While it may be good for the interwebs as whole that all current versions make it difficult or even impossible to establish a https connection with a web server that supports only weak encryption suites, the needs of a system administrator may differ. Again and again I find myself in the situation that I need to configure systems (e.g., legacy appliances of all kinds) that I have not touched for years, and which can be configured by web interface, and which require https, but none of my up-to-date browsers is willing to talk to that old-fashioned embedded webserver. Being in my own LAN, I'd be happy to use just http for the moment, but that again is something the appliance rejects. Nowadays, even fiddling with about:config in Firefox, say, seems not to help any more - not to mention the problem that one might accidentally forget to undo such a security change. Not everybody still has an XP box with IE6.0 somewhere in a dusty shelf just for this purpose, so the question is: Is there any method / software / practice / system configuration that is up to date in all respects except that it still allows (possibly with warning) even the most outdated encryptions and cipher suites (and at the same time doesn't make me shoot myself into my feet by being vulnerable in "normal" web access)?

  • 1
    If your legacy applications can't be updated perhaps you can put them behind a reverse proxy that does offer supported encryption methods. – Gene Aug 29 '15 at 16:29

I don't think you will find an up-to-date browser that allows things that are now considered outright security vulnerabilities.

If this is for more of a one-off situation, I think something like an old Portable Firefox version could do the job in an isolated environment like what you describe. (Of course, that browser would be old and unpatched in all ways and shouldn't be used in any environment where it may be exposed to anything unknown!)

You probably wouldn't want to configure your main browser to be allow this sort of thing, even if you could. It would be way too easy to forget to restore proper settings or accidentally using it for something else in parallel while configured for this purpose.

It does sound like the proper solution would be replace the appliance with something that is still maintained and supported.

However, as @Gene suggested in the comments, by isolating the appliance and setting up a reverse proxy in front it may be possible to extend its lifetime in a relatively sane way.
If you're sticking to that appliance, it's probably a good idea to isolate it as much as possible anyway (add authentication in the proxy layer?) as it quite likely has its own set of security vulnerabilities if it is long abandoned by the vendor.

  • Thanks, I'll try that. Even to update or replace the appliance I'd need to access the original thing first, for example to export the configuration – Hagen von Eitzen Aug 29 '15 at 20:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.