[PATCH] SSL: don't enable SSLv3 by default
piotr at cloudflare.com
Thu Oct 30 23:33:09 UTC 2014
> - SSLv3 is still important from compatibility point of view, there
> are various clients which doesn't support (or enable by default)
> anything better;
But is it, really?
All major browsers (Chrome , Firefox , IE , Opera ) either
already disabled SSLv3 or are about to do it.
Huge chunk of websites (>42% of Alexa's top 10.000 ) requires at
least TLSv1.0, including major properties like Facebook, Twitter ,
Wikipedia  and websites that are using one of the popular CDNs
(CloudFlare , Akamai , MaxCDN , Fastly ).
OpenBSD and LibreSSL disabled SSLv3 by default .
Furthermore, when we disabled SSLv3 across our network  and gave
website owners the ability to opt-in back to it... less than 0.001%
did re-enable it.
Hopefully that list is long enough to convince you that SSLv3 is not
really important... Definitely not important enough to be enabled by
default, because that's what the commit changes, people can still
enable SSLv3 in the conf if they really need to.
More information about the nginx-devel