Forum Discussion
NimbostratusHow do you select right chiper?
Cipher's aren't the problem - the capture shows you're negotiating the "DES-CBC3-SHA" cipher, which is the F5's default for SSLv3 clients. RC4-SHA and RC4-MD5 are also options for SSLv3 if the client doesn't support 3DES.
Instead, the issue here is actually with your certificate. It's SHA-2 signed, and SSLv3 only knows about SHA-1 and MD5. You'll need to have the CA re-issue the certificate in SHA-1 format. Note that it won't be possible to get SHA-1 certificates starting in about 2016, so you'll need to upgrade your application to support TLS before then.
NimbostratusHi
I did try with your chiper but the app fault, You can view the follewing the capture of three Handshake SSL.
New TCP connection 1: 172.18.48.159(55735) <-> 172.22.156.172(443) 1 1 0.0431 (0.0431) C>S Handshake ClientHello Version 3.0 cipher suites SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_DES_CBC_SHA SSL_RSA_EXPORT_WITH_RC4_40_MD5 SSL_RSA_EXPORT_WITH_DES40_CBC_SHA compression methods NULL 1 2 0.0432 (0.0000) S>C Handshake ServerHello Version 3.0 session_id[32]= 21 bd b8 db d4 bb f0 72 57 37 16 e1 4e af de 9a 13 52 d6 5b 15 12 cb 67 f9 b8 e1 a9 1d ed 5a f2 cipherSuite SSL_RSA_WITH_3DES_EDE_CBC_SHA compressionMethod NULL 1 3 0.0432 (0.0000) S>C Handshake Certificate 1 4 0.0432 (0.0000) S>C Handshake ServerHelloDone 1 5 0.0438 (0.0005) C>S Alert level fatal value close_notify 1 0.0439 (0.0001) C>S TCP FIN 1 0.0439 (0.0000) S>C TCP FIN
