Configure TLS Minimum Version and Restricted Cipher List

StarlingX r13 introduces the ability to configure the minimum TLS version and a restricted set of TLS cipher suites for externally visible StarlingX HTTPS server endpoints.

Configure Minimum TLS Version

To configure minimum TLS version, run the following commands:

~(keystone_admin)]$ system service-parameter-add platform config tls-min-version=<value>
~(keystone_admin)]$ system service-parameter-modify platform config tls-min-version=<value>
~(keystone_admin)]$ system service-parameter-delete platform config tls-min-version

Where,

Valid values: VersionTLS12, VersionTLS13

Default values: VersionTLS12 for new install and VersionTLS12 (unchanged) for upgrades.

Configure Restricted Cipher Suites

To configure restricted cipher suites, run the following commands:

~(keystone_admin)]$ system service-parameter-add platform config tls-cipher-suite=<comma-separated list>
~(keystone_admin)]$ system service-parameter-modify platform config tls-cipher-suite=<comma-separated list>
~(keystone_admin)]$ system service-parameter-delete platform config tls-cipher-suite

Where,

Valid values: Comma-separated list of IANA-named cipher suites (both TLS 1.2 and TLS 1.3 ciphers).

Default values:

TLS 1.2 (6 ciphers):

  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

  • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

  • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

  • TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

  • TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

TLS 1.3 (3 ciphers):

  • TLS_AES_256_GCM_SHA384

  • TLS_AES_128_GCM_SHA256

  • TLS_CHACHA20_POLY1305_SHA256

Note

All ciphers use AEAD encryption with forward secrecy (ECDHE key exchange). They do not use CBC, SHA1, and weak ciphers.

Certificate Type and Cipher Availability

For TLS 1.2 cipher suites, the type of key in the server certificate determines which suites are available and negotiable.

  • TLS_ECDHE_RSA suites require an RSA key in the server certificate.

  • TLS_ECDHE_ECDSA suites require an ECDSA key in the server certificate.

All listed suites (TLS 1.2 and TLS 1.3) use ECDHE for key exchange (providing forward secrecy). The RSA/ECDSA distinction applies only to authentication (certificate signature), not to the key exchange mechanism.

Note

Removing the tls-cipher-suite parameter reverts to the 9 strong default ciphers listed above.

Note

The add, modify, delete operations take effect immediately. Running system service-parameter-apply platform is not required.

The following table lists the affected endpoints:

#

Endpoint

Port(s)

Network

1

StarlingX REST APIs (sysinv, keystone, barbican, USM, etc.)

5000, 6385, 6443, 7777, 9311, 15497, 18002, 4545

OAM

2

StarlingX Horizon (lighttpd)

8443

OAM

3

Docker Registry (registry.local)

9001

MGMT

4

OpenLDAP / slapd

636

MGMT

5

nginx-ingress

443

OAM

6

OIDC Dex

30556

OAM

7

OIDC Client

30555

OAM

Configure Kubernetes TLS

The Kubernetes API server TLS settings are managed separately via existing service parameters:

~(keystone_admin)]$ system service-parameter-add/modify/delete kubernetes kube_apiserver tls-min-version=<value>
~(keystone_admin)]$ system service-parameter-add/modify/delete kubernetes kube_apiserver tls-cipher-suites=<value>

Default values:

  • tls-min-version: VersionTLS12

  • tls-cipher-suites:

    TLS 1.2 (6 ciphers):

    • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

    • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

    • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

    • TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

    • TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

    TLS 1.3 (3 ciphers):

    • TLS_AES_128_GCM_SHA256

    • TLS_AES_256_GCM_SHA384

    • TLS_CHACHA20_POLY1305_SHA256

The same IANA cipher suite naming convention is used as the platform parameters.

A separate system service-parameter-apply Kubernetes is required after changing these values.

For more details, see kube-apiserver configuration.

Distributed Cloud Behavior

The TLS parameters are not synchronized from System Controller to subclouds. For existing subclouds, use the REST API or CLI on each subcloud to configure the TLS parameters.

Verify TLS Configuration

You can verify TLS configuration by running the following commands:

  1. Check current settings.

    ~(keystone_admin)]$ system service-parameter-list --service platform --section config | grep tls

  2. Verify TLS negotiation per endpoint.

    ~(keystone_admin)]$ echo | openssl s_client -connect <OAM_IP>:6385 2>/dev/null | grep -E 'Protocol|Cipher'

  3. Test the configuration with TLS 1.1.

    ~(keystone_admin)]$ echo | openssl s_client -connect <OAM_IP>:6385 -tls1_1 2>&1 | grep 'Cipher is'