How to Check the TLS Version on Linux (OpenSSL, Curl, Nmap)

Eric DawsonByEric Dawson Updated Computers & Software

Checking the TLS version on Linux takes one command in most cases. Run openssl s_client -connect example.com:443 -servername example.com -brief and read the Protocol version line in the output, since it names the exact version the server negotiated, such as TLSv1.3. Curl can display negotiation for one connection, while nmap’s ssl-enum-ciphers script enumerates accepted protocol versions and cipher suites. Nmap TLS 1.3 detection can fail in a documented circumstance.

How to Check TLS Version on Linux with OpenSSL

OpenSSL’s s_client command is the standard way to see which TLS version a Linux system negotiates with a remote server.

The -servername flag matters more than it looks. Many web servers host several sites on one IP address, and without Server Name Indication the server has no way to know which certificate or configuration to offer, so a check without it can report the wrong host entirely. Include -servername on every check against a shared host.

Two flags help when a quick check is not enough detail. The -debug flag prints a hex dump of the entire exchange, and -trace shows a readable log of each protocol message as it happens. Neither is needed for a routine version check, but both help when a connection fails and the cause is not obvious.

Piping </dev/null into the command, or preceding it with echo Q |, closes the connection automatically once the handshake completes. Skip that step and s_client waits for keyboard input, so the terminal appears to hang.

OpenSSL’s default connection method works with most servers, but a few very old or misconfigured ones cannot handle it and drop the connection instead. If a check against a live server fails outright, try adding -tls1_2 to force a specific version before assuming the server is unreachable.

How to Force a Specific TLS Version with OpenSSL

Add a version flag, such as -tls1_2 or -tls1_3, and OpenSSL will attempt to negotiate only that version, so success or failure tells you exactly what the server supports.

Four flags enable specific TLS versions directly. The flag -tls1 targets TLS 1.0, -tls1_1 targets TLS 1.1, -tls1_2 targets TLS 1.2, and -tls1_3 targets TLS 1.3. Use a corresponding -no_tls1_2 or -no_tls1_3 flag to rule a version out instead of forcing one in.

Flag Purpose Example
-tls1 Force TLS 1.0 openssl s_client -connect host:443 -tls1
-tls1_1 Force TLS 1.1 openssl s_client -connect host:443 -tls1_1
-tls1_2 Force TLS 1.2 openssl s_client -connect host:443 -tls1_2
-tls1_3 Force TLS 1.3 openssl s_client -connect host:443 -tls1_3
-no_tls1_2 Disable TLS 1.2 openssl s_client -connect host:443 -no_tls1_2
-no_tls1_3 Disable TLS 1.3 openssl s_client -connect host:443 -no_tls1_3
-brief Minimal output openssl s_client -connect host:443 -brief
-servername SNI support, required for virtual hosts openssl s_client -connect host:443 -servername host

How to Check STARTTLS Services Such as SMTP and IMAP

OpenSSL s_client checks mail and messaging protocols with the -starttls flag, which upgrades a plain connection to TLS the same way a mail server does. Use -starttls smtp against port 587 for outgoing mail, or -starttls imap against port 143 for incoming mail.

The rest of the command stays the same. Keep -servername pointed at the exact mail hostname and add -brief for a short answer. A working STARTTLS check confirms both that TLS is available on that port and which version the server offers.

How to Check the TLS Version with Curl

Curl reports the negotiated TLS version once verbose output is turned on. Run curl -sSvo /dev/null https://example.com 2>&1 | grep -E 'SSL connection using|TLSv[0-9]' to filter the connection details for lines that name the version.

Curl’s TLS options can set an acceptable protocol range, and the availability of specific options depends on the curl version and its underlying system libraries. If the server cannot negotiate a version within the allowed range, the transfer fails.

How to Test for Exactly One TLS Version with Curl

Curl treats a single version flag as a floor, not a ceiling, so –tlsv1.2 alone still allows curl to negotiate TLS 1.3 when the server offers it. Adding –tls-max sets the ceiling: curl --tlsv1.2 --tls-max 1.2 -sSvo /dev/null https://example.com locks the test to exactly TLS 1.2. To test exactly TLS 1.3, use curl --tlsv1.3 --tls-max 1.3 -sSvo /dev/null https://example.com.

Test Scenario Command Notes
Show negotiated TLS version curl -v https://example.com 2>&1 | grep -i "TLSv" Simple quick check
Test minimum TLS 1.2 curl –tlsv1.2 https://example.com May still negotiate TLS 1.3 if available
Test exactly TLS 1.2 only curl --tlsv1.2 --tls-max 1.2 -sSvo /dev/null https://example.com Both flags required for an exact version
Test exactly TLS 1.1 curl –tlsv1.1 –tls-max 1.1 https://example.com Works only if curl was built with legacy support
Verbose TLS details curl -sSvo /dev/null https://example.com Shows all handshake details

How to Read the Full Handshake with Curl’s Verbose Output

The -v flag, or –verbose, shows connection details and the server response without writing the response body to a file when used with -o /dev/null. Pair it with -s to silence the progress meter and -S to still show errors if the connection fails.

How to Enumerate TLS Versions with Nmap

Nmap’s ssl-enum-ciphers script lists every TLS version and cipher suite a server accepts in a single scan, then grades each one from A to F by cryptographic strength. Run nmap –script ssl-enum-ciphers -p 443 example.com and read the output grouped under headings like TLSv1.2 and TLSv1.3.

Add -sV, as in nmap -sV –script ssl-enum-ciphers -p 443 example.com, when checking a host where TLS might be running on an unexpected port. Service detection finds it even when the port number does not match the usual 443.

Scanning an IP address instead of a hostname skips Server Name Indication unless it is supplied manually. Pass –script-args tls.servername=example.com to point the scan at the right virtual host.

Nmap builds its list by opening repeated SSL and TLS connections and offering a different cipher or compressor each time, then watching which ones the server accepts. Some servers pick from whatever order the client offers, while others always rank ciphers their own way, which forces the script to run extra probes to map the full list.

Beyond version enumeration, the script flags known weaknesses such as MD5-signed certificates and the POODLE vulnerability. Treat the scan as intrusive: run it only against servers you own or have permission to test, and confirm nmap is a current version first, since many Linux distributions still ship an outdated build that misses newer ciphers and scores them incorrectly.

Since 2023, I have owned a Fujitsu ScanSnap iX1300 receipt scanner, a reminder that a tidy record can still omit the detail that matters. In How to Enumerate TLS Versions with Nmap, I would insist on checking the complete list of accepted TLS versions and cipher suites, because a partial result is bookkeeping with blinders.

How Do OpenSSL, Curl, and Nmap Compare for Checking TLS Versions

Each tool answers a related but different question. OpenSSL s_client and curl show what one connection negotiates right now, while nmap’s ssl-enum-ciphers script reports everything a server is willing to accept across many connections.

Tool Basic Command Exact TLS 1.2 Test Exact TLS 1.3 Test Supports STARTTLS Best Use Case
OpenSSL s_client openssl s_client -connect example.com:443 -servername example.com -brief -tls1_2 flag -tls1_3 flag Yes, -starttls smtp or -starttls imap Quick single host checks, STARTTLS services
curl curl -v https://example.com –tlsv1.2 –tls-max 1.2 –tlsv1.3 Limited STARTTLS support HTTP level testing, scripting
nmap ssl-enum-ciphers nmap –script ssl-enum-ciphers -p 443 example.com Not applicable, enumerates automatically Not applicable, enumerates automatically Yes Full server inventory, cipher audit

Pick the tool by the job in front of you. Checking a single site behind a known hostname is fastest with OpenSSL s_client. A script or monitoring job that needs a version check fits curl better, since its exit codes and flags are easy to automate. Auditing everything a server offers, including weak ciphers and old protocols, calls for nmap.

How to List All TLS Versions Your Linux System Supports Locally

Run openssl ciphers -v | awk '{print $2}' | sort | uniq to print the protocol version labels attached to the installed OpenSSL library’s cipher suites, independent of any remote server, as of September 2026. Typical output includes entries like SSLv3, TLSv1, TLSv1.2, and TLSv1.3, though which ones actually appear depends on how that OpenSSL build was compiled.

This local check answers a different question than a connection test. Knowing a system supports TLS 1.3 does not mean a given server will negotiate it, and a locally available protocol can still be disabled by policy at the application layer.

The plain openssl version command is not a substitute for either check. It reports which OpenSSL build is installed on the machine, not which protocol version any past or future connection actually used.

What to Do if a TLS Version Check Fails or Times Out

A failed or hanging TLS check almost always comes down to one of three causes: a blocked port, a server that only speaks an outdated protocol, or a missing -servername flag on a site that shares an IP address with other hosts. Work through them in that order before assuming the server itself is broken.

  1. Confirm the port is open first. A scan such as nmap -p 443 example.com shows whether anything is listening before time goes into debugging a TLS negotiation that never had a chance to start.
  2. Re-run the OpenSSL check with -servername set to the exact hostname, not the IP address, since a shared host can silently answer with the wrong certificate and confuse the result.
  3. For a mail or messaging service, check whether the port expects a direct TLS handshake or a STARTTLS upgrade. Testing a STARTTLS port such as 587 without the -starttls smtp flag produces a connection error that looks like a TLS failure but is really a protocol mismatch.
  4. Forcing a specific version with -tls1_2 or -tls1_3 can succeed where the default negotiation fails, and the result still shows which version, if any, the server supports.
  5. Check the tool itself before blaming the server last. Run curl -V to confirm which TLS versions that curl build actually supports, since an older or minimal build can lack TLS 1.3 entirely regardless of what the remote server offers.

Frequently Asked Questions

Does the OpenSSL Version Command Show the TLS Version Used in a Connection?

No. The openssl version command only reports which OpenSSL build is installed on the system. To see which TLS version an actual connection used, run openssl s_client with the -brief flag against the host in question.

Why Do I Need Server Name Indication with OpenSSL?

Many websites share one IP address across multiple domains, and the server needs Server Name Indication to know which certificate and configuration to present. Leaving out -servername can return results for the wrong site entirely, so include it on every check against a shared host.

Can Curl Test TLS 1.0 or TLS 1.1 on Linux?

Curl supports –tlsv1.0 and –tlsv1.1 flags, but whether a given install can actually use them depends on the curl build and the TLS library behind it. Older protocol support is sometimes compiled out entirely, so a failed test can mean the protocol is missing locally rather than unavailable on the server.

Is Nmap Safe to Run Against Any Server?

Only run it against systems you own or have explicit permission to test. Nmap classifies the ssl-enum-ciphers script as an intrusive scan because it opens many connections in a short time, and running it against a server without authorization can violate that server’s terms of use.

How Do I Check TLS on a Non-HTTPS Service Like Email?

Add the -starttls flag to OpenSSL s_client along with the protocol name, such as -starttls smtp for port 587 or -starttls imap for port 143. The command upgrades the plain connection to TLS the same way a mail client does, then reports the negotiated version.

For a one time check, OpenSSL s_client with the -brief flag gives the fastest answer. Curl fits better inside a script or monitoring job, and nmap’s ssl-enum-ciphers script is the right call when auditing everything a server accepts in one pass. Pin services to TLS 1.2 or newer wherever the software allows it, since nmap’s cipher grades do not take protocol versions into account.

References

Sources read in September 2026.

Eric Dawson

I'm Eric Dawson, and I write The Money Watch from north Columbus, Ohio. Most of what I cover comes from my own life: renting, a 2014 Honda Fit, parking, computers, food and the bills behind all of it. I spent four years in an apartment-property office and eleven on a distributor's operations desk, reading leases and invoices. Where you need real information, I research the maker's or agency's own page and independent sources and report what they publish. I don't give tax, investment, legal or medical advice.