Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot change TLS minimum version to 1.3 for internal encryption (between Ingress to Activator) #14057

Closed
izabelacg opened this issue Jun 2, 2023 · 1 comment · Fixed by #14074
Assignees
Labels
kind/feature Well-understood/specified features, ready for coding. triage/accepted Issues which should be fixed (post-triage)
Milestone

Comments

@izabelacg
Copy link
Member

Describe the feature

I attempted to change the minimum TLS version (from 1.2 to 1.3) in the activator when internal encryption is activated, but kourier-tls tests failed (PR attempt #13930). They failed when this line is changed (communication between Ingress to Activator):

MinVersion: tls.VersionTLS12,

TLS 1.3 comes with numerous enhancements, such as a quicker TLS handshake and more secure cipher suites. We should aim to move minimum version from 1.2 to 1.3.

@KauzClay
Copy link
Contributor

KauzClay commented Jun 2, 2023

For visibility, the internal-encryption feature is undergoing some changes. One of them being the switch from internal-encryption to dataplane-trust config flags, see knative/networking#778.

We may want to consider this issue as the internal encryption track moves forward

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Well-understood/specified features, ready for coding. triage/accepted Issues which should be fixed (post-triage)
Projects
Development

Successfully merging a pull request may close this issue.

3 participants