security: raise minimum TLS version to 1.2 - #102
Open
tas50 wants to merge 1 commit into
Open
Conversation
The HTTPS server (used when `use-ssl` is enabled) was configured with `MinVersion: tls.VersionTLS10`, which permits TLS 1.0 and 1.1. Both are deprecated (RFC 8996) and exposed to downgrade and cipher weaknesses (e.g. BEAST). All authenticated request bodies and web-UI passwords sent to /authenticate_user traverse this connection. Raise the floor to TLS 1.2. Signed-off-by: Tim Smith <tsmith84@proton.me>
tas50
force-pushed
the
fix/tls-min-version
branch
from
June 7, 2026 17:06
05b32df to
0b385da
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
When
use-sslis enabled, the HTTPS server is configured with:tls.VersionTLS10permits TLS 1.0 and 1.1, both deprecated by RFC 8996 and subject to downgrade and cipher-weakness attacks (BEAST, etc.). A network MITM can negotiate a client down to TLS 1.0. All authenticated request bodies — and web-UI passwords posted to/authenticate_user— traverse this connection.Fix
Raise the minimum to
tls.VersionTLS12(one line). TLS 1.2 is universally supported by current Chef clients; modern Go negotiates 1.3 when both sides support it.Verification
go build ./...andgo vet .pass.