feat: bump default TLS version to TLS v1.2

[kruskall]

What does this PR do?

Bump the default TLS version to TLS v1.2 from TLS v1.1.

Support for TLS v1.1 is not removed for the sake of compatibility.

Why is it important?

Motivated from the work in APM Server toward bumping the default TLS version to 1.2: elastic/apm-server#10491

TLS v1.1. was formally deprecated in 2021 and is considered obsolete: https://datatracker.ietf.org/doc/html/rfc8996

Several standard and the NIST guidelines for TLS implementation recommends not using TLS 1.1 or lower.

Checklist

• My code follows the style guidelines of this project
  - [ ] I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
  - [ ] I have added an entry in CHANGELOG.md

Author's Checklist

• [ ]

Related issues

Related to elastic/apm-server#10491

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-05-08T16:05:24.706+0000

• Duration: 9 min 37 sec

Test stats 🧪

Test	Results
Failed	0
Passed	777
Skipped	5
Total	782

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[cmacknz]

Let's hold off on merging this until we have have sanity checked that this won't do anything surprising when Beats, Elastic Agent, and Fleet Server are eventually updated with this change.

In particular we need to verify that an Elastic Agent defaulting to TLS v1.2 can connect to a Fleet Server defaulting to TLS v1.1 and vice versa. The version negotiation should just work, but the downside and impact of being wrong about that is big enough that I don't want to assume there will be no problems. Let's actually test it first.

Needs testing before merge

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[simitt]

@cmacknz can you provide an update whether this is planned to make it into 8.9?

[cmacknz]

No progress on this, not a high priority for us yet.

[jlind23]

@pierrehilbert can we please make this a priority for one of the next upcoming sprints? As stated by @cmacknz we should test this and it will most probably work OOTB.
Testing 7.17.X and 8.X together would be the path to take.

[ycombinator]

As mentioned in #121 (comment), the work left to do on this PR now is testing the impact of the changes in this PR before we can be confident about merging it. Concretely, the following two tests will need to be performed:

Agent using TLSv1.1 can talk to Fleet Server using TLSv1.2

For this test, Elastic Agent will need to built without any changes to its dependencies. This will produce an Agent that's using TLSv1.1.

Fleet Server will need to be built with it's elastic-agent-libs dependency temporarily pointing to a local copy that has this PR checked out in it. This will produce a Fleet Server that's using TLSv1.2.

Then it's a matter of enrolling the built Agent with the built Fleet Server and smoke testing that a few common operations in Fleet that would cause back-and-forth communication between Agent and Fleet Server work as expected.

Agent using TLSv1.2 can talk to Fleet Server using TLSv1.1

For this test, Elastic Agent will need to built with it's elastic-agent-libs dependency temporarily pointing to a local copy that has this PR checked out in it. This will produce an Agent that's using TLSv1.2.

Fleet Server will need to be built without any changes to its dependencies. This will produce a Fleet Server that's using TLSv1.1.

Then it's a matter of enrolling the built Agent with the built Fleet Server and smoke testing that a few common operations in Fleet that would cause back-and-forth communication between Agent and Fleet Server work as expected.

[kruskall]

Support for TLS v1.1 is not removed for the sake of compatibility.

this doesn't apply anymore now that we have SetInsecureDefaults. PR Updated

[kruskall]

We might want to release a new version before merging this so people can backport to 8.x, 7.x and call the insecure default func

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 88828ef

History

• 💚 Build #520 succeeded 114f794
• 💚 Build #331 succeeded b9c873c
• 💚 Build #280 succeeded 3e43bee
• 💚 Build #184 succeeded aac914e

cc @nchaulet