shazow/urllib3 — pull request #321 by reaperhulk (2014-01-26 19:11:25+00:00)
Title: update DEFAULT_SSL_CIPHER_LIST for PyOpenSSL

The default cipher suites set in the pyopenssl contrib are now slightly out of date. SSLLabs has updated their recommendations and now suggests not using RC4 (see: [Is BEAST still a threat?](http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html)).

This particular suite has been lifted from the [current master of twisted](https://github.com/twisted/twisted/blob/trunk/twisted/internet/_sslverify.py#L995), but provides a whitelist that prefers forward secrecy for key exchange, AES-GCM for encryption (with fallbacks for CBC and 3DES if AES is unavailable), and disables null auth, etc. This was derived by @hynek, so if there questions about it we can drag him in to answer.