Skip to content

grpc/rocsp: Use TLSv1.2 and TLSv1.3 exclusively#6600

Merged
aarongable merged 3 commits intomainfrom
redis-tls1-3
Jan 24, 2023
Merged

grpc/rocsp: Use TLSv1.2 and TLSv1.3 exclusively#6600
aarongable merged 3 commits intomainfrom
redis-tls1-3

Conversation

@beautifulentropy
Copy link
Copy Markdown
Member

@beautifulentropy beautifulentropy commented Jan 24, 2023

Fixes #6580

@beautifulentropy beautifulentropy requested a review from a team as a code owner January 24, 2023 17:32
@pgporada
Copy link
Copy Markdown
Member

pgporada commented Jan 24, 2023

LGTM

aarongable
aarongable reviewed Jan 24, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@aarongable aarongable left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the reason to not increase our TLS MaxVersion to 1.3 everywhere?

boulder/cmd/config.go

Line 184 in 55e5a24

MaxVersion: tls.VersionTLS12,

@beautifulentropy
Copy link
Copy Markdown
Member Author

beautifulentropy commented Jan 24, 2023 •
edited
Loading

What's the reason to not increase our TLS MaxVersion to 1.3 everywhere?

boulder/cmd/config.go

Line 184 in 55e5a24

MaxVersion: tls.VersionTLS12,

I suppose it didn't cross my mind to make that broader change. However, I can see now that we clamped at v1.2 in 2018 which is before (opt-in) v1.3 support had been added to crypto/tls.

I'll go ahead and make that change.

@beautifulentropy beautifulentropy changed the title rocsp: Use TLS v1.3 exclusively grpc/rocsp: Use TLSv1.3 exclusively Jan 24, 2023
aarongable
aarongable reviewed Jan 24, 2023
View reviewed changes
@aarongable aarongable requested a review from jsha January 24, 2023 20:22
@beautifulentropy beautifulentropy changed the title grpc/rocsp: Use TLSv1.3 exclusively grpc/rocsp: Use TLSv1.2 and TLSv1.3 exclusively Jan 24, 2023
@aarongable aarongable merged commit 0d6f856 into main Jan 24, 2023
@aarongable aarongable deleted the redis-tls1-3 branch January 24, 2023 20:53
@beautifulentropy beautifulentropy mentioned this pull request Apr 29, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pgporada pgporada pgporada approved these changes

@aarongable aarongable aarongable approved these changes

@jsha jsha Awaiting requested review from jsha

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Boulder should support TLS 1.3 when connecting to Redis

3 participants

@beautifulentropy @pgporada @aarongable