3 ms·
And here's the technical detail of how we do it: https://blog.cloudflare.com/tls-certificate-optimization-technical-details/ https://blog.cloudflare.com/tls-cer
by prdonahue 10y ago
And here's the technical detail of how we do it: https://blog.cloudflare.com/tls-certificate-optimization-technical-details/ https://blog.cloudflare.com/tls-certificate-optimization-tec....
- Negitivefrags 10y agoIs there actually an open source implementation of this though? I've looked, but never found one, though that was quite some time ago. Perhaps things have changed. This approach is beyond the ability of most to implement for themselves if they don't have support from their webserver for it.
- jvehent 10y agoYou can do it with HAProxy by checking for SNI and falling back to a SHA1 cert when the extension is absent. https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SHA1/SHA256-certificate-switching-with-HAProxy https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SH...
- agwa 10y agoA recent combination of Apache and OpenSSL has support for certificate switching based on key algorithm. You can serve an ECDSA+SHA2 certificate to clients that support ECDSA, and an RSA+SHA1 certificate to clients that don't. I'm pretty sure that all clients that reject SHA1 support ECDSA, so this should work.