IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Use only TLS 1.2 by default

Browse Source 
TLS 1.3 is causing some trouble with client cert authentication.
Conditional client cert authentication requires post-handshake
authentication extension on TLS 1.3. The new feature is not fully
implemented yet.

TLS 1.0 and 1.1 are no longer state of the art and now disabled by
default.

TLS 1.2 works everywhere and supports PFS.

Related: https://pagure.io/freeipa/issue/7667

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2019-07-01 10:41:23 +02:00
parent c484d79ecf
commit b57c818fab
5 changed files with 32 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ipaplatform/debian/tasks.py
View File

@@ -72,9 +72,10 @@ class DebianTaskNamespace(RedHatTaskNamespace):
pass
def configure_httpd_protocol(self):
# TLS 1.3 is not yet supported
directivesetter.set_directive(paths.HTTPD_SSL_CONF,
'SSLProtocol',
'all -SSLv3', False)
'TLSv1.2', False)
def setup_httpd_logging(self):
# Debian handles httpd logging differently

4
ipaplatform/redhat/tasks.py
View File

@@ -590,10 +590,10 @@ class RedHatTaskNamespace(BaseTaskNamespace):
self.systemd_daemon_reload()
def configure_httpd_protocol(self):
"""Drop SSLProtocol directive and let crypto policy handle it"""
# TLS 1.3 is not yet supported
directivesetter.set_directive(paths.HTTPD_SSL_CONF,
'SSLProtocol',
None, False)
'TLSv1.2', False)
def set_hostname(self, hostname):
ipautil.run([paths.BIN_HOSTNAMECTL, 'set-hostname', hostname])