Forum Discussion

chinay2k_15322's avatar
chinay2k_15322
Icon for Nimbostratus rankNimbostratus
Mar 06, 2015

Impact of disabling Secure Renegotiation

Currently my customer would like to disable Secure Renegotiation in client SSL profile since they found the report from sslab indicated there was a risk of DoS attack in secure renegotiation. May I ...
application delivery
design
LTM
security
Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
Mar 09, 2015

Sure you can disable the SSL secure renegotiation, but there are some downsides in doing that.

 

Article explaining the difference: (if you have some time to read)

 

https://devcentral.f5.com/articles/ssl-profiles-part-6-ssl-renegotiation

 

Alternative solution with an iRule:

 

https://devcentral.f5.com/articles/ssl-renegotiation-dos-attack-ndash-an-irule-countermeasure

 

What ever solution you prefer, always best to test in a staging environment before implementing in production. If there's no staging environment available, try implementing the changes outside peak hours.