Current hardening-related TLS configuration used by various roles is at this point fairly outdated, particularly taking into account that TLSv1.3 has come out and become generally available/usable with numerous packages in Debian 12 Bookworm.

To keep up with the times and best practices, the TLS configuration for all roles should be refreshed.

The following should be done:

• Update all roles that deploy servers that utilise TLS encryption.
  • Bump up the default TLS version used as much as possible.
  • Update the default list of configured ciphers.
  • Both TLS version and ciphers enabled/used should remain configurable in order to account for specific deployment requirements (clients using outdated libraries etc).
• Update role reference documentation.
• Update usage instructions.
• Update release notes.