Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

luke_xu_56087's avatar
luke_xu_56087
Icon for Nimbostratus rankNimbostratus
Dec 07, 2012

How to force client ssl profile to use tls 1.0 only?

We are running version 11.1, is there a way to force client ssl profile to use tls 1.0 only?  
config
design
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Dec 07, 2012
So technically speaking, there are three problems with the above string:

1. 11.2 introduces TLSv1_1

2. Disabling TLSv1_2 does not disable other protocols, so a browser could still use TLSv1_1 and SSLv3

3. Unless you have specific requirements for COMPAT ciphers, the COMPAT stack relies on the OpenSSL library and is therefore slower than the NATIVE stack. The DEFAULT string includes NATIVE, so you only need DEFAULT and the list of protocols that you don't want.

For example: 


DEFAULT:!TLSv1_2:!TLSv1_1:!SSLv3

Here's some important references:

http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171.html

http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13163.html

http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13156.html

http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13187.html