View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011677 | Taler | deployment and operations | public | 2026-07-25 14:58 | 2026-09-19 14:40 |
| Reporter | Christian Grothoff | Assigned To | Florian Dold | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | informing | Resolution | fixed | ||
| Platform | i7 | OS | Debian GNU/Linux | OS Version | squeeze |
| Product Version | git (master) | ||||
| Target Version | 1.6 | Fixed in Version | 1.6 | ||
| Summary | 0011677: TLS version pinning still disabled | ||||
| Description | See in Ansible: > # FIXME: comment-in later, upgrade fails if we put this immediately, > # we need to run once without, otherwise nginx will see these > # directives twice in different places and the setup script will fail. > # NOTE: remove the above comment AND the commented out lines > # below once spec has been updated once -- then update immediately > # again! > > # ssl_prefer_server_ciphers on; > ## Note: session cache is shared across all services on this server > # ssl_session_cache shared:TLS:10m; > # ssl_dhparam /etc/ssl/private/dhparam.pem; > # ssl_protocols TLSv1.3 TLSv1.2; > # ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; | ||||
| Tags | BAFIN, compliance, security | ||||
| @Christian: Your change didn't quite work, since it conflicts with the settings in nginx.conf, and there can be only one instance of the respective setting in any scope. Instead, I'll do this as a *.conf.inc file that's included from each of our server blocks. That way we can use drop-in files without having to modify nginx.conf. | |
| commit 3a6f20a0fe241cfcc97111252b261489c6a67f30 (HEAD -> master, origin/master, origin/HEAD) Author: Florian Dold <dold@taler.net> Date: Mon Sep 7 22:07:50 2026 +0200 webserver: scope TLS settings to managed HTTPS servers Move TLS settings into the shared server snippet to avoid duplicate directives in Debian nginx.conf. Inherit the packaged TLS protocol selection and remove the obsolete global drop-in before validation. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-07-25 14:58 | Christian Grothoff | New Issue | |
| 2026-07-25 14:58 | Christian Grothoff | Status | new => assigned |
| 2026-07-25 14:58 | Christian Grothoff | Assigned To | => Florian Dold |
| 2026-07-25 14:58 | Christian Grothoff | Tag Attached: security | |
| 2026-07-25 14:58 | Christian Grothoff | Tag Attached: comp | |
| 2026-07-25 14:58 | Christian Grothoff | Tag Detached: comp | |
| 2026-07-25 14:58 | Christian Grothoff | Tag Attached: BAFIN | |
| 2026-07-25 14:58 | Christian Grothoff | Tag Attached: compliance | |
| 2026-09-07 20:09 | Florian Dold | Note Added: 0029924 | |
| 2026-09-07 20:30 | Florian Dold | Status | assigned => informing |
| 2026-09-07 20:30 | Florian Dold | Resolution | open => fixed |
| 2026-09-07 20:30 | Florian Dold | Note Added: 0029925 | |
| 2026-09-19 14:39 | Christian Grothoff | Target Version | 1.7 => 1.6 |
| 2026-09-19 14:40 | Christian Grothoff | Fixed in Version | => 1.6 |