[PATCH 5/6] When selecting TLS protocol options for GnuTLS set the same defaults as in openssl.

[Nikos Mavrogiannopoulos]

On Sat, 2013-11-23 at 19:26 +0000, David Woodhouse wrote:
> > This change removes the protocol-weakening options (e.g., the disabling of
> > secure renegotiation, the removal of ECDHE ciphersuites, and the restriction
> > to the known to be weak TLS 1.0).
> 
> I don't think we can do that; certainly not unconditionally. Some
> servers (or their firewalls) are very picky about what they allow, and
> secure renegotiation and TLS > 1.0 have definitely been known to give
> immediately connection failures.

Could that be conditionally? (or relate that to --pfs option?) 

btw. Are the issues you refer to related to the bigip firewall and
http://www.ietf.org/mail-archive/web/tls/current/msg10423.html
There it seems that bigip is interpreting TLS1.0 messages as SSL2.0 if a
number of extensions is present. His suggestion was to add a very large
TLS extension to avoid that bug (In 3.2.7 I added the %DUMBFW option in
priority strings to do just that).

regards,
Nikos