GitLab.com and Logjam

What this post added

This post details the technical decision-making process and implementation for updating GitLab.com's SSL cipher suite to address the Logjam vulnerability. It explains the trade-offs considered, specifically the compatibility issues with older Java-based clients when using 2048-bit DHE parameters. The post outlines the investigation into removing DHE suites entirely, the observed results (improved SSL Labs score to 'A', continued forward secrecy via ECDHE for most clients, but loss of forward secrecy for specific older clients), and the final decision to remove DHE suites from GitLab.com. It also mentions updating recommended configurations for omnibus-gitlab packages and source installations.