Issue changing TLS version in HTTPS monitor
Hello everyone,
I am having troubles to change the cipher suite on a custom https monitor. Our client has turned off TLS v1.0 on their servers but each time I change the cipher option from DEFAULT ie. to DEFAULT:!SSLv3:!TLSv1 (worked on serverssl profile) to limit it to TLS v1.1 and TLS v1.2 no SSL session is being established for the monitor (I'm checking it with ssldump on the LTM, we use v10.2.4). Actually it just receives TCP fin and TCP resets messages. As soon as I put DEFAULT back, without disabling any other versions, I immediately start to see SSL sessions building up (and denied by server) using TLS v1.0. The only thing I can tamper with are the hashing/encryption/authentication algorithms, like ie DEFAULT:!RC4:!AES. This works as expected. But disabling the whole version stops creating ssl sessions.
Is it somehow enforced/hard-coded? And can it be changed?
Thanks.
Hi Peter ,
https monitor uses openssl library and openssl flags sslv3 and tls1.0 same . So when you use DEFAULT:!SSLv3:!TLSv1 there are no ciphers left to negotiate .
have you tried
tmsh modify ltm monitor https monitor_name cipherlist TLSv1 or someother version .
you can see openssl ciphers by using this command :
openssl -v DEFAULT or some other setting in cipherlist in monitor https