Use different ways to set ciphers for TLS 1.3

[ghost]

Openssl have a different way to set ciphers for TLS 1.3. If you using ssl_ciphers with only TLS 1.3 nginx will fail to start. You need to use "ssl_conf_command Ciphersuites" command in nginx.

I implement it that way that I check in the template if TLS version is set to 1.3 if so use the new syntax.

Links:
https://forum.nginx.org/read.php?11,287698
mozilla/ssl-config-generator#124
https://wiki.openssl.org/index.php/TLS1.3

[chr4]

Good catch. I'm not convinced yet to use the same variable for both cipher suites, though.

TLSv13 and TLSv12 might be used alongside. The current config doesn't allow for TLSv13 cipher suite specification (not critical, as they are by default quite good). But currently, it's not possible to specify ssl_conf_command Ciphersuites for a mixed configuration - and the existing ssl_ciphers option will then be automatically mapped to TLSv13 once ssl_protocols is set to only use TLSv13.

I'd vote for a cleaner approach on using a second option, either ssl_conf_command directly, or abstracting it as tlsv13_ciphers (I think the former would be a bit clearer/cleaner), that can be used to specify TLSv13 ciphers if set.

I'd still set ssl_ciphers when TLSv13 only is enabled, just so it fails and people get feedback about the invalid configuration. Ignoring it silently in TLSv13 mode might lead the caller to believe they set it correctly, but it's silently ignored.

[dgo-]

Make sense!

I would go for the approve add an extra variable(pillar) ssl_conf_command. (Note: ssl_conf_command, can used to configure more then ciphers)

I would set default the ssl_conf_command variable to an empty list. I would choose a list here, because you can you ssl_conf_command multiple times. See example from nginx docs:

ssl_conf_command Options PrioritizeChaCha;
ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256;

I would default to an empty list, because the nginx default is also not set. In the template would do a for loop over the list, so we only set it if something is in the list.

As you suggested I would always set the ssl_ciphers variables. If ssl_conf_command Ciphersuites is set correctly you can also set the ssl_ciphers without running in a problem or lowering the security on TLS 1.3.

What do you think about the approve?

[chr4]

I think you should add a "real" example on how to use this, but mention the default is empty (maybe in a seperate paragraph), then test for that change to actually be in the file in the test below.

[chr4]

Yes, that sounds like a good plan! I think you can use the example you provided above in pillar.example, as it automatically verifies that multiple arguments are working.

[chr4]

Suggested change

[chr4]

Perfect, thanks!