Forum Discussion
SMP73
Altostratus
AltostratusMost up to date Cipher Suite for version 14.1.x to increase BitSight findings?
Trying to improve some BitSight findings on our externally hosted sites. Bitsight is kind of vague on its findings and explanations. I know there used to be a page somewhere that had up to date Cip...
These are the default 14.1.x ciphers: https://my.f5.com/manage/s/article/K54125331
And these are all the 14.1.x ciphers: https://my.f5.com/manage/s/article/K97098157
I'd probably kill all TLSv1.0 and v1.1 ciphers to start:
DEFAULT:!TLSv1:!TLSv1_1
In 14.1.x the DHE key is 1024 bit, which can get you dinged, so probably turn those off:
DEFAULT:!TLSv1:!TLSv1_1:!DHE
If this doesn't do it, probably remove RSA (key exchange) & SHA1 ciphers:
DEFAULT:!TLSv1:!TLSv1_1:!DHE:!RSA:!SHA
That wil basically bring you to a subset of ECDHE ciphers with SHA256/SHA384.
Paulius
MVP
MVPSMP73 If you know what can't exist in your ciphers it might be easier to use cipher groups rather than attempting to find the specific string to use.
SMP73Altostratus
AltostratusThanks yeah, as mentioned, I can find countless articles on the process to do this, I am just unable to find a "recommended/best practice" cipher suite like I used to be able to. It looks like there used to be a guy here that would post cipher suites that you could cut and paste that were up to current standards , but looks like this is no longer here. It looks like I now need to check some security body for best practices and do some translation on what ciphers whis equates to in the F5 naming convention and format for the cipher suites.
- Paulius
SMP73 I would start by creating a new Client SSL Profile and using the secure parent profile. After that you can run a scan using site https://www.ssllabs.com/ssltest/ or various other sites to see what might not be the setting for you. This should provide a human readable list as to what is not the optimal ciphers that you have available. Once you have that human readable list that should match up one to one in the cipher group where you can exclude the ciphers that are causing the lower security rating.
- SMP73
Ok, thats kind of where I am right now, just trying to cross reference it all and translate the terminology into F5's syntax. Further question though, when i modified the in use SSl profile to remove the "No TLSv1.3" option, and saved it, SSL labs still did not show TLS 1.3 enabled. I tried switching SSL Profiles and saving then switching back and saving, and it still does not show up on SSL Labs. Is there some trick to get modfications to SSL profiles to take?