How to disable TLS v1.0 & v1.1 in HAProxy?

RKProxy · February 23, 2022, 10:09am

Hi,

For our application, it shows TLS v1.0 & v1.1 are enabled. We need to disable it.

We checked the haproxy config file file & added this:

frontend ssl
bind 0.0.0.0:443 ssl crt /etc/haproxy/ssl_cert.pem ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 force-tlsv12 ca-file /etc/haproxy/ssl_ca_cert.pem no-tlsv11 no-tlsv10 no-sslv3 verify optional

But still, it shows as enabled.

What are we missing here? Let us know if you need the complete config file.

Thanks.

rhada · February 23, 2022, 2:33pm

Hello,

Here we use

ssl-default-server-options no-sslv3 ssl-min-ver TLSv1.2

And result seems OK BUT we get a warning at startup :

no-sslv3/no-tlsv1x are ignored for server 'my_server'. Use only 'ssl-min-ver' and 'ssl-max-ver' to fix.

You can get rid of it with a line like

ssl-default-server-options ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.2

Help it can help

RKProxy · February 23, 2022, 2:52pm

This syntax does not work in version 1.5.8

rhada · February 23, 2022, 3:22pm

Haproxy 1.5 is quite old. Not sure if still maintained.

You should consider to uprgrade.

Regarding your issue, you have to check the doc to find the appropriate config

lukastribus · February 23, 2022, 3:51pm

no-tlsv11 no-tlsv10 no-sslv3

This configuration is correct, the configuration may not be properly applied (old haproxy instance running in the background with old configurations), you may hit a bug, or your measurements may not be accurate.

Provide the output of haproxy -vv and openssl outputs from the haproxy machine (not a far end device crossing firewalls and other security devices, you may have SSL intercepting devices in the path), but 127.0.0.1:443 :

openssl s_client -tls1 127.0.0.1:443
openssl s_client -tls1_1 127.0.0.1:443
openssl s_client -tls1_2 127.0.0.1:443

ravi.soni · February 24, 2022, 10:26am

Please find the haproxy version screenshot .

1.For This we getting error after run those below commands.

openssl s_client -tls1 127.0.0.1:443
openssl s_client -tls1_1 127.0.0.1:443
openssl s_client -tls1_2 127.0.0.1:443

Command Not Found

2.But We run the command openssl for cipher we getting output below.

ravi@admins-/ % openssl s_client -connect developernexus.ob.globalbank.sbi:443 -cipher “EDH”

CONNECTED(00000005)

verify return:1

Certificate chain

0 *****************

Server certificate

-----BEGIN CERTIFICATE-----

“”*************************************""

-----END CERTIFICATE-----

subject=***********************

No client certificate CA names sent

Server Temp Key: DH, 1024 bits

SSL handshake has read 4849 bytes and written 302 bytes

New, TLSv1/SSLv3, Cipher is “*******************”
Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

No ALPN negotiated

SSL-Session:

Protocol : TLSv1.2

Cipher : *****************

Session-ID: ********************

Session-ID-ctx:

Master-Key: ****************************

Start Time: 1645684131

Timeout : 7200 (sec)

Verify return code: 0 (ok)

HTTP/1.0 408 Request Time-out

Cache-Control: no-cache

lukastribus · February 24, 2022, 11:25am

You need to run those commands on the haproxy box against 127.0.0.1:443. If you are missing the local openssl tool, install it.

higor.s · January 31, 2023, 7:02pm

ssl-default-bind-options no-sslv3 no-tlsv11 no-tlsv10
Worked for me!

rs1234 · February 24, 2023, 2:11pm

Sorry to re-activate the conversation again, I’m using HAproxy 2.4.x and tried all possible syntax but still not disabling tls1.1 and 1.0, Am I missing something?

lukastribus · February 24, 2023, 3:37pm

It also depends on the openssl release, you are probably running v3.0.

You can append :@SECLEVEL=0 to ssl-default-bind-ciphers or manually edit your openssl.cnf to lower the SECLEVEL to 0.

Forget what I said, I got the question wrong.

rs1234 · February 24, 2023, 7:37pm

Thank you for the reply @lukastribus could you give me the exact syntax for openssl.cnf? I’m using openssl 1.1.1

lukastribus · February 24, 2023, 8:26pm

I’m sorry, I realize I got the question wrong.

Please refer to post #5 in this thread.

If this doesn’t work for you, provide the outputs request in that post.

rs1234 · February 24, 2023, 8:46pm

That didn’t work unfortunately:

HAProxy version 2.4.4-acb1d0b 2021/09/07 - https://haproxy.org/
Status: long-term supported branch - will stop receiving fixes around Q2 2026.
Known bugs: http://www.haproxy.org/bugs/bugs-2.4.4.html
Running on: Linux 3.10.0-1160.36.2.el7.x86_64 #1 SMP Wed Jul 21 11:57:15 UTC 2021 x86_64
Build options :
TARGET = linux-glibc
CPU = generic
CC = cc
CFLAGS = -O2 -g -Wall -Wextra -Wdeclaration-after-statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wtype-limits
OPTIONS = USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1
DEBUG =

Feature list : +EPOLL -KQUEUE +NETFILTER +PCRE -PCRE_JIT -PCRE2 -PCRE2_JIT +POLL -PRIVATE_CACHE +THREAD -PTHREAD_PSHARED +BACKTRACE -STATIC_PCRE -STATIC_PCRE2 +TPROXY +LINUX_TPROXY +LINUX_SPLICE +LIBCRYPT +CRYPT_H +GETADDRINFO +OPENSSL -LUA +FUTEX +ACCEPT4 -CLOSEFROM +ZLIB -SLZ +CPU_AFFINITY +TFO +NS +DL +RT -DEVICEATLAS -51DEGREES -WURFL +SYSTEMD -OBSOLETE_LINKER +PRCTL +THREAD_DUMP -EVPORTS -OT -QUIC -PROMEX -MEMORY_PROFILING

Default settings :
bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX_THREADS=64, default=2).
Built with OpenSSL version : OpenSSL 1.1.1 11 Sep 2018
Running on OpenSSL version : OpenSSL 1.1.1 11 Sep 2018
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
Built with network namespace support.
Built with zlib version : 1.2.7
Running on zlib version : 1.2.7
Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”)
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Built with PCRE version : 8.32 2012-11-30
Running on PCRE version : 8.32 2012-11-30
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Encrypted password support via crypt(3): yes
Built with gcc compiler version 4.8.5 20150623 (Red Hat 4.8.5-44)

Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.

Available services : none

Available filters :
[SPOE] spoe
[CACHE] cache
[FCGI] fcgi-app
[COMP] compression
[TRACE] trace

And haproxy.cnf
global
ssl-default-bind-ciphers TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:TLS13-CHACHA20-POLY1305-SHA256:EECDH+AESGCM:EECDH+CHACHA20
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
log /dev/log local0
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
stats socket /var/lib/haproxy/stats
tune.ssl.default-dh-param 2048

CONNECTED(00000003)
139630862251920:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70
139630862251920:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:

no peer certificate available

No client certificate CA names sent

SSL handshake has read 7 bytes and written 0 bytes

New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.1
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1677271775
Timeout : 7200 (sec)
Verify return code: 0 (ok)

lukastribus · February 24, 2023, 11:25pm

What makes you think that the configuration doesn’t work, specifically?

As per the output you provided, TLSv1.1 is NOT negotiated.

rs1234 · February 25, 2023, 2:32am

Thank you so much @lukastribus. I was getting confused with haproxy -vv output which says the OpenSSL library supports: TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3.
Thank you so much for your help.

Topic		Replies	Views
Enable TLS 1.0 & TLS 1.1 in haproxy 2.4 Help!	3	959	March 28, 2023
SSL Configuration for HAProxy 1.6.12 Help!	0	1193	July 4, 2017
Ssllab still complains about tls 1.0 Help!	1	376	March 3, 2020
TLS1.3 not operating in V1.8.14 Help!	11	3008	December 29, 2018
Disable certain TLS 1.3 ciphers in haproxy.cfg Help!	4	6423	August 5, 2018

How to disable TLS v1.0 & v1.1 in HAProxy?

CONNECTED(00000003) 139630862251920:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70 139630862251920:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:

no peer certificate available

No client certificate CA names sent

SSL handshake has read 7 bytes and written 0 bytes

Related Topics

CONNECTED(00000003)
139630862251920:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70
139630862251920:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659: