Does LTM version 13.X support TLS1.3 if yes how to check that and apply to VS client ssl profiles ?

TLS 1.3 is still not released. Draft 26 was released on March 04, 2018

You can find SSL/TLS protocol and ciphersuites supported by the F5 from here K13163: SSL ciphers supported on BIG-IP platforms (11.x - 13.x) TLS 1.3 is not listed and as Stanislas said it is currently in draft but also don't expect it to be supported until the majority of browsers have implemented it.

Can I just upgrade the openSSL package for using TLS1.3? And will TLS1.3 be processed by current BIG-IP model with NITROX III in hardware or I need the new i series model? Thanks!

TLS 1.3 has just been approved by the IETF: https://techcrunch.com/2018/03/23/the-web-will-soon-be-a-little-safer-with-the-approval-of-this-new-security-standard/ It would be great to get a timeline when F5 intends to release a software update supporting TLS 1.3. Also, both Chrome and Firefox support TLS 1.3. Chrome 65 supports TLS 1.3: https://www.chromium.org/Home/tls13 Firefox 52 supports TLS 1.3: https://groups.google.com/forum/!topic/mozilla.dev.platform/sfeqeMkyxCI

Both Chrome and Firefox support draft versions of TLS 1.3 up until now. Guess the next version of the browsers will support the final version and F5 will likely add support within the next major release.

LTM TLS 1.3 | DevCentral

15 Replies

stan_piron
Cumulonimbus
Mar 06, 2018
TLS 1.3 is still not released.

Draft 26 was released on March 04, 2018
Andy_McGrath
Cumulonimbus
Mar 06, 2018
You can find SSL/TLS protocol and ciphersuites supported by the F5 from here K13163: SSL ciphers supported on BIG-IP platforms (11.x - 13.x)

TLS 1.3 is not listed and as Stanislas said it is currently in draft but also don't expect it to be supported until the majority of browsers have implemented it.
Raphael1
Nimbostratus
Mar 06, 2018
Can I just upgrade the openSSL package for using TLS1.3? And will TLS1.3 be processed by current BIG-IP model with NITROX III in hardware or I need the new i series model?

Thanks!
marcelw_300661
Nimbostratus
Mar 26, 2018
TLS 1.3 has just been approved by the IETF: https://techcrunch.com/2018/03/23/the-web-will-soon-be-a-little-safer-with-the-approval-of-this-new-security-standard/

It would be great to get a timeline when F5 intends to release a software update supporting TLS 1.3. Also, both Chrome and Firefox support TLS 1.3.

Chrome 65 supports TLS 1.3: https://www.chromium.org/Home/tls13

Firefox 52 supports TLS 1.3: https://groups.google.com/forum/!topic/mozilla.dev.platform/sfeqeMkyxCI
- Andy_McGrath
  Cumulonimbus
  Mar 26, 2018
  Both Chrome and Firefox support draft versions of TLS 1.3 up until now. Guess the next version of the browsers will support the final version and F5 will likely add support within the next major release.
Ken_Schultz_525
Nimbostratus
Apr 10, 2018
As has already been commented above, TLS1.3 is now approved. Is there a real answer yet for a timeline for supporting it?
- Andy_McGrath
  Cumulonimbus
  Apr 10, 2018
  Short answer nope. F5 uses OpenSSL for a lot of SSL work so the answer to your question is a question, when will OpenSSL 1.1.1 be release (which will support the final TLS 1.3 standard)?
  
  That can be followed by another question of when will F5 view OpenSSL 1.1.1 as stable and add to their next major release?
  
  If you have a major project I would go ask F5 via your reseller or F5 account manager as they might be able to sort you out early access or engineering release but I would guess this would take a while to sort.
g-ram
Nimbostratus
Aug 13, 2018
With the DH & RSA ciphers marked down as weak & dinged on Qualys on PFS, a. How do we make the sites more secure & b. How do we make sure clients that connect to the sites will not be impacted on taking out the weak ciphers by only supporting a handful of ciphers that are strong by TLS1.2 ?

Are we left with much options here ?
g-ram_31429
Cirrus
Aug 13, 2018
With the DH & RSA ciphers marked down as weak & dinged on Qualys on PFS, a. How do we make the sites more secure & b. How do we make sure clients that connect to the sites will not be impacted on taking out the weak ciphers by only supporting a handful of ciphers that are strong by TLS1.2 ?

Are we left with much options here ?
Andy_McGrath
Cumulonimbus
Nov 15, 2018
Thought might be of interest to some: F5 Article TLS1-3 are you ready
Saravanan_M_K
Employee
Nov 15, 2018
TLSv1.3 (final standard, i.e. RFC8446) will be supported starting from BIG-IPv14.1.0.1 (and also in v15.0).
laksh_373750
Nimbostratus
Dec 01, 2018
@Saravanan

How does F5 BigIP handle Perfect Forward Secrecy in the client and server side profiles? TLS 1.3 support ephemeral keys and the keys can be changed midway during the SSL session. How would F5 BigIP be able to gain access to the ephemeral keys to decrypt the sessions? Any idea when we can get more details?
- Kevin_Stewart
  Employee
  Dec 03, 2018
  laksh, you seem to be implying passive decryption, which isn't possible anyway. BIG-IP handles PFS as a function of the proxy architecture, terminating the TLS session on the client side, and initiating a separate TLS session on the server side.