After reading about tls 1.2 sessions[s], I wanted to see how easy/hard it would be to a) run tls 1.2 without session tickets, and/or force tls 1.3+ -- the close

After reading about tls 1.2 sessions[s], I wanted to see how easy/hard it would be to a) run tls 1.2 without session tickets, and/or force tls 1.3+ -- the closest I came was: [ed: moved the link up, for less confusing flow] http://erlang.org/doc/apps/ssl/ssl_protocol.html#id61195 http://erlang.org/doc/apps/ssl/ssl_protocol.html#id61195 which isn't all that enlightening to someone not familiar with Erlang. Does anyone know of a "best security practices" particularly for cowboy/opp/erlang and/or elixir? I'm reminded of how for the longest time ssl was completely broken in python (it wasn't at all obvious how to force verification of certificates - especially for new developers)... And I've grudgingly come to accept that tls/http2 is complex enough that beyond getting to "it works" - even foolproof libraries need a couple of lines of text discussing trade-offs (eg. security vs performance vs ease-of multi-server deployment of session resumption). [s] https://news.ycombinator.com/item?id=15358446 https://news.ycombinator.com/item?id=15358446