Drop unused TLSv1.1 support completely in tlsserver module#519
Merged
jonasbardino merged 5 commits intoMay 13, 2026
Conversation
jonasbardino
force-pushed
the
adjust/drop-tlsv1.1-support-and-require-python3.7-or-later-in-ssl-context-hardening
branch
from
44336da to
82dcde0
Compare
jonasbardino
added
the
stale check errors
Contributor
Author
|
The lint issue is old and a duplicate of the one from #338 . |
jonasbardino
added
the
battle-tested
jonasbardino
force-pushed
the
adjust/drop-tlsv1.1-support-and-require-python3.7-or-later-in-ssl-context-hardening
branch
2 times, most recently
from
cc6dd09 to
b43d97b
Compare
jonasbardino
force-pushed
the
adjust/drop-tlsv1.1-support-and-require-python3.7-or-later-in-ssl-context-hardening
branch
2 times, most recently
from
819d1b1 to
d2267b7
Compare
…it tests accordingly. Should make it clear even for code scans that we always enforce TLSv1.2+ everywhere.
…ument in symmetry with pyOpenSSL version and to avoid any client/server confusion caused by the use of `create_default_context`.
…of them now default to TLSv1.2+ and only adjust ciphers offered if the service-specific `enable_SVC_legacy_tls` conf option is set. Drop the outdated client comments and disable ftps tls_legacy now that modern pyOpenSSL is available on every supported platform. Add `enable_openid_legacy_tls` conf option and implement the same cipher handling in the built-in OpenID service.
jonasbardino
force-pushed
the
adjust/drop-tlsv1.1-support-and-require-python3.7-or-later-in-ssl-context-hardening
branch
from
d2267b7 to
adee6f6
Compare
rasmunk
reviewed
May 13, 2026
rasmunk
reviewed
May 13, 2026
Contributor
|
Other than the two comments, it looks good and should be ready for approval |
suggested in review feedback.
Contributor
Author
Thanks, updated and tested the daemons to still fundamentally work on a test deployment site once again. |
jonasbardino
deleted the
adjust/drop-tlsv1.1-support-and-require-python3.7-or-later-in-ssl-context-hardening
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drop unused TLSv1.1 support completely in
tlsservermodule and alignenable_SVC_legacy_tlsconf options across services to only enable older compatibility ciphers over the same TLSv1.2+ protocols. Adjust unit tests accordingly.Should make it clear even for code scans that we always enforce TLSv1.2+ everywhere.
Tested on one of our dev/test deployments in:
enable_SVC_legacy_tls = False)enable_SVC_legacy_tls = True)allow_pre_tlsv13manually toggled off intlsserver.py)and the scan results with
testssl.shlook sane for all three.NOTE: this PR incorporates the pending #504 so it should be rebased after that one is reviewed and merged.