Forum Discussion

kridsana_52318's avatar
kridsana_52318
Icon for Nimbostratus rankNimbostratus
Apr 24, 2015

F5 dual-certificate deployment to fix SHA-1 Deprecate issue

Hi   From this information SHA-1 Deprecate >> link from qualys   My customer sha-1 certificate is mark as insecure already. (He using APM and certificate expire on 2018)   If we renew certi...
BIG-IP Access Policy Manager (APM)
design
security
sha256
TMOS
nitass's avatar
nitass
Icon for Employee rankEmployee
May 03, 2015

So I need to add new certificate/key pair which use SHA256 in Key exchange mechanism into Client SSL profile.

 

And change cipher suit to ex. DEFAULT:SHA256 , something like that, Am I right?

 

you have to create another key pair which is not rsa (because current one is rsa) such as ecdsa, then get its csr signed by ca. add them to clientssl profile and adjust cipher string if needed (i.e. some cipher suite uses rsa certificate with sha1 and some uses ecdsa certificate with sha256).