Skip to content

Explicitly include RSA key exchange AES cipher suites in TLS client config #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
riccardo-perotti merged 2 commits into from
Apr 17, 2026
Merged

Explicitly include RSA key exchange AES cipher suites in TLS client config #41

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
67b11e9
Explicitly include RSA key exchange AES cipher suites in TLS client c…
riccardo-perotti Apr 17, 2026
2b6e393
Restore BuildNameToCertificate call accidentally dropped in previous …
riccardo-perotti Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion scamp/connection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,27 @@ type Connection struct {
// remote host
func DialConnection(connspec string) (conn *Connection, err error) {
// Trace.Printf("Dialing connection to `%s`", connspec)

// Build cipher suite list from the current defaults plus RSA key exchange AES suites.
// Go 1.22+ removed RSA key exchange from the default list (GODEBUG tlsrsakey=0), but
// some internal Go services built with older toolchains (e.g. gt-auth-service) still
// require them. We add only the AES variants — RC4 and 3DES are intentionally excluded.
var cipherSuites []uint16
for _, cs := range tls.CipherSuites() {
cipherSuites = append(cipherSuites, cs.ID)
}
cipherSuites = append(cipherSuites,
tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
)

config := &tls.Config{
InsecureSkipVerify: true,
CipherSuites: cipherSuites,
}
config.BuildNameToCertificate()
Comment thread
riccardo-perotti marked this conversation as resolved.
config.BuildNameToCertificate() //nolint:staticcheck // deprecated no-op, preserved to minimise diff

tlsConn, err := tls.Dial("tcp", connspec, config)
if err != nil {
Expand Down
Loading