Add support RFC 5746 secure renegotiation for site
darkdarin opened this issue · comments
OS: Debian Bookworm
OpenSSL version: 3.0.9
When I try to send a curl request to https://getcomposer.org (for downloading the composer installer) - an error occurs:
> curl https://getcomposer.org
curl: (35) OpenSSL/3.0.9: error:0A000152:SSL routines::unsafe legacy renegotiation disabled
This is because in OpenSSL 3 Secure renegotiation is required by default for TLS connections (https://www.openssl.org/docs/manmaster/man7/migration_guide.html)
The only way to access the site is to enable the UnsafeLegacyRenegotiation parameter in the OpenSSL configuration, but this is not secure.
Therefore, it is necessary to add support RFC 5746 secure renegotiation for getcomposer.org resource
I am not sure what this is about nor how to fix it tbh, as https://www.ssllabs.com/ssltest/analyze.html?d=getcomposer.org&s=142.44.245.229 shows it is supported:
That said, we should try dropping TLSv1.1 support at last, and I can try to modernize our ssl config a little, see if it helps resolve this too.
Ok I dropped TLSv1.1 now and enabled client selection of ciphers again, I am hoping this helps the problem for you but I cannot test it so would appreciate if you can confirm. If so and nobody complains I'll try to deploy this to packagist.org & the JSON repo there as well (but that's used by more people/machines).
I tested in more depth, and realized that this is probably not a problem with getcomposer.org and packagist.org.
This issue only reproduces from my work environment and is likely related to the use of a corporate firewall.
On a clean debian bookworm + openssl 3.0.9 from any networks, all resources are accessed correctly.
I apologize for the incorrect issue and your wasted time.
No worries, it nudged me to finally get rid of TLS1.1 which is good, so far nobody complained :)