Set minimum TLS version in all tls.Config objects

builtin/credential/ldap/path_config.go

@@ -215,6 +215,7 @@ type ConfigEntry struct {
 
 func (c *ConfigEntry) GetTLSConfig(host string) (*tls.Config, error) {
 	tlsConfig := &tls.Config{
+		MinVersion: VersionTLS12,
 		ServerName: host,
 	}
 	if c.InsecureTLS {

builtin/logical/cassandra/util.go

@@ -50,6 +50,7 @@ func createSession(cfg *sessionConfig, s logical.Storage) (*gocql.Session, error
 	if cfg.TLS {
 		tlsConfig := &tls.Config{
 			InsecureSkipVerify: cfg.InsecureTLS,
+			MinVersion:         VersionTLS12,
 		}
 
 		if len(cfg.Certificate) > 0 || len(cfg.IssuingCA) > 0 {

helper/certutil/types.go

@@ -438,6 +438,7 @@ func (p *ParsedCertBundle) GetTLSConfig(usage TLSUsage) (*tls.Config, error) {
 
 	tlsConfig := &tls.Config{
 		NextProtos: []string{"http/1.1"},
+		MinVersion: VersionTLS12,
 	}
 
 	if p.Certificate != nil {

physical/consul.go

@@ -191,6 +191,7 @@ func setupTLSConfig(conf map[string]string) (*tls.Config, error) {
 	}
 
 	tlsClientConfig := &tls.Config{
+		MinVersion:         VersionTLS12,
 		InsecureSkipVerify: insecureSkipVerify,
 		ServerName:         serverName[0],
 	}