{"action":"created","issue":{"url":"https://api.github.com/repos/bagder/curl/issues/406","labels_url":"https://api.github.com/repos/bagder/curl/issues/406/labels{/name}","comments_url":"https://api.github.com/repos/bagder/curl/issues/406/comments","events_url":"https://api.github.com/repos/bagder/curl/issues/406/events","html_url":"https://github.com/bagder/curl/pull/406","id":104516174,"number":406,"title":"Use HTTP2-compatible cipher as first preference","user":{"login":"mhils","id":1019198,"avatar_url":"https://avatars.githubusercontent.com/u/1019198?v=3","gravatar_id":"","url":"https://api.github.com/users/mhils","html_url":"https://github.com/mhils","followers_url":"https://api.github.com/users/mhils/followers","following_url":"https://api.github.com/users/mhils/following{/other_user}","gists_url":"https://api.github.com/users/mhils/gists{/gist_id}","starred_url":"https://api.github.com/users/mhils/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhils/subscriptions","organizations_url":"https://api.github.com/users/mhils/orgs","repos_url":"https://api.github.com/users/mhils/repos","events_url":"https://api.github.com/users/mhils/events{/privacy}","received_events_url":"https://api.github.com/users/mhils/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-09-02T16:06:08Z","updated_at":"2015-09-03T11:36:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/bagder/curl/pulls/406","html_url":"https://github.com/bagder/curl/pull/406","diff_url":"https://github.com/bagder/curl/pull/406.diff","patch_url":"https://github.com/bagder/curl/pull/406.patch"},"body":"This is a follow up of https://sourceforge.net/p/curl/bugs/1487/ - 0d1060f21efe81454f59f75d12f2798ba0566130 did not solve this issue for me.\r\nWhen connecting to [http2.golang.org](https://http2.golang.org/), OpenSSL advertises the following cipher suites after sorting ciphers with `@STRENGTH`:\r\n![](https://maximilianhils.com/upload/2015-09/2015-09-02_17-53-48.png)\r\n\r\nThe go server apparently does not support `SHA384`. As a consequence, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)` will be picked, which is blacklisted by the HTTP2 spec. This causes the go server to fail the connection.\r\n\r\nBy listing ECDHE-RSA-AES128-GCM-SHA256 as the first preference, HTTP2 servers will always either pick that (HTTP2 servers must implement that cipher according to the spec) or the server preference, which should not be blacklisted by the HTTP2 spec. Unfortunately, `ECDHE-RSA-AES128-GCM-SHA256` is considered to be weaker by OpenSSL (`AES128` vs `AES256` I suppose), so we need to remove `@STRENGTH` again.\r\n\r\nTest case: `curl --http2 https://http2.golang.org/`"},"comment":{"url":"https://api.github.com/repos/bagder/curl/issues/comments/137413427","html_url":"https://github.com/bagder/curl/pull/406#issuecomment-137413427","issue_url":"https://api.github.com/repos/bagder/curl/issues/406","id":137413427,"user":{"login":"bagder","id":177011,"avatar_url":"https://avatars.githubusercontent.com/u/177011?v=3","gravatar_id":"","url":"https://api.github.com/users/bagder","html_url":"https://github.com/bagder","followers_url":"https://api.github.com/users/bagder/followers","following_url":"https://api.github.com/users/bagder/following{/other_user}","gists_url":"https://api.github.com/users/bagder/gists{/gist_id}","starred_url":"https://api.github.com/users/bagder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bagder/subscriptions","organizations_url":"https://api.github.com/users/bagder/orgs","repos_url":"https://api.github.com/users/bagder/repos","events_url":"https://api.github.com/users/bagder/events{/privacy}","received_events_url":"https://api.github.com/users/bagder/received_events","type":"User","site_admin":false},"created_at":"2015-09-03T11:36:44Z","updated_at":"2015-09-03T11:36:44Z","body":"So yes, other people are also telling me that \"@STRENGTH\" doesn't work and that we need to list ciphers explicitly. Let's bite the bullet. Any suggestions?"}}