From 1a9184e9c554f546c28c07a97a0820de45af7556 Mon Sep 17 00:00:00 2001
From: Matthew Thode <mthode@mthode.org>
Date: Mon, 17 Dec 2018 09:51:34 -0600
Subject: [PATCH] Force force-tlsv12 only

Secure by default

Change-Id: I61aaa82ac705a4cf6a082a149d78db85e0365706
---
 defaults/main.yml                                   | 2 +-
 releasenotes/notes/tls12-only-40fea49efdb9d4dd.yaml | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 releasenotes/notes/tls12-only-40fea49efdb9d4dd.yaml

diff --git a/defaults/main.yml b/defaults/main.yml
index cebdcd2e..07f03b3e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -208,7 +208,7 @@ horizon_wsgi_threads: "{{ [[ansible_processor_vcpus|default(2) // 2, 1] | max, h
 horizon_ssl_cert: /etc/ssl/certs/horizon.pem
 horizon_ssl_key: /etc/ssl/private/horizon.key
 horizon_ssl_ca_cert: /etc/ssl/certs/horizon-ca.pem
-horizon_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3') }}"
+horizon_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3 -TLSv1.1') }}"
 horizon_ssl_cipher_suite: "{{ ssl_cipher_suite | default('ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS') }}"
 # if using a self-signed certificate, set this to true to regenerate it
 horizon_ssl_self_signed_regen: false
diff --git a/releasenotes/notes/tls12-only-40fea49efdb9d4dd.yaml b/releasenotes/notes/tls12-only-40fea49efdb9d4dd.yaml
new file mode 100644
index 00000000..510881e1
--- /dev/null
+++ b/releasenotes/notes/tls12-only-40fea49efdb9d4dd.yaml
@@ -0,0 +1,7 @@
+---
+security:
+  - |
+    The default TLS version has been set to TLS1.2.  This only allows
+    version 1.2 of the protocol to be used when terminating or creating TLS
+    connections.  You can change the value with the horizon_ssl_protocol
+    variable.