Bug 34193

Summary: Default HTTPS template has outdated SSLProtocol value
Product: Koha Reporter: David Cook <dcook>
Component: Architecture, internals, and plumbingAssignee: David Cook <dcook>
Status: RESOLVED FIXED QA Contact: Martin Renvoize <martin.renvoize>
Severity: major    
Priority: P5 - low CC: fridolin.somers, martin.renvoize
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.03,22.11.09
Attachments: Bug 34193: SSLProtocol enable in use versions and disable deprecated versions
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

Description David Cook 2023-07-03 23:47:56 UTC
At the moment, debian/templates/apache-site-https.conf.in defaults to SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1

However, TLSv1.2 and TLSv1.3 are the only TLS versions that are supported globally at the moment. Both 1.1 and 1 are deprecated now, and are disabled in most systems. 

Where possible, you want to be using TLSv1.3, and failing that TLSv1.2.
Comment 1 David Cook 2023-07-03 23:51:07 UTC
We want to go with the following:
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 

This has the effect of enabling all the modern versions and then selectively disabling the deprecated versions.

Despite what is stated on the Apache website, "all" stands for ''+SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 +TLSv1.3''
Comment 2 David Cook 2023-07-03 23:57:18 UTC
Created attachment 152994 [details] [review]
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

This patch changes the default SSLProtocol for the Let's Encrypt
HTTPS template, so that it enables in use versions of TLS while
disabling the deprecated versions of TLS.
Comment 3 David Cook 2023-07-04 00:02:10 UTC
This one is tough to test without a public facing system that can use Let's Encrypt.

But a visual inspection shows it's good. You can always check your production systems. You should be using something like "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1" already if you're using Apache with HTTPS.
Comment 4 Martin Renvoize 2023-08-17 13:10:11 UTC
Created attachment 154568 [details] [review]
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

This patch changes the default SSLProtocol for the Let's Encrypt
HTTPS template, so that it enables in use versions of TLS while
disabling the deprecated versions of TLS.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2023-08-17 13:10:38 UTC
Confirmed this is the right thing to do.. all working as expected.. Going straight for PQA here.
Comment 6 David Cook 2023-08-17 23:58:04 UTC
(In reply to Martin Renvoize from comment #5)
> Confirmed this is the right thing to do.. all working as expected.. Going
> straight for PQA here.

Thanks, Martin!
Comment 7 Tomás Cohen Arazi 2023-08-18 07:35:42 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 8 Fridolin Somers 2023-08-22 06:24:07 UTC
Pushed to 23.05.x for 23.05.03
Comment 9 Pedro Amorim 2023-08-28 10:22:59 UTC
Nice work everyone!

Pushed to 22.11.x for next release