Forum Discussion
BIG-IP SSL vulnerability CVE-2017-6168
All of the major desktop and mobile browsers have supported DHE and/or ECDHE Key Exchange for a number of years, as alternatives to RSA Kx. The most notable user agents that do not are IE6 (anywhere) and IE8 on XP (IE8 on newer versions of Windows is OK). https://www.ssllabs.com/ssltest/clients.html is a list of UAs - you're interested in the 'Forward Secrecy' column - that's DHE/ECDHE.
For most sites disabling RSA Kx (which is what !RSA does) should not be an issue. As the SA advises, it will mainly be an issue for any site that still, for whatever cursed reason, needs to support ancient clients like IE6. Or sites that might be used by specialized clients which, for whatever reason, only support RSA - maybe an old embedded client in a set-top box, etc.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com