TLS 1.1-1.2 support (better, secure protocols)

[cyberduck]

34092a6 created the issue

hi David,

This feature request may not be on demand, but I'll just propose this hoping it will be reconsidered in the future versions.

I've setup 5 public WebDAV targets for developer testing (Login: webdav/webdav)

• https://dav.pixi.me/ (no SSLv3, supports TLSv1-1.2 - Apache/mod_dav framework)

• https://tlsv11.pixi.me/ (no SSLv3, supports TLSv1.1 only -Apache/mod_dav framework)

• https://tlsv12.pixi.me/ (no SSLv3, supports TLSv1.2 only - Apache/mod_dav framework)

• http://dav.negimaki.com/ (no SSL/TLS required - Apache/mod_dav framework)

• https://g2.pixi.me/w/webdav/ (no SSLv3, supports TLSv1-1.2 - Gallery 2 WebDAV module framework) - ** uploads will render 0 bytes because Cyberduck only supports certain types of WebDAV frameworks, mainly Apache/mod_dav **

ciphers we use (in Server preferred order):

• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-RC4-SHA
• ECDHE-RSA-AES256-SHA384
• ECDHE-RSA-AES128-SHA256
• ECDHE-RSA-AES128-SHA
• RC4-SHA

Per target, my testing involves these actions:

• upload/rename/delete files of various types (image, docs, pdfs)
• upload/rename/delete/move folders

I'll update the entry for Cyberduck (both platforms) in https://pixi.me/webdav.php#matrix whenever these enhancement request will get implemented in the future.

Thanks again!

Best regards,

Steve Caturan

[cyberduck]

@dkocher commented

SunJSSE Provider

1Although SunJSSE in the Java SE 7 release supports TLS 1.1 and TLS 1.2, neither version is enabled by default for client connections. Some servers do not implement forward compatibility correctly and refuse to talk to TLS 1.1 or TLS 1.2 clients. For interoperability, SunJSSE does not enable TLS 1.1 or TLS 1.2 by default for client connections

[cyberduck]

@dkocher commented

Fix use of custom SSL socket configuration in 4825fe9.

[cyberduck]

@dkocher commented

In 0c011a3.

[cyberduck]

@dkocher commented

Please test with the latest snapshot build available.

[cyberduck]

@dkocher commented

We have tests added in 0c011a3 but do not assert the protocol versions.

[cyberduck]

34092a6 commented

Thank you for implementing this enhancement, I didn't expect it this quick. I can confirm that Cyberduck 4.4.x build 14107 supports TLSv1.2, TLSv1.1 and TLSv1.0 on Apache 2.4.6/mod_ssl OpenSSL/1.0.1e

[cyberduck]

@dkocher commented

Replying to [comment:8 wwwpixime]:

Thank you for implementing this enhancement, I didn't expect it this quick. I can confirm that Cyberduck 4.4.x build 14107 supports TLSv1.2, TLSv1.1 and TLSv1.0 on Apache 2.4.6/mod_ssl OpenSSL/1.0.1e

Thanks for your testing and interoperability matrix!

[cyberduck]

@dkocher commented

TLSv1.2 is currently known not work (handshake failure) in the Windows version.

[cyberduck]

@dkocher commented

Replying to [comment:11 dkocher]:

TLSv1.2 is currently known not work (handshake failure) in the Windows version.

Caused by missing ECDHE ciphers.

[cyberduck]

@ylangisc commented

In b2e7ae3. A new snapshot build is available.

[cyberduck]

@dkocher commented

#7760 closed as duplicate.