What version of TLS would be required for a router that separates client requests from a web server behind a router? Let's say the supported TLS client is 1.2 and so is the web server, BUT the router doesn't support TLS 1.2, it's only 1.0. Will work? As a side note all requests needs to be HTTPS.
Add a comment
|
2 Answers
Routers between the client and the server don't care what version of TLS the client and the server are using. The router simply sees IP packets, and routes them accordingly.
A network-level router doesn't support TLS at all; TLS happens at a much higher level than any protocol that such a router cares about (which is generally IP). The router might have a web-based configuration site, which is served by a webserver which might support TLS of some version or other, but that's completely unrelated to the router's handling of the packets that it's routing; it neither knows nor cares whether they are using TLS of any version.
However, there are some scenarios where TLS support in a "router" matters. One of them is if by "router" you mean software that routes incoming requests to an appropriate server. Such a router will definitely need to know enough to decode TLS client hello messages (which doesn't require supporting the full protocol but does require some understanding of it), and likely will terminate the TLS connection itself (e.g. to direct a given user always to a given node), which will absolutely limit the connection to whatever version of TLS this "router" supports. Fortunately, in that situation, the "router" should just be software that can be easily upgraded to support a version of TLS from the last 15 years.
Another scenario is if the "router" is hardware that performs some analysis of the connection. Even if it isn't terminating the connection, it might decode the metadata for purposes such as tracking metrics or routing requests to appropriate servers. In that case, full support for a protocol isn't needed, but you do sometimes run into issues if the hardware was not designed to handle your traffic. For example, some old F5 hardware would fail to handle very large SSL/TLS handshake data (and more recently, they had a similar problem in software). That isn't technically a protocol issue, it's just that handshakes have been growing over time - people used to use simpler certificates, with shorter keys and signatures, or listed fewer cipher suites, etc. - and so as those sizes grew over time, problems began manifesting.
