Forum Discussion

JAIME_QUIROGA_1's avatar
JAIME_QUIROGA_1
Icon for Nimbostratus rankNimbostratus
Oct 20, 2014
Solved

How do you select right chiper?

Hi   I need you to help me, I have a problem with a virtual Server that uses SSL, I have captured traffic and I see that the client gives a fatal error, I think that the root cause of the error is...
application delivery
deployment
LTM
performance
ssl
TMSH
  • John_Heyer_1508's avatar
    John_Heyer_1508
    Dec 09, 2014

    Cipher's aren't the problem - the capture shows you're negotiating the "DES-CBC3-SHA" cipher, which is the F5's default for SSLv3 clients. RC4-SHA and RC4-MD5 are also options for SSLv3 if the client doesn't support 3DES.

     

    Instead, the issue here is actually with your certificate. It's SHA-2 signed, and SSLv3 only knows about SHA-1 and MD5. You'll need to have the CA re-issue the certificate in SHA-1 format. Note that it won't be possible to get SHA-1 certificates starting in about 2016, so you'll need to upgrade your application to support TLS before then.