smartcontractkit / smartcontractkit/chainlink
[FEAT] Enforce TLS 1.2 as minimum for shell HTTP client
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 8.2k
- Forks
- 2k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 202
Description
Description
The shell HTTP client currently uses default TLS configurations which may allow outdated and insecure TLS versions (like 1.0 or 1.1) depending on the environment's default crypto policy.
Proposed Improvement
Explicitly enforce TLS 1.2 as the minimum supported version in newHttpClient to ensure a consistent and secure communication baseline, protecting against downgrade attacks and known vulnerabilities in older TLS protocols.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the shell HTTP client's newHttpClient entry point and inspect how its TLS configuration is currently obtained. Enforce TLS 1.2 as the minimum supported version, then verify that the client no longer permits older TLS versions; the issue does not name a specific file or test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100