Retrieving Browser SSL Info in PHP

From: Date: Tue, 09 Mar 2004 03:29:51 +0000
Subject: Retrieving Browser SSL Info in PHP
Groups: php.general 
Request: Send a blank email to php-general+get-179863@lists.php.net to get a copy of this message
Hello, My problem is this: I wish to have extremely highly secure sessions. I have instituted full SSL, tuned apache, and set the web server security such that there is very low possiblity of internal session hijacking. However, I am concerned about the session fixation problem (as well as a direct attack on the client box yielding the cookie contents), and would like to take into consideration a user's browser SSL certificate as a fairly reliable session-duration indicator that I am talking to the proper client throughout the session. However I cannot find any environment variable or server variable that suggests what the CLIENT's SSL information might be, only what my server's certificates say. This is a fairly common recommendation on the 'net, and I must be a dunce but I cannot find out how to retrieve this information in PHP. Could someone kindly point me in the direction of the right variable here? Thanks!

« previous php.general (#179863) next »