Bug 1272504

Summary: Enable TLS 1.2 as the default in nss
Product: Red Hat Enterprise Linux 6 Reporter: Josh Bressers <bressers>
Component: nssAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED ERRATA QA Contact: Hubert Kario <hkario>
Severity: unspecified Docs Contact: Robert Krátký <rkratky>
Priority: urgent    
Version: 6.8CC: bressers, dpal, emaldona, fkrska, hkario, kdudka, kengert, mkolbas, mmckinst, mparkin, mpoole, mschena, nkinder, rhesse, rkratky, rrelyea, salmy, srandhaw, szidek, tasander, tmraz
Target Milestone: rcKeywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: nss-3.19.1-6.el6 Doc Type: Enhancement
Doc Text:
NSS now enables the TLS version 1.2 protocol by default In order to satisfy current best security practices, the Transport Layer Security (TLS) 1.2 protocol has been enabled by default in NSS. This means that it is no longer necessary to explicitly enable it in applications that use NSS library defaults. If both sides of TLS connection enable TLS 1.2, this protocol version is now used automatically.
Story Points: ---
Clone Of:
: 1299564 (view as bug list) Environment:
Last Closed: 2016-05-10 21:08:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1253743, 1289134, 1289205, 1299564, 1310222    
Attachments:
Description Flags
Enables TLS 1.2 by default rrelyea: review+

Description Josh Bressers 2015-10-16 15:09:12 UTC
We spoke in the past about making TLS 1.2 the default for RHEL6. We should do this now given the current environment and where the industry is moving.

We will likely need some bugs to fix confused clients. I will let QE and dev file those.

Comment 3 Elio Maldonado Batiz 2015-11-18 22:58:13 UTC
Created attachment 1096374 [details]
Enables TLS 1.2 by default

Comment 4 Bob Relyea 2015-11-18 23:32:05 UTC
Comment on attachment 1096374 [details]
Enables TLS 1.2 by default

r+ rrelyea.

Comment 5 Kamil Dudka 2015-12-07 16:27:09 UTC
If you intend to change the default TLS version for libcurl-based applications too,  we need to patch also the curl package as we did in RHEL-7 (bug #1170339).

Comment 6 Kamil Dudka 2015-12-08 11:48:34 UTC
(In reply to Kamil Dudka from comment #5)
> If you intend to change the default TLS version for libcurl-based
> applications too,  we need to patch also the curl package as we did in
> RHEL-7 (bug #1170339).

I will (re)use bug #1289205 for this.  Please vote for it in case you want to increase the chance of having it included in RHEL-7.3.

Comment 7 Kamil Dudka 2015-12-08 11:49:27 UTC
(In reply to Kamil Dudka from comment #6)
> I will (re)use bug #1289205 for this.  Please vote for it in case you want
> to increase the chance of having it included in RHEL-7.3.

I meant RHEL-6.8, of course...

Comment 8 Steve Almy 2015-12-08 14:54:27 UTC
*** Bug 1289124 has been marked as a duplicate of this bug. ***

Comment 26 Robert Krátký 2016-02-26 15:54:18 UTC
Hi Elio,

This bug was flagged as requiring a Release Note. Could you please fill out the Doc Text field? I'll edit it into a RN and make sure it gets published.

Thank you.

Comment 27 Elio Maldonado Batiz 2016-03-02 13:33:44 UTC
Done, kept the explanation very concise.

Comment 28 Mike Parkin 2016-03-04 12:22:28 UTC
PayPal are forcing TLS1.2 support from June 17th 2016.

https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914&viewlocale=en_US

Looking at RHEL release dates it's unclear as to whether or not 2.8 will be released in time.

Is there any chance of having this released before then?

Also linked are 1289205 and 1255920

Comment 29 Hubert Kario 2016-03-04 13:18:41 UTC
Please note that this bug is only about NSS defaults. All versions of NSS package since 3.15.2 support both TLSv1.2 and TLSv1.2-specific AES-GCM ciphersuites.

If you require ability to enable TLSv1.2 in PHP (as bug 1255920 would indicate), please contact customer support so that they work with you to provide the best solution available.

Comment 30 Mike Parkin 2016-03-04 13:48:45 UTC
Sorry - I was not clear with my original post. 

I can get a 1.2 connection by forcing tls with cURL or PHP, but it won't connect by default. Forcing isn't a very clean option as I'd have to check against a whitelist of endpoints (i.e PayPal) to decide when to force it and when not to. This is because other services don't support 1.2.

I do not have a large amount of knowledge regarding the connection between nss/curl/libcurl - so apologies if this is the wrong bug request to file this information.

Comment 31 Kamil Dudka 2016-03-04 14:12:24 UTC
(In reply to Mike Parkin from comment #30)
> I can get a 1.2 connection by forcing tls with cURL or PHP, but it won't
> connect by default. Forcing isn't a very clean option as I'd have to check
> against a whitelist of endpoints (i.e PayPal) to decide when to force it and
> when not to. This is because other services don't support 1.2.

Then you should use the CURL_SSLVERSION_TLSv1 option of libcurl to negotiate the highest available TLS 1.x version:

https://curl.haxx.se/libcurl/c/CURLOPT_SSLVERSION.html

If I am not mistaken, this is going to be the NSS default in RHEL-6.8 anyway.

Comment 32 Mike Parkin 2016-03-04 14:16:33 UTC
Thanks Kamil, that works.

Comment 33 Kamil Dudka 2016-03-04 14:18:15 UTC
(In reply to Kamil Dudka from comment #31)
> If I am not mistaken, this is going to be the NSS default in RHEL-6.8 anyway.

I should have looked first.  According to attachment #1096374 [details], NSS will allow SSL 3.0+ whereas CURL_SSLVERSION_TLSv1 means TLS 1.0+.  Still I believe that TLS 1.0+ will work for you just fine without maintaining any whitelist.

Comment 34 Mike Parkin 2016-03-04 14:19:37 UTC
Yes I think that TLS1.0+ should be widely supported enough, thank you.

Comment 35 Robert Krátký 2016-03-04 14:22:55 UTC
Thanks for the Doc Text, Elio.

Comment 39 Kai Engert (:kaie) (inactive account) 2016-04-05 11:56:52 UTC
*** Bug 1320288 has been marked as a duplicate of this bug. ***

Comment 42 errata-xmlrpc 2016-05-10 21:08:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0820.html