Skip to content

Addresses #7881: removing weaker ciphers #10353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

vincepower
Copy link

Description

This is a "bug" fix to address concerns from our security teams where weak and disallowed ciphers are showing up in Typha. Often we will configure ciphers at runtime , but that does not appear to be an option for this service.

Related issues/PRs

fixes #7881

Todos

  • Tests
  • Documentation
  • Release note

@vincepower vincepower requested a review from a team as a code owner May 5, 2025 13:26
@marvin-tigera marvin-tigera added this to the Calico v3.31.0 milestone May 5, 2025
@marvin-tigera marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels May 5, 2025
@CLAassistant
Copy link

CLAassistant commented May 5, 2025

CLA assistant check
All committers have signed the CLA.

@dzacball
Copy link

dzacball commented May 7, 2025

Wouldn't it be possible to also remove TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA? These two CBC mode ciphers are also often considered weak.

@caseydavenport
Copy link
Member

I believe @lucastigera is looking at making this configurable. I don't think we can make a default set that is going to satisfy everyone's needs.

@dzacball
Copy link

dzacball commented May 7, 2025

I believe @lucastigera is looking at making this configurable. I don't think we can make a default set that is going to satisfy everyone's needs.

Wow, I see. That is very good news, and I think the best possible solution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs-pr-required Change is not yet documented release-note-required Change has user-facing impact (no matter how small)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Weak cipher suites supported on calico-typha
5 participants