Skip to content
Postman API Testing Tips

How See If Postman Call Using Tls 1.2

API Testing Blog

Securing Your API Calls: How to Ensure Your Postman Requests Use TLS 1.2

Ensuring your API calls are secure is crucial. TLS 1.2 is the latest and most robust version of the Transport Layer Security protocol, offering enhanced encryption and authentication for secure communication. This guide will lead you through the steps of verifying if your Postman calls are utilizing TLS 1.2.

Step 1. Understanding the Importance of TLS 1.2

TLS 1.2 offers significant advantages over previous versions, including:

  • Stronger Encryption: Provides enhanced data protection during transmission.
  • Vulnerability Mitigation: Addresses known security flaws present in older TLS versions.
  • Improved Authentication: Ensures secure communication between client and server.

Step 2. Checking Postman Settings

Postman, the popular API testing tool, allows configuration of TLS settings. To ensure you are using TLS 1.2:

1. Navigate to Postman Settings:

Open your Postman application and click on the “Settings” option located in the top right corner (usually represented by a gear icon).

2. Select “General”:

Within the settings menu, locate and select the “General” tab.

3. Enable TLS 1.2:

Within the “General” settings tab, scroll down to the “SSL Certificate Verification” section. Ensure the “Enable SSL Certificate Verification” checkbox is actively checked. This will enable your Postman calls to use TLS 1.2 if supported by the target server. Postman defaults to using whatever TLS version is available unless explicitly configured.

4. Additional Postman Settings:

If you need more granular control over TLS behavior, you can adjust the “Trust Store Configuration.” This allows you to define the path to a custom trust store file.

Step 3. Utilizing the “openssl s_client” Command (For advanced users)

For advanced users, the “openssl s_client” command provides a powerful tool to directly investigate TLS communications. This method goes beyond Postman settings and allows you to scrutinize the actual TLS handshake process.

1. Navigate to Your Terminal:

Open a terminal window on your computer (macOS/Linux) or command prompt (Windows).

2. Execute the “openssl s_client” Command:

Terminal window
openssl s_client -connect your-api-endpoint:443 -showcerts

Replace your-api-endpoint with the hostname or IP address of your API server. For instance, api.example.com. If your API server uses a different port (not the default 443), modify the command accordingly.

3. Analyze the Output:

After running the command, the output will display detailed information about the TLS handshake process. Look for the line “Protocol:” in the output. This will indicate the negotiated TLS version. For TLS 1.2, the output should indicate “TLSv1.2”.

Step 4. Testing with Postman

Once you’ve verified the TLS settings are correct, test your API call in Postman.

1. Construct Your API Request:

In Postman, create a new request by providing the API endpoint URL, method (GET, POST, etc.), and any necessary headers or data.

2. Send the Request:

Click the “Send” button to execute the request.

3. Analyze the Response:

Inspect the response to ensure everything functions as expected. If you receive an error related to TLS, it might indicate an issue with either your server configuration or Postman settings.

Example Code & Troubleshooting

Example Code (for Postman):

{
  "url": "https://api.example.com/users",
  "method": "GET",
  "header": [],
  "body": {}
}

Troubleshooting TLS Issues:

  • Firewall Block: Ensure no firewalls on your local machine or network are blocking TLS 1.2 traffic.
  • Server Configuration: Verify that the target API server is properly configured to support TLS 1.2.
  • Outdated Libraries: Ensure all libraries used on the server-side (and any intermediaries) are up-to-date to support TLS 1.2.
  • TLS Mismatch: If your client (Postman) is using a different TLS version than the server, you might see communication errors.

By following these steps, you can effectively ensure your Postman calls utilize TLS 1.2 for secure API communication.

API Testing Blog