Bug 34193

Summary:	Default HTTPS template has outdated SSLProtocol value
Product:	Koha	Reporter:	David Cook <dcook>
Component:	Architecture, internals, and plumbing	Assignee:	David Cook <dcook>
Status:	RESOLVED FIXED	QA Contact:	Martin Renvoize (ashimema) <martin.renvoize>
Severity:	major
Priority:	P5 - low	CC:	fridolin.somers, martin.renvoize
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:	23.11.00,23.05.03,22.11.09
Circulation function:
Attachments:	Bug 34193: SSLProtocol enable in use versions and disable deprecated versions Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

Description David Cook 2023-07-03 23:47:56 UTC

At the moment, debian/templates/apache-site-https.conf.in defaults to SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1

However, TLSv1.2 and TLSv1.3 are the only TLS versions that are supported globally at the moment. Both 1.1 and 1 are deprecated now, and are disabled in most systems. 

Where possible, you want to be using TLSv1.3, and failing that TLSv1.2.

Comment 1 David Cook 2023-07-03 23:51:07 UTC

We want to go with the following:
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 

This has the effect of enabling all the modern versions and then selectively disabling the deprecated versions.

Despite what is stated on the Apache website, "all" stands for ''+SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 +TLSv1.3''

Comment 2 David Cook 2023-07-03 23:57:18 UTC

Created attachment 152994 [details] [review]
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

This patch changes the default SSLProtocol for the Let's Encrypt
HTTPS template, so that it enables in use versions of TLS while
disabling the deprecated versions of TLS.

Comment 3 David Cook 2023-07-04 00:02:10 UTC

This one is tough to test without a public facing system that can use Let's Encrypt.

But a visual inspection shows it's good. You can always check your production systems. You should be using something like "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1" already if you're using Apache with HTTPS.

Comment 4 Martin Renvoize (ashimema) 2023-08-17 13:10:11 UTC

Created attachment 154568 [details] [review]
Bug 34193: SSLProtocol enable in use versions and disable deprecated versions

This patch changes the default SSLProtocol for the Let's Encrypt
HTTPS template, so that it enables in use versions of TLS while
disabling the deprecated versions of TLS.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 5 Martin Renvoize (ashimema) 2023-08-17 13:10:38 UTC

Confirmed this is the right thing to do.. all working as expected.. Going straight for PQA here.

Comment 6 David Cook 2023-08-17 23:58:04 UTC

(In reply to Martin Renvoize from comment #5)
> Confirmed this is the right thing to do.. all working as expected.. Going
> straight for PQA here.

Thanks, Martin!

Comment 7 Tomás Cohen Arazi (tcohen) 2023-08-18 07:35:42 UTC

Pushed to master for 23.11.

Nice work everyone, thanks!

Comment 8 Fridolin Somers 2023-08-22 06:24:07 UTC

Pushed to 23.05.x for 23.05.03

Comment 9 Pedro Amorim 2023-08-28 10:22:59 UTC

Nice work everyone!

Pushed to 22.11.x for next release