MinTLSVersion is too low

[Gregory-Ledray]

https://github.com/elastic/go-elasticsearch/blob/master/elasticsearch_example_test.go

Recommends this code to configure the TLSClientConfig:

TLSClientConfig: &tls.Config{
MinVersion: tls.VersionTLS11,
},

But I ?think? (I am very unsure about this) Elasticsearch supports TLSv1.3 https://www.elastic.co/guide/en/elasticsearch/reference/current/jdk-tls-versions.html

The example repository should absolutely be updated to use tls.VersionTLS13 if it is supported by Elasticsearch.

[Gregory-Ledray]

To add to this: I came across this error because it showed up as a vulnerability via Gitlab's security vulnerability tool, which is a static analysis tool that I think uses gosec to find vulnerabilities.

[Anaethelion]

Hi @Gregory-Ledray, thanks for raising this!

I agree this example should be bumped to a more recent version of TLS.
However while Elasticsearch does support TLS1.3 if it's JDK supports it, many providers are only supporting TLS1.2.

So I would suggest raising the MinVersion in the example to 1.2 for now, what do you think ?

[Gregory-Ledray]

Any improvement would be an improvement.