Phase out weak ciphers?

[cpuguy83]

We have this comment:

go-connections/tlsconfig/config.go

Line 43 in 58542c7

// Extra (server-side) accepted CBC cipher suites - will phase out in the future

Perhaps it is time to go ahead and make good on that comment?

[cpuguy83]

/cc @thaJeztah @AkihiroSuda @neersighted

Related to moby/moby#45121

[neersighted]

PTAL @corhere as well; I have no strong opinions -- if no others appear, maybe we discuss this on Thursday?

[thaJeztah]

Yeah, we still need to dig into the TLS1.3 issue as well; updating moby to the latest code in this repo breaks things (see moby/moby#41084 and the original PR linked)

[cpuguy83]

Seems strange that we even have tlsconfig in this repo.

[thaJeztah]

Yeah, ISTR the original reason was to have a canonical place where these were defined (as at the time it was not always trivial to decide on the ciphers, and to make sure all repositories followed the same)