Fix TLS 1.2 support (#1637)

CHANGELOG.md

@@ -4,6 +4,18 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ## Next
 
+### Deprecations/Changes
+
+* tls: Boundary's support for TLS 1.0/1.1 on the API listener was broken. Rather
+  than fix this, we are simply not supporting TLS 1.0/1.1 as they are insecure.
+
+### Bug Fixes
+
+* tls: Support TLS 1.2 for more clients. This was broken for some clients due to
+  a missing mandated cipher suite of the HTTP/2 (`h2`) specification that could
+  result in no shared cipher suites between the Boundary API listener and those
+  clients. ([PR](https://github.com/hashicorp/boundary/pull/1637))
+
 ## 0.6.2 (2021/09/27)
 
 ### Deprecations/Changes

internal/cmd/base/listener.go

@@ -54,7 +54,7 @@ func NewListener(l *listenerutil.ListenerConfig, ui cli.Ui) (*alpnmux.ALPNMux, m
 	}
 
 	if len(l.Purpose) != 1 {
-		return nil, nil, nil, fmt.Errorf("Expected single listener purpose, found %d", len(l.Purpose))
+		return nil, nil, nil, fmt.Errorf("expected single listener purpose, found %d", len(l.Purpose))
 	}
 	purpose := l.Purpose[0]
 
@@ -65,6 +65,17 @@ func NewListener(l *listenerutil.ListenerConfig, ui cli.Ui) (*alpnmux.ALPNMux, m
 		// TODO: Eventually we'll support bringing your own cert, and we'd only
 		// want to disable if you aren't actually bringing your own
 		l.TLSDisable = true
+	default:
+		switch l.TLSMinVersion {
+		case "", "tls12", "tls13":
+		default:
+			return nil, nil, nil, fmt.Errorf("unsupported minimum tls version %q", l.TLSMinVersion)
+		}
+		switch l.TLSMaxVersion {
+		case "", "tls12", "tls13":
+		default:
+			return nil, nil, nil, fmt.Errorf("unsupported maximum tls version %q", l.TLSMaxVersion)
+		}
 	}
 
 	finalAddr, ln, err := f(purpose, l, ui)

internal/cmd/base/servers.go

@@ -390,7 +390,9 @@ func (b *Server) SetupListeners(ui cli.Ui, config *configutil.SharedConfig, allo
 				// 1.2
 				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
 				tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-				tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+				tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+				tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
 			}
 		}