<p>We've an application and API, running on kubernetes on Azure, using an nginx-ingress and cert-manager which automatically creates letsencrypt certificates. The connection to the application/API is encrypted with TLS1.3.</p>
<p>From an older application, running on a Win 2012 server, we want to retrieve data from the API (on k8s). This isn't successful, since TLS1.3 isn't supported on that server.</p>
<p>I'd like to set the minimum version of TLS to 1.2 on kubernetes.
How can I achieve that?</p>
<p>I've read, that with kubelet, the tls-min-version can be configured, but I don't know how to apply this.</p>
<p><strong>Note:</strong> we use <code>az aks create</code> to create the k8s clusters.</p>

Peter
<p>As your win server connects to the application on <strong>K8s</strong> you have to set the version of <strong>TLS</strong> on the Nginx ingress level.</p>
<p>Nginx ingress &amp; cert-manager is point where you server connects and access API so you just have to update the TLS version of Nginx.</p>
<p>You can do it by changing the config map for <strong>Nginx</strong> ingress controller. Also, you might need to update the certificate also, there could be a chance by default Let's encrypt(CA) providing the default TLS 1.3.</p>
<p>So after enabling <strong>TLS 1.2</strong> for <strong>Nginx</strong> you might need to re-generate the cert-manager secret(certificate).</p>
<p><strong>Configmap Nginx ingress controller</strong></p>
<pre><code>kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-config
  namespace: ingress-nginx
data:
  ssl-ciphers: &quot;ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384&quot;
  ssl-protocols: &quot;TLSv1.2 TLSv1.3&quot;
</code></pre>
<p>above configmap will start both TLS versions for Nginx ingress controller.</p>
