For stuff like this please indicate what codebase you're using and if you happen to know what is failing. I would expect this to work with either mainline or 1.2.7 with the configuration you described. If des-cbc-md5 is not in permitted_enctypes it would fail, but you would have to explicitly set that in order to get the failure.