I have an instance of httpd (version 2.0) that uses mod_proxy to transform incoming http requests to https. My problem is that I need my proxy to connect to a server that only supports SSLv3/TLSv1 Client Hello handshaking.

As a test, I've tried forcing TLSv1 on every option I can find:

SSLProxyEngine On
SSLProxyProtocol TLSv1
SSLProxyCipherSuite TLSv1

But I can see that httpd is still attempting an SSLv2 handshake. I realize this was the old intended behavior for backwards compatibility for some clients, but as far as I can tell this should have forced a newer handshake. Is this intended behavior? Is this maybe a bug in my old modules?


Found the answer by looking through the httpd source-- httpd version 2.0 will not use SSLv3/TLSv1 handshaking for any connections because it only uses SSLv2_client_method() or SSLv23_client_method() for creating its SSL context.

From ssl_engine_init.c:

if (protocol == SSL_PROTOCOL_SSLV2) {
    method = mctx->pkp ?
       SSLv2_client_method() : /* proxy */
        SSLv2_server_method();  /* server */
    ctx = SSL_CTX_new(method);  /* only SSLv2 is left */
else {
    method = mctx->pkp ?
        SSLv23_client_method() : /* proxy */
        SSLv23_server_method();  /* server */
    ctx = SSL_CTX_new(method); /* be more flexible */

Per the SSL documentation, a server context created with TLSv1_server_method() will not understand SSLv2* methods. Confirmed that later versions of httpd/mod_ssl work as expected and try SSLv3/TLSv1 first.

Don't use old versions!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.