Bug 1272504 - Enable TLS 1.2 as the default in nss
Summary: Enable TLS 1.2 as the default in nss
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: nss
Version: 6.8
Hardware: Unspecified
OS: Unspecified
urgent
unspecified
Target Milestone: rc
: ---
Assignee: Elio Maldonado Batiz
QA Contact: Hubert Kario
Robert Krátký
URL:
Whiteboard:
: 1289124 1320288 (view as bug list)
Depends On:
Blocks: 1253743 1289134 1289205 1299564 1310222
TreeView+ depends on / blocked
 
Reported: 2015-10-16 15:09 UTC by Josh Bressers
Modified: 2019-10-10 10:21 UTC (History)
21 users (show)

Fixed In Version: nss-3.19.1-6.el6
Doc Type: Enhancement
Doc Text:
NSS now enables the TLS version 1.2 protocol by default In order to satisfy current best security practices, the Transport Layer Security (TLS) 1.2 protocol has been enabled by default in NSS. This means that it is no longer necessary to explicitly enable it in applications that use NSS library defaults. If both sides of TLS connection enable TLS 1.2, this protocol version is now used automatically.
Clone Of:
: 1299564 (view as bug list)
Environment:
Last Closed: 2016-05-10 21:08:45 UTC


Attachments (Terms of Use)
Enables TLS 1.2 by default (615 bytes, patch)
2015-11-18 22:58 UTC, Elio Maldonado Batiz
rrelyea: review+
Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:0820 normal SHIPPED_LIVE nss bug fix and enhancement update 2016-05-10 22:40:02 UTC

Description Josh Bressers 2015-10-16 15:09:12 UTC
We spoke in the past about making TLS 1.2 the default for RHEL6. We should do this now given the current environment and where the industry is moving.

We will likely need some bugs to fix confused clients. I will let QE and dev file those.

Comment 3 Elio Maldonado Batiz 2015-11-18 22:58:13 UTC
Created attachment 1096374 [details]
Enables TLS 1.2 by default

Comment 4 Bob Relyea 2015-11-18 23:32:05 UTC
Comment on attachment 1096374 [details]
Enables TLS 1.2 by default

r+ rrelyea.

Comment 5 Kamil Dudka 2015-12-07 16:27:09 UTC
If you intend to change the default TLS version for libcurl-based applications too,  we need to patch also the curl package as we did in RHEL-7 (bug #1170339).

Comment 6 Kamil Dudka 2015-12-08 11:48:34 UTC
(In reply to Kamil Dudka from comment #5)
> If you intend to change the default TLS version for libcurl-based
> applications too,  we need to patch also the curl package as we did in
> RHEL-7 (bug #1170339).

I will (re)use bug #1289205 for this.  Please vote for it in case you want to increase the chance of having it included in RHEL-7.3.

Comment 7 Kamil Dudka 2015-12-08 11:49:27 UTC
(In reply to Kamil Dudka from comment #6)
> I will (re)use bug #1289205 for this.  Please vote for it in case you want
> to increase the chance of having it included in RHEL-7.3.

I meant RHEL-6.8, of course...

Comment 8 Steve Almy 2015-12-08 14:54:27 UTC
*** Bug 1289124 has been marked as a duplicate of this bug. ***

Comment 26 Robert Krátký 2016-02-26 15:54:18 UTC
Hi Elio,

This bug was flagged as requiring a Release Note. Could you please fill out the Doc Text field? I'll edit it into a RN and make sure it gets published.

Thank you.

Comment 27 Elio Maldonado Batiz 2016-03-02 13:33:44 UTC
Done, kept the explanation very concise.

Comment 28 Mike Parkin 2016-03-04 12:22:28 UTC
PayPal are forcing TLS1.2 support from June 17th 2016.

https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914&viewlocale=en_US

Looking at RHEL release dates it's unclear as to whether or not 2.8 will be released in time.

Is there any chance of having this released before then?

Also linked are 1289205 and 1255920

Comment 29 Hubert Kario 2016-03-04 13:18:41 UTC
Please note that this bug is only about NSS defaults. All versions of NSS package since 3.15.2 support both TLSv1.2 and TLSv1.2-specific AES-GCM ciphersuites.

If you require ability to enable TLSv1.2 in PHP (as bug 1255920 would indicate), please contact customer support so that they work with you to provide the best solution available.

Comment 30 Mike Parkin 2016-03-04 13:48:45 UTC
Sorry - I was not clear with my original post. 

I can get a 1.2 connection by forcing tls with cURL or PHP, but it won't connect by default. Forcing isn't a very clean option as I'd have to check against a whitelist of endpoints (i.e PayPal) to decide when to force it and when not to. This is because other services don't support 1.2.

I do not have a large amount of knowledge regarding the connection between nss/curl/libcurl - so apologies if this is the wrong bug request to file this information.

Comment 31 Kamil Dudka 2016-03-04 14:12:24 UTC
(In reply to Mike Parkin from comment #30)
> I can get a 1.2 connection by forcing tls with cURL or PHP, but it won't
> connect by default. Forcing isn't a very clean option as I'd have to check
> against a whitelist of endpoints (i.e PayPal) to decide when to force it and
> when not to. This is because other services don't support 1.2.

Then you should use the CURL_SSLVERSION_TLSv1 option of libcurl to negotiate the highest available TLS 1.x version:

https://curl.haxx.se/libcurl/c/CURLOPT_SSLVERSION.html

If I am not mistaken, this is going to be the NSS default in RHEL-6.8 anyway.

Comment 32 Mike Parkin 2016-03-04 14:16:33 UTC
Thanks Kamil, that works.

Comment 33 Kamil Dudka 2016-03-04 14:18:15 UTC
(In reply to Kamil Dudka from comment #31)
> If I am not mistaken, this is going to be the NSS default in RHEL-6.8 anyway.

I should have looked first.  According to attachment #1096374 [details], NSS will allow SSL 3.0+ whereas CURL_SSLVERSION_TLSv1 means TLS 1.0+.  Still I believe that TLS 1.0+ will work for you just fine without maintaining any whitelist.

Comment 34 Mike Parkin 2016-03-04 14:19:37 UTC
Yes I think that TLS1.0+ should be widely supported enough, thank you.

Comment 35 Robert Krátký 2016-03-04 14:22:55 UTC
Thanks for the Doc Text, Elio.

Comment 39 Kai Engert (:kaie) (inactive account) 2016-04-05 11:56:52 UTC
*** Bug 1320288 has been marked as a duplicate of this bug. ***

Comment 42 errata-xmlrpc 2016-05-10 21:08:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0820.html


Note You need to log in before you can comment on or make changes to this bug.