2

In the light of POODLE we have an urgent requirement to turn off SSL2/3 and TLS 1.0 on our public-facing webservers. However we're a public sector body and around 5-10% of visits to our sites are made using machines running Windows XP and lower browsers and our users are not the most tech-savvy and will start flooding our helplines if they try to visit a site they use regularly only to find it is 'down'.

What we'd like to do is show a message to users of older browsers informing them that SSL2/3 is no more and advising them to upgrade OS/ browser in order to keep using your sites. However it would appear that to detect SSL2/3 we have to have SSL2/3 enabled on our servers ...

Is there some other secure way of detecting requests over SSL2/3 and reacting accordingly?

Improve this question
3
  • 1
    Only XP machines below SP3 don't support TLS 1.0. You can leave TLS 1.0 enabled and be POODLE free
    – Drifter104
    Mar 23, 2016 at 17:49
  • 3
    Your organization hasn't given this very much urgency, since it's been nearly a year and a half! Anyway, even with 5-10% of visitors using XP, it's likely only a tiny minority of those who aren't sufficiently up to date to use TLS 1.0, or aren't using a browser other than IE. This group has already run into this issue on other sites, after all, and has had plenty of reason to adapt. And things will be worse for them in a few months when online shopping sites begin dropping TLS 1.0 support.
    – Michael Hampton
    Mar 23, 2016 at 18:35
  • 1
    Just to be clear RFC 7525 states that "Implementations MUST NOT negotiate SSL version 2 [or 3]." So any solution that tries to detect is in violation of industry best practices. TLS 1.0 is next to go as @MichaelHampton states above. Salesforce and others are disabling it. It's time to move on.
    – HTTP500
    Mar 24, 2016 at 21:28

2 Answers 2

Reset to default
3

About the only thing I can think of is having a proxy in front of the site that still supports the old standards, and have that redirect the user to a different site if it detects SSL2 or 3 connections (or an unsupported browser string?)

Of course, to do this, you'll need a proxy that can talk the old protocols to older browsers securely without potentially compromising the connections from more secure endpoints. This isn't going to be easy; you'll need to keep the proxy itself patched and secure and part of being able to guarantee that is the case will be disabling insecure protocols such as SSL2 or 3, and of course a PCI audit against your site will go through this proxy and give unhelpful results, if this is an issue for you. Good luck with all of that.

On reflection since my earlier dash at answering this, you may just need to accept that its time to cut your losses. Aside from anything else, I can't help but imagine that anyone who hasn't upgraded from IE6 yet is either not going to, or is part of a corporate network and can't.

Improve this answer
3

SSL handshaking occurs before any application-level communication, so if you want to prohibit 2/3 then browsers are going to get a very ugly message.

On the other hand, you can enable 2/3 and have your application detect the low version and return the user a specific error message. Unfortunately at this point they've already sent you whatever session cookies etc they have over the old SSL version, potentially exposing them. The only way to prevent the user from transmitting this data is to block the old SSL versions during the handshake and live with the ungraceful user experience.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .