[issue20995] Use Better Default Ciphers for the SSL Module

[Mark Kubacki]

Mark Kubacki added the comment:

The cipher strings rely too much on AES for my taste. Imagine that ChaCha20Poly1305 or any other strong cipher suite is introduced to OpenSSL in the future.

Enabling using general, and demoting using narrow terms, seems IMHO a better approach. For example:

    ECDH+HIGH:DH+HIGH:!aNULL:!MD5:!RC4:-3DES:HIGH

----------
nosy: +markk

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue20995>
_______________________________________