使用openssl以编程方式查找已协商的TLS版本

Question

I'm using openssl in a non web application to commute a socket to TLS (STARTTLS protocol). Everything works fine, but I would also like to know which version of TLS among the allowed ones was actually negociated.

Is there any way to find this information using openssl API ?

Note: with openssl 1.1 and later the information is likely returned by the function SSL_SESSION_get_protocol_version() but I need to also find this information for previous openssl library versions (code in the wild, performing a major update of openssl for mere logging purpose is not an option).

Answer 1

You can use SSL_get_version() :

SSL_get_version() returns the name of the protocol used for the connection ssl . It should only be called after the initial handshake has been completed. Prior to that the results returned from this function may be unreliable.

RETURN VALUES

The following strings can be returned:

SSLv2
The connection uses the SSLv2 protocol.

SSLv3
The connection uses the SSLv3 protocol.

TLSv1
The connection uses the TLSv1.0 protocol.

TLSv1.1
The connection uses the TLSv1.1 protocol.

TLSv1.2
The connection uses the TLSv1.2 protocol.

unknown
This indicates an unknown protocol version.