Skip to content

Always use system TLS defaults#706

Open
rhysparry wants to merge 1 commit intomainfrom
rhys/eft-157/os-tls-config
Open

Always use system TLS defaults#706
rhysparry wants to merge 1 commit intomainfrom
rhys/eft-157/os-tls-config

Conversation

@rhysparry
Copy link
Copy Markdown
Contributor

Background

While we were rolling out the change to adapt Halibut configuration to use system defaults we provided a mechanism for consumers of Halibut (i.e. Tentacle and Octopus) to override these defaults if necessary.

Now that we have confirmed that switching to system defaults has not caused issues, and has improved security (by allowing older TLS protocols to be disabled by the Operating System) we are removing the ability to configure these protocols directly.

Results

  • Removes the ISslConfigurationProvider and its provided implementations
  • Exposes the SslProtocols value used internally via SslConfiguration.SupportedProtocols. This value has been set to None, which "Allows the operating system to choose the best protocol to use, and to block protocols that are not secure." (see docs)
  • Updates usages of the ISslConfigurationProvider to access this static property.
  • Removes the ability to supply SSL configuration within the HalibutRuntimeBuilder
  • Resolves EFT-157

Before

  • TLS Protocols supported by Halibut could be overridden by the application.

After

  • TLS Protocols supported by Halibut are configured at the Operating System level.

How to review this PR

Quality ✔️

Pre-requisites

  • I have read How we use GitHub Issues for help deciding when and where it's appropriate to make an issue.
  • I have considered informing or consulting the right people, according to the ownership map.
  • I have considered appropriate testing for my change.

@rhysparry rhysparry requested a review from a team as a code owner March 26, 2026 03:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant