Forum Discussion

Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Feb 07, 2017

HowTo: Getting an awesome Qualys SSL-Labs rating... (Feb 2017 Update)

Hi Folks, I've posted in August 2016 a Client SSL Profile configuration to achive a top notch Qualys SSL-Labs rating. HowTo: Getting an awesome Qualys SSL-Labs rating... https://devcentral.f5.c...
devops
LTM
security
Seth_Randall_31's avatar
Seth_Randall_31
Icon for Nimbostratus rankNimbostratus
Apr 26, 2017

We tend to disable 3DES unless we have a system that absolutely needs it. We usual work with them to upgrade if we can. The ciphers we've been using are:

!SSLv2:!EXPORT:!DHE:!3DES:RSA+AES-GCM:RSA+AES:ECDHE+AES-GCM:ECDHE+AES:!MD5:!SSLv3:!RC4

For easy of entry, you can deny all DHE and all 3DES by just using !DHE and !3DES instead of specifying each one. At least you can on 11.6.0.