Default to TLS v1.2 in all TLS libraries in 20.04 LTS

Like many I was also hit by the seclevel change. I’m sure the blog post will explain the tecnical details but essentially in openssl you can enable tls versions and additionally there is a concept of security levels. Contrary to the default in ubuntu 20.04 tls 1.0 and 1.1 are only allowed on security level <2 instead of <4. Also the default security level of 1 was raised to 2.

This disables tls < 1.2 in qt since there is no way (i checked the source code, they make it impossible) to change the security level/cipher string. That gives the strange situation where the qt api lets you force the tls version to 1.0 but in that case you essentially break everything. It gives you a nice socket error -1 (qt does not know how to handle the error thrown by openssl).

Since ubuntu changed defaults I do not expect qt to fix this upstream. My suggestions would be change the default QSslConfiguration to Tls1_2OrLater (if not already) and append @SECLEVEL=1 to the cipher string if TLS1_0 or TLS1_1 is requested. Another possibility would be to undefine unsupported tls versions so that compiling software that uses invalid configuration fails.

Another side note: In ubuntu 20.04 it is also impossible by default to use “sha1” certificates. This should be no issue since they were deprecated some years ago, but some inhouse ca might still use them.