Enable TLS 1.0 and TLS 1.1 on Ubuntu 20.04
Solution 1:
I finally found out how to enable for nginx (afraid I don't know how to do it system-wide) and other services with a configuration allowing changing ciphers.
Source: man ciphers.1ssl
Edit your nginx configuration and amend your cipherlist to add the pseudocipher @SECLEVEL=1
.
Example:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
becomes
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
# seclevel for TLS 1.0 and 1.1
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:@SECLEVEL=1";
Solution 2:
For GnuTLS, as explained in
https://discourse.ubuntu.com/t/default-to-tls-v1-2-in-all-tls-libraries-in-20-04-lts/12464/8
create /etc/gnutls/config
(both directory and files were missing)
with the following content:
[overrides]
default-priority-string = NORMAL
This was enough to fix the following error in evolution (due to a pop3 server lacking TLS-1.2 support):
A packet with illegal or unsupported version was received
There were other instructions in this link for system-wide openSSL "fix", not tested.