When working with the PKIoverheid in The Netherlands to digitally communicate with the Dutch government over the internet, one has to implement WS-Security message signing as well as two-way SSL message encrypting.

It is common practice that the back-end systems (such as an Oracle Service Bus for example) are not directly connected to the internet. Often there is some gateway in front that acts as a reverse proxy, load balancer and/or SSL offloader. Within the “WebLogic-world” the Apache HTTP server is often used together with the mod_wl plugin for load balancing. This is, naturally, also a good place to also do the SSL offloading, and handle the two-way SSL transport.

Since August, the Dutch government requires SHA256 certificates, which is part of the TLS v1.2 implementation. This TLS standard is unfortunately still not fully supported everywhere. When using Apache for example, the de-facto standard for SSL is mod_ssl (based on OpenSSL). However, there is still not full support for TLS v1.2 in the latest stable release (v1.0.1) of OpenSSL at the time of writing.

A quick workaround is to switch to GnuTLS and the mod_gnutls Apache module. It works in a similar way as mod_ssl, and has full TLS v1.2 support.