For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

TMcGov_92811's avatar
TMcGov_92811
Icon for Nimbostratus rankNimbostratus
Dec 08, 2008

iRule to log SSL failures due to weak encryption

I have implemented the following Ciper in an SSL profile per F5 support to prevent SSLv2 or weak encryption schemes from connecting.     ALL:!NULL:!ADH:!LOW:!EXP:RC4+RSA:!SSLv2:+HIGH:+MEDIU...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Dec 08, 2008
To add to Denny's suggestion, you could set no restrictions on the client SSL profile, but then check the cipher bits and/or name in an iRule in HTTP_REQUEST. If the client's SSL spec is too low, you could send back a response or redirect. Here are a couple of related posts:

 

 

HTTPS Redirects (Click here)

 

 

Identify Client Cipher Strength (Click here)

 

 

Aaron