<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hello,</p>
<p>I would like to to disable TLS versions in DoT/DoH lower than 1.3
from security reasons. I am trying to use:<br>
</p>
<p><tt>addTLSLocal('0.0.0.0', '/etc/dnsdist/cert.pem',
'/etc/dnsdist/key.pem', { minTLSVersion='tls1.3',
provider='OpenSSL' })</tt></p>
<p>It seems that it does not work: when testing with testssl.sh (
3.0rc5 from <a class="moz-txt-link-freetext" href="https://testssl.sh/dev/">https://testssl.sh/dev/</a>) I can see that versions 1,
1.1 and 1.2 are still offered.</p>
<p><font size="-1"><tt>###########################################################</tt><tt><br>
</tt><tt> testssl.sh 3.0rc5 from
<a class="moz-txt-link-freetext" href="https://testssl.sh/dev/">https://testssl.sh/dev/</a></tt><tt><br>
</tt><tt><br>
</tt><tt> This program is free software. Distribution and</tt><tt><br>
</tt><tt> modification under GPLv2 permitted.</tt><tt><br>
</tt><tt> USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</tt><tt><br>
</tt><tt><br>
</tt><tt> Please file bugs @ <a class="moz-txt-link-freetext" href="https://testssl.sh/bugs/">https://testssl.sh/bugs/</a></tt><tt><br>
</tt><tt><br>
</tt><tt>###########################################################</tt><tt><br>
</tt><tt><br>
</tt><tt> Using "OpenSSL 1.0.2-chacha (1.0.2k-dev)" [~179
ciphers]</tt><tt><br>
</tt><tt> on rzt-proxy:./bin/openssl.Linux.x86_64</tt><tt><br>
</tt><tt> (built: "Jan 18 17:12:17 2019", platform:
"linux-x86_64")</tt><tt><br>
</tt><tt><br>
</tt><tt> Start 2019-11-28 09:41:31 -->>
62.141.x.x:853 (dot.xxxxx.cz) <<--</tt><tt><br>
</tt><tt><br>
</tt><tt> rDNS (62.141.x.x): dot.xxxxx.cz.</tt><tt><br>
</tt><tt> Service detected: Couldn't determine what's
running on port 853, assuming no HTTP service => skipping
all HTTP checks</tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><tt> Testing protocols via sockets except NPN+ALPN </tt><tt><br>
</tt><tt><br>
</tt><tt> SSLv2 not offered (OK)</tt><tt><br>
</tt><tt> SSLv3 not offered (OK)</tt><tt><br>
</tt><tt> TLS 1 offered</tt><tt><br>
</tt><tt> TLS 1.1 offered</tt><tt><br>
</tt><tt> TLS 1.2 offered (OK)</tt><tt><br>
</tt><tt> TLS 1.3 offered (OK): final</tt><tt><br>
</tt><tt> NPN/SPDY not offered</tt><tt><br>
</tt><tt> ALPN/HTTP2 not offered</tt></font><br>
</p>
<p>I am not sure about the syntax of options <tt>{
minTLSVersion='tls1.3', provider='OpenSSL' }, it seems to be
ignored as it accepts anything...<br>
</tt></p>
<p>Versions: Debian 10.2, dnsdist 1.4.0-1pdns.buster, openssl
1.1.1d-0+deb10u2. </p>
<p>Thanks</p>
<p>Ales Rygl<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
</body>
</html>