Hi, It was discovered that our recommendations select an inferior Ciphersuite in OpenSSL versions 0.9.8l to at least 1.0.0. https://github.com/puppetlabs/puppet/pull/2494#issuecomment-41351666 This seems to be a flaw in how OpenSSL selects algorithms from a given suite. Aaron