One of the things I noticed was that there is no rationale listed for the ssl_session_tickets disablement. I assume your concern is something like https://www.

One of the things I noticed was that there is no rationale listed for the ssl_session_tickets disablement. I assume your concern is something like https://www.imperialviolet.org/2013/06/27/botchingpfs.html https://www.imperialviolet.org/2013/06/27/botchingpfs.html which for most general use cases you're correct in saying that it should be disabled, but, it definitely deserves a nuanced explanation.