Mercurial > prosody-modules

annotate mod_warn_legacy_tls/README.md @ 6562:5da6fb562df9 default tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_unified_push: Fix push error handling (fixes #2000) Use the error object that send_iq() passes as an argument to it's reject callback instead of attempting and failing to do the parsing in the callback itself.
author kmq
date Mon, 06 Jul 2026 14:23:57 +0200
parents b3489b046782
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6066
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
1 ---
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
2 labels:
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
3 - Stage-Alpha
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
4 summary: Warn users of obsolete TLS Versions in clients
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
5 ---
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
6
6067
b048767a69b0 mod_warn_legacy_tls: typo
Menel <menel@snikket.de>
parents: 6066
diff changeset
7 TLS 1.0 and TLS 1.1 are obsolete. This module warns clients if they are using those versions, to prepare for disabling them. (If you use the default prosody config, this module will be unnessesary in its default setting, since these protocols are not allowed anymore by any supported prosody version.)
6066
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
8
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
9 This module can be used to warn from TLS1.2 if you want to switch to modern security in the near future.
3728
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 # Configuration
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12
6226
b3489b046782 mod_warn_legacy_tls: Normalize README Markdown
Kim Alvefur <zash@zash.se>
parents: 6224
diff changeset
13 ``` lua
3728
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 modules_enabled = {
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 -- other modules etc
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 "warn_legacy_tls";
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 }
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 -- This is the default, you can leave it out if you don't wish to
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 -- customise or translate the message sent.
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 -- '%s' will be replaced with the TLS version in use.
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 legacy_tls_warning = [[
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 Your connection is encrypted using the %s protocol, which has been demonstrated to be insecure and will be disabled soon. Please upgrade your client.
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 ]]
6066
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
25
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
26 --You may want to warn about TLS1.2 these days too (This note added 2024), by default prosody will not even allow connections from TLS <1.2
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
27 --Example:
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
28 legacy_tls_versions = { "TLSv1", "TLSv1.1", "TLSv1.2" }
3728
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 ```
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 ## Options
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 `legacy_tls_warning`
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34 : A string. The text of the message sent to clients that use outdated
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 TLS versions. Default as in the above example.
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 `legacy_tls_versions`
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 : Set of TLS versions, defaults to
5073bbd86970 mod_warn_legacy_tls: Add a README
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 `{ "SSLv3", "TLSv1", "TLSv1.1" }`{.lua}, i.e. TLS \< 1.2.
6066
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
40
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
41 # Compatibility
7adab72d5ebe mod_warn_legacy_tls: Update Examples and Introduction for current TLS versions.
Menel <menel@snikket.de>
parents: 5975
diff changeset
42
6226
b3489b046782 mod_warn_legacy_tls: Normalize README Markdown
Kim Alvefur <zash@zash.se>
parents: 6224
diff changeset
43 Prosody-Version Status
b3489b046782 mod_warn_legacy_tls: Normalize README Markdown
Kim Alvefur <zash@zash.se>
parents: 6224
diff changeset
44 ----------------- ----------------------
b3489b046782 mod_warn_legacy_tls: Normalize README Markdown
Kim Alvefur <zash@zash.se>
parents: 6224
diff changeset
45 trunk Works as of 25-05-25
b3489b046782 mod_warn_legacy_tls: Normalize README Markdown
Kim Alvefur <zash@zash.se>
parents: 6224
diff changeset
46 13 Works
b3489b046782 mod_warn_legacy_tls: Normalize README Markdown
Kim Alvefur <zash@zash.se>
parents: 6224
diff changeset
47 0.12 Works