How to determine which TLS/SSL protocol was negotiated when using sslvSSLv23?

Question

I am using TIdSSLIOHandlerSocketOpenSSL to open a TLS/SSL connection. I currently want to support tls 1.0 to 1.2.

I initialize the IOHandler like this.

TIdSSLIOHandlerSocketOpenSSL(FSocket.IOHandler).SSLOptions.SSLVersions := [sslvTLSv1_2,sslvTLSv1_1, sslvTLSv1];

After the connection is made, how can I get which protocol was negotiated for the connection? (Both for ensuring the configuration of both the client and test server is correct, and eventually for statistics purpose).

I checked SSLContext.Method after the connection, but it still shows sslvSSLv23 after the connection. SSLContext.SSLVersions shows [sslvTLSv1_2,sslvTLSv1_1, sslvTLSv1].

So how do I get that information?

Outclass

Answer 1

The specific negotiated protocol is in the TIdSSLIOHandlerSocketOpenSSL.SSLSocket.Cipher.Version property after the SSL/TLS session is established. OpenSSL also has a SSL_get_version() function (which Indy does not use, but you can call directly).

Labourer

Cipher.Version doesn't seem to contain the current protocol in use (Or I'm seriously missing something). If, for example, I force using only TLS1.1 on the client, Cipher.Version returns 'TLSv1/SSLv3'. I'm going to look into SSL_get_version. – Outclass

SSL_get_version did give me the information I was looking for. Thanks. – Outclass

@KenBourassa hmm, SSL_CIPHER_get_version() didn't used to be that way, but it looks like the documentation has changed since I last saw it, so the behavior has apparently changed over time. In that case, stick with SSL_get_version(). I might integrate a new property for it. – Labourer

Answer 2

Try TIdSSLIOHandlerSocketOpenSSL.SSLSocket.Cipher.Description

Tadpole