6

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some cases it may lock out significant users.

Looking at the SSL handshake the client sends details of what it supports.

So in theory a server could send a certificate that the client will support. Newer browsers would get a SHA2 signed one and older ones SHA1.

However it doesn't look like there are any ways do do this with nginx configuration. While you can set versions of cyphers and protocols you can't have any logic to determine how to behave with different client configurations.

Ia there a way to server a different certificate depending on what the client supports?

Improve this question
6
  • 5
    Just as those major browsers are sunsetting support for SHA-1, so should you be. If you have users affected by your move to SHA-2 then they should be looking at updating their browsers or moving to a platform that supports SHA-2 natively.
    – joeqwerty
    Sep 24, 2014 at 12:04
  • Btw. you are not locking out all IE6 users. IE6 on XP with SP3 supports it.
    – faker
    Sep 24, 2014 at 12:09
  • 3
    Anyone still running XP is out of support now, and anyone still running XP without SP3 is utterly insane.
    – Michael Hampton
    Sep 24, 2014 at 16:05
  • 2
    Probably the best move is to stop https support for them. May as well make it abundantly clear that they aren't secure anyway. I would implement this using user agent matching.
    – user140044
    Sep 25, 2014 at 7:08
  • 4
    You shouldn't even be able to procure a SHA-1 certificate now anyway.
    – Cameron Kerr
    May 2, 2015 at 10:04

1 Answer 1

Reset to default
1

This isn't currently possible with nginx (though it is with apache). However, it seems that companies like CloudFlare have already implemented their own internal modifications of nginx to be able to do so and will hopefully be open sourcing their work (https://news.ycombinator.com/item?id=8276770), so I'm hoping/expecting nginx will have this ability in a year from now when the need becomes more pressing as we approach 2016.

In the meantime, i just bought a 1-yr cert expiring in late 2015 so i don't get hit by Chrome's warnings until a hopefully a feature like this comes out.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .