For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Aviv's avatar
Aviv
Icon for Cirrus rankCirrus
Jul 12, 2015

SSL Ciphers

Hi!   i have big-ip 11.5.1   according to ssllabs.com test i need to config only this ciphers on ssl profile :   TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112 TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 1...
application delivery
ASM Advanced WAF
LTM
security
TMSH
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jul 15, 2015

Because of the recent Logjam vulnerabilities targeting Diffie-Helman

https://weakdh.org/

A recommended course of action is to simply prefer ECDHE (instead of DHE). So a good cipher string would be something like this:

!SSLv2:!EXPORT:ECDHE+AES-GCM:ECDHE+AES:ECDHE+3DES:RSA+AES-GCM:RSA+AES:RSA+3DES:-MD5:-SSLv3:-RC4