They also use a pretty strong TLS conf https://gist.github.com/jvehent/98fdfef139b6237f7bf5
What strikes me is that their conf is inaccessible to old client (no sslv3, no sha-1 cert). Honest question: does the government think it's ok to break website access from ancient clients (XPSP2 IE6)? Or will they be forced to enable legacy ciphers when the first citizens complain? I'm genuinely interested, because the topic of TLS modernity is a hard problem to solve. If that was easy, google.com wouldn't be using RC4-MD5 and a sha-1 cert...