ECDSA certificates - do not seeem to be presented

Question

Hello,&nbsp;We have recntly got a first ECDSA certificate. When I tried to configure the SSL profile it did not let me because at least one RSA certificate must be included. We do not have one for this url so I picked the self signed one hoping that would be just a fallback for really old browsers. But when checking the URL with the browsers (Chrome and Firerefox - up to date) I only get presented the second - RSA - certificate. I am sure this is not a limitation on the Browser side, so I am wondering if the F5 bigip maybe does not present it. The question is why? I was thinking that maybe the cipher suites that go along in the SSL profile are not all compatible with the ECDSA certificate, but there are several that should be. The documentation (https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-administration-13-0-0/8.html) does not secify anything else (I am actually running 12 but should not make a big difference. Any ideas?&nbsp;RegardsCarol

grumpy_cat · Accepted Answer

Hi Carol,&nbsp;I suspect this is to do with your cipher group/string though we haven't been using these key exchanges yet. The article you provided states use 'ECDHE' but this will include all suites using RSA key exchange. For example:# tmm --clientciphers 'ECDHE'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ID&nbsp;SUITE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BITS PROT&nbsp;&nbsp;CIPHER&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MAC&nbsp;&nbsp;&nbsp;KEYX&nbsp;0: 49199&nbsp;ECDHE-RSA-AES128-GCM-SHA256&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;ECDHE_RSA&nbsp;&nbsp;1: 49171&nbsp;ECDHE-RSA-AES128-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1&nbsp;&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;&nbsp;2: 49171&nbsp;ECDHE-RSA-AES128-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;&nbsp;3: 49171&nbsp;ECDHE-RSA-AES128-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;&nbsp;4: 49171&nbsp;ECDHE-RSA-AES128-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;DTLS1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;&nbsp;5: 49191&nbsp;ECDHE-RSA-AES128-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;ECDHE_RSA&nbsp;&nbsp;6: 49200&nbsp;ECDHE-RSA-AES256-GCM-SHA384&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA384&nbsp;ECDHE_RSA&nbsp;&nbsp;7: 49172&nbsp;ECDHE-RSA-AES256-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1&nbsp;&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;&nbsp;8: 49172&nbsp;ECDHE-RSA-AES256-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;&nbsp;9: 49172&nbsp;ECDHE-RSA-AES256-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;10: 49172&nbsp;ECDHE-RSA-AES256-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;DTLS1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;11: 49192&nbsp;ECDHE-RSA-AES256-SHA384&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA384&nbsp;ECDHE_RSA&nbsp;12: 52392&nbsp;ECDHE-RSA-CHACHA20-POLY1305-SHA256&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;CHACHA20-POLY1305&nbsp;&nbsp;NULL&nbsp;&nbsp;ECDHE_RSA&nbsp;13: 49170&nbsp;ECDHE-RSA-DES-CBC3-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;168&nbsp;TLS1&nbsp;&nbsp;DES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;14: 49170&nbsp;ECDHE-RSA-DES-CBC3-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;168&nbsp;TLS1.1&nbsp;DES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;15: 49170&nbsp;ECDHE-RSA-DES-CBC3-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;168&nbsp;TLS1.2&nbsp;DES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;&nbsp;You'll need to specify 'ECDHE_ECDSA' to only offer ECDSA key exchange cipher suites. Hopefully that'll do the job.&nbsp;Kind regardsBen

Forum Discussion

ECDSA certificates - do not seeem to be presented

Recent Discussions

AS3 Limitations

Help needed with iRule (connection closed log )

Use of SSL Decryption.

VLAN Failsafe Functionality

FTP PASV mode to Extended Passive mode

Related Content

Automating ACMEv2 Certificate Management on BIG-IP

Help F5 Transform the BIG-IP Administrator Certification

Re: Management Certificate

Automate Let's Encrypt Certificates on BIG-IP

F5 SLEDFest 2022 Tallahassee Edition - Infrastructure Modernization presentation

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS