Forum Discussion

Mark_Cloutier's avatar
Mark_Cloutier
Icon for Nimbostratus rankNimbostratus
Oct 05, 2012

SSL change in version 11.2.1?

Last night I replaced a version 9.4.8 2400 with an HA pair of 3600s, ASM is licensed but not in use yet on the 3600s. I found this morning that a couple of the sites that I terminate SSL on the BIGi...
config
design
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 05, 2012
Ahh, that's because 11.2 now supports, and defaults to strict secure renegotiation in the server SSL profile. It's likely that your servers don't support secure renegotiation.

 

 

From the BIG-IP shell, run the following:

 

 

openssl s_client -connect :443

 

 

The response will either contain "Secure Renegotiation IS supported", "Secure Renegotiation IS NOT supported", or nothing. If it appears that secure renegotiation is NOT supported, you can set the Secure Renegotiation setting in the server SSL profile to Request and give that a shot.