util: Use TLSv1.2 as minimum TLS version by default

[dveeden]

What problem does this PR solve?

Issue Number: close #36036

Problem Summary:

• https://www.rfc-editor.org/rfc/rfc8996.html#name-do-not-use-tls-11
• https://dev.mysql.com/worklog/task/?id=14519

What is changed and how it works?

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

The minimum TLS version has been changed from TLSv1.1 to TLSv1.2 to comply with IETF RFC 8996.

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• hawkingrei

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[sre-bot]

Code Coverage Details: https://codecov.io/github/pingcap/tidb/commit/b36d47ece1ce3ca9216be8d87902064e58f942da

[dveeden]

/cc @likzn @hawkingrei @zhangyangyu

[ti-chi-bot]

@dveeden: GitHub didn't allow me to request PR reviews from the following users: likzn.

Note that only pingcap members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @likzn @hawkingrei @zhangyangyu

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[zhangyangyu]

I think this is not a simple one line change. It might affect some users still using TLSv1.1(both conscious & unconscious). We need to see how the product managers think.

[dveeden]

I think this is not a simple one line change. It might affect some users still using TLSv1.1(both conscious & unconscious). We need to see how the product managers think.

Yes I agree.

If people use very old clients that use YaSSL they won't be able to use TLSv1.2 or newer.
(see also: https://dev.mysql.com/doc/refman/5.7/en/ssl-libraries.html )

However this should only be merged into master and not be backported. So this won't affect users of TiDB v6.1.x or older.

This is only changing the default, so people can change the config to allow TLSv1.1 if needed.

This will improve security and may also be beneficial for compliance with various regulations.

[dveeden]

This is how MySQL handles this: (source: https://dev.mysql.com/doc/refman/8.0/en/encrypted-connection-protocols-ciphers.html )

[dveeden]

/label security

[lulukelu]

Customers can choose TLS 1.1, 1.2, 1.3 versions, the default is to configure TLS 1.2, but does not support TLS1.0?

[dveeden]

Customers can choose TLS 1.1, 1.2, 1.3 versions, the default is to configure TLS 1.2, but does not support TLS1.0?

By default TiDB supports TLSv1.1, 1.2 and 1.3. It can be configured to support TLSv1.0.

This change would change the default to only support TLSv1.2 and TLSv1.3.

[dveeden]

@lulukelu could you suggest reviewers for this PR?

[dveeden]

/hold

I'd like to make sure @bb7133 is ok with merging this.

[dveeden]

/unhold

[ti-chi-bot]

@ljun0712: adding LGTM is restricted to approvers and reviewers in OWNERS files.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dveeden]

/hold

[bb7133]

LGTM

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bb7133, CbcWestwolf, hawkingrei, ljun0712, lulukelu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [CbcWestwolf,bb7133,hawkingrei]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2023-11-23 10:07:32.218097971 +0000 UTC m=+485280.883324151: ☑️ agreed by CbcWestwolf.
• 2024-01-04 18:19:00.117160584 +0000 UTC m=+2367431.154387526: ☑️ agreed by bb7133.

[bb7133]

/unhold