From looking at the SSL Labs results I notice a few changes:
- The servers are now indicating a cipher suite preference.
- The servers are now putting TLS suites above the SSL suites.
- The servers no longer support TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.
- Why continue to support SSL 2.0 when no client that only supports SSL 2.0 has the WU client software on it.
- Why include more than one SSL cipher suite, if the goal is to enable the use of SSL 3.0 and the only clients to this server are based on SCHANNEL and CryptoAPI a single suite would be enough.
- If your going to support the RC4 cipher suites, why not prioritize them above the other suites so that they are resistant to BEAST.
- Why remove TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, I am guessing its performance but that is surprising since its not that much more expensive.
We also see a few changes when browsing to https://www.update.microsoft.com, unlike before when we browse from a client that doesn’t have a WU agent available on it (like XP /w IE6 and no SP) we no longer get instructions on how to get patched we now get a blank page.
Anyhow thats what I see today.