I am proposing a change to the Handshake Simulation section for SSL Labs reports so that any failures, such as lack of SSLv3, will NOT BE SHOWN IN RED. Many developers implementing HTTPS on their websites associate the red with something bad that they need to fix. In this case, the red is actually something good for the Internet, meaning that SSLv3 is not supported. Many website operators may actually go back and downgrade their HTTPS to support SSLv3 to "fix" that "issue". More broadly, I would think that all End-of-Life (EOL) or unsupported configurations should be removed from this section. At the very least, the color should be changed to orange. IE5 is not included on the client list and why is that? Because it is unsupported and should not be considered any longer. The same is true with IE6 / Windows XP. Java6 is also EOL. Ideally, all EOL clients should be removed from that section too. Thoughts?
|IE 6 / XP No FS 1 No SNI 2||Protocol or cipher suite mismatch||Fail3|
(3) Only first connection attempt simulated. Browsers tend to retry with a lower protocol version.