diff options
| author | Brad Warren <bmw@users.noreply.github.com> | 2019-10-01 20:34:11 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-10-01 20:34:11 +0300 |
| commit | e3dbd9ce4a6336afd58c1917939172d7adc1d8bb (patch) | |
| tree | 58203c7f84226afd226bca8d8c82e8fe393d743c /CHANGELOG.md | |
| parent | c2480b29f7e289a0d3db3d8e7639b909b9069ace (diff) | |
Keep compatibility with IE11 in the Nginx plugin (#7414)test-0.39.0
As discussed at https://github.com/mozilla/server-side-tls/issues/263, Mozilla's current intermediate recommendations drop support for some non-EOL'd versions of IE. [Their TLS recommendations were updated to suggest a couple possible workarounds for people who need this support](https://github.com/mozilla/server-side-tls/pull/264) and [April suggested that we make this change in Certbot](https://github.com/mozilla/server-side-tls/issues/263#issuecomment-537085728).
We know `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` translates to `ECDHE-RSA-AES128-SHA` because [nginx uses the same cipher format as OpenSSL](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers) and the translation is shown in the table at https://github.com/mozilla/server-side-tls/blob/gh-pages/Cipher_Suites.mediawiki.
The risk of regressions making this change is low as we always had this ciphersuite enabled just a few releases ago: https://github.com/certbot/certbot/tree/v0.36.0/certbot-nginx/certbot_nginx
* Keep compatibility with IE11
* update changelog
Diffstat (limited to 'CHANGELOG.md')
| -rw-r--r-- | CHANGELOG.md | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 7155fa0d7..fe806de29 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ Certbot adheres to [Semantic Versioning](https://semver.org/). * Don't send OCSP requests for expired certificates * Return to using platform.linux_distribution instead of distro.linux_distribution in OS fingerprinting for Python < 3.8 +* Updated the Nginx plugin's TLS configuration to keep support for some versions of IE11. ### Fixed |