You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Now, if this proposal goes through then this won't be as big of a problem: #62459
However, what if I want to set MinVersion to tls.VersionTLS13 instead of the proposed TLS 1.2?
So I created my own wrapper function for this:
typeSafeTLSAutoCertManagerstruct {
_private*autocert.Manager
}
// SecureTLSConfig creates a new secure TLS config suitable for net/http.Server serversfunc (m*SafeTLSAutoCertManager) GetSecureTLSConfig() *tls.Config {
return&tls.Config{ //nolint:exhaustruct // I'm using Valsorda's example config: https://blog.cloudflare.com/exposing-go-on-the-internet/GetCertificate: m._private.GetCertificate,
NextProtos: []string{
"h2", "http/1.1", // enable HTTP/2acme.ALPNProto, // enable tls-alpn ACME challenges
},
PreferServerCipherSuites: true,
CurvePreferences: []tls.CurveID{
tls.X25519, // Go 1.8 onlytls.CurveP256,
},
MinVersion: tls.VersionTLS13,
}
}
But then I thought that maybe the library itself could be more user-friendly and provide some kind of hint to the user that they should not blindly use the return value from TLSConfig() and that they need to make modifications to the return value before they use it in their server.
Maybe TLSConfig() could take some parameters? Or maybe the docs could be improved?
What do you think?
The text was updated successfully, but these errors were encountered:
We generally believe in making the defaults safe any time we can, rather than telling the user they should change them. That's why we are doing #62459.
Note that if you want to limit to TLS 1.3 you can do something like
Still, I think there is nothing autocert-specific in the choice of MinVersion, so it's something which we should get right at the crypto/tls level (which indeed is #62459), rather than in the autocert docs.
I am using the example code from here: https://pkg.go.dev/golang.org/x/crypto/acme/autocert#example-Manager
Currently the Manager.TLSConfig() function takes no parameters and returns a TLSConfig that allows TLS 1.0.
The example code suggests that we should pass the return value directly into the server struct like this:
Now, if this proposal goes through then this won't be as big of a problem: #62459
However, what if I want to set MinVersion to
tls.VersionTLS13
instead of the proposed TLS 1.2?So I created my own wrapper function for this:
But then I thought that maybe the library itself could be more user-friendly and provide some kind of hint to the user that they should not blindly use the return value from
TLSConfig()
and that they need to make modifications to the return value before they use it in their server.Maybe TLSConfig() could take some parameters? Or maybe the docs could be improved?
What do you think?
The text was updated successfully, but these errors were encountered: