Make gunicorn use TLSv1.2 only

yola / yodeploy

Python library for deployment

4 stars 0 forks source link

Make gunicorn use TLSv1.2 only #227

Closed fr33l closed 5 years ago

fr33l commented 5 years ago

PCI Council set TLS 1.0 End of Life Date on June 30 2018, details.

Gunicorn, for now has a default value ssl.PROTOCOL_SSLv23, which allows auto-negotiation between client and server, including, deprected TLS 1.0.

This PR prohibits auto-negotiation and allows only TLS 1.2.

We will update this to OP_NO_TLSv1 once this will be dealth with

Depends https://github.com/yola/chef/pull/2773

snitch commented 5 years ago

:sparkles: No lint errors found. :sparkles:

beck commented 5 years ago

Nit about commit messages: why is more important than what.

When in doubt just use this template:

Summary of change

because [OMG TELL ME WHY YOU DID THIS 🔥🙏😭😡💥!!!]

fr33l commented 5 years ago

Nit about commit messages: why is more important than what.

The why is explained in linked PR, and I don't feel like saying that in public repo is a good idea.

snitch commented 5 years ago

:sparkles: No lint errors found. :sparkles:

beck commented 5 years ago

The why is explained in linked PR

The git history is where important communication is logged. The PR description and chat is ephemeral.

The PR description exists only on Github, and Github is a social platform which can/should be easily swapped. Eg: maybe you switch to gitlab or start using an internal tool and abandon github all-together. Now the "why" is lost.