0

We currently use .htaccess to force all traffic coming to our sites over to https. In order to pass various security requirements we should be shutting off SSL 3.0/TLS 1.0, but a small but significant portion of our sizable audience is still using browser versions that make it problematic to shut it off without explanation.

Looking through various .htaccess recipes, I've not yet found one that can check down to the security protocol level and redirect to a different location.

The end result I'm looking for is to be able to gracefully handle those users of older browsers that either don't support TLS 1.1/1.2 or that require user interaction to do so. If we can redirect just the browsers that aren't going to work to a non-https page with information/instructions, it will save much grief.

Leaving SSL 3.0 on is not an option and neither is removing the https-only restriction for the whole website. It seems to me that we could do page-level detection but that the overhead there, compared to having apache do the lifting, seems too high.

Improve this question
3
  • The SSL/TLS handshake must occur before any .htaccess commands would run, so you face sending 100% of traffic to a HTTP page explaning what's going on, then redirecting the vast majority using modern browsers to the HTTPS site (maybe with a bit of JS on the HTTP page). This is inefficient and very confusing for visitors, are you sure you are unwilling to consider HTTPS-only?
    – Tom Brossman
    Commented May 17, 2015 at 7:53
  • That was my fear, that there was no way to handle it preemptively. Even with the lightest-weight of pages doing the checking it would mean an extra redirect for everyone. btw, did you mean "reconsider https-only"? We're already redirecting everyone to https but have been late in removing SSL 3.0 so as not to crush our end-users that still use non-modern IE.
    – mpa000
    Commented May 20, 2015 at 19:38
  • I should have said 'TLS only'. Run a SSL Labs test on your site, show it to the decision makers, and ask if they are comfortable with poor security for all to keep the site accessible to a small minority with obsolete browsers. And you will be surprised how many of those users ignore the HTTPS errors & warnings and click through to your site anyway.
    – Tom Brossman
    Commented May 21, 2015 at 7:18

1 Answer 1

Reset to default
0

You point out that a small but significant proportion of your users are using out-dated browsers. You are never going to be able to get all users to upgrade to the latest version but you can establish a phase out period during which you can detect the security mechanisms supported by the browser. If the browser doesn't support modern technologies you can output a banner message to the browser above the site telling the end user that on such a date support for their browser will end and they need to upgrade if they wish to continue to access the site. After that date just switch off SSL3 and TLS1. After that point if a user connects with an unsupported browser they will get a server generated error message.

There is not much you can do to filter those connections before the fact as SSL is done prior to htaccess or application level rules. If you need this done at the server layer then there will be the trade off of blocking some users.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.