TLS 1.3 support - patch v3 #3909
Conversation
bukka
force-pushed
the
openssl_tls_13
branch
2 times, most recently
from
d9a7f2e to
c658218
Compare
|
@kelunik I enabled TLS 1.3 by default. Would you be able to give it a try with Amp if all works fine for you? |
|
@bukka thanks, I'll give it a try this week. |
|
@kelunik Did you get chance to do any testing? Think it would be great to do a bit more testing if it should go to 7.3. |
|
I will have time after the 20th to do some testing with Amp. |
|
I have been thinking about this and I will probably go just with 7.4. The fact is that this is really a feature and it is going to change the behaviour of 7.3 slightly which we should never do as part of bug fixing release if the current behaviour is not broken. It will also go through the whole cycle and it will get much better testing. |
|
I'm fine with that. If there's a major vulnerability in TLS 1.2 and everyone needs to migrate to 1.3, we can still backport it. On the other hand, it's a pretty minor patch and we could make the |
- add support for following secure options: tls-versions, tls-ciphersuites, ssl-ciphers - improve parsing Uri (e.g. previously in some cases ssl-mode has to always be in front of other secure options) - improve error messages - support trying open secure connections in loop for various TLS versions - still waiting for patches related to TLSv1.3 support in PHP: php/php-src#3650 php/php-src#3700 php/php-src#3909
Explicit TLS 1.3 will be available via in PHP 7.4: php/php-src#3909 Older PHP versions implicitly support TLS 1.3 provided that the underlying OpenSSL version supports TLS 1.3. However, for PHP 7.3 some recent changes implicitly disable TLS 1.3, so we skip TLS 1.3 tests on affected PHP versions: php/php-src#3317
Explicit TLS 1.3 will be available via in PHP 7.4: php/php-src#3909 Older PHP versions implicitly support TLS 1.3 provided that the underlying OpenSSL version supports TLS 1.3. However, for PHP 7.3 some recent changes implicitly disable TLS 1.3, so we skip TLS 1.3 tests on affected PHP versions: php/php-src#3317
Explicit TLS 1.3 support will be available in PHP 7.4: php/php-src#3909 Older PHP versions implicitly support TLS 1.3 provided that the underlying OpenSSL version supports TLS 1.3. However, for PHP 7.3 some recent changes implicitly disable TLS 1.3, so we skip TLS 1.3 tests on affected PHP versions: php/php-src#3317
This is an updated version of the PR #3700 - patch v2. It fixes logic and tests.
I plan to add it to the default as well but it needs extra tests. It's not ready for merging yet but creating a PR to see the CI result.