Search code examples
sslx509tls1.2

How do I know that my openssl generates TLSv1.2

I need to generate a TLSv1.2 SSL certificate. I have done the following:

openssl genrsa -out myselfsigned.key 2048
openssl req -new -x509 -sha256 -key myselfsigned.key -out myselfsigned.cer -days 365 -subj /CN=<my localhost ip address>

Now how do I know that the certificate is actually a TLSv1.2 SSL certificate?

Solution

  • There is no such thing as a TLS 1.2 certificate. There are RSA and ECDSA certificates which can be used with various TLS protocol versions and ciphers.

    If TLS 1.2 is actually used depends on the capabilities and configuration of both client and server. You can check this when doing a packet capture and analyzing it with wireshark. Also there are often ways at server and client to find out which TLS version is in use by the current connection but how this is done depends on the client and server. For example with many browsers you get this information when clicking on the lock icon and then looking at the connection details.