Update TLS version on production

jolicode / secret-santa

:santa: The code behind Secret Santa, the holiday bot for Slack / Discord / Webex

https://secret-santa.team/

MIT License

213 stars 19 forks source link

Update TLS version on production #212

Closed pyrech closed 2 years ago

pyrech commented 3 years ago

A security from Zoom marketplace informed us that it seems we use an obselete tls version.

Transport Layer Security versions TLS1.0 and TLS1.1 are obsolete

We need to find if this is something we can configure on our hosting provider (https://www.clever-cloud.com/doc/)

xavierlacot commented 3 years ago

Obviously the website of Clever Cloud itself only uses TLS 1.2+, so it must be possible

Nispeon commented 3 years ago

We are using TLS 1.3, the problem is that we should disallow compatibility for versions 1.0 and 1.1. It is most definitely something that has to be dealt with by sending a ticket to their support, as it is not doable from the Clever Cloud dashboard.

damienalexandre commented 3 years ago

From the support:

We will deprecate those TLS versions in the end of the year [...]

Just wait a see :sunglasses:

damienalexandre commented 2 years ago

It's fixed upstream :+1: