Ubuntu – Which TLS protocols are enabled in Ubuntu 14.04’s OpenSSL

openssltls

This is a follow up to Override Distro Package with Custom Package?.

Does anyone know if Ubuntu 14.04's OpenSSL enables all TLS protocols (TLS1.0, TLS1.1 and TLS1.2)? Or does it have protocols disabled (TLS1.1 and TLS1.2) like past versions?

Related: how does one even check for this sort of thing?

Edit: This is not a bug report question; nor is it a developer question. You guys are taking the "Close as Bug Report" much too far.

Best Answer

$ cat /etc/issue
Ubuntu 14.04 LTS \n \l

$ apt-cache policy openssl
openssl:
  Installed: 1.0.1f-1ubuntu2
  Candidate: 1.0.1f-1ubuntu2
  Version table:
 *** 1.0.1f-1ubuntu2 0
        500 http://us.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages
        100 /var/lib/dpkg/status

$ openssl ciphers -v 'TLSv1.2' | head -4
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384

Related Solutions

Ubuntu – Override Distro Package with Custom Package

Yes, you can provide packages in a PPA that will install over top the standard Ubuntu packages. However, you will have to take the time to keep the packages up to date whenever new versions are released into Ubuntu. You may also want to check that it is still not enabled in the packages in Trusty as well. If it's already enabled in Trusty, then when 14.04 LTS is released in April 2014, it might be better to just upgrade. If it's not already enabled, you might want to discuss with the Ubuntu security team, about getting it enabled, by filing a bug report, and subscribing them to it.

You can do it by fixing the version number. For example, if the current version in Ubuntu is 1.0.1e-0ubuntu1, then you'll want to specify your version as 1.0.1e-0ubuntu1.1~12.04.1 for building in your PPA. Appending the .1~12.04.1 makes it higher than the current Ubuntu version, but lower than the next Ubuntu version (so that if there is a security update in Ubuntu, it will take precedence). The 12.04 portion specifies it's built for 12.04, and the final .1 is your build number (in case you make a mistake and need to rebuild the same package, you can bump this to .2 for example). You will also need to specify the appropriate release series code name in the debian/changelog file as precise for 12.04, though if building off the existing 12.04 packages, on 12.04, should be set by default already.

Ubuntu – Enable TLS 1.0 and TLS 1.1 on Ubuntu 20.04

I finally found out how to enable for nginx (afraid I don't know how to do it system-wide) and other services with a configuration allowing changing ciphers.

Source: man ciphers.1ssl

Edit your nginx configuration and amend your cipherlist to add the pseudocipher @SECLEVEL=1.

Example:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

becomes

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
# seclevel for TLS 1.0 and 1.1
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:@SECLEVEL=1";

Best Answer

Related Solutions

Ubuntu – Override Distro Package with Custom Package

Ubuntu – Enable TLS 1.0 and TLS 1.1 on Ubuntu 20.04

Related Question