tomciopp
Using TLS 1.3 with Phoenix
TLS 1.3 has been out for a little over a year now, but it has been unavailable in Phoenix due to erlang’s handling of ssl. With the most recent version of erlang released (22.2.3) these issues should now be solved. I’ve spent a bit of time going down the rabbit hole of getting our servers to run the protocol so our end users can get better performance and security. If you’d like to upgrade follow the directions below and let me know in the comments if you run into any issues.
YOU MUST BE RUNNING ERLANG 22.2.3 OR THIS WILL NOT WORK
Within your endpoint configuration copy/paste the following code within the :https keyword
https: [
...
honor_cipher_order: true,
ciphers: [
'TLS_AES_128_GCM_SHA256',
'TLS_AES_256_GCM_SHA384',
'TLS_CHACHA20_POLY1305_SHA256',
'ECDHE-ECDSA-AES128-GCM-SHA256',
'ECDHE-RSA-AES128-GCM-SHA256',
'ECDHE-ECDSA-AES256-GCM-SHA384',
'ECDHE-RSA-AES256-GCM-SHA384',
'ECDHE-ECDSA-CHACHA20-POLY1305',
'ECDHE-RSA-CHACHA20-POLY1305',
'DHE-RSA-AES128-GCM-SHA256',
'DHE-RSA-AES256-GCM-SHA384'
],
eccs: [
:x25519,
:secp256r1,
:secp384r1
],
secure_renegotiate: true,
reuse_sessions: true,
versions: [:"tlsv1.3", :"tlsv1.2"],
...
]
Cipher and eccs are based off of the work done in OWASP Cipher String Cheat
Sheet and Mozilla’s Server Side TLS v5.3. This should give you compatibility with almost all modern devices and should lead to an A+ rating in SSL Labs and Immuniweb
Let me know if you have any questions or run into any problems if you use this config for your project.
Most Liked
tomciopp
WARNING
It looks like there are errors if you make a connection using secure websockets. I’m uncertain if this is within phoenix, or erlang but the configuration above shouldn’t have to change for things to work out of the box. I’m going to dig into the errors and will report back in this thread if/when there is news on a fix.
tomciopp
I can reopen a pull request to plug, but I’m not sure when it will be merged since we require the use of erlang 23.0.0 or greater. To get this working today you would need to copy/paste the above code.
voltone
Well, you’re going to need a recent version of OpenSSL for your target environment. How to get it depends on your OS/distribution.
When building OTP from source, either manually or using asdf/kerl, keep in mind that you may have multiple versions of OpenSSL installed, so you may have to use the --with-ssl=/path/to/openssl build option to select the correct one. With asdf/kerl you can do that by setting KERL_CONFIGURE_OPTIONS=--with-ssl=/path/to/openssl.
The requirements for enabling TLS 1.3 in OTP are listed here. If you want to find out which specific algorithm is missing you’re going to have to check the output of :crypto.supports() against that list manually.
If you get stuck, include your OS details, how you’ve installed OpenSSL and Erlang/OTP, what versions, and the algorithms that appear to be missing, so you can compare notes with others who may have had more luck with a similar environment.
voltone
This means the OpenSSL version you are using (or that Erlang/OTPs :crypto module was built against) does not support all the necessary primitives to enable TLS 1.3. You may have to upgrade your OpenSSL version and rebuild Erlang/OTP.
Edit: you can the exact list of what OTP requires from OpenSSL to enable TLS 1.3 here
Popular in Guides/Tuts
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Catch errors, track performance, monitor hosts and more.
Categories:
Sub Categories:
Forums
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
Courses that'll move you from confusion to "Aha, now I get it!"