From eedabb3d272dcaf5deb9ede02c59f7c81c1e903f Mon Sep 17 00:00:00 2001 From: Miroslav Lichvar Date: Thu, 26 Mar 2020 15:18:08 +0100 Subject: [PATCH] nts: disable TLS version 1.2 Require TLS version 1.3 or later as specified in the latest NTS draft. --- nts_ke_session.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nts_ke_session.c b/nts_ke_session.c index bd1b001..2883273 100644 --- a/nts_ke_session.c +++ b/nts_ke_session.c @@ -551,8 +551,9 @@ init_gnutls(void) if (r < 0) LOG_FATAL("Could not initialise %s : %s", "gnutls", gnutls_strerror(r)); - /* NTS specification requires TLS1.2 or later */ - r = gnutls_priority_init2(&priority_cache, "-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1", + /* NTS specification requires TLS1.3 or later */ + r = gnutls_priority_init2(&priority_cache, + "-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-TLS1.2", NULL, GNUTLS_PRIORITY_INIT_DEF_APPEND); if (r < 0) LOG_FATAL("Could not initialise %s : %s", "priority cache", gnutls_strerror(r));