use min tls 1.2 (#4969)

* use min tls 1.2

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* add changelog

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

services/proxy/pkg/command/server.go

@@ -163,6 +163,7 @@ func loadMiddlewares(ctx context.Context, logger log.Logger, cfg *config.Config)
 	var oidcHTTPClient = &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
+				MinVersion:         tls.VersionTLS12,
 				InsecureSkipVerify: cfg.OIDC.Insecure, //nolint:gosec
 			},
 			DisableKeepAlives: true,

services/proxy/pkg/proxy/proxy.go

@@ -51,6 +51,7 @@ func NewMultiHostReverseProxy(opts ...Option) (*MultiHostReverseProxy, error) {
 	}
 
 	tlsConf := &tls.Config{
+		MinVersion:         tls.VersionTLS12,
 		InsecureSkipVerify: options.Config.InsecureBackends, //nolint:gosec
 	}
 	if options.Config.BackendHTTPSCACert != "" {