NXDRIVE-2920: Upgrade to TLS 1.2

docs/changes/5.5.0.md

@@ -6,7 +6,7 @@ Release date: `2024-xx-xx`
 
 - [NXDRIVE-2882](https://jira.nuxeo.com/browse/NXDRIVE-2882): fix_db should create dump.sql in same dir as db
 - [NXDRIVE-2901](https://jira.nuxeo.com/browse/NXDRIVE-2901): Authorization Error for OAuth
-- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2):
+- [NXDRIVE-2920](https://jira.nuxeo.com/browse/NXDRIVE-2920): Upgrade to TLS 1.2
 
 ### Direct Edit
 

nxdrive/utils.py

@@ -68,6 +68,8 @@
     "notBefore": "N/A",
 }
 
+MINIMUM_TLS_VERSION = "TLSv1_2"
+
 log = getLogger(__name__)
 
 
@@ -604,7 +606,10 @@ def retrieve_ssl_certificate(hostname: str, /, *, port: int = 443) -> str:
     import ssl
 
     with ssl.create_connection((hostname, port)) as conn:  # type: ignore
-        with ssl.SSLContext().wrap_socket(conn, server_hostname=hostname) as sock:
+        # Declaring a minimum version to restrict the protocol
+        context = ssl.create_default_context()
+        context.minimum_version = getattr(ssl.TLSVersion, MINIMUM_TLS_VERSION)
+        with context.wrap_socket(conn, server_hostname=hostname) as sock:
             cert_data: bytes = sock.getpeercert(binary_form=True)  # type: ignore
             return ssl.DER_cert_to_PEM_cert(cert_data)
 

tools/skiplist.py

@@ -22,6 +22,7 @@
 CliHandler.unbind_server  # Used by the arguments parser
 CustomWindow.keyPressEvent  # Called by base class
 _.close_settings_too  # Used by Appiclation.show_filters()
+context.minimum_version  # Used to set TLS minimum version
 DirectTransferModel.destination_link  # Used in QML
 DocPair.last_sync_error_date  # Check NXDRIVE-1804
 Download.transfer_type  # Used in QML