7

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some cases it may lock out significant users.

Looking at the SSL handshake the client sends details of what it supports.

So in theory a server could send a certificate that the client will support. Newer browsers would get a SHA2 signed one and older ones SHA1.

However it doesn't look like there are any ways do do this with nginx configuration. While you can set versions of cyphers and protocols you can't have any logic to determine how to behave with different client configurations.

Ia there a way to server a different certificate depending on what the client supports?

  • 5
    Just as those major browsers are sunsetting support for SHA-1, so should you be. If you have users affected by your move to SHA-2 then they should be looking at updating their browsers or moving to a platform that supports SHA-2 natively. – joeqwerty Sep 24 '14 at 12:04
  • Btw. you are not locking out all IE6 users. IE6 on XP with SP3 supports it. – faker Sep 24 '14 at 12:09
  • 3
    Anyone still running XP is out of support now, and anyone still running XP without SP3 is utterly insane. – Michael Hampton Sep 24 '14 at 16:05
  • 2
    Probably the best move is to stop https support for them. May as well make it abundantly clear that they aren't secure anyway. I would implement this using user agent matching. – Melvyn Sep 25 '14 at 7:08
  • 4
    You shouldn't even be able to procure a SHA-1 certificate now anyway. – Cameron Kerr May 2 '15 at 10:04
1

This isn't currently possible with nginx (though it is with apache). However, it seems that companies like CloudFlare have already implemented their own internal modifications of nginx to be able to do so and will hopefully be open sourcing their work (https://news.ycombinator.com/item?id=8276770), so I'm hoping/expecting nginx will have this ability in a year from now when the need becomes more pressing as we approach 2016.

In the meantime, i just bought a 1-yr cert expiring in late 2015 so i don't get hit by Chrome's warnings until a hopefully a feature like this comes out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.