Do you use the internet? Of course you do. Whether you’re at your PC or reading this on your mobile device, you’re using the internet right now. Transport Layer Security, the successor to Secure Sockets Layer, encrypts many of the internet protocols we use every day. Whenever you send sensitive data such as authentication credentials or credit card information over the web, you’d better see HTTPS in your address bar. In fact, more and more websites are being completely delivered over HTTPS, even when you’re just reading the news. Hopefully soon the entire web will be on port 443, the default for HTTPS, exclusively. TLS is also used for internet services such as email, FTP and VPN.
Although TLS encrypts internet traffic to improve our cybersecurity, it’s far from perfect. Remember Heartbleed, back in 2014? A simple syntax error made most versions of OpenSSL 1.0.1, a TLS implementation, completely useless for encryption. OpenSSL 1.0.1g’s release in April 2014 fixed the bug, and many operating systems had to be updated to their later versions.
Now it’s time to make sure that all of the pertinent software we use supports TLS 1.2 in some form or another. The protocol was initially defined in August 2008, so you’d hope developers would have caught up by now. TLS 1.0 and 1.1 are vulnerable to cipher block chaining attacks: TLS 1.2 fixes that.
Kurt Roeckx, a Debian developer, dropped TLS 1.0 and 1.1 support in Debian Unstable’s implementation of OpenSSL. In his post, he wrote:
I’ve just uploaded a version of OpenSSL to unstable that disables the TLS 1.0 and 1.1 protocol. This currently leaves TLS 1.2 as the only supported SSL/TLS protocol version.
This will likely break certain things that for whatever reason still don’t support TLS 1.2. I strongly suggest that if it’s not supported that you add support for it, or get the other side to add support for it.
OpenSSL made a release five years ago that supported TLS 1.2. The current support of the server side seems to be around 90%. I hope that by the time Buster (Debian Linux 10) releases the support for TLS 1.2 will be high enough that I don’t need to enable them again.
Roeckx’s change will only affect Debian Linux 10 and Linux distributions that may be built with it, such as future releases of Ubuntu and Linux Mint. But considering the inferior security of TLS 1.0 and 1.1, now is the time to make sure that your software supports TLS 1.2, regardless of which operating systems and web browsers you use.
Qualys SSL Labs has a list of specific web browsers, Android versions, OpenSSL versions, and Java versions and whether or not they support TLS 1.2. You should check it out yourself. If your version of Android is 4.3 or older, if you’re using Internet Explorer 10, Firefox 26, or Chrome 29, you’re out of luck. Update your software now.