TLS 1.3 to 1.2 downgrading in a proxy

user_5763136 0
Viewed 1330

I'm trying to set up a HTTPS proxy that would allow to downgrade TLS 1.3 to TLS 1.2.

My actual problem is :

  • old browser + OS, only supports TLS 1.2, can't upgrade...
  • new web server added in the system, only manages TLS 1.3, can't touch it either...
  • I can install software on a middlebox that is connected on both components.

I need the browser to be able to connect to the webserver, through the middlebox.

I'm thinking HAProxy, but I'm really a noob here, and I'm not sure where to check for this capability and how one would achieve this.

How should I set up HAProxy ?

Thanks in advance for your help.

tls1.3 tls1.2 haproxy
1 Answers

If i understand correctly. Browser connects to haproxy using TLSv1.2 and haproxy connects to server using TLSv1.3.
So here is how it may work:

globals
  ssl-default-bind-ciphers <list of TLS1.2 ciphers>
  ssl-default-bind-options ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.2
  ssl-default-server-ciphersuites <list of TLS1.3 ciphersuites>
  ssl-default-server-options ssl-min-ver TLSv1.3

defaults
  mode http

frontend foo
  bind *:443 ssl crt /path/to/cert.pem
  default_backend bar

backend bar
  server yourservername 192.168.1.1:443 ssl

You will need haproxy built with OpenSSL 1.1.1 or later for TLSv1.3.
I put ssl-min-ver TLSv1.2 for bind, because lower versions are deprecated. ssl-max-ver TLSv1.2 in ssl-default-bind-options will limit TLS up to 1.2 for all frontends, unless otherwise declared and ssl-min-ver TLSv1.3 in ssl-default-server-options will force all connections to backend servers use TLSv1.3, unless otherwise declared in configuration. Those defaults are to save typing, when you have more servers. Those options can be declared seperately on every bind and every server config line.

user_144615310
Related