I've read this article from Google's Online Security Blog, and it says that Google will disable support for SSLv3 and RC4.
Here's the reason:
SSLv3 has been obsolete for over 16 years and is so full of known problems that the IETF has decided that it must no longer be used. RC4 is a 28 year old cipher that has done remarkably well, but is now the subject of multiple attacks at security conferences. The IETF has decided that RC4 also warrants a statement that it too must no longer be used.
- When that happens, will we —the clients— have to do any kind of upgrade or configuration?
- What can we do right now?
I'm not sure if I understand well, will HTTPS disappear, or is it only about encryption upgrades?
Also there is a 'requirements' section in the article
Specifically, we are requiring:
- TLS 1.2 must be supported.
- A Server Name Indication (SNI) extension must be included in the handshake and must contain the domain that's being connected to.
- The cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 must be supported with P-256 and uncompressed points.
- At least the certificates in https://pki.google.com/roots.pem must be trusted.
- Certificate handling must be able to support DNS Subject Alternative Names and those SANs may include a single wildcard as the left-most label in the name.
As clients of domain name registrars and web hosting services, will we have to do any upgrade, or is this information only for them?
Basically, what I ask is: Should we get SSL Certificates for our websites still? If so, from where, or what version?