TLS 1.3 Not working
we have a few servers running alma9 with cpanel 130.0.12 and everything is upto date. a few have litespeed server and a few running stock apache. Now we are trying to enable tls 1.3 and assumed this was enabled by default? the current SSL/TLS field has:
All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
as per: BUT thats doesnt get tls 1.3 working AND adding in +TLSv1.2 +TLSv1.3 as per: https://support.cpanel.net/hc/en-us/articles/4403554663575-How-to-enable-TLS-1-3-in-the-Apache-Global-Configuration doesnt work either. using the default ssl cipher whm ships with... open ssl is also at the latest version avaliable (v3.X.X) also read this: https://support.cpanel.net/hc/en-us/community/posts/19142719819031-Enable-TLS-1-3?input_string=TLS%201.3%20Not%20working but that doesnt help.
What am i missing?
-
Hey there! After you make the change and you run the test from https://www.ssllabs.com, does it give you any specific failure details or just that 1.3 isn't supported? Or does it just say "TLS 1.3 no"
You shouldn't need to do anything else besides the details on that page in order to get things working, so if it's not working as expected it may be best to create a ticket so this can be investigated directly.
0 -
cPRex it just says "TLS 1.3 no"
Thats the case for a number of sites spread over different boxes all running the latest cpanel version 130.0.12, 1 running just apache on almalinux 9, a few running almalinux9 and litespeed, and a few running almalinux8 with litespeed all with the same provider.
applied the settings from that page and restarted apache a number of times (and litespeed for ones with LS).
cannot create a ticket to investigate as the license is not direct from you guys and current provider cannot help.
stuck with an cpanel issue that i cannot seems to pinpoint whats wrong to fix...
0 -
The provider should be able to fix things for you - if they can't, they should be escalating the issue to us.
0 -
cPRex ok, before i do, i just ran a retest to ensure i gave you the correct information. apart from it saying: TLS 1.3 No in the protcols configuration section, in the summary section it does also state: 'This server does not support TLS 1.3.'
Apologies in advance for the incorrect info previously... does that help shed any light?
0 -
Not particularly - I just ran through those steps on a test machine and confirmed they worked well on my end, so I can't say for sure what's happening on your system, unfortunately.
0 -
cPRex thanks for the update. the strange thing is its the same case on a number of boxes.
Asked the license provider for support and as I suspected got the reply:
We do not offer support for unmanaged services as per our support remit. I would advise going through each step with cPanel on how to do this. If you're still having issues I recommend restarting the server and try again.
so now we are stuck! what do i do?
0 -
What a terrible reply!
If they are selling your license they are required to provide some level of support. Can you message cs@cpanel.net to get in touch with our Customer Service team about this?
0 -
cPRex yes, but it gets better:
The cPanel software is not something we offer support for, we only sell the licence to you.
what details should we send to the CS team?
In the meantime, stuck with boxes not able to use 1.3 and a provider whos unwilling to help.. can you provide ANY info on what we can check in the meantime that could be preventing tls 1.3 from working?
Do we need to re run autossl again? retsrated apache with the whm interface after the change to global config, and also via ssh BUT is there another way to hard refresh/reboot apach? maybe its not saving the settings? how can we check the settings are saved? atm we check the whm global config ui... anything and all info you can provide would be greatly appreciated and helpful...
lastly, as a last option (as we do not want downtime or any further issues compounding), if we get a license directly from you guys would we be able to get the support required? can you provide the relevant links and docs that helps us to understand the process and way to buy, remove, add a new license with minimal downtime?
many thanks in advance...
0 -
You should let the CS team know your IP address and provider and then we can go from there.
Yes, if the license was purchased directly from us there wouldn't be any issue getting support as we'd provide that completely. There is no downtime when switching the license to us, and the CS team can help with that.
0 -
Do not edit your httpd.conf. But you should see something like this in it:
grep SSLPr /etc/apache2/conf/httpd.conf
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1grep SSLCi /etc/apache2/conf/httpd.conf
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256And you might want to use something like https://www.ssllabs.com/ssltest/ to test an SSL certificate on the affected server and see if it's really seeing that TLS 1.3 is not available.
0 -
mtindor thanks for the input. Appreciated.
cPRex so an update. After pushing back against the (what i will call) reluctance at providing help and providing them a few statements that you mentioned they eventually agreed to help. and today found the issue!
It was the global pre include that had the following:
SSLProtocol +TLSv1.1 +TLSv1.2
SSLHonorCipherOrder onThat was causing the issue. It never crossed our minds to look there as that hasn't been touched for eons!
From all the searches we did on the cpanel site and google in general did not come across one post to say check the pre includes to ensure nothing was preventing the settings in global from being used or written! Lesson learned. Maybe that could be documented somewhere? or not 🤔
anyway, issue fixed.
on a side-note, the fact that we cannot get support for cpanel is disappointing. Even after the provider kindly helped out they still stated:
We don’t provide system administration as part of services, and this wasn’t an issue with cPanel itself.
We’ve covered this particular fix at no cost as a gesture of goodwill, but in the future, I'm afraid support of this type cannot be included
I can understand that BUT I feel it was part of cpanel. Not being able to find any documents or help to pinpoint where to check or look wasnt helpful and thus help was needed. Maybe im wrong?
Should i still post to CS about the issue? more specifically regarding getting the help we needed???
0 -
I would still contact CS to let them know about your experience, yes.
The Apache include system is definitely a part of cPanel, although it's impossible to know if anything is present there. However, we have a tool as part of our internal support that scans these files as soon as we log into a system, so we likely would have caught this quickly.
0 -
cPRex thank you, ill do that. Appreciate all your input.
1
Please sign in to leave a comment.
Comments
13 comments