Remove server support for TLS 1.0 and 1.1

[justincormack]

This should not be needed any more and is not recommended.

Signed-off-by: Justin Cormack justin.cormack@docker.com

[justincormack]

cc @n4ss

[n4ss]

I think that go-connections is used pretty much everywhere by docker, and some clients (ex: homebrew's docker-compose between ] Snow Leopard ; Sierra ]) do not support TLS > 1.0 yet because of the super old OpenSSL version (0.9.8) that is linked with the default macOS python.

This is why I added modifiers on the default config generators: 5bd7d32

That way we can set the min TLS version project-by-project / product-by-product accordingly to back-compatibility.

ps: I created a PR for homebrew's formula

[justincormack]

For Docker for Mac (which may only support 10.11 and 1.12 now?) we can ship compose linked against any version we like. That is also what Apple seems to recommend anyway. For self install most people use homebrew, which has later versions. So I think we should fix this in compose.

[dperny]

Is there any good reason to keep around TLSv1.1 as the minimum version as opposed to just going straight to TLSv1.2. I don't know of any clients that support 1.1 and not 1.2

[justincormack]

Yes, happy to remove 1.1 at the same time. Amended.

[cyli]

@n4ss @justincormack Possibly docker-compose and docker-py may support TLS>1.2 - at least, if it's pip install-ed with the TLS it should: docker/docker-py#1563.

[cyli]

LGTM

[n4ss]

lgtm

[thaJeztah]

LGTM

[vdemeester]

LGTM 🐸