Asseon

you are right, bad case of a Layer 8 issue.

That does not seem to work according to ssllabs browser test.

I was unable to find one. Right now the only way seems to be to patch nss.

If your nginx version is 1.13 or newer than yes, that should be enough.

[0] http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_p...

Right now there are no benefits though. Because the browser sends the domainname you contact unencrypted via the TLS handshake due to SNI. So someone listing in to your communication will learn the hostname anyway.

I know people are working on encrypted SNI but that will take time.

Russia tried that for 3 years, now they use normal time the hole year. It seems only "summer time" is not a good idea either.

Seems to be down here too (germany), at least the desktop client. The web client still works.

Yes but A5/1 is utterly brocken. Besides thanks to numerous attacks possible through SS7 you probably do not even need to break the encryption.