Forum Discussion
CirrostratusQuestion about forcing TLS 1.2 and SOL13171
I found article SOL13171 that says to just use "TLSv1_2" in the Ciphers field, and this will force TLS 1.2. That sounds simple enough, but without also including "NATIVE" in the field, how can the encrypted connection even be established because nothing has been included to allow the other cipher suite protocols needed such as the bulk encryption algorithm, the key exchange, or any of that. I'm confused.
My goal is to force TLS 1.2 for Exchange 2010 clients.
6 Replies
Brad_ParkerCirrus
What cipher string are you using now? There's a couple ways to accomplish this. You can change your cipher string or enable the
options in the Options List item in you client ssl profile. If your current cipher string idNo SSL, No TLSv1, and No TLSv1.1
a simple change to'DEFAULT'
would do the trick.'DEFAULT:!TLSv1:!TLSv1_1'
Ken_B_50116Currently the profile is just default.
How is
functionally different thanTLSv1_2
? The SOL article says to use justDEFAULT:!TLSv1:!TLSv1_1
, but you suggestion makes more sense because it's starting with the default suites and then stripping out the bad TLS versions.TLSv1_2- Brad_ParkerJust TLSv1_2 on its own will also contain ADH, MD5, and RC4 ciphers which are all considered insecure at this point. The default string will not contain those. RC4 was remove from DEFAULT in 11.6 and ADH and MD5 removed in earlier versions.
- Brad_Parkerhttps://support.f5.com/kb/en-us/solutions/public/13000/100/sol13156.html
- Ken_B_50116
Here is a variant on my original question: I'm running 11.4.1 HF7. If I wanted to offer TLS 1.2 but not require it, then based on sol13156, most of the cipher suites include TLS 1.2 and a lower version. So at that point the version of TLS used depends on what the client tells the server it can support, and the LTM should use the most secure version?
- Brad_ParkerThat is correct. The client sends its supported ciphers in the client Hello and the server, in this case the BigIP, will choose the cipher that matches highest in its list.
