Forum Discussion

Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Feb 07, 2017

HowTo: Getting an awesome Qualys SSL-Labs rating... (Feb 2017 Update)

Hi Folks, I've posted in August 2016 a Client SSL Profile configuration to achive a top notch Qualys SSL-Labs rating. HowTo: Getting an awesome Qualys SSL-Labs rating... https://devcentral.f5.c...
devops
LTM
security
melcaniac's avatar
melcaniac
Icon for Cirrus rankCirrus
Jun 06, 2017

If you are using version 10, you can still get an A- grade without disabling 3DES (so that IE8/XP browsers can still connect). This option is better than DEFAULT:!RC4:!SSLv3 because it prefers to use the 256 bit encryption and drops lower if the client doesn't support it.

 

Chipher-List (for v10):

 

!SSLv3:RSA+AES256-SHA256:RSA+AES256-SHA:RSA+AES128-SHA256:RSA+AES128-SHA:RSA+AES128-SHA:RSA+3DES