Forum Discussion

Andrei_Popiste1's avatar
Andrei_Popiste1
Icon for Nimbostratus rankNimbostratus
Jan 17, 2011

SSL serverside cipher mismatch

In a hardware-based 10.2(+HF2) LTM installation, LTM cannot negotiate cipher with an IIS6 server (ssldump reports a TCP close sequence after client hello).     Default https monitor reports TLS...
config
design
Andrei_Popiste1's avatar
Andrei_Popiste1
Icon for Nimbostratus rankNimbostratus
Jan 19, 2011
Testing both (monitor & vs): default https monitor using DEFAULT:+SHA:+3DES:+kEDH succeeds with TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, server-side SSL handshake of VS fails (SERVERSSL_HANDSHAKE event never reached, ssldump shows only client (f5) hellos followed by real server's TCP FIN.

 

 

In server SSL profile used for vs I tried several combinations: DEFAULT:+EDH, COMPAT, ALL - with ALL, only

 

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

 

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

 

TLS_DHE_RSA_WITH_DES_CBC_SHA

 

TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA

 

TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA

 

are sent from f5 to server. I tried also the default serverssl-insecure-compatible.

 

 

I wonder if default monitor is implemented using openssl libraries.