kind:change

title:Removed SSLv3 support from webhooks and services

created_at:2014-10-16

author_name:kdaigle

This morning, we[removed support][github-services-pr] for the`ssl_version` webhook configuration

option and made`TLS 1.X` the default cryptographic protocol to address the[POODLE exploit][poodle].

You should no longer set or rely on the`ssl_version` configuration option.

If you have any questions or feedback, please[drop us a line][contact].

[github-services-pr]:https://github.com/github/github-services/pull/949

[poodle]:https://www.openssl.org/~bodo/ssl-poodle.pdf

[contact]:https://github.com/contact?form[subject]=Removed+SSLv3+support+from+webhooks+and+services

In certain exceptional cases, we may temporarily bump your rate limit higher. You

should be prepared to answer technical questions about your goal and your planned usage of the API. We may still choose not to bump your limit if we feel that you can achieve your wildest

dreams with the current rate limit (but don't worry, we'll help you out).

When we send events to your server, we attempt to negotiate either SSL version 2 or 3.

If your server requires a specific SSL version and does not support SSL negotiation,

you can specify a specific version within the[webhook's config block](https://developer.github.com/v3/repos/hooks/#edit-a-hook). Include a parameter called`ssl_version`, with a value of either`2` or`3`.