Can you elaborate on why you need to turn this off? Servers are required to be compatible with it, and it costs 5 bytes, which does not seem nearly worth a configuration option.

@FiloSottile I agree with you. However, I don't see the point of sending a dummy CCS if there are no broken middleboxes along the path. Also I want to detect failing middleboxes before making a purchasing decision. If a middlebox doesn't work according to specs, the vendor won't get our money.

I agree with the vendor testing use case, but crypto/tls is meant for production use, not security or conformance testing. There are a number of forks that add all sorts of useful switches for that purpose.

Given it's basically free, I'd rather always send it (even when it's useless) than add the complexity and API surface to make it configurable. One of the main features of crypto/tls is that it's opinionated on anything it can reasonably decide for the user, and tls.Config is already more overwhelming than I'd like it to be.