Project

General

Profile

Actions

Feature #2511

closed

pass protocol and cipher details to fcgi env

Added by oschonrock over 10 years ago. Updated over 7 years ago.

Status:
Fixed
Priority:
Normal
Category:
TLS
Target version:
ASK QUESTIONS IN Forums:

Description

Motivation
-----------
We currently live in a world where there are no good options for protocol/ciphers (ie BEAST/RC4 problem). And it has been revealed (thanks Ed!) that the NSA can probably easily decrypt RC4. You have to allow insecure options to support the huge browser body out that does not yet support decent protocol cipher combinations.

Since Lighty supports TLS1.2 etc by compiling against latest openssl. One way is to push the end user towards updating their browsers (the good ones are nearly there on TLS1.2 etc). In order to do that the server side application really needs access to the what protocol version and cipher / key length the user-agent has used to connect..and then display appriproiate motivational end-user messaging.

Feature
-------
This could be done by pushing this protocol/cipher detail into setenv to picked up, eg by php $_SERVER. Similar to what apache2/mod_php does:

http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#envvars

Is this info available at the right stage of request to do that, if so the required change might be quite trivial...?


Related issues 1 (0 open1 closed)

Related to Feature #2652: [patch] Add additional SSL env variables for strict client certificate authentication and authorizationDuplicate2015-07-04Actions
Actions #1

Updated by oschonrock over 10 years ago

this would achieve a similar goal as this...ie push user-agents towards better protocol cipher combinations:

http://blog.lighttpd.net/articles/2013/06/01/mitigating-beast-with-gnutls/

but in a different way...and for lighty 1.4 and 2.0

Actions #2

Updated by stbuehler over 10 years ago

  • Priority changed from High to Normal
Actions #3

Updated by gstrauss almost 8 years ago

  • Category changed from core to TLS
Actions #4

Updated by gstrauss over 7 years ago

  • Related to Feature #2652: [patch] Add additional SSL env variables for strict client certificate authentication and authorization added
Actions #5

Updated by gstrauss over 7 years ago

  • Status changed from New to Patch Pending
  • Target version set to 1.4.42
Actions #6

Updated by gstrauss over 7 years ago

  • Status changed from Patch Pending to Fixed
  • % Done changed from 0 to 100
Actions

Also available in: Atom