标签：#tls

Runbooks still say "renew the SSL certificate" when the browser warning is obsolete protocol . The certificate can be brand new. The tunnel is still TLS 1.0. This is a shortened English note. The tables, handshake diagram, and OpenSSL CLI checks live on the original post: https://sunshout.tistory.com/2206 SSL vs TLS (the only distinction that matters) SSL is a Netscape protocol from the 1990s. SSL 3.0 is withdrawn (POODLE and friends). What every browser speaks now is TLS , currently 1.2 or 1.3. People still say "SSL cert" because vendors sold that phrase. The file is an X.509 certificate. The handshake that uses it is TLS. SSL TLS Who Netscape IETF Versions you might still see 2.0 / 3.0 (disable) 1.0 / 1.1 (disable), 1.2 / 1.3 (use) Status Forbidden Required If a ticket says "SSL is broken", translate it to: which TLS version did the handshake negotiate, and which cipher? The tunnel only has three jobs Confidentiality — encryption so a tap does not yield plaintext. Integrity — a MAC (today: AEAD) so a MITM cannot flip bits unnoticed. Authentication — the certificate binds this hostname to a key a CA will vouch for. https is that tunnel. It is not "the lock icon means the page is safe to click." It means the bits on the wire are for that name, encrypted, and unmodified. XSS and a malicious origin are a different layer. The outage that is not the certificate Symptom: new Let's Encrypt leaf, browsers still scream obsolete TLS or refuse the handshake on phones. Cause: nginx/Apache/openssl still allow TLS 1.0/1.1, or the server has no 1.2+. Renewing the cert does nothing. Check, do not guess: # must fail openssl s_client -connect example.com:443 -tls1 # must work openssl s_client -connect example.com:443 -tls1_2 nginx: ssl_protocols TLSv1.2 TLSv1.3 ; ssl_prefer_server_ciphers off ; Keep TLS 1.2 next to 1.3 if you still have old Android or old Java. New services can prefer 1.3. What to put in the cipher line Key exchange: ECDHE (forward secrecy). Static RSA key exchange

Force nginx to TLS 1.3 An nginx server is accepting an old TLS version, and the exam wants it locked to TLS one point three. The config lives in a ConfigMap. The catch is that editing the ConfigMap alone changes nothing. Let's do it the way the CKA expects. 🎥 Watch the video: https://www.youtube.com/watch?v=rx-77YBw99w This is a CKA Workloads & Scheduling walkthrough. Every command below is real output from a live cluster, and you can reproduce the whole thing yourself (scripts at the end). The scenario An nginx-static Deployment serves HTTPS, and its server config comes from a ConfigMap named nginx-config. Right now it allows both TLS one point two and one point three. Your task is to allow only TLS one point three, then make nginx actually use the change, so that a TLS one point two request fails. nginx-static serves HTTPS from the nginx-config ConfigMap It currently allows TLS 1.2 AND 1.3 Restrict ssl_protocols to TLS 1.3 only A TLS 1.2 request to the Service must then fail How nginx, ConfigMaps, and rolling restarts fit together Two ideas drive this. First, ssl_protocols is an allow list; leave only TLSv1.3 and nginx rejects any older handshake. Second, a ConfigMap mounted into a pod updates the file on disk, but nginx only reads ssl_protocols when it starts. So you must roll the Deployment, with kubectl rollout restart, for the new value to take effect. Inspect the current state Start by seeing what is running and what the config says. The nginx-static Deployment, its Service on port four forty three, and the nginx-config ConfigMap are all here. Grep the rendered ConfigMap for the ssl_protocols line: it lists TLSv1.2 and TLSv1.3, so old clients still get in. $ kubectl -n nginx-static get deploy,svc,configmap NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/nginx-static 1/1 1 1 17h deployment.apps/tester 1/1 1 1 17h NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/nginx-static ClusterIP 10.96.13.162 <none> 443/TCP 17h NAME DATA AGE configmap/kube-root-ca.