Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-61241

TLSv1.1 supportability for ingress on 4.16+

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Important
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      Documentation bug for https://issues.redhat.com/browse/OCPBUGS-53302
      
      For OCP 4.16+ TLSv1.1 is documented to be supported [1] for the Ingress Controller, however TLSv1.1 is disabled on RHEL9 on which 4.16+ images are based. Even the LEGACY policy in RHEL9 enforces TLSv1.2 as minimum [2][3] so working around this is not trivial.
      
      Since this documented procedure [4] for the old profile does not enable TLSv1.1 for ingress, it should be updated. 
      
      [1] https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/security_and_compliance/tls-security-profiles#tls-profiles-understanding_tls-security-profiles
      [2] https://access.redhat.com/solutions/7099498
      [3] https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/securing_networks/planning-and-implementing-tls_securing-networks#protocols
      [4] https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/security_and_compliance/tls-security-profiles#tls-profiles-ingress-configuring_tls-security-profiles    

      Version-Release number of selected component (if applicable):

      4.16+    

      How reproducible:

          

      Steps to Reproduce:

          1.
          2.
          3.
          

      Actual results:

          

      Expected results:

          

      Additional info:

          

              rhn-support-jdohmann Jesse Dohmann
              rhn-support-bverschu Bram Verschueren
              None
              None
              Hongan Li Hongan Li
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: