At the moment, debian/templates/apache-site-https.conf.in defaults to SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 However, TLSv1.2 and TLSv1.3 are the only TLS versions that are supported globally at the moment. Both 1.1 and 1 are deprecated now, and are disabled in most systems. Where possible, you want to be using TLSv1.3, and failing that TLSv1.2.
We want to go with the following: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 This has the effect of enabling all the modern versions and then selectively disabling the deprecated versions. Despite what is stated on the Apache website, "all" stands for ''+SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 +TLSv1.3''
Created attachment 152994 [details] [review] Bug 34193: SSLProtocol enable in use versions and disable deprecated versions This patch changes the default SSLProtocol for the Let's Encrypt HTTPS template, so that it enables in use versions of TLS while disabling the deprecated versions of TLS.
This one is tough to test without a public facing system that can use Let's Encrypt. But a visual inspection shows it's good. You can always check your production systems. You should be using something like "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1" already if you're using Apache with HTTPS.
Created attachment 154568 [details] [review] Bug 34193: SSLProtocol enable in use versions and disable deprecated versions This patch changes the default SSLProtocol for the Let's Encrypt HTTPS template, so that it enables in use versions of TLS while disabling the deprecated versions of TLS. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Confirmed this is the right thing to do.. all working as expected.. Going straight for PQA here.
(In reply to Martin Renvoize from comment #5) > Confirmed this is the right thing to do.. all working as expected.. Going > straight for PQA here. Thanks, Martin!
Pushed to master for 23.11. Nice work everyone, thanks!
Pushed to 23.05.x for 23.05.03
Nice work everyone! Pushed to 22.11.x for next release