In order to test some of the TLS functionality in various roles, an OpenSSL configuration hack is deployed in order to allow for use of outdated TLS versions (like 1.1). It would be beneficial to get rid of those since every now and then they seem to break during distribution upgrades.

The easiest way to go about this would be to change the TLS protocol version defaults and use only TLSv1.2 and TLSv1.3 versions for testing purposes. For this to be effectively possible, support for Debian 11 Bullseye will have to be dropped first (since the version of OpenSSL shipped with it does not support TLSv1.3).

The following should be done:

• Update tests for all roles.
  • Drop use of anything lower than TLSv1.1.
  • For configurable TLS protocol versions, rely on TLSv1.2 and TLSv1.3 only.
  • Drop hacks made to the system-wide OpenSSL configuration files.
• Make sure all tests are still passing after these changes.
• Make sure to document that the Majic Ansible Roles are primarily meant to be used with TLSv1.2 and TLSv1.3 and that anything lower than that may require manual changes on the administrator's side to global OpenSSL configuration file which are outside of scope of project documentation.
• Update role reference documentation.
• Update usage instructions.
• Update release notes.