Hacker News new | past | comments | ask | show | jobs | submit login

Note that "connections made _by_ some particular web browser" (in this case Chrome) and "connections made _to_ some web site" (and seen in your logs) are not the same kind of thing.

Both client and server will try to negotiate the best version they and their peer can manage, but the populations of those peers are different so the statistics are not necessarily well correlated.

One problem Chrome doesn't have to worry about, but your site might (especially if its demographics skew towards people with older and possibly out-of-support systems) is out-dated web browsers.

Also I'm going to link the diediedie draft, which is now superseded by a version with a more corporate name but I was amused because the IETF's script crashed when trying to render it, so rather than link the current one that doesn't do that here's the original with the funnier name and the crash:

https://tools.ietf.org/html/draft-moriarty-tls-oldversions-d...




This is important, from a client perspective (e.g. from Chrome) this makes sense.

But from a server perspective, you still have trouble with old clients, particularly Windows XP.

Slowly disappearing but not gone yet.

Fortunately SNI (i.e. not requiring a dedicated IP per SSL customer) is becoming so commonplace that a lot of those browsers are getting broken anyway, which will probably speed up that deprecation.


> Where necessary, servers may enable both modern and legacy options, to continue to support legacy clients.

It looks like you can still have older TLS versions enabled as long as TLS 1.2 or later is supported.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: