deprecated crypto defaults

[eslerm]

I am unsure if this issue belongs here or just as a note for Security reviewers in https://git.launchpad.net/ubuntu-security-tools/tree/audits/workflow.template#n219

Spec FO152 (pending) aims to disable TLS 1.0 and 1.1 by default, as these were deprecated by RFC 8996 in 2021. If a MIR package uses TLS/SSL the owning team should be responsible for spec compliance.

[adrien-n]

I typically use sslscan to assess which protocols and ciphers are enabled. Its colored output is not normed but is a good start if you don't know what you're looking at. :)
Just follow the packages' docs on how to enable TLS and use the "snakeoil" certs generated by the "ssl-cert" package.

See the screenshots below for examples. As you see, it's easy to spot TLS 1.0 and 1.1 being enabled. :)

sslscan ubuntu.com

sslscan example.org

Of course, with a snakeoil cert, the SSL certificate won't be considered valid but you shouldn't take that into account, that's expected.

[cpaelzer]

I feel we should place a hint that this is expected in the submitters template (for awareness) but the check would IMHO live best in the note for Security reviewers that @eslerm mentioned.

Let us discuss and conclude the way forward in the next MIR team meeting.

[eslerm]

Thanks @cpaelzer. A light hint so that owning teams knows what to expect sounds perfect. Is that hint okay as a soft check? #45

A more in-depth check will be performed by the Security team.