Skip to content

K
k3s
Commit b7705d25 authored by Joe Beda's avatar Joe Beda
Browse files
Options

Merge pull request #2827 from liggitt/tlsv1

Bump minimum TLS version from SSLv3 to TLSv1.0
parents 17475cdb 2475123d
Show whitespace changes
Inline Side-by-side
Showing with 4 additions and 0 deletions
cmd/kube-apiserver/apiserver.go
View file @ b7705d25
...@@ -224,6 +224,8 @@ func main() { ...@@ -224,6 +224,8 @@ func main() {
WriteTimeout: 5 * time.Minute, WriteTimeout: 5 * time.Minute,
MaxHeaderBytes: 1 << 20, MaxHeaderBytes: 1 << 20,
TLSConfig: &tls.Config{ TLSConfig: &tls.Config{
// Change default from SSLv3 to TLSv1.0 (because of POODLE vulnerability)
MinVersion: tls.VersionTLS10,
// Populate PeerCertificates in requests, but don't reject connections without certificates // Populate PeerCertificates in requests, but don't reject connections without certificates
// This allows certificates to be validated by authenticators, while still allowing other auth types // This allows certificates to be validated by authenticators, while still allowing other auth types
ClientAuth: tls.RequestClientCert, ClientAuth: tls.RequestClientCert,
......
pkg/client/transport.go
View file @ b7705d25
...@@ -68,6 +68,8 @@ func NewClientCertTLSTransport(certFile, keyFile, caFile string) (*http.Transpor ...@@ -68,6 +68,8 @@ func NewClientCertTLSTransport(certFile, keyFile, caFile string) (*http.Transpor
certPool.AppendCertsFromPEM(data) certPool.AppendCertsFromPEM(data)
return &http.Transport{ return &http.Transport{
TLSClientConfig: &tls.Config{ TLSClientConfig: &tls.Config{
// Change default from SSLv3 to TLSv1.0 (because of POODLE vulnerability)
MinVersion: tls.VersionTLS10,
Certificates: []tls.Certificate{ Certificates: []tls.Certificate{
cert, cert,
}, },
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment