4

Something like this?

# TLS v1.0+ for one IP

<VirtualHost _default_:443>

    Order deny,allow // <------------- HERE
    Deny from all // <------------- HERE
    Allow from 10.20.30.40 // <------------- HERE

    SSLProtocol all -SSLv2 -SSLv3 
    SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
    SSLHonorCipherOrder     on
    SSLCompression          off

    ...

</VirtualHost>

# TLS v1.2 for everyone else

<VirtualHost _default_:443>

    Order allow,deny // <------------- HERE
    Deny from 10.20.30.40 // <------------- HERE
    Allow from * // <------------- HERE

    SSLProtocol -all +TLSv1.2
    SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AECDH-AES256-SHA:ADH-AES256-GCM-SHA384:ADH-AES256-SHA256:ADH-AES256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:AECDH-DES-CBC3-SHA:ADH-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA
    SSLHonorCipherOrder on
    SSLCompression off

    ...

</VirtualHost>

Edit:

I have also an idea to create 2nd VirtualHost for different port lets says 344 and forward/route port 443 to 344 for that specific IP. Is it possible?

Improve this question
4
  • In theory it is possible but I don't think OpenSSL (or maybe mod_ssl) actually does it.
    – Michael Hampton
    May 15, 2015 at 12:21
  • 2
    @MichaelHampton maybe its doable with little help of iptables (or my mikrotik router)? for example I could run another VirtualHost on different port and filter+redirect request for that IP from port 443 to another?
    – Peter
    May 15, 2015 at 13:00
  • you might be able to do a redirect before, think of something like rewriteurl. you use www.example.com (do the rewrite to tls10.example.com based on ip ,otherwise tls1.2.example.com) then have your "normal" apache virtual hosts respond to those subdomains differently as you want. Sadly i lack enough info to check if rewriteurl is capable of that.
    – Dennis Nolte
    May 18, 2015 at 9:52
  • @Dennis i would need two certs or wildcart cert
    – Peter
    May 18, 2015 at 9:59

2 Answers 2

Reset to default
4
+50

Create two virtualhosts, differing only in the port that is used.

Use iptables to conditionally redirect the selected IP to the TLS 1.0 instance.

iptables -t nat -A PREROUTING -s CLIENT_OF_INTEREST -p tcp --dport 443 -j REDIRECT --to-port 344

Although, I must add that doing so would leave me feeling a bit yuck. It would be better, if at all possible, to make the client able to do TLS 1.2.

eg. if its Java, make sure you have the 'unlimited' crypto bits added on.

But I quite understand that this is not always possible.

Improve this answer
5
  • thanks, it looks nice i'll test it. it is yuck but i need to make workaround for old software
    – Peter
    May 19, 2015 at 21:32
  • i am geting ip_tables: REDIRECT target: only valid in nat table, not filter i guess I would have to set it up on my mikrotik
    – Peter
    May 20, 2015 at 8:52
  • Why not have the "stupid" client use a different port?
    – Hagen von Eitzen
    May 21, 2015 at 18:27
  • @peter you need to add -t nat
    – Cameron Kerr
    May 21, 2015 at 18:40
  • And -A PREROUTING, sorry.
    – Cameron Kerr
    May 21, 2015 at 18:41
2

Yes, it's possible, you can set SSLProtocol directive for each virtualhost.

Sample config you posted seems to be OK but you are using default virtualhosts. You must better use IP:Port.

http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocol

https://httpd.apache.org/docs/2.4/mod/core.html#virtualhost

Improve this answer
1
  • I have only one virtualhost... I want to set SSLProtocol for client IP
    – Peter
    May 18, 2015 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.