TLS `min_version` defaults to 1.2, not 1.0 as documented

Operating system

Linux

System version

Fedora 44

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.1

Environment: go1.26.8 linux/arm64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_musl
Revision: 1ac1a339cb1223e9c70eae14c44411c75033c02d
CGO: enabled

Description

TLS min_version appears to default to TLS 1.2, but the documentation says that a server should default to TLS 1.0.

Reproduction

Server config:

{
    "$schema": "https://sing-box.sagernet.org/schema.json",
    "log": { "level": "info" },
    "inbounds": [
        {
            "type": "vless",
            "tag": "vless-in",
            "listen": "::",
            "listen_port": 443,
            "users": [{ "name": "test", "uuid": "00000000-0000-0000-0000-000000000000", "flow": "xtls-rprx-vision" }],
            "tls": {
                "enabled": true,
                "alpn": "h2",
                "certificate_path": "/etc/letsencrypt/live/example.com/fullchain.pem",
                "key_path": "/etc/letsencrypt/live/example.com/privkey.pem"
            }
        }
    ],
    "outbounds": [{ "type": "direct", "tag": "direct" }],
}

Then test with SSL Labs.

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start with the linked min_version documentation, then reproduce the supplied VLESS server configuration and inspect the Go TLS configuration path that selects the default. Verify the effective minimum version with SSL Labs, and finish when the documented default matches the observed behavior or the implementation is corrected and verified.