RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1272504 - Enable TLS 1.2 as the default in nss
Summary: Enable TLS 1.2 as the default in nss
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: nss
Version: 6.8
Hardware: Unspecified
OS: Unspecified
urgent
unspecified
Target Milestone: rc
: ---
Assignee: Elio Maldonado Batiz
QA Contact: Alicja Kario
Robert Krátký
URL:
Whiteboard:
: 1289124 1320288 (view as bug list)
Depends On:
Blocks: 1253743 1289134 1289205 1299564 1310222
TreeView+ depends on / blocked
 
Reported: 2015-10-16 15:09 UTC by Josh Bressers
Modified: 2019-11-14 07:04 UTC (History)
21 users (show)

Fixed In Version: nss-3.19.1-6.el6
Doc Type: Enhancement
Doc Text:
NSS now enables the TLS version 1.2 protocol by default In order to satisfy current best security practices, the Transport Layer Security (TLS) 1.2 protocol has been enabled by default in NSS. This means that it is no longer necessary to explicitly enable it in applications that use NSS library defaults. If both sides of TLS connection enable TLS 1.2, this protocol version is now used automatically.
Clone Of:
: 1299564 (view as bug list)
Environment:
Last Closed: 2016-05-10 21:08:45 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Enables TLS 1.2 by default (615 bytes, patch)
2015-11-18 22:58 UTC, Elio Maldonado Batiz 		rrelyea: review+
Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:0820 0 normal SHIPPED_LIVE nss bug fix and enhancement update 2016-05-10 22:40:02 UTC

Description Josh Bressers 2015-10-16 15:09:12 UTC 
We spoke in the past about making TLS 1.2 the default for RHEL6. We should do this now given the current environment and where the industry is moving.

We will likely need some bugs to fix confused clients. I will let QE and dev file those.
Comment 3 Elio Maldonado Batiz 2015-11-18 22:58:13 UTC 
Created attachment 1096374 [details]
Enables TLS 1.2 by default
Comment 4 Bob Relyea 2015-11-18 23:32:05 UTC 
Comment on attachment 1096374 [details]
Enables TLS 1.2 by default

r+ rrelyea.
Comment 5 Kamil Dudka 2015-12-07 16:27:09 UTC 
If you intend to change the default TLS version for libcurl-based applications too,  we need to patch also the curl package as we did in RHEL-7 (bug #1170339).
Comment 6 Kamil Dudka 2015-12-08 11:48:34 UTC 
(In reply to Kamil Dudka from comment #5)
> If you intend to change the default TLS version for libcurl-based
> applications too,  we need to patch also the curl package as we did in
> RHEL-7 (bug #1170339).

I will (re)use bug #1289205 for this.  Please vote for it in case you want to increase the chance of having it included in RHEL-7.3.
Comment 7 Kamil Dudka 2015-12-08 11:49:27 UTC 
(In reply to Kamil Dudka from comment #6)
> I will (re)use bug #1289205 for this.  Please vote for it in case you want
> to increase the chance of having it included in RHEL-7.3.

I meant RHEL-6.8, of course...
Comment 8 Steve Almy 2015-12-08 14:54:27 UTC 
*** Bug 1289124 has been marked as a duplicate of this bug. ***
Comment 26 Robert Krátký 2016-02-26 15:54:18 UTC 
Hi Elio,

This bug was flagged as requiring a Release Note. Could you please fill out the Doc Text field? I'll edit it into a RN and make sure it gets published.

Thank you.
Comment 27 Elio Maldonado Batiz 2016-03-02 13:33:44 UTC 
Done, kept the explanation very concise.
Comment 28 Mike Parkin 2016-03-04 12:22:28 UTC 
PayPal are forcing TLS1.2 support from June 17th 2016.

https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914&viewlocale=en_US

Looking at RHEL release dates it's unclear as to whether or not 2.8 will be released in time.

Is there any chance of having this released before then?

Also linked are 1289205 and 1255920
Comment 29 Alicja Kario 2016-03-04 13:18:41 UTC 
Please note that this bug is only about NSS defaults. All versions of NSS package since 3.15.2 support both TLSv1.2 and TLSv1.2-specific AES-GCM ciphersuites.

If you require ability to enable TLSv1.2 in PHP (as bug 1255920 would indicate), please contact customer support so that they work with you to provide the best solution available.
Comment 30 Mike Parkin 2016-03-04 13:48:45 UTC 
Sorry - I was not clear with my original post. 

I can get a 1.2 connection by forcing tls with cURL or PHP, but it won't connect by default. Forcing isn't a very clean option as I'd have to check against a whitelist of endpoints (i.e PayPal) to decide when to force it and when not to. This is because other services don't support 1.2.

I do not have a large amount of knowledge regarding the connection between nss/curl/libcurl - so apologies if this is the wrong bug request to file this information.
Comment 31 Kamil Dudka 2016-03-04 14:12:24 UTC 
(In reply to Mike Parkin from comment #30)
> I can get a 1.2 connection by forcing tls with cURL or PHP, but it won't
> connect by default. Forcing isn't a very clean option as I'd have to check
> against a whitelist of endpoints (i.e PayPal) to decide when to force it and
> when not to. This is because other services don't support 1.2.

Then you should use the CURL_SSLVERSION_TLSv1 option of libcurl to negotiate the highest available TLS 1.x version:

https://curl.haxx.se/libcurl/c/CURLOPT_SSLVERSION.html

If I am not mistaken, this is going to be the NSS default in RHEL-6.8 anyway.
Comment 32 Mike Parkin 2016-03-04 14:16:33 UTC 
Thanks Kamil, that works.
Comment 33 Kamil Dudka 2016-03-04 14:18:15 UTC 
(In reply to Kamil Dudka from comment #31)
> If I am not mistaken, this is going to be the NSS default in RHEL-6.8 anyway.

I should have looked first.  According to attachment #1096374 [details], NSS will allow SSL 3.0+ whereas CURL_SSLVERSION_TLSv1 means TLS 1.0+.  Still I believe that TLS 1.0+ will work for you just fine without maintaining any whitelist.
Comment 34 Mike Parkin 2016-03-04 14:19:37 UTC 
Yes I think that TLS1.0+ should be widely supported enough, thank you.
Comment 35 Robert Krátký 2016-03-04 14:22:55 UTC 
Thanks for the Doc Text, Elio.
Comment 39 Kai Engert (:kaie) (inactive account) 2016-04-05 11:56:52 UTC 
*** Bug 1320288 has been marked as a duplicate of this bug. ***
Comment 42 errata-xmlrpc 2016-05-10 21:08:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0820.html
Note You need to log in before you can comment on or make changes to this bug.