Project

General

Profile

Feature #2511

pass protocol and cipher details to fcgi env

Added by oschonrock almost 7 years ago. Updated almost 4 years ago.

Status:
Fixed
Priority:
Normal
Category:
TLS
Target version:
ASK QUESTIONS IN Forums:

Description

Motivation
-----------
We currently live in a world where there are no good options for protocol/ciphers (ie BEAST/RC4 problem). And it has been revealed (thanks Ed!) that the NSA can probably easily decrypt RC4. You have to allow insecure options to support the huge browser body out that does not yet support decent protocol cipher combinations.

Since Lighty supports TLS1.2 etc by compiling against latest openssl. One way is to push the end user towards updating their browsers (the good ones are nearly there on TLS1.2 etc). In order to do that the server side application really needs access to the what protocol version and cipher / key length the user-agent has used to connect..and then display appriproiate motivational end-user messaging.

Feature
-------
This could be done by pushing this protocol/cipher detail into setenv to picked up, eg by php $_SERVER. Similar to what apache2/mod_php does:

http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#envvars

Is this info available at the right stage of request to do that, if so the required change might be quite trivial...?


Related issues

Related to Feature #2652: [patch] Add additional SSL env variables for strict client certificate authentication and authorizationDuplicate2015-07-04Actions
#1

Updated by oschonrock almost 7 years ago

this would achieve a similar goal as this...ie push user-agents towards better protocol cipher combinations:

http://blog.lighttpd.net/articles/2013/06/01/mitigating-beast-with-gnutls/

but in a different way...and for lighty 1.4 and 2.0

#2

Updated by stbuehler almost 7 years ago

  • Priority changed from High to Normal
#3

Updated by gstrauss over 4 years ago

  • Category changed from core to TLS
#4

Updated by gstrauss almost 4 years ago

  • Related to Feature #2652: [patch] Add additional SSL env variables for strict client certificate authentication and authorization added
#5

Updated by gstrauss almost 4 years ago

  • Status changed from New to Patch Pending
  • Target version set to 1.4.42
#6

Updated by gstrauss almost 4 years ago

  • Status changed from Patch Pending to Fixed
  • % Done changed from 0 to 100

Also available in: Atom