*: define strict TLS 1.2 cipher suite default

[hexfusion]

etcd 3.4 should set a strict and secure default cipher list. Since the current etcd default list is what is defined by Go and the fact that etcd binaries can exist in the wild for a long time. To minimize future exposure to insecure ciphers we should set this default to a strict set based on the best knowledge we have at the time. As this list is subject to change we should review and update this list on a regular basis.

I think Mozilla modern is a good place to start and would enforce TLS 1.2 .

https://github.com/mozilla/server-side-tls/blob/5bfa79352c8e6e0324962be792d803ec666fa6fc/ssl-config-generator/index.html#L185

As of today this would include.

ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-CHACHA20-POLY1305
ECDHE-RSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256'

Looking for input on why we should not enforce TLS 1.2 by default for etcd 3.4.

ref: #8320

[jingyih]

/cc @wenjiaswe

[gyuho]

@hexfusion Moving to 3.5

[jmhbnz]

Hey @serathius, @ahrtr - Now that we have #15156 merged and --tls-min-version 'TLS1.2' as default in v3.6 and backported to both v3.5 and v3.4 release branches can we close this issue or am I missing something that still needs to be done?

[jmhbnz]

Closing as I believe we have this covered now. Happy to re-open if I am missing something.