Forum Discussion

Samir_Jha_52506's avatar
Samir_Jha_52506
Icon for Noctilucent rankNoctilucent
Oct 21, 2016

Remove cipher from SSL profile.

Hi Experts, Can you please help to remove below cipher from SSL profile. V11.4

 

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

 

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

 

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

 

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

 

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

 

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

 

Currently I am using this cipher "DEFAULT:!ADH:!EXPORT40:!EXP:!LOW:!MEDIUM:!SSLv3:!DHE:!ECDHE-RSA-AES256-GCM-SHA384:!ECDHE-RSA-AES256-SHA384".

 

Please help me on this.

 

application delivery
BIG-IP
LTM
security

1 Reply

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Oct 21, 2016

    Try something like this in the cipher: 

    !ECDH+AESGCM:!ECDH+AES256
    for the relevant ciphers that you don't want to use.

    However, I would recommend the other way around, given the length of the ciphers that you are trying to avoid, why don't you identify the ciphers that you want to use and just allow them.

    See SOL13171 for cipher strings.