Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security/stunnel: Service cannot be started when only TLS v1.3 ciphers are enabled #4485

Open
3 tasks done
boomer41 opened this issue Jan 19, 2025 · 0 comments
Open
3 tasks done

Comments

@boomer41
Copy link

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug
I have configured a service I intend to allow only TLS v1.3 on.
Thus, I configured the following ciphers only:

  • TLS_AES_256_GCM_SHA384
  • TLS_CHACHA20_POLY1305_SHA256

After doing that, the service cannot be started anymore. Clicking "Apply" has no effect.
Also, the stunnel log file log stays completely empty even with all severity filters enabled.

To Reproduce

  1. Configure a service, and make sure to only enable the ciphers mentioned above (advanced mode). Deselect all other ciphers.
  2. Apply the configuration
  3. Observe that the service is not running. Manually starting it from the Dashboard has no effect Either
  4. Observe that the service's log file does not get any more entries.

Expected behavior
Stunnel should be running, and the service should be running with TLSv1.3 ciphers only, forcing it to TLSv1.3

Environment
Software version used and hardware type if relevant.

OPNsense 24.7.12-amd64
Latest updates as of 2025-01-19

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant