Use system-defined TLS protocol versions #1170
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| public static class EnvironmentOverrides | ||
| { | ||
| public static bool UseLegacyExplicitSslConfiguration => | ||
| Environment.GetEnvironmentVariable("OCTOPUS_TENTACLE_USE_LEGACY_TLS") == "YES"; |
Contributor
There was a problem hiding this comment.
Should the value for this be TRUE rather than YES, as it should follow the standard bool convention?
Contributor
|
Fixes #468 Confirmed by customer with the issue |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
Historically, Halibut, and by extension, Tentacle, has explicitly defined the set of supported TLS protocols. This has allowed newer protocols to be used without requiring the underlying system to enable them by default. However, it has also meant that older protocols have remained enabled to support customers running old systems.
Modern Operating System defaults are intended to provide the appropriate balance between security and compatibility, while allowing users to control the balance. This pull request switches the default Tentacle TLS configuration to match that of the underlying Operating System.
As a temporary safety measure, the
OCTOPUS_TENTACLE_USE_LEGACY_TLSenvironment variable can be set to the valueYESto switch to the previous behaviour of explicit configuration.Results
For modern systems, this will result in TLS 1.0 and 1.1 no longer being available. Similarly, TLS 1.3 may also become unavailable if it is not configured by default.
How to review this PR
Pre-requisites