Home / server / Questions / 644335
Accepted
burnersk
Asked: 2014-11-15 03:49:02 +0800 CST

Is it possible to set SSL/TLS version HTTP header with Apache which an backend application can use?

  • 772

There is one service on a virtual machine with a dedicated IP that required to be accessible via SSLv3 (WinXP with IE6 clients). I moved that service several several years ago to a that virtual machine to be able to disable SSLv3 for all the other services.

I would like to notify the SSLv3 clients for that service that this service will require TLS 1.1 or higher at "some time". That notification must not be shown on any other clients (business decision).

To achieve this I was thinking of injecting the used SSL/TLS version information on the proxies (Apache) into the original HTTP request to let the backend application conditionally place that "upgrade your system, dinosaur!" notification based on the actual used transport layer security method.

How do I configure the injection? I found the needed environment variables only when Apache is compiled with debug flags but that is not possible on production.

The final result should be that Apache Proxy is injecting the HTTP request header "X-TLS-Version: SSL3" (or "X-TLS-Version: TLS12" or familar syntax).

apache-2.2

2 Answers

  1. Best Answer

    Apache's mod_ssl makes a number of environment variables available when the SSLOptions directive +StdEnvVars is enabled, which includes the SSL protocol:

    SSL_PROTOCOL string The SSL protocol version (SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2)

    Which you can then use as a condition to set a header when SSLv3 is used:

    SSLOptions +StdEnvVars    
SetEnvIf SSL_PROTOCOL "SSLv3" insecure-protocol=true
RequestHeader set X-TLS-Version "SSLv3" env=insecure-protocol

    To always set a header with the SSL protocol the following may work:

    RequestHeader set X-TLS-Version %{SSL_PROTOCOL}s

    which has a small advantage that for simple scenario's you don't need to incur the overhead of SSLOptions +StdEnvVars but can access certain SSL variables directly with the %{FOOBAR}s syntax.

    neither was tested.

    • 4

  2. Set SSLOptions +StdEnvVars and a variety of SSL/TLS-related environment variables will be set. (And you may find this value already set in your web server config, as it is in some sample configs.)

    The environment variable your application will want to inspect will be SSL_PROTOCOL.

    And you have all our condolences for not being able to remove IE6 and XP from your environment on time.

    • 1