全部产品
Search
文档中心

服务网格 ASM:在ASM网关配置TLS协议版本增强安全性

更新时间:Apr 11, 2024

当面临因使用老旧TLS协议引发的安全隐患时,您可以在ASM网关配置TLS协议版本至最新安全标准,通过禁用不安全的旧版本(如TLS 1.0和1.1)并启用更强大的TLS 1.2及更高版本,从而有效抵御中间人攻击、防止数据泄露等安全风险,确保服务与客户端之间HTTPS连接的稳固性和安全性。

前提条件

背景信息

包括TLS v1.0在内的早期TLS版本存在已知的安全问题,容易导致传输中的数据泄露。因此,一个增强网站安全性的最佳做法是禁用早期版本的TLS(v1.0和v1.1)并仅启用TLS v1.2及更高版本。同时,禁用TLS v1.2中的弱密码也非常重要。

步骤一:准备网关使用的证书和私钥

以域名aliyun.com为例,为网关生成证书和私钥,并保存为Secret。例如,如果您已经拥有针对aliyun.com可用的证书和私钥,需要将密钥命名为aliyun.com.key,证书命名为aliyun.com.crt;如果没有,可以通过openssl执行以下步骤来生成证书和密钥。

  1. 执行以下命令,创建根证书和私钥。

    openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt
  2. 执行以下命令,为aliyun.com服务器生成证书和私钥。

    openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
    openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt
  3. 按照ASM实例版本,创建Secret或证书。

    • ASM实例为1.17以下

      在入口网关Pod所在的集群对应的KubeConfig环境下,执行以下命令,在istio-system命名空间中创建包含证书和私钥的Secret。

      kubectl create -n istio-system secret tls myexample-credential --key=aliyun.com.key --cert=aliyun.com.crt
      重要

      Secret名称不能以istio或prometheus开头,且不能包含token字段。

    • ASM实例为1.17及以上

      1. 登录ASM控制台,在左侧导航栏,选择服务网格 > 网格管理

      2. 网格管理页面,单击目标实例名称,然后在左侧导航栏,选择ASM网关 > 证书管理

      3. 证书管理页面,单击创建,然后在证书信息面板,配置相关信息,单击确定

        配置项

        说明

        名称

        输入证书的名称,本示例为myexample-credential

        公钥证书

        步骤2生成的aliyun.com.crt内容。

        私钥

        步骤2生成的aliyun.com.key内容。

步骤二:创建网关规则

  1. 登录ASM控制台,在左侧导航栏,选择服务网格 > 网格管理

  2. 网格管理页面,单击目标实例名称,然后在左侧导航栏,选择ASM网关 > 网关规则,然后单击使用YAML创建

  3. 创建页面,选择目标命名空间和任意场景模板,配置如下YAML。

    本文以default命名空间为例,YAML中设置minProtocolVersion值为TLSV1_2,表示禁用TLS v1.0和v1.1。

    apiVersion: networking.istio.io/v1beta1
    kind: Gateway
    metadata:
      name: mysdsgateway
    spec:
      selector:
        istio: ingressgateway
      servers:
        - hosts:
            - '*'
          port:
            name: https
            number: 443
            protocol: HTTPS
          tls:
            credentialName: myexample-credential
            minProtocolVersion: TLSV1_2
            mode: SIMPLE

步骤三:创建虚拟服务

  1. 在网格详情页面左侧导航栏,选择流量管理中心 > 虚拟服务,然后在右侧页面,单击使用YAML创建

  2. 创建页面,选择目标命名空间和任意场景模板,配置如下YAML。

    展开查看VirtualService YAML

    apiVersion: networking.istio.io/v1beta1
    kind: VirtualService
    metadata:
      name: bookinfo-tlsversion-sample
    spec:
      gateways:
        - mysdsgateway-tlsversion-sample
      hosts:
        - '*'
      http:
        - match:
            - uri:
                exact: /productpage
            - uri:
                prefix: /static
            - uri:
                exact: /login
            - uri:
                exact: /logout
            - uri:
                prefix: /api/v1/products
          route:
            - destination:
                host: productpage
                port:
                  number: 9080

步骤四:验证TLS版本

testssl.sh是一个免费的命令行工具,可以检查服务器在任何端口上的服务是否支持TLS/SSL密钥、协议以及一些加密缺陷等。本文使用testssl.sh对TLS版本进行验证。

  1. 执行以下命令,以容器方式运行testssl.sh

    docker run --rm -ti  registry.cn-hangzhou.aliyuncs.com/acs/testssl.sh https://网关地址/productpage

    展开查看预期输出

    Testing protocols via sockets except NPN+ALPN
    
    SSLv2      not offered (OK)
    SSLv3      not offered (OK)
    TLS 1      not offered
    TLS 1.1    not offered
    TLS 1.2    offered (OK)
    TLS 1.3    offered (OK): final
    
    ......
    Running client simulations (HTTP) via sockets
    
    Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
    ------------------------------------------------------------------------------------------------
    Android 6.0                  TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
    Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
    Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
    Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Android 11 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Android 12 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Chrome 79 (Win 10)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Firefox 66 (Win 8.1/10)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    IE 6 XP                      No connection
    IE 8 Win 7                   No connection
    IE 8 XP                      No connection
    IE 11 Win 7                  No connection
    IE 11 Win 8.1                No connection
    IE 11 Win Phone 8.1          No connection
    IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
    Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
    Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Safari 12.1 (iOS 12.2)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
    Safari 13.0 (macOS 10.14.6)  TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
    Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    Java 7u25                    No connection
    Java 8u161                   TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
    Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            256 bit ECDH (P-256)
    Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
    go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
    LibreSSL 2.8.3 (Apple)       TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
    OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
    OpenSSL 1.1.0l (Debian)      TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
    OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
    OpenSSL 3.0.3 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
    Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
    Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)

    由预期输出得到,TLS 1和TLS 1.1版本均为not offered,说明已禁用这两个版本;TLS 1.2和1.3版本均为offered,说明支持这两个版本。

    在客户端的模拟请求中,也可以看到只有支持TLS 1.2和1.3版本的客户端才能建立连接。

  2. 可选:若您需要严格限制到TLS 1.2版本,请参照以下步骤。

    1. 参照如下YAML,修改Gateway网关规则配置,设置maxProtocolVersionminProtocolVersion均为TLSV1_2

      apiVersion: networking.istio.io/v1beta1
      kind: Gateway
      metadata:
        name: mysdsgateway
        namespace: default
      spec:
        selector:
          istio: ingressgateway
        servers:
          - hosts:
              - '*'
            port:
              name: https
              number: 443
              protocol: HTTPS
            tls:
              credentialName: myexample-credential
              maxProtocolVersion: TLSV1_2
              minProtocolVersion: TLSV1_2
              mode: SIMPLE
    2. 执行以下命令,进行验证测试。

      docker run --rm -ti  registry.cn-hangzhou.aliyuncs.com/acs/testssl.sh https://网关地址/productpage

      展开查看预期输出

       Testing protocols via sockets except NPN+ALPN
      
       SSLv2      not offered (OK)
       SSLv3      not offered (OK)
       TLS 1      not offered
       TLS 1.1    not offered
       TLS 1.2    offered (OK)
       TLS 1.3    not offered and downgraded to a weaker protocol
      
      ......
       Running client simulations (HTTP) via sockets
      
       Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
      ------------------------------------------------------------------------------------------------
       Android 6.0                  TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
       Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
       Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Android 9.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Android 10.0 (native)        TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Android 11 (native)          TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Android 12 (native)          TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Chrome 79 (Win 10)           TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Chrome 101 (Win 10)          TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Firefox 66 (Win 8.1/10)      TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Firefox 100 (Win 10)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       IE 6 XP                      No connection
       IE 8 Win 7                   No connection
       IE 8 XP                      No connection
       IE 11 Win 7                  No connection
       IE 11 Win 8.1                No connection
       IE 11 Win Phone 8.1          No connection
       IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
       Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Edge 101 Win 10 21H2         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Safari 12.1 (iOS 12.2)       TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Safari 13.0 (macOS 10.14.6)  TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Safari 15.4 (macOS 12.3.1)   TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       Java 7u25                    No connection
       Java 8u161                   TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
       Java 11.0.2 (OpenJDK)        TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
       Java 17.0.3 (OpenJDK)        TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
       go 1.17.8                    TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
       LibreSSL 2.8.3 (Apple)       TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
       OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
       OpenSSL 1.1.0l (Debian)      TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
       OpenSSL 1.1.1d (Debian)      TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
       OpenSSL 3.0.3 (git)          TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
       Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
       Thunderbird (91.9)           TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)

      由预期输出得到,TLS 1和TLS 1.1版本均为not offered,TLS 1.3版本为not offered and downgraded to a weaker protocol,说明已禁用这三个版本;TLS 1.2版本为offered,说明只支持TLS 1.2版本。

      在客户端的模拟请求中,也可以看到只有支持TLS 1.2版本的客户端才能建立连接。

  3. 可选:若您需要严格限制到TLS 1.3版本,请参照以下步骤。

    1. 参照如下YAML,修改Gateway网关规则配置,设置maxProtocolVersionminProtocolVersion均为TLSV1_3

      apiVersion: networking.istio.io/v1beta1
      kind: Gateway
      metadata:
        name: mysdsgateway
        namespace: default
      spec:
        selector:
          istio: ingressgateway
        servers:
          - hosts:
              - '*'
            port:
              name: https
              number: 443
              protocol: HTTPS
            tls:
              credentialName: myexample-credential
              maxProtocolVersion: TLSV1_3
              minProtocolVersion: TLSV1_3
              mode: SIMPLE
    2. 执行以下命令,进行验证测试。

      docker run --rm -ti  registry.cn-hangzhou.aliyuncs.com/acs/testssl.sh https://网关地址/productpage

      展开查看预期输出

      Testing protocols via sockets except NPN+ALPN
      
      SSLv2      not offered (OK)
      SSLv3      not offered (OK)
      TLS 1      not offered
      TLS 1.1    not offered
      TLS 1.2    not offered
      TLS 1.3    offered (OK): final
      
      ......
      Running client simulations (HTTP) via sockets
      
       Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
      ------------------------------------------------------------------------------------------------
       Android 6.0                  No connection
       Android 7.0 (native)         No connection
       Android 8.1 (native)         No connection
       Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Android 11 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Android 12 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Chrome 79 (Win 10)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Firefox 66 (Win 8.1/10)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       IE 6 XP                      No connection
       IE 8 Win 7                   No connection
       IE 8 XP                      No connection
       IE 11 Win 7                  No connection
       IE 11 Win 8.1                No connection
       IE 11 Win Phone 8.1          No connection
       IE 11 Win 10                 No connection
       Edge 15 Win 10               No connection
       Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Safari 12.1 (iOS 12.2)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
       Safari 13.0 (macOS 10.14.6)  TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
       Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       Java 7u25                    No connection
       Java 8u161                   No connection
       Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            256 bit ECDH (P-256)
       Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
       go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
       LibreSSL 2.8.3 (Apple)       No connection
       OpenSSL 1.0.2e               No connection
       OpenSSL 1.1.0l (Debian)      No connection
       OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
       OpenSSL 3.0.3 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
       Apple Mail (16.0)            No connection
       Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)

      由预期输出得到,TLS 1、TLS 1.1和TLS 1.2版本均为not offered,说明已禁用这三个版本;TLS 1.3版本为offered,说明只支持TLS 1.3版本。

      在客户端的模拟请求中,也可以看到只有支持TLS 1.3版本的客户端才能建立连接。