TLS unique value is present in TLS 1.2 version.
In Golang, I can get the value of the TLS unique value from the http response through the field TLS.

I'd like know how I can get it from Apache.
Is there an environment variable that already exposes it?
Should I change the apache configuration?

I have secured my EST enroll endpoint with basic auth

<Location "/.well-known/est/simpleenroll">
AuthType Basic
AuthName "estrealm"
AuthUserFile /etc/openxpki/a2sec/.htpasswd
require valid-user


The username from the incoming http request in exposed through the Apache environment variable REMOTE_USER for instance, and I would like to get the TLS unique value as well.

  • If I may ask, what would be the purpose of it? Channel bindings? Something else?
    – grawity
    Dec 7, 2023 at 10:21
  • It's more of a recommendation from the rfc 7030. In short, it's a way for the EST server to make sure that the CSR, which includes that TLS binding channel (TLS unique value), comes from the same client with whom the TLS connection has been established with.
    – MoBe
    Dec 7, 2023 at 13:39
  • Related: security.stackexchange.com/questions/273384/…
    – mti2935
    Dec 7, 2023 at 18:15
  • Apache mod_ssl provides environment variables for accessing some of the high-level information about the TLS session, such as the TLS version, ciphersuites, certificate info, etc. However, these variables do not include the gritty details of the TLS session, such as the pre-master secret, tls-unique, etc. See security.stackexchange.com/questions/215358/… for an interesting read on how some of those can be accessed.
    – mti2935
    Dec 7, 2023 at 18:54


You must log in to answer this question.

Browse other questions tagged .