Print Page - nginx TLS >=1.2

Title: nginx TLS >=1.2
Post by: siga75 on October 07, 2019, 03:14:59 PM

is there a ways to force a minimum allowed TLS version?

EDIT: I saw there's the choise on the upstream, but I didn't see in the frontend server

Title: Re: nginx TLS >=1.2
Post by: fabian on October 07, 2019, 06:45:40 PM

The frontends are hardcoded to 1.1-1.3 (1.1 is only for compatibility) but 1.3 is currently not available because the TLS library is outdated.
Imho this is a sane setting or do you want to get rid of 1.1 (which will probably cause problems with for example older Java versions, older Android devices, ...)?
It may be available with 20.1 but that's not under my control.

See https://github.com/opnsense/plugins/issues/790 for the ticket tracking the issue for HAProxy and nginx (we both suffer the same issue).

Title: Re: nginx TLS >=1.2
Post by: siga75 on October 08, 2019, 07:53:27 AM

thanks Fabian, I am fine with 1.1, I am glad 1.0 is not supported by default :)

OPNsense Forum

English Forums => General Discussion => Topic started by: siga75 on October 07, 2019, 03:14:59 PM