pass protocol and cipher details to fcgi env
We currently live in a world where there are no good options for protocol/ciphers (ie BEAST/RC4 problem). And it has been revealed (thanks Ed!) that the NSA can probably easily decrypt RC4. You have to allow insecure options to support the huge browser body out that does not yet support decent protocol cipher combinations.
Since Lighty supports TLS1.2 etc by compiling against latest openssl. One way is to push the end user towards updating their browsers (the good ones are nearly there on TLS1.2 etc). In order to do that the server side application really needs access to the what protocol version and cipher / key length the user-agent has used to connect..and then display appriproiate motivational end-user messaging.
This could be done by pushing this protocol/cipher detail into setenv to picked up, eg by php $_SERVER. Similar to what apache2/mod_php does:
Is this info available at the right stage of request to do that, if so the required change might be quite trivial...?
[TLS] set SSL_PROTOCOL, SSL_CIPHER* (fixes #2511)
initialized for mod_magnet and dynamic CGI-like handlers
(mod_cgi, mod_fastcgi, mod_scgi, mod_ssi) (not mod_proxy)
Note: in the future a config flag (does not yet exist) might be required
to activate initialization of these SSL_* env variables. This might
occur if there are requests to access these variables in mod_accesslog,
and/or if more SSL_* varables are created, which would be more work.
"pass protocol and cipher details to fcgi env"
Updated by oschonrock about 6 years ago
this would achieve a similar goal as this...ie push user-agents towards better protocol cipher combinations:
but in a different way...and for lighty 1.4 and 2.0
Also available in: Atom