Validate TLS 1.1 is disabled on Gorouter in Tanzu Platform for Cloud Foundry

Products

• VMware Tanzu Platform - Cloud Foundry

Issue/Introduction

This article provides the procedure to validate that TLS 1.1 is disabled at the Gorouter level across Tanzu Platform for Cloud Foundry foundations. While TLS termination may occur at the Load Balancer (LB) level, these steps confirm the platform's internal configuration.

Symptoms

• Requirement to audit or disable legacy TLS versions (TLS 1.0/1.1) for security compliance.
• Need to verify Gorouter configuration across multiple environments.

Environment

• Tanzu Platform for Cloud Foundry
• Gorouter

Resolution

To verify that the Gorouter is not accepting TLS 1.1 connections, follow these three methods:

1. Verify Manifest Desired State Run the following command to check the configured TLS versions in the deployment manifest:

   bosh -e #### -d #### manifest | grep -iE 'min_tls_version|max_tls_version'
   
   

2. Verify Rendered Configuration on Router VMs Check the actual rendered gorouter.yml file on each router instance:

   bosh -e #### -d #### ssh router -c 'sudo grep -iE "tls_version" /var/vcap/jobs/gorouter/config/gorouter.yml'

    

3. Perform an OpenSSL Probe (LB Bypass) Probe a specific router IP directly using OpenSSL to attempt a TLS 1.1 handshake. Replace <ROUTER_IP> with the internal IP of a router VM:

   echo | openssl s_client -connect <ROUTER_IP>:443 -tls1_1 -brief

    

   Expected Outcome: The command should return an error similar to error:0A0000BF:SSL routines:tls_setup_handshake:no protocols available, confirming the protocol is rejected.

Additional Information

• If TLS is terminated at the LB, validation should also be performed at the LB listener/VIP logs.
• Subscribe to this article for updates on security best practices: How to Subscribe to Knowledge Articles.