| Can you explain how it isn't quite right? I would like to correct the article if this is the case. When I ran the code, the Go HTTP/2 package caused a panic with the message "http2: TLSConfig.CipherSuites is missing HTTP/2-required TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256". I went source diving and found the following: https://golang.org/src/net/http/h2_bundle.go?h=TLS_ECDHE_RSA... It even has the helpful comment: > If they already provided a CipherSuite list, return an error if it has a bad order or is missing ECDHE_RSA_WITH_AES_128_GCM_SHA256. I cannot see how I would have achieved my aim without disabling HTTP/2. The aim of the exercise was to get a perfect score using Go. I wasn't discussing HTTP/2 in general. I was referencing the Go standard library implementation. As I say, if you still think it's not right, please let me know. |
That is to say, you're correct that server configured for a 100% on SSLLabs will not support HTTP/2, but I agree with davidben that SSLLabs is incorrect here for incetivising AES-256, particularly in CBC mode, for the 100% score.