Forum Discussion
Alin_Olar_24603
Nimbostratus
NimbostratusExact syntax for SSL ciphers
Hi,
Trying to help a coworker with an SSL Client profile request with custom ciphers. So far I have been able to see the ciphers supported on F5 but not the exact syntax when you configure them.
I checked the TMSH manual and did some searching on KB but all i find are strengths of ciphers and so on - nothing on the way the ciphers have to be written (i.e : TLS1.2 is TLSv_1.2)
Apologies in advance if I missed something obvious.
IainThomson85_1Cumulonimbus
The best thing to do - is view the ciphers that are currently in use via CLI.
How its displayed in the CLI (Bash) is how it should be put into the Client SSL Profile (I'm assuming that's where you want to disable them)
Alternatively the Client SSL profile also gives you options to do things the easy way like "Disable all SSL Ciphers" under the options section...
Alin_Olar_24603This is what the request looks like :
SSLCipherSuite EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA'
SSLProtocol -ALL +TLSv1.1 +TLSv1.2
- IainThomson85_1
What Cipher do you want to use ? Ciphers are included in the version of OpenSSL that the BigIP is running.
- Alin_Olar_24603
The Problem is i want to add ciphers , not remove them. Hence the issue with knowing the syntax.