Forum Discussion
NimbostratusIssue on disabling TLS 1.0 / TLS 1.1
Hello,
We have a problem with an LTM (Local Trafic Manager) when we turn off TLS 1.0 and 1.1. Indeed when protocols are disabled in SSL profiles, the F5 does not return any error to the client. We would like to disable these protocols and returning a html code to our clients when he goes on the website.
We have prepared an irule that looks like this:
when HTTP_REQUEST {
if {[SSL :: cipher version]! = "TLSv1.2"}
{HTTP :: respond 503 content {
my html
}
}
This irule works if we don’t disable both protocols directly in the SSL profile. On the other hand, when this is the case, the F5 does not even read the irule. I think it is the trigger condition of the irule that is wrong, when the handshake fail, there is no HTTP request.
We are looking for a solution to setup an irule that would return a html code or that makes a redirection to another url in case of SSL handshake failure.
Someone can help me ?
Lee_SutcliffeNacreous
The problem you have is that SSL negotiation happens prior to HTTP_REQUEST. So if you have disabled TLS 1.0 and the client only uses TLS 1.0, the session will never be established, it will be terminated before you reach the HTTP request event... hence being unable to send an HTTP::response command.
It is by design that you do not receive an error in this instance. You would see in the SSL handshake that the version is not supported but this is not obvious to your users unless they are capturing the request using Wireshark for example.
What is your actual requirement?
If you use SSL, browser expect to finish ssl handshake 1st. You will not be able to receive html code if ssl handshake fails. You need to get ssl handshake established and only then you can send and receive html.
This is just TCP/IP stack rules. If lower level protocols fails, upper level will not work. What you can do, you can wait until ssl handshake established and then terminate it if ssl version is lower then tls 1.2. You can implement it via iRule
Mike_62127this iRule works well for what you are asking.
if { [SSL::cipher version] ne "TLSv1.2" } { HTTP::respond 200 content "Your browser must support TLSv1.2"- Mike_62127
I should have added that you need to keep TLSv 1.0 & 1.1 enabled in the SSL Profile. this will terminate any non TLSv 1.2 connections at the LTM and send the custom error message to the client.
But be aware that this solution requires tls1.0 and tls1.1 to be enabled and may impact your rank on ssllabs. You need to decide which option to use.
See Lee Sutcliffe's replies earlier