configtls: TLS 1.2 is the new default min version (#4503)

* configtls: TLS 1.2 is the new default min version Signed-off-by: Juraci Paixão Kröhling <[email protected]> * Add changelog entry Signed-off-by: Juraci Paixão Kröhling <[email protected]> Co-authored-by: Bogdan Drutu <[email protected]>
open-telemetry · Dec 2, 2021 · 9309a1f · 9309a1f
1 parent 7402e94
commit 9309a1f
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ## 🛑 Breaking changes 🛑
 
 - Remove `config.NewConfigMapFrom[File|Buffer]`, add testonly version (#4502)
+- `configtls`: TLS 1.2 is the new default mininum version (#4503)
 
 ## 🧰 Bug fixes 🧰
 

diff --git a/config/configtls/README.md b/config/configtls/README.md
@@ -36,7 +36,8 @@ won't use TLS at all.
 
 Minimum and maximum TLS version can be set:
 
-- `min_version` (default = "1.0"): Minimum acceptable TLS version.
+- `min_version` (default = "1.2"): Minimum acceptable TLS version.
+It's recommended to use at least 1.2 as the minimum version.
 
 - `max_version` (default = "1.3"): Maximum acceptable TLS version.
 

diff --git a/config/configtls/configtls.go b/config/configtls/configtls.go
@@ -178,7 +178,7 @@ func (c TLSServerSetting) LoadTLSConfig() (*tls.Config, error) {
 
 func convertVersion(v string) (uint16, error) {
 	if v == "" {
-		return 0, nil // default
+		return tls.VersionTLS12, nil // default
 	}
 	val, ok := tlsVersions[v]
 	if !ok {