, required for virtual hosts openssl s_client -connect host:443 -servername host

How to Check STARTTLS Services Such as SMTP and IMAP

OpenSSL s_client checks mail and messaging protocols with the -starttls flag, which upgrades a plain connection to TLS the same way a mail server does. Use -starttls smtp against port 587 for outgoing mail, or -starttls imap against port 143 for incoming mail.

The rest of the command stays the same. Keep -servername pointed at the exact mail hostname and add -brief for a short answer. A working STARTTLS check confirms both that TLS is available on that port and which version the server offers.

How to Check the TLS Version with Curl

Curl reports the negotiated TLS version once verbose output is turned on. Run curl -sSvo /dev/null https://example.com 2>&1 | grep -E ‘SSL connection using|TLSv’ to filter the handshake log down to the one line that names the version.

Four flags map directly to protocol versions: –tlsv1.0, –tlsv1.1, –tlsv1.2, and –tlsv1.3. Which of them actually work depends on the curl build installed and the TLS library behind it, whether that is OpenSSL, GnuTLS, or something else. Some servers also enforce their own minimum version regardless of what curl requests, so a failed test can reflect server policy rather than a curl limitation.

How to Test for Exactly One TLS Version with Curl

Curl treats a single version flag as a floor, not a ceiling, so –tlsv1.2 alone still allows curl to negotiate TLS 1.3 when the server offers it. Adding –tls-max sets the ceiling: curl –tlsv1.2 –tls-max 1.2 -sSvo /dev/null https://example.com locks the test to exactly TLS 1.2, and swapping in –tlsv1.3 tests TLS 1.3 alone.

Test Scenario Command Notes
Show negotiated TLS version curl -v https://example.com 2>&1 | grep -i "TLSv" Simple quick check
Test minimum TLS 1.2 curl –tlsv1.2 https://example.com May still negotiate TLS 1.3 if available
Test exactly TLS 1.2 only curl –tlsv1.2 –tls-max 1.2 -sSvo /dev/null https://example.com Both flags required for an exact version
Test exactly TLS 1.1 curl –tlsv1.1 –tls-max 1.1 https://example.com Works only if curl was built with legacy support
Verbose TLS details curl -sSvo /dev/null https://example.com Shows all handshake details

How to Read the Full Handshake with Curl’s Verbose Output

The -v flag, or –verbose, prints the entire TLS handshake along with the server’s response headers, useful when a version check needs the full picture rather than one filtered line. Pair it with -s to silence the progress meter and -S to still show errors if the connection fails.

How to Enumerate TLS Versions with Nmap

Nmap’s ssl-enum-ciphers script lists every TLS version and cipher suite a server accepts in a single scan, then grades each one from A to F by cryptographic strength. Run nmap –script ssl-enum-ciphers -p 443 example.com and read the output grouped under headings like TLSv1.2 and TLSv1.3.

Add -sV, as in nmap -sV –script ssl-enum-ciphers -p 443 example.com, when checking a host where TLS might be running on an unexpected port. Service detection finds it even when the port number does not match the usual 443.

Scanning an IP address instead of a hostname skips Server Name Indication unless it is supplied manually. Pass –script-args tls.servername=example.com to point the scan at the right virtual host.

Nmap builds its list by opening repeated SSL and TLS connections and offering a different cipher or compressor each time, then watching which ones the server accepts. Some servers pick from whatever order the client offers, while others always rank ciphers their own way, which forces the script to run extra probes to map the full list.

Beyond version enumeration, the script flags known weaknesses such as MD5-signed certificates and the POODLE vulnerability. Treat the scan as intrusive: run it only against servers you own or have permission to test, and confirm nmap is a current version first, since many Linux distributions still ship an outdated build that misses newer ciphers and scores them incorrectly.

If I needed to decide whether a server still accepts an older TLS version, I would start with nmap rather than rely on a successful OpenSSL or curl connection. A normal connection only proves the version selected for that one handshake, and modern TLS can choose the newest mutual option. Nmap gives the broader answer because it groups the versions and cipher suites the server accepts. I would then use OpenSSL or curl to retest any version that needs a simple pass or fail confirmation.

How Do OpenSSL, Curl, and Nmap Compare for Checking TLS Versions

Each tool answers a related but different question. OpenSSL s_client and curl show what one connection negotiates right now, while nmap’s ssl-enum-ciphers script reports everything a server is willing to accept across many connections.

Tool Basic Command Exact TLS 1.2 Test Exact TLS 1.3 Test Supports STARTTLS Best Use Case
OpenSSL s_client openssl s_client -connect example.com:443 -servername example.com -brief -tls1_2 flag -tls1_3 flag Yes, -starttls smtp or -starttls imap Quick single host checks, STARTTLS services
curl curl -v https://example.com –tlsv1.2 –tls-max 1.2 –tlsv1.3 Limited STARTTLS support HTTP level testing, scripting
nmap ssl-enum-ciphers nmap –script ssl-enum-ciphers -p 443 example.com Not applicable, enumerates automatically Not applicable, enumerates automatically No Full server inventory, cipher audit

Pick the tool by the job in front of you. Checking a single site behind a known hostname is fastest with OpenSSL s_client. A script or monitoring job that needs a version check fits curl better, since its exit codes and flags are easy to automate. Auditing everything a server offers, including weak ciphers and old protocols, calls for nmap.

How to List All TLS Versions Your Linux System Supports Locally

Run openssl ciphers -v | awk ‘{print $2}’ | sort | uniq to print every TLS protocol version the installed OpenSSL library can use, independent of any remote server. Typical output includes entries like SSLv3, TLSv1, TLSv1.2, and TLSv1.3, though which ones actually appear depends on how that OpenSSL build was compiled.

This local check answers a different question than a connection test. Knowing a system supports TLS 1.3 does not mean a given server will negotiate it, and a locally available protocol can still be disabled by policy at the application layer.

The plain openssl version command is not a substitute for either check. It reports which OpenSSL build is installed on the machine, not which protocol version any past or future connection actually used.

What to Do if a TLS Version Check Fails or Times Out

A failed or hanging TLS check almost always comes down to one of three causes: a blocked port, a server that only speaks an outdated protocol, or a missing -servername flag on a site that shares an IP address with other hosts. Work through them in that order before assuming the server itself is broken.

Confirm the port is open first. A scan such as nmap -p 443 example.com shows whether anything is listening before time goes into debugging a TLS negotiation that never had a chance to start.

Rule out a Server Name Indication problem next. Re-run the OpenSSL check with -servername set to the exact hostname, not the IP address, since a shared host can silently answer with the wrong certificate and confuse the result.

For a mail or messaging service, check whether the port expects a direct TLS handshake or a STARTTLS upgrade. Testing a STARTTLS port such as 587 without the -starttls smtp flag produces a connection error that looks like a TLS failure but is really a protocol mismatch.

Old and misconfigured servers sometimes reject OpenSSL’s default connection method outright. Forcing a specific version with -tls1_2 or -tls1_3 can succeed where the default negotiation fails, and the result still shows which version, if any, the server supports.

Check the tool itself before blaming the server last. Run curl -V to confirm which TLS versions that curl build actually supports, since an older or minimal build can lack TLS 1.3 entirely regardless of what the remote server offers.

Frequently Asked Questions

Does the OpenSSL Version Command Show the TLS Version Used in a Connection?

No. The openssl version command only reports which OpenSSL build is installed on the system. To see which TLS version an actual connection used, run openssl s_client with the -brief flag against the host in question.

Why Do I Need Server Name Indication with OpenSSL?

Many websites share one IP address across multiple domains, and the server needs Server Name Indication to know which certificate and configuration to present. Leaving out -servername can return results for the wrong site entirely, so include it on every check against a shared host.

Can Curl Test TLS 1.0 or TLS 1.1 on Linux?

Curl supports –tlsv1.0 and –tlsv1.1 flags, but whether a given install can actually use them depends on the curl build and the TLS library behind it. Older protocol support is sometimes compiled out entirely, so a failed test can mean the protocol is missing locally rather than unavailable on the server.

Is Nmap Safe to Run Against Any Server?

Only run it against systems you own or have explicit permission to test. Nmap classifies the ssl-enum-ciphers script as an intrusive scan because it opens many connections in a short time, and running it against a server without authorization can violate that server’s terms of use.

How Do I Check TLS on a Non-HTTPS Service Like Email?

Add the -starttls flag to OpenSSL s_client along with the protocol name, such as -starttls smtp for port 587 or -starttls imap for port 143. The command upgrades the plain connection to TLS the same way a mail client does, then reports the negotiated version.

For a one time check, OpenSSL s_client with the -brief flag gives the fastest answer. Curl fits better inside a script or monitoring job, and nmap’s ssl-enum-ciphers script is the right call when auditing everything a server accepts in one pass. Pin services to TLS 1.2 or newer wherever the software allows it, since older protocols are the ones nmap’s grading script flags first.

What This Page Does Not Publish

  • I do not compare OpenSSL and LibreSSL behaviour here.
  • I do not explain certificate errors or tell you when to bypass validation.
  • I do not cover automation or monitoring scripts; these commands are for manual checks.

References

Author Profile

Eric Dawson
Eric Dawson
I'm Eric Dawson, the writer behind The Money Watch. I live in the Columbus, Ohio area and I write about the ordinary questions that turn out to be complicated: computers, shopping, food, travel, parking, small businesses, fees, rules and products. Every article starts with the official page, the maker or the agency, then the sources that check it, and I say plainly where they disagree and what I would do. More about how I work is on the About page.