crypto/tls: remove RSA KEX ciphers from the default list

[gostls13.git] / src / crypto / tls / common.go

diff --git a/src/crypto/tls/common.go b/src/crypto/tls/common.go
index 69b0ee6ede7a6ed516688685a545d943af37355b..6058824dede742951a5d4f877b2489159b746f55 100644 (file)
--- a/src/crypto/tls/common.go
+++ b/src/crypto/tls/common.go
@@ -670,7 +670,9 @@ type Config struct {
        // the list is ignored. Note that TLS 1.3 ciphersuites are not configurable.
        //
        // If CipherSuites is nil, a safe default list is used. The default cipher
-       // suites might change over time.
+       // suites might change over time. In Go 1.22 RSA key exchange based cipher
+       // suites were removed from the default list, but can be re-added with the
+       // GODEBUG setting tlsrsakex=1.
        CipherSuites []uint16
 
        // PreferServerCipherSuites is a legacy field and has no effect.