elastic
[Elastic Agent] Remove TLS 1.1 from a default allowed protocol
Today our default supported protocols for beats are TLS 1.1, 1.2, and 1.3
TLS 1.1 has been deprecated by a number of standards bodies and is generally considered to be unsafe.
Now that TLS 1.3 is widely deployed and supported I would like to discuss removing TLS 1.1 as a protocol we support by default. I think there is value in keeping the support configurable, there are likely some users who still need TLS 1.1 support for one reason or another. But I would expect users to explicitly enable TLS 1.1.
This would be a breaking change, we should discuss this in the context of removing TLS 1.1 by default only for 8.0.
:100: for disabling it by default.
For 7.9/10 we could add a big ERROR/WARNING log message if we detect a connection that uses TLS1.1 and ssl_version setting has not been configured. But personally I'd be in favor to disable TLS 1.1 by default in the 7.x release cycle.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
![botelastic[bot] avatar](https://avatars.githubusercontent.com/u/6764390?v=4 "Published by a pub.dev verified publisher"){kind=small}
Hi! We just realized that we haven't looked into this issue in a while. We're sorry!
We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!
This slipped through the cracks, and I think we should do it.
@cmacknz would you have any concerns about making this change within 8.x? It would be breaking, but for a very small minority. Seems worthwhile for the improved default security.
No concerns doing this in 8.x, security is a valid reason for a breaking change. We shouldn't be exploitable by default.
I'll look to get this prioritized across the Beats/Elastic Agent/Fleet server products as there a few requests for this to be removed.
Hi! We just realized that we haven't looked into this issue in a while. We're sorry!
We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!
Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)
Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)