Repository navigation
Make TLSv1.2 a minimum, add tls_min_version and tls_max_version - #761
Open
eglitobias wants to merge 3 commits into
Open
eglitobias wants to merge 3 commits into
eglitobias wants to merge 3 commits into
Conversation
eglitobias
force-pushed
the
tls-default-min-version
branch
2 times, most recently
from
November 4, 2026 08:39
2b7261d to
cee8d6a
Compare
eglitobias
changed the title
eglitobias
force-pushed
the
tls-default-min-version
branch
from
November 4, 2026 10:16
6c83fbf to
67a33d2
Compare
eglitobias
changed the title
eglitobias
force-pushed
the
tls-default-min-version
branch
from
November 4, 2026 10:43
67a33d2 to
d2e4525
Compare
The TLSv1.2 default was applied as both min and max version. Fixes #760
Version names are now also accepted as strings.
eglitobias
force-pushed
the
tls-default-min-version
branch
from
November 4, 2026 10:47
d2e4525 to
7e05971
Compare
eglitobias
marked this pull request as ready for review
November 4, 2026 10:50
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #760.
Without an explicit
tls_protocol, the:TLSv1_2default was applied as both min and max version, so brokers that only accept TLSv1.3 failed the handshake. TLSv1.2 is now only the lower bound.The second commit adds
tls_min_versionandtls_max_versionto set the range of versions to negotiate.tls_protocolkeeps pinning both bounds but is deprecated, so it could go in the next major release. Version names are now accepted as strings too (e.g."TLSv1_3"from YAML or ENV), which used to raiseArgumentError.The third commit warns when
tls_protocolis used, in the same style as the warning for:ack.If you would rather keep this PR to the fix, the second and third commits can be dropped.
The pinning goes back to 2.18.0 (7ec9ee8), not 2.20:
ctx.ssl_version = :TLSv1_2also sets min and max to the same version.