Tentacle should use system-configured TLS protocol versions by default

[rhysparry]

Background

Operating Systems can be configured to specify the default supported TLS protocol versions. Currently, Tentacle override these defaults, enabling TLS 1.0, 1.1, 1.2 and 1.3 explicitly. This allows systems to use newer TLS versions when they are available, but prevents users from disabling older protocols by removing them from the default set.

In #1170 we added an environment variable to allow users to opt-in to using system-defined TLS protocol versions.

This environment variable should be inverted to enable system-defined TLS protocol versions by default.

Related

• Installing Tentacle on a RHEL machine with Fips enabled and crypto policies restricting to TLS 1.2 still allows connections over TLS 1.0 and 1.1 #468
• Add Environment variable to use system-defined TLS protocol versions #1170