allow setting minimum TLS to 1.3

[fosterseth]

e.g.

- tls-server:
    name: server2
    cert: /home/sbf/sockceptor/certs/foo.crt
    key: /home/sbf/sockceptor/certs/foo.key
    requireclientcert: true
    clientcas: /home/sbf/sockceptor/certs/ca.crt
    minTLS13: true

cipher scan

With minTLS13: true

PORT     STATE SERVICE
2222/tcp open  EtherNetIP-1
| ssl-enum-ciphers: 
|   TLSv1.3: 
|     ciphers: 
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|     cipher preference: client
|_  least strength: A

[eqrx]

Could we maybe also restrict the cipher set for tls 1.2?

cfg := &tls.Config{
        MinVersion:               tls.VersionTLS12,
        CurvePreferences:         []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256},
        PreferServerCipherSuites: true,
        CipherSuites: []uint16{
            tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
            tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
        },
    }

This way also TLS1.2 would be robust.

[eqrx]

FYI, got my recommendation from here: https://cipherlist.eu/

[fosterseth]

a ws-listener test is failing, from the stdout of the node

ERROR 2022/04/28 17:50:18 HTTP server error: http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256).

so I added one of those ciphers just for the case of ws-listener