The available ciphers list lacks an option with the combination of AES-256 and SHA-2. As far as I can tell there are only AES-256 options with SHA-1, and AES-128 options with SHA-2.
This is a problem because many companies (and government organizations) have cryptographic guidelines, of which most are starting to forbid SHA-1 and AES-128 based combinations. For those organizations the lack of suitable combination is a blocker for usage of crypto/TLS. (You can't negotiate with compliance people, they are a bit like terrorists, unfortunately.)
For example:
I build integration APIs that use client certificate authentication. I am going to be soon simply forbidden to use Go for that. I could add an extra web server (Apache, nginx, .. name your poison) but then the problem would be how I could absolutely reliably authenticate the web server against the API server. The most reliable method would be again mutual certificate authentication, requiring again AES-256 and SHA-2... Also, bringing in 3rd party library or daemon sounds too heavy solution for maintenance for me, requiring audit & accreditation process...
The available ciphers list lacks an option with the combination of AES-256 and SHA-2. As far as I can tell there are only AES-256 options with SHA-1, and AES-128 options with SHA-2.
This is a problem because many companies (and government organizations) have cryptographic guidelines, of which most are starting to forbid SHA-1 and AES-128 based combinations. For those organizations the lack of suitable combination is a blocker for usage of crypto/TLS. (You can't negotiate with compliance people, they are a bit like terrorists, unfortunately.)
For example:
I build integration APIs that use client certificate authentication. I am going to be soon simply forbidden to use Go for that. I could add an extra web server (Apache, nginx, .. name your poison) but then the problem would be how I could absolutely reliably authenticate the web server against the API server. The most reliable method would be again mutual certificate authentication, requiring again AES-256 and SHA-2... Also, bringing in 3rd party library or daemon sounds too heavy solution for maintenance for me, requiring audit & accreditation process...