Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I have my application on an apache webserver with no HTTPS configuration.
However you can reach it only by passing from another webserver with https configured, I have no control on this webserver.
The access server, anyway, supports TLSv1.0 as min TLS version and also defines some weak cyphers such as DES3.
Would it be possible to restrict, only for my server, the TLS version to 1.1+ (which is offered by the access server) and to exclude DES3 from accepted cyphers?
If I understand you correctly you have a reverse proxy ("another webserver") which has HTTPS enabled and which forwards the request as HTTP to your server. You have no control over this reverse proxy but want to make sure that any requests which reach your server used originally TLS 1.1+ and not 3DES.
Given that you have no control of the reverse proxy you have also no control which TLS version and ciphers are used with the connection. But if the reverse proxy provides you with the information which TLS version and ciphers were used (mostly not done, but if it is done then inside some non-standard HTTP header) then you could check in your application if this matches your restrictions and otherwise reject the request.
