1638023 - TLS configuration is weak

Status: VERIFIED FIXED

(Cloud Services :: Operations: Firefox Profiler, task)

Description

[Julien Wajsberg [:julienw]]

Our TLS configuration supports TLS 1.0 and TLS 1.1 as well as weak ciphers for TLS 1.2. Here is Mozilla own recommendations about TLS configuration that we need to follow.

This happens on both prod and non prod.

nonprod: ssltest
prod: ssltest

Comment 1

[Jeremy Orem [:oremj]]

We aren't able to tweak these in GCP until https://github.com/kubernetes/ingress-gce/issues/246 is fixed. I don't think we need to worry about this, all of our GCP properties have this configuration.

Comment 2

[Stephanie Ouillon [:arroway] (needinfo me)]

It looks like it has been fixed upstream: https://github.com/kubernetes/ingress-gce/issues/246#issuecomment-617991794
Jeremy, for the sake of curiosity, do you any idea what the timeline might be for having it enabled on our side? And if I understand your comment correctly, our configuration as it is should already support it when it is available, is that right?

Comment 3

[Jeremy Orem [:oremj]]

I'm not sure what the timeline will be. Judging from their previous releases, I would guess a few months away. Yeah, our configuration will support it once it is available.

Comment 4

[Julien Wajsberg [:julienw]]

This seems to be available in both regular and stable channels now: https://github.com/kubernetes/ingress-gce/issues/246#issuecomment-711438978

Do you think we can fix this on our server now? As far as I know TLS 1.0/1.1 and the weak ciphers for TLS 1.2 are still present.

Thanks!

Comment 5

[Jeremy Orem [:oremj]]

Yes, this is possible to do now. I'll update this to use our standard ssl profile.

Comment 6

[Jon Buckley [:jbuck]]

PR: https://github.com/mozilla-services/cloudops-infra/pull/3272

Comment 7

[Jon Buckley [:jbuck]]

This has been deployed to production

Comment 8

[Julien Wajsberg [:julienw]]

I can confirm that all 3 servers (prod, stage, dev) are now A+ according to ssllabs!
Thanks a lot!