[GH-ISSUE #5241] [Feature Request] Implement minimum TLS 1.2+ plus configuration to set higher

gitea-mirror commented

2026-05-05 14:34:35 -06:00

Owner

Copy link

Originally created by @ocljlayton on GitHub (Mar 17, 2026).
Original GitHub issue: https://github.com/fatedier/frp/issues/5241

Describe the feature request

[Feature Request] Implement minimum TLS 1.2+ plus configuration to set higher

Default implementation means TLS 1.0 and 1.1, in addition to 1.2+, is enabled. As well as being undesirable on anything lower than TLS 1.2, it gets flagged by security scanners such as Security Scorecard.

It may be possible to override this via Go settings GODEBUG=tls10server=0,tls11server=0, but have not tested this to date.

Preference is introduction of a minTlsversion in the TLS config, defaulted to 1.2+.

Describe alternatives you've considered

It may be possible to override this via Go settings GODEBUG=tls10server=0,tls11server=0, but have not tested this to date.

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @ocljlayton on GitHub (Mar 17, 2026). Original GitHub issue: https://github.com/fatedier/frp/issues/5241 ### Describe the feature request [Feature Request] Implement minimum TLS 1.2+ plus configuration to set higher Default implementation means TLS 1.0 and 1.1, in addition to 1.2+, is enabled. As well as being undesirable on anything lower than TLS 1.2, it gets flagged by security scanners such as Security Scorecard. It may be possible to override this via Go settings GODEBUG=tls10server=0,tls11server=0, but have not tested this to date. Preference is introduction of a minTlsversion in the TLS config, defaulted to 1.2+. ### Describe alternatives you've considered It may be possible to override this via Go settings GODEBUG=tls10server=0,tls11server=0, but have not tested this to date. ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [x] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror closed this issue

2026-05-05 14:34:36 -06:00

gitea-mirror commented

2026-05-05 14:34:38 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Mar 17, 2026):

https://github.com/fatedier/frp/releases/tag/v0.55.0

@fatedier commented on GitHub (Mar 17, 2026): https://github.com/fatedier/frp/releases/tag/v0.55.0

gitea-mirror commented

2026-05-05 14:34:39 -06:00

Author

Owner

Copy link

@ocljlayton commented on GitHub (Mar 17, 2026):

Apologies, I will retest. My prior research to raising insinuated that 1.0/1.1 would still be enabled even in the latest Go version, but I suspect that to be wrong now based on your comment. If it is still an issue, I will reopen.

@ocljlayton commented on GitHub (Mar 17, 2026): Apologies, I will retest. My prior research to raising insinuated that 1.0/1.1 would still be enabled even in the latest Go version, but I suspect that to be wrong now based on your comment. If it is still an issue, I will reopen.

gitea-mirror referenced this issue

2026-05-05 14:51:07 -06:00

[PR #4069] [MERGED] disable quic-go's ECN support by default #4910

No Branch/Tag specified