edgexfoundry / edgex-go

EdgeX Golang Services Monorepo | Owner: Core/Support WG

Apache License 2.0

1.33k stars 480 forks source link

Audit and bump TLS security level for API gateway #3680

Closed bnevis-i closed 3 years ago

bnevis-i commented 3 years ago

🚀 Feature Request

Relevant Package

Kong

Description

CII Best Practices recommends use of strong TLS ciphers. We currently deploy Kong with the default cipher list.

Describe the solution you'd like

Upgrade to "modern" ssl_cipher_suite
Enable only TLSv1.3 by default

Suggest to do this via compose file or via service definition. KONG_NGINX_HTTP_SSL_PROTOCOLS etc

Also: update environment variable section in common config section of edgex docs.

Stretch goal for Jakarta.

Validation: testtls.sh or other tool.

bnevis-i commented 3 years ago

Attaching BEFORE report. kong.before.zip

bnevis-i commented 3 years ago

Closing as will-not-fix.

The default "intermediate" ssl_cipher_suite is pretty good.

According to the testssl.sh connection simulation and using the "modern" ssl_cipher_suite, the modern suite results in also disabling TLSv1.2 which will completely block IE 11 and Edge browsers (though all most all of the other modern browsers will work).

Leaving well-enough alone.

bnevis-i commented 3 years ago

Reopening as use case is not browsers but API clients.

bnevis-i commented 3 years ago

Rationale to keeping: this is a config change, if breaks users can go back to old config. Strong desire to have TLSv1.3 in LTS.

Add TLS documentation section to documentation.

bnevis-i commented 3 years ago

After report attached.

kong.after.zip