Forum Discussion

L__G_'s avatar
L__G_
Icon for Altostratus rankAltostratus
Mar 31, 2022
Solved

Display a warning on client browser when cipher suite mismatch

Hello,

We have a ssl profile with a very limited ciphers suite (TLS1.2, TLS1.3 and other limitations).

Is it possible to display a warning message on a browser when there is no match between browser cipher suite and our VS SSL profile cipher suite (via irule, policy, ...) ?

For example when client uses TLS 1.0, we want its browser to display a "please update your browser" or a "your cipher is not permited on our site" message.

Thank you for your help

cipher mismatch
event
ssl
warning message
  • Dario_Garrido's avatar
    Dario_Garrido
    Apr 01, 2022

    Hello L__G_

    When you use an HTTPS scheme in your browser, you are asking the browser to perform a TLS handshake before sending any HTTP traffic. If both ciphers don't match, you will receive a TLS Alert during the TLS handshake and the connection will be interrupted.

    To respond with a specific message, you should send somehow an HTTP traffic response without encryption, but you cannot respond with an HTTP packet because:
    1. Your TLS handshake was finished abruptly
    2. In HTTP, you only respond to queries that were initiated by the client, and you didn't send any query to the server because the TLS was interrupted.

    So, this is technically restricted by the protocol.

     

5 Replies

Sort By
  • MaximP's avatar
    MaximP
    Icon for Cirrus rankCirrus
    Apr 01, 2022
    L__G_, hello.

    There is an option. You can create less strong SSL profile, that supports, let's say, TLSv1, but response with a sorry page for users who use TLSv1. In that case you have to allow unwanted chiper suites, but you don't process this unsecure traffic to an application.

    Example Irule below

     

     

     

    when CLIENTSSL_HANDSHAKE {
    if { ( [SSL::cipher version] equals "TLSv1" ) } {
        set Invalid_SSL 1
    } else {
        set Invalid_SSL 0
    }
}
when HTTP_REQUEST {
  if { $Invalid_SSL == 1 } {
    HTTP::respond 200 content "<html><head><title>HTTP Request denied</title></head><body>Please update your browser</body></html>"  
    return
  }
}

     

     

     

      

    • L__G_'s avatar
      L__G_
      Icon for Altostratus rankAltostratus
      Apr 04, 2022

      Hello MaximP,

      Thank you for your reply.

      Unfortunatly, our Security Manager wants our profile to be TLSv1.2 or TLS 1.3.

      It seems there is no solutions except a browser error.

      Thank you again for your help.

  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for MVP rankMVP
    Apr 01, 2022

    Hello L__G_

    When you use an HTTPS scheme in your browser, you are asking the browser to perform a TLS handshake before sending any HTTP traffic. If both ciphers don't match, you will receive a TLS Alert during the TLS handshake and the connection will be interrupted.

    To respond with a specific message, you should send somehow an HTTP traffic response without encryption, but you cannot respond with an HTTP packet because:
    1. Your TLS handshake was finished abruptly
    2. In HTTP, you only respond to queries that were initiated by the client, and you didn't send any query to the server because the TLS was interrupted.

    So, this is technically restricted by the protocol.

     

    • L__G_'s avatar
      L__G_
      Icon for Altostratus rankAltostratus
      Apr 04, 2022

      Hello Diaro_Garrido.

      After my readings, I didn't have high hopes on this point. Thank you for your help.