Public bug reported:
[Description]
Since OpenSSL 1.1.1 was backported to Bionic, some (all?) applications
gained access to TLS 1.3 by default. The applications that were not
rebuilt against OpenSSL 1.1.1 can't tune the TLS 1.3 settings (protocol,
ciphersuites selection, ciphersuites order) like it's possible with 1.2
and below. As such, one should turn to configuring /etc/ssl/openssl.cnf
to alter TLS 1.3 settings.
Here is how I'd expect to be able to turn off TLS 1.3:
# diff -Naur /etc/ssl/openssl.cnf{.orig,}
--- /etc/ssl/openssl.cnf.orig 2019-06-11 10:33:02.330143086 -0400
+++ /etc/ssl/openssl.cnf 2019-06-11 11:15:23.805113804 -0400
@@ -12,6 +12,16 @@
HOME = .
RANDFILE = $ENV::HOME/.rnd
+ssl_conf = ssl_sect
+
+[ssl_sect]
+
+system_default = system_default_sect
+
+[system_default_sect]
+
+MaxProtocol = TLSv1.2
+
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
This doesn't work as 'openssl s_client -connect rproxy.sdeziel.info:443'
negotiates TLS 1.3 with TLS_AES_256_GCM_SHA384.
Similarly, trying to change the 'Ciphers' or the 'Ciphersuites' list with:
# diff -Naur /etc/ssl/openssl.cnf{.orig,}
--- /etc/ssl/openssl.cnf.orig 2019-06-11 10:33:02.330143086 -0400
+++ /etc/ssl/openssl.cnf 2019-06-11 11:37:23.362889367 -0400
@@ -12,6 +12,17 @@
HOME = .
RANDFILE = $ENV::HOME/.rnd
+ssl_conf = ssl_sect
+
+[ssl_sect]
+
+system_default = system_default_sect
+
+[system_default_sect]
+
+Ciphers = TLS_AES_128_GCM_SHA256
+Ciphersuites = TLS_AES_128_GCM_SHA256
+
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
Doesn't work as s_client keeps negotiating TLS 1.3 with
TLS_AES_256_GCM_SHA384 (!= 128)
ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: openssl 1.1.1-1ubuntu2.1~18.04.1
ProcVersionSignature: Ubuntu 4.15.0-51.55-generic 4.15.18
Uname: Linux 4.15.0-51-generic x86_64
NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
ApportVersion: 2.20.9-0ubuntu7.6
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Jun 11 11:22:47 2019
InstallationDate: Installed on 2018-07-15 (331 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Release amd64 (20180714)
ProcEnviron:
LANG=en_CA.UTF-8
TERM=xterm-256color
SHELL=/bin/bash
XDG_RUNTIME_DIR=<set>
PATH=(custom, no user)
SourcePackage: openssl
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: openssl (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug bionic rls-ee-incoming
** Attachment added: "openssl.cnf trying to disable TLS 1.3"
https://bugs.launchpad.net/bugs/1832370/+attachment/5270156/+files/openssl.cnf
** Attachment removed: "ProcCpuinfoMinimal.txt"
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1832370/+attachment/5270158/+files/ProcCpuinfoMinimal.txt
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/1832370
Title:
Unable to configure or disable TLS 1.3 via openssl.cnf
Status in openssl package in Ubuntu:
New
Bug description:
[Description]
Since OpenSSL 1.1.1 was backported to Bionic, some (all?) applications
gained access to TLS 1.3 by default. The applications that were not
rebuilt against OpenSSL 1.1.1 can't tune the TLS 1.3 settings
(protocol, ciphersuites selection, ciphersuites order) like it's
possible with 1.2 and below. As such, one should turn to configuring
/etc/ssl/openssl.cnf to alter TLS 1.3 settings.
Here is how I'd expect to be able to turn off TLS 1.3:
# diff -Naur /etc/ssl/openssl.cnf{.orig,}
--- /etc/ssl/openssl.cnf.orig 2019-06-11 10:33:02.330143086 -0400
+++ /etc/ssl/openssl.cnf 2019-06-11 11:15:23.805113804 -0400
@@ -12,6 +12,16 @@
HOME = .
RANDFILE = $ENV::HOME/.rnd
+ssl_conf = ssl_sect
+
+[ssl_sect]
+
+system_default = system_default_sect
+
+[system_default_sect]
+
+MaxProtocol = TLSv1.2
+
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
This doesn't work as 'openssl s_client -connect
rproxy.sdeziel.info:443' negotiates TLS 1.3 with
TLS_AES_256_GCM_SHA384.
Similarly, trying to change the 'Ciphers' or the 'Ciphersuites' list with:
# diff -Naur /etc/ssl/openssl.cnf{.orig,}
--- /etc/ssl/openssl.cnf.orig 2019-06-11 10:33:02.330143086 -0400
+++ /etc/ssl/openssl.cnf 2019-06-11 11:37:23.362889367 -0400
@@ -12,6 +12,17 @@
HOME = .
RANDFILE = $ENV::HOME/.rnd
+ssl_conf = ssl_sect
+
+[ssl_sect]
+
+system_default = system_default_sect
+
+[system_default_sect]
+
+Ciphers = TLS_AES_128_GCM_SHA256
+Ciphersuites = TLS_AES_128_GCM_SHA256
+
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
Doesn't work as s_client keeps negotiating TLS 1.3 with
TLS_AES_256_GCM_SHA384 (!= 128)
ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: openssl 1.1.1-1ubuntu2.1~18.04.1
ProcVersionSignature: Ubuntu 4.15.0-51.55-generic 4.15.18
Uname: Linux 4.15.0-51-generic x86_64
NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
ApportVersion: 2.20.9-0ubuntu7.6
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Jun 11 11:22:47 2019
InstallationDate: Installed on 2018-07-15 (331 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Release amd64 (20180714)
ProcEnviron:
LANG=en_CA.UTF-8
TERM=xterm-256color
SHELL=/bin/bash
XDG_RUNTIME_DIR=<set>
PATH=(custom, no user)
SourcePackage: openssl
UpgradeStatus: No upgrade log present (probably fresh install)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1832370/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
