Forum Discussion
NimbostratusPOODLE Again - Can't apply Perfect Forward Secrecy (PFS) after applying !SSLv3:RC4-SHA
Hi,
I had "ECDHE:NATIVE:!MD5:!EXPORT:!DES:!DHE:!EDH:!RC4:!SSLv3", in my cipher string and my rating was A+.
With the New POODLE Vulnerability threat and receiving the error from SSL Lab This server is vulnerable to the POODLE attack against TLS servers. Patching required. Grade set to F , I've ADDED "!SSLv3:RC4-SHA" in the cipher string and I am still getting F.
I removed the previous string and now have "!SSLv3:RC4-SHA" only, and now my grade is B in SSL Lab. One of the reason "The server does not support Forward Secrecy with the reference browsers". I've added "ECDHE" to the string without any luck.
Can you please let me know the Cipher string that I need to use to enable PFS + No POODLE Vulnerability? or what cipher string should i use alongside "!SSLv3:RC4-SHA" to achieve this?
6 Replies
Seth_CooperEmployee
Hi Virtualrana,
You really should open a support case to get any security questions answered. Support can validate the correct settings and work with the security group within F5 to make sure you have the optimal setup.
Regards,
Seth
TortiCirrus
If Im right, you cannot get an A+ without an update. For PFS you need ECDHE. for no poodle, you need an update or rc4. if you choose rc4, you cannot get PFS, because there is no cipher with ECDHE and RC4.
Jan-Fredrik_KleTry this one: ECDHE+AES:ECDHE+3DES:RSA+3DES:!SSLv2:!SSLv3:!MD5:!EXPORT:!RC4
Best regards
Virtualrana_132Thanks Jan-Fredrik, for your suggestion. Tried that but didn't help. I need to use "!SSLv3:RC4-SHA" to prevent the new vulnerability.
- Virtualrana_132Thanks Torti for the clarification, this is really helpful. I've logged a case with F5 and waiting for them to get back to me. Hopefully they will be able to tell me the right combination or suggest something without the upgrade. And if I definitely need to upgrade, I will do that. Thanks again.
- MegaZone
SIRT
The only ciphers on BIG-IP that are NOT subject to TLS POODLE are RC4 and, post 11.5.0, AES-GCM. All other ciphers are CBC and therefore vulnerable unless you upgrade to a patched version. You can't use any other cipher without getting the 'F' grade, so upgrading to a patched version is the right move.
