OCPBUGS-17349: Drop weak TLS ciphers #1964

liouk · 2025-05-21T10:13:33Z

This PR removes the following RSA/CBC/SHA1 insecure TLS ciphers from the list of default ciphers:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA

Proof PRs:

openshift-ci-robot · 2025-05-21T10:13:39Z

@liouk: This pull request references Jira Issue OCPBUGS-17349, which is invalid:

expected the bug to target the "4.20.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This PR removes the following RSA/CBC/SHA1 insecure TLS ciphers from the list of default ciphers:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-05-21T10:14:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: liouk
Once this PR has been reviewed and has the lgtm label, please assign bertinatto for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

liouk · 2025-05-21T10:15:07Z

/jira refresh

openshift-ci-robot · 2025-05-21T10:15:11Z

@liouk: An error was encountered updating to the POST state for bug OCPBUGS-17349 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details.

Full error message.


No response returned: Post "https://issues.redhat.com/rest/api/2/issue/15405568/transitions": POST https://issues.redhat.com/rest/api/2/issue/15405568/transitions giving up after 5 attempt(s)

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

liouk · 2025-05-21T10:16:19Z

/jira refresh

openshift-ci-robot · 2025-05-21T10:16:28Z

@liouk: This pull request references Jira Issue OCPBUGS-17349, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.0) matches configured target version for branch (4.20.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xingxingxia

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-05-21T10:22:55Z

@liouk: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2025-05-22T07:45:11Z

@liouk: This pull request references Jira Issue OCPBUGS-17349, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.0) matches configured target version for branch (4.20.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xingxingxia

Details

In response to this:

This PR removes the following RSA/CBC/SHA1 insecure TLS ciphers from the list of default ciphers:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

Proof PRs:

DO-NOT-MERGE: Proof PR for library-go#1964 openshift-apiserver#512

DO-NOT-MERGE: Proof PR for library-go#1964 kubernetes#2306

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ibihim · 2025-05-22T13:20:05Z

pkg/crypto/crypto.go

+		tls.TLS_RSA_WITH_AES_128_GCM_SHA256, // forbidden by http/2
+		tls.TLS_RSA_WITH_AES_256_GCM_SHA384, // forbidden by http/2


nit: The indent is off for this comment.

Because the lines above are comments as a whole, gofmt won't align the comments at the end unfortunately 😅 I could adjust manually, but the next person that formats this file will likely get the same change.

ibihim · 2025-05-22T14:29:22Z

pkg/crypto/crypto.go

 		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,    // forbidden by http/2
 		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,    // forbidden by http/2


While at it, we should consider dropping those as well. They use CBC with an HMAC-SHA1. Which I assume is the same reasoning as dropping the others.

I concur, let's drop everything not in the current (v5.7) guidelines. Basically drop everything "forbidden by http/2".

openshift-ci-robot · 2025-05-27T13:15:10Z

@liouk: This pull request references Jira Issue OCPBUGS-17349, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.0) matches configured target version for branch (4.20.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xingxingxia

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This PR removes the following RSA/CBC/SHA1 insecure TLS ciphers from the list of default ciphers:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

Proof PRs:

DO-NOT-MERGE: Proof PR for library-go#1964 openshift-apiserver#512

DO-NOT-MERGE: Proof PR for library-go#1964 kubernetes#2306

DO-NOT-MERGE: Proof PR for library-go#1964 origin#29854

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2025-08-27T01:00:20Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

candita · 2025-08-28T22:23:51Z

@liouk we still need this to resolve a bunch of issues. Can we get this into the next release?

/remove-lifecycle stale

candita · 2025-11-03T21:10:07Z

@ibihim can we get some movement on this issue? PTAL?

sanchezl · 2025-11-11T18:34:16Z

pkg/crypto/crypto.go

 		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,    // forbidden by http/2
 		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,    // forbidden by http/2


I concur, let's drop everything not in the current (v5.7) guidelines. Basically drop everything "forbidden by http/2".

sanchezl · 2025-11-13T18:13:43Z

Thank you for this work @liouk!

Work will continue on #2051, which has broader scope to align with the complete Mozilla SSL Configuration Guidelines intermediate profile (https://ssl-config.mozilla.org/guidelines/latest.json).

Closing this PR in favor of #2051.

sanchezl · 2025-11-13T18:13:50Z

Superseded by #2051

sanchezl · 2025-11-13T19:38:01Z

/close

openshift-ci · 2025-11-13T19:38:19Z

@sanchezl: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2025-11-13T19:38:21Z

@liouk: This pull request references Jira Issue OCPBUGS-17349. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

This PR removes the following RSA/CBC/SHA1 insecure TLS ciphers from the list of default ciphers:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

Proof PRs:

DO-NOT-MERGE: Proof PR for library-go#1964 openshift-apiserver#512

DO-NOT-MERGE: Proof PR for library-go#1964 kubernetes#2306

DO-NOT-MERGE: Proof PR for library-go#1964 origin#29854

DO-NOT-MERGE: Proof PR for library-go#1964 cluster-version-operator#1200

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

crypto: drop weak TLS ciphers

a5d70f1

openshift-ci bot requested review from deads2k and p0lyn0mial May 21, 2025 10:14

liouk changed the title ~~OCPBUGS-17349: Drop weak TLS ciphers~~ WIP: OCPBUGS-17349: Drop weak TLS ciphers May 21, 2025

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 21, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels May 21, 2025

openshift-ci bot requested a review from xingxingxia May 21, 2025 10:16

This was referenced May 21, 2025

DO-NOT-MERGE: Proof PR for library-go#1964 openshift/openshift-apiserver#512

Open

DO-NOT-MERGE: Proof PR for library-go#1964 openshift/kubernetes#2306

Open

liouk changed the title ~~WIP: OCPBUGS-17349: Drop weak TLS ciphers~~ OCPBUGS-17349: Drop weak TLS ciphers May 22, 2025

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 22, 2025

ibihim reviewed May 22, 2025

View reviewed changes

openshift-ci bot assigned ibihim May 22, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 22, 2025

ibihim reviewed May 22, 2025

View reviewed changes

liouk mentioned this pull request May 27, 2025

DO-NOT-MERGE: Proof PR for library-go#1964 openshift/origin#29854

Closed

liouk mentioned this pull request May 28, 2025

DO-NOT-MERGE: Proof PR for library-go#1964 openshift/cluster-version-operator#1200

Closed

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 27, 2025

openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 28, 2025

sanchezl suggested changes Nov 11, 2025

View reviewed changes

sanchezl mentioned this pull request Nov 13, 2025

OCPBUGS-17349: crypto: remove deprecated TLS ciphers #2051

Merged

openshift-ci bot closed this Nov 13, 2025

		tls.TLS_RSA_WITH_AES_128_GCM_SHA256, // forbidden by http/2
		tls.TLS_RSA_WITH_AES_256_GCM_SHA384, // forbidden by http/2

		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, // forbidden by http/2
		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, // forbidden by http/2

OCPBUGS-17349: Drop weak TLS ciphers #1964

OCPBUGS-17349: Drop weak TLS ciphers #1964

Uh oh!

Conversation

liouk commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 21, 2025

Uh oh!

openshift-ci bot commented May 21, 2025

Uh oh!

liouk commented May 21, 2025

Uh oh!

openshift-ci-robot commented May 21, 2025

Uh oh!

liouk commented May 21, 2025

Uh oh!

openshift-ci-robot commented May 21, 2025

Uh oh!

openshift-ci bot commented May 21, 2025

Uh oh!

openshift-ci-robot commented May 22, 2025

Uh oh!

ibihim May 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liouk May 22, 2025

Choose a reason for hiding this comment

Uh oh!

ibihim May 22, 2025

Choose a reason for hiding this comment

Uh oh!

sanchezl Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented May 27, 2025

Uh oh!

openshift-bot commented Aug 27, 2025

Uh oh!

candita commented Aug 28, 2025

Uh oh!

candita commented Nov 3, 2025

Uh oh!

sanchezl Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

sanchezl commented Nov 13, 2025

Uh oh!

sanchezl commented Nov 13, 2025

Uh oh!

sanchezl commented Nov 13, 2025

Uh oh!

openshift-ci bot commented Nov 13, 2025

Uh oh!

openshift-ci-robot commented Nov 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

liouk commented May 21, 2025 •

edited

Loading

ibihim May 22, 2025 •

edited

Loading