[KAFKA-9460] Enable TLSv1.2 by default and disable all others protocol versions

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.5.0
• Component/s: security
• Labels: needs-kip
• Assignee: Nikolay Izhikov
• Reporter: Nikolay Izhikov
• Reviewer: Rajini Sivaram
• Created: 21/Jan/20 12:40
• Updated: 29/Jan/20 16:22
• Resolved: 28/Jan/20 19:14

Description

In KAFKA-7251 support of TLS1.3 was introduced.

For now, only TLS1.2 and TLS1.3 are recommended for the usage, other versions of TLS considered as obsolete:

https://www.rfc-editor.org/info/rfc8446
https://en.wikipedia.org/wiki/Transport_Layer_Security#History_and_development
But testing of TLS1.3 incomplete, for now.

We should enable actual versions of the TLS protocol by default to provide to the users only secure implementations.

Users can enable obsolete versions of the TLS with the configuration if they want to.

Issue Links

• relates to: KAFKA-9320 Enable TLSv1.3 by default and disable some of the older protocols
• links to: Dev-list discussion
• links to: GitHub Pull Request #7998
• links to: KIP-553
• mentioned in: Page Loading...