Forum Discussion

mahjoub's avatar
mahjoub
Icon for Cirrus rankCirrus
Oct 24, 2022

Enabling TLS version

Hi,

I have one request which need your assitance, the request is that, we have some applications which can't modify the TLS version to 1.2 or 1.3, these applications need to be published, so I want to know is it possible ot enable TLS1.2 from F5 to Internet and from F5 to backend server enable 1.0 or 1.1 or keep in default in server side, please your advice the posibility and how perform this if possible.

Thanks in advance.

 

 

  • Most definitely. BIG-IP is a full proxy, so you can control the cipher properties on each side of the proxy independently.

    • mahjoub's avatar
      mahjoub
      Icon for Cirrus rankCirrus

      Hi Kevin,

      Thanks for your reply, would you guide me how to perform this.

      Thanks in advance.

      • Kevin_Stewart's avatar
        Kevin_Stewart
        Icon for Employee rankEmployee

        Configure a client SSL profile that supports TLS 1.2 and 1.3, and a separate server SSL profile that supports TLS 1.1 and 1.0.

        I the full proxy architecture, the client SSL profile works on the client side of the proxy and acts as the server to the TLS session. The client sends a Client Hello message and list of supported ciphers, and the server (BIG-IP) picks one of the ciphers to continue the TLS handshake. The server SSL profile works on the server side of the proxy and acts as the client to the TLS session. It sends a Client Hello to the server with its list of supported ciphers. This list comes from the cipher string defined in the server SSL profile.