-
Notifications
You must be signed in to change notification settings - Fork 9.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
*: define strict TLS 1.2 cipher suite default #10304
Labels
Comments
/cc @wenjiaswe |
@hexfusion Moving to 3.5 |
7 tasks
Hey @serathius, @ahrtr - Now that we have #15156 merged and |
Closing as I believe we have this covered now. Happy to re-open if I am missing something. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
etcd 3.4 should set a strict and secure default cipher list. Since the current etcd default list is what is defined by Go and the fact that etcd binaries can exist in the wild for a long time. To minimize future exposure to insecure ciphers we should set this default to a strict set based on the best knowledge we have at the time. As this list is subject to change we should review and update this list on a regular basis.
I think Mozilla modern is a good place to start and would enforce TLS 1.2 .
https://github.com/mozilla/server-side-tls/blob/5bfa79352c8e6e0324962be792d803ec666fa6fc/ssl-config-generator/index.html#L185
As of today this would include.
Looking for input on why we should not enforce TLS 1.2 by default for etcd 3.4.
ref: #8320
The text was updated successfully, but these errors were encountered: