In one article I read that Openssl 1.0.2 allows you to select the certificate, depending on client configuration. For example Windows XP early SP2 does not support ECC certificate. for this server will return one certificate and other certificate for modern OS.

I can`t find a description of the this technology. Does any web server support it?

  • Are you referring to Server Name Indication? – Michael Hampton Sep 30 '15 at 7:07
  • No. Choose server certificate based on client supported chipers – Dmitry Gorozhanin Sep 30 '15 at 7:21
  • Perhaps it would help if you told us exactly what you were reading. – Michael Hampton Sep 30 '15 at 7:22
  • Of course, but the article in Russian habrahabr.ru/company/yandex/blog/249771 – Dmitry Gorozhanin Sep 30 '15 at 7:25
  • 1
    I think you are talking about: К сожалению, Windows XP < SP3 и некоторые другие браузеры, доля которых среди клиентов больших сайтов отлична от нуля, не поддерживают ECC сертификатов. Решением может стать использование разных сертификатов для разных клиентов, что позволит экономить ресурсы за счет более новых клиентов, которых большинство. Openssl версии 1.0.2 позволяет выбрать сертификат сервера в зависимости от параметров клиента. К сожалению, пока Nginx «из коробки» не позволяет использовать несколько сертификатов для одного сервера. The article does not give a solution that I can find. – Michael Hampton Sep 30 '15 at 7:31

You're referring to this bit in the linked article (here, translated to English):

OpenSSL version 1.0.2 allows you to select the server certificate based on the parameters of the client. Unfortunately Nginx out of the box does not allow the use of multiple certificates for a single server.

This appears to be referring to the following OpenSSL feature, added in 1.0.2:

*) Add certificate callback. If set this is called whenever a certificate is required by client or server. An application can decide which certificate chain to present based on arbitrary criteria: for example supported signature algorithms. Add very simple example to s_server. This fixes many of the problems and restrictions of the existing client certificate callback: for example you can now clear an existing certificate and specify the whole chain. [Steve Henson]

So far I can find no evidence that nginx supports this functionality, nor of any unofficial patches. Nor, from a quick look, did I find anything relevant for Apache or any other web server. I am sure it will be added eventually, but if you really need this soon, I would suggest asking on the nginx mailing list.

  • Thanks. This feaute is very helpful to me. It allow to use https with gost chipers for clients that support it. – Dmitry Gorozhanin Sep 30 '15 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.