Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to redirect clients that use old browsers to a page that instructs them to download a newer browser.

by "old" browsers I mean - browsers that don't support certain ciper suites \ ssl protocols.
e.g. TLS1.1 or older to go to old.html and TLS1.2 to go to index.html

Is that possible?

share|improve this question

1 Answer 1

Yes and no.

Yes you can detect browser versions pretty easily. It is part of the headers send with each request. Matching them up with capabilities is somewhat trickier as is keeping such a list up to date.

No in the sense that your web/application server still need to allow HTTPS access using insecure versions of the SSL protocol and will still support low quality cipher suites. The SSL negotiation is already finished before you can detect the browser version and present the old.html page.

I'm not sure but I assume it is not unlikely that browsers will negiatiotate with an HTTPS server to use the most secure algorith, but it's possible for browser and server to mutually agree on the lowest, most insecure protocol they have in common as well as that will likely also be the most inexpensive computationally ; a valid choice for low power devices.

So even determining the actual cipher suite used may not be accurate in determining that the browser is "old".

share|improve this answer
    
Hi. I am actually looking for a way to serve a different page to clients who don't support TLS1.2, so i'd like to resolve this in the Nginx level. e.g. one configuration that serves TLS1.2 clients and another for all the rest. –  Nadav Jan 17 at 15:05
    
Anything unclear in the nginx manual? With again the caveat a browser may support TLS 1.2 and negotiate to not use it. –  HBruijn Jan 17 at 15:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.