MinVersion is missing from this TLS configuration GO-S1020MinVersion is missing from this TLS configuration: tls.Config395 }
396
397 // Bind server and CA certs into chain for TLS listener configuration
398 server.TLS = &tls.Config{}399 server.TLS.Certificates = []tls.Certificate{
400 {Certificate: [][]byte{serverCert.Raw}, Leaf: serverCert, PrivateKey: caKey},
401 {Certificate: [][]byte{caCert.Raw}, Leaf: caCert},MinVersion is missing from this TLS configuration: tls.Config 725 return nil, err
726 }
727
728 return &tls.Config{ 729 RootCAs: pool,
730 Certificates: []tls.Certificate{clientCert},
731 }, nilMinVersion is missing from this TLS configuration: tls.Config234 return defaultClient
235 }
236
237 tlsConfig := &tls.Config{238 RootCAs: x509.NewCertPool(),
239 }
240MinVersion is missing from this TLS configuration: tls.Config 34 insecureClient = &http.Client{
35 Timeout: defaultClientTimeout,
36 Transport: &http.Transport{
37 TLSClientConfig: &tls.Config{ 38 InsecureSkipVerify: true,
39 },
40 },
Description
MinVersion is missing from this TLS configuration. As the default value is
TLS 1.0, which is considered insecure, it is recommended to explicitly set the
MinVersion to a secure version of TLS, such as VersionTLS13.
Bad practice
client := &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
KeyLogWriter: w,
Rand: rand{},
InsecureSkipVerify: true,
},
},
}
Recommended
client := &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
KeyLogWriter: w,
MinVersion: tls.VersionTLS13, // min version set
Rand: rand{},
InsecureSkipVerify: true,
},
},
}