F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

SanYang's avatar
SanYang
Icon for Cirrostratus rankCirrostratus
May 07, 2025

About Cipher Suites

Hello experts,   We've been doing SSL LAB scans lately. We found that with the same certificate and the same client ssl profile settings, the scanning results are not the same. The strange th...
application delivery
Tofunmi's avatar
Tofunmi
Icon for MVP rankMVP
May 12, 2025

Are you doing SSL offloading on that VIP? If your VIP is not doing full SSL offload (e.g., SSL Passthrough or using a transparent profile), the curve seen could be coming from the backend server, not F5. 

openssl s_client -connect <IP>:443 -curves secp521r1


If the VIP is truly terminating SSL and does not support secp521r1, the handshake should fail. If the backend server supports it, the same test against it directly will succeed. This should help isolate whether the F5 or the backend is advertising support for that curve.