Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

created traefik tls file for prod and block tls 1.0 and 1.1 #40

Merged
merged 2 commits into from
May 29, 2024

Conversation

joshdentremont
Copy link
Contributor

Adds a second tls.yml file for production sites so that prod and dev can have separate options.

Also sets the minimum TLS version for production to 1.2 in order to block TLS 1.0 and 1.1 on production sites.

To test this, there should be no change to dev sites, but spinning up a production site with this PR should cause TLS 1.0 and 1.1 to be disabled. You can test it using something like https://www.ssllabs.com/ssltest/index.html

@joshdentremont
Copy link
Contributor Author

Looks like Traefik automatically blocks TLS 1.0 and 1.1 in newer versions, but this might still be worth merging for anyone who wants to be able to edit other traefik options in production.

We could also use this to specify the cipher suites for increased security, which may be worth setting as a default.

@joshdentremont
Copy link
Contributor Author

Also specifying the cipher suites used. I based this on a scan using SSL Labs.

The last two ciphers show as weak, but were needed for supporting older versions of Safari and IE

image image image

@joecorall joecorall merged commit 4ac3d57 into Islandora-Devops:main May 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants