docs: update config comments about tls default values (#15213)

* docs: update config comments about tls default values fix default tls protocols * Apply suggestions from code review Co-authored-by: Andrew Wilkins <[email protected]> * Update apm-server.yml --------- Co-authored-by: Andrew Wilkins <[email protected]>
elastic · Jan 13, 2025 · 89d45e4 · 89d45e4
1 parent a5447ff
commit 89d45e4
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 34 deletions.
diff --git a/apm-server.docker.yml b/apm-server.docker.yml
@@ -112,8 +112,8 @@ apm-server:
     # It is recommended to use the provided keystore instead of entering the passphrase in plain text.
     #key_passphrase: ''
 
-    # List of supported/valid protocol versions. By default TLS versions 1.1 up to 1.3 are enabled.
-    #supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]
+    # List of supported/valid protocol versions. By default TLS versions 1.2 up to 1.3 are enabled.
+    #supported_protocols: [TLSv1.2, TLSv1.3]
 
     # Configure cipher suites to be used for SSL connections.
     # Note that cipher suites are not configurable for TLS 1.3.
@@ -261,9 +261,9 @@ apm-server:
     # production environments is strongly discouraged.
     #ssl.verification_mode: full
 
-    # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-    # 1.2 are enabled.
-    #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+    # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+    # 1.3 are enabled.
+    #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
     # List of root certificates for HTTPS server verifications.
     #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -397,9 +397,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -517,9 +517,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -676,9 +676,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -924,9 +924,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

diff --git a/apm-server.yml b/apm-server.yml
@@ -112,8 +112,8 @@ apm-server:
     # It is recommended to use the provided keystore instead of entering the passphrase in plain text.
     #key_passphrase: ''
 
-    # List of supported/valid protocol versions. By default TLS versions 1.1 up to 1.3 are enabled.
-    #supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]
+    # List of supported/valid protocol versions. By default TLS versions 1.2 up to 1.3 are enabled.
+    #supported_protocols: [TLSv1.2, TLSv1.3]
 
     # Configure cipher suites to be used for SSL connections.
     # Note that cipher suites are not configurable for TLS 1.3.
@@ -261,9 +261,9 @@ apm-server:
     # production environments is strongly discouraged.
     #ssl.verification_mode: full
 
-    # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-    # 1.2 are enabled.
-    #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+    # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+    # 1.3 are enabled.
+    #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
     # List of root certificates for HTTPS server verifications.
     #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -397,9 +397,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -517,9 +517,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -676,9 +676,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
@@ -924,9 +924,9 @@ output.elasticsearch:
   # production environments is strongly discouraged.
   #ssl.verification_mode: full
 
-  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
-  # 1.2 are enabled.
-  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+  # List of supported/valid TLS versions. By default all TLS versions 1.2 up to
+  # 1.3 are enabled.
+  #ssl.supported_protocols: [TLSv1.2, TLSv1.3]
 
   # List of root certificates for HTTPS server verifications.
   #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]