Groups > linux.debian.user > #262974 > unrolled thread

etcd - ETCD_TLS_MIN_VERSION

Started by	Dennis Gesker <dennis@gesker.com>
First post	2023-11-01 00:00 +0100
Last post	2023-11-01 08:30 +0100
Articles	2 — 2 participants

Back to article view | Back to linux.debian.user

  etcd - ETCD_TLS_MIN_VERSION Dennis Gesker <dennis@gesker.com> - 2023-11-01 00:00 +0100
    Re: etcd - ETCD_TLS_MIN_VERSION Reco <recoverym4n@enotuniq.net> - 2023-11-01 08:30 +0100

#262974 — etcd - ETCD_TLS_MIN_VERSION

From	Dennis Gesker <dennis@gesker.com>
Date	2023-11-01 00:00 +0100
Subject	etcd - ETCD_TLS_MIN_VERSION
Message-ID	<Hv5Sh-2dba-15@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hello:

Should ETCD_TLS_MIN_VERSION and ETCD_CIPHER_SUITES be recognized as valid
in the /etc/default/etcd file?

I'd like to set...

ETCD_TLS_MIN_VERSION="TLS1.3" # or, maybe TLSv1.3 - with v like nginx?
ETCD_CIPHER_SUITES="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256"

Tried adding ETCD_TLS_MIN_VERSION first but I'm getting an "unrecognized"
entry in the logs.

ETCD_KEY_FILE and other related TLS vars seem to match up OK.

I'm on Bookworm.
/usr/bin/etcd --version returns 3.4.23

Thanks,
Dennis

[toc] | [next] | [standalone]

#262977

From	Reco <recoverym4n@enotuniq.net>
Date	2023-11-01 08:30 +0100
Message-ID	<HvdPP-2jbe-1@gated-at.bofh.it>
In reply to	#262974

	Hi.

On Tue, Oct 31, 2023 at 04:46:29PM -0600, Dennis Gesker wrote:
> Should ETCD_TLS_MIN_VERSION and ETCD_CIPHER_SUITES be recognized as valid
> in the /etc/default/etcd file?

ETCD_CIPHER_SUITES should be recognized.
As for ETCD_TLS_MIN_VERSION - it could, but it won't.

[1] shows us, that --tls-min-version and --tls-max-version were added in
etcd version 3.4.25.

Both bookworm and trixie have only 3.4.23.

Reco

[1] https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md

[toc] | [prev] | [standalone]

csiph-web

etcd - ETCD_TLS_MIN_VERSION

Contents

#262974 — etcd - ETCD_TLS_MIN_VERSION

#262977