You would probably break your site for a lot of your users.
The newest stable Fx and Chrome, including mobile, will still work, right?
I think so.
What about various web services like rss readers
They should be fine.. unsure. I presume most web services use openssl.. and thanks to heartbleed they should be using latest openssl libraries.
or the google bot
I doubt googlebot would have issues scraping you, but I dont think google would rank you well if they knew your site would be broken for significant chunk of users.
I wish there was an easy way to log what version of SSL/TLS client used and with what ciphers for all mainstream web servers. Then you could just run a script on it and see how many would break. Could be useful for other things too.
My guess is CURL-based bots will fail (CURL had some problems with TLS 1.2-only auth), custom-written bots may too depending on architecture and (maybe) used openssl lib vesion. For browsers support see http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_br...
Comments
If I disable everything except TLS 1.2 in nginx, how much breakage should I expect? Has anyone tried?
The latest stable Fx and Chrome, including mobile, will still work, right? What about various web services like rss readers or the google bot?
http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_br...
You would probably break your site for a lot of your users.
I think so.
They should be fine.. unsure. I presume most web services use openssl.. and thanks to heartbleed they should be using latest openssl libraries.
I doubt googlebot would have issues scraping you, but I dont think google would rank you well if they knew your site would be broken for significant chunk of users.
I wish there was an easy way to log what version of SSL/TLS client used and with what ciphers for all mainstream web servers. Then you could just run a script on it and see how many would break. Could be useful for other things too.
%sslc in haproxy I think
My guess is CURL-based bots will fail (CURL had some problems with TLS 1.2-only auth), custom-written bots may too depending on architecture and (maybe) used openssl lib vesion. For browsers support see http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_br...