2

TLS unique value is present in TLS 1.2 version.
In Golang, I can get the value of the TLS unique value from the http response through the field TLS.

I'd like know how I can get it from Apache.
Is there an environment variable that already exposes it?
Should I change the apache configuration?

I have secured my EST enroll endpoint with basic auth

<Location "/.well-known/est/simpleenroll">
AuthType Basic
AuthName "estrealm"
AuthUserFile /etc/openxpki/a2sec/.htpasswd
require valid-user

</Location>

The username from the incoming http request in exposed through the Apache environment variable REMOTE_USER for instance, and I would like to get the TLS unique value as well.

MoBe
  • 21
  • 4
  • If I may ask, what would be the purpose of it? Channel bindings? Something else? – grawity Dec 07 '23 at 10:21
  • It's more of a recommendation from the rfc 7030. In short, it's a way for the EST server to make sure that the CSR, which includes that TLS binding channel (TLS unique value), comes from the same client with whom the TLS connection has been established with. – MoBe Dec 07 '23 at 13:39
  • Related: https://security.stackexchange.com/questions/273384/how-to-include-tls-unique-value-in-csr – mti2935 Dec 07 '23 at 18:15
  • Apache mod_ssl provides environment variables for accessing some of the high-level information about the TLS session, such as the TLS version, ciphersuites, certificate info, etc. However, these variables do not include the gritty details of the TLS session, such as the pre-master secret, tls-unique, etc. See https://security.stackexchange.com/questions/215358/extracting-openssl-pre-master-secret-from-apache2 for an interesting read on how some of those can be accessed. – mti2935 Dec 07 '23 at 18:54

0 Answers0