We currently use .htaccess to force all traffic coming to our sites over to https. In order to pass various security requirements we should be shutting off SSL 3.0/TLS 1.0, but a small but significant portion of our sizable audience is still using browser versions that make it problematic to shut it off without explanation.
Looking through various .htaccess recipes, I've not yet found one that can check down to the security protocol level and redirect to a different location.
The end result I'm looking for is to be able to gracefully handle those users of older browsers that either don't support TLS 1.1/1.2 or that require user interaction to do so. If we can redirect just the browsers that aren't going to work to a non-https page with information/instructions, it will save much grief.
Leaving SSL 3.0 on is not an option and neither is removing the https-only restriction for the whole website. It seems to me that we could do page-level detection but that the overhead there, compared to having apache do the lifting, seems too high.