Setting TLS min version

[namolnad]

Hi there,

I've just deployed a new app with kamal, and use the built-in support for SSL. I'm seeing some users unable to access the site when on an office network. I suspect this may be due to my minimum TLS version being 1.0, and causing my SSL report at ssllabs.com to provide a B score. I'm curious if there is a way to set the minimum TLS version and bump it up to 1.2 to allow my domain to receive a score of A.

Below is what my deploy.yml file looks like, in case that's helpful.

Thanks so much for your help!

servers:
  web:
      - 123.456.789.012
  jobs:
    hosts:
      - 123.456.789.012
    cmd: "bin/jobs"
# Note: If using Cloudflare, set encryption mode in SSL/TLS setting to "Full" to enable CF-to-app encryption.
proxy:
  ssl: true
  host: mydomain.com

[kevinmcconnell]

Hi @namolnad,

We haven't exposed a way to configure the minimum TLS version, however Kamal Proxy should already require TLS 1.2. I would expect to see an 'A' rating at SSL Labs. Can I just confirm, you're not running anything else in front of Kamal Proxy, are you? Your DNS points directly to the host that your Kamal app is deployed on?

Also, which Kamal version are you using?

[namolnad]

Thanks for the quick response, Kevin. You're correct, I'm not running anything else in front of Kamal Proxy. DNS record points directly to the Digital Ocean droplet IP I'm using.

I'm using kamal 2.5.3 and kamal-proxy v0.8.4 from the looks of it.

[kevinmcconnell]

@namolnad thanks for confirming. I've not been able to reproduce this on my end.

For me, a fresh deploy of a Kamal app to a DO droplet is getting an A+ rating from SSL Labs, with the allowed TLS versions showing 1.2 and above:

What are you seeing for that section, in your report? Also, just to be sure, if you clear and repeat the scan are you still seeing the same thing reported?