Forum Discussion

W__Tout_99150's avatar
W__Tout_99150
Icon for Nimbostratus rankNimbostratus
Mar 07, 2013

SSL handshake failure

Hello,   we're seeing a weird behaviour during SSL handshake where the client (on an Android mobile device) sends the ClientHello to the LB but the LB does not send back the ServerHello. We see th...
app sec
BIG-IP Access Policy Manager (APM)
security
nitass's avatar
nitass
Icon for Employee rankEmployee
Mar 09, 2013
can you try to disable tls1 (i.e. using ciphers: !SSLv2:ALL:!DH:!ADH:!EDH:@SPEED:!TLSv1)? 

[root@B3600-R67-S41:Active] config  b version|grep -iA 1 version
BIG-IP Version 10.2.1 511.0
Hotfix HF3 Edition

[root@B3600-R67-S41:Active] config  tmm --clientciphers '!SSLv2:ALL:!DH:!ADH:!EDH:@SPEED:!TLSv1'
     ID SUITE                          BITS  PROT  METHOD CIPHER MAC    KEYX
 0:   4 RC4-MD5                         128  SSL3  Native RC4    MD5    RSA
 1:   5 RC4-SHA                         128  SSL3  Native RC4    SHA    RSA
 2:  47 AES128-SHA                      128  SSL3  Native AES    SHA    RSA
 3:  47 AES128-SHA                      128  DTLS1  Native AES    SHA    RSA
 4:  53 AES256-SHA                      256  SSL3  Native AES    SHA    RSA
 5:  53 AES256-SHA                      256  DTLS1  Native AES    SHA    RSA
 6:  10 DES-CBC3-SHA                    192  SSL3  Native DES    SHA    RSA
 7:  10 DES-CBC3-SHA                    192  DTLS1  Native DES    SHA    RSA
 8:   9 DES-CBC-SHA                      64  SSL3  Native DES    SHA    RSA
 9:   9 DES-CBC-SHA                      64  DTLS1  Native DES    SHA    RSA
10:  96 EXP1024-RC4-MD5                  56  SSL3  Native RC4    MD5    RSA
11: 100 EXP1024-RC4-SHA                  56  SSL3  Native RC4    SHA    RSA
12:  98 EXP1024-DES-CBC-SHA              56  SSL3  Native DES    SHA    RSA
13:  98 EXP1024-DES-CBC-SHA              56  DTLS1  Native DES    SHA    RSA
14:   3 EXP-RC4-MD5                      40  SSL3  Native RC4    MD5    RSA
15:   8 EXP-DES-CBC-SHA                  40  SSL3  Native DES    SHA    RSA
16:   8 EXP-DES-CBC-SHA                  40  DTLS1  Native DES    SHA    RSA
17:  97 EXP1024-RC2-CBC-MD5              56  SSL3  Compat RC2    MD5    RSA
18:  97 EXP1024-RC2-CBC-MD5              56  DTLS1  Compat RC2    MD5    RSA
19:   6 EXP-RC2-CBC-MD5                  40  SSL3  Compat RC2    MD5    RSA
20:   6 EXP-RC2-CBC-MD5                  40  DTLS1  Compat RC2    MD5    RSA