3 ms·
Terminate the TLS at a load balancer and have the load balancer detect the weak ciphersuite and send the traffic to a separate server? That server can then redi
by eridius 9y ago
Terminate the TLS at a load balancer and have the load balancer detect the weak ciphersuite and send the traffic to a separate server? That server can then redirect to legacybrowser.example.com, or just serve up the content that you would get if you went to that domain.
- sitkack 9y agoI'd like it so if any old cipher suite is negotiated, it is then redirected to `legacybrowser.example.com` so that main traffic would ONLY use high quality cipher suites. One might even limit what the user could do using the insecure connection.
- eridius 9y agoAnd that's what my proposal does. All the traffic that goes to your normal servers comes from clients that used high quality cipher suites, and all the clients that negotiated weak cipher suites end up talking to a separate server entirely.