Skip to content

feat: Improve supported cipher suites in RFC9151 policy#5559

Merged
goatgoose merged 1 commit intoaws:mainfrom
goatgoose:update-rfc9151
Oct 15, 2025
Merged

feat: Improve supported cipher suites in RFC9151 policy#5559
goatgoose merged 1 commit intoaws:mainfrom
goatgoose:update-rfc9151

Conversation

@goatgoose
Copy link
Copy Markdown
Contributor

@goatgoose goatgoose commented Oct 13, 2025

Release Summary:

  • Removes RSA key exchange and DHE cipher suites from the rfc9151 named security policy. Use the numbered version of this policy instead (20250429) to maintain the current preferences.

Resolved issues:

resolves #5543

Description of changes:

Updates the RFC 9151 security policy with better supported cipher suites, as described in #5543.

Call-outs:

None

Testing:

The rfc9151 backwards compatibility test was updated to ensure the updated policy is backwards compatible with the current policy.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@goatgoose goatgoose marked this pull request as ready for review October 14, 2025 16:24
@goatgoose goatgoose added this pull request to the merge queue Oct 15, 2025
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Oct 15, 2025
@goatgoose goatgoose added this pull request to the merge queue Oct 15, 2025
Merged via the queue into aws:main with commit 7372079 Oct 15, 2025
50 checks passed
@goatgoose goatgoose deleted the update-rfc9151 branch October 15, 2025 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security policy: update RFC9151 to remove subpar ciphers

3 participants