Background
smart-proxy currently controls TLS behavior through two settings: ssl_disabled_ciphers (accepts a list of cipher names to remove from a hardcoded list) and tls_disabled_versions (accepts a list of TLS versions to disable). These settings do not integrate with RHEL’s system-wide crypto-policies (PROFILE=SYSTEM), meaning foreman-proxy does not automatically respect the organization’s security settings on managed RHEL hosts.
Proposed Changes
Two new settings are introduced in config/settings.yml:
tls_ciphers — accepts any OpenSSL cipher string, including PROFILE=SYSTEM:
When unset, smart-proxy auto-detects: if the openssl config exists, it defaults to PROFILE=SYSTEM, otherwise it falls back to OpenSSL’s built-in defaults.
tls_min_version — sets the minimum TLS protocol version. Valid values are '1.2' and '1.3' as versions 1.0 and 1.1 are disabled by default.
Breaking Changes
The following settings are removed in this release:
| Removed setting | Replacement |
|---|---|
ssl_disabled_ciphers |
Use tls_ciphers to specify the allowed cipher list |
tls_disabled_versions |
Use tls_min_version to set the minimum version |
You can track the progress of this feature in Fixes #39405 - Add tls_min_version and tls_ciphers settings by adamlazik1 · Pull Request #947 · theforeman/smart-proxy · GitHub.