# TLS1.2 version support by Mender **URL:** \ **Category:** General Discussions\ **Tags:** yocto, sumo\ **Created:** [September 5, 2019, 5:28am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985 "2019-09-05T05:28:19Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![ajithpv](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/ajithpv/32/728_2.png) [@ajithpv](https://hub.mender.io/u/ajithpv)\ **Post date:** [September 5, 2019, 5:28am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/1 "2019-09-05T05:28:19Z")
Hi, I would like to know whether Mender currently supports TLS1.2 version. If no, then I would also like to know which version is currently supporting by the Mender. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [September 5, 2019, 6:36am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/2 "2019-09-05T06:36:36Z")
From the client’s side, it defaults to the highest available supported version available. On the backend side, I am not sure though. With nginx handling it I think. Let’s ask @0lmi ---
**Author:** ![ajithpv](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/ajithpv/32/728_2.png) [@ajithpv](https://hub.mender.io/u/ajithpv)\ **Post date:** [September 5, 2019, 6:38am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/3 "2019-09-05T06:38:51Z")
> [@oleorhagen](#): > > From the client’s side, it defaults to the highest available supported version available. May I know what is the highest version supported and how to check this on the client side? ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [September 5, 2019, 6:42am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/4 "2019-09-05T06:42:03Z")
The mender client is using the: `https://golang.org/pkg/crypto/tls/` package. The client library for the mender client can be found here: `https://github.com/mendersoftware/mender/blob/master/client/client.go` The benefit of open source I guess 😉 ---
**Author:** ![0lmi](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/0lmi/32/133_2.png) [@0lmi](https://hub.mender.io/u/0lmi)\ **Post date:** [September 16, 2019, 9:42am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/5 "2019-09-16T09:42:10Z")
TLS version 1.2 is currently supported by backend. See [nginx config](https://github.com/mendersoftware/mender-api-gateway-docker/blob/master/nginx.conf#L67) for details. ---
**Author:** ![ajithpv](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/ajithpv/32/728_2.png) [@ajithpv](https://hub.mender.io/u/ajithpv)\ **Post date:** [September 16, 2019, 10:59am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/6 "2019-09-16T10:59:22Z")
Thank you @oleorhagen and @0lmi for your replies. Since, I’m using the standalone mender, I’m specifically looking for the client-side TLS support. I have gone through the `https://golang.org/pkg/crypto/tls/` site but I didn’t get the TLS support completely. 1. According to the mentioned site, go package supports TLS 1.2 and TLS1.3 partially. Whether this means mender supports TLS 1.2 and TLS 1.3 partially? What this partial TLS1.2 or TLS 1.3 means? 2. Whether mender 2.0 supports TLS 1.3 (at least partial one as per the site)? 3. How I can specify the mender client to choose between TLS 1.2 and TLS1.3? @mirzak, any suggestions? ---
**Author:** ![mirzak](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/mirzak/32/2056_2.png) [@mirzak](https://hub.mender.io/u/mirzak)\ **Post date:** [September 18, 2019, 6:51am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/7 "2019-09-18T06:51:47Z")
> @mirzak, any suggestions? Unfortunately not much to add here. Do not know much of the inner workings of TLS protocols ---
**Author:** ![ajithpv](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/ajithpv/32/728_2.png) [@ajithpv](https://hub.mender.io/u/ajithpv)\ **Post date:** [September 18, 2019, 9:41am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/8 "2019-09-18T09:41:26Z")
I hope @oleorhagen might have some insight 💡 ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [September 18, 2019, 11:34am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/9 "2019-09-18T11:34:15Z")
Hi @ajithpv 🙂 So I’ve done a little bit of digging. The mender-client currently does not support TLS 1.3, as far as I can see (since it is running on go-1.11). We currently do not have any configuration options available for this, but it should be easy enough if you are willing to compile your own client. Then setting the `minVersion` in the tls config in the `client.go` file, like this (untested): ```auto diff --git a/client/client.go b/client/client.go index bea3597..b7cb622 100644 --- a/client/client.go +++ b/client/client.go @@ -298,6 +298,7 @@ func newHttpsClient(conf Config) (*http.Client, error) { tlsc := tls.Config{ RootCAs: trustedcerts, InsecureSkipVerify: conf.NoVerify, + MinVersion: tls.VersionTLS12, } transport := http.Transport{ TLSClientConfig: &tlsc, ``` Should do the trick I think. You mind giving it a go? 😉 ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [September 18, 2019, 11:34am UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/10 "2019-09-18T11:34:45Z")
If you want tls13 support, you have to build off of a newer go. Preferrably `1.13` ---
**Author:** ![ajithpv](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/ajithpv/32/728_2.png) [@ajithpv](https://hub.mender.io/u/ajithpv)\ **Post date:** [September 18, 2019, 12:11pm UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/11 "2019-09-18T12:11:33Z")
Thank you so much @oleorhagen for the findings. There is a discussion from our side on TLS1.2 vs TLS 1.3 usage on our platform. I might have to try with TLS1.3, if the decision leads to stick with TLS1.3. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [September 18, 2019, 12:23pm UTC](https://hub.mender.io/t/tls1-2-version-support-by-mender/985/12 "2019-09-18T12:23:44Z")
You’re welcome 🌞 In general it should be easy enough with the given change, and then make sure you are using `go-1.13`, and then `make build` in the mender repo. If not, you can build from source using yocto also (with local sources). Just get back to me if yous decide to go with this solution, and are having issues. -OO