Forum Discussion

Edouard's avatar
Edouard
Icon for Cirrus rankCirrus
Nov 03, 2022

Client SSL profile fall back

Hi Guys,

We have some clients that use TLS1.0 whereas others use TLS1.2.

Could clientssl_tls1  profile be used for clients that use TLS1.0 and clientssl_tls1.2 be used for clients that work with TLS1.2.

All clients use the same server name (SNI) and clientssl_tls1 & clientssl_tls1.2 profiles are within the same VS.

Please advise.

Edouard.

application delivery
cloud
devops
security
  • Mayur_Sutare's avatar
    Mayur_Sutare
    Icon for MVP rankMVP
    Nov 03, 2022

    Hi Edouard ,

    So basically, you need your vServer to accept requests on both TLS1.0 as well as TLS1.2 if I understood it correctly.

    If that's so, then you can keep TLS1.0 as well as TLS1.2 enabled under associated client ssl profile. So single client-ssl profile will accept both requests and it will negotiate client on best possible match.

    Additionally, if it is possible, try to keep all your vServers running on min TLS1.2 as lower SSL/TLS versions are prone to different vulnerabilties. You may be already knowing this but just thought of highlighting this also. Ty!

     

    Hope it helps!

    Mayur