<p>An existing nginx ingress named <code>nginx-proxy</code> running on the K8 cluster.</p>
<p>Now, there is a requirement from the Dev team to disable TLS 1.0, 1.1 support.</p>
<p>Upon searching, I could see <a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/" rel="nofollow noreferrer">this solution</a> using configmap.</p>
<p>Do you think applying/creating a new configmap as follows to an existing nginx ingress helps me to resolve the issue?</p>
<pre><code>kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-proxy
data:
  ssl-protocols: &quot;TLSv1.2 TLSv1.3&quot;
</code></pre>
<p>Adding a new configmap like that to an existing nginx ingress breaks anything?. Because this is for the production website.</p>
<p>A piece of advice would be really helpful.</p>

<blockquote>
<p>To provide the most secure baseline configuration possible,</p>
<p>nginx-ingress defaults to using TLS 1.2 and 1.3 only, with a <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-ciphers" rel="nofollow noreferrer">secure set of TLS ciphers</a>. <sup>[<a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers" rel="nofollow noreferrer">source</a>]</sup></p>
</blockquote>
<p>It seems ingress-nginx uses TLS <em>1.2</em> and <em>1.3</em> <strong>only</strong> by default. The snippet you added to your question can be used to enable older TLS versions - like <em>1.0</em> and <em>1.1</em>.</p>
<pre class="lang-yaml prettyprint-override"><code>kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-config
data:
  ssl-ciphers: &quot;ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA&quot;
  ssl-protocols: &quot;TLSv1 TLSv1.1 TLSv1.2 TLSv1.3&quot;
</code></pre>
<p><sup>[<a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/#legacy-tls" rel="nofollow noreferrer">source</a>]</sup></p>
<p>You can check which versions of TLS (and ciphers) are enabled by issuing</p>
<pre class="lang-text prettyprint-override"><code>nmap --script ssl-enum-ciphers -p 443 &lt;ingress-nginx&gt;
</code></pre>
<p>replace <code>&lt;ingress-nginx&gt;</code> with your ingress IP.</p>
