For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mcorvalan_57694's avatar
mcorvalan_57694
Icon for Nimbostratus rankNimbostratus
May 27, 2011

best practice for ssl ciphers

Hi All:

 

 

I send this post to ask you that the last week I have a auditory, an they tell me that I have

 

Low Strength Ciphers (< 56-bit key).

And I need to change the weak SSL ciphers.

 

How can I change this option on my LTM 3900?

 

 

Since now thanks alot.

 

 

 

Synopsis

 

The remote service supports the use of weak SSL ciphers.

 

List of Hosts

 

 

 

 

Plugin Output

 

Here is the list of weak SSL ciphers supported by the remote server :

 

 

Low Strength Ciphers (< 56-bit key)

 

SSLv3

 

EXP-EDH-RSA-DES-CBC-SHA Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export

 

EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export

 

TLSv1

 

EXP-EDH-RSA-DES-CBC-SHA Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export

 

EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export

 

 

The fields above are :

 

 

{OpenSSL ciphername}

 

Kx={key exchange}

 

Au={authentication}

 

Enc={symmetric encryption method}

 

Mac={message authentication code}

 

{export flag}

 

 

config
design

4 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    May 27, 2011
    You can customize the allowed ciphers for a VS using this SOL

     

     

    sol7815: Configuring the cipher strength for SSL profiles

     

    http://support.f5.com/kb/en-us/solutions/public/7000/800/sol7815.html

     

     

    And for the management GUI using this:

     

     

    sol6768: Restricting Configuration utility access to SSL clients that are 128 bits or higher

     

    http://support.f5.com/kb/en-us/solutions/public/6000/700/sol6768.html

     

     

    Aaron
  • mcorvalan_57694's avatar
    mcorvalan_57694
    Icon for Nimbostratus rankNimbostratus
    May 27, 2011
    Ok Aaron thanx alot for replying me asap.

     

    I think that the last option that u sent me it's gonna be usefully for me, because the problem that i found .

     

    is the IP 10.100.101.6 it's my managment interface an' not any virtual sever.