0

BLUF: Can someone help me set yum and/or dnf to prefer TLS 1.3 when connecting to https sites?

Situation:

  • fresh installation of CentOS Stream 9 (CentOS-Stream-9-20220718.0-x86_64-dvd1.iso)
  • on corporate network with a transparent proxy service
  • with the repos set default yum and dnf fails to download with the following error:

Error: Failed to download metadata fro repo 'baseos': Cannot prepare internal mirrorlist: Curl error (35): SSL connect error for https://mirrors.centos.org/metalink?repo=centos-baseos-9-stream&arch=x86_64&protocol=https,http [error:0A000152:SSL routines::unsafe legacy renegotiation disabled]

  • with other repos that use https connections i am getting the same errors
  • once the centos.repo is modified to point to http rather than https the downloads work
  • other repos that only support https (i.e. https://download.docker.com) still do not work
  • curl https://google.com results in the same error along with any up-to-date https site
  • curl --tlsv1.3 https://google.com results with the correct output from the server.

I think I have tracked this problem down to a TLS 1.3 client support, possibly due to our company proxy rejecting the TLS 1.2 cyphers. What I cannot figure out is how to tell yum, dnf, or any other client side command to use TLS 1.3 to negotiate the connection. I have found similar problems with CentOS 7 and 8 but have not found how it is addressed in 9. In 7 and 8 it seems that the openssl is missing the cyphers for TLS 1.3 but on 9 openssl is updated and has 1.3 support.

Improve this question

1 Answer 1

Reset to default
-1

Add tlsv1.3 option to ~/.curlrc. You can find other supported config file locations in the curl manual.

Forcing TLS 1.3 disabled TLS inspection in my case, but it will not work with old servers. Another option is to allow unsafe legacy renegotiation by setting UnsafeLegacyRenegotiation option in /etc/pki/tls/openssl.cnf:

… [ crypto_policy ] Options = UnsafeLegacyRenegotiation .include = /etc/crypto-policies/back-ends/opensslcnf.config …

You can also set minimum supported TLS version in openssl.cnf, but it seems to be ignored by curl:

MinProtocol = TLSv1.3 TLS.MinProtocol = TLSv1.3
Improve this answer
1
  • After reading this post I realized my default route was not set. I had changed my network interface from dhcp to static on a CentOS system. I set the default gateway but that was not enough. I also needed to set the default route. You can do both with a single command: 'nmcli connection modify eth0 +ipv4.routes "192.168.10.0/24 192.168.10.1"' Commented Aug 17, 2024 at 14:08

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.