search

atc0005 / check-cert

Go-based tooling to check/verify certs
MIT License
19 stars 3 forks source link

Ensure that TLS v1.0 is allowed #218

Open atc0005 opened 3 years ago

atc0005 commented 3 years ago

From the Go 1.17 release notes:

Beginning in the next release, Go 1.18, the Config.MinVersion for crypto/tls clients will default to TLS 1.2, disabling TLS 1.0 and TLS 1.1 by default. Applications will be able to override the change by explicitly setting Config.MinVersion. This will not affect crypto/tls servers.

The idea is that the tools in this repo will need to examine the certs from older servers, so we should permit TLS v1.0 as the baseline version.

atc0005 commented 2 years ago

Per https://go.dev/doc/go1.18#tls10:

TLS 1.0 and 1.1 disabled by default client-side

If Config.MinVersion is not set, it now defaults to TLS 1.2 for client connections. Any safely up-to-date server is expected to support TLS 1.2, and browsers have required it since 2020. TLS 1.0 and 1.1 are still supported by setting Config.MinVersion to VersionTLS10. The server-side default is unchanged at TLS 1.0.

The default can be temporarily reverted to TLS 1.0 by setting the GODEBUG=tls10default=1 environment variable. This option will be removed in Go 1.19.