TLS 1.2 workaround for legacy component

Question

I've got a Windows application out in the wild that uses a very old component to contact an authentication server over HTTPS:

http.QuickGetStr("https://www.myserver.com/validate?license=myserial)

This returns an array with the authentication data.

I need to update Apache to TLS 1.2 as the same server is used for the e-commerce side of things and browsers are now showing "insecure" for servers not running TLS 1.2+

The problem is that the component used in the application that communicates with the authentication server doesn't support TLS 1.2, so when the server is updated to TLS 1.2, all of the exiting users can no longer log in as the component fails and doesn't return any authentication data. I can and will certainly update the application with a more modern component, but that won't help legacy users who don't update.

I need to figure out a way to switch the authentication server over to TLS 1.2 without shutting off access to the existing users who will start up the application and be unable to authenticate. One idea is to use a new authentication URL in new updates and somehow redirect the authentication requests via .htacess and send TLS 1.0 requests one way and TLS 1.2 requests another. Would that work?

wp78de wp78de · Accepted Answer · 2020-05-26T23:43:22

You should be able to solve this using a RewriteCond. ModRewrite needs to be enabled

NameVirtualHost *:443
SSLStrictSNIVHostCheck on

<VirtualHost *:443>
  DocumentRoot /var/www/html
  ServerName my.domain.com

  SSLProtocol TLSv1 TLSv1.2

  RewriteEngine On
  RewriteCond %{SSL:SSL_PROTOCOL} ^TLSv1$
  RewriteCond %{REQUEST_URI} !^/validate$
  RewriteRule .* "-" [F]

  <Directory "/var/www/html">
    Order Deny,Allow
    Allow from all
  </Directory>
</VirtualHost>

TLS 1.2 workaround for legacy component

1 Answers