crypto/tls: remove RSA KEX ciphers from the default list

[gostls13.git] / doc / godebug.md

diff --git a/doc/godebug.md b/doc/godebug.md
index 2ca27a640d33258158ede414d45c5c00bc2d5d64..9235635bdd0958789c4a847793c59b7e2d7131b5 100644 (file)
--- a/doc/godebug.md
+++ b/doc/godebug.md
@@ -155,6 +155,10 @@ Go 1.22 changed the default minimum TLS version supported by both servers
 and clients to TLS 1.2. The default can be reverted to TLS 1.0 using the
 [`tls10server` setting](/pkg/crypto/tls/#Config).
 
+Go 1.22 changed the default TLS cipher suites used by clients and servers when
+not explicitly configured, removing the cipher suites which used RSA based key
+exchange. The default can be revert using the [`tlsrsakex` setting](/pkg/crypto/tls/#Config).
+
 ### Go 1.21
 
 Go 1.21 made it a run-time error to call `panic` with a nil interface value,