> testssl.ch still laments about BREACH, when tested against a recent > nginx 1.16. > > Qualys ssllabs doesn't mention it at all. > > Is it fixed? > > Can you safely enable gzip on ssl-vhosts? I think you are confusing TLS compression with HTTP compression...