I have uploaded a package for sponsoring by the SRU team. ** Description changed:
Since LP: #1797386, openssl with TLS 1.3 support is available on Bionic. This had the nice side effect of enabling TLS 1.3 for various services (nginx, postfix, dovecot, etc) but not apache2. TLS 1.3 support is required to use the "modern compatibility" configuration recommended by Mozilla [1]. Since Bionic is an LTS release and apache2 is popular and in main, it would be nice to have support for TLS 1.3. According to [2], support for TLS 1.3 was added in version 2.4.36 while Bionic ships 2.4.29. Disco ships with 2.4.38 so should be OK. - 1: https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility 2: https://ssl-config.mozilla.org/#server=apache&server-version=2.4.39&config=modern&openssl-version=1.1.1 + + [Test Case] + + See comment #3 for a test case, alternatively run the security team QRT + apache2 test here: https://launchpad.net/qa-regression-testing + + [Regression Potential] + + Enabling TLSv1.3 as an SRU will introduce a new protocol in certain + environments. This may be problematic for a small number of users, but + the benefit of having TLSv1.3 enabled greatly outweighs that. + + From an update point of view, the patchset is quite large, but it has + been tested by the QRT script, and in production by users. ** Changed in: apache2 (Ubuntu Bionic) Status: Triaged => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1845263 Title: [wishlist] Add TLSv1.3 support to apache2 on Bionic To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1845263/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
