Redirection of pre-TLS 1.2 requests

matt · January 19, 2021, 10:06pm

While this is correct, I want to clarify that Caddy can do this, but you’d have to manually patch in support for TLS 1.1:

github.com

caddyserver/caddy/blob/160d19999982c4facd32c4bddced5a7dc91e8a40/modules/caddytls/values.go#L116-L129

    
      
          // SupportedProtocols is a map of supported protocols.
          var SupportedProtocols = map[string]uint16{
          	"tls1.2": tls.VersionTLS12,
          	"tls1.3": tls.VersionTLS13,
          }
          
          
// unsupportedProtocols is a map of unsupported protocols.
          // Used for logging only, not enforcement.
          var unsupportedProtocols = map[string]uint16{
          	//nolint:staticcheck
          	"ssl3.0": tls.VersionSSL30,
          	"tls1.0": tls.VersionTLS10,
          	"tls1.1": tls.VersionTLS11,
          }

A one-line change would make it possible. I don’t recommend this, but in your case if you give a helpful error message on TLS 1.1 then I suppose I won’t judge.