Hacker News new | ask | show | jobs
by themew 2808 days ago
So if we remove TLS 1.1 from our servers and just offer 1.2, we fail on fallback when testing through Qualys.
5 comments

What web server are you using? I'm running numerous servers with just TLS v1.2 and get A+ at Qualys [1].

Not bragging, just curious where you fall down.

[1] https://www.ssllabs.com/ssltest/analyze.html?d=tractor.textp...

Your link shows all the clients you’re blocking. Expand the “unsupported clients” section. You’re currently blocking a lot of clients some folks care about (I say good riddance to them, but not everyone can).
There's no reason to remove TLS 1.1 from your server. This change is about the minimum protocol version supported by the browser.

Your server can advertise SSLv3 support alongside TLS 1.2, and Chrome 70 will still happily connect to it.

People also thought that there's no reason to remove SSLv2 from your server, and then the DROWN attack happened:

https://drownattack.com/

DROWN shows that merely supporting SSLv2 is a threat to modern servers and clients. It allows an attacker to decrypt modern TLS connections between up-to-date clients and servers by sending probes to a server that supports SSLv2 and uses the same private key.

> There's no reason to remove TLS 1.1 from your server.

I posit there's no reason to support TLS 1.1 on your server. There are very few clients that support TLS 1.1, but not TLS 1.2. So, either you are willing to support clients on TLS 1.0 (or SSLv3), or you aren't.

Apple only added TLS 1.2 to their SecureTransport lib in OS X 10.9, which was released in late 2013. Not so old!
Did they actually support tls 1.1 though?
1. Downgrade attacks.

2. Preventing people from shooting themselves in the foot.

Mozilla and Chrome and others will need to work with the various sites testing TLS (and "SSL") to make sure their tests stop asking for this.
You don’t “fail” due to lack of 1.1, you can still get an A+ as evidenced by Pete’s link. That said, you’ll notice that his server is blocking a bunch of clients that maybe you care about.
As far as security goes, that sounds like a good thing.