anycable-go TLS Settings?

[cjamison]

We have implemented AnyCable with anycable-go and things seem to work well. However, we have noticed that some of our clients are having issues establishing a WSS connection and we are getting TLS handshake error in the anycable-go logs. Right now, our nginx still permits TLS 1, 1.1 and 1.2 (although I would prefer not to). I wonder if some clients connect successfully with TLS 1 or 1.1 and then have a problem with anycable-go? Can you share what TLS version anycable-go supports? Or, even possibly the ciphers? I could not find it anywhere in the configuration or the code.

[palkan]

I wonder if some clients connect successfully with TLS 1 or 1.1 and then have a problem with anycable-go?

Yeah, that could be the case. We rely on Go's built-in tls package, which currently supports only 1.2 and 1.3: https://golang.org/pkg/crypto/tls/

As I understand, your clients connect to anycable-go directly, right? I'd recommend to use NGINX to terminate SSL for WebSockets as well, so you can have more control on TLS configuration.