Restrict TLS version not working
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
Research direction
Start by reproducing the issue with the cfssl serve command and its -min-tls-version=1.3 option, then compare the result with the working 1.2 invocation. Use ssls-can to verify the enabled protocols and ciphers. Done means TLS 1.0 through 1.2 and their CBC ciphers are disabled while TLS 1.3 remains enabled.
Written by the indexing model from the issue text.
Description
When running:
/usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.3 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem
SSLSCAN returns the following
SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 enabled
TLSv1.1 enabled
TLSv1.2 enabled
TLSv1.3 enabled
While restricting the TLS version 1.2 seems to work successfully.
/usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.2 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem
However the CBC ciphers are considered problematic ans we would like to force TLS 1.3 only. With both 1.2 and 1.3 enabled we see the following protocols and ciphers available.
SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 disabled
TLSv1.1 disabled
TLSv1.2 enabled
TLSv1.3 enabledTLS Fallback SCSV:
Server supports TLS Fallback SCSVTLS renegotiation:
Session renegotiation not supportedTLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib supportHeartbleed:
TLSv1.3 not vulnerable to heartbleed
TLSv1.2 not vulnerable to heartbleedSupported Server Cipher(s):
Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253
Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253
Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253
Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253
Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253
Accepted TLSv1.2 128 bits AES128-GCM-SHA256
Accepted TLSv1.2 256 bits AES256-GCM-SHA384
Accepted TLSv1.2 128 bits AES128-SHA
Accepted TLSv1.2 256 bits AES256-SHA
Accepted TLSv1.2 112 bits TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
Accepted TLSv1.2 112 bits TLS_RSA_WITH_3DES_EDE_CBC_SHA
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- Avg merge
- 12h 48m
- Merged PRs (30d)
- 2
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudflare/cfssl
-
gencrl: serial numbers that fail to parse are added to the CRL as 0 or a partial valuePossibly taken @sebxt claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cfssl#1460 ·
Maintainers usually reply within 2 days
-
`Bundler.BundleFromRemote` fails for IPv6 address literalsPossibly taken @reginaldalfret claimed this 14 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
cloudflare/cfssl#1448 ·
Maintainers usually reply within 2 days
-
crl_override (and extensions) in /api/v1/sign request body are silently ignored by the HTTP APIPossibly taken @Hashim1999164 claimed this 69 days ago. Open
Difficulty 2/5 Half a day Newbie friendliness 78/100
cloudflare/cfssl#1439 ·
Maintainers usually reply within 2 days
-
gencrl silently revokes the wrong serial number when a line is not plain decimalPossibly taken @RaphaelFakhri claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
cloudflare/cfssl#1458 ·
Maintainers usually reply within 2 days
-
config: LoadConfig panics when not_after is before not_beforePossibly taken @sebxt claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
cloudflare/cfssl#1456 ·
Maintainers usually reply within 2 days
All issues in cloudflare/cfssl
Similar issues
-
🕷️ bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
sysadminsmedia/homebox#1805 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
router-for-me/CLIProxyAPI#6851 ·
Maintainers usually reply within 1 day
-
usage: a custom provider's balance meters ("…%" in the balance path) ignore the Left/Used switchOpen
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
[bug]: docs: Update webhook delete examples to use the correct flag (--webhook-id)Possibly taken @MuhammadHassan968 claimed this today. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 84/100
goharbor/harbor-cli#1127 ·
Maintainers usually reply within 12 days