Subject: Re: ensure 128 bit encryption

From: [email-masked]
Date: Fri, 18 Jan 2002 17:49:46 +0100 (MET)

with this option, the user gets no https connection if he has < 128 bit. but
the user should get a error page. so it must be possible to establish a
connection with <128 bit but redirected to the error page.

> Use the following in either <Directory> OR <Location> configuration 
> directives,
>     SSLRequireSSL
>     SSLRequire ( %{SSL_CIPHER_USEKEYSIZE} >= 128 )
> Thanks,
> Rajidhar Etta
> ----- Original Message -----
> From: Christian Hekerens <[email-masked]>
> Date: Friday, January 18, 2002 3:50 am
> Subject: ensure 128 bit encryption
> 
> > hi!
> > 
> > i want do ensure that all users have at least 128 bit encryption 
> > on all
> > of
> > my sites. this is necessary because of the users can bookmark a 
> > page. so
> > i
> > have no entry page with an cgi-script where i can read the
> > HTTPS_SECRETKEYSIZE
> > environment variable. i tried it with mod_rewrite, but there i also
> > can't
> > access HTTPS_SECRETKEYSIZE.
> > i can't turn off weak ciphers, because then no connection is possible.
> > what i
> > want is, that users with i.e. 56 bit encryption (browser) are 
> > forwardedto
> > an error page (can be unsecure).
> > 
> > i hope anyone can help me, thanx
> > 
> > chris
> > ______________________________________________________________________
> > Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> > User Support Mailing List                      [email-masked]
> > Automated List Manager                            [email-masked]
> > 
> 

-- 
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net

---

From: Thomas Binder <[email-masked]>
Date: Mon, 21 Jan 2002 18:49:18 +0100

Hi!

On Fri, Jan 18, 2002 at 05:49:46PM +0100, [email-masked] wrote:
> with this option, the user gets no https connection if he has <
> 128 bit. but the user should get a error page. so it must be
> possible to establish a connection with <128 bit but redirected
> to the error page.

Try the following (inside <directory>...</directory):

SSLOptions +StdEnvVars
RewriteBase absolute-filesystem-path-to-directory
RewriteCond %{ENV:SSL_CIPHER_EXPORT} "^true$"
RewriteRule ".*" /noexport.html

Now, when someone accesses your directory with an export browser,
(s)he will be redirected to the page /noexport.html, which may
then explain what's wrong.

Directly checking the key size is a bit tricky, as RewriteCond
only offers lexical comparison, but you'd need numerical for that
purpose, as for example 56 is lexically greater than 128, thus
>127 won't work as expected. Maybe someone else knows an elegant
solution.

Ciao

Thomas

-- 
I should have been a country-western singer.  After all, I'm older than
most western countries.
		-- George Burns

---

From: Thomas Binder <[email-masked]>
Date: Mon, 21 Jan 2002 19:01:01 +0100

Hi!

> RewriteRule ".*" /noexport.html

An addition: You also need

RewriteEngine On

Ciao

Thomas

-- 
It is far more impressive when others discover your good qualities without
your help.
		-- Miss Manners

---

From: [email-masked]
Date: Mon, 28 Jan 2002 10:00:20 +0100 (MET)

> then explain what's wrong.

nice try, but we have another problem. we use a global certificate, so
export browsers have! 128 bit. only very old browsers use <128 bit. so this also
doesn't work.

---

From: Thomas Binder <[email-masked]>
Date: Wed, 30 Jan 2002 11:45:18 +0100

Hi!

On Mon, Jan 28, 2002 at 10:00:20AM +0100, [email-masked] wrote:
> nice try, but we have another problem. we use a global
> certificate, so export browsers have! 128 bit. only very old
> browsers use <128 bit. so this also doesn't work.

Sorry, I don't get your point. SSL_CIPHER_EXPORT is only set when
a client connects using a crippled cipher. An export browser
accessing a global site certificate will of course not cause
SSL_CIPHER_EXPORT to be set.

If you mean something else, please explain in more detail.

Ciao

Thomas

-- 
If you don't drink it, someone else will.

---

From: Eckard Wille <[email-masked]>
Date: Fri, 10 Mar 2006 18:25:11 +0100

> then explain what's wrong.

Hi all,

just wanted to set up the described configuration with Apache 2.0.54
and OpenSSL 0.9.7.g, but stumbled over the environment changes which
did not jump in my face while reading the docs. Seems like the SSL
environment isn't reachable for mod_rewrite via ENV: or LA-U: prefix,
instead the prefix SSL: has to be used, described in the change report
> http://mail-archives.apache.org/mod_mbox/httpd-bugs/200408.mbox/[email-masked]%3E
Maybe Ralf could add this SSL:-prefix regarding mod_rewrite to his
excellent docs somewhere around the environment references, because
most of the existing howtos on the net do not include that new syntax.
The following lines in the global ssl environment did the trick
for our ssl hosts:

SSLOptions +StdEnvVars
RewriteEngine on
RewriteCond %{SSL:SSL_CIPHER_USEKEYSIZE} <128
RewriteCond %{REQUEST_URI} !^/error/.*$
RewriteRule .* /error/weak_encryption.html [R,L]

Greetings from Germany,
Eckard