Forum Discussion
Manikanta_26608
Nimbostratus
NimbostratusHTTPS calls supporting TLS V 1.2
Hello,
I have a requirement that some of the applications with VIP's in F5 loadbalancer should support TLS 1.2. I thought of creating a SSL profile with cipher list as TLS V1_2. But i am not ver...
I don't think you need to do anything in particular to enable TLS1.2. It's one of the common features of the SSL/TLS handshake to pick the highest protocol version both parties support. Recent BigIP versions allow (and prefer) TLS1.2 to be used during client-side SSL handshake, unless you have disabled it yourself, or if your software version is badly outdated (10.2.2 and older). While TLS1.2 is given preference, there's nothing that by default would prevent your clients from falling back to older TLS versions if 1.2 is not supported.
- What is your BigIP verion? This SOL lists out the SSL/TLS versions which are enabled by the default clientssl profile configurations, or by the
Cipher String setting. https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13156.htmlDEFAULT
- What is your BigIP verion? This SOL lists out the SSL/TLS versions which are enabled by the default clientssl profile configurations, or by the
Hannes_Rapp_162
Nacreous
NacreousI don't think you need to do anything in particular to enable TLS1.2. It's one of the common features of the SSL/TLS handshake to pick the highest protocol version both parties support. Recent BigIP versions allow (and prefer) TLS1.2 to be used during client-side SSL handshake, unless you have disabled it yourself, or if your software version is badly outdated (10.2.2 and older). While TLS1.2 is given preference, there's nothing that by default would prevent your clients from falling back to older TLS versions if 1.2 is not supported.
- What is your BigIP verion? This SOL lists out the SSL/TLS versions which are enabled by the default clientssl profile configurations, or by the
Cipher String setting. https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13156.htmlDEFAULT
Manikanta_26608Nimbostratus
NimbostratusThanks Hannes, It answers my question. My BigIP version is 11.5.3.So every call reaching Bigip should not support TLS 1.2. For the calls which supports TLS lower versions, lower ciphers will get picked up? How exactly this cipher selection works for each request.