use min tls 1.2 (#4969)

* use min tls 1.2 Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de> * add changelog Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de> Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
2022-11-03 16:08:56 +01:00
parent 9fc64e5479
commit 0f7dba53fb
11 changed files with 21 additions and 3 deletions
@@ -64,6 +64,7 @@ func Server(opts ...Option) (http.Service, error) {
 			}

 			tlsConf = &tls.Config{
+				MinVersion:         tls.VersionTLS12,
 				InsecureSkipVerify: options.Config.Events.TLSInsecure, //nolint:gosec
 				RootCAs:            rootCAPool,
 			}
@@ -89,6 +89,7 @@ func NewService(opts ...Option) Service {
 				// When insecure is set to true then we don't need a certificate.
 				options.Config.Identity.LDAP.CACert = ""
 				tlsConf = &tls.Config{
+					MinVersion: tls.VersionTLS12,
 					//nolint:gosec // We need the ability to run with "insecure" (dev/testing)
 					InsecureSkipVerify: options.Config.Identity.LDAP.Insecure,
 				}
@@ -101,7 +102,9 @@ func NewService(opts ...Option) Service {
 					options.Logger.Fatal().Err(err).Msg("The configured LDAP CA cert does not exist")
 				}
 				if tlsConf == nil {
-					tlsConf = &tls.Config{}
+					tlsConf = &tls.Config{
+						MinVersion: tls.VersionTLS12,
+					}
 				}
 				certs := x509.NewCertPool()
 				pemData, err := ioutil.ReadFile(options.Config.Identity.LDAP.CACert)