SSL Cipher error in ltm logfile "Cipher XX:Y negotiated is not configured in profile <sslprofilename>"
I recently moved an HTTPS Virtual Server from an old LTM (running 9.3.1) to a new pair of load balancers running 11.4.1. This particular Virtual Server is using both a client SSL profile and a server SSL profile, pointing at a pool with a single node. Everything seems to be working with my various browser testing. However, I'm seeing log lines in /var/log/ltm such as the following:
Nov 7 08:10:33 bigip7 err tmm4[12863]: 01260014:3: Cipher 16:2 negotiated is not configured in profile /Common/MyClientSSLProfile.
Nov 7 08:21:44 bigip7 err tmm3[12863]: 01260014:3: Cipher 16:2 negotiated is not configured in profile /Common/MyServerSSLProfile.
Both of the above SSL Profiles utilize the "DEFAULT" cipher list. So, my assumption is that some clients are hitting this Virtual Server and are presenting a cipher that the DEFAULT cipher list doesn't include.
Can anyone decode what the "Cipher 16:2" (there are others... "Cipher 4:3", "Cipher 16:3", "Cipher 4:2" etc.) notation means - is it specific to the lines you see when you issue "tmm -clientciphers 'DEFAULT'" or "tmm -serverciphers 'DEFAULT'"?
I'm not sure that anything is really wrong here, but I am concerned that we might be trashing some SSL connections (doing a tcpdump of the traffic, and correlating times when the above /var/log/ltm errors get logged, then looking up the source IP address and correlating the timestamp to the Apache logfiles shows me most of these hits are to the webserver and doing a "GET /") - clearly not all SSL transactions are throwing the /var/log/ltm errors - just some.
Thanks for any insight anyone may have.
- Joe
I don't believe that cipher message is going to map to a specific cipher and I've only ever seen it when the Proxy SSL is configured. Is that a feature you've enabled?
Enabling debug logging for SSL might help, just remember to set it back when done.
tmsh modify sys db log.ssl.level value debug
tmsh modify sys db log.ssl.level value warning
Just a guess; Proxy SSL is enabled and the backend server is using a cipher which isn't in BIG-IP's DEFAULT cipher list. Just some additional background:
http://support.f5.com/kb/en-us/solutions/public/13000/300/sol13389.html