match latest config from https://cipherli.st/