Testing TLS clients

Check how secure your TLS client is using How's My SSL?. Useful for web browsers but also for other HTTPS clients, such as IoT devices, for which a JSON API is available.

Check the About page for information on what their rating means.

Example using curl

Check the TLS version used by curl:

$ curl -s https://www.howsmyssl.com/a/check | jq .tls_version
"TLS 1.2"

Forcing curl to use TLS 1.3 on a recent MacOS won't work:

$ curl --tlsv1.3 https://www.howsmyssl.com/a/check 
curl: (4) LibreSSL was built without TLS 1.3 support

Indeed, on my Catalina, curl uses libressl:

$ curl-config --configure
--enable-hidden-symbols --enable-threaded-resolver --with-gssapi --with-ssl=/usr/local/libressl

You can install an OpenSSL-linked version using brew:

brew install curl-openssl

$ /usr/local/opt/curl-openssl/bin/curl-config --ssl-backends
OpenSSL

The OpenSSL version of curl supports TLS1.3:

$ /usr/local/opt/curl-openssl/bin/curl -s https://www.howsmyssl.com/a/check | jq  '.tls_version, .rating'
"TLS 1.3"
"Probably Okay"

OpenSSL version

Default on MacOS:

$ /usr/bin/openssl version
LibreSSL 2.8.3

Note that brew supplies different versions of OpenSSL:

$ /usr/local/opt/openssl/bin/openssl version   
OpenSSL 1.0.2s  28 May 2019
$ /usr/local/opt/openssl@1.1/bin/openssl version
OpenSSL 1.1.1d  10 Sep 2019