cfengine/core — pull request #1730 by jimis (2014-05-26 13:22:02+00:00)
Title: Disable all renegotiation, resumption options and set safest defaults.

Reason is we want to expose a minimal attack surface on the very complex
TLS protocol and its implementations.

To disable TLS renegotiation and session resumption we need to turn off
the server-side session cache *and* disable session tickets (RFC 5077)
extension, see [1]. In the future we can always selectively re-enable
options in order to gain a performance boost.

[1] https://www.mail-archive.com/openssl-users@openssl.org/msg73185.html

Since we do not care about cross-browser compatibility and web, we also
disable all OpenSSL defaults that help with backwards compatibility.