The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello!


I'm sure many of you have heard about an industry-wide effort to get rid
of the old crypto protocols TLS 1.0 and TLS 1.1.


One example of a more-than-gentle push in that direction is that web
servers which still support these versions are considered a security
risk by various audit softwares. Qualys SSL Labs for instance downgrade
a server's score in that case.


Indeed, moving towards TLS 1.2 only is a no-brainer for an ordinary
"just HTML" serving web server as browsers all support TLS 1.2, or at
least have an upgrade path to a version that has.


The situation is a bit different on cat.eduroam.org because we onboard
devices to get onto the internet in the first place, and support older
versions of especially mobile devices which don't have and will never
get an update enabling TLS 1.2.


For these devices, discontinuing support means they are stuck in a dead
end. Arguably, that's a good thing even because devices which are that
old probably also don't get any other relevant security updates and it's
better that they stay offline (tongue in cheek).


Still, it is a difficult decision if we really want to pull the plug
here. To help us make the call, we have enabled more verbose logging on
cat.eduroam.org to see which TLS protocol versions clients are actually
negotiating when they connect. Here is the breakdown:


Total number of TLS requests: 15277249 (100 %)
TLSv1.2 - 15249675 requests (99,8195 %)
TLSv1.1 - 1755 requests (0,0115 %)
TLSv1.0 - 25819 requests (0,169 %)

Time period covered is 12.07.2020. 06:23:43 - 20.08.2020 12:50:17 (all
times are CET).


As you can see, the numbers of affected page loads are really very low,
but not zero.


Based on these numbers, we plan to remove the support for TLS 1.0 and
TLS 1.1 in the coming months.


Please reply to this message if you think this is not an acceptable way
forward. We would appreciate your response until 31 September 2020, one
month from now.


We will make a more concrete announcement, with date for
discontinuation, at a later stage.


Greetings,


Stefan Winter


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la 
Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's 
key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: signature.asc
Description: OpenPGP digital signature