For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Feb 07, 2017

Hi aalkhuja,

 

as Nathan has pointed out you have to a.) either remove every non PFS enabled algorythms or b.) you have to prioritise the PFS enabled algorythms in your Client-SSL-Profile chipher suite.

 

You may check out a posting of mine to build a solid chipher suite string to achive a good compatibility (legacy algorythms for Windows XP / IE8 are still supported) while prefering PFS enabled algorythms for the PFS enabled browsers.

 

HowTo: Getting an awesome Qualys SSL-Labs rating (Feb 2017 Update)

 

https://devcentral.f5.com/questions/howto-getting-an-awesome-qualys-ssl-labs-rating-feb-2017-update-51489

 

Cheers, Kai