Web TLS Protocol Configuration

Commands are available to list Transport Layer Security (TLS) protocol versions and also to enable or disable TLS versions.

Note

• The command should be run on all nodes in a cluster.

• When enabling or disabling a TLS protocol version, the web server needs to be restarted. Running the command will show a message and carry out this task.

The following protocols are available in VOSS Automate:

• TLSv1.1

• TLSv1.2

• TLSv1.3

Important

• While TLSv1.1 is still available, you are strongly advised to move to the later versions for security reasons.

• TLSv1.2 is enabled by default upon installation. Upon upgrade, your current protocol is retained.

• TLSv1.2 can only be disabled by enabling TLSv1.3.

• web ssl list

  Example:

  $ web ssl list
  TLSv1.1: Disabled
  TLSv1.3: Disabled
  TLSv1.2: Enabled
  

  • Enabling or disabling a protocol that is already in that state, will raise an error message.

• web ssl disable <TLS version>

  • Enabling or disabling a protocol that is already in that state, will raise an error message.

  Example:

  $ web ssl disable TLSv1.1
  Disabling the TLSv1.1 protocol requires the web server to be restarted.
  Do you wish to continue? yes
  TLSv1.1: Disabled
  TLSv1.2: Enabled
  
  Restarting nginx for settings to take effect
  
  Application nginx processes stopped.
  
  
  Application services: firewall processes stopped.
  Application nginx processes started.
  

• web ssl enable <TLS version>

  Note

  • When running web ssl enable TLSv1.3, it will disable TLSv1.1 and TLSv1.2. Users will not be able to alter web ciphers.

  • When running web ssl enable TLSv1.1 or web ssl enable TLSv1.2, it will disable TLSv1.3. Users can change the web ciphers.

  • If a user enables TLSv1.1, it will also enable TLSv1.2.

  • Enabling or disabling a protocol that is already in that state, will raise an error message.

  Example:

  $ web ssl enable TLSv1.1
  Enabling the TLSv1.1 protocol requires the web server to be restarted.
  Do you wish to continue? yes
  TLSv1.1: Enabled
  TLSv1.2: Enabled
  
  
  Restarting nginx for settings to take effect
  
  Application nginx processes stopped.
  
  
  Application services: firewall processes stopped.
  Application nginx processes started.
  

The table below shows the result of running web ssl enable or web ssl disable given a specific state (from web ssl list).

State			Command	Result
1.1	1.2	1.3	on/off	1.1	1.2	1.3
off	on	off	1.1 on	on	on	off
off	off	on	1.1 on	on	on	off
off	off	on	1.2 on	off	on	off
off	on	off	1.3 on	off	off	on
on	on	off	1.3 on	off	off	on
on	on	off	1.1 off	off	on	off