Forum Discussion

Alin_Olar_24603's avatar
Alin_Olar_24603
Icon for Nimbostratus rankNimbostratus
Feb 13, 2017

Exact syntax for SSL ciphers

Hi,   Trying to help a coworker with an SSL Client profile request with custom ciphers. So far I have been able to see the ciphers supported on F5 but not the exact syntax when you configure them....
cipher
ciphersuites
LTM
security
IainThomson85_1's avatar
IainThomson85_1
Icon for Cumulonimbus rankCumulonimbus
Feb 13, 2017

The best thing to do - is view the ciphers that are currently in use via CLI.

 

How its displayed in the CLI (Bash) is how it should be put into the Client SSL Profile (I'm assuming that's where you want to disable them)

 

Alternatively the Client SSL profile also gives you options to do things the easy way like "Disable all SSL Ciphers" under the options section...

 

  • Alin_Olar_24603's avatar
    Alin_Olar_24603
    Icon for Nimbostratus rankNimbostratus
    Feb 13, 2017

    The Problem is i want to add ciphers , not remove them. Hence the issue with knowing the syntax.

     

  • IainThomson85_1's avatar
    IainThomson85_1
    Icon for Cumulonimbus rankCumulonimbus
    Feb 13, 2017

    What Cipher do you want to use ? Ciphers are included in the version of OpenSSL that the BigIP is running.

     

  • Alin_Olar_24603's avatar
    Alin_Olar_24603
    Icon for Nimbostratus rankNimbostratus
    Feb 13, 2017

    This is what the request looks like :

     

    SSLCipherSuite EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA'

     

    SSLProtocol -ALL +TLSv1.1 +TLSv1.2