Forum Discussion
Daniel_Varela
Employee
EmployeeECDSA only clientssl profiles
Hi,
Does someone know if it is planned to support clientssl profiles with only ECDSA keys? I think is not useful to require RSA keys as pretty much any modern browser support these type o keys (they actually are at top of the cipher list)
Cheers
Hannes_RappNimbostratus
Check this with product developers. You have the privilege to sit on the table of one of your comrades and harass them directly. You can also go the official route and open a RFE but that won't be nearly as effective :)
Hopefully there will be an option in BigIP 14. But I'm afraid that for a while, things will get more complex. As RSA is being phased out but not completely dead, a backup option is just as important. A dual-setup would make sense - link to ECDSA private key as recommended default, and RSA private key as optional backup for legacy clients.
- Kevin_Stewart
If I recall, there's an actual mechanical reason why the F5 minimally requires an RSA cert/key, but I don't remember the details.
In any case, it's reasonably straightforward to work around this:
- Define your EC cert/key in the client SSL profile
- Also define a generic RSA cert/key (the built-in Default will do)
- Modify the Ciphers list so that only ECDHE_ECDSA is allowed (ex. ECDHE_ECDSA)
The F5 will choose the server certificate to present based on the handshake algorithm selected, so in this case you must force it to use ECDSA. And since you're only allowing ECDSA based on the cipher string, only the EC cert/key will ever be used (and any client that doesn't support ECDSA will naturally fail).
