Forum Discussion

justin_westove1's avatar
justin_westove1
Icon for Nimbostratus rankNimbostratus
Mar 03, 2016

Leave TLSv1 enabled but prioritize TLS1.2 or TLS1.1 over v1

We've disabled SSL all together on our F5 but we still allow TLSv1, TLSv1.1 and 1.2. We notice that most of our clients are hitting us on TLSv1 even though we support 1.2. Our clients have stated tha...
application delivery
BIG-IP
clientssl
LTM
security
ssl
Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous

Append +TLSv1 to your clientssl Cipher configuration. This will move all TLSv1.0 cipher suite combinations to the end of the list (least preferred).

I.e: 

DEFAULT:+TLSv1

justin_westove1's avatar
justin_westove1
Icon for Nimbostratus rankNimbostratus
Mar 04, 2016
Awesome thanks! Is this documented somewhere? I looked and couldn't find an article on this.