[Bug 1832370] Re: Unable to configure or disable TLS 1.3 via openssl.cnf

[Simon Déziel]

In my tests, I used NGINX with those TLS related params:

# grep -r ssl_ /etc/nginx/nginx.conf /etc/nginx/conf.d/ /etc/nginx/sites-enabled/
/etc/nginx/nginx.conf:	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
/etc/nginx/nginx.conf:	ssl_prefer_server_ciphers on;
/etc/nginx/conf.d/ssl.conf:ssl_ciphers         TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
/etc/nginx/conf.d/ssl.conf:ssl_session_cache   shared:SSL:1m;
/etc/nginx/conf.d/ssl.conf:ssl_session_timeout 1d;
/etc/nginx/conf.d/ssl.conf:ssl_session_tickets off;
/etc/nginx/conf.d/ssl.conf:ssl_certificate     /etc/nginx/certs/sdeziel.info/fullchain.pem;
/etc/nginx/conf.d/ssl.conf:ssl_certificate_key /etc/nginx/certs/sdeziel.info/privkey.pem;
/etc/nginx/conf.d/ssl.conf:ssl_stapling on;


I used many variations of ssl_ciphers and ssl_protocols to no avail. My main goal is to have TLS 1.3 and 1.2 enabled with this ciphers list from above but that doesn't work as seen here: 
 https://dev.ssllabs.com/ssltest/analyze.html?d=sdeziel.info&s=2001%3a470%3ab1c3%3a7942%3a0%3a0%3a0%3a80&hideResults=on&latest

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/1832370

Title:
  Unable to configure or disable TLS 1.3 via openssl.cnf

Status in openssl package in Ubuntu:
  New

Bug description:
  [Description]

  Since OpenSSL 1.1.1 was backported to Bionic, some (all?) applications
  gained access to TLS 1.3 by default. The applications that were not
  rebuilt against OpenSSL 1.1.1 can't tune the TLS 1.3 settings
  (protocol, ciphersuites selection, ciphersuites order) like it's
  possible with 1.2 and below. As such, one should turn to configuring
  /etc/ssl/openssl.cnf to alter TLS 1.3 settings.

  Here is how I'd expect to be able to turn off TLS 1.3:

  # diff -Naur /etc/ssl/openssl.cnf{.orig,}
  --- /etc/ssl/openssl.cnf.orig	2019-06-11 10:33:02.330143086 -0400
  +++ /etc/ssl/openssl.cnf	2019-06-11 11:15:23.805113804 -0400
  @@ -12,6 +12,16 @@
   HOME			= .
   RANDFILE		= $ENV::HOME/.rnd
   
  +ssl_conf = ssl_sect
  +
  +[ssl_sect]
  +
  +system_default = system_default_sect
  +
  +[system_default_sect]
  +
  +MaxProtocol = TLSv1.2
  +
   # Extra OBJECT IDENTIFIER info:
   #oid_file		= $ENV::HOME/.oid
   oid_section		= new_oids

  This doesn't work as 'openssl s_client -connect
  rproxy.sdeziel.info:443' negotiates TLS 1.3 with
  TLS_AES_256_GCM_SHA384.

  
  Similarly, trying to change the 'Ciphers' or the 'Ciphersuites' list with:

  # diff -Naur /etc/ssl/openssl.cnf{.orig,}
  --- /etc/ssl/openssl.cnf.orig	2019-06-11 10:33:02.330143086 -0400
  +++ /etc/ssl/openssl.cnf	2019-06-11 11:37:23.362889367 -0400
  @@ -12,6 +12,17 @@
   HOME			= .
   RANDFILE		= $ENV::HOME/.rnd
   
  +ssl_conf = ssl_sect
  +
  +[ssl_sect]
  +
  +system_default = system_default_sect
  +
  +[system_default_sect]
  +
  +Ciphers = TLS_AES_128_GCM_SHA256
  +Ciphersuites = TLS_AES_128_GCM_SHA256
  +
   # Extra OBJECT IDENTIFIER info:
   #oid_file		= $ENV::HOME/.oid
   oid_section		= new_oids

  Doesn't work as s_client keeps negotiating TLS 1.3 with
  TLS_AES_256_GCM_SHA384 (!= 128)

  ProblemType: Bug
  DistroRelease: Ubuntu 18.04
  Package: openssl 1.1.1-1ubuntu2.1~18.04.1
  ProcVersionSignature: Ubuntu 4.15.0-51.55-generic 4.15.18
  Uname: Linux 4.15.0-51-generic x86_64
  NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
  ApportVersion: 2.20.9-0ubuntu7.6
  Architecture: amd64
  CurrentDesktop: ubuntu:GNOME
  Date: Tue Jun 11 11:22:47 2019
  InstallationDate: Installed on 2018-07-15 (331 days ago)
  InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Release amd64 (20180714)
  ProcEnviron:
   LANG=en_CA.UTF-8
   TERM=xterm-256color
   SHELL=/bin/bash
   XDG_RUNTIME_DIR=<set>
   PATH=(custom, no user)
  SourcePackage: openssl
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1832370/+subscriptions