How to confirm that SMTP SES connections are using TLSv1.2

Question

I recently received the below (greatly abbreviated) email, informing me of TLS 1.0 or TLS 1.1 usage on my account. 
Whilst I have made what I believe to be the necessary changes on a test environment to upgrade to TLS 1.2, I have been unable to determine how to use AWS to confirm that these changes have been successful.
The below email suggests to me that there should be some area where I can check the TLS versions used for SMTP Messages sent, however all my current attempts of CloudWatch, CloudTrail (as recommended in the longer non abbreviated email) etc. have been unsuccessful with this.

Any advice would be greatly appreciated.

"Please see the following for further details on the TLS 1.0 or TLS 1.1 connections detected from your account to SES using Simple Mail Transfer Protocol (SMTP) to between July 16, 2023 and July 30, 2023. We are unable to provide UserAgent for these connections because it is part of the HTTP protocol, but is not part of SMTP connections.

Accepted Answer

Install a network packet analyzer on your server e.g. Wireshark 4.0.7 freeware.  Create a filter so you only see tcp port 587 traffic.  The output from the packet analyzer will tell you the TLS protocol version being used.

See the accepted answer on the same question I posted on 07/26/2023.

[How to verify TLS version used with .NET application to SES via SMTP](https://repost.aws/questions/QU7I-oFURmQ0ehoQvBoRybNw/how-to-verify-tls-version-used-with-net-application-to-ses-via-smtp)

Answer

I have the exact same issue and i got no equivalent of WireShark on my debian pure CLI server.
Therefore i tried to PAINFULLY set log chain (summoning many services : SES, CloudTrail, SNS, Lambda, CloudWatch, S3, IAM) hoping i'll see some TLS metrics for SMTP links ...
After hours of hellish setup, documentation not being super clear nor flexible enough for various needs, i managed to obtain stacks of logs but NOTHING i need to verify TLS 1.2.
I used Lake, Insights, direct log watch, various filters and queries adviced, no way out of this maze so far.
I mean, simple connection logging on SES should be a very basic feature obtainable in few clicks.
Hours of interface fight brought no result.
Yet, Amazon sends me mails asking to upgrade and their support cannot give me more infos on which version TLS was used during my tests.
It's a pity circle run.

Answer

You can follow article : https://aws.amazon.com/blogs/security/tls-1-2-required-for-aws-endpoints/

Try using CloudWatch Log Insights , it will give you details. below is the sample query. You need to select corresponding CloduWatch logs group that is specific to your services. Below result will give connection TLSv1.1 connection. For 1.2, just modify parameters inside IN clause.

```

filter tlsDetails.tlsVersion in [ "TLSv1", "TLSv1.1" ]
| stats count(*) as numOutdatedTlsCalls by userIdentity.accountId, recipientAccountId, eventSource, eventName, awsRegion, tlsDetails.tlsVersion, tlsDetails.cipherSuite, userAgent
| sort eventSource, eventName, awsRegion, tlsDetails.tlsVersion
```

I hope this gives you an idea to find records.

How to confirm that SMTP SES connections are using TLSv1.2

Relevant content