From f34f366b70e2786d0054c9e92b95bbba46048481 Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Sun, 18 Aug 2024 18:30:35 -0400 Subject: [PATCH] crypto/tls: change default minimum version to 1.2 Updates the default from 1.0 -> 1.2 for servers, bringing it in line with clients. Add a GODEBUG setting, tls10server, which lets users revert this change. Fixes #62459 Change-Id: I2b82f85b1c2d527df1f9afefae4ab30a8f0ceb41 Reviewed-on: https://go-review.googlesource.com/c/go/+/541516 LUCI-TryBot-Result: Go LUCI Reviewed-by: Damien Neil --- common.go | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/common.go b/common.go index e7dd94b..53209a6 100644 --- a/common.go +++ b/common.go @@ -746,14 +746,11 @@ type Config struct { // MinVersion contains the minimum TLS version that is acceptable. // - // By default, TLS 1.2 is currently used as the minimum when acting as a - // client, and TLS 1.0 when acting as a server. TLS 1.0 is the minimum - // supported by this package, both as a client and as a server. + // By default, TLS 1.2 is currently used as the minimum. TLS 1.0 is the + // minimum supported by this package. // - // The client-side default can temporarily be reverted to TLS 1.0 by - // including the value "x509sha1=1" in the GODEBUG environment variable. - // Note that this option will be removed in Go 1.19 (but it will still be - // possible to set this field to VersionTLS10 explicitly). + // The server-side default can be reverted to TLS 1.0 by including the value + // "tls10server=1" in the GODEBUG environment variable. MinVersion uint16 // MaxVersion contains the maximum TLS version that is acceptable. @@ -1059,8 +1056,7 @@ func (c *Config) supportedVersions(isClient bool) []uint16 { if needFIPS() && (v < fipsMinVersion(c) || v > fipsMaxVersion(c)) { continue } - if (c == nil || c.MinVersion == 0) && - isClient && v < VersionTLS12 { + if (c == nil || c.MinVersion == 0) && v < VersionTLS12 { continue } if c != nil && c.MinVersion != 0 && v < c.MinVersion {