Depreciating TLS 1.0 and 1.1

romero2k · February 23, 2019, 9:18pm

When checking the SSL Labs test for my development site of late, using Trellis 1.0.0, and I noticed that the Trellis SSL/TLS configuration is still allowing TLS 1.0 and 1.1 instead of just 1.2.

With all of the major browser vendors announcing an end to TLS 1.0 and 1.1 support sometime in the next year or so, I’m thinking it might be time for Trellis to stop supporting it as well.

I notice that Trellis uses the H5BP templates for nginx configuration during server setup. I’m thinking it might be good to move to their intermediate policy config, which should be a good balance of supporting all of the major browsers under current support (Chrome, Firefox, Safari, Edge, and Internet Explorer) use TLS 1.2 and that’s what gets negotiated by the SSL Labs test.

If there is concern for supporting some range of older broswers that don’t support TLS 1.2, maybe there can be a setting somewhere to use the older depreciated template that keeps TLS 1.0 and 1.1 active.

Given that the philosophy of all of the Roots projects has been to use the best, most modern approaches to code and standards, I think this would be another step in the right direction to providing the best experience for the Wordpress world.

ben · February 24, 2019, 5:00pm

See https://github.com/h5bp/server-configs-nginx/pull/210

Looks like we just need to update to v3?

Last update to Trellis H5BP configs was this: https://github.com/roots/trellis/pull/973

romero2k · February 24, 2019, 5:14pm

Yes, this looks correct. Here is the “intermediate” policy I was referencing:

github.com

h5bp/server-configs-nginx/blob/d2531ac605516e8cbda2e6ee23f69bb825875c0f/h5bp/ssl/policy_intermediate.conf

# ----------------------------------------------------------------------
# | SSL policy - Intermediate                                          |
# ----------------------------------------------------------------------

# For services that don't need backward compatibility, the parameters
# below provide a higher level of security.
#
# (!) This policy enfore a strong SSL configuration, which may raise
#     errors with old clients.
#     If a more compatible profile is required, use intermediate policy.
#
# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known
#     to be weak and potentially vulnerable but are required to support
#     Microsoft Edge and Safari.
#     https://safecurves.cr.yp.to/
#
# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html

ssl_protocols TLSv1.2;

This file has been truncated. show original

system · April 6, 2019, 9:18pm

This topic was automatically closed after 42 days. New replies are no longer allowed.