I have a scenario where a secure website with an A ssllabs overall rating is getting some warnings due to a lack of support for non-SNI browsers.
- Android 2.3.7 Incorrect certificate because this client doesn't support SNI
- IE 6 / XP Server closed connection
- IE 8 / XP Incorrect certificate because this client doesn't support SNI
- Java 6u45 Client does not support DH parameters > 1024 bits
I got the idea (maybe not the best one) of allowing those browsers to reach the website by sending the requests to a secondary insecure (non-https) backend using the http user agent information.
I understand that allowing those clients to reach the website would be a security breach, but at least They'll be able to see the website.
So, my question is about a security conception, what is worse/better? Allowing those clients to reach the website even if it means a security issue, or to deprecate support for those browsers?