TLS `min_version` defaults to 1.2, not 1.0 as documented

Operating system

Linux

System version

Fedora 44

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.1

Environment: go1.26.8 linux/arm64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_musl
Revision: 1ac1a339cb1223e9c70eae14c44411c75033c02d
CGO: enabled

Description

TLS min_version appears to default to TLS 1.2, but the documentation says that a server should default to TLS 1.0.

Reproduction

Server config:

{
    "$schema": "https://sing-box.sagernet.org/schema.json",
    "log": { "level": "info" },
    "inbounds": [
        {
            "type": "vless",
            "tag": "vless-in",
            "listen": "::",
            "listen_port": 443,
            "users": [{ "name": "test", "uuid": "00000000-0000-0000-0000-000000000000", "flow": "xtls-rprx-vision" }],
            "tls": {
                "enabled": true,
                "alpn": "h2",
                "certificate_path": "/etc/letsencrypt/live/example.com/fullchain.pem",
                "key_path": "/etc/letsencrypt/live/example.com/privkey.pem"
            }
        }
    ],
    "outbounds": [{ "type": "direct", "tag": "direct" }],
}

Then test with SSL Labs.

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.