Skip to content

Conversation

@moritzbeck13
Copy link

After Portainer dropped support for everything but TLSv1.3 in 2.13, it was noticed (portainer/portainer#6902 and portainer/portainer#6900) that NPM seemed to only offer TLSv1.3 for serving, but not for proxying.
This makes sense, since the ssl_protocols flag is manually set to support TLSv1.2 and TSLv1.3 here, but the respective proxy_ssl_protocols flag is unset, meaning it is relied on the default NGINX setting, which enables support for TLSv1, TLSv1.1 and TLSv1.2, but not TLSv1.3.
Please note that I was not able to test this and just wanted to get the fix out as fast as possible. Since I included all the older versions, that are also in the default settings, unlike the ssl_protocols flag, which theoretically drops support for some older version, the functionality should only be enhanced and there should be no compatibility issues. With regards to the age of some of these older protocols, feel free to change this to exclude support for those, though.
I am not 100% sure about the location for this flag, but I think there is no better place for it. The ssl_protocols is only imported for HTTPS connections, but since you can also proxy an HTTP server over an HTTPS connection, I think it should be included in the main config.

@jc21 jc21 added the requires-verification Waiting for one or more people to confirm the fix label Aug 23, 2022
@kaindlnetwork
Copy link

Very cool Idea! It would be interesting if this would be a setting in the Web-UI to change it if needed by the user. With TLSv1.3 as default would be good for the future.

@github-actions
Copy link

PR is now considered stale. If you want to keep it open, please comment 👍

@github-actions github-actions bot added the stale label Feb 17, 2024
@github-actions github-actions bot removed the stale label Nov 26, 2024
@github-actions
Copy link

PR is now considered stale. If you want to keep it open, please comment 👍

@nginxproxymanagerci
Copy link

CI Error:

/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
certbot-node: Pulling from nginxproxymanager/nginx-full
Digest: sha256:a3f685a6ec6c4a3781242888fbfa53127abec9321d7ae871486ed2246693cdc4
Status: Image is up to date for nginxproxymanager/nginx-full:certbot-node
docker.io/nginxproxymanager/nginx-full:certbot-node
�[1;34m❯ �[1;36mTesting backend ...�[0m
yarn install v1.22.22
[1/4] Resolving packages...
[2/4] Fetching packages...
warning [email protected]: The engine "bun" appears to be invalid.
warning [email protected]: The engine "deno" appears to be invalid.
[3/4] Linking dependencies...
warning " > @apidevtools/[email protected]" has unmet peer dependency "openapi-types@>=7".
[4/4] Building fresh packages...
Done in 8.86s.
yarn run v1.22.22
$ biome lint .
Checked 83 files in 45ms. No fixes applied.
Done in 0.12s.
�[1;34m❯ �[1;32mTesting Complete�[0m
�[1;34m❯ �[1;36mBuilding ...�[0m
ERROR: failed to build: NotFound: forwarding Ping: no such job oetudby756fjafbofvea65vo0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires-verification Waiting for one or more people to confirm the fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants