Bug 34193 - Default HTTPS template has outdated SSLProtocol value
Summary: Default HTTPS template has outdated SSLProtocol value
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low major with 1 vote (vote)
Assignee: David Cook
QA Contact: Martin Renvoize
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-03 23:47 UTC by David Cook
Modified: 2023-12-28 20:47 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.03,22.11.09


Attachments
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions (1.60 KB, patch)
2023-07-03 23:57 UTC, David Cook
Details | Diff | Splinter Review
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions (1.66 KB, patch)
2023-08-17 13:10 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2023-07-03 23:47:56 UTC
At the moment, debian/templates/apache-site-https.conf.in defaults to SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1

However, TLSv1.2 and TLSv1.3 are the only TLS versions that are supported globally at the moment. Both 1.1 and 1 are deprecated now, and are disabled in most systems. 

Where possible, you want to be using TLSv1.3, and failing that TLSv1.2.
Comment 1 David Cook 2023-07-03 23:51:07 UTC
We want to go with the following:
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 

This has the effect of enabling all the modern versions and then selectively disabling the deprecated versions.

Despite what is stated on the Apache website, "all" stands for ''+SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 +TLSv1.3''
Comment 2 David Cook 2023-07-03 23:57:18 UTC
Created attachment 152994 [details] [review]
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

This patch changes the default SSLProtocol for the Let's Encrypt
HTTPS template, so that it enables in use versions of TLS while
disabling the deprecated versions of TLS.
Comment 3 David Cook 2023-07-04 00:02:10 UTC
This one is tough to test without a public facing system that can use Let's Encrypt.

But a visual inspection shows it's good. You can always check your production systems. You should be using something like "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1" already if you're using Apache with HTTPS.
Comment 4 Martin Renvoize 2023-08-17 13:10:11 UTC
Created attachment 154568 [details] [review]
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

This patch changes the default SSLProtocol for the Let's Encrypt
HTTPS template, so that it enables in use versions of TLS while
disabling the deprecated versions of TLS.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2023-08-17 13:10:38 UTC
Confirmed this is the right thing to do.. all working as expected.. Going straight for PQA here.
Comment 6 David Cook 2023-08-17 23:58:04 UTC
(In reply to Martin Renvoize from comment #5)
> Confirmed this is the right thing to do.. all working as expected.. Going
> straight for PQA here.

Thanks, Martin!
Comment 7 Tomás Cohen Arazi 2023-08-18 07:35:42 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 8 Fridolin Somers 2023-08-22 06:24:07 UTC
Pushed to 23.05.x for 23.05.03
Comment 9 Pedro Amorim 2023-08-28 10:22:59 UTC
Nice work everyone!

Pushed to 22.11.x for next release