Force httpd 2.0 mod_ssl to use TLSv1 for proxied handshakes

Question

I have an instance of httpd (version 2.0) that uses mod_proxy to transform incoming http requests to https. My problem is that I need my proxy to connect to a server that only supports SSLv3/TLSv1 Client Hello handshaking.

As a test, I've tried forcing TLSv1 on every option I can find:

SSLProxyEngine On
SSLProxyProtocol TLSv1
SSLProxyCipherSuite TLSv1

But I can see that httpd is still attempting an SSLv2 handshake. I realize this was the old intended behavior for backwards compatibility for some clients, but as far as I can tell this should have forced a newer handshake. Is this intended behavior? Is this maybe a bug in my old modules?

score 0 · Answer 1 · answered Jan 15 '15 at 18:16

Found the answer by looking through the httpd source-- httpd version 2.0 will not use SSLv3/TLSv1 handshaking for any connections because it only uses SSLv2_client_method() or SSLv23_client_method() for creating its SSL context.

From ssl_engine_init.c:

if (protocol == SSL_PROTOCOL_SSLV2) {
    method = mctx->pkp ?
       SSLv2_client_method() : /* proxy */
        SSLv2_server_method();  /* server */
    ctx = SSL_CTX_new(method);  /* only SSLv2 is left */
}
else {
    method = mctx->pkp ?
        SSLv23_client_method() : /* proxy */
        SSLv23_server_method();  /* server */
    ctx = SSL_CTX_new(method); /* be more flexible */
}

Per the SSL documentation, a server context created with TLSv1_server_method() will not understand SSLv2* methods. Confirmed that later versions of httpd/mod_ssl work as expected and try SSLv3/TLSv1 first.

Don't use old versions!

Force httpd 2.0 mod_ssl to use TLSv1 for proxied handshakes

1 Answers1